JP2018097461A - Computer system, log analysis method and log analysis device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize an efficient log analysis processing by using limited computer resources in a control system.SOLUTION: A computer system includes a device for acquiring log data on a monitoring object and a log analysis device for executing log data analysis processing. When receiving a message including a type and an importance level, the log analysis device determines a candidate parameter to identify log analysis processing and log data to be used for the log analysis processing on the basis of the type and the importance level, corrects the candidate parameter on the basis of processing load of the log analysis device so as to execute adjustment processing to determine a parameter for execution, corrects an internal parameter defining contents of processing of the log analysis processing in order to execute the log analysis processing with the parameter for execution, acquires log data on the basis of the parameter for execution and executes the log analysis processing with the acquired log data.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a log analysis method relating to devices constituting a control system.

  Control systems used in social infrastructure such as electric power, railways, water supply, and gas, and automobiles are based on information acquired from sensors, in order to satisfy preset conditions such as pressure and temperature, valves and actuators. Control the equipment.

  In order to realize the above-described control, the embedded device periodically acquires information from the sensor, checks the state of the device to be controlled, notifies the server, etc., and controls the device as necessary. For this reason, the control system generally performs processing based on a large amount of communication data.

  The control system uses a dedicated OS and a dedicated protocol, and is installed in an isolated state in an area that cannot be accessed from an external network such as the Internet. For this reason, it has been considered to be free from cyber attacks such as computer viruses and denial of service attacks.

  However, the number of control systems using a general-purpose OS and a general-purpose protocol is increasing, and a system configuration for connecting to an information system is also progressing in order to improve control efficiency. Therefore, the risk of cyber attacks is increasing. In recent years, computer viruses targeting control systems have emerged. Therefore, a technology for detecting malware and unauthorized access is also required for the control system.

  As a technique for detecting unauthorized access to an information system, a technique described in Patent Document 1 is known. Patent Document 1 states that “the unauthorized access information database 22a sequentially stores unauthorized access information. The identical person determination processing unit 24 refers to the unauthorized access information database 22a and matches the predetermined items between the unauthorized access information. The determination condition database 23b stores in advance conditions for determining unauthorized access behavior, and the unauthorized person determination processing unit 25 includes the same person determination processing unit 24 as the same person. For the plurality of unauthorized access information determined to be, it is determined whether or not it is an unauthorized access action with reference to the determination condition of the determination condition database 23b, and it is determined whether or not the same person is an unauthorized person. .

JP 2002-334061 A

  When applying the technique of Patent Document 1 to a control system, an apparatus for determining whether or not an unauthorized access action is performed with reference to a determination condition database is necessary. The apparatus is required to have high performance. Therefore, it is difficult to realize the technology described in Patent Document 1 using an apparatus such as an embedded device having limited computer resources.

  A typical example of the invention disclosed in the present application is as follows. That is, a computer system that includes a device that acquires log data to be monitored and a log analysis device that executes analysis processing of the log data, wherein the log analysis device receives a message that includes a type and an importance level Determining candidate parameters for specifying log analysis processing and log data used for the log analysis processing based on the type and importance, and correcting the candidate parameters based on the processing load of the log analysis device To execute an adjustment process for determining an execution parameter, and to execute a log analysis process using the execution parameter, modify an internal parameter that defines the processing content of the log analysis process, The log data is acquired based on the execution parameters, and the log analysis process is performed using the acquired log data. Characterized by a run.

  According to the present invention, a log analysis apparatus having limited computer resources can efficiently execute log analysis processing. Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

1 is a diagram illustrating an example of the overall configuration of a computer system according to Embodiment 1. FIG. 2 is a diagram illustrating an example of a hardware configuration and a software configuration of the log analysis apparatus according to the first embodiment. FIG. FIG. 2 is a diagram illustrating an example of a hardware configuration and a software configuration of a control device according to the first embodiment. 2 is a diagram illustrating an example of a hardware configuration and a software configuration of the network monitoring apparatus according to the first embodiment. FIG. FIG. 2 is a diagram illustrating an example of a hardware configuration and a software configuration of a security countermeasure device according to the first embodiment. 6 is a diagram illustrating a configuration example of log analysis definition information according to Embodiment 1. FIG. It is a figure explaining the structural example of the adjustment policy information of Example 1. FIG. It is a figure explaining the structural example of the schedule information of Example 1. FIG. It is a sequence diagram explaining the flow of a process in the computer system of Example 1. FIG. 6 is a flowchart illustrating processing executed when the log analysis device according to the first embodiment receives a message from a control device. FIG. 6 is a diagram illustrating an example of a screen displayed on the output device according to the first embodiment. FIG. 6 is a diagram illustrating an example of a screen displayed on the output device according to the first embodiment. 10 is a flowchart illustrating details of adjustment processing executed by the log analysis module according to the first embodiment. 6 is a flowchart illustrating processing executed by the log analysis apparatus according to the first embodiment according to schedule information. FIG. 6 is a diagram illustrating an example of the overall configuration of a computer system according to a second embodiment. 10 is a flowchart illustrating processing executed when the log analysis device according to the second embodiment receives a message from a control device. It is a flowchart explaining the process which the log analyzer of Example 2 performs according to schedule information.

