JP2010134862A - Log analysis system, method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a log analysis system capable of detecting an abnormality and identifying an abnormality generation source, while suppressing a processing load required for log analysis. <P>SOLUTION: A frequency conversion means 12 converts a time axis distribution of schematic log information produced by integrating detailed log information into frequency axis distribution. A frequency band intensity calculation means 13 calculates a frequency band intensity in a frequency band to be supervised by referring to the frequency axis distribution of the schematic log information. A frequency band intensity supervision means 14 supervises a temporal change of the frequency band intensity, and detects an abnormality when the variation of the frequency band intensity becomes greater than or equal to a predetermined threshold. Based on the time axis distribution of the detailed log information at the time going back from the abnormality occurrence time by a predetermined time, an abnormality identification means 15 identifies the abnormality generation source. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a log analysis system, method, and program, and more particularly, to a log analysis system, method, and program for detecting occurrence of an abnormality based on log information.

  In order to investigate the cause of an abnormality, detect unauthorized access, and predict future resource usage, a log analysis system that records and analyzes system operation status as log information has been introduced. Causes of abnormalities in computer systems are due to viruses and worms. Viruses and worms have a latent period and an onset period, and some viruses and worms appear in a certain cycle. Focusing on the periodicity of such attacks, a method for detecting signs of attacks of unknown viruses and worms has been proposed.

Patent Document 1 describes an example of a log analysis system that focuses on the periodicity of log information. In Patent Document 1, a distribution of log information on the time axis is converted into a distribution on the frequency axis using Fourier transform, and an abnormality is detected using a change in the distribution on the frequency axis. In patent document 1, when the intensity | strength of a frequency component exceeds a certain ratio with respect to the past intensity | strength, it determines with it being abnormal.
JP 2005-151289 A

  In Patent Document 1, in order to identify a program (application software) infected with an unknown virus or worm, it is always necessary to individually analyze the frequency of the resource usage rate and event occurrence amount for all programs. For this reason, Patent Document 1 has a problem that the load required for log analysis increases.

  An object of the present invention is to provide a log analysis system, method, and program capable of detecting an occurrence of an abnormality and specifying an abnormality occurrence source while suppressing a processing load required for log analysis.

  In order to achieve the above object, the log analysis system of the present invention refers to log information storage means for storing detailed log information and summary log information obtained by integrating a plurality of detailed log information. A frequency conversion means for converting the axial distribution into a frequency axis distribution, and a frequency for calculating a frequency band intensity that is a sum of intensity in the frequency band to be monitored with reference to the frequency axis distribution of the summary log information converted by the frequency conversion means Band strength calculation means, frequency band intensity monitoring means for monitoring the time variation of the calculated frequency band intensity and detecting the occurrence of anomaly when the fluctuation of the frequency band intensity exceeds a predetermined threshold, and the frequency band intensity When the monitoring unit detects the occurrence of an abnormality, the log information storage unit is referred to, and based on the time axis distribution of the detailed log information at a time going back a predetermined time from the abnormality occurrence time. Characterized in that it comprises an abnormality identifying means for identifying the source.

  In the log analysis method of the present invention, a computer refers to log information storage means for storing detailed log information and summary log information obtained by integrating a plurality of detailed log information, and sets the time axis distribution of the summary log information as a frequency axis. A step of converting to a distribution; the computer refers to a frequency axis distribution of the converted summary log information; and calculates a frequency band intensity that is a sum of intensity in a frequency band to be monitored; Monitoring the time variation of the calculated frequency band intensity, detecting the occurrence of an abnormality when the fluctuation of the frequency band intensity exceeds a predetermined threshold, and the computer detecting the occurrence of the abnormality, Referring to the log information storage means, the abnormality source is specified based on the time axis distribution of the detailed log information at a time that goes back a predetermined time from the abnormality occurrence time. And having a step.

  The program of the present invention refers to log information storage means for storing detailed log information and summary log information obtained by integrating a plurality of detailed log information, and converts the time axis distribution of the summary log information into a frequency axis distribution , Referring to the frequency axis distribution of the converted summary log information, calculating the frequency band intensity that is the sum of the intensity in the frequency band to be monitored, and monitoring the temporal change of the calculated frequency band intensity. A process for detecting the occurrence of an abnormality when the fluctuation of the frequency band intensity exceeds a predetermined threshold, and a time that goes back a predetermined time from the abnormality occurrence time with reference to the log information storage means when the occurrence of the abnormality is detected. Based on the time axis distribution of the detailed log information in the above, the computer is caused to execute processing for specifying an abnormality source.

  The log analysis system, method, and program of the present invention can detect the occurrence of abnormality and specify the source of abnormality while suppressing the processing load required for log analysis.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 shows a log analysis system according to a first embodiment of the present invention. The log analysis system 10 includes a log information collection unit 11, a frequency conversion unit 12, a frequency band intensity calculation unit 13, a frequency band intensity monitoring unit 14, an abnormality identification unit 15, and a log information storage unit 21. The function of each unit in the log analysis system 10 can be realized by executing a predetermined program on a computer.

  The log analysis system 10 is connected to a management target device via a communication path, and can exchange information with the management target device. The devices to be managed are computers, network devices, and other devices. In FIG. 1, one management target computer 31 is illustrated as a management target apparatus. The management target computer 31 is not limited to one, and there may be a plurality of management target computers 31. The communication path between the log analysis system 10 and the management target computer 31 can be realized by wired communication, wireless communication, or a mixture thereof.

