JP2016218788A - Log extraction system, log extraction method, and log extraction program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To surely grasp the execution of an unsteady program by using not only the log of a file operation but also information on the start of a process.SOLUTION: A log extraction system 1 includes: a terminal 10; a log management device 20; and a management terminal 30. The log management device receives a log 12 from a terminal, and stores log information including a process start log indicating a start event of a process of the terminal and a file operation log indicating an operation event of a file in a log storage part 23. A log extraction part 22 receives a trace key set by a trace key setting part 32 of a management terminal, and extracts the process start log or file operation log related to the trace key as a search condition that is a starting point of trace as a trace log, and extracts the process start log or file operation log related to the trace log as the trace log.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a log extraction system, a log extraction method, and a log extraction program.

  Many of the tasks that are routinely performed in the office are carried out while creating and editing electronic files using computers to create documents, spreadsheets, e-mail operations, and web browsing. . In such a computer system, a log management system for storing operations performed on electronic files as a log and grasping the usage status of the electronic file is used.

  Conventionally, forensics technology that collects and accumulates operation logs of unsteady programs that run on a computer system using logs stored in a log management system, and specifies and traces the operation history is known. ing. Note that the unsteady program is a program that is not necessary for business, is prohibited from being used, or is a program that runs on a business terminal, such as malware, on an irregular basis.

  For example, in relation to the forensics technique, a technique for visualizing a log of a large amount of file operation and tracing the operation performed on the file is known (for example, Non-Patent Document 1 or Non-Patent Document 2). reference). Further, a method for extracting a file operation log tree at high speed is known (for example, see Patent Document 1).

JP 2013-161288 A

Shinichi Nakahara, Naoto Fujiki, Shigehiko Ushijima, “Cloud Traceability (CBoC TRX)”, NTT Technical Journal Vol.23, No.10, 2011. Toshihiro Motoda, Tsuyoshi Nagayoshi, Junya Akiba, Makoto Takeuchi, “Traceability Platform TRX”, NTT Technical Journal Vol.26, No.3, 2014.

  However, in the prior art, the file operation log has been accumulated, but there is a problem in that it is not possible to reliably grasp that the unsteady program has been executed because information relating to process startup is not accumulated. .

  For example, in order to ascertain unambiguously that an unsteady program has been executed without fail, it is necessary to refer to a process activation log. However, although Non-Patent Document 1 and Non-Patent Document 2 describe that a file operation log is visualized, there is no description about information related to process activation.

  Specifically, when the accumulated logs are limited to those related to file operation events, the generation and deletion of files can be determined. For example, the log in which process A's own file A is generated and the process It is difficult to connect the file A and the file B without ambiguity to the log in which the file A is generated by the A and the log in which the process B deletes the file A.

  The log extraction system of the present invention includes a process start log indicating a process start event of a terminal, a file operation log indicating a file operation event, a log storage unit for storing log information including a file operation log, and a search as a starting point of a trace The process start log or the file operation log related to the trace key which is a condition is extracted as a trace log, and the other process start log or other file operation log related to the trace log is extracted as a trace log. And an extraction unit.

  The log extraction method of the present invention includes a log accumulation step for accumulating log information including a process activation log indicating a process activation event of a terminal, a file operation log indicating a file operation event, and a search as a starting point of a trace. The process start log or the file operation log related to the trace key which is a condition is extracted as a trace log, and the other process start log or other file operation log related to the trace log is extracted as a trace log. And an extraction step.

  According to the present invention, not only a file operation log but also information related to process activation is used to reliably grasp that an unsteady program has been executed.

FIG. 1 is a diagram illustrating an example of a configuration of a log extraction system according to the first embodiment. FIG. 2A is a diagram illustrating an example of a file operation log in the log extraction system according to the first embodiment. FIG. 2-2 is a diagram illustrating an example of items of a file operation log in the log extraction system according to the first embodiment. FIG. 3A is a diagram illustrating an example of a process activation log in the log extraction system according to the first embodiment. FIG. 3B is a diagram illustrating an example of process activation log items in the log extraction system according to the first embodiment. FIG. 4A is a diagram illustrating a file operation event in the log extraction system according to the first embodiment. FIG. 4B is a diagram illustrating a process activation event in the log extraction system according to the first embodiment. FIG. 5A is a diagram illustrating an example of a connection pattern of events in the log extraction system according to the first embodiment. FIG. 5-2 is a diagram illustrating an example of a connection pattern of events in the log extraction system according to the first embodiment. FIG. 5C is a diagram illustrating an example of a connection pattern of events in the log extraction system according to the first embodiment. FIG. 5-4 is a diagram illustrating an example of a connection pattern of events in the log extraction system according to the first embodiment. FIG. 6 is a diagram illustrating an example of processing of the log extraction system according to the first embodiment. FIG. 7 is a diagram illustrating an example of a malware operation sequence. FIG. 8 is a diagram illustrating an example of a series of logs in the log extraction system according to the first embodiment. FIG. 9 is a diagram illustrating an output example of a log search result in the log extraction system according to the first embodiment. FIG. 10 is a diagram illustrating an example of processing of the log extraction system according to the second embodiment. FIG. 11 is a diagram illustrating an example of a trace log of the log extraction system according to the second embodiment. FIG. 12 is a diagram illustrating an example of a trace log of the log extraction system according to the second embodiment. FIG. 13 is a diagram illustrating an example of processing of the log extraction system according to the third embodiment. FIG. 14 is a diagram illustrating an example of processing of the log extraction system according to the third embodiment. FIG. 15 is a diagram illustrating an example of a file operation log in the log extraction system according to the third embodiment. FIG. 16 is a diagram illustrating an example of a computer in which a log extraction system or a log management apparatus is realized by executing a program.

  Hereinafter, embodiments of a log extraction system, a log extraction method, and a log extraction program according to the present application will be described in detail with reference to the drawings. In addition, the log extraction system, the log extraction method, and the log extraction program according to the present application are not limited by this embodiment.

[Configuration of First Embodiment]
First, the configuration of the log extraction system will be described with reference to FIG. FIG. 1 is a diagram illustrating an example of a configuration of a log extraction system according to the first embodiment. As illustrated in FIG. 1, the log extraction system 1 includes a terminal 10, a log management device 20, and a management terminal 30.