  Embodiments according to the present invention will be described below with reference to the accompanying drawings. In each figure, the same reference numerals are given to common configurations.

  FIG. 1 is a diagram illustrating an example of the overall configuration of a computer system according to the first embodiment.

  The computer system includes a log analysis device 101, a control device 102, a network monitoring device 103, and a security countermeasure device 104. Each device is connected to each other via a network 105.

  The log analysis device 101 executes log analysis processing. The control device 102 controls a device to be controlled by the control system. The network monitoring apparatus 103 performs network monitoring. The security countermeasure device 104 executes security-related processing such as user authentication. In the present embodiment, the network monitoring device 103 and the security countermeasure device 104 collect log data to be monitored and manage the collected log data.

  The administrator 106 can view the log analysis result output by the log analysis apparatus 101.

  FIG. 2 is a diagram illustrating an example of a hardware configuration and a software configuration of the log analysis apparatus 101 according to the first embodiment.

  The log analysis apparatus 101 includes a processor 201, a memory 202, a storage device 203, an input / output interface 204, and a network interface 205, and each hardware is connected via a bus 206.

  The processor 201 executes a program stored in the memory 202. When the processor 201 executes processing according to a program, the processor 201 operates as a module having a predetermined function. In the following description, when a process is described using a module as a subject, it indicates that the processor 201 is executing a program that realizes the module.

  The memory 202 stores a program executed by the processor 201 and information necessary for the program. The memory 202 includes a work area that is temporarily used by the program.

  The storage device 203 stores data permanently. The storage device 203 may be a storage medium such as an HDD (Hard Disk Drive) and an SSD (Solid State Drive), or a nonvolatile memory. Note that the program and information stored in the memory 202 may be stored in the storage device 203. In this case, the processor 201 reads the program and information from the storage device 203, loads the program and information into the memory 202, and executes the program loaded into the memory 202.

  The input / output interface 204 is an interface for connecting to the input device 207 and the output device 208. Note that the input device 207 includes a keyboard, a mouse, a touch panel, and the like, and the output device 208 includes a touch panel, a display, and the like.

  The network interface 205 is an interface for connecting to other computers via a network.

  The memory 202 stores a program for realizing the log analysis module 211 as a program, and stores log analysis definition information 212, adjustment policy information 213, and schedule information 214 as information. The storage device 203 stores log data management information 215 as data.

  The log analysis module 211 includes a plurality of execution modules 221 that execute different log analysis processes. The log analysis module 211 selects an execution module to be called according to the type of log analysis processing to be executed.

  The log analysis definition information 212 stores definition information regarding a log analysis process to be executed and parameters for specifying log data used for the log analysis process based on the message type and the message level. Details of the log analysis definition information 212 will be described with reference to FIG.

  The adjustment policy information 213 stores a policy for adjusting parameters according to the processing load of the log analysis apparatus 101. Details of the adjustment policy information 213 will be described with reference to FIG.

  The schedule information 214 is information for managing an execution schedule of log analysis processing that causes a delay. In this embodiment, an execution schedule of log analysis processing that cannot be executed immediately is registered in the schedule information 214. For example, when a log analysis process with a high processing load occurs simultaneously, an execution schedule of the log analysis process is registered in the schedule information 214. Details of the schedule information 214 will be described with reference to FIG.

  The log data management information 215 stores log data used for log analysis processing. The log data management information 215 is stored in the storage device 203 because the data size is large. However, when the capacity of the memory 202 is large, the log data management information 215 may be stored in the memory 202. Note that log data is not stored in the log data management information 215 before the start of the log analysis process, but the log data acquired when the log analysis process is executed.

  Note that a program such as an OS (Operating System) for controlling the log analysis apparatus 101 is stored in the memory 202, but is omitted because it is not directly related to the present invention.

  FIG. 3 is a diagram illustrating an example of a hardware configuration and a software configuration of the control device 102 according to the first embodiment.

  The control device 102 includes a processor 301, a memory 302, a storage device 303, an input / output interface 304, and a network interface 305, and each hardware is connected via a bus 306.

  The processor 301, memory 302, storage device 303, input / output interface 304, network interface 305, and bus 306 are the same as the processor 201, memory 202, storage device 203, input / output interface 204, network interface 205, and bus 206. Therefore, the description is omitted.

  Note that a valve 307 and an actuator 308 which are devices to be controlled are connected to the input / output interface 304 of the control device 102. The valve 307 and the actuator 308 are examples of devices to be controlled, and are not limited thereto.

  The memory 302 stores a program for realizing the control module 311 as a program.

