JP2014064216A - Attack host behavior analyzer, method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an attack host behavior analyzer, method, and program, capable of predicting future behavior of an attack host.SOLUTION: An analyzer 1 includes: an acquisition part 11 for acquiring transmission time for each of transmission data from an attack host; a generation part 12 for generating distribution data of transmission time with regard to the same attack host within a first hour from a specified time; a classification part 13 for generating one or more clusters by clustering first distribution data of a similar distribution characteristic; an association part 14 for associating the characteristic data to the cluster to store the association, the characteristic data being extracted from a group of second distribution data generated within a second hour after generation target time of the first distribution data with regard to the host corresponding to the cluster; and an output part 15 for outputting the characteristic data associated with the cluster as behavior prediction data on and after the corresponding time when new distribution data is generated that can be classified in any of the clusters within the first hour before a certain time.

Description

  The present invention relates to an apparatus, a method, and a program for analyzing data transmission behavior by an attacking host.

  Conventionally, as measures against spam mail (spam mail), a method for judging spam mail from the characteristics of the mail body (for example, refer to Non-Patent Document 1 or 2) and a method for judging spam mail from host or email address information (For example, see Non-Patent Documents 3, 4 or 5).

SpamAssassin, [online], [Search June 20, 2012], Internet <http: // spamassin. apache. org / index. html> TransWare, [online], [Search June 20, 2012], Internet <http: // www. transware. co. jp / product / ah / svm. html> Spamhaus, [online], [Search June 20, 2012], Internet <http: // www. spamhaus. org /> SPF, [online], [Search June 20, 2012], Internet <http: // www. ietf. org / rfc / rfc4408. txt> S25R, [online], [June 20, 2012 search], Internet <http: // http: // www. gabacho-net. jp / anti-spam / anti-spam-system. html>

  By the way, the above-mentioned countermeasure against spam mail is to detect the received spam mail. Therefore, it has been difficult to grasp future trends such as whether or not the attack will continue after detecting spam and how much the network and equipment will be tight if it continues.

  It is an object of the present invention to provide an attack host behavior analysis apparatus, method, and program capable of predicting the behavior of an attack host in the future.

  The present invention provides the following solutions.

  (1) With respect to transmission data from a known attack host, an acquisition unit that acquires the transmission time of each transmission data and the distribution of the transmission time for the same attack host within a first time from the specified time are shown. A generating unit that generates distribution data, a clustering unit that clusters first distribution data having similar distribution characteristics from the plurality of distribution data corresponding to a plurality of hosts, and generates one or more clusters; For a host corresponding to a cluster, a distribution feature is extracted from a set of second distribution data generated within a second time after the generation target time of the first distribution data, and the feature data is associated with the cluster. And when the new distribution data classified into one of the clusters is generated within a first time before a certain time, Same attack host later as the estimation data behavior for data transmission, behavior analysis device attacks host and an output unit which outputs the feature data associated with the cluster.

  According to such a configuration, the attack host behavior analysis apparatus stores a cluster in which past behaviors of known attack hosts are classified and feature data indicating future behavior in association with each other. Therefore, when the behavior analysis apparatus of an attack host can confirm the behavior classified into any cluster for a certain host, it can predict the future behavior of this host from the feature data associated with this cluster.

As a result, based on the prediction of future behavior, the attack host behavior analysis device, for example, blocks communication with the target attack host if it is predicted that spam mail will be sent regularly in the future. Judgment can be made.
Furthermore, since the network administrator can estimate the behavior of the attacking host and calculate the traffic volume when changing the network configuration or adding equipment, it is possible to suppress unnecessary equipment investment.

  (2) The attack host behavior analysis device according to (1), wherein the distribution data is data indicating presence / absence of transmission data for each time period obtained by dividing the first time into a predetermined number.

  According to such a configuration, the attack host behavior analysis device can easily perform clustering and association of feature data by using numerical data indicating the presence or absence of transmission data for each time zone as distribution data indicating past behavior. It can be carried out.

  (3) The distribution data is a vector whose element is presence / absence of transmission data for each time period, and the feature data is a vector indicating a center of a set of vectors as the distribution data. Attack host behavior analysis device.