  The terminal 10 includes agent software 11 and transfers a log to the log management apparatus 20. The log management device 20 includes a reception unit 21, a log extraction unit 22, and a log storage unit 23. Further, the log storage unit 23 includes a file operation log storage unit 231 that stores a file operation log indicating a file operation event and a process start log storage unit 232 that stores a process start log indicating a process start event of a terminal. It is. In addition, the management terminal 30 includes a trace key setting unit 32, a query transmission unit 31, and a display unit 33.

  It is assumed that the terminal 10, the log management device 20, and the management terminal 30 are connected to a network and can communicate with each other. Further, agent software 11 having a function of generating and storing logs and a function of transmitting logs to the log management apparatus 20 is installed in the terminal 10. Note that the log generated and transmitted by the agent software 11 includes a file operation log and a process activation log. Further, a plurality of terminals 10 may be provided on the network, and the network may be a LAN (Local Area Network) used in a company, for example. Further, the network may be a logically configured LAN even if the location is divided, or may be directly connected to the Internet.

  The receiving unit 21 of the log management apparatus 20 receives the log from the terminal 10 and registers and stores the received log in the file operation log storage unit 231 and the process activation log storage unit 232 of the log storage unit 23. Further, the log extraction unit 22 receives the trace key set by the trace key setting unit 32 of the management terminal 30 via the query transmission unit 31. Then, the log extraction unit 22 searches the log stored in the log storage unit 23 using the trace key and extracts it as a trace log.

  At this time, the log extraction unit 22 not only searches and extracts the log using the trace key as a search condition, but also traces the process activation log or the file operation log related to the trace key that is the search condition that is the starting point of the trace. A process start log or a file operation log related to the trace log is extracted as a trace log. As a result, the log extraction unit 22 searches for a log directly and indirectly related to the trace key. Then, the log extraction unit 22 transmits the set of searched trace logs to the management terminal 30. Note that the log extraction unit 22 and the log storage unit 23 of FIG. 1 are the minimum configuration of the present invention.

  The process activation log includes information for identifying an execution file associated with a process activation event, a process ID that is an ID of a process executed by the execution file, and a parent process ID that is an ID of a process that executes the execution file. The file operation log includes any one or more, and the file operation log includes information for specifying an input target file associated with a file operation event, information for specifying an output target file, and types of operations performed on the input target file or the output target file Including one or more of the information for identifying the operation type indicating the process ID and the process ID indicating the ID of the process that performs the operation, and the log extracting unit 22 Whether the target file of the file operation log matches The target file of the file operation log in the file and the execution file of the other process startup log match, the process ID of the file operation log in the trace log matches the process ID of the other process startup log, or When the process ID of the process start log in the trace log matches the parent process ID of another process start log, it is determined that the trace log and other process start log or other file operation log are related, and the other The target file of the file operation log or the other process activation log may be extracted as a trace log.

  The query transmission unit 31 of the management terminal 30 transmits a query for searching the log storage unit 23 of the log management device 20 to the log extraction unit 22. Note that the query transmission unit 31 may include the trace key set by the trace key setting unit 32 in the query. The display unit 33 displays a set of trace logs received from the log extraction unit 22 of the log management device 20 on a screen or the like.

  The file operation log will be described with reference to FIGS. FIG. 2A is a diagram illustrating an example of a file operation log in the log extraction system according to the first embodiment. FIG. 2B is a diagram illustrating an example of file operation log items in the log extraction system according to the first embodiment. The occurrence of an incident represents the occurrence of a file operation event and a process activation event.

As shown in FIG. 2-2, “occurrence time” is the time when the incident occurred, “domain name” is the domain name or computer name, “user name” is the name of the user who performed the file operation, and “process name” is the file The process name of the process that performed the operation, “Process ID” is the process ID of the process that performed the file operation, “Operation Type” is a character string that represents the update content,
“Read”, “Create”, “Modify”, “Rename”, “SaveAs”, “Move”, “Copy”, “Delete”, “ToRecycler”, “FromRecycler” are included. “Operation source file name” is the name of the file to be operated, “Operation source file path” is the file full path to be operated, “Operation source file size” is the file size to be operated, “Operation file “Name” indicates the name of the new file, “Operation destination file path” indicates the full path of the new file, and “Operation destination file size” indicates the file size of the new file. The “operation type” specifically indicates the type of operation performed on the input target file or the output target file.

  In the example of the file operation log illustrated in FIG. 2A, the occurrence time is “2011/12/12 12: 15: 23.223”, the domain name is “PC_01”, the user name is “User_A”, and the process name is “notepad. exe ", process ID is" 2353 ", operation type is" Create ", operation source file name is" minutes.txt ", operation source file path is" C: \ My Documents \ minutes.txt ", operation source file The size is “11KByte”. Also, information on the operation destination file name, operation destination file path, and operation destination file size is not included. The file operation log only needs to include information on one of the original file and the destination file. For example, when a file is deleted, the operation destination file does not exist. When the file name is changed, a file having a different file name from the operation source file exists as the operation destination file.

  The process activation log will be described with reference to FIGS. 3-1 and 3-2. FIG. 3A is a diagram illustrating an example of a process activation log in the log extraction system according to the first embodiment. FIG. 3B is a diagram illustrating an example of process activation log items in the log extraction system according to the first embodiment.

  As shown in FIG. 3-2, “occurrence time” is the time when the incident occurred, “domain name” is the domain name or computer name, “user name” is the name of the user who executed the process, and “execution process name” is the execution "Command line" is the process execution command line, "Execution file path" is the file path of the executed process, "Process ID" is the process ID of the execution process, and "Parent process ID" is the execution The process ID of the parent process of the process is shown. “Process ID” can also be referred to as an ID of a process executed by an execution file, and “parent process ID” can be referred to as an ID of a process for executing an execution file.

