Abnormality detection device

Abstract

An abnormality detection device (10) comprises: a system call collection unit (11) that collects system calls issued by monitoring targets; a profile creation unit (12) that creates, for each type of system call of each monitoring target, a profile of the average and variance of the issuance time intervals between the collected system calls, and stores the profile in a profile database (15); a profile control unit (14) that acquires, from the profile database (15), a profile to be applied to collected system calls; and an abnormality detection unit (13) that extracts issuance time intervals from the collected system calls as actual values, and performs abnormality detection using the actual values within a single time window and the acquired profile.

Description

Anomaly detection device

[0001] The present invention relates to an anomaly detection device that detects an anomaly in a computer system.

[0002] In recent years, information and communication technology has played an important role in various businesses, and many companies operate a wide variety of computer systems. At the same time, cyber attacks against computer systems, such as targeted attacks, have been increasing. In order to minimize the risk of cyber attacks, it is necessary to give computer systems only the minimum functions and permissions they require, i.e., not to grant unnecessary functions or permissions, and to quickly detect abnormalities that occur in computer systems and lead to prompt response.

[0003] Here, as an example, consider minimizing the risk of cyber-attacks on a computer system equipped with the Linux OS ("Linux" is a registered trademark). Seccomp (secure computing mode) (see Non-Patent Document 1) is a technology that restricts the functions and permissions of the Linux OS, and is one of the functions of the Linux kernel. This seccomp technology sets a whitelist of system calls called a seccomp profile for each process, and if a system call that is not included in this profile is called, it kills (terminates) the process or records the system call in a log.

[0004] “seccomp - System Calls Manual,” Mar. 26, 2024, [online], [Retrieved August 15, 2020], Internet <URL: https: / / manned.org / seccomp.2>

[0005] However, the technology described in Non-Patent Document 1 restricts system calls that can be issued by classifying them in a binary whitelist format. Therefore, it is not possible to perform security control that takes into account characteristics such as the frequency of system calls. For example, even if a system call is included in a seccomp profile, if it is issued at an abnormal frequency or outside of normal working hours when system calls are invoked, it cannot be determined to be abnormal.

[0006] The present invention has been made in view of the above points, and an object of the present invention is to realize more accurate anomaly detection by taking into consideration feature quantities such as the frequency of issuing system calls.

[0007] an anomaly detection device according to the present invention is an anomaly detection device that detects anomalies using system calls, and is characterized by comprising: a system call collection unit that collects system calls issued by monitoring targets including processes and applications; a profile creation unit that calculates the average and variance of the issuance time intervals of the collected system calls for each type of system call of the monitoring targets, creates a profile indicating features of the issuance frequency of the system calls using the calculated pair of average and variance, and stores the profile in a profile database; a profile control unit that acquires from the profile database a profile to be applied to the type of system call of each monitoring target collected by the system call collection unit in the anomaly detection execution phase; and an anomaly detection unit that extracts the issuance time intervals as realized values ​​from the system calls collected in the anomaly detection execution phase, separates a string of the extracted realized values ​​into time windows, and performs predetermined processing on the realized values ​​of the issuance time intervals using the realized values ​​of the issuance time intervals within one of the time windows and the profile acquired from the profile database, and executes anomaly detection of the collected system calls as a single anomaly detection.

[0008] According to the present invention, by taking into consideration feature quantities such as the frequency of issuing system calls, more accurate anomaly detection can be achieved.

[0009] 1 is a diagram illustrating the overall configuration of an anomaly detection system including an anomaly detection device according to an embodiment of the present invention. FIG. 1 is a diagram illustrating the issuance time interval of a system call. FIG. 2 is a diagram illustrating the calculation of the mean and variance using the issuance time interval of a system call. FIG. 3 is a diagram illustrating the creation of a profile aggregating a plurality of system calls. FIG. 4 is a flowchart illustrating the flow of processing in the profile creation phase executed by the anomaly detection device according to an embodiment of the present invention. FIG. 5 is a diagram illustrating the time window of the issuance time interval. FIG. 6 is a diagram illustrating the sum of a plurality of issuance time intervals of a system call. FIG. 7 is a flowchart illustrating the flow of processing in the profile application phase executed by the anomaly detection device according to an embodiment of the present invention. FIG. 1 is a diagram illustrating the overall configuration of an anomaly detection system including an anomaly detection device according to a first modification of the present embodiment. FIG. 2 is a flowchart illustrating the flow of anomaly detection processing (composite anomaly detection) executed by the anomaly detection unit of the anomaly detection device according to the first modification of the present embodiment. FIG. 3 is a diagram illustrating the overall configuration of an anomaly detection system including an anomaly detection device according to a second modification of the present embodiment. FIG. 4 is a diagram illustrating an example of creating a profile by classifying profiles. FIG. 5 is a diagram illustrating an example of creating a profile by classifying profiles, excluding unstable profiles. FIG. 6 is a flowchart illustrating the flow of profile creation processing executed by the profile creation unit of the anomaly detection device according to the second modification of the present embodiment. FIG. 7 is a diagram illustrating the overall configuration of an anomaly detection system including an anomaly detection device according to a third modification of the present embodiment. FIG. 8 is a hardware configuration diagram illustrating an example of a computer that realizes the functions of the anomaly detection device according to an embodiment of the present invention.

[0010] Next, an embodiment of the present invention (hereinafter referred to as "the present embodiment") will be described.

[0011] The anomaly detection device 10 (see FIG. 1 ) according to this embodiment creates a system call profile for each process or application, and performs anomaly detection and security control based on the profile. Specifically, the anomaly detection device 10 focuses on the time intervals between system calls (mean and variance) as feature quantities such as the frequency of system calls, and performs profiling and anomaly detection.

[0012] The processing performed by the anomaly detection device 10 in this embodiment consists of a "profile creation phase" and a "profile application phase" (anomaly detection execution phase). The "profile creation phase" is a phase in which a profile is created by collecting system calls issued by the monitoring target (processes or applications) for a predetermined period of time. The "profile application phase" is a phase in which the created profile is applied to the monitoring target to perform anomaly detection and security control. Note that the profile creation phase assumes that no attacks have been made against the computer system 20 ( FIG. 1 ) being monitored. Furthermore, when the characteristics of the system calls change due to an application update or specification change, the system returns to the profile creation phase and updates the profile.