  According to such a configuration, the attack host behavior analysis device easily performs clustering and association of feature data using a vector indicating the presence or absence of transmission data for each time zone as distribution data indicating past behavior. be able to.

  (4) The attacking unit according to any one of (1) to (3), wherein the associating unit clusters the set of the second distribution data and generates the feature data for a cluster having the maximum number of elements. Behavior analysis device.

  According to such a configuration, the behavior analysis device of the attacking host suppresses noise by clustering a set of vectors indicating future behavior corresponding to clusters indicating past behavior and selecting the cluster with the largest element. Thus, the prediction accuracy can be improved.

  (5) The attack host behavior analysis device according to any one of (1) to (4), further including an adjustment unit that adjusts the first time and a predetermined number of times for dividing the first time based on a designated input. .

  According to such a configuration, the attack host behavior analysis apparatus can adjust the first time and the number of divisions for generating distribution data. Therefore, the administrator can improve the prediction accuracy by setting an appropriate period and the number of divisions according to the situation when operating the behavior analysis apparatus of the attack host.

  (6) The attack host behavior analysis device according to any one of (1) to (5), wherein the transmission data is a spam mail.

  According to such a configuration, the attack host behavior analysis apparatus can predict the future behavior of the spam mail transmission server.

  (7) With respect to transmission data from a known attack host, an acquisition step for acquiring the transmission time of each of the transmission data and the distribution of the transmission time for the same attack host within a first time from the specified time are shown. A generation step of generating distribution data, a clustering step of clustering first distribution data having similar distribution characteristics among a plurality of distribution data corresponding to a plurality of hosts, and generating one or more clusters; For a host corresponding to a cluster, a distribution feature is extracted from a set of second distribution data generated within a second time after the generation target time of the first distribution data, and the feature data is associated with the cluster. And storing the new distribution data classified into one of the clusters within a first time before a certain time. If it is configured, the behavior analysis of the attack host executed by the computer with the output step of outputting the feature data associated with the cluster as the estimation data of the behavior transmitted by the same attack host after the time Method.

  According to such a configuration, the same effect as in (1) can be expected when the computer executes the attack host behavior analysis method.

  (8) With respect to transmission data from a known attack host, an acquisition step for acquiring the transmission time of each of the transmission data and the distribution of the transmission time for the same attack host within a first time from the specified time are shown. A generation step of generating distribution data, a clustering step of clustering first distribution data having similar distribution characteristics among a plurality of distribution data corresponding to a plurality of hosts, and generating one or more clusters; For a host corresponding to a cluster, a distribution feature is extracted from a set of second distribution data generated within a second time after the generation target time of the first distribution data, and the feature data is associated with the cluster. And storing the new distribution data classified into one of the clusters within a first time before a certain time. If it is configured, an attack host for causing the computer to execute an output step of outputting the feature data associated with the cluster as estimated data of behavior transmitted by the same attack host after the time. Behavior analysis program.

  According to such a configuration, the same effect as in (1) can be expected by causing the computer to execute the behavior analysis program of the attack host.

  According to the present invention, it is possible to predict the behavior of the attacking host in the future.

1 is a schematic diagram of a system including an analysis apparatus according to an embodiment. It is a figure which shows the function structure of the analyzer which concerns on embodiment. It is a figure which shows an example of the vector which concerns on embodiment. It is a flowchart which shows the production | generation process of the analysis data which concerns on embodiment. It is a flowchart which shows the prediction process of the action of the attack host which concerns on embodiment.

An example of an embodiment of the present invention will be described.
The analysis device 1 (attack host behavior analysis device) according to the present embodiment is a server device that predicts the future behavior of an attack host by analyzing the behavior of a known attack host from traffic flow data on the network. is there. The attack host is, for example, a server that transmits data such as junk mail or attack packets. Hereinafter, the transmission data will be described as spam mail.

FIG. 1 is a schematic diagram of a system including an analysis apparatus 1 according to the present embodiment.
The spam mail transmitted from the attack host 2 (mail server) passes through the router 4 of the backbone network. The collection server 3 collects traffic flow data or packet capture data from the router 4 with respect to the IP address of the attacking host 2 and provides it to the analysis device 1.

