JP2006268775A5

JP2006268775A5 -

Info

Publication number: JP2006268775A5
Application number: JP2005089891A
Authority: JP
Filing date: 2005-03-25
Publication date: 2008-05-08
Anticipated expiration: 2025-03-25

Claims

A software behavior modeling device that models the normal operation of monitored software,
Let the monitored software try multiple times,
An instruction acquisition unit for acquiring instructions issued during operation of the monitored software;
An instruction storage unit for storing the acquired instructions in a time series for each trial;
A model generation unit that reads the time series of instructions stored in the instruction storage unit for each trial and creates an operation model from the time series of instructions;
A model accumulating unit for accumulating an operation model of the monitored software generated by the model generating unit until the previous reading;
The model storage unit
A first model storage unit that stores the tree structure model generated by the model generation unit up to the previous reading;
A second model accumulating unit for accumulating an operation model whose feature value is a statistical amount of instruction issuance generated until the previous reading by the model generating unit;
The model generation unit
A time series of instructions read this time as a learning series, a first model generation unit that generates a tree structure model from the learning series and the motion model stored in the first model storage unit;
Software having a second model generation unit for deriving a statistic from the learning sequence and learning the behavior model stored in the second model storage unit using the statistic Behavior modeling device.

The second model accumulating unit accumulates an operation model having the feature co-occurrence frequency of instructions generated by the model generating unit until the previous reading,
The second model generation unit derives a statistic from the learning sequence, and further learns the behavior model stored in the second model storage unit using the co-occurrence frequency. The software behavior modeling apparatus according to claim 1.

When an abnormal operation of the monitoring target software is input, a negative example separation unit that separates a time series of instructions generated by the abnormal operation from the acquired instructions,
The negative example separation unit traces the acquired instruction on an operation model stored in the first model storage unit, and an instruction time series from the point in time when an instruction different from the operation model appears by an abnormal operation. Judged as a negative example of the resulting instruction sequence,
The software behavior modeling device according to claim 1, wherein the second model generation unit generates a model of an abnormal operation using the negative example.

The software operation according to any one of claims 1 to 3, further comprising a meta information adding unit that adds, as meta information, computer environment information in which the monitoring target software is operated to the generated operation model. Modeling device.

A software operation monitoring device for monitoring the operation of monitored software,
An instruction acquisition unit for acquiring instructions issued during operation of the monitored software;
An instruction storage unit for storing the acquired instructions in time series;
A first verification unit that obtains the tree structure model from the first model storage unit that stores the tree structure model of the monitoring target software and traces the tree structure model on the tree structure model, thereby determining a deviation from a normal operation When,
Among the time series of instructions accumulated by the instruction accumulation unit, the time series from the time point when the first verification unit determines to be a divergence is used as a verification series, and the statistical amount of instruction issuance of the monitored software is used as a feature quantity. The behavior model is acquired from the second model accumulation unit that has accumulated the behavior model, a statistic is generated from the verification sequence, and discriminant analysis with the behavior model is performed to determine a deviation from the normal behavior A software operation monitoring apparatus comprising: a verification unit.

The first verification unit acquires the tree structure model from a first model storage unit that stores the tree structure model of the monitoring target software, and the tree structure model is acquired in the order in which the instruction acquisition unit acquires the instructions. The software operation monitoring apparatus according to claim 5, wherein the deviation from the normal operation is determined by tracing above.

The second model accumulating unit accumulates an operation model having a feature amount of a co-occurrence frequency of instructions issued by the monitoring target software,
The said 2nd model verification part derives | leads-out the co-occurrence frequency of an instruction | indication from the said verification series, and discriminate | determines the deviation from a normal operation | movement by discriminant analysis with the said operation model. Software operation monitoring device.

A time series of instructions accumulated by the instruction accumulation unit is used as a learning sequence, and the tree structure model accumulated in the first model accumulation unit and the instruction issuance statistics accumulated in the second model accumulation unit are characterized. A model learning unit that learns the behavior model as a quantity using the learning sequence;
8. The model learning unit according to claim 5, wherein the model learning unit learns a model only when the second verification unit determines that the operation of the monitoring target software is normal. 9. The software operation monitoring device described.

The software operation monitoring apparatus according to claim 5, wherein the verification sequence is a set of time series subsequences of instructions issued until the monitoring target software is terminated. .

The software operation monitoring apparatus according to claim 9, wherein the partial sequence is generated by dividing the time series of the instructions at a timing at which the monitoring target software issues a system call.