[0013] 1 is a diagram showing the overall configuration of an anomaly detection system 100 including an anomaly detection device 10 according to this embodiment. As shown in Fig. 1, the anomaly detection system 100 includes a computer system 20 on which processes and applications to be monitored are executed, and the anomaly detection device 10 that is communicatively connected to the computer system 20.

[0014] The computer system 20 is a system configured with one or more computers (not shown). This computer is, for example, a Linux computer running the Linux OS. However, it may also be a computer running an OS other than Linux, as long as it issues system calls or similar functions. The computer may also be a physical server, or a virtual server (virtual machine, container) on which processes and applications are executed. In the following description of this embodiment, the computer that configures the computer system 20 will be described as being configured with a single Linux computer.

[0015] <<Anomaly Detection Device>> Next, the anomaly detection device 10 will be described. As shown in Fig. 1, the anomaly detection device 10 includes a system call collection unit 11, a profile creation unit 12, an anomaly detection unit 13, a profile control unit 14, and a profile database 15. In the above-mentioned "profile creation phase," the system call collection unit 11 and the profile creation unit 12 mainly create a profile from the collected system calls. In addition, in the "profile application phase," the system call collection unit 11, the anomaly detection unit 13, and the profile control unit 14 apply the created profile to the acquired system calls to perform anomaly detection and security control.

[0016] Of the functions provided by the anomaly detection device 10, the system call collection unit 11 may be provided within each computer of the computer system 20, and the collected system calls may be transmitted to the anomaly detection device 10. Alternatively, the system call collection unit 11 may be provided as a device in a single housing, and may collect system calls from each computer of the computer system 20 and transmit them to the anomaly detection device 10. Furthermore, each functional unit of the anomaly detection device 10 may be provided as a function within each computer of the computer system 20. Each function of the anomaly detection device 10 will be described in detail below.

[0017] The system call collection unit 11 collects system calls issued from the computer system 20. The system call collection unit 11 monitors identification information of issued system calls (e.g., system call name and system call number), issuance time, arguments, return values, and identification information related to the issuing process or user (e.g., process name (process ID), parent process name (parent process ID), child process name (child process ID), user name (user ID), group name (group ID)), and collects (stores) the information in chronological order as a system call log.

[0018] The OS of the computer (Linux computer) in the computer system 20 is equipped with a kernel that performs the basic functions of the OS, and the kernel allows the execution of applications and manages processes based on system calls from the applications, etc. The computer in the computer system 20 according to this embodiment is equipped with a function (agent) that extracts system calls issued by applications, etc., using the computer kernel, etc., and sends them to the anomaly detection device 10. This function can be realized using, for example, eBPF (extended Berkeley Packet Filter).

[0019] The system call collection unit 11 outputs the collected system call information (system call log) to the profile creation unit 12 in the "profile creation phase" and to the abnormality detection unit 13 in the "profile application phase."

[0020] The method by which the system call collection unit 11 outputs collected system call information (system call log) to other functional units (the profile creation unit 12 and the anomaly detection unit 13) can be arbitrarily set by an administrator of the anomaly detection system 100, in accordance with security requirements, performance requirements, etc. For example, possible methods include a method of sequentially outputting each system call immediately after collection, a method of buffering system calls for a predetermined period of time before outputting, a method of buffering system calls for a predetermined number of times before outputting, or a method of buffering system calls for a predetermined period of time for each piece of identification information related to a process or user before outputting.

[0021] Furthermore, since there are usually more than 300 types of system calls, attempting to monitor and collect all of them may place a heavy load on the system. Therefore, the system call collection unit 11 may monitor only some of the system calls related to security monitoring and anomaly detection. However, in an environment or situation where load does not need to be considered, all system calls may be collected.

[0022] The anomaly detection device 10 according to this embodiment focuses on the time interval between system calls as a feature quantity of the system call issuance frequency, etc. (Details will be described later.) For this reason, the system call collection unit 11 is required to extract the identification information and issuance time of each system call from the collected system call information (system call log).

[0023] In the profile creation phase, the profile creation unit 12 uses the system call log obtained from the system call collection unit 11 to create a system call profile (hereinafter sometimes simply referred to as a "profile") of the process or application to be monitored.

[0024] Here, the set of system calls (identified by system call name or system call number) to be collected is defined as "R". Then, for the issuance interval of system call r∈R, the i-th (i is a natural number equal to or greater than 1) is counted from an arbitrary point in time and defined as "X r,i For example, as shown in FIG. 2, １ (Syscall １ ) (black x mark), the first and second issued system call r １ The issuing time interval between r1,1 ", and the second and third issued system calls １ The issuing time interval between r1,2 ". The same applies below. Also, the system call r ２ (Syscall ２ ) (white × mark), the first and second issued system call r ２ The issuing time interval between r2,1 ", and the second and third issued system calls ２ The issuing time interval between r2,2 " The same applies below.

[0025] And, {X r,i}={X r,1 , X r,2 , X r,3 , ・・・, X r,n}, the average μ r ・Dispersion σ r2 The random sample is considered to have a population with a probability distribution of G. Note that a general distribution is assumed as the population distribution G. In other words, it does not have to be a normal distribution or the like.

[0026] As shown in FIG. 3, the profile creation unit 12 creates a pair of mean and variance (μ r ,σ r 2 ) is calculated in advance. For example, １ (Syscall １ ) then (μ r1 ,σ r1 2 ) (see symbol a in Figure 3), and executes the system call r ２ (Syscall ２ ), then (μ r2 ,σ r2 2 ) is calculated (see symbol b in FIG. 3). At this time, the average μ r For example, {X r,n}, and the variance σ r 2 For example, {X r,n}, we use the sample variance and unbiased variance.