  In the example of the process startup log shown in FIG. 3A, the occurrence time is “2011/12/12 12: 15: 23.223”, the domain name is “PC_01”, the user name is “User_A”, and the execution process name is “notepad”. .exe ", the execution file path is" C: \ Windows \ System32 \ notepad.exe ", the process ID is" 2353 ", and the parent process ID is" 260 ". As shown in FIG. 3A, for example, when a process is activated by a mouse click, a command line is not included. On the other hand, for example, when a process is started from the command line, a command line such as “notepad.exe” is included.

  A file operation event and a process activation event will be described with reference to FIGS. 4A and 4B. FIG. 4A is a diagram illustrating a file operation event in the log extraction system according to the first embodiment. FIG. 4B is a diagram illustrating a process activation event in the log extraction system according to the first embodiment.

  FIG. 4A schematically illustrates a file operation event. The Src file and the Dst file in FIG. 4A correspond to the operation source file and the operation destination file of the file operation log, respectively. The file operation corresponds to the operation type of the file operation log, and the PID corresponds to the process ID.

  FIG. 4B schematically shows a process activation event. The parent PID and PID in FIG. 4-2 correspond to the parent process ID and process ID of the process activation log, respectively. An executable file is an executable file for executing a process.

The log extraction unit 22 searches for a log that satisfies any of the following four conditions as a related log.
(Condition 1) The target file of the file operation log matches the target file of the other file operation log. (Condition 2) The target file of the file operation log matches the execution file of the other process startup log (Condition 3) The process ID of the file operation log matches the process ID of the other process startup log. (Condition 4) The process ID of the process startup log matches the parent process ID of the other process startup log.

  A connection pattern in the case where the log satisfies the above (1) to (4) will be described with reference to FIGS. FIG. 5A to FIG. 5D are diagrams illustrating examples of event connection patterns in the log extraction system according to the first embodiment. In FIGS. 5-1 to 5-4, PID indicates a process ID.

  FIG. 5A shows (Condition 1), that is, a case where the target file of the file operation log matches the target file of another file operation log. As shown in FIG. 5A, the Dst file of the file operation event 511 matches the Src file of the file operation event 512. The connection pattern shown in FIG. 5A is generated by, for example, an operation of further copying the copied derived file.

  FIG. 5B shows (Condition 2), that is, a case where the target file of the file operation log matches the execution file of another process activation log. As shown in FIG. 5A, the Dst file of the file operation event 512a matches the execution file of the process activation event 522a. As shown in FIG. 5B, the Src file of the file operation event 521b matches the execution file of the process activation event 522b. The connection pattern shown in FIG. 5A is generated by, for example, an operation of copying and starting an execution file. The connection pattern shown in FIG. 5B is generated by, for example, an operation for deleting an execution file after starting a process.

  FIG. 5C illustrates (Condition 3), that is, the case where the process ID of the file operation log matches the process ID of another process activation log. As illustrated in FIG. 5C, the process ID of the file operation event 531 matches the process ID of the process activation event 532. The connection pattern shown in FIG. 5C occurs, for example, when the activated process duplicates a file.

  FIG. 5-4 shows (Condition 4), that is, the case where the process ID of the process activation log matches the parent process ID of another process activation log. As shown in FIG. 5-4, the process ID of the process activation event 541 matches the process ID of the process activation event 542. The connection pattern shown in FIG. 5-4 occurs, for example, when the parent process starts a child process.

[Process of First Embodiment]
First, the process of the log extraction system 1 will be described with reference to FIG. Thereafter, the flow until the log extraction system 1 actually extracts the trace log from the trace key will be described with reference to FIGS.

  FIG. 6 is a diagram illustrating an example of processing of the log extraction system according to the first embodiment. First, the management terminal 30 inputs the trace key set by the trace key setting unit 32 to the log extraction unit 22 of the log management device 20 via the query transmission unit 31 (step S101).

  Then, the log extraction unit 22 of the log management apparatus 20 searches the log of the log storage unit 23 using the trace key and extracts it as a trace log (step S102). The logs searched at this time include a file operation log and a process activation log. Specific search processing will be described later. Thereafter, the log extraction unit 22 selects one of the extracted trace logs as a search trace log and outputs it to the management terminal 30 (step S103).

Furthermore, the log extraction unit 22 of the log management device 20 searches and extracts a file operation log or a process activation log that satisfies a predetermined condition from the log storage unit 23 using the search trace log (step S104). Here, the predetermined conditions are, for example, the following four conditions.
(Condition 1) The target file of the file operation log matches the target file of the other file operation log. (Condition 2) The target file of the file operation log matches the execution file of the other process startup log (Condition 3) The process ID of the file operation log matches the process ID of the other process startup log. (Condition 4) The process ID of the process startup log matches the parent process ID of the other process startup log.

  Then, the log extraction unit 22 selects a search trace log that has not been selected from the extracted trace logs, and outputs it to the management terminal 30 (step S105). If all the trace logs have been selected, nothing is selected (step S105). When a new search trace log is selected (step S106, Yes), the log extraction unit 22 searches and extracts a file operation log or process activation log that satisfies a predetermined condition from the log storage unit 23. (Step S104). If no new search trace log is selected (step S106, No), the log extraction unit 22 ends the process.

  Next, the processing of the log extraction system 1 will be described with a specific example. It is assumed that the log extraction system 1 and the operating system on which malware operates in the following description is Windows (registered trademark). FIG. 7 is a diagram illustrating an example of a malware operation sequence. As shown in FIG. 7, first, the malware introduction program (mdload.exe) is downloaded through a malicious website by a browser (iexplorer.exe) or the like. Malware is often disguised as a useful utility. Here, as an example, it is assumed that it is disguised as winword.exe.

  After the download, the malware introduction program is saved (11a), and the malware introduction program is executed by the user by double clicking or the like (21b). Next, the malware introduction program downloads (21b), stores (12a), and executes (22b) the first malware (winword.exe).

  Then, startup registration (13a) is performed by the executed first malware so that blacken2.exe, which is the second malware, is executed at startup. Thereafter, when Windows restarts, blacken2.exe is started to access the Web site, and the illegally read information is transmitted from the terminal (23b). Finally, blacken2.exe reads the transmission information (14a) and deletes itself (blacken2.exe) (15a).