  The control module 311 controls the entire control device 102. The control module 311 controls the valve 307 and the actuator 308. Specifically, the control module 311 changes the operation of the valve 307 and the actuator 308, and monitors the state of the valve 307 and the actuator 308. When the control module 311 detects an event such as stop and restart of the valve 307 and the actuator 308, the control module 311 transmits a message corresponding to each event to the log analysis apparatus 101. The message includes information such as message type and message level. The message level is a value representing the importance.

  FIG. 4 is a diagram illustrating an example of a hardware configuration and a software configuration of the network monitoring apparatus 103 according to the first embodiment.

  The network monitoring apparatus 103 includes a processor 401, a memory 402, a storage device 403, and a network interface 405, and each hardware is connected via a bus 406. The network monitoring apparatus 103 may have an input / output interface.

  Since the processor 401, the memory 402, the storage device 403, the network interface 405, and the bus 406 are the same as the processor 201, the memory 202, the storage device 203, the network interface 205, and the bus 206, description thereof is omitted.

  The memory 402 stores a program for realizing the network management module 411 as a program. The storage device 403 stores network log data management information 412 as data.

  The network log data management information 412 is information for managing network log data that is a log related to data flowing through the network 105. The network log data includes a time stamp.

  The network management module 411 acquires network log data and stores the network log data in the network log data management information 412. Further, the network management module 411 transmits network log data stored in the network log data management information 412 to the log analysis apparatus 101 in accordance with the request received from the log analysis apparatus 101.

  FIG. 5 is a diagram illustrating an example of a hardware configuration and a software configuration of the security countermeasure device 104 according to the first embodiment.

  The security countermeasure device 104 includes a processor 501, a memory 502, a storage device 503, and a network interface 505, and each hardware is connected via a bus 506. The security countermeasure device 104 may have an input / output interface.

  Since the processor 501, the memory 502, the storage device 503, the network interface 505, and the bus 506 are the same as the processor 201, the memory 202, the storage device 203, the network interface 205, and the bus 206, description thereof is omitted.

  The memory 502 stores a program for realizing the security countermeasure module 511 as a program. The storage device 503 stores security log data management information 512 as data.

  The security log data management information 512 is information for managing security log data that is a log related to a security function. The security log data includes a time stamp.

  The security countermeasure module 511 provides a security function such as user authentication. The security countermeasure module 511 acquires security log data and stores the security log data in the security log data management information 512. Further, the security countermeasure module 511 transmits the security log data stored in the security log data management information 512 to the log analysis device 101 in accordance with the request received from the log analysis device 101.

  FIG. 6 is a diagram illustrating a configuration example of the log analysis definition information 212 according to the first embodiment.

  The log analysis definition information 212 includes a record including an ID 601, a message type 602, a message level 603, a log data type 604, a target period 605, and a module type 606. One record corresponds to one definition information.

  The ID 601 is a field for storing identification information for uniquely identifying a record of the log analysis definition information 212.

  The message type 602 is a field for storing the type of message notified from the control device 102 or the like. The message level 603 is a field for storing the message level notified from the control device 102 or the like.

  The log data type 604 is a field for storing the type of log data to be acquired. The log data type 604 stores a value indicating the type of log data and items included in the log data. The target period 605 is a field for storing the time range of the log data to be acquired. In this embodiment, the log data to be acquired is specified based on the log data type 604 and the target period 605.

  The module type 606 is a field for storing the type of the execution module 221 to be called. That is, the module type 606 represents the type of log analysis processing.

  In this embodiment, log analysis processing with different processing loads is executed according to the message level 603. That is, the granularity of the log analysis processing executed by the execution module 221 differs depending on the acquired log data. In this embodiment, it is assumed that parameters (internal parameters) that define processing contents such as variables, codes, and functions used in log analysis processing are set in advance for each processing granularity.

  Note that the record may include a field for storing an internal parameter.

  FIG. 7 is a diagram illustrating a configuration example of the adjustment policy information 213 according to the first embodiment.

  The adjustment policy information 213 includes a record including an ID 701, a priority 702, a load condition 703, and an adjustment method 704. One record corresponds to one adjustment policy.

  The ID 701 is a field for storing identification information for uniquely identifying the record of the adjustment policy information 213.

  The priority 702 is a field for storing the priority of the policy. In this embodiment, a numerical value representing the priority is set as the priority 702 in order from “1”. “1” is the highest priority. When there are a plurality of applicable adjustment policies, the log analysis module 211 selects the adjustment policy with the highest priority as the adjustment policy to be used.

  The load condition 703 is a field for storing information related to the load of the log analysis apparatus 101 that is an application condition of the adjustment policy.

  The adjustment method 704 is a field for storing information related to a specific log analysis processing adjustment method. In the adjustment method 704 for the record whose ID 701 is “1”, scheduling for delaying the execution time of the log analysis processing is set as the adjustment method. Further, an adjustment method for changing to a log analysis process with a low processing load is set in the adjustment method 704 for the record whose ID 701 is “2”. In the adjustment method 704 for the record whose ID 701 is “5”, an adjustment method for narrowing the time range of the log data to be acquired is set in order to reduce the processing load.