  The log information collection unit 11 collects log information on the operation status from the management target computer 31. The log information collection unit 11 stores the collected log information in the log information storage unit 21. The log information includes an event occurrence time, a computer usage rate, a CPU in the computer, a memory, a name of an operating program (application), and the like. If the management target device is a network device, the log information may include information indicating the operation state of the network device, such as the number of packets and the bandwidth.

  The log information collection unit 11 acquires log information from the management target computer 31 periodically, for example. Alternatively, the log information collection unit 11 may acquire log information when an event occurs in the management target computer 31. The log information collection unit 11 records the acquired log information in the log information storage unit 21 by dividing it into detailed log information and general log information that is general log information obtained by integrating a plurality of detailed log information.

  FIG. 2 shows the log information storage unit 21. The summary log information 25 is a summary log, and the detail log information 26 is a detail log. The log information collection unit 11 records the collected log information in the detailed log information 26. The log information collection unit 11 records a statistical value obtained by integrating a plurality of detailed log information 26 in the summary log information 25.

  FIG. 3 shows specific examples of the summary log information 25 and the detailed log information 26. FIG. 3 shows log information of the CPU usage rate. The CPU usage rate in the detailed log information 26 is the CPU usage rate of each program being executed in the computer. The CPU usage rate in the summary log information 25 is the CPU usage rate of the entire computer that integrates the CPU usage rates of the programs. When the log information acquisition source is a network device, the number of packets for each port can be used as summary log information, and the number of packets for each destination address within each port can be used as detailed log information. The log information stored in the log information storage unit 21 may be discarded when a certain period has elapsed in order to effectively use the storage area. Or you may move to another memory | storage means after progress of a fixed period.

  The frequency conversion unit 12 refers to the log information storage unit 21 and generates a distribution of the summary log information on the time axis from the summary log information 25. When the summary log information is information represented by a numerical value such as a CPU usage rate, the frequency conversion unit 12 plots the numerical value over time to generate a time axis distribution of the summary log information. When the summary log information is information that is not represented by a numerical value, such as an event occurrence notification, the number of event occurrences and the occurrence frequency at each time may be obtained and plotted on the time axis. The frequency conversion means 12 converts the time axis distribution of the generated summary log information into a frequency axis distribution. Fourier transform can be used for conversion from the time axis distribution to the frequency axis distribution.

  FIG. 4 shows how the load of the management target computer 31 changes with time (time axis distribution). The horizontal axis indicates time, and the vertical axis indicates the load at each time. The frequency conversion unit 12 acquires the load of the management target computer 31 at each time from the log information storage unit 21 and plots it on the time axis. As the load, the usage rate of the CPU can be used.

  FIG. 5 shows a frequency axis distribution of the load of the management target computer 31. The horizontal axis represents the frequency, and the vertical axis represents the intensity of the frequency component. In FIG. 5, the horizontal axis is shown as a frequency. However, since the frequency and the repetition period have a reciprocal one-to-one relationship, the frequency on the horizontal axis can be a repetition time period.

  The frequency conversion means 12 obtains a distribution on the frequency axis as shown in FIG. 5 by frequency converting the time axis distribution of the CPU usage rate shown in FIG. The frequency conversion unit 12 converts the time axis distribution of the summary log information at a predetermined time into the frequency axis distribution, for example, every predetermined time. Since the frequency axis distribution differs depending on which time zone of the time axis distribution is frequency-converted, the frequency axis distribution changes with the passage of time.

  The frequency band intensity calculation means 13 refers to the frequency axis distribution of the summary log information and calculates a frequency band intensity that is the sum of the intensities of the frequency bands to be monitored in the frequency axis distribution. The frequency band intensity calculation means 13 integrates the intensity in the range from the frequency f1 to f2, for example, with the frequency band B (f1 <f <f2) shown in FIG. Calculate the intensity. The frequency band to be monitored is not limited to one and may be plural. For example, in FIG. 5, three frequency bands A (f <f1), frequency band B (f1 <f <f2), and frequency band C (f> f2) are monitored, and the three frequency bands The intensity may be calculated.

  Various methods are conceivable as frequency band dividing methods. For example, a method of dividing at equal intervals on the frequency axis is conceivable. Alternatively, in the frequency band division, the frequency band width may be non-uniform. As a dividing method in which the width of the frequency band is not uniform, a method of dividing the frequency band so that the intensities of the frequency bands are almost equal can be considered. Specifically, for example, a method of determining the number of frequency band divisions as three and adjusting the upper and lower limits of the three frequency band intensities so that the frequency band intensities have substantially the same value can be considered. Alternatively, find the value obtained by dividing the sum of the intensities of all frequencies by the number of divisions in the frequency band, add the intensity from the lower frequency side, and the value becomes the value obtained by dividing the sum of the intensities by the number of divisions. May be determined as the boundary frequency of the frequency band.

  The administrator designates which frequency band the frequency band intensity calculation means 13 uses as the monitoring target to calculate the frequency band intensity. Alternatively, the frequency band to be monitored may be fixedly determined in advance. In the designation of the frequency band to be monitored, in the case where the frequency band is divided unevenly, the i th from the higher frequency side of the plurality of frequency bands (i is from 1 to the number of frequency band divisions) May be specified as any integer between.