  A method for searching the file operation log and the process activation log of each operation sequence will be described with reference to FIG. FIG. 8 is a diagram illustrating an example of a series of logs in the log extraction system according to the first embodiment. First, the executable file “winword.exe” is set as a trace key. Although the execution file name is used as a trace key here, the trace key may be a process ID or a process name, or may be a log itself.

  As shown in FIG. 8, a process activation log 22b including the trace key in the execution file path is searched. And the execution file path of 22b and the original file path of 12a which is a file operation log correspond (condition 2). Further, the process ID of 12a that is the file operation log and the process ID of 21b that is the process activation log match (condition 3). In addition, the execution file path 21b, which is the process activation log, matches the original file path 11a, which is the file operation log (condition 3). In addition, the execution file path 21b that is the process activation log and the original file path 11a that is the file operation log match (condition 2).

  Further, the process ID 22b which is the process activation log and the process ID 13a which is the file operation log match (condition 3). Further, the original file path 13a that is the file operation log matches the execution file path 23b that is the process activation log (condition 2). Further, the process ID of 23b, which is the process activation log, and the process ID of 14a, which is the file operation log, match (condition 3). Further, the execution file path 23b, which is the process activation log, matches the original file path 15a, which is the file operation log (condition 2).

  The above search results are shown in FIG. FIG. 9 is a diagram illustrating an output example of a log search result in the log extraction system according to the first embodiment. As shown in FIG. 9, the target file of 11a and the execution file of 21b, the process ID of 21b and the process ID of 12a, the target file of 12a and the execution file of 22b, the process ID of 22b and the process ID of 13a, the target of 13a The file and the execution file of 23b, the process ID of 23b and the process ID of 14a, and the execution file of 23b and the target file of 15a are associated with each other.

Moreover, when the specific example demonstrated is applied to the flowchart of FIG. 6, it will become as follows, for example.
(1) Input the execution file “winword.exe” as a trace key (step S101)
(2) Extract 22b as a search trace log from the log storage unit 23 using the trace log (step S102)
(3) 22b is selected as a search trace log and output to the management terminal 30 (step S103)
(4) Extract 12a and 13a as trace logs from the log storage unit 23 using 22b (step S104)
(5) 12a is selected as a search trace log and output to the management terminal 30 (step S103)
Selected: 12a
Unselected: 13a
(6) Extract 21b as a trace log from the log storage unit 23 using 12a (step S104)
(7) 21b is selected as a search trace log (step S105)
Selected: 12a, 21b
Unselected: 13a
(8) Since the search trace log is selected, the processing is continued (Yes in step S106).
(9) Extract 11a as a trace log from the log storage unit 23 using 21b (step S104)
(10) 11a is selected as a search trace log (step S105)
Selected: 12a, 21b, 11a
Unselected: 13a
(11) Since the search trace log is selected, the process is continued (Yes in step S106).
(12) Since there is no log related to 11a, nothing is extracted (step S104).
(13) Select 13a as a search trace log (step S105)
Selected: 12a, 21b, 11a, 13a
Unselected: None (14) Since the search trace log is selected, the processing is continued (Yes in step S106).
(15) 23b is extracted as a trace log from the log storage unit 23 using 13a (step S104)
(16) Select 23b as a search trace log (step S105)
Selected: 12a, 21b, 11a, 13a, 23b
Unselected: None (17) Since the search trace log has been selected, the processing is continued (Yes in step S106).
(18) Extract 14a and 15a as trace logs from the log storage unit 23 using 23b (step S104)
(19) 14a is selected as a search trace log (step S105)
Selected: 12a, 21b, 11a, 13a, 23b, 14a
Not selected: 15a
(20) Since the search trace log has been selected, the processing is continued (step S106, Yes).
(21) Since there is no log related to 14a, nothing is extracted (step S104).
(22) 15a is selected as a search trace log (step S105)
Selected: 12a, 21b, 11a, 13a, 23b, 14a, 15a
Unselected: None (23) Since the search trace log is selected, the processing is continued (Yes in step S106).
(24) Since there is no log related to 15a, nothing is extracted (step S104).
(25) Since there is no unselected log, no trace log is selected (step S105).
Selected: 12a, 21b, 11a, 13a, 23b, 14a, 15a
Unselected: None (26) Since the search trace log has not been selected, the process ends (No in step S106).

[Effect of the first embodiment]
Log information including a process activation log indicating a process activation event of the terminal 10 and a file operation log indicating a file operation event is accumulated in the log accumulation unit 23, and the log extraction unit 22 performs a search as a starting point of the trace. A process start log or file operation log related to the trace key as a condition is extracted as a trace log, and a process start log or file operation log related to the trace log is extracted as a trace log. The process start log includes information for specifying an execution file, a process ID, and a parent process ID associated with the process start event, and the file operation log includes an input target file, an output target file, an operation type, a process associated with the file operation event. Contains information identifying the ID. Then, the log extraction unit 22
(1) The target file of one file operation log matches the target file of another file operation log. (2) The target file of one file operation log matches the execution file of another process startup log. (3) One (4) The process ID of one process startup log and the parent process ID of another process startup log match. In this case, it is determined that the target file of one file operation log or one process start log is related to the target file of another file operation log or another process start log.

  As a result, the process activation log and the file operation log can be associated with each other, and it is possible to reliably grasp that the unsteady program has been executed.

[Second Embodiment]
By adding a predetermined selection condition when searching the accumulated log, an output suitable for the purpose of use of the trace log can be obtained. As a second embodiment, for example, a case where a trace of a zero-day attack by malware is detected by adding an incident occurrence time as a selection condition will be described.

  Specifically, the log extraction unit 22 acquires vulnerability disclosure date / time, patch application date / time and a trace key based on vulnerability information of a program operating on the terminal 10 and a patch application result for the vulnerability, Outputs a trace log whose occurrence time is between the vulnerability disclosure date and the patch application date.

[Configuration of Second Embodiment]
In the log extraction system 1 of the second embodiment, the log extraction unit 22 can search not only related logs but also logs based on conditions specified as selection conditions. Moreover, the query transmission part 31 of the management terminal 30 transmits the query which set not only the trace key but the range of incident occurrence time as a selection condition, for example. Other configurations are the same as those of the first embodiment.

