JP2019020776A - Access log analysis device, access log analysis method and access log analysis program - Google Patents

Abstract

To reduce a work load of analysis of an access log.SOLUTION: An access log analysis device comprises: an extraction unit which extracts a time series set of an access destination by an access source for every unit time, from an access log storing information indicating each of an access time, files of the access source and the access destination, for every access to each file stored in a storage device; and a specifying unit which specifies the time series set appearing in the plural unit times.SELECTED DRAWING: Figure 3

Description

  The present invention relates to an access log analysis device, an access log analysis method, and an access log analysis program.

  There is a desire to detect unauthorized access such as file access due to policy violations or spoofing of employees regarding access to in-house shared file servers.

  As an unauthorized access detection operation, based on the contents of the access log recorded for a certain period, the legitimacy of access related to the access log is determined. For example, an access log is analyzed to check whether access has occurred outside business hours and whether access has been made from a country or region with low access frequency.

JP 2009-116680 A JP 2002-334061 A JP 2013-137740 A JP 2007-148946 A JP 2013-191188 A JP 2010-250502 A JP 2012-068833 A JP 2013-191188 A

  However, an access log is similarly recorded for mechanical (automatic) access such as file backup and file search that occur regularly. Since such access logs are generated in large quantities in a short time, the number of access log analysis targets increases. For example, download of access logs to terminals used by analysts who analyze access logs, and analysis by analysts There is a problem that it takes time to decipher the access log.

  Accordingly, in one aspect, an object of the present invention is to reduce the work burden of access log analysis.

  In one aspect, the access log analysis apparatus can access the access log for each access source from the access log in which information indicating the access time, the access source, and the access destination file is recorded for each access to each file stored in the storage device. An extraction unit that extracts a time series set of access destinations for each unit time; and a specifying unit that specifies the time series set that appears in a plurality of the unit times.

  As one aspect, the work burden of access log analysis can be reduced.

It is a figure which shows the system configuration example in embodiment of this invention. It is a figure which shows the hardware structural example of the analyzer 10 in embodiment of this invention. It is a figure which shows the function structural example of the analyzer 10 in embodiment of this invention. It is a figure for demonstrating the production | generation of a cross tabulation table. It is a figure for demonstrating specification of a continuation event. It is a flowchart for demonstrating an example of the process sequence of the production | generation process of a cross tabulation table. It is a figure which shows an example of an access log. It is a figure which shows the structural example of a cross tabulation table. It is a flowchart for demonstrating an example of the process sequence of the specific process of a continuation event. 3 is a diagram illustrating a configuration example of a continuation event storage unit 14. FIG. It is a flowchart for demonstrating an example of the process sequence of the classification process of an access log.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing an example of a system configuration in the embodiment of the present invention. In FIG. 1, one or more user terminals such as user terminals 30a, 30b, and 30c (hereinafter referred to as “user terminal 30” when not distinguished from each other) are a LAN (Local Area Network) or an intranet in a certain company. Connected to the file server 20 via the network. Further, the analysis apparatus 10 is also connected to the file server 20 via a network. In the present embodiment, the company is referred to as “company A”.

  In the company A, the file server 20 is one or more computers (storage devices) in which, for example, files shared by a plurality of employees, files managed in an organization in the company A, and the like are stored. A file refers to a file storing electronic data.

  Each user terminal 30 is a terminal that is an access source for a file stored in the file server 20. For example, a PC (Personal Computer), a smartphone, a tablet terminal, or the like may be used as the user terminal 30. The access from the user terminal 30 is periodically or repetitively performed by an access generated at an arbitrary timing by the user operation of the user terminal 30 (hereinafter referred to as “user access”) or a program installed in the user terminal 30. There are mechanical accesses that occur (hereinafter referred to as “machine access”). Examples of machine access include access for periodic backup of files and access by a file search function. For example, an access having the following characteristics is assumed as an example of a machine access. The generation timing is regular (several times a day, once a half day, etc.) and short time (1 minute, 10 minutes, etc.). The number of accesses to one file is one time. For access that occurs in a short time, the access source IP address is the same. However, there is a possibility that the access source IP address is different at each occurrence timing, such as when a different IP address is assigned to the user terminal 30 every day.

  On the other hand, as an example of user access, there is access for browsing and editing files. Note that examples of unauthorized user access include file browsing by impersonation and access for falsification of a file.

  The analysis device 10 is one or more computers that support detection of unauthorized access to a file based on a log (hereinafter referred to as “access log”) recorded for each access to the file in the file server 20. In the present embodiment, the analysis apparatus 10 divides the access log group into an access log with high possibility of machine access (hereinafter referred to as “machine access candidate log”) and an access log with high possibility of user access (hereinafter referred to as “machine access candidate log”). And “user access candidate log”). By doing so, the analyst can narrow down the access logs to be analyzed to the user access candidate logs, for example, when there is a high possibility that unauthorized access has occurred with respect to user access, reducing the work load can do.