  The frequency band intensity calculating unit 13 outputs the calculated frequency band intensity to the frequency band intensity monitoring unit 14. The frequency band intensity monitoring means 14 monitors the time variation of the frequency band intensity calculated by the frequency band intensity calculating means 13 and determines whether an abnormality has occurred in the monitoring target frequency band based on the fluctuation of the frequency band intensity. Monitor. When the frequency band intensity monitoring unit 14 determines that the fluctuation of the frequency band intensity is greater than or equal to a predetermined threshold value, it detects the occurrence of an abnormality. When the frequency band intensity calculating unit 13 calculates the frequency band intensity of a plurality of frequency bands, the frequency band intensity monitoring unit 14 may monitor whether or not an abnormality has occurred in the plurality of frequency bands. . At this time, the threshold value used for determining the occurrence of abnormality may be different for each frequency band, or may be the same value in each frequency band.

  FIG. 6 shows how the frequency band intensity changes with time. The graph shown in FIG. 6 corresponds to the time change of the frequency band intensity in the frequency band B in FIG. The frequency band intensity monitoring means 14 holds the average of the frequency band intensity for a predetermined time before the present as the normal level. The frequency band intensity monitoring means 14 generates an abnormality when the difference between the normal level and the frequency band intensity is greater than or equal to a predetermined threshold value, that is, when the frequency band intensity fluctuates by more than the threshold value from the normal level. Is detected. When detecting the occurrence of abnormality, the frequency band intensity monitoring unit 14 notifies the abnormality specifying unit 15 of the frequency band determined to be abnormal and the abnormality occurrence time (t0).

  Upon receiving the notification of the occurrence of abnormality, the abnormality identification unit 15 analyzes the detailed log information stored in the log information storage unit 21 and identifies (estimates) the occurrence source of the abnormality having periodicity. More specifically, the abnormality specifying unit 15 analyzes the detailed log information in the time range from the abnormality occurrence time t0 to a time that is a predetermined time before the abnormality occurrence time t0, and the time of the detailed log information in the time range. Find the axial distribution. Thereafter, the abnormality specifying unit 15 detects a peak in the time axis distribution of the detailed log information. In the peak detection, the abnormality specifying unit 15 sets the average of the detailed log information in the time before the time range to be analyzed as a normal value, and the detailed log information is predetermined in the time range to be analyzed than in the normal time. A point in time that fluctuates more than the threshold value is detected as a peak. The abnormality identification unit 15 identifies the source of the abnormality according to the detected number of peaks.

  FIG. 7 shows a time axis distribution of the CPU usage rate in the detailed log information. The frequency band intensity monitoring means 14 detects that the fluctuation of the frequency band intensity in the frequency band to be monitored has exceeded the threshold at time t0, and detects the occurrence of an abnormality. Upon receiving the notification of the occurrence of abnormality, the abnormality identification unit 15 refers to the log information storage unit 21, and detailed log information in a time range from the abnormality occurrence time t0 to a time that is a fixed time before the abnormality occurrence time t0. 26 time-axis distributions are analyzed. The abnormality specifying unit 15 counts the peak of detailed log information in the time range, for example, the peak number of the CPU usage rate for each program, and the generation source of the detailed log information is the source of the abnormality from the peak number. Determine whether or not.

  The time range of the detailed log information analyzed when the abnormality identification unit 15 identifies the occurrence source of the abnormality is from a time before a time longer than the reciprocal of the lower limit frequency of the frequency band where the abnormality is detected from the abnormality occurrence time. Until the time of occurrence of abnormality. In other words, the abnormality specifying unit 15 analyzes the detailed log information in a time that goes back from the abnormality occurrence time t0 by the period time of the lower limit frequency of the frequency band to be monitored. For example, when the frequency band where the occurrence of abnormality is detected is the frequency band B shown in FIG. 5 (upper limit frequency f2, lower limit frequency f1), the abnormality specifying unit 15 determines the time before time t0- (1 / f1). Detailed log information from time to time t0 is analyzed.

The abnormality specifying means 15 counts the number of peaks in the time axis distribution of the detailed log information in the above time range, and the ratio of the peak number from 1 to the upper limit frequency (f _B ) and the lower limit frequency (f _A ) of the frequency band (f _B / f _A ), the generation source of the detailed log information, that is, the program that output the detailed log information is identified as the source of the abnormality. For example, in the case of the frequency band B, the number of peaks of the frequency f1, which is the lower limit of the frequency band in which the abnormality occurred at the time of (1 / f1), is 1, and the peak number of the upper limit frequency f2 is (f2 / This is because the number of peaks at a frequency between f1 and f2 is between 1 and (f2 / f1). For these reasons, it is desirable that the ratio between the retroactive time and the upper limit / lower limit of the number of peaks determined to be the cause of the abnormality is (1 / f1): 1: (f2 / f1).

  With respect to the retroactive time, that is, the time range for analyzing the detailed log information, since the peak at the lower limit frequency should be observed once, it is desirable that the time be longer than one cycle time of the lower limit frequency. In addition, since the time interval of occurrence of abnormality may include some variation, the analysis target time may be set longer than the above ratio, or the range of the number of peaks determined to be abnormal may be increased.