  FIG. 8 is a diagram illustrating a configuration example of the schedule information 214 according to the first embodiment.

  The schedule information 214 includes a record including an ID 801, a log data type 802, a target period 803, and a module type 804. One record corresponds to one log analysis process.

  The ID 801 is a field for storing identification information for uniquely identifying the record of the schedule information 214. The log data type 802, the target period 803, and the module type 804 are the same as the log data type 604, the target period 605, and the module type 606.

  Next, processing in the computer system will be described.

  FIG. 9 is a sequence diagram illustrating the flow of processing in the computer system according to the first embodiment.

  When the occurrence of an event is detected, the control device 102 transmits a message corresponding to the event to the log analysis device 101 (step S901). The message includes message content and message level including information for specifying the message type.

  The log analysis apparatus 101 determines a log analysis process and parameters to be executed by analyzing the message (step S902). In the present embodiment, the type of log data, the items included in the log data, the time range of the log data, and the like are determined as parameters.

  The log analysis apparatus 101 transmits an acquisition request to the network monitoring apparatus 103 and the security countermeasure apparatus 104 in order to acquire log data specified by the parameters (steps S903 and S904). Note that when log analysis processing information to be executed is registered in the schedule information 214, the log analysis apparatus 101 transmits an acquisition request after the execution trigger has elapsed.

  The security countermeasure device 104 and the network monitoring device 103 transmit the requested log data to the log analysis device 101 in accordance with the acquisition request (steps S905 and S906).

  After receiving the log data, the log analysis apparatus 101 executes log analysis processing (step S907). The log analyzer 101 displays the analysis result for the administrator 106 (step S908).

  When the log analysis apparatus 101 receives a reanalysis instruction from the administrator 106 (step S909), the log analysis apparatus 101 determines a log analysis process and parameters to be executed (step S910). The reanalysis instruction includes the message type and message level in the previous log analysis process.

  In this embodiment, the log analysis apparatus 101 refers to the log analysis definition information 212 and selects a log analysis process corresponding to a message level higher than the message level included in the reanalysis instruction. For example, when the message type included in the reanalysis instruction is “T1” and the message level is “Minor”, the log analysis apparatus 101 selects a record whose message type 602 is “T1” and the message level 603 is “Caution”. select.

  The log analysis apparatus 101 transmits an acquisition request to the network monitoring apparatus 103 and the security countermeasure apparatus 104 in order to acquire log data specified by the parameters (steps S911 and S912).

  The security countermeasure device 104 and the network monitoring device 103 transmit the requested log data to the log analysis device 101 in accordance with the acquisition request (steps S913 and S914).

  After receiving the log data, the log analysis device 101 executes log analysis processing (step S915). The log analyzer 101 displays the analysis result to the administrator 106 (step S916).

  FIG. 10 is a flowchart illustrating processing executed when the log analysis apparatus 101 according to the first embodiment receives a message from the control apparatus 102.

  When the log analysis module 211 receives a message from the control device 102, the log analysis module 211 starts processing described below.

  The log analysis module 211 acquires a message type and a message level from the message (step S1001).

  Specifically, the log analysis module 211 acquires the message type from the message content included in the message, and acquires the message level included in the message.

  The log analysis module 211 executes adjustment processing (step S1002). In this process, a log analysis process and parameters to be executed are determined. Details of the adjustment processing will be described with reference to FIG.

  Next, the log analysis module 211 determines whether or not the execution schedule of the log analysis processing to be executed is registered in the schedule information 214 (step S1003).

  When it is determined that the execution schedule of the log analysis process to be executed is registered in the schedule information 214, the log analysis module 211 ends the process. When the execution schedule is registered in the schedule information 214, the log analysis process is not executed at this point.

  When it is determined that the execution schedule of the log analysis process to be executed is not registered in the schedule information 214, the log analysis module 211 transmits an acquisition request for acquiring log data determined by the adjustment process to the target device. (Step S1004).

  As described later, in the adjustment process, the type of log data to be acquired, items to be included in the log data, the time range of the log data, and the like are determined. The log analysis module 211 specifies a device from which log data is acquired based on the type of log data, and transmits an acquisition request including item identification information and a time range to the specified device.

  Next, after acquiring the log data, the log analysis module 211 executes the log analysis process determined by the adjustment process (step S1005).

  Specifically, the log analysis module 211 calls the execution module 221 determined by the adjustment process, and instructs the execution of the process. Since the log analysis process is a known technique, a detailed description thereof is omitted. Further, the present embodiment is not limited to the contents of log analysis processing.

  Next, the log analysis module 211 outputs the analysis result to the administrator 106 (step S1006). Thereafter, the log analysis module 211 ends the process.

  Specifically, the log analysis module 211 generates display information for displaying the analysis result, and displays a screen on the output device 208 based on the display information.

  The log analysis module 211 executes the same processing when receiving a reanalysis instruction from the administrator 106.

