Abnormality detection device

Abstract

An abnormality detection device (10) has an analysis method classification unit (131a) and a determination unit (132d). The analysis method classification unit (131a) classifies a network into one of a plurality of analysis methods for abnormality detection on the basis of summary data for packet capture data acquired from the network. In addition, the determination unit (132d) determines a resource set required to perform network abnormality detection by the analysis method classified by the analysis method classification unit (131a).

Description

Anomaly detection device

[0001] The present invention relates to an abnormality detection device.

[0002] Conventionally, systems that detect security-related anomalies based on traffic flowing through a network are known. For example, a technology for monitoring server operation is known that uses various logs and visualizes the operation status based on the contents of the logs (see, for example, Non-Patent Documents 1 and 2).

[0003] ZABBIX, [online], [Retrieved July 16, 2024], Internet (https: / / www.zabbix.com / ) Splunk, [online], [Retrieved July 16, 2024], Internet (https: / / www.splunk.com / )

[0004] However, the conventional technology has a problem in that it is difficult to introduce a system for detecting anomalies into a network.

[0005] For example, when introducing a system that detects security-related anomalies based on the traffic flowing through the network into a specific network, it is effective to estimate the amount of traffic flowing through the network in advance and check whether the system has sufficient resources.

[0006] However, estimates are often made using assumed values ​​for parameters such as the number of terminals, traffic volume per terminal, communication destinations, etc. With these existing estimation methods, when actually implemented, there are often excess or deficiencies in processing capacity, making it difficult to select appropriate resources.

[0007] Additionally, there are flow analysis and packet analysis methods for detecting anomalies, but the appropriate analysis method varies depending on the number of ports being used and whether or not encrypted communication is being used, so this information is also required before starting operation.

[0008] The present invention has been made in view of the above, and has an object to easily introduce a system for detecting anomalies into a network.

[0009] In order to solve the above-mentioned problems and achieve the objectives, the anomaly detection device of the present invention is characterized by having an analysis method classification unit that classifies the network into one of a plurality of analysis methods for anomaly detection based on packet capture data obtained from the network, and a determination unit that determines the resource set required to perform anomaly detection on the network using the analysis method classified by the analysis method classification unit.

[0010] According to the present invention, it becomes possible to easily introduce a system for detecting anomalies into a network.

[0011] Fig. 1 is a diagram illustrating an example of the configuration of an anomaly detection device according to a first embodiment. Fig. 2 is a flowchart illustrating a processing flow when the anomaly detection device according to the first embodiment is initially applied. Fig. 3 is a flowchart illustrating a processing flow when the anomaly detection device according to the first embodiment is initially applied. Fig. 4 is a flowchart illustrating a processing flow when the anomaly detection device according to the first embodiment is in operation. Fig. 5 is a diagram illustrating an example of a computer that executes an anomaly detection program.

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0013] [First embodiment] [Configuration of an anomaly detection device] Fig. 1 is a diagram showing an example of the configuration of an anomaly detection device according to Embodiment 1. As shown in Fig. 1, an anomaly detection device 10 has a data input unit 11, a display unit 12, a control unit 13, and a recording unit 14.

[0014] The anomaly detection device 10 may be a general-purpose computer such as a server or a PC. The anomaly detection device 10 is connected to an input device 20 and an output device 30. The input device 20 is a keyboard, a mouse, etc. The output device 30 is a display, etc.

[0015] The data input unit 11 is an interface that accepts data input from the input device 20. The display unit 12 is an interface that outputs data (e.g., image data) to the output device 30. The anomaly detection device 10 may also have a communication interface that exchanges data by communication via a network.

[0016] The control unit 13 controls the entire anomaly detection device 10. The control unit 13 is, for example, an electronic circuit such as a central processing unit (CPU), a micro processing unit (MPU), or a graphics processing unit (GPU), or an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0017] The control unit 13 also has an internal memory for storing programs that define various processing procedures and control data, and executes each process using the internal memory. The control unit 13 also functions as various processing units when various programs are run. For example, the control unit 13 functions as a classification unit 131, an operation monitoring unit 132, and an abnormality detection unit 133.

[0018] The recording unit 14 is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), an optical disk, etc. Note that the recording unit 14 may also be a data-rewritable semiconductor memory such as a random access memory (RAM), a flash memory, or a non-volatile static random access memory (NVSRAM). The recording unit 14 stores the operating system (OS) and various programs executed by the anomaly detection device 10.

[0019] The recording unit 14 stores the classification result 141 , the resource set 142 , the determination result 143 , the plan data 144 , and the plan result 145 .

[0020] Below, we will explain the details of each part of the anomaly detection device 10, and the processing flow divided into initial application and operation. A system including the anomaly detection device 10 is called an anomaly detection system. When the anomaly detection system is introduced, initial application processing is performed. After initial application processing is performed, the anomaly detection system (anomaly detection unit 133) performs operation processing in response to the occurrence of a predetermined trigger (such as the passage of a certain period of time or the input of a certain amount of packet capture data).

