JP2017219947A - Abnormality detection device, abnormality detection method and abnormality detection program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable the detection of a parasite attack that cannot be detected by network log management and traffic monitoring.SOLUTION: An abnormality detection device includes a detection part 11, an information processing part 12 and a storage part 13. The storage part 13 stores each power model learned by a learning procedure. The information processing part 12 acquires processing information of a server 83 and an air conditioner 82 to notify a detection part 11 of the processing information. The detection part 11 compares the processing information acquired from the information processing part 12, power information of a single server 83 acquired from each server 83 and power information of the entire data center 81 acquired from the server 83 and the air conditioner with the power model stored in the storage part 13 to detect a parasite attack.SELECTED DRAWING: Figure 11

Description

  The present disclosure relates to an abnormality detection apparatus, method, and program.

  Attacks on information security such as DDoS (Distributed Denial of Service attack) via a network to various servers such as data centers, communication facilities, and companies have become a major social problem. Attacks such as DDoS attack (Distributed Denial of Service attack), where a large number of computers distributed over multiple networks send connection requests to specific networks and computers all at once, overflowing the communication capacity and stopping the function Since any public server can be a target, social loss is enormous. Therefore, it is possible to detect and protect communications with suspicious large-scale traffic and behavior by network log management and traffic monitoring from the outside, and to register the attacker's information in advance and not accept communications from the attacker Various countermeasures such as setting are being taken (Non-Patent Document 1).

  On the other hand, for example, when there is no attacker's information in advance by some means, or when the user connects a memory or the like instead of the network, the server etc. is infected and communication on the network occurs As a result of abnormally generating processing inside the server, parasite attack that causes power down has become a social problem. Since the parasite attack that causes this power down is an attack that does not involve communication, it is necessary to monitor the power consumption. In this case, which power value is correct for a certain task (regular load) It is impossible to detect or judge whether it is a value or an attacked power as an abnormality. That is, the method of Non-Patent Document 1 has an essential problem that a parasite attack is difficult to detect by a normal network monitoring or analysis technique or cannot be detected by monitoring power.

  An attack involving communication with a communication device or server can be analyzed by directly detecting communication or analyzing a log. On the other hand, in the case of a parasite attack such as a virus that has entered once does not involve communication with the outside and powers down by abnormally increasing the internal operation of the device, it does not involve communication with the outside. Therefore, there is a problem that it cannot be detected by direct monitoring of communication or log analysis.

  Naturally, although there is a certain effect in virus detection, there are cases in which it is intruded by the migration across multiple data centers, etc., and it is often difficult for normal detection. For this reason, it is necessary to detect a state in which the operation more than originally expected is performed in the device by analyzing the change in power for each device with high accuracy.

http: // www. cisco. com / web / JP / product / hs / security / tad / product / xt5600_ds. html Kazumasa Kitada, Yasushi Nakamura, Kazuhiro Matsuda, Shigeto Matsuoka, “Construction of a data center power simulator that combines numerical fluid analysis and power consumption model”, IEICE NS / IN Technical Committee, February 25, 2016

  An object of the present disclosure is to make it possible to detect a parasite attack that cannot be detected by network log management or traffic monitoring.

  In the present disclosure, the presence / absence of “parasite” is detected by learning in advance a power consumption pattern in a normal state and monitoring and comparing the power consumption.

  Specifically, the abnormality detection device according to the present disclosure holds a heat source device power consumption model indicating power consumption and temperature change with respect to the operation amount of the heat source device, and calculates the operation amount of the heat source device and the first power consumption measurement value. When acquired, the difference between the first predicted value of the power consumption of the heat source device after operation and the first power consumption measurement value is obtained from the operation amount derived using the heat source device power consumption model, and the difference is used. And a detector for detecting an abnormality of the heat source device.

  The detection unit holds a space power consumption model indicating power consumption and a temperature change in a space where a heat source device is arranged, and obtains a set temperature and a second power consumption measurement value in the space. A difference between a second predicted value of power consumption of the space at the time of setting to the set temperature derived using a model and the second power consumption measurement value is obtained, and an abnormality of the space is detected using the difference. May be.

  Specifically, the abnormality detection method according to the present disclosure holds a heat source device power consumption model indicating power consumption and temperature change with respect to the operation amount of the heat source device, and calculates the operation amount of the heat source device and the first power consumption measurement value. When acquired, the difference between the first predicted value of the power consumption of the heat source device after operation and the first power consumption measurement value is obtained from the operation amount derived using the heat source device power consumption model, and the difference is used. And a detection procedure for detecting an abnormality of the heat source device.