  11A and 11B are diagrams illustrating an example of a screen displayed on the output device 208 according to the first embodiment. Here, a screen when log data summarization processing is executed as log analysis processing will be described.

  FIG. 11A shows a screen 1100 displayed when a message with a message level “critical” is received, and FIG. 11B shows a screen 1110 displayed when a message with a message level “minor” is received. .

  The screen 1100 includes a message content display area 1101 and a log analysis result display area 1102.

  The message content display area 1101 is an area for displaying the content of the message. The message content display area 1101 displays the date and time of message generation, message level, message content, and the like.

  The log analysis result display area 1102 is an area for displaying the result of the log analysis processing. The log analysis result display area 1102 displays parameters, analysis results, and the like.

  The screen 1110 includes a message content display area 1111, a log analysis result display area 1112, and a supplement display area 1113.

  The message content display area 1111 and the log analysis result display area 1112 are the same areas as the message content display area 1101 and the log analysis result display area 1102. However, the information displayed in the message content display area 1111 and the log analysis result display area 1112 has a coarser granularity than the information displayed in the message content display area 1101 and the log analysis result display area 1102.

  The supplement display area 1113 is an area for displaying the changed contents of the log analysis process changed by the adjustment process. The supplemental display area 1113 illustrated in FIG. 11B includes an execution button for instructing execution of a log analysis process that outputs a more detailed analysis result than the executed log analysis process. The administrator 106 inputs a reanalysis instruction to the log analysis apparatus 101 by operating the execution button.

  Since the log analysis process to be executed is different depending on the message level, the screen for displaying the result of the log analysis process is different as shown in FIGS. 11A and 11B.

  FIG. 12 is a flowchart illustrating details of the adjustment process executed by the log analysis module 211 according to the first embodiment.

  The log analysis module 211 acquires load information indicating the processing load of the log analysis apparatus 101 (step S1201).

  Next, the log analysis module 211 determines a log analysis process to be executed and candidate parameters based on the log analysis definition information 212 (step S1202).

  Specifically, the log analysis module 211 refers to the log analysis definition information 212 and searches for a record in which the message type 602 and the message level 603 match the message type and message level of the received message. The log analysis module 211 determines the log analysis processing to execute the module type 606 of the retrieved record, and determines the log data type 604 and the target period 605 of the retrieved record as candidate parameters.

  Next, the log analysis module 211 determines whether or not the log analysis process needs to be scheduled based on the load information and the adjustment policy information 213 (step S1203). Specifically, the following processing is executed.

  The log analysis module 211 refers to the load condition 703 based on the load information and searches for a corresponding record that satisfies the load condition 703.

  When there is no record satisfying the load condition 703, the log analysis module 211 determines that log analysis processing scheduling is not necessary.

  When there are a plurality of records satisfying the load condition 703, the log analysis module 211 refers to the priority 702 of the retrieved record and selects the record with the highest priority. The log analysis module 211 determines whether the adjustment method 704 for the selected record is “register in schedule information”. When the adjustment method 704 of the selected record is “schedule information”, the log analysis module 211 determines that the log analysis processing needs to be scheduled. The above is the description of step S1203.

  When it is determined that the log analysis process needs to be scheduled, the log analysis module 211 registers the execution schedule of the log analysis process in the schedule information 214 (step S1204), and ends the adjustment process.

  Specifically, the log analysis module 211 adds a record to the schedule information 214 and sets identification information in the ID 801 of the added record. Further, the log analysis module 211 adds the log data type 604, the target period 605, and the module type 606 of the record searched in step S1202 to the log data type 802, the target period 803, and the module type 804 of the added record. Set. When registering the execution schedule of the log analysis process, the candidate parameters are not changed.

  When it is determined that the log analysis processing does not need to be scheduled, the log analysis module 211 determines whether the candidate parameter needs to be changed (step S1205).

  Specifically, the log analysis module 211 refers to the adjustment method 704 for the record retrieved from the adjustment policy information 213 in step S1203, and determines whether the adjustment method 704 is an adjustment method for changing candidate parameters. To do.

  For example, when the ID 701 of the retrieved record is “2”, the log analysis module 211 determines that the candidate parameter needs to be changed.

  When it is determined that the candidate parameter needs to be changed, the log analysis module 211 changes the candidate parameter based on the selected record adjustment method 704 (step S1206), and executes the log analysis process and the execution A parameter is determined (step S1207). Thereafter, the log analysis module 211 ends the adjustment process. In this case, the changed parameter is determined as the execution parameter.

  At this time, the log analysis module 211 changes the processing content of the log analysis processing in accordance with the change of the candidate parameter. That is, the log analysis module 211 changes the internal parameters in order to execute the log analysis process using the execution parameters. As a result, log analysis processing with different granularities can be executed.

  When it is determined that it is not necessary to change the candidate parameter, the log analysis module 211 determines a log analysis process to be executed and an execution parameter (step S1207). Thereafter, the log analysis module 211 ends the adjustment process. In this case, the candidate parameter is determined as the execution parameter.