[0021] 2 is a flowchart showing the flow of processing during initial application of the anomaly detection device according to the first embodiment. First, the anomaly detection device 10 receives input of packet capture data as traffic of a network in which the anomaly detection system is to be introduced.

[0022] First, the data processing unit 131b uses the packet capture data to compile communication content into summary data (step S101). Next, the analysis method classification unit 131a classifies the communication content into analysis methods suitable for the anomaly detection system (step S102). The analysis method classification unit 131a stores the classification results 141 in the recording unit 14. This processing allows the anomaly detection device 10 to grasp the scale and nature of the network.

[0023] Here, traffic analysis methods for anomaly detection are classified into flow analysis and packet analysis. Flow analysis is a method of analyzing flow data that aggregates packet capture data using, for example, 5-tuple. Packet analysis is a method of analyzing the data of individual packets contained in packet capture data.

[0024] The analysis method classification unit 131a classifies packet capture data into one of the following categories: suitable for flow analysis, suitable for packet analysis, suitable for both flow analysis and packet analysis, and suitable for neither.

[0025] Summary data is information about packets included in packet capture data. The summary data may include the capture date and time, the number of terminals to which the packets are connected, the number of port numbers, whether the packets are encrypted, the communication volume, and the communication rate (packets per second (pps) or bytes per second (bps)). The summary data may also include flow data. The summary data may also include information about the combination of communication by MAC address, IP address, and port number of the source or destination of the packets.

[0026] For example, conditions suitable for flow analysis include that the port number of the communication destination of the packets included in the packet capture data is equal to or less than a certain number, and that the packets included in the packet capture data are being communicated in encrypted form.

[0027] Furthermore, for example, conditions suitable for packet analysis include that the communication volume (number of bytes per packet) of packets included in the packet capture data is uniform (for example, the variance is below a threshold), the communication rate (number of packets per unit time) is below a certain number, and no encrypted communication is being performed.

[0028] If the packet capture data satisfies the conditions for being suitable for flow analysis (step S102; suitable for flow analysis), the analysis method classification unit 131a classifies the network from which the packet capture data was obtained as a network to which flow analysis can be applied and presents the information (step S103).

[0029] If the packet capture data satisfies the conditions for being suitable for packet analysis (step S102; suitable for packet analysis), the analysis method classification unit 131a classifies the network from which the packet capture data was obtained as a network to which packet analysis can be applied and presents the information (step S104).

[0030] If the packet capture data satisfies both the conditions for being suitable for flow analysis and the conditions for being suitable for packet analysis (step S102; suitable for both flow analysis and packet analysis), the analysis method classification unit 131a classifies the network from which the packet capture data was obtained as a network to which both flow analysis and packet analysis can be applied and presents the information (step S105).

[0031] If the packet capture data does not satisfy either the conditions for being suitable for flow analysis or the conditions for being suitable for packet analysis (step S102; neither is suitable), the analysis method classification unit 131a classifies the network from which the packet capture data was obtained as an inapplicable network and presents the information (step S106).

[0032] The information is presented, for example, by the display unit 12 causing the output device 30 to display a screen of the classification results.

[0033] In this way, the analysis method classification unit 131a classifies a network into one of a plurality of analysis methods for anomaly detection based on information (summary data) indicating the communication content of packet capture data acquired from the network.

[0034] After executing step S103, S104, or S105, the abnormality detection device 10 transitions to the pre-operation phase. After executing step S106, the abnormality detection device 10 ends the process.

[0035] 3 is a flowchart showing the flow of processing at the time of initial application of the anomaly detection device according to the first embodiment. FIG. 3 shows the processing content of the pre-operation.

[0036] As shown in FIG. 3, first, the resource set acquisition unit 132a calculates the number of generated features per unit time from the summary data of the packet capture data, from the perspective of the processing of the anomaly detection system (step S201).

[0037] The number of generated features is the number of features generated based on packet capture data according to specific rules. For example, the number of generated features increases as the number of communication combinations of MAC addresses, IP addresses, and port numbers of packet source or destination increases. For example, the number of generated features increases as the communication volume and communication rate increase. For example, the number of generated features increases as more packet captures are obtained in a unit time based on the capture date and time.

[0038] The resource set acquisition unit 132a selects an applicable resource set from the resource set 142 in the recording unit 14 based on the number of generated features (step S202). The resource set 142 includes information on resource sets such as the CPU, memory, and HDD of the anomaly detection device 10. The larger the number of generated features, the larger the resource set that the resource set acquisition unit 132a selects.