[Process of Second Embodiment]
In the second embodiment, the trace log that satisfies the selection condition is output to the management terminal 30. Therefore, the log management device 20 determines whether or not the trace log selected as the search trace log satisfies the selection condition. The process of the log extraction system 1 according to the second embodiment will be described with reference to FIG. FIG. 10 is a diagram illustrating an example of processing of the log extraction system according to the second embodiment.

  First, the management terminal 30 inputs vulnerability information to the log extraction unit 22 of the log management device 20 (step S201). Then, the trace key, selection condition 1 and selection condition 2 are determined from the vulnerability information (step S202).

  Then, the log extraction unit 22 of the log management apparatus 20 searches the log of the log storage unit 23 using the trace key and extracts it as a trace log (step S203). The logs searched at this time include a file operation log and a process activation log. Further, specific search processing is the same as in the first embodiment. Thereafter, the log extraction unit 22 selects one of the extracted trace logs as a search trace log (step S204).

  Here, the log extraction unit 22 determines whether or not the search trace log satisfies the selection condition 1 (step S205). If the search trace log satisfies the selection condition 1 (step S205, Yes), the log extraction unit 22 determines whether the search trace log satisfies the selection condition 2 (step S206). . Furthermore, when the search trace log satisfies the selection condition 2 (step S206, Yes), the log extraction unit 22 outputs the search trace log to the management terminal 30 (step S207).

  When the search trace log does not satisfy the selection condition 1 (step S205, No), or when the search trace log does not satisfy the selection condition 2 (step S206, No), the search trace log is sent to the management terminal 30. Proceed to the next process without outputting.

  Next, the log extraction unit 22 of the log management device 20 searches and extracts a file operation log or process activation log satisfying a predetermined condition from the log storage unit 23 using the search trace log (step S208). Here, the predetermined conditions are the same as those in the first embodiment.

  Then, the log extraction unit 22 selects a search trace log that has not been selected from the extracted trace logs, and outputs the selected trace log to the management terminal 30 (step S209). If all trace logs have been selected, nothing is selected (step S209). When a new search trace log is selected (step S210, Yes), the log extraction unit 22 determines whether the search trace log satisfies the selection condition 1 (step S205). If no new search trace log is selected (step S210, No), the log extraction unit 22 ends the process.

Here, with reference to FIG. 11 and FIG. 12, the process of the second embodiment will be described with a specific example. In this case, the purpose is to output a trace log in order to detect a trace of a zero-day attack. First, selection condition 1 and selection condition 2 are set as follows. Here, t ₁ indicates a patch release timing, and t ₂ indicates a patch application completion timing. In addition, the activation of “Bash.exe” is used as a trace key.
(Selection condition 1)
The execution file name is “Bash.exe”, the operation type is “Read”, and the operation file name is “secret.ini”.
(Selection condition 2)
Period incident occurs is between t ₁ of t _2.

First, the process when the zero-day attack is negative will be described with reference to FIG. FIG. 11 is a diagram illustrating an example of a log of the log extraction system according to the second embodiment. In this case, the following processing is performed.
(1) From the input vulnerability information, select “Bash.exe” as a trace key and determine selection condition 1 and selection condition 2 (steps S201 and S202).
(2) Extracting 221b as a search trace log from the log storage unit 23 using the trace log (step S203)
(3) Select 221b as a search trace log (step S209)
Selected: 221b
Not selected: None (4) Since 221b does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S205).
(5) Extract 216a and 211a as trace logs from the log storage unit 23 using 221b (step S208)
(6) Select 211a as a search trace log (step S209)
Selected: 221b, 211a
Unselected: 216a
(7) Since the search trace log has been selected, the processing is continued (step S210, Yes).
(8) Since 211a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S205).
(9) 212a and 215a are extracted as trace logs from the log storage unit 23 using 211a (step S208).
(10) Select 212a as the search trace log (step S209)
(11) Since the search trace log is selected, the process is continued (step S210, Yes).
Selected: 221b, 211a, 212a
Unselected: 216a, 215a
(12) Since 212a does not satisfy the selection condition 1, it is not output to the management terminal 30 (step S205, No).
(13) Extract 213a as a trace log from the log storage unit 23 using 212a (step S208)
(14) Select 213a as the search trace log (step S209)
(15) Since the search trace log is selected, the process is continued (step S210, Yes).
Selected: 221b, 211a, 212a, 213a
Unselected: 216a, 215a
(16) Since 213a does not satisfy the selection condition 1, it is not output to the management terminal 30 (step S205, No).
(17) 214a is extracted as a trace log from the log storage unit 23 using 213a (step S208).
(18) Select 214a as the search trace log (step S209)
(19) Since the search trace log is selected, the process is continued (step S210, Yes).
Selected: 221b, 211a, 212a, 213a, 214a
Unselected: 216a, 215a
(20) Since 214a does not satisfy the selection condition 1, it is not output to the management terminal 30 (step S205, No).
(21) Since there is no log related to 214a, nothing is extracted (step S208).
(22) Select 215a as a search trace log (step S209)
(23) Since the search trace log is selected, the process is continued (step S210, Yes).
Selected: 221b, 211a, 212a, 213a, 214a, 215a
Unselected: 216a
(24) Since 215a does not satisfy the selection condition 1, it is not output to the management terminal 30 (step S205, No).
(25) Since there is no log related to 214a, nothing is extracted (step S208).
(26) Select 215a as a search trace log (step S209)
(27) Since the search trace log has been selected, the processing is continued (step S210, Yes).
Selected: 221b, 211a, 212a, 213a, 214a, 215a
Unselected: 216a
(28) Since 215a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S205).
(29) Since there is no log related to 214a, nothing is extracted (step S208).
(30) Select 216a as the search trace log (step S209)
(31) Since the search trace log is selected, the process is continued (step S210, Yes).
Selected: 221b, 211a, 212a, 213a, 214a, 215a, 216a
Not selected: None (32) Since 216a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S205).
(33) Extract 217a as a trace log from the log storage unit 23 using 216a (step S208)
(34) Select 217a as the search trace log (step S209).
(35) Since the search trace log has been selected, the processing is continued (Yes in step S210).
Selected: 221b, 211a, 212a, 213a, 214a, 215a, 216a, 217a
Not selected: None (36) Since 217a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S205).
(37) 222b is extracted as a trace log from the log storage unit 23 using 217a (step S208).
(38) 222b is selected as the search trace log (step S209).
(39) Since the search trace log has been selected, the processing is continued (step S210, Yes).
Selected: 221b, 211a, 212a, 213a, 214a, 215a, 216a, 217a, 222b
Not selected: None (40) 222b does not satisfy the selection condition 1, and is not output to the management terminal 30 (No in step S205).
(41) Since there is no log related to 222b, nothing is extracted (step S208).
(42) No trace log is selected because there is no unselected log (step S209).
(43) Since the search trace log has not been selected, the process ends (No in step S210).
In this case, since the log output to the management terminal 30, that is, the log satisfying the selection condition 1 and the selection condition 2 does not exist, it can be said that the zero-day attack is negative.