  In the present embodiment, only log data necessary for log analysis processing is acquired upon receipt of a message. As a result, the communication load of the entire computer system can be reduced, and the processing load of the log analysis apparatus 101 can be reduced.

  In addition, the log analysis module 211 determines the processing content of the log analysis processing to be executed in consideration of the processing load. This makes it possible to execute log analysis processing necessary for security countermeasures and failure countermeasures using limited computer resources.

  FIG. 13 is a flowchart for explaining processing executed by the log analysis apparatus 101 according to the first embodiment in accordance with the schedule information 214.

  The log analysis module 211 periodically executes processing described below.

  The log analysis module 211 determines whether or not an execution schedule is registered in the schedule information 214 (step S1301).

  When it is determined that the execution schedule is not registered in the schedule information 214, the log analysis module 211 ends the process.

  When it is determined that the execution schedule is registered in the schedule information 214, the log analysis module 211 acquires the load information of the log analysis apparatus 101 (step S1302), and determines whether the processing load is low (step S1302). S1303).

  For example, the log analysis module 211 determines whether the processor usage rate is smaller than a first threshold value and the memory usage rate is smaller than a second threshold value. If any of the conditions is not satisfied, the log analysis module 211 determines that the processing load is high.

  When it is determined that the processing load is high, the log analysis module 211 shifts to a waiting state, and after a predetermined time has elapsed, returns to step S1302 and executes similar processing.

  When it is determined that the processing load is low, the log analysis module 211 selects an analysis process to be executed from the schedule information 214 (step S1304).

  Specifically, the log analysis module 211 selects one record registered in the schedule information 214. In this embodiment, it is assumed that the records are selected in order from the record on the schedule information 214.

  Next, the log analysis module 211 transmits an acquisition request for acquiring log data specified by the log data type 802 and the target period 803 of the selected record to the target device (step S1305).

  Next, the log analysis module 211 acquires log data, and then executes log analysis processing corresponding to the selected record (step S1306).

  Specifically, the log analysis module 211 calls the execution module 221 corresponding to the module type 804 of the selected record, and instructs the execution of the process.

  Next, the log analysis module 211 outputs the analysis result to the administrator 106 (step S1307).

  Next, the log analysis module 211 determines whether or not a record exists in the schedule information 214 (step S1308).

  When it is determined that there is a record in the schedule information 214, the log analysis module 211 returns to step S1302 and executes the same processing.

  When it is determined that there is no record in the schedule information 214, the log analysis module 211 ends the process.

  Note that the log analysis device 101 may periodically acquire log data from the network monitoring device 103 and the security countermeasure device 104 and register the log data in the log data management information 215. In this case, in step S1003 and step S1305, the log analysis module 211 acquires log data including necessary items from the log data management information 215.

  According to the first embodiment, the log analysis apparatus 101 acquires log data when a message is received from the control apparatus 102. Since the log analysis device 101 does not always need to acquire log data, the processing load on the log analysis device 101 can be reduced and the bandwidth of the network 105 can be used effectively.

  The log analysis device 101 determines log analysis processing to be executed according to the message level, and adjusts the execution time of the log analysis processing and the processing content of the log analysis processing according to the processing load. As a result, the log analysis apparatus 101 can execute log analysis processing using limited computer resources.

  The second embodiment is different from the first embodiment in that the control apparatus 102 holds log data, and the log analysis apparatus 101 executes log analysis processing using the log data. In the second embodiment, the log analysis apparatus 101 adjusts the amount of log data to be acquired according to the processing load of the control apparatus 102. Hereinafter, the second embodiment will be described with a focus on differences from the first embodiment.

  FIG. 14 is a diagram illustrating an example of the overall configuration of the computer system according to the second embodiment.

  The computer system according to the second embodiment includes a log analysis device 101 and a control device 102. Each device is connected to each other via a network 105.

  FIG. 15 is a flowchart illustrating processing executed when the log analysis apparatus 101 according to the second embodiment receives a message from the control apparatus 102.

  The log analysis module 211 acquires load information indicating the processing load of the control apparatus 102 after the process of step S1003 (step S1501).

  Based on the acquired load information, the log analysis module 211 determines whether the processing load on the control device 102 is high (step S1502).

  For example, the log analysis module 211 determines whether the usage rate of the processor of the control device 102 is smaller than the third threshold value. When the usage rate of the processor of the control device 102 is smaller than the third threshold, the log analysis module 211 determines that the processing load of the control device 102 is small.

  When it is determined that the processing load on the control device 102 is low, the log analysis module 211 proceeds to step S1004.

  When it is determined that the processing load on the control device 102 is high, the log analysis module 211 changes the acquisition range of log data (step S1503). Thereafter, the log analysis module 211 proceeds to step S1004.

  Specifically, the log analysis module 211 changes the time range of the log data so that the data amount of the log data transmitted by the control device 102 is reduced. For example, the log analysis module 211 changes the current time range in half.