FIG. 2 is a diagram illustrating a functional configuration of the analysis apparatus 1 according to the present embodiment.
The analysis device 1 includes a control unit 10, a storage unit 20, a communication unit 30, an input unit 40, and a display unit 50.

  The control unit 10 is a part that controls the entire analysis apparatus 1, and appropriately reads and executes various programs stored in the storage unit 20, thereby cooperating with the hardware described above and various functions in the present embodiment. Is realized. The control unit 10 may be a CPU (Central Processing Unit). In addition, the function of each part with which the control part 10 is provided is mentioned later.

  The storage unit 20 stores various programs for causing the hardware group to function as the analysis apparatus 1, programs for causing the control unit 10 to execute various functions of the present embodiment, various data, and the like. Various data stored in the storage unit 20 will be described later.

  The communication unit 30 is a network adapter when the analysis apparatus 1 transmits / receives information to / from another apparatus, and directly accesses the collection server 3 or the router 4 in the network, and traffic information such as network flow data or packet capture data. Is obtained and provided to the control unit 10.

  The input unit 40 is an interface device that receives an instruction input from the user to the analysis device 1. The input unit 40 is configured by, for example, a key operation unit or a touch panel.

  The display unit 50 displays a screen for accepting data input to the user, or displays a screen for processing results obtained by the analysis apparatus 1. The display unit 50 may be a liquid crystal display or an organic EL display.

  The control unit 10 includes an acquisition unit 11, a generation unit 12, a classification unit 13, an association unit 14, an output unit 15, and an adjustment unit 16. Further, the storage unit 20 stores traffic information 21 and analysis data 22.

The acquisition unit 11 acquires the traffic information 21 including the transmission time of each transmission data regarding the transmission data from the known attack host 2 specified by the IP address via the communication unit 30 and stores it in the storage unit 20. To do.
The IP address of the known attack host 2 is acquired by, for example, extracting a mail transmission host determined to be junk mail by an existing black list or content filter.

The generation unit 12 generates distribution data indicating the distribution of transmission times related to the same attack host 2 within the first time (D) from the specified time (T) based on the traffic information 21.
Specifically, the distribution data is a vector whose element is the presence or absence of transmission data for each time zone (for example, one hour) obtained by dividing the first time (D) into a predetermined number.

FIG. 3 is a diagram illustrating an example of a vector as distribution data according to the present embodiment.
Based on the traffic information 21, it is determined whether or not a spam mail is transmitted from the attacking host 2 every hour for a period between the time T and the first time D. Each time zone becomes one element of the vector, the value of the element corresponding to the time zone when the junk mail is transmitted is “1”, and the value of the element corresponding to the time zone when the junk mail is not sent is “0”. It becomes.

For example, since the junk mail was not transmitted from time T to time T + 1, the first term of the vector is “0”, and the junk mail was not transmitted from time T + 1 to time T + 2, so the second term of the vector is “1”.
The analysis apparatus 1 considers all mails transmitted from the attack host 2 as spam mails and generates vectors, thereby reducing the processing load.

The classification unit 13 clusters one or more vectors (first distribution data) having similar distribution characteristics from among a plurality of vectors corresponding to a plurality of hosts, and generates one or more clusters.
Specifically, the classification unit 13 generates a cluster using an unsupervised clustering algorithm such as k-means or X-means. Thereby, the past behavior of the attack host 2 is classified into a plurality of patterns.

  Further, the classification unit 13 assigns meanings indicating the characteristics of the cluster by a vector (for example, a centroid vector) indicating the center of a set of vectors included in each cluster (for example, keeps sending mail, and stops after sending mail). , Send e-mail temporarily (burst), etc.).

  Further, the generation unit 12 relates to the host corresponding to each cluster within the second time after the generation target time (from time T to time T + D) of the vector (first distribution data) (for example, from time T + D to time T + D + D). A new vector (second distribution data) is generated.

  The associating unit 14 extracts distribution features from a set of newly generated vectors (second distribution data), and stores the feature data as analysis data 22 in association with the clusters.