    FIG. 8 shows the overall operation procedure. The log information collection unit 11 collects log information on the operation status from the management target computer 31 connected to the log analysis system 10 (step A1). The log information collection unit 11 records the collected log information in the log information storage unit 21. The log information collecting unit 11 divides log information into general log information and detailed log information, records the general log information in the general log information 25 (FIG. 2), and stores the detailed log information in the detailed log information. 26.

  The frequency conversion means 12 acquires the summary log information from the log information storage means 21, and converts the time axis distribution of the summary log information into the frequency axis distribution (step A2). In step A2, the frequency conversion means 12 performs, for example, Fourier transform on the load time axis distribution of the management target computer shown in FIG. 4 to generate the frequency axis distribution shown in FIG. The frequency band intensity calculation means 13 calculates the sum of the frequency band intensity included in the monitoring target frequency band in the frequency axis distribution (step A3). When there are a plurality of frequency bands to be monitored, the frequency band intensity calculating means 13 calculates the frequency band intensity for each of them.

  The frequency band intensity monitoring means 14 monitors the time change of the frequency band intensity in the monitoring target frequency band, and detects the occurrence of abnormality when the fluctuation of the frequency band intensity exceeds the threshold value (step A4). When the frequency band intensity monitoring unit 14 detects the occurrence of an abnormality, the frequency band where the abnormality has occurred, that is, the information indicating the monitoring target frequency band in which the abnormality has occurred, and the abnormality occurrence time, the abnormality specifying unit 15 Notify The abnormality identifying unit 15 refers to the log information storage unit 21 and analyzes the detailed log information to identify a source of abnormality having periodicity (step A5).

  FIG. 9 shows the procedure for identifying the abnormality source in step A5. Here, it is assumed that the frequency band in which the occurrence of abnormality is detected is the frequency band B in FIG. 5, and the CPU usage rate is considered as log information. The abnormality identification unit 15 is notified of the time t0 when the occurrence of abnormality is detected and the abnormality occurrence frequency band B from the frequency band intensity monitoring unit 14 (steps B1 and B2). The frequency band intensity monitoring unit 14 notifies the abnormality specifying unit 15 of the lower limit frequency f1 and the upper limit frequency f2 of the abnormality occurrence frequency band B, for example. Alternatively, the abnormality identification unit 15 is notified of the identification information of the abnormality occurrence frequency band B, and the abnormality identification unit 15 refers to a table that manages the upper limit frequency and the lower limit frequency of the frequency band to be monitored, and the lower limit frequency f1. And the upper limit frequency f2.

  The abnormality specifying unit 15 sets a time range from the time (t0− (1 / f1)) before the abnormality occurrence time t0 to (1 / f1) to the abnormality occurrence time t0 as a time range for analyzing the detailed log information. The abnormality specifying unit 15 refers to the detailed log information 26, and counts the number of peaks of time change of the CPU usage rate from the time axis distribution of the CPU usage rate of each program in the analysis time range (step B3). In step B3, the number of peaks is counted for each program executed on the management target computer 31.

  The abnormality specifying means 15 determines whether or not the number of peaks counted in step B3 is between 1 and (f2 / f1) (step B4). When the number of peaks is between 1 and (f2 / f1), the abnormality specifying unit 15 specifies the program that has output the detailed log information as an abnormality source (step B5). The abnormality identification unit 15 outputs the identified abnormality source program to an output device such as a display. When the number of peaks is not between 1 and (f2 / f1), the process is terminated.

  In the present embodiment, the frequency conversion unit 12 converts the time axis distribution of the summary log information into the frequency axis distribution. The frequency band intensity calculating means 13 calculates the frequency band intensity of the frequency band to be monitored from the frequency axis distribution of the summary log information. The frequency band intensity monitoring means 14 monitors the time variation of the frequency band intensity, and detects the occurrence of an abnormality when the fluctuation of the frequency band intensity is equal to or greater than a threshold value. When an abnormality occurrence is detected, the abnormality identification unit 15 analyzes the time axis distribution of the detailed log information at a time that goes back a predetermined time from the abnormality occurrence time, and identifies the abnormality occurrence source.

  In the present embodiment, the frequency axis distribution of the summary log information is used when detecting the occurrence of abnormality. Reducing the processing burden required for frequency conversion compared to when performing frequency conversion on all log information including detailed log information by making the log information subject to frequency change into summary log information Can do. That is, the occurrence of abnormality can be detected with a small processing load. In this embodiment, the time axis distribution of the detailed log information is used for specifying the abnormality generation source. If an abnormality is detected, by examining the time axis distribution of the detailed log information around that time, a program behaving abnormally can be found, and the source of the abnormality can be identified. In the present embodiment, it is not necessary to convert the detailed log information to the frequency axis distribution in specifying the abnormality source, so that the abnormality source can be specified while suppressing the processing load required for log analysis.

  FIG. 10 shows a log analysis system according to the second embodiment of the present invention. The log analysis system 20 of this embodiment has a configuration in which a peak condition determination unit 16 is added to the log analysis system 10 of the first embodiment shown in FIG. The peak condition determining means 16 is a peak when the abnormality specifying means 15 detects a peak from the time axis distribution of the detailed log information based on the change in the frequency band intensity before and after the frequency band intensity monitoring means 14 detects the occurrence of the abnormality. Determine the detection conditions. More specifically, the peak condition determining means 16 obtains a fluctuation rate of the frequency band intensity before and after detecting the occurrence of an abnormality, and determines a reference value (peak determination threshold value) as a peak detection condition based on the fluctuation rate. To do.