[0027] In this embodiment, this mean and variance pair (μ r ,σ r 2 ) is called a profile, and anomalies are detected by statistical inference based on this profile. r ,σ r 2 ) is added with identification information of the monitored object (process or application) and the system call, and is stored in the profile database 15 (FIG. 1).

[0028] As another example, the profile creation unit 12 may aggregate profiles for any number of system calls. For example, as shown in FIG. １ ,r ２ ∈R, these are treated as the same system call r １' and the system call r １ and r ２ from the set R and instead use the system call r １ ' is added to the set R. Then, the profile creation unit 12 adds the system call r １ ' profile (μ r1’ ,σ r1’ 2 ) is calculated (symbol c in FIG. 4). When the profile creating unit 12 aggregates the profiles in this way, the size of the profile set is reduced, which makes it possible to reduce calculation costs.

[0029] Returning to FIG. 1 , the profile database 15 stores the system call profile of each process or application to be monitored, linked to the process or application identification information and the system call identification information. While the profile created by the profile creation unit 12 is the main profile stored, profiles created separately by an administrator of the anomaly detection system 100 or the like may also be stored. In addition to the profiles, the profile database 15 also stores various hyperparameters (e.g., time window size l, number of slides in the time window d, threshold θ) to be described later. α , threshold θ ｚ ) is stored.

[0030] <Processing in the "Profile Creation Phase"> Next, the flow of processing in the profile creation phase will be described. Fig. 5 is a flowchart showing the flow of processing in the profile creation phase executed by the anomaly detection device 10 according to this embodiment.

[0031] First, the system call collection unit 11 of the anomaly detection device 10 collects system call information (system call log) from the computer system 20 (step S101).

[0032] Next, the profile creation unit 12 of the anomaly detection device 10 acquires the system call logs from the system call collection unit 11 and extracts only the system call logs related to the monitoring target (process or application) (step S102).

[0033] The profile creating unit 12 repeats the processes of steps S104 to S106 for each system call rεR (step S103).

[0034] In step S104, the profile creation unit 12 extracts a system call log of one system call r from the set R of system calls. In step S105, the profile creation unit 12 calculates the issuance time interval {X r,i} average μ r and variance σ r 2 At this time, the average μ r For example, {X r,n}, and the variance σ r 2 For example, {X r,n}, we use the sample variance and unbiased variance.

[0035] In step S106, the profile creation unit 12 calculates the calculated mean and variance pair (μ r ,σ r 2 ) is stored in the profile database 15 as a profile of the system call r∈R related to the monitoring target. r ,σ r 2 ) is added with identification information of the monitoring target and the system call, and is stored in the profile database 15.

[0036] The profile creating unit 12 then repeats the processes of steps S104 to S106 for the system call r to be monitored for which a profile has not yet been created (step S107).

[0037] In addition, the profile (μ r ,σ r 2To calculate σ(σ) more accurately, i.e., to obtain a value close to the parameter of distribution G, it is desirable to set the number of samples n as large as possible. Because the accuracy of the profile is a trade-off between the time and computational cost required for collecting and recording system calls, the implementer can arbitrarily determine the value of the number of samples n and the period for collecting system calls. Alternatively, the profile creation phase described above may be executed multiple times to check the stability of the profile, i.e., whether the mean and variance are similar each time, and select a profile that is more stable (i.e., whose values ​​are less likely to fluctuate each time). For example, if the profile of a certain system call is unstable, i.e., if the mean and variance values ​​tend to fluctuate, that system call may be removed from set R.

[0038] Returning to FIG. 1, the following mainly describes the anomaly detection unit 13 and the profile control unit 14 that execute the "profile application phase" (anomaly detection execution stage).

[0039] In the profile application phase, the anomaly detection unit 13 performs anomaly detection based on the system call profile of the monitored object (process or application) input from the profile control unit 14 described below and the system call log input from the system call collection unit 11.

[0040] Specifically, the anomaly detection unit 13 first obtains a profile to be applied to a process or application to be monitored from the profile control unit 14. Then, the anomaly detection unit 13 extracts an issuance time interval as an actual value (described in detail below) from the system call collected by the system call collection unit 11 in the "profile application phase" (anomaly detection execution stage). The anomaly detection unit 13 separates the extracted realized values ​​into time windows, and performs predetermined processing on the actual values ​​of the issuance time interval using the realized values ​​of the issuance time interval within one time window and the profile acquired from the profile database 15. If behavior deviating from the profile is detected, the anomaly detection unit 13 determines that an anomaly has occurred ("single anomaly detection" described below). When an anomaly is detected, the anomaly detection unit 13 notifies the profile control unit 14, an administrator of the anomaly detection system 100, or the like of the anomaly detection. Examples of items that the anomaly detection unit 13 notifies the profile control unit 14 or the like when an anomaly occurs include the system call's identification information, issuance time, arguments, return values, and identification information related to the issuer.

[0041] The anomaly detection method executed by the anomaly detection unit 13 will be described in detail below. In the profile application phase, the time interval between occurrences of actually issued (observed) system calls is calculated by the random variable X r,i The realization value x r,i The abnormality detection unit 13 can be regarded as the realized value x r,i is extracted from the system call log and managed by a "time window" of size l. Specifically, the sequence of realizations {x r,i} is divided into time windows, and anomaly detection is performed based on the l realized values ​​within the time windows. After that, the time window is slid by d (the number of slides) and anomaly detection is performed in the same way. This process is repeated thereafter.

[0042] 6 shows the case where a time window of size l (referred to as "Window" in FIG. 6) is slid by one realization at a time (when d = 1). The size l of this time window and the number d by which the time window is slid are set arbitrarily by an administrator or the like of the anomaly detection system 100.

[0043] The value of the number of slides d does not need to be a fixed constant, but may be indefinite. In other words, anomaly detection may be performed irregularly. Also, the value x that stores the time window r,i The values ​​do not have to be continuously observed. That is, an administrator or the like may arbitrarily select a method for selecting values. For example, l values ​​may be randomly selected from a large number of values ​​observed in the past. This concept of time window is introduced for each system call. In this embodiment, the time window of a system call r∈R is defined as "W ｒ " should be written as ".