[0039] The resource set may be prepared in advance based on data of a machine that serves as the base for the anomaly detection device 10. The anomaly detection device 10 may also manually or automatically perform a process of adding a resource set as appropriate.

[0040] The operation execution unit 132c performs an operation using the packet capture data in the pre-operation environment of the selected resource set (step S203). For example, the operation is an anomaly detection process using a machine learning technique that uses features generated from the packet capture data. In addition, the operation execution unit 132c performs either flow analysis only, packet analysis only, or both flow analysis and packet analysis in the operation, according to the selection result in step S102 of FIG. 2.

[0041] At this time, the resource set application unit 132b applies the resource set selected by the resource set acquisition unit 132a to the pre-operation environment. For example, the resource set may be specified as "CPU: 4 cores, 2 GHz, memory: 8 GB, HDD: 2 TB." The resource set application unit 132b can create a virtual environment according to the selected resource set as the pre-operation environment.

[0042] The determination unit 132d determines whether or not there is a problem with the operation performed by the operation execution unit 132c (step S204). Problematic patterns include "Yes 1" and "Yes 2." The determination unit 132d stores the determination result 143 in the recording unit 14.

[0043] "Yes 1" is a pattern of resource shortage, i.e., a specific resource usage rate exceeds an upper threshold. For example, if any of the CPU usage rate, memory usage rate, and HDD usage rate exceeds 90% (for example, if the threshold is exceeded for more than half of the operation period), the determining unit 132d determines that a problem of the "Yes 1" pattern has occurred.

[0044] "Yes 2" is a pattern of resource overload, i.e., the usage rate of a specific resource falls below the lower limit threshold. For example, if any of the CPU usage rate, memory usage rate, and HDD usage rate falls below 10% (for example, if they have never exceeded the threshold), the determining unit 132d determines that a problem of the "Yes 2" pattern has occurred.

[0045] If the determination result is "Yes 1" (Step S204; Yes 1), the resource set acquisition unit 132a selects a resource set that adds at least some of the resources from the selected resource set of CPU, memory, and HDD (Step S205). For example, if the resource set selected in Step S202 is "CPU: 4 cores, 2 GHz, memory: 8 GB, HDD: 2 TB," the resource set acquisition unit 132a selects in Step S205 a resource set that adds the resources from the selected resource set, "CPU: 8 cores, 2 GHz, memory: 16 GB, HDD: 3 TB."

[0046] If the determination result is "Yes 2" (Step S204; Yes 2), the resource set acquisition unit 132a selects a resource set obtained by reducing at least some of the resources from the selected resource set of CPU, memory, and HDD (Step S206). For example, if the resource set selected in Step S202 is "CPU: 4 cores, 2 GHz, memory: 8 GB, HDD: 2 TB," the resource set acquisition unit 132a selects in Step S206 a resource set obtained by reducing the selected resource set, "CPU: 2 cores, 2 GHz, memory: 4 GB, HDD: 1 TB."

[0047] After executing step S205 or S206, the anomaly detection device 10 returns to step S203 and repeats the process. If the determination result in step S204 is neither "Yes 1" nor "Yes 2" (step S204; No (acceptable range)), the resource set acquisition unit 132a presents the selected resource set (step S207) and terminates the process. The resource set acquisition unit 132a stores the presented resource set in the recording unit 14 as plan data 144.

[0048] In this way, the determining unit 132d determines a resource set required for detecting an anomaly in a network, based on the analysis method classified by the analysis method classifying unit 131a. The determining unit 132d also determines a resource set based on the number of feature quantities generated based on packet capture data.

[0049] The determining unit 132d further determines a resource set required for detecting an anomaly in the network, based on the result of performing anomaly detection on packet capture data in an environment based on the determined resource set.

[0050] 4 is a flowchart showing a processing flow during operation of the anomaly detection device according to the first embodiment. Here, it is assumed that the operation execution unit 132c is executing an operation in an operation environment to which the resource set presented in step S207 of FIG. 3 is applied.

[0051] 4, first, the measurement unit 132e measures resource data during operation (step S301). The measurement unit 132e stores the measured resource log as the plan result 145 in the recording unit 14. For example, the resource log includes CPU usage, memory usage, and HDD usage for each date and time.

[0052] The measurement unit 132e compares the currently measured resource log with a previously measured resource log (e.g., a resource log from the same time one week ago), calculates the degree of increase or decrease, and further calculates the degree of adaptability to the plan data (step S302).

[0053] If, as a result of the comparison, the judgment unit 132d determines that the currently measured resources need to be increased (step S303; increase), it presents multiple information on the timing of resource increase and the amount of resource increase (increased resource set) (when and how much to increase), and also presents the degree of suitability for the resource plan (step S304).