  In the detection procedure, when a space power consumption model indicating power consumption and temperature change in a space where a heat source device is arranged is held, and a set temperature and a second power consumption measurement value in the space are acquired, the space power consumption A difference between a second predicted value of power consumption of the space at the time of setting to the set temperature derived using a model and the second power consumption measurement value is obtained, and an abnormality of the space is detected using the difference. May be.

  Specifically, the abnormality detection program according to the present disclosure is a program for causing a computer to implement the functions provided in the abnormality detection device according to the present disclosure, and each procedure provided in the abnormality detection method according to the present disclosure is stored in the computer. This is a program to be executed. The abnormality detection program may be recorded on a computer-readable recording medium.

  According to the present disclosure, it is possible to easily detect the presence or absence of “parasite” by learning a power consumption pattern in a normal state in advance and monitoring and comparing the power consumption.

It is a structural example of a data center. An example of the abnormality detection method which concerns on embodiment is shown. An example of the power model of a single server is shown. An example of the power model of a single air conditioner is shown. An example of transition of power consumption of all servers when a task is changed is shown. An example of transition of the power consumption of an air-conditioning apparatus at the time of changing a task is shown. An example of transition of power consumption of the entire data center and the server when the task is not changed is shown. An example of the power model of the whole data center is shown. An example of transition of power consumption of the entire data center during normal and abnormal times is shown. An example of transition of the power consumption of the server at the time of normal and abnormal is shown. The structural example of the abnormality detection apparatus which concerns on embodiment is shown. A specific example of the detection procedure is shown. An example of another form of a detection procedure is shown.

  Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In addition, this indication is not limited to embodiment shown below. These embodiments are merely examples, and the present disclosure can be implemented in various modifications and improvements based on the knowledge of those skilled in the art. In the present specification and drawings, the same reference numerals denote the same components.

  The abnormality detection device according to the embodiment makes an individual power model for each component (server) in advance, predicts power consumption when a certain task is given, and exceeds the predicted value, Judge that abnormal operation such as parasite attack is occurring inside the equipment.

  In addition, if a power model for the entire data center is built, not just the individual power model, even if tasks are distributed in the data center, if the predicted value is greatly exceeded, the parasite attack It can be determined that such an abnormal operation is occurring inside the device.

  FIG. 1 shows a configuration example of a data center. The data center 81 includes an ICT (Information and Communication Technology) device part serving as a heat source such as a server or a router, and an air conditioner 82 that cools the ICT (Information and Communication Technology) device. In the following embodiment, a case where a heat source device such as an ICT device is the server 83 will be described for easy understanding. Accordingly, the heat source device power consumption model is referred to as a server power consumption model.

  The power consumption of the entire data center 81 is mainly the sum of the power consumption of all the servers 83 and the power consumption of the air conditioner 82. However, in the server 83, the power consumption of each component is a CPU (Central Processing Unit) operating rate, suction temperature, and air volume (air condition setting conditions), while in the air conditioner 82, the set temperature, air volume, or server 83 greatly depends on the power consumed (the amount of heat to be processed), the return temperature, and the like. Therefore, in order to accurately predict the power consumption of the entire data center 81 at a given task amount (processing amount), it is necessary to clarify those operating conditions and to grasp them by learning (for example, non-patent literature). 2).

FIG. 2 shows an example of the abnormality detection method according to the embodiment. The detection procedure is as follows.
Learning procedure S101: The anomaly detection apparatus grasps in advance a space power consumption model of the entire data center 81 when a certain task (processing) is normally given by using machine learning.
Monitoring procedure S102: The abnormality detection device constantly monitors the transition of power consumption during operation, and analyzes the difference from the power consumption grasped in advance when processing is performed.
Detection procedure S103: The abnormality detection device determines the presence or absence of a parasite attack using the difference obtained by the analysis.

In grasping in the learning procedure S101, it is preferable to consider the following points.
The power consumption of the server 83 varies greatly depending on the processing amount of the server 83 and the temperature and air volume of the air supplied by air conditioning. The processing amount of the server 83 is, for example, the operating status of the CPU and memory.
The power consumption of the air conditioner 82 varies greatly depending on the power consumption of the server 83 (power that the air conditioner processes), the return temperature or supply air temperature, and the air volume.
Based on these, the server power consumption model of the server 83 alone, the air conditioning power consumption model of the air conditioner 82 alone, and the space power consumption model of the entire data center 81 are grasped individually.