[0044] Next, the anomaly detection unit 13 calculates the realization value x of the issuance time interval. r,i First, for a system call r∈R, l issuance time intervals {X r,i} and the sample mean are defined as follows:

[0045]

[0046] FIG. 7 shows the system call １ (Syscall １ ) (black x marks) for l=5 issue intervals {X r,i} and the system call r ２ (Syscall ２ ) (white × mark) for l = 2 issue time intervals {X r,i}.

[0047] Then, to make it easier to handle statistically, the sample means are standardized using the following variable transformation:

[0048]

[0049] In the case of the standard normal distribution, a standard normal distribution table or the like can be used, and standardization makes statistical inference easier. Based on the above theory, the anomaly detection unit 13 performs anomaly detection as follows.

[0050]

[0051] Here, from the standard normal distribution table, zr,l Absolute value of |z r,l When | is the 100α% point on both sides, α can be considered as the normal probability. Then, we use the fact that "the 100α% point on both sides is the same value as the upper (lower) 50α% point." In the standard normal distribution table, |z r,l | is given, the obtained probability is doubled to α, and this value is a certain threshold θ α (e.g., 10 -12 ) is judged to be abnormal. For example, r,l When | = 1.01, the normal probability is α = 0.156 × 2 = 0.312. r,l When | = 0, the normal probability is α = 0.5 × 2 = 1.0.

[0052] There is no need to calculate the normal probability α, r,l A threshold value may be set for |z r,l | Threshold θ z is θ α can be uniquely determined using the standard normal distribution table. For example, using the standard normal distribution table, θ α If = 0.1, |z r,l | value is θ z When the threshold value θ exceeds 1.28, it is judged to be abnormal. α (or threshold θ z ) can be arbitrarily determined by an administrator or the like of the anomaly detection system 100. Note that the anomaly detection performed by the anomaly detection unit 13 for one time window as described above is referred to as "single anomaly detection."

[0053] 1 , the profile control unit 14 obtains a profile to be applied to a monitoring target (process or application) from the profile database 15 and selects one based on a predetermined policy. If there are multiple profiles applicable to the monitoring target among the profiles obtained from the profile database 15, the profile control unit 14 executes a predetermined policy, such as applying the latest profile, or, if multiple profiles are applicable, applying the profile with the fewest number of system calls to be monitored. Such a predetermined policy is set in advance by an administrator or the like of the anomaly detection system 100.

[0054] When the profile control unit 14 selects a profile of a process or application to be monitored, it outputs the profile to the abnormality detection unit 13. At this time, the profile control unit 14 notifies the abnormality detection unit 13 of, for example, the identification information of the process or application, as well as a list of profiles to be applied to each system call.

[0055] When the profile control unit 14 receives a notification from the anomaly detection unit 13 that an anomaly has occurred as a result of the anomaly detection process, the profile control unit 14 executes security control on the computer system 20 in accordance with a predetermined response policy set in advance by an administrator of the anomaly detection system 100, for example. For example, the profile control unit 14 may forcibly kill (terminate) the process that issued the unauthorized system call, or forcibly log out the user who issued the unauthorized system call. Alternatively, the profile control unit 14 may simply record a log of the unauthorized system call, i.e., not interfere with the issuer of the system call. Information required for such response, such as the identification information of the issuing process or user, is acquired in advance by the system call collection unit 11.

[0056] <Processing in the "Profile Application Phase"> Next, the flow of processing in the profile application phase will be described. Fig. 8 is a flowchart showing the flow of processing in the profile application phase executed by the anomaly detection device 10 according to this embodiment.

[0057] First, the profile control unit 14 of the anomaly detection device 10 obtains a profile to be applied to a monitoring target (process or application) from the profile database 15 (step S110). If there are multiple profiles that can be applied to the monitoring target, the profile control unit 14 selects a profile appropriate for the monitoring target based on a predetermined policy.

[0058] Next, the anomaly detection unit 13 of the anomaly detection device 10 acquires information on the system calls (system call log) collected in the profile application phase from the system call collection unit 11 (step S111), and calculates the realization value {x r,i} as the time window W ｒ Manage it with.

[0059] Then, the anomaly detection unit 13 performs the following steps S112 to S119 for one system call r∈R. ｒ While updating the value, the processes of steps S113 to S118 are repeated (step S112).

[0060] First, the anomaly detection unit 13 calculates the realization value {x r,i} into the time window W ｒ Then, the anomaly detection unit 13 acquires l values ​​from the realized value {x r,i} (step S114). Next, the anomaly detection unit 13 calculates the sample mean from the sample mean and the profile (μ r ,σ r 2 ) to z r,l is calculated (step S115).

[0061] Then, the abnormality detection unit 13 calculates the absolute value |z r,l and calculates the normal probability α from the standard normal distribution table (step S116). r,l | and threshold θ ｚ If an abnormality is detected, step S116 can be omitted.

[0062] Next, the abnormality detection unit 13 sets a threshold value θｚ or threshold θ α Specifically, the abnormality detection unit 13 performs an abnormality detection determination using the absolute value |z r,l | is the threshold θ ｚ or whether the normal probability α is greater than the threshold θ α It is then determined whether the value is smaller than (step S117).

[0063] And the absolute value |z r,l | is the threshold θ ｚ If the normal probability α is not greater than the threshold θ α If the absolute value |z r,l | is the threshold θ ｚ or if the normal probability α is greater than the threshold θ α If the difference is smaller than the threshold (Yes in step S117), it is determined to be abnormal and notifies the profile control unit 14 etc. (step S118). Then, the profile control unit 14 executes security control on the computer system 20 in accordance with a predetermined response policy.

[0064] Next, the abnormality detection unit 13 determines the time window W ｒ While updating (for example, sliding it against the sequence of realized values), the processes of steps S113 to S118 are repeated at predetermined time intervals (periodically) or irregularly (step S119). The processes of steps S112 to S119 are executed for one system call r∈R. These processes are executed for all system calls r included in the set R. In this case, parallel processing may be used to improve efficiency. In addition, the size l of the time window, the number d by which the window is slid, and the threshold θ ｚ , θ α These hyperparameters do not need to be uniform and can be set individually for each system call. Note that if the time window size l is set to a uniform value, the rarer the system call, the longer it takes for the time window to be filled, and therefore the longer the anomaly detection cycle. In such cases, it may be desirable to set the time window size l to a small value, for example.