[0054] If, as a result of the comparison, the judgment unit 132d determines that the currently measured resources need to be reduced (step S303; reduction), it presents multiple information on the timing of resource reduction and the amount of resource reduction (reduced resource set) (when and how much can be reduced), and also presents the degree of suitability for the resource plan (step S305).

[0055] The determining unit 132d may determine whether the resources need to be increased or decreased by the same determination as in step S204 of FIG.

[0056] For example, the determining unit 132d calculates a value by dividing the utilization rate of one of the currently measured resource logs by the same utilization rate of the previously measured resource log. For example, if the CPU utilization rate of the currently measured resource log is 90% and the CPU utilization rate of the previously measured resource log is 60%, the determining unit 132d calculates the value as 90% / 60%=1.5.

[0057] If the calculated value is 1.0 or greater, the determining unit 132d determines that resources need to be increased to prevent a resource shortage. If the calculated value is less than 1.0, the determining unit 132d determines that resources need to be decreased to prevent a resource excess.

[0058] In this way, the measurement unit 132 e measures a resource log when anomaly detection is performed on packet capture data based on traffic generated from a network in an environment based on the resource set determined by the determination unit 132 d. Furthermore, the determination unit 132 d determines, based on the resource log, whether the resources required for anomaly detection on the packet capture data are increasing or decreasing.

[0059] As described above, the analysis method classification unit 131a classifies a network into one of a plurality of analysis methods for anomaly detection based on packet capture data acquired from the network. Furthermore, the determination unit 132d determines a resource set required for performing anomaly detection on the network, based on the analysis method classified by the analysis method classification unit 131a.

[0060] This makes it possible to know in advance whether the effects of introducing an anomaly detection system into a network that is planned for introduction can be expected. As a result, according to this embodiment, it is possible to easily introduce a system for anomaly detection into a network.

[0061] The determining unit 132d determines the resource set based on the number of features generated from the packet capture data, which makes it possible to support the introduction of an anomaly detection system that uses a machine learning technique in particular.

[0062] The determining unit 132d further determines a resource set necessary for detecting an anomaly in the network based on the result of performing an anomaly detection on the packet capture data in the environment based on the determined resource set, thereby enabling the necessary resource set to be determined with even greater accuracy.

[0063] The measuring unit 132e measures a resource log when anomaly detection is performed on packet capture data based on traffic generated from a network in an environment based on the resource set determined by the determining unit 132d. Based on the resource log, the determining unit 132d determines whether the resources required for anomaly detection on the packet capture data are increasing or decreasing.

[0064] This means that even during operation, if there are changes in the frequency or method of use of the network being monitored, the resources of the operating system can be monitored using indicators specific to the anomaly detection system, making it possible to reflect this in future resource planning.

[0065] [Program] In one embodiment, the anomaly detection device 10 can be implemented by installing an anomaly detection program that executes the above-described processing as package software or online software on a desired computer. For example, by having an information processing device execute the above-described anomaly detection program, the information processing device can function as the anomaly detection device 10. The information processing device referred to here includes desktop and notebook personal computers. Other examples of information processing devices include smartphones, tablet terminals, and the like.

[0066] 5 is a diagram showing an example of a computer that executes an anomaly detection program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0067] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0068] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the program that defines each process of the anomaly detection device 10 is implemented as a program module 1093 in which computer-executable code is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, the program module 1093 for executing processes similar to those of the functional configuration of the anomaly detection device 10 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced with an SSD.

[0069] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0070] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0071] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0072] 10 Anomaly detection device 11 Data input unit 12 Display unit 13 Control unit 14 Recording unit 20 Input device 30 Output device 131 Classification unit 131a Analysis method classification unit 131b Data processing unit 132 Operation monitoring unit 132a Resource set acquisition unit 132b Resource set application unit 132c Operation execution unit 132d Determination unit 132e Measurement unit 133 Anomaly detection unit 141 Classification result 142 Resource set 143 Determination result 144 Plan data 145 Plan result

Claims

1. An anomaly detection device comprising: an analysis method classification unit that classifies a network into one of a plurality of analysis methods for anomaly detection based on packet capture data obtained from the network; and a determination unit that determines a resource set required to perform anomaly detection on the network using the analysis method classified by the analysis method classification unit.

2. The anomaly detection device according to claim 1, characterized in that the determination unit determines the resource set based on the number of features generated based on the packet capture data.

3. The anomaly detection device described in claim 1, characterized in that the determination unit further determines the resource set required to perform anomaly detection on the network based on the results of performing anomaly detection on the packet capture data in an environment based on the determined resource set.

4. The anomaly detection device described in claim 1 further comprises a measurement unit that measures a resource log when anomaly detection is performed on packet capture data based on traffic generated from the network in an environment based on the resource set determined by the determination unit, and the determination unit determines, based on the resource log, whether the resources required for anomaly detection on the packet capture data are on an increasing or decreasing trend.

Images