Here, the feature data may be a vector (for example, a centroid vector) indicating the center of a set of vectors (second distribution data). At this time, the associating unit clusters the set of generated vectors (second distribution data), and generates feature data for the cluster having the largest number of elements.
Thereby, the association between the past behavior (features of the first distribution data) and the future behavior (features of the second distribution data) appearing after the past behavior is stored.

When new distribution data classified into one of the clusters is generated within the first time (D) before a certain time after the analysis data 22 is stored, the output unit 15 is the same after this time. Feature data associated with the classified cluster is output as behavior estimation data transmitted by the attacking host 2.
The output unit 15 outputs estimated data of the future behavior of the attack host 2 to the display unit 50 or to an external terminal via the communication unit 30.

  The adjustment unit 16 sets the first time (D) and a predetermined number for dividing the first time, that is, a time interval (for example, one hour) for determining whether or not spam mail is transmitted, to the communication unit 30 or the input unit 40. Adjust based on the specified input from etc.

FIG. 4 is a flowchart showing the generation process of the analysis data 22 according to this embodiment.
In step S <b> 1, the acquisition unit 11 acquires the traffic information 21 of each transmission data from the known attack host 2 via the communication unit 30 and stores it in the storage unit 20.

  In step S2, the generation unit 12 shows the distribution of transmission times related to the same attack host within the first time (D) from the specified time (T) based on the traffic information 21 stored in step S1. A vector (first distribution data) is generated.

  In step S3, the classification unit 13 clusters the vectors (first distribution data) generated in step S2 using a predetermined algorithm to generate one or more clusters.

  In step S4, the generation unit 12 generates a vector (first distribution data) for each cluster generated in step S3 within a second time (for example, from time T + D) after the generation target time (from time T to time T + D). A new vector (second distribution data) is generated for time T + D + D).

  In step S <b> 5, the associating unit 14 extracts distribution features from the set of vectors (second distribution data) generated in step S <b> 4, and stores the feature data as analysis data 22 in association with the corresponding clusters.

FIG. 5 is a flowchart showing the behavior prediction process of the attack host 2 according to the present embodiment.
In step S <b> 11, the acquisition unit 11 acquires the traffic information 21 related to the attack target host 2 to be analyzed via the communication unit 30 and stores it in the storage unit 20.

  In step S <b> 12, the generation unit 12 generates a vector indicating the distribution of junk mail transmission times within the first time (D) up to a certain time, based on the traffic information 21 stored in step S <b> 11.

  In step S13, the output unit 15 determines whether or not the analysis data 22 includes a cluster similar to the vector generated in step S12, that is, a cluster into which the vector can be classified. If this determination is YES, the process proceeds to step S14, and if the determination is NO, the process ends.

  In step S <b> 14, the output unit 15 outputs the feature data associated with the cluster determined in step S <b> 13 as estimated data of the future behavior of the attack host 2. In step S13, when it is not classified into any cluster, the output unit 15 does not output estimated data.

  As described above, according to the present embodiment, the analysis apparatus 1 stores a cluster in which past behaviors of known attack hosts 2 are classified and feature data indicating future behaviors in association with each other. Therefore, when the behavior classified into any cluster can be confirmed for a certain host, the analysis apparatus 1 can predict the future behavior of this host from the feature data associated with this cluster.

As a result, based on the prediction of future behavior, the analysis apparatus 1 determines that, for example, if the junk mail is predicted to be constantly transmitted in the future, the communication with the target attack host 2 is blocked. Can be defeated.
Furthermore, since the network administrator can estimate the behavior of the attack host 2 and calculate the traffic amount when changing the network configuration or adding equipment, it is possible to suppress unnecessary equipment investment.

  Further, the analysis apparatus 1 can easily perform clustering and association of feature data by using numerical data indicating the presence or absence of transmission data for each time zone, specifically, a vector, as distribution data indicating past behavior. it can.

  In addition, the analysis apparatus 1 can suppress noise and improve prediction accuracy by clustering a set of vectors indicating future behavior corresponding to clusters indicating past behavior and selecting a cluster with the largest element.