[0065] In this way, the anomaly detection device 10 according to this embodiment can create a system call profile for each monitoring target (process or application) and perform anomaly detection and security control based on the system call profile.

[0066] [Modification 1] Next, a description will be given of a modification of the anomaly detection device 10 according to the present embodiment. Fig. 9 is a diagram showing the overall configuration of an anomaly detection system 100 including an anomaly detection device 10A according to Modification 1 of the present embodiment.

[0067] The anomaly detection device 10A according to variant example 1 of this embodiment, like the anomaly detection device 10 (Figure 1) according to this embodiment, creates a system call profile for each monitored object (process or application) and performs anomaly detection and security control based on the system call profile.

[0068] The anomaly detection device 10 according to this embodiment performs a normal / abnormal determination within a single time window, which makes it susceptible to the influence of outliers, i.e., results in a high false positive rate. Therefore, the anomaly detection device 10A according to a first modification of this embodiment performs anomaly detection based on multiple time windows, making it less susceptible to the influence of outliers.

[0069] 9, the configuration of an anomaly detection device 10A according to Modification 1 of this embodiment differs from the anomaly detection device 10 shown in FIG. 1 only in the function of the anomaly detection unit 13A. Therefore, the function of the anomaly detection unit 13A will be described below. The other functional units are the same as those of the anomaly detection device 10 according to this embodiment, and therefore will not be described again.

[0070] The anomaly detection unit 13A detects m time windows W ｒ m normal probabilities from {α ｊ}={α １ , α ２ , α ３ , …, α ｍ} is obtained. At this time, the anomaly detection unit 13A performs anomaly detection by comprehensively considering the results of m single anomaly detections.

[0071] For example, these normal probabilities {α ｊ The threshold is determined based on the average value (average normal probability) and the product (simultaneous normal probability) of these values. That is, if these values ​​are smaller than the threshold η, it is determined to be abnormal.

[0072]

[0073] Here, the threshold value η can be arbitrarily determined by an administrator or the like of the anomaly detection system 100. The administrator or the like may also arbitrarily select the m time windows, but it is preferable to perform anomaly detection for the most recent time window. Hereinafter, this type of anomaly detection will be referred to as "composite anomaly detection."

[0074] When applying this composite anomaly detection method, the anomaly detection unit 13A needs to refer to a standard normal distribution table to calculate the normal probability α when detecting a single anomaly. However, by using the method described below, the anomaly detection unit 13A can calculate the normal probability α by |z r,l Only threshold determination for | is required.

[0075] The anomaly detection unit 13A records whether a single anomaly is determined to be normal (0) or abnormal (1) in m single anomaly detections.

[0076]

[0077] In this case, {b ｊ}, the rate of abnormality (1) is θ α (i.e., the proportion of normal (0) is 1-θ α (becomes normal) is considered to be a normal state. On the other hand, if this ratio is extremely large or extremely small, it can be determined to be an abnormality. Therefore, composite abnormality detection can be performed by setting a threshold value η for the number and ratio of abnormal (1) or normal (0). This threshold value η is determined arbitrarily by the administrator of the anomaly detection system 100, etc. Note that the threshold value θ ｚ is the threshold θ α can be uniquely determined using the standard normal distribution table. For example, θ α When = 0.05, θ ｚ = 1.96. Also, θα When = 0.05, if the system is normal, m b ｊ It is natural that 5% of these will be abnormal (1).

[0078] Therefore, the abnormality detection unit 13A detects, for example, {b ｊ The number of anomalies (1) in the α ) and the actually observed {b ｊ}, the probability p obtained from the sum k ｋ If it is below the threshold value η, it is determined to be abnormal.

[0079]

[0080] The method of aggregating the results of single anomaly detection and the method of anomaly detection executed by the anomaly detection unit 13A are not limited to the methods described above, and can be set arbitrarily by the administrator of the anomaly detection system 100, etc.

[0081] <Abnormality detection process by abnormality detection unit 13A> Next, a description will be given of the process by the abnormality detection unit 13A in the "profile application phase" of the abnormality detection device 10A according to Modification 1 of the present embodiment. Fig. 10 is a flowchart showing the flow of the abnormality detection process (composite abnormality detection) executed by the abnormality detection unit 13A of the abnormality detection device 10A.

[0082] The anomaly detection device 10A repeats the following processing of steps S202 to S207 for one system call rεR at predetermined time intervals (regularly) or irregularly (step S201).

[0083] First, the anomaly detection unit 13A uses the single anomaly detection method executed by the anomaly detection unit 13 (FIG. 1) according to this embodiment to calculate the time window W ｒ While updating the value of the single anomaly detection unit 13A, the single anomaly detection unit 13A performs single anomaly detection m times (steps S202 to S204). At this time, the anomaly detection unit 13A does not need to notify each anomaly detected during each single anomaly detection.

[0084] Next, the anomaly detection unit 13A aggregates the results of the m single anomaly detections using the above-mentioned method (step S205). For example, the anomaly detection unit 13A calculates the average normal probability and the simultaneous normal probability, and records whether the m single anomaly detections were determined to be normal (0) or abnormal (1).

[0085] The anomaly detection unit 13A then performs a threshold determination on the aggregation result (step S206). If the result is determined to be normal (step S206 → normal), the process proceeds to step S208. On the other hand, if the result is determined to be abnormal in the threshold determination (step S206 → abnormal), the profile control unit 14 and the like are notified of this (step S207). Next, the profile control unit 14 executes security control on the computer system 20 in accordance with a predetermined response policy.

[0086] The anomaly detection unit 13A then repeats the following steps S202 to S207 at predetermined time intervals (periodically) or irregularly (step S208). Steps S201 to S208 are executed for one system call r∈R. These steps are executed for all system calls r included in the set R. At this time, parallel processing may be used to improve efficiency. Furthermore, various hyperparameters, including the aggregation method for single anomaly detection results, the threshold η, the frequency of iterative processing, etc., do not need to be uniform, and may be set individually for each system call.