  When the processing load of the control device 102 is high, the amount of log data transmitted per unit time decreases, and the time required for log analysis processing increases. Therefore, the waiting time until the manager 106 displays the analysis result is increased. Therefore, in this embodiment, when the processing load on the control device 102 is high, the log analysis device 101 changes the acquisition range so that the data amount of the log data becomes small.

  In place of step S1503, the log analysis module 211 may repeatedly execute the processing of step S1501 and step S1502 until the processing load on the control apparatus 102 becomes low, or the log analysis processing execution schedule is included in the schedule information 214. May be registered.

  FIG. 16 is a flowchart for explaining processing executed by the log analysis apparatus 101 according to the second embodiment according to the schedule information 214.

  The log analysis module 211 acquires load information from the control apparatus 102 after the process of step S1303 (step S1601).

  Based on the acquired load information, the log analysis module 211 determines whether or not the processing load on the control device 102 is high (step S1602).

  When it is determined that the processing load on the control device 102 is high, the log analysis module 211 changes the acquisition range of log data (step S1603). Thereafter, the log analysis module 211 proceeds to step S1304.

  The processing in steps S1601, S1602, and S1603 is the same as the processing in steps S1501, S1502, and S1503.

  Note that the same processing may be executed in the first embodiment. For example, when the log analysis apparatus 101 acquires network log data from the network monitoring apparatus 103, the log analysis apparatus 101 may change the acquisition range of log data based on the load information of the network monitoring apparatus 103.

  According to the second embodiment, when the log analysis apparatus 101 acquires log data from the control apparatus 102, the log analysis apparatus 101 determines the data amount of the log data to be acquired or the acquisition timing of the log data in consideration of the processing load of the control apparatus 102. adjust. Thereby, the waiting time until the log analysis processing is completed can be shortened.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. Further, for example, the above-described embodiments are described in detail for easy understanding of the present invention, and are not necessarily limited to those provided with all the described configurations. Further, a part of the configuration of each embodiment can be added to, deleted from, or replaced with another configuration.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. The present invention can also be realized by software program codes that implement the functions of the embodiments. In this case, a storage medium in which the program code is recorded is provided to the computer, and a CPU included in the computer reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the program code itself and the storage medium storing it constitute the present invention. As a storage medium for supplying such a program code, for example, a flexible disk, a CD-ROM, a DVD-ROM, a hard disk, an SSD (Solid State Drive), an optical disk, a magneto-optical disk, a CD-R, a magnetic tape, A non-volatile memory card, ROM, or the like is used.

  The program code for realizing the functions described in the present embodiment can be implemented by a wide range of programs or script languages such as assembler, C / C ++, perl, Shell, PHP, Java (registered trademark).

  Furthermore, by distributing the program code of the software that implements the functions of the embodiments via a network, the program code is stored in a storage means such as a hard disk or memory of a computer or a storage medium such as a CD-RW or CD-R. The CPU included in the computer may read and execute the program code stored in the storage unit or the storage medium.

  In the above-described embodiments, the control lines and information lines indicate what is considered necessary for the explanation, and not all control lines and information lines on the product are necessarily shown. All the components may be connected to each other.

101 Log analysis device 102 Control device 103 Network monitoring device 104 Security countermeasure device 105 Network 106 Administrator 201, 301, 401, 501 Processor 202, 302, 402, 502 Memory 203, 303, 403, 503 Storage device 204, 304, On Output interface 205, 305, 405, 505 Network interface 206, 306, 406, 506 Bus 207 Input device 208 Output device 211 Log analysis module 212 Log analysis definition information 213 Adjustment policy information 214 Schedule information 215 Log data management information 221 Execution module 307 Valve 308 Actuator 311 Control module 411 Network management module 412 Network log data management information 511 Security Countermeasure module 512 security log data management information

Claims (15)