  FIG. 11 shows the time change of the frequency band intensity. When the frequency band intensity monitoring unit 14 detects the occurrence of an abnormality, the peak condition determining unit 16 obtains a fluctuation rate p between the frequency band intensity before the occurrence of the abnormality and the frequency band intensity after the occurrence of the abnormality. The frequency band intensity before the occurrence of abnormality is defined as, for example, the average of the frequency band intensities from the time before the abnormality occurrence time t0 to the abnormality occurrence time t0. Further, the frequency band intensity after the occurrence of abnormality is defined as, for example, the average of the frequency band intensity from the abnormality occurrence time t0 to the time t1 obtained by adding a predetermined time to the abnormality occurrence time t0.

  The peak condition determining means 16 determines a peak determination threshold value based on the variation rate p. The peak condition determining means 16 determines, for example, a value proportional to the fluctuation rate p as a peak determination threshold value. When the peak condition determining means 16 uses a value proportional to the fluctuation rate p as a peak determination threshold value, if the proportionality coefficient is a, the value of a is “0.8”, “1”, “ 1.4 "etc. can be considered. That is, the peak determination threshold value may be a value smaller than p, the same value as p, or a value larger than p. This is because the time axis distribution and the frequency axis distribution are generated based on the same log information and show the same tendency.

  The threshold value for peak determination is not limited to the value proportional to the above-described variation rate p. The peak condition determining means 16 may determine a peak determination threshold value from the variation rate p using a predetermined function having the variation rate p as a variable. It is preferable that the fluctuation rate p and the peak determination threshold value have a positive correlation. That is, it is preferable that the function used for determining the peak determination threshold value is a function that increases the peak determination threshold value as the variation rate p increases. The function used for determining the threshold for peak determination may be a step function.

  When the peak condition determining unit 16 determines the peak determination threshold value, the peak condition determining unit 16 notifies the abnormality specifying unit 15 of the determined peak determination threshold value. The abnormality specifying unit 15 detects a point in time at which the time axis distribution of the detailed log information fluctuates more than a peak determination threshold value as a peak. More specifically, the abnormality specifying unit 15 sets the average of the detailed log information in the time before the time range to be analyzed as a normal value, and the detailed log information has a peak in the time range to be analyzed than in the normal time. A time point that fluctuates by more than the threshold for determination is detected as a peak.

  FIG. 12 shows the time axis distribution of the detailed log information. The abnormality specifying unit 15 receives the peak determination threshold value from the peak condition determining unit 16. Alternatively, the fluctuation rate p may be received from the peak condition determining unit 16 and the peak determination threshold value may be obtained from the fluctuation rate p in the abnormality specifying unit 15. The abnormality specifying unit 15 detects a point in time when the detailed log information fluctuates by more than the peak determination threshold value as a peak. Since the peak determination threshold value increases as the fluctuation rate p increases, when the fluctuation of the frequency axis distribution of the summary log information is large, a portion where the time axis distribution of the detailed log information largely fluctuates is detected as a peak. It will be.

Since the fluctuation rate p is determined after a predetermined time has elapsed from the detection of the occurrence of the abnormality (time t1 in FIG. 11), the abnormality specifying unit 15 performs the time after the time t1 later than the detection time t0 of the abnormality occurrence. You will be notified of the threshold for peak judgment. In the present embodiment, the time range in which the abnormality specifying unit 15 analyzes the detailed log information may be a time that goes back a predetermined time from the time when the fluctuation rate p is obtained (the time when the peak determination threshold is determined). That is, as shown in FIG. 12, the time range from the time t1 when the variation rate p is determined to the time (t1- (1 / f _A )) is detailed with the lower limit frequency of the frequency band to be monitored as f _A. It is good also as a time range which analyzes log information.

  Subsequently, an operation procedure will be described. The overall operation procedure is the same as that in the first embodiment shown in FIG. When the frequency band intensity monitoring unit 14 detects that the fluctuation of the frequency band intensity in the frequency band to be monitored has exceeded the threshold value in step A4, the frequency band intensity monitoring unit 14 obtains the fluctuation rate of the frequency band intensity before and after the detection. The frequency band intensity monitoring unit 14 determines a peak determination threshold value according to the obtained variation rate, and notifies the abnormality specifying unit 15 of the threshold value. In step A5, the abnormality specifying unit 15 detects a time point when the time axis distribution of the detailed log information fluctuates more than the notified peak determination threshold as a peak, and specifies the source of the abnormality.

  In the present embodiment, a peak determination unit that determines a peak detection condition at the time of peak detection based on fluctuations in frequency band intensity before and after the occurrence of abnormality is used. By determining the peak detection condition based on the fluctuation of the frequency band intensity before and after detecting the occurrence of an abnormality, the magnitude of the fluctuation of the time axis distribution of the detailed log information that is determined to be a peak is matched to the magnitude of the fluctuation of the frequency band intensity. It can be changed. For example, when the peak determination threshold value that is a peak detection condition is set to a value proportional to the fluctuation rate of the frequency band intensity before and after the occurrence of an abnormality, the peak determination threshold is increased as the fluctuation of the frequency axis distribution of the summary log information increases. The threshold value also increases. In this case, the abnormality specifying unit 15 does not detect the time point when the fluctuation of the time axis distribution of the detailed log information is small as a peak, but detects the time point when the fluctuation is large as a peak. By doing in this way, even if the abnormality specific | specification means 15 includes a small fluctuation | variation in the time-axis distribution of detailed log information, it cannot detect it as a peak, but can detect a peak correctly. Other effects are the same as those of the first embodiment.