  In the learning procedure S101, operation data of the server 83 and the air conditioner 82 is input to the abnormality detection device in advance. The server operation data is data obtained by collecting information about the power consumption of the server 83 arranged in the data center 81 for each server 83. The abnormality detection apparatus creates a power consumption model (server power consumption model) for each model by machine learning using the operation data of the server 83. The operation data of the air conditioner is data obtained by collecting information on the power consumption of the air conditioner 82 arranged in the data center 81 for each air conditioner 82. The abnormality detection device creates an air conditioning power consumption model that is a power consumption model for each model of the air conditioning equipment 82 by machine learning using the operation data of the air conditioning equipment 82. These models are obtained by operating in advance under various conditions and measuring the power.

  FIG. 3 shows an example of a server power consumption model of the server 83 alone. This is an example of a server power consumption model, and is an example of changes in power consumption (W) under various operating conditions (CPU utilization (%), intake air temperature (° C.)) of the server 83 alone. The server power consumption model is constructed by operating the server 83 alone. A server power consumption model may be created for each model of the server 83, and it is not necessary to create a model using the server 83 actually arranged in the data center 81.

  FIG. 4 shows an example of an air conditioning power consumption model of the air conditioning device 82 alone. This is an example of changes in power consumption (kW) under various operating conditions (set air volume (%), set temperature (° C.)) in the air conditioner 82 alone. Here, in FIG. 4, as an example of the set air volume of the air conditioner 82, the ratio (%) with respect to the maximum rotation speed of the fan is shown. The temperature is an air supply temperature of air supplied from the air conditioner 82 to the data center 81. An air-conditioning power consumption model may be created for each model of the air-conditioning equipment 82, and it is not necessary to create a model using the air-conditioning equipment 82 actually arranged in the data center 81.

  FIG. 5 and FIG. 6 show an example of power consumption of all servers and air conditioners when the task (process) is changed. This is a comparison between measured values of power consumption (all servers, air conditioning equipment) and predicted values of power consumption (all servers, air conditioners) predicted by machine learning when the task (amount of processing) is changed. . It can be seen that the power consumption of the entire server can be predicted with an accuracy of 5% on average.

  FIG. 7 shows an example of the total power consumption of the data center when the task is constant and the air-conditioning blowout temperature is changed. Unlike FIG. 5 and FIG. 6, the transition of power consumption of the server 83 and the entire data center 81 when the task (processing amount) is constant and various operation conditions (air-conditioning blowout temperature) are changed. It is an example. It can be seen that even with the same amount of processing, the power consumption of the entire data center 81 changes.

  FIG. 8 shows an example of the power consumption model of the entire data center 81. This is an example of a space power consumption model, and is an example of a change in power consumption of the data center 81 with respect to various operating conditions. Wind-max and wind-min are air volumes of the air conditioner 82. Thus, by grasping the power consumption for all the operating conditions by learning in advance, it is possible to detect the presence or absence of an attack with respect to an increase in power consumption when receiving an attack.

  FIG. 9 and FIG. 10 show a comparison between a normal power consumption transition LN and an attack power consumption transition LA, respectively. FIG. 9 shows the entire data center 81, and FIG. The power consumption LN when a certain task (processing amount) is given is accurately (server) based on the power model (server alone or total data center power) learned in advance as shown in the previous figures. 7% on a standalone basis and 5% accuracy on overall data center power). Therefore, the power consumption increased from the values, such as the power consumption transitions LA1 and LA2 shown in FIG. 10 and the power consumption transition LA shown in FIG. 9, can be determined as a parasite attack.

  In a normal parasite attack, as shown in transitions LA1 and LA2 of power consumption shown in FIG. 10, there are many cases where a constant load is continuously applied, and therefore, it occurs in bursts using a power consumption pattern learned in advance. It is possible to easily detect a parasite attack on the basis of a power consumption value that is constantly increased while ignoring the load (power increase). In the embodiment, a state where a steady increase in power consumption of 20% or more is determined as a parasite attack, and the power consumption of the server is reduced to be separated from the network.

  In FIG. 11, the block diagram of the abnormality detection apparatus of embodiment is shown. The abnormality detection device includes a detection unit 11, an information processing unit 12, and a storage unit 13. The storage unit 13 stores each power model learned in the learning procedure S101. The information processing unit 12 acquires processing information of the server 83 and the air conditioner 82 and notifies the detection unit 11 of the processing information. The detection unit 11 stores processing information obtained from the information processing unit 12, power information of the server 83 alone obtained from each server 83, and power information of the entire data center 81 obtained from the server 83 and the air conditioner 82. Compared with the power model stored in 13, the parasite attack is detected.