Next, processing when the zero-day attack is positive will be described with reference to FIG. FIG. 12 is a diagram illustrating an example of a log of the log extraction system according to the second embodiment. In this case, the following processing is performed.
(1) “Bash.exe” is selected from the input vulnerability information as a trace key, and selection conditions 1 and 2 are determined (steps S201 and S202).
(2) Extracting 321b as a search trace log from the log storage unit 23 using the trace log (step S203)
(3) Select 321b as a search trace log (step S209)
Selected: 321b
Not selected: None (4) Since 321b does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S205).
(5) Extract 316a and 311a as trace logs from the log storage unit 23 using 321b (step S208)
(6) Select 311a as a search trace log (step S209)
Selected: 321b, 311a
Unselected: 316a
(7) Since the search trace log has been selected, the processing is continued (step S210, Yes).
(8) Since 311a does not satisfy the selection condition 1, it is not output to the management terminal 30 (step S205, No).
(9) 312a and 315a are extracted as trace logs from the log storage unit 23 using 311a (step S208).
(10) Select 312a as a search trace log (step S209)
(11) Since the search trace log is selected, the process is continued (step S210, Yes).
Selected: 321b, 311a, 312a
Unselected: 316a, 315a
(12) Since 312a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S205).
(13) Extract 313a as a trace log from the log storage unit 23 using 312a (step S208)
(14) Select 313a as a search trace log (step S209)
(15) Since the search trace log is selected, the process is continued (step S210, Yes).
Selected: 321b, 311a, 312a, 313a
Unselected: 316a, 315a
(16) Since 313a does not satisfy the selection condition 1, it is not output to the management terminal 30 (step S205, No).
(17) Extract 314a as a trace log from the log storage unit 23 using 313a (step S208)
(18) Select 314a as a search trace log (step S209)
(19) Since the search trace log is selected, the process is continued (step S210, Yes).
Selected: 321b, 311a, 312a, 313a, 314a
Unselected: 316a, 315a
(20) Since 314a does not satisfy the selection condition 1, it is not output to the management terminal 30 (step S205, No).
(21) Since there is no log related to 314a, nothing is extracted (step S208).
(22) Select 315a as a search trace log (step S209)
(23) Since the search trace log is selected, the process is continued (step S210, Yes).
Selected: 321b, 311a, 312a, 313a, 314a, 315a
Unselected: 316a
(24) Since 315a satisfies the selection condition 1 and the selection condition 2, it is output to the management terminal 30 (steps S205, Yes, S206, Yes, S207).
(25) Since there is no log related to 314a, nothing is extracted (step S208).
(26) Select 315a as the search trace log (step S209)
(27) Since the search trace log has been selected, the processing is continued (step S210, Yes).
Selected: 321b, 311a, 312a, 313a, 314a, 315a
Unselected: 316a
(28) Since 315a does not satisfy the selection condition 1, it is not output to the management terminal 30 (step S205, No).
(29) Since there is no log related to 314a, nothing is extracted (step S208).
(30) Select 316a as a search trace log (step S209)
(31) Since the search trace log is selected, the process is continued (step S210, Yes).
Selected: 321b, 311a, 312a, 313a, 314a, 315a, 316a
Not selected: None (32) Since 316a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S205).
(33) Extract 317a as a trace log from the log storage unit 23 using 316a (step S208)
(34) Select 317a as a search trace log (step S209)
(35) Since the search trace log has been selected, the processing is continued (Yes in step S210).
Selected: 321b, 311a, 312a, 313a, 314a, 315a, 316a, 317a
Not selected: None (36) Since 317a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S205).
(37) 322b is extracted as a trace log from the log storage unit 23 using 317a (step S208).
(38) Select 322b as a search trace log (step S209)
(39) Since the search trace log has been selected, the processing is continued (step S210, Yes).
Selected: 321b, 311a, 312a, 313a, 314a, 315a, 316a, 317a, 322b
Not selected: None (40) Since 322b does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S205).
(41) Since there is no log related to 322b, nothing is extracted (step S208).
(42) No trace log is selected because there is no unselected log (step S209).
(43) Since the search trace log has not been selected, the process ends (No in step S210).
In this case, since the log output to the management terminal 30, that is, the log satisfying the selection condition 1 and the selection condition 2 exists, it can be said that the zero-day attack is positive.

[Effects of Second Embodiment]
The log extraction unit 22 acquires vulnerability disclosure date / time, patch application date / time, and trace key based on vulnerability information of the program that was operating on the terminal 10 and the patch application result for the vulnerability, and the range of occurrence time is Outputs a trace log between the vulnerability release date and the patch application date. Thereby, in order to achieve the purpose of detecting the trace of the zero-day attack, the trace log can be extracted and output without performing unnecessary processing.

[Third Embodiment]
In the third embodiment, the log extraction unit 22 traces a file operation log that forms a tree structure in relation to the trace log when the file operation log forms a tree structure that is associated with each other. Extract all at once as a log. Specifically, the file operation log can be searched at high speed by applying existing high-speed tree extraction means (for example, see Patent Document 1). In the log extraction system of the third embodiment, high-speed tree extraction means is applied.