[0087] In this way, the anomaly detection device 10A according to variant example 1 of this embodiment performs composite anomaly detection, making it less susceptible to the influence of outliers when determining whether something is normal or abnormal within a single time window, thereby enabling more accurate anomaly detection.

[0088] [Modification 2] Next, an anomaly detection device 10B according to a modification of the present embodiment will be described. Fig. 11 is a diagram showing the overall configuration of an anomaly detection system 100 including an anomaly detection device 10B according to Modification 2 of the present embodiment.

[0089] The anomaly detection device 10B according to variant example 2 of this embodiment, like the anomaly detection device 10 ( FIG. 1 ) according to this embodiment and the anomaly detection device 10A ( FIG. 9 ) according to variant example 1 of this embodiment, creates a system call profile for each monitored object (process or application) and performs anomaly detection and security control based on the system call profile.

[0090] The anomaly detection device 10 ( FIG. 1 ) and the anomaly detection device 10A ( FIG. 9 ) profile system calls independently, which poses a problem of not being able to consider the correlation between them. In the anomaly detection device 10B according to a second modification of this embodiment, in order to consider the correlation between system calls, the collected system calls of the monitoring target are classified into predetermined types according to the circumstances at the time of issuance of the system call, and a profile is created for each type and stored in the profile database 15B. The anomaly detection unit 13B then performs the above-described single anomaly detection or multiple anomaly detection for each type, and if an anomaly is determined for either type, it determines that an anomaly has occurred in the monitoring target. The anomaly detection device 10B will be described in detail below.

[0091] 11, an anomaly detection device 10B according to the second modification of this embodiment differs from the anomaly detection device 10 shown in Fig. 1 in the functions of a profile creation unit 12B, an anomaly detection unit 13B, and a profile database 15B. The other functional units are the same as those of the anomaly detection device 10 according to this embodiment, and therefore a description thereof will be omitted.

[0092] In order to take into account the correlation between system calls, the profile creation unit 12B creates profiles by classifying them into predetermined types depending on the circumstances at the time the system call is issued. Here, the set of types τ is called "T." The profile creation unit 12B classifies the types depending on the circumstances at the time the system call is issued, such as the internal state of the process or application to be monitored or the time period of use, and collects system call logs separately for each type to create a profile for each system call.

[0093] For example, the profile creation unit 12B classifies the usage time period of the computer system 20 into types such as weekday daytime, weekday nighttime, weekday late night, holiday daytime, holiday nighttime, and holiday late night. Other types include when a process is started, running, terminated, or terminated abnormally. Furthermore, types are also classified according to the amount of computing resources used by the process, such as CPU usage and memory usage.

[0094] 12 shows an example of creating profiles by type. For example, in an example where profiles are categorized by usage time period, "type 0" indicates a profile of system calls during "weekday daytime," "type 1" indicates a profile of system calls during "weekday nighttime," and "type 2" indicates a profile of system calls during "weekday late night."

[0095] The profile creation unit 12B may aggregate profiles for any number of system calls, similar to the profile creation unit 12 ( FIG. 1 ) of the anomaly detection device 10 according to this embodiment. The profile creation unit 12B may also execute the profile creation process multiple times to check the stability of the profiles, that is, whether the values ​​(average, variance) are similar each time, and select a profile that is more stable (values ​​less likely to fluctuate each time).

[0096] The profile creation unit 12B does not necessarily need to create profiles for all system calls in the set R for one type. For example, consider a case where types are divided by usage time period, and weekday daytime is designated as "type 0." During weekday daytime, if the system call r ０ The profile is unstable (mean and variance values ​​tend to fluctuate during the daytime on weekdays). １ , r ２ If the profile is stable (mean and variance values ​​are unlikely to fluctuate), "type 0" will contain the system call r １ , r ２ Include the profile of the system call ０ There is no need to include a profile for

[0097] 13 shows an example in which profiles are classified into types, and if the profile is not stable for that type, the profile is not created (indicated by "-" in FIG. 13). In this way, the profile creation unit 12B adopts a profile with stable values ​​and stores it in the profile database 15B, thereby improving the accuracy of anomaly detection.

[0098] <Processing of Profile Creation Unit 12B> Here, a description will be given of the flow of processing executed by the profile creation unit 12B. Fig. 14 is a flowchart showing the flow of profile creation processing executed by the profile creation unit 12B of the anomaly detection device 10B according to Modification 2 of this embodiment.

[0099] First, the profile creation unit 12B acquires the system call log collected in the profile creation phase from the system call collection unit 11, and extracts only the system calls related to the monitoring target (process or application) (step S301).

[0100] Next, the profile creation unit 12B repeats the processes of steps S303 to S308 for each type τ∈T (step S302). In step S303, the profile creation unit 12B extracts system call logs corresponding to the type τ∈T (for example, in the case of classification by usage time period, logs collected during the time period corresponding to the type τ∈T).

[0101] Next, the profile creation unit 12B repeats the processes of steps S305 to S307 for each system call r∈R (step S304). In step S305, the profile creation unit 12B extracts a system call log of one system call r from the set R of system calls. In step S306, the profile creation unit 12B calculates the issuance time interval {X r,i} average μ r and variance σ r 2 At this time, the average μ r For example, {X r,n}, and the variance σ r 2 For example, {X r,n}, we use the sample variance and unbiased variance.

[0102] In step S307, the profile creation unit 12B calculates the calculated mean and variance pair (μ r ,σ r 2 ) is stored in the profile database 15B as a profile of the system call r∈R related to the monitoring target. At this time, the profile creating unit 12B stores the created profile (μ r ,σ r 2 ) is added with the monitoring target, the system call identification information, and the type identification information, and is stored in the profile database 15B.

[0103] Then, the profile creating unit 12B repeats the processes of steps S305 to S307 for the system call r to be monitored for which a profile has not yet been created (step S308).