  FIG. 13 shows a log analysis system according to the third embodiment of the present invention. The log analysis system 30 of this embodiment has a configuration in which an abnormality detection threshold value determination unit 17 is added to the log analysis system 10 of the first embodiment shown in FIG. The abnormality detection threshold value determining means 17 is a summary log when the frequency band intensity monitoring means 14 detects the occurrence of an abnormality according to the number of managed computers 31 whose frequency band intensity monitoring means 14 monitors the frequency band intensity. An abnormality detection threshold value that is a threshold value for fluctuations in the frequency axis distribution of information is determined. The log analysis system 30 may have the peak condition determination means 16 (FIG. 10).

  The log information collecting unit 11 collects log information from a plurality of managed computers 31 (three managed computers 31a to 31c in FIG. 13). The frequency band intensity monitoring unit 14 monitors changes in the frequency band intensity in the three managed computers 31 for the same monitoring target frequency. For example, when the frequency band B shown in FIG. 5 is set as the frequency band to be monitored, the frequency band intensity monitoring unit 14 changes the frequency band intensity of the frequency band B in the management target computer 31a and the frequency band B in the management target computer 31b. Change in frequency band intensity and change in frequency band intensity of frequency band B in the managed computer 31c are monitored.

  The abnormality detection threshold value determination unit 17 decreases the abnormality detection threshold value according to the number of the management target computers 31. More specifically, using the threshold value when there is one managed computer 31 as a basic threshold value, the abnormality detection threshold value is lowered from the basic threshold value as the managed computer 31 increases. The abnormality detection threshold value determination means 17 notifies the frequency band intensity monitoring means 14 of the determined abnormality detection threshold value. The frequency band intensity monitoring unit 14 detects the occurrence of an abnormality when the fluctuation in the frequency band intensity is equal to or greater than the notified abnormality detection threshold value.

  For example, the abnormality detection threshold value determination unit 17 decreases the basic threshold value in inverse proportion to the number of managed computers. Or you may reduce linearly according to the number of management object computers from a basic threshold. It is preferable that the abnormality detection threshold value determination means 17 sets a lower limit to the abnormality detection threshold value so that even when the number of computers to be managed increases, it does not become smaller than the lower limit. This is because if the abnormality detection threshold is made too low, the occurrence of abnormality is detected with a slight fluctuation in the frequency band intensity.

  14A to 14C show temporal changes in the frequency band intensity of each managed computer 31. FIG. The abnormality detection threshold value determination means 17 determines a value corresponding to the threshold value shown in FIG. 6 as the abnormality determination detection threshold value when the number of managed computers is one. When the number of computers to be managed is three, the abnormality detection threshold value determination means 17 sets a value lower than the basic threshold value as a threshold value for abnormality determination, and the same applies from the three managed computers 31. When abnormal frequency band intensity fluctuations are observed, abnormality detection is performed earlier. This is because each managed computer 31 is often managed with the same security policy and may be subjected to the same attack at the same time.

  In the present embodiment, an abnormality detection threshold value determination that determines an abnormality detection threshold value that is a threshold value when the frequency band intensity monitoring unit 14 detects an abnormality according to the number of managed computers 31. Means 17 is used. By reducing the abnormality detection threshold according to the number of managed computers, the detection time of occurrence of abnormality can be advanced for managed computer groups that may be attacked simultaneously. Other effects are the same as in the first embodiment.

  FIG. 15 shows a log analysis system according to the fourth embodiment of the present invention. The log analysis system 50 of this embodiment has a configuration in which a frequency input unit 51 and a frequency band intensity distribution output unit 52 are added to the log analysis system 10 of the first embodiment shown in FIG. The frequency input means 51 and the frequency band intensity distribution output means 52 are means for realizing an input / output function for the operator. The log analysis system 50 may include one or both of the peak condition determination unit 16 (FIG. 10) and the abnormality detection threshold value determination unit 17 (FIG. 13).

  The frequency input means 51 designates a monitoring target frequency band for outputting the monitoring state of the frequency band intensity. Various methods are conceivable as the method of specifying the frequency band. For example, a method of specifying an upper limit and a lower limit of a frequency band, a method of specifying a frequency band to be output from the displayed frequency bands, and the like can be considered. The frequency band intensity distribution output means 52 displays, for each management target computer 31, the frequency band intensity of the frequency band specified using the frequency input means 51 in association with the management target computer 31 of the frequency band intensity generation source. Display on the screen. Further, the frequency band intensity distribution output unit 52 may display the color of the management target device in which the occurrence of the abnormality is detected by the frequency band intensity monitoring unit 14 in a prominent color such as red, in addition to the display of the frequency band intensity. . In this case, it becomes easy to visually recognize in which device the abnormality has occurred.