  Moreover, the analysis apparatus 1 can adjust the period (first time = D) and the number of divisions for generating distribution data. Therefore, when operating the analysis apparatus 1, the administrator can set an appropriate period and the number of divisions according to the situation, and can improve prediction accuracy.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. Further, the effects described in the present embodiment are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the present embodiment.

  The analysis device 1 is an example of an information processing device that can be connected to a network, and may be various information processing devices (computers) such as a server device or a PC (Personal Computer), and each function described above is realized by software. Is done. When realized by software, a program constituting the software is installed in the information processing apparatus. These programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network.

1 Analysis device (attack host behavior analysis device)
DESCRIPTION OF SYMBOLS 10 Control part 11 Acquisition part 12 Generation part 13 Classification part 14 Association part 15 Output part 16 Adjustment part 20 Storage part 21 Traffic information 22 Analysis data 30 Communication part 40 Input part 50 Display part

Claims (8)

With respect to transmission data from a known attack host, an acquisition unit for acquiring the transmission time of each of the transmission data,
A generating unit that generates distribution data indicating a distribution of the transmission time for the same attack host within a first time from a specified time;
A clustering unit that clusters first distribution data having similar distribution characteristics among a plurality of distribution data corresponding to a plurality of hosts, and generates one or more clusters;
For a host corresponding to the cluster, a distribution feature is extracted from a set of second distribution data generated for a second time after the generation target time of the first distribution data, and the feature data is extracted into the cluster. An associating unit for associating and storing;
When new distribution data classified into one of the clusters is generated within a first time before a certain time, it is associated with the cluster as estimated data of behavior transmitted by the same attacking host after that time. An attack host behavior analysis device comprising: an output unit for outputting the feature data.   The attack host behavior analysis device according to claim 1, wherein the distribution data is data indicating presence / absence of transmission data for each time period obtained by dividing the first time into a predetermined number. The distribution data is a vector whose element is the presence or absence of transmission data for each time period,
The attack host behavior analysis device according to claim 2, wherein the feature data is a vector indicating a center of a set of vectors as the distribution data.   4. The attack host behavior analysis according to claim 1, wherein the associating unit clusters the second distribution data set and generates the feature data for a cluster having the largest number of elements. 5. apparatus.   5. The attack host behavior analysis apparatus according to claim 1, further comprising: an adjustment unit configured to adjust the first time and a predetermined number dividing the first time based on a designated input. 6.   The attack host behavior analysis device according to claim 1, wherein the transmission data is a junk mail. With respect to transmission data from a known attack host, an acquisition step of acquiring the transmission time of each of the transmission data;
A generation step of generating distribution data indicating a distribution of the transmission time for the same attack host within a first time from a specified time;
A clustering step of clustering first distribution data having similar distribution characteristics from among the plurality of distribution data corresponding to a plurality of hosts to generate one or more clusters;
For a host corresponding to the cluster, a distribution feature is extracted from a set of second distribution data generated for a second time after the generation target time of the first distribution data, and the feature data is extracted into the cluster. An association step to associate and store;
When new distribution data classified into one of the clusters is generated within a first time before a certain time, it is associated with the cluster as estimated data of behavior transmitted by the same attacking host after that time. An attacking host behavior analysis method in which a computer executes an output step of outputting the feature data. With respect to transmission data from a known attack host, an acquisition step of acquiring the transmission time of each of the transmission data;
A generation step of generating distribution data indicating a distribution of the transmission time for the same attack host within a first time from a specified time;
A clustering step of clustering first distribution data having similar distribution characteristics from among the plurality of distribution data corresponding to a plurality of hosts to generate one or more clusters;
For a host corresponding to the cluster, a distribution feature is extracted from a set of second distribution data generated for a second time after the generation target time of the first distribution data, and the feature data is extracted into the cluster. An association step to associate and store;
When new distribution data classified into one of the clusters is generated within a first time before a certain time, it is associated with the cluster as estimated data of behavior transmitted by the same attacking host after that time. An attack host behavior analysis program for causing a computer to execute the output step of outputting the feature data.

Images