[0104] Furthermore, the profile creating unit 12B repeats the processes of steps S303 to S308 for the type τ for which a profile has not yet been created (step S309).

[0105] In addition, the profile (μ r ,σ r 2 In order to calculate ∑ gamma ∑ ...

[0106] Returning to FIG. 11 , the profile database 15B stores the system call profile of each process or application to be monitored as information linked to the process or application identification information, the system call identification information, and the type identification information. While the profile created by the profile creation unit 12B is the main profile stored, profiles created separately by the administrator of the anomaly detection system 100 or the like may also be stored. In addition to the profiles, the profile database 15B also stores various hyperparameters (for example, the time window size l, the number of slides in the time window d, the threshold θ α , threshold θ ｚ ) is stored.

[0107] The abnormality detection unit 13B performs single abnormality detection according to this embodiment and multiple abnormality detection according to variant 1 of this embodiment for each type, and if any type is determined to be abnormal, that is, if there is no type that is determined to be normal, it determines that an abnormality has occurred and notifies the profile control unit 14, etc., of this fact.

[0108] In this way, the anomaly detection device 10B according to the second modification of this embodiment can perform profiling and anomaly detection while taking into consideration the correlation between system calls, thereby enabling the anomaly detection device 10B to perform even more accurate and flexible security control.

[0109] [Modification 3] Next, an anomaly detection device 10C according to a modification of the present embodiment will be described. Fig. 15 is a diagram showing the overall configuration of an anomaly detection system 100 including an anomaly detection device 10C according to Modification 3 of the present embodiment.

[0110] The anomaly detection device 10C according to variant example 3 of this embodiment, like the anomaly detection device 10 according to this embodiment ( FIG. 1 ), the anomaly detection device 10A according to variant example 1 of this embodiment ( FIG. 9 ), and the anomaly detection device 10B according to variant example 2 of this embodiment ( FIG. 11 ), creates a system call profile for each monitored object (process or application) and performs anomaly detection and security control based on the system call profile.

[0111] The anomaly detection device 10 ( FIG. 1 ), the anomaly detection device 10A ( FIG. 9 ), and the anomaly detection device 10B ( FIG. 11 ) have a problem in that profiling cannot be used if the variance is unstable (easily changes) during profiling. To solve this problem, in the anomaly detection device 10C according to Variation 3 of this embodiment, the profile creation unit 12C creates a profile using only the calculated average when the value calculated for the variance of the issuance time intervals of collected system calls is unstable over multiple calculations. Then, the anomaly detection unit 13C performs anomaly detection (single anomaly detection) using the unbiased variance (details described below) obtained from the realized values ​​and the profile created using only the average. The anomaly detection device 10C will be described in detail below.

[0112] 15, an anomaly detection device 10C according to the third modification of this embodiment differs from the anomaly detection device 10 shown in Fig. 1 in the functions of a profile creation unit 12C and an anomaly detection unit 13C. The other functional units are the same as those of the anomaly detection device 10 according to this embodiment, and therefore a description thereof will be omitted.

[0113] The profile creation unit 12C executes the profiling creation process multiple times to test the stability of the profile (whether the same values ​​(average, variance) are obtained each time) in the profile creation unit 12 of the anomaly detection device 10 according to this embodiment (FIG. 1), the profile creation unit 12 of the anomaly detection device 10A according to Modification 1 of this embodiment (FIG. 9), and the profile creation unit 12B of the anomaly detection device 10B according to Modification 2 of this embodiment (FIG. 11). r 2 If it turns out that is not stable, the average μ r Then, the profile creating unit 12C creates a profile based on the created profile (average μ r ) is stored in the profile database 15.

[0114] The anomaly detection unit 13C calculates the variance σ r 2 When is unknown, the unbiased variance u obtained from the realization is used instead. r 2The single anomaly detection according to this embodiment is performed using the above.

[0115]

[0116] Therefore, by using a t-distribution table instead of the standard normal distribution table, processing can be performed in the same way as single anomaly detection according to this embodiment. r 2 Even if the standard normal distribution table is unknown, by replacing the standard normal distribution table with a t-distribution table, the anomaly detection unit 13 of the anomaly detection device 10 according to this embodiment, the anomaly detection unit 13A of the anomaly detection device 10A according to Modification 1 of this embodiment, and the anomaly detection unit 13B of the anomaly detection device 10B according to Modification 2 of this embodiment can be implemented in a similar manner.

[0117] <Hardware Configuration> The anomaly detection devices 10, 10A, 10B, and 10C according to the present embodiment are realized by a computer 900 having a configuration such as that shown in Fig. 16. Fig. 16 is a hardware configuration diagram showing an example of the computer 900 that realizes the functions of the anomaly detection devices 10, 10A, 10B, and 10C according to the present embodiment. The computer 900 includes a CPU 901, a ROM (Read Only Memory) 902, a RAM 903, an HDD (Hard Disk Drive) 904, an input / output I / F (Interface) 905, a communication I / F 906, and a media I / F 907.

[0118] The CPU 901 operates based on a program (anomaly detection program) stored in the ROM 902 or the HDD 904, and controls each functional unit of the anomaly detection devices 10, 10A, 10B, and 10C. The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started up, programs related to the hardware of the computer 900, and the like.

[0119] The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input / output I / F 905. The CPU 901 acquires data from the input device 910 via the input / output I / F 905, and outputs generated data to the output device 911. Note that a GPU (Graphics Processing Unit) or the like may be used as a processor together with the CPU 901.

[0120] The HDD 904 stores programs executed by the CPU 901 and data used by the programs. The communication I / F 906 receives data from other devices via a communication network (e.g., NW (Network) 922) and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network.

[0121] The media I / F 907 reads a program (anomaly detection program) or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads a program related to a target process from the recording medium 912 onto the RAM 903 via the media I / F 907, and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase Change Rewritable Disc), a magneto-optical recording medium such as an MO (Magneto Optical Disc), a magnetic recording medium, a semiconductor memory, or the like.