  FIG. 2 is a diagram illustrating a hardware configuration example of the analysis apparatus 10 according to the embodiment of the present invention. The analysis apparatus 10 in FIG. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, and the like that are mutually connected by a bus B.

  A program for realizing processing in the analysis apparatus 10 is provided by the recording medium 101. When the recording medium 101 on which the program is recorded is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program need not be installed from the recording medium 101 and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The CPU 104 executes a function related to the analysis device 10 according to a program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

  An example of the recording medium 101 is a portable recording medium such as a CD-ROM, a DVD disk, or a USB memory. An example of the auxiliary storage device 102 is an HDD (Hard Disk Drive) or a flash memory. Both the recording medium 101 and the auxiliary storage device 102 correspond to computer-readable recording media.

  FIG. 3 is a diagram illustrating a functional configuration example of the analysis apparatus 10 according to the embodiment of the present invention. 3, the analysis apparatus 10 includes a cross tabulation table generation unit 11, a continuation event identification unit 12, an access log classification unit 13, and the like. Each of these units is realized by processing executed by the CPU 104 by one or more programs installed in the analysis apparatus 10. The analysis apparatus 10 also uses the continuation event storage unit 14. The continuation event storage unit 14 can be realized by using, for example, a storage device that can be connected to the auxiliary storage device 102 or the analysis device 10 via a network.

  For example, the cross tabulation table generation unit 11 generates a cross tabulation table for each period of a predetermined cycle (for example, one day) for an access log recorded in a predetermined period such as the past week. The cross tabulation table is a table in which an ordered set (time series set) of file path character strings (path names) of access destinations per unit time (for example, 30 minutes) is classified by access source.

  FIG. 4 is a diagram for explaining generation of a cross tabulation table. FIG. 4 shows an example in which an access log group for one week is divided every day, and a cross tabulation table is generated for each day's access log group. The lower table in FIG. 4 shows a cross tabulation table. The rows of the cross tabulation table are distinguished for each access source, and the columns are distinguished for each unit time. An ellipse in any cell of the cross tabulation table indicates an ordered set extracted with respect to the access source and unit time related to the cell. Accordingly, in FIG. 4, an example in which ordered sets s1 and s2 are extracted from the access log groups for each day from the first day to the seventh day, and an ordered set s3 is further extracted from the access log groups on and after the third day. It is shown. In addition, the same code | symbol is attached | subjected to the ordered set with the same content.

  The continuation event specifying unit 12 compares the ordered sets of the respective cross tabulation tables (each day), so that the ordered set that appears continuously (repeatedly) on each day (that is, appears in a daily cycle). Specified ordered set). A set of ordered sets continuing on each day is hereinafter referred to as a “continuation event”. The continuation event specifying result is stored in the continuation event storage unit 14.

  FIG. 5 is a diagram for explaining identification of a continuation event. In FIG. 5, ordered sets having the same contents are connected by lines. Here, the ordered sets s1 and s2 appear on each day of one week. Therefore, the ordered sets s1 and s2 are specified as continuation events.

  The access log classification unit 13 classifies each access log into a machine access candidate log or a user access candidate log based on the continuation event stored in the continuation event storage unit 14.

  Hereinafter, a processing procedure executed by the analysis apparatus 10 will be described. FIG. 6 is a flowchart for explaining an example of the processing procedure of the cross tabulation table generation processing.

  In step S101, the cross tabulation table generation unit 11 acquires the setting of the analysis target period. The analysis target period is a period for specifying an access log to be analyzed, and is specified by, for example, a start date and an end date of the period. One week in FIG. 4 corresponds to the analysis target period. The analysis target period may be set in advance or may be input by the user at the timing of step S101.

  Subsequently, the cross tabulation table generation unit 11 acquires a setting of a period (hereinafter referred to as “generation period”) as a generation unit of the cross tabulation table (S102). One day in FIG. 4 corresponds to the generation period. The generation period may be set in advance or may be input by the user at the timing of step S102. Note that the generation period may be set based on a cycle in which machine access occurs. For example, if the machine access is scheduled to occur every two days, the generation period may be set to two days.

  Subsequently, the cross tabulation table generation unit 11 assigns 1 to the variable i (S103). In FIG. 6, a variable i is a variable for storing the order of generation periods that are to be processed.

  Subsequently, the cross tabulation table generation unit 11 reads the access log group of the i-th generation period from the file server 20 (S104).

  FIG. 7 is a diagram illustrating an example of an access log. As shown in FIG. 7, the access log includes values of items such as an access source IP, an access time, an access destination path, and an operation for each access to any file. The access source IP is an IP address of the access source user terminal 30 or the like. The access time is information indicating the access time such as the date and time when the access occurred. The access destination path is a path character string of a file to be accessed. The operation is information indicating the type of operation performed on the file to be accessed. For example, Read (reference), Write (write), Delete (deletion), Read-failure (reference failure), Write-failure (write failure), Delete-failure (deletion failure), and the like may be recorded as operations.

  In step S104, an access log group whose access time is included in the i-th generation period (hereinafter referred to as “target access log group”) is read.

  Subsequently, the cross tabulation table generation unit 11 specifies the