  FIG. 16 shows a display screen example. The display screen includes a frequency band designation area 220 for designating a frequency band to be output and an intensity distribution output area 230 for displaying the level of the frequency band intensity. Here, a computer 201 (201a to 201c) and a network device 202 (202a to 202c) are considered as management target devices. In the frequency band designation area 220, an input bar used when the frequency input means 51 designates a frequency band is displayed. In the intensity distribution output area 230, the management target computer 201 and the network device 202 are displayed on a network topology indicating their connection relationship.

  The operator uses a mouse or the like to move the position of the knob 221 on the input bar in the frequency band designation area 220 and designates a desired frequency band. The frequency input means 51 notifies the frequency band intensity calculation means 13 of the frequency band designated by the operator where the knob 221 is located. The frequency band intensity calculating unit 13 calculates the frequency band intensity of the notified frequency band for the computer 201 and the network device 202 to be managed.

  The frequency band intensity distribution output unit 52 graphically displays the frequency band intensity of the computer 201 or network device 202 to be managed. For example, the frequency band intensity distribution output unit 52 displays the strength of the frequency band intensity of each device by darkening the color of the graphic fill of the managed computer 201 or the network device 202 as the frequency band intensity is higher. . The intensity strength may be expressed by using different colors such as red, blue, yellow, and green according to the frequency band intensity instead of the shade of the fill color. Further, instead of the color, the numerical value of the frequency band intensity may be displayed in or around the graphic of the management target computer 201 or the network device 202.

  17A to 17C show the frequency axis distribution of the summary log information. FIG. 17A shows the frequency axis distribution of the summary log information of the computer 201a. FIG. 17B shows the frequency axis distribution of the summary log information of the computer 201b, and FIG. 17C shows the frequency axis distribution of the summary log information of the computer 201c. Assume that the frequency input means 51 designates the frequency band B (f1 <f <f2). The frequency band intensity calculating means 13 calculates the sum of the intensities from the frequencies f1 to f2 in the frequency axis distribution for the computers 201a to 201c.

  Comparing the frequency band intensities in the computers 201a to 201c, the frequency band intensity in the computer 201a and the frequency band intensity in the computer 201c are approximately the same, and the frequency band intensity in the computer 201b is lower than the frequency band intensities in other computers. The frequency band intensity distribution output means 52 displays the computers 201a and 201c in a darker color than the computer 201b. The operator can grasp that the frequency band intensity of the frequency band B of the computers 201a and 201c is high by looking at the display screen.

  In the present embodiment, a frequency band intensity distribution output unit 52 that outputs the frequency band intensity calculated by the frequency band intensity calculation unit 13 in association with the management target computer of the calculation source is used. The frequency band intensity of each managed device changes from moment to moment. The frequency band intensity distribution output means 52 outputs the frequency band intensity of each managed device in association with the management target device of the calculation source, so that the operator can change how the frequency band intensity of each managed device changes. You can figure out what to do. In particular, when the frequency band intensity distribution output unit 52 represents the frequency band intensity of each management target device by color or density, the operator can change the frequency band intensity by which device the change in color or density is observed. It can be easily grasped whether there is.

  In this embodiment, the management target device is displayed on the network topology, and the frequency band intensity of the management target device is displayed together with the network configuration. In this case, it is possible to easily grasp which device on the network has a high frequency band intensity. In a service executed in cooperation with a plurality of devices, related devices often have the same periodicity. By displaying the management target device on the network topology, the operator can see the relationship between the devices together with the topology information, and the displayed information can be used to find the relationship between the devices.

  In each of the above embodiments, an example in which the log analysis system includes the log information collection unit 11 has been described. However, if the summary log information and the detailed log information are already recorded in the log information storage unit 21, The log information collecting unit 11 can be omitted. That is, when an abnormality occurrence is detected offline using log information collected in advance, the log information collection unit 11 and the log information collection operation in step A1 in FIG. 8 may be omitted.

  As described above, the present invention has been described based on the preferred embodiment. However, the log analysis system, method, and program of the present invention are not limited to the above embodiment, and various configurations are possible from the configuration of the above embodiment. Those modified and changed as described above are also included in the scope of the present invention.

The block diagram which shows the log analysis system of 1st Embodiment of this invention. The block diagram which shows a log information storage means. The block diagram which shows the data example of summary log information and detailed log information. The graph which shows the time-axis distribution of summary log information. The graph which shows the frequency-axis distribution of summary log information. The graph which shows the time change of frequency band intensity. The graph which shows the time-axis distribution of detailed log information. The flowchart which shows the whole process sequence. The flowchart which shows the procedure of abnormality source identification. The block diagram which shows the log analysis system of 2nd Embodiment of this invention. The graph which shows the time change of frequency band intensity. The graph which shows the time-axis distribution of detailed log information. The block diagram which shows the log analysis system of 3rd Embodiment of this invention. (A)-(c) is a graph which shows the time change of the frequency band intensity in each management object computer. The block diagram which shows the log analysis system of 4th Embodiment of this invention. The figure which shows the example of a display screen. (A)-(c) is a graph which shows the frequency-axis distribution of the outline log information in each management object computer.