A computer system including an apparatus that acquires log data to be monitored and a log analysis apparatus that executes analysis processing of the log data,
The log analyzer is
When receiving a message including a type and importance, based on the type and importance, determine a candidate parameter for specifying log analysis processing and log data used for the log analysis processing,
Executing an adjustment process for determining parameters for execution by modifying the candidate parameters based on the processing load of the log analyzer;
In order to execute the log analysis process using the parameters for execution, modify the internal parameters that define the processing content of the log analysis process,
Based on the execution parameters, obtain the log data,
A computer system, wherein the log analysis process is executed using the acquired log data. The computer system according to claim 1,
The log analyzer is
Log analysis definition information including a record including a combination of the type and the importance, and a value specifying the log analysis process and the candidate parameter;
Holding the condition relating to the index indicating the processing load of the log analyzer and the adjustment policy information including a record composed of the adjustment method of the candidate parameter;
By determining the log analysis process and the candidate parameter by referring to the log analysis definition information based on the type and the importance,
By specifying the adjustment method of the candidate parameter by referring to the adjustment policy information based on the index calculated from the processing load of the log analyzer,
A computer system, wherein the execution parameter is determined by modifying the candidate parameter based on the specified adjustment method. The computer system according to claim 2,
The computer system characterized in that the adjustment policy information includes a record including scheduling for delaying execution of a log analysis process using log data acquired based on the candidate parameter as the adjustment method. The computer system according to claim 2,
The log analyzer is
When obtaining the log data from the device based on the parameters for execution, obtain load information indicating the processing load of the device,
Based on the load information, determine whether the processing load of the device is high,
When it is determined that the processing load of the device is high, the computer system is characterized in that the execution parameter is modified so that the data amount of the log data acquired from the device is reduced. A computer system according to claim 4, wherein
The log data includes a time stamp,
The computer system according to claim 1, wherein the parameter includes a type of log data to be acquired, items to be included in the log data to be acquired, and a time range of the log data to be acquired. A log analysis method in a computer system including an apparatus that acquires log data to be monitored and a log analysis apparatus that executes an analysis process of the log data,
When the log analysis apparatus receives a message including a type and an importance level, the log analysis process and candidate parameters for specifying log data to be used for the log analysis process are determined based on the type and the importance level. A first step to:
A second step in which the log analysis device executes an adjustment process for determining an execution parameter by correcting the candidate parameter based on a processing load of the log analysis device;
A third step in which the log analysis device corrects an internal parameter that defines the processing content of the log analysis processing in order to execute the log analysis processing using the parameters for execution;
A fourth step in which the log analysis device acquires the log data based on the parameters for execution;
A log analysis method comprising: a fifth step in which the log analysis device executes the log analysis processing using the acquired log data. The log analysis method according to claim 6,
The log analyzer is
Log analysis definition information including a record including a combination of the type and the importance, and a value specifying the log analysis process and the candidate parameter;
Holding the condition relating to the index indicating the processing load of the log analyzer and the adjustment policy information including a record composed of the adjustment method of the candidate parameter;
In the first step, the log analysis process and the candidate parameter are determined by referring to the log analysis definition information based on the type and the importance.
The second step includes
The log analysis device identifying the adjustment method of the candidate parameter by referring to the adjustment policy information based on an index calculated from the processing load of the log analysis device;
The log analysis method includes the step of determining the parameters for execution by modifying the candidate parameters based on the specified adjustment method. The log analysis method according to claim 7,
The log analysis method characterized in that the adjustment policy information includes a record including scheduling for delaying execution of log analysis processing using log data acquired based on the candidate parameter as the adjustment method. The log analysis method according to claim 7,
The fourth step includes
The log analysis device acquiring load information indicating a processing load of the device;
The log analysis device determining whether the processing load of the device is high based on the load information;
When it is determined that the processing load of the device is high, the log analysis device includes a step of correcting the parameters for execution so that a data amount of the log data acquired from the device is reduced. A featured log analysis method. The log analysis method according to claim 9, comprising:
The log data includes a time stamp,
The log analysis method, wherein the parameter includes a type of log data to be acquired, items to be included in the log data to be acquired, and a time range of the log data to be acquired. A log analysis device that executes analysis processing of the log data acquired from a device that manages log data to be monitored,
When receiving a message including a type and importance, based on the type and importance, determine a candidate parameter for specifying log analysis processing and log data used for the log analysis processing,
Executing an adjustment process for determining parameters for execution by modifying the candidate parameters based on the processing load of the log analyzer;
In order to execute the log analysis process using the parameters for execution, modify the internal parameters that define the processing content of the log analysis process,
Based on the execution parameters, obtain the log data,
A log analysis apparatus that executes the log analysis processing using the acquired log data. The log analyzer according to claim 11,
Log analysis definition information including a record including a combination of the type and the importance, and a value specifying the log analysis process and the candidate parameter;
Holding the condition relating to the index indicating the processing load of the log analyzer and the adjustment policy information including a record composed of the adjustment method of the candidate parameter;
By determining the log analysis process and the candidate parameter by referring to the log analysis definition information based on the type and the importance,
By specifying the adjustment method of the candidate parameter by referring to the adjustment policy information based on the index calculated from the processing load of the log analyzer,
The log analysis apparatus characterized in that the execution parameter is determined by correcting the candidate parameter based on the specified adjustment method. The log analysis device according to claim 12,
The log analysis apparatus characterized in that the adjustment policy information includes a record including scheduling for delaying execution of log analysis processing using log data acquired based on the candidate parameter as the adjustment method. The log analysis device according to claim 12,
When acquiring the log data from the device based on the parameters for execution, acquire load information indicating the processing load of the device,
Based on the load information, determine whether the processing load of the device is high,
When it is determined that the processing load of the device is high, the execution parameter is corrected so that the amount of the log data acquired from the device is reduced. The log analyzer according to claim 14,
The log data includes a time stamp,
The log analysis apparatus, wherein the parameter includes a type of log data to be acquired, items to be included in the log data to be acquired, and a time range of the log data to be acquired.

Images