[0122] For example, when a computer 900 functions as the anomaly detection device 10, 10A, 10B, or 10C of the present invention, a CPU 901 of the computer 900 executes a program loaded onto a RAM 903 to realize the function of the anomaly detection program. In addition, data stored in the RAM 903 is stored in an HDD 904. The CPU 901 reads and executes a program related to a target process from a recording medium 912. Alternatively, the CPU 901 may read a program related to a target process from another device via a communication network (NW 922).

[0123] <Effects> The effects of the anomaly detection device according to this embodiment will be described below. The anomaly detection device according to this embodiment is an anomaly detection device 10 ( FIG. 1 ) that detects anomalies using system calls, and includes: a system call collection unit 11 that collects system calls issued by monitoring targets including processes and applications; a profile creation unit 12 that calculates the average and variance of the issuance time intervals of the collected system calls for each type of system call of each monitoring target, creates a profile from the calculated pair of average and variance as a profile indicating feature quantities of the issuance frequency of the system call, and stores the profile in a profile database 15; a profile control unit 14 that acquires from the profile database 15 a profile to be applied to the type of system call of each monitoring target collected by the system call collection unit 11 during the anomaly detection execution phase; and an anomaly detection unit 13 that extracts issuance time intervals as realized values ​​from the system calls collected during the anomaly detection execution phase, separates the sequence of the extracted realized values ​​into time windows, and performs predetermined processing on the realized values ​​of the issuance time intervals using the realized values ​​of the issuance time intervals within one time window and the profile acquired from the profile database 15, thereby performing anomaly detection on the collected system calls as single anomaly detection.

[0124] In this way, the anomaly detection device 10 according to this embodiment can calculate the average and variance of the system call issuance time intervals as feature quantities of the system call issuance frequency, and create a profile. The anomaly detection device 10 can then achieve more accurate anomaly detection that takes into account the system call issuance frequency, etc. Furthermore, the anomaly detection process of the anomaly detection device 10 according to this embodiment requires lower computational costs than anomaly detection using machine learning, enabling faster anomaly detection and the associated security control.

[0125] Furthermore, in the anomaly detection device 10 (10A), the anomaly detection unit 13A executes the single anomaly detection process that was executed using one time window multiple times using multiple time windows, and performs composite anomaly detection, which indicates that the results of the multiple anomaly detections are used to determine anomalies in the collected system calls.

[0126] In this way, the anomaly detection device 10A performs anomaly detection based on multiple time windows, thereby reducing the influence of outliers in determining whether an anomaly is normal or abnormal when an anomaly detection is performed for a single time window, making it possible to achieve more accurate anomaly detection.

[0127] In the anomaly detection device 10 (10B), the profile creation unit 12B classifies the collected system calls of the monitoring target into predetermined types according to the circumstances at the time the system call was issued, creates a profile for each type, and stores the profile in the profile database 15B. The anomaly detection unit 13B performs single anomaly detection or multiple anomaly detection for each type, and if an anomaly is determined to exist for either type, determines that an anomaly has occurred in the monitoring target.

[0128] In this way, the anomaly detection device 10B can classify the collected system calls of the monitored objects into predetermined types according to the circumstances at the time the system calls were issued, and then perform anomaly detection for each type to determine whether an anomaly has occurred in the monitored object. This makes it possible to achieve more accurate anomaly detection by taking into account the correlation between system calls.

[0129] In the anomaly detection device 10 (10C), when creating a profile, if the calculated value of the variance of the issuance time intervals of collected system calls is not stable over multiple calculations, the profile creation unit 12C creates the profile using only the calculated average. Furthermore, the anomaly detection unit 13C performs single anomaly detection using the unbiased variance obtained from the realized values ​​and the profile created using only the average.

[0130] By doing so, when the variance is not stable when creating a profile, the anomaly detection device 10C can perform anomaly detection using only the average as the profile.

[0131] The present invention is not limited to the above-described embodiments, and many modifications can be made by a person having ordinary skill in the art within the technical concept of the present invention.

[0132] 10, 10A, 10B, 10C Anomaly detection device 11 System call collection unit 12, 12B, 12C Profile creation unit 13, 13A, 13B, 13C Anomaly detection unit 14 Profile control unit 15, 15B Profile database 20 Computer system 100 Anomaly detection system

Claims

1. An anomaly detection device that detects anomalies using system calls, comprising: a system call collection unit that collects system calls issued by monitoring targets including processes and applications; a profile creation unit that calculates the average and variance of the issuance time intervals of the collected system calls for each type of system call of the monitoring targets, creates a profile from the calculated pair of average and variance as a profile indicating feature quantities of the issuance frequency of the system call, and stores the profile in a profile database; a profile control unit that obtains from the profile database a profile to be applied to the type of system call of each monitoring target collected by the system call collection unit in the anomaly detection execution stage; and an anomaly detection unit that extracts the issuance time intervals as realized values ​​from the system calls collected in the anomaly detection execution stage, separates the extracted realized values ​​into time windows, and performs predetermined processing on the realized values ​​of the issuance time intervals using the realized values ​​of the issuance time intervals within one of the time windows and the profile obtained from the profile database, and performs anomaly detection of the collected system calls as a single anomaly detection.

2. The anomaly detection device described in claim 1, characterized in that the anomaly detection unit executes the single anomaly detection process executed using one of the time windows multiple times using multiple time windows, and executes composite anomaly detection, which indicates that the results of the multiple anomaly detections are used to determine an anomaly in the collected system calls.

3. The anomaly detection device described in claim 2, characterized in that the profile creation unit classifies the collected system calls of the monitored object into predetermined types depending on the situation at the time the system call was issued, creates a profile for each type, and stores the profile in the profile database, and the anomaly detection unit performs the single anomaly detection or the compound anomaly detection for each type, and if an anomaly is determined to be present for either type, determines that an anomaly has occurred in the monitored object.

4. The anomaly detection device described in claim 1, characterized in that when creating the profile, the profile creation unit creates the profile using only the calculated average if the value calculated for the variance of the issuance time intervals of the collected system calls is not stable over multiple calculations, and the anomaly detection unit performs the single anomaly detection using the unbiased variance obtained from the realized values ​​and the profile created using only the average.

Images