  The power information of the server 83 alone is a parameter of the server power consumption model, such as a CPU utilization rate and an intake air temperature. The power information of the entire data center 81 is a parameter of the space power consumption model, for example, the number of servers and the set temperature of the air conditioner 82.

  FIG. 12 shows the operation of the abnormality detection apparatus in the detection procedure S103. In the monitoring procedure S102, the detection unit 11 monitors the transition of power consumption during operation, and analyzes the difference from the power consumption grasped in advance when a calculation process (task) is performed in each server 83.

  The detection unit 11 compares the predicted value of the power consumption of the entire data center 81 with the measured value of power consumption (S111), and if the difference between the predicted value and the measured value exceeds the set value (Yes in S111), step S112. Migrate to

  The detection unit 11 compares the predicted power consumption value of each server 83 with the measured power consumption value (S112). If the difference between the predicted value and the measured value exceeds the set value (Yes in S112), the process proceeds to step S113. Transition.

  The detection unit 11 compares the transition of the measured power consumption value of each server 83 with the server power consumption model, and detects a parasite attack (S113). For example, when the power consumption of a certain server 83 is equal to or greater than a set value and the state has exceeded a set time, it is determined that the server 83 is receiving a parasite attack. When detecting a parasite attack (Yes in step S113), the detection unit 11 notifies the information processing unit 12 of control information indicating that the power consumption of the server 83 that has detected the parasite attack is reduced. Upon receiving this notification, the information processing unit 12 reduces the power consumption of the server 83 that has received the notification and disconnects it from the network (S114).

  As shown in FIG. 13, step S111 may be omitted in the detection procedure S103. In addition, the abnormality detection device according to the embodiment may stare by causing the computer to function as the detection unit 11 and the information processing unit 12. In this case, each configuration is realized by the computer executing the computer program stored in the storage unit 13. As described above, the apparatus of the embodiment can be realized by a computer and a program, and the program can be recorded on a recording medium or provided through a network.

(Effect of embodiment)
In this embodiment, a data center, a communication facility, a company, etc., against an internal “parasite attack” that cannot detect communications with suspicious large-scale traffic or behavior by external network log management or traffic monitoring As long as the power consumption pattern for each device such as a server is obtained by learning in advance, it can be easily detected. This method has advantages in terms of operational security and privacy because it can detect “parasite” attacks simply by monitoring power consumption, and does not require detection or analysis related to communication details.

  The present disclosure can be applied to the information communication industry.

11: Detection unit 12: Information processing unit 13: Storage unit 81: Data center 82: Air conditioner 83: Server

Claims (5)

Holding the heat source equipment power consumption model indicating the power consumption and the temperature change with respect to the operating amount of the heat source equipment, and obtaining the operating amount of the heat source equipment and the first power consumption measurement value, derived using the heat source equipment power consumption model A detection unit that obtains a difference between a first predicted value of power consumption of the heat source device after operation of the operation amount and the first power consumption measurement value, and detects an abnormality of the heat source device using the difference,
Anomaly detection device. The detection unit holds a space power consumption model indicating power consumption and a temperature change in a space where a heat source device is arranged, and obtains a set temperature and a second power consumption measurement value in the space. A difference between a second predicted value of power consumption of the space at the time of setting to the set temperature derived using a model and the second power consumption measurement value is obtained, and an abnormality in the space is detected using the difference. ,
The abnormality detection device according to claim 1. Holding the heat source equipment power consumption model indicating the power consumption and the temperature change with respect to the operating amount of the heat source equipment, and obtaining the operating amount of the heat source equipment and the first power consumption measurement value, derived using the heat source equipment power consumption model Obtaining a difference between a first predicted value of the power consumption of the heat source device after operation of the operating amount and the first power consumption measurement value, and using a detection procedure for detecting an abnormality of the heat source device using the difference;
Anomaly detection method. In the detection procedure, when a space power consumption model indicating power consumption and temperature change in a space where a heat source device is arranged is held, and a set temperature and a second power consumption measurement value in the space are acquired, the space power consumption A difference between a second predicted value of power consumption of the space at the time of setting to the set temperature derived using a model and the second power consumption measurement value is obtained, and an abnormality in the space is detected using the difference. ,
The abnormality detection method according to claim 3.   An abnormality detection program for causing a computer to execute the procedure according to claim 3 or 4.

Images