[Configuration of Third Embodiment]
In the log extraction system 1 according to the third embodiment, the log extraction unit 22 uses high-speed tree extraction means. Other configurations are the same as those of the second embodiment. In the description of the third embodiment, search of the process activation log is not described, but a preliminary search of the file operation log is performed by high-speed tree extraction means, and the first embodiment or the second embodiment. The file operation log and the process activation log may be searched by the method according to the embodiment.

  In the third embodiment, it is assumed that a family ID is assigned to the file operation log by the following process as a premise (for details, see paragraphs 0024 to 0040 of Patent Document 1). First, the file operation log as a node of the tree is classified into a root having only a derivation destination, a branch having both derivation source and derivation destination, and a leaf having only the derivation source. In addition, arbitrary ID shall be attached | subjected to the root. Next, branches and leaves derived from the root are recursively searched, and the same ID as the root is assigned as the family ID.

[Process of Third Embodiment]
First, with reference to FIG. 13, a description will be given of processing in the case where DTS (Distributed Tree Search), that is, high-speed tree extraction means is not applied. FIG. 13 is a diagram illustrating an example of processing of the log extraction system according to the third embodiment. As shown in FIG. 13, first, the management terminal 30 determines the trace key and selection condition 1 and inputs them to the log extraction unit 22 (step S301).

  Then, the log extraction unit 22 of the log management device 20 searches and extracts the log tree group of the log storage unit 23 using the trace key (step S302). The tree searched at this time includes a file operation log. Then, the log extraction unit 22 selects an unselected tree so far from the extracted tree group, and selects the first log of the selected tree as a search node (step S303).

  Here, the log extracting unit 22 determines whether the search node satisfies the selection condition 1 (step S304). If the search node satisfies the selection condition 1 (step S304, Yes), the log extraction unit 22 outputs the search node to the management terminal 30 (step S305).

  If the search node does not satisfy the selection condition 1 (No in step S304), the process proceeds to the next process without outputting the search trace log to the management terminal 30.

Next, the log extraction unit 22 of the log management apparatus 20 searches and extracts a file operation log that satisfies the following conditions from the log storage unit 23 using the search node (step S306).
(Condition 1) The target file of the file operation log matches the target file of another file operation log

  Then, an unselected file operation log extracted so far is selected as a search node (step S307). If all the file operation logs included in the selected tree have been selected, nothing is selected (step S307). If a new search node is selected (step S308, Yes), the log extraction unit 22 determines whether the search node satisfies the selection condition 1 (step S304).

  If a new search node has not been selected (No at Step S308), the log extracting unit 22 checks whether or not an unselected tree exists (Step S309). When an unselected tree exists (step S309, Yes), the log extraction unit 22 selects an unselected tree so far from the extracted trace logs, and searches the first log of the selected tree. It selects as a node for use (step S303). When there is no unselected tree (step S309, No), the log extraction unit 22 ends the process.

  Next, processing when a high-speed tree extraction unit is applied will be described with reference to FIG. FIG. 14 is a diagram illustrating an example of processing of the log extraction system according to the third embodiment. As shown in FIG. 14, first, the management terminal 30 determines the trace key and selection condition 1 and inputs them to the log extraction unit 22 (step S351).

  Then, the log extraction unit 22 of the log management device 20 searches and extracts the log tree group of the log storage unit 23 using the trace key (step S352). The tree searched at this time includes a file operation log. Then, the log extraction unit 22 selects an unselected tree so far from the extracted tree group, and extracts a node corresponding to the family ID of the selected tree (step S353). Next, the log extraction unit 22 outputs the extracted nodes that satisfy the selection condition 1 to the management terminal 30 (step S354).

  The log extraction unit 22 confirms whether or not an unselected tree exists (step S355). Here, when an unselected tree exists (step S355, Yes), the log extracting unit 22 selects an unselected tree so far from the extracted tree group, and sets the family ID of the selected tree. A corresponding node is extracted (step S353). When there is no unselected tree (step S355, No), the log extraction unit 22 ends the process.

Here, the processing of the third embodiment will be described using a specific example with reference to FIG. Selection condition 1 is set as follows.
(Selection condition 1)
The trace key and execution user are different.
In reality, it is assumed that there are 1000 trees shown in FIG. 15, that is, a group of file operation logs. Further, as described above, it is assumed that the same family ID is attached to the file operation logs included in the same tree. First, when the flowchart shown in FIG. 13 is applied, the following processing is performed.

(1) Determine and input the trace key (share.exe) and selection condition 1 (step S301)
(2) Search and extract log tree group from log storage unit 23 using trace log (step S302)
(3) Select an unselected tree so far from the extracted tree group, and select the first log of the selected tree as a search node (step S303).
Here, the trace key is 121b, the selected trees are 121b, 112a, 113a, 114a, 115a, 116a, 117a, 118a, 119a, and 120a, and the search node is 112a.
Selected: 112a
Not selected: None (4) Since 112a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S304).
(5) Extract 113a as a file operation log from the log storage unit 23 using 112a (step S306)
(6) Select 113a as a search node (step S307)
Selected: 112a, 113a
Not selected: None (7) Since the search node has been selected, the processing is continued (Yes in step S308).
(8) Since 113a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S304).
(9) 114a is extracted as a file operation log from the log storage unit 23 using 113a (step S306).
(10) Select 114a as a search node (step S307)
Selected: 112a, 113a, 114a
Unselected: None (11) Since the search node has been selected, the processing is continued (Yes in step S308).
(12) Since 114a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S304).
(13) 115a, 117a, and 118a are extracted as file operation logs from the log storage unit 23 using 114a (step S306).
(14) Select 115a as a search node (step S307)
Selected: 112a, 113a, 114a, 115a
Not selected: 117a, 118a
(15) Since the search node is selected, the process is continued (Yes in step S308).
(16) Since 115a does not satisfy the selection condition 1, it is not output to the management terminal 30 (step S304, No).
(17) 116a is extracted as a file operation log from the log storage unit 23 using 115a (step S306).
(18) Select 116a as a search node (step S307)
Selected: 112a, 113a, 114a, 115a, 116a
Not selected: 117a, 118a
(19) Since the search node has been selected, the processing is continued (Yes in step S308).
(20) Since 116a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S304).
(21) Since there is no log related to 116a, nothing is extracted (step S306).
(22) Select 117a as a search node (step S307)
Selected: 112a, 113a, 114a, 115a, 116a, 117a
Unselected: 118a
(23) Since the search node has been selected, the processing is continued (Yes in step S308).
(24) Since 115a does not satisfy the selection condition 1, it is not output to the management terminal 30 (No in step S304).
(25) Since there is no log related to 116a, nothing is extracted (step S306).
(26) Select 118a as a search node (step S307)
Selected: 112a, 113a, 114a, 115a, 116a, 117a, 118a
Unselected: None
(27) Since the search node is selected, the processing is continued (Yes in step S308).
(28) Since 118a does not satisfy the selection condition 1, it is not output to the management terminal 30 (step S304, No).
(29) Extract 119a as a file operation log from the log storage unit 23 using 118a (step S306)
(30) Select 119a as a search node (step S307)
Selected: 112a, 113a, 114a, 115a, 116a, 117a, 118a, 119a
Unselected: None
(31) Since the search node has been selected, the processing is continued (Yes in step S308).
(32) Since 119a does not satisfy the selection condition 1, it is not output to the management terminal 30 (step S304, No).
(33) 120a is extracted as a file operation log from the log storage unit 23 using 119a (step S306).
(34) Select 120a as a search node (step S307)
Selected: 112a, 113a, 114a, 115a, 116a, 117a, 118a, 119a, 120a
Unselected: None
(35) Since the search node has been selected, the processing is continued (Yes in step S308).
(36) Since 119a satisfies selection condition 1 (step S304, Yes), it is output to the management terminal 30 (step S305).
(37) Since there is no log related to 116a, nothing is extracted (step S306).
(38) If there is an unselected tree group (step S309, Yes), the process is repeated. If not (step S309, No), the log extracting unit 22 ends the process.