Explanation of symbols

10, 20, 30, 50: Log analysis system 11: Log information collecting means 12: Frequency converting means 13: Frequency band intensity calculating means 14: Frequency band intensity monitoring means 15: Abnormality specifying means 16: Peak condition determining means 17: Abnormal Detection threshold determining means 21: log information storage means 25: summary log information 26: detailed log information 31: managed computer 51: frequency input means 52: frequency band intensity distribution output means 201: computer 202: network device 220: Frequency band designation area 221: Knob 230: Intensity distribution output area

Claims (15)

Reference is made to log information storage means for storing detailed log information and summary log information obtained by integrating a plurality of detailed log information, and frequency conversion means for converting the time axis distribution of the summary log information into a frequency axis distribution;
A frequency band intensity calculating means for calculating a frequency band intensity that is a sum of intensity in the frequency band to be monitored with reference to the frequency axis distribution of the summary log information converted by the frequency converting means;
A frequency band intensity monitoring means for monitoring a time change of the calculated frequency band intensity and detecting occurrence of an abnormality when the fluctuation of the frequency band intensity exceeds a predetermined threshold;
When the frequency band intensity monitoring unit detects the occurrence of abnormality, the log information storage unit is referred to, and an abnormality that identifies an abnormality generation source based on a time axis distribution of detailed log information at a time that goes back a predetermined time from the abnormality occurrence time A log analysis system comprising a specifying means.   The abnormality identification unit identifies an abnormality occurrence source based on a time axis distribution of detailed log information in a time period that goes back at least from the period of the lower limit frequency of the frequency band to be monitored from the abnormality occurrence time. The described log analysis system.   The abnormality specifying unit refers to the log information storage unit, detects a peak from a time axis distribution of detailed log information at a time that goes back a predetermined time from the abnormality occurrence time, and generates an abnormality based on the number of detected peaks The log analysis system according to claim 1 or 2, wherein a source is specified. When the detected peak number is between 1 and (f _B / f _A ) where the lower limit frequency of the frequency band to be monitored is f _A and the upper limit frequency is f _B , the abnormality specifying means The log analysis system according to claim 3, wherein the generation source is identified as an abnormality source.   5. The peak condition determining means for determining a peak detection condition for detecting the peak based on the amount of change in the frequency band intensity before and after the occurrence of abnormality by the frequency band intensity monitoring means. Log analysis system described in.   The peak condition determining means obtains a variation rate that is a ratio between a frequency band intensity before detection of the occurrence of the abnormality and a frequency band intensity after detection of the occurrence of the abnormality, and the abnormality specifying means is configured to store the detailed log information. The log analysis system according to claim 5, wherein a time point at which the time axis distribution fluctuates by more than a peak determination threshold corresponding to the fluctuation rate is detected as a peak.   According to the number of devices to be managed, the frequency band intensity monitoring means further includes an abnormality detection threshold value determining means for determining an abnormality detection threshold value that is a threshold value when detecting occurrence of an abnormality. The log analysis system according to any one of claims 1 to 6.   The log analysis according to any one of claims 1 to 7, further comprising a frequency band intensity distribution output unit that outputs the frequency band intensity calculated by the frequency band intensity calculation unit in association with a management target apparatus that is a calculation source. system.   The log analysis system according to any one of claims 1 to 8, further comprising log information collection means for acquiring log information from the management target device and recording the acquired log information in the log information storage means. The computer refers to log information storage means for storing detailed log information and summary log information obtained by integrating a plurality of detailed log information, and converts the time axis distribution of the summary log information into a frequency axis distribution;
The computer refers to the frequency axis distribution of the converted summary log information, and calculates a frequency band intensity that is a sum of the intensity in the frequency band to be monitored;
The computer monitors a time change of the calculated frequency band intensity, and detects occurrence of an abnormality when the fluctuation of the frequency band intensity exceeds a predetermined threshold value;
When the computer detects the occurrence of an abnormality, the computer refers to the log information storage unit, and specifies an abnormality occurrence source based on a time axis distribution of detailed log information at a time going back a predetermined time from the abnormality occurrence time. And a log analysis method.   In the step of identifying the abnormality occurrence source, the computer refers to the log information storage unit, detects a peak from a time axis distribution of detailed log information at a time that goes back a predetermined time from the abnormality occurrence time, and detects the detected peak The log analysis method according to claim 10, wherein a source of abnormality is specified based on the number.   The log analysis method according to claim 11, further comprising: determining a peak detection condition for detecting the peak based on a change amount of frequency band intensity before and after detecting the occurrence of the abnormality. A process for converting the time axis distribution of the summary log information into a frequency axis distribution with reference to log information storage means for storing the detailed log information and summary log information obtained by integrating a plurality of detailed log information;
A process of calculating a frequency band intensity that is a sum of intensity in a frequency band to be monitored with reference to the frequency axis distribution of the converted summary log information;
Monitoring the time variation of the calculated frequency band intensity, and detecting the occurrence of an abnormality when the fluctuation of the frequency band intensity exceeds a predetermined threshold;
When the occurrence of the abnormality is detected, the computer refers to the log information storage unit, and specifies the abnormality occurrence source based on the time axis distribution of the detailed log information at a time that goes back a predetermined time from the abnormality occurrence time. A program to be executed.   The process of identifying the abnormality occurrence source refers to the log information storage means, detects the peak from the time axis distribution of the detailed log information at a time that goes back a predetermined time from the abnormality occurrence time, and the number of detected peaks The program of Claim 13 including the process which specifies the generation source of abnormality based on.   The program according to claim 14, further causing the computer to further execute a process of determining a peak detection condition for detecting the peak based on a change amount of frequency band intensity before and after detecting the occurrence of the abnormality.

Images