Next, when the flowchart shown in FIG. 14 is applied, the following processing is performed.
(1) Determine and input the trace key (share.exe) and selection condition 1 (step S351)
(2) Search and extract log tree group from log storage unit 23 using trace log (step S352)
(3) Select an unselected tree so far from the extracted tree group, and extract a node corresponding to the family ID of the selected tree (step S353)
(4) A node satisfying the selection condition 1 among the extracted nodes is output to the management terminal 30 (step S354).
(5) When there is an unselected tree group (step S355, Yes), the process is repeated. When there is no tree group (step S355, No), the log extracting unit 22 ends the process.

[Effect of the third embodiment]
When a tree structure in which file operation logs are associated with each other is formed, the log extraction unit 22 extracts the file operation logs that form a tree structure related to the trace log as a trace log. As a result, the trace log extraction process can be performed efficiently.

[System configuration, etc.]
Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. Further, all or any part of each processing function performed in each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic.

  In addition, among the processes described in the present embodiment, all or part of the processes described as being automatically performed can be manually performed, or the processes described as being manually performed can be performed. All or a part can be automatically performed by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above-described document and drawings can be arbitrarily changed unless otherwise specified.

[program]
FIG. 16 is a diagram illustrating an example of a computer in which a log extraction system or a log management apparatus is realized by executing a program. The computer 1000 includes a memory 1010 and a CPU 1020, for example. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to the display 1130, for example.

  The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the log extraction system 1 or the log management device 20 is implemented as a program module 1093 in which a code executable by a computer is described. The program module 1093 is stored in the hard disk drive 1090, for example. For example, a program module 1093 for executing processing similar to the functional configuration in the log extraction system 1 or the log management device 20 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

  The setting data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 and executes them as necessary.

  The program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN, WAN (Wide Area Network), etc.). The program module 1093 and the program data 1094 may be read by the CPU 1020 from another computer via the network interface 1070.

DESCRIPTION OF SYMBOLS 1 Log extraction system 10 Terminal 11 Agent software 20 Log management apparatus 21 Reception part 22 Log extraction part 23 Log storage part 231 File operation log storage part 232 Process starting log storage part 30 Management terminal 31 Query transmission part 32 Trace key setting part 33 Display Part

Claims (6)

A log accumulation unit that accumulates log information including a process activation log indicating a process activation event of a terminal and a file operation log indicating a file operation event;
The process start log or the file operation log related to the trace key that is the search condition that is the starting point of the trace is extracted as a trace log, and another process start log or other file operation log related to the trace log is extracted, A log extractor for extracting as a trace log;
A log extraction system comprising: The process activation log includes information specifying an execution file associated with a process activation event, a process ID that is an ID of a process executed by the execution file, and a parent process ID that is an ID of a process that executes the execution file. Including any one or more of them,
The file operation log specifies information specifying an input target file associated with a file operation event, information specifying an output target file, and an operation type indicating a type of operation performed on the input target file or the output target file And any one or more of process information indicating an ID of a process performing the operation,
The log extraction unit determines whether the target file of the file operation log in the trace log matches the target file of the other file operation log, or whether the target file of the file operation log in the trace log and the other process startup log The execution file matches, the process ID of the file operation log in the trace log matches the process ID of the other process startup log, or the process ID of the process startup log in the trace log and other When the parent process ID of the process start log matches, it is determined that the trace log and other process start log or other file operation log are related, and the target file of the other file operation log or the other process start log 2 is extracted as a trace log. Log extraction system.   The log extraction unit is configured to extract the file operation logs forming the tree structure as a trace log in a lump in relation to a trace log when the file operation logs form a tree structure associated with each other. The log extraction system according to claim 1 or 2, wherein   The log extraction unit obtains vulnerability disclosure date / time, patch application date / time and a trace key based on vulnerability information of a program running on the terminal and a patch application result for the vulnerability, and extracts the extracted trace log. 4. The log extraction system according to claim 1, wherein the trace log whose generation time is between the vulnerability disclosure date and time and the patch application date and time is output. 5. A log accumulation step for accumulating log information including a process activation log indicating a process activation event of a terminal and a file operation log indicating a file operation event;
The process start log or the file operation log related to the trace key that is the search condition that is the starting point of the trace is extracted as a trace log, and another process start log or other file operation log related to the trace log is extracted, A log extraction process to extract as a trace log;
A log extraction method characterized by including   A log extraction program for causing a computer to function as the log extraction system according to any one of claims 1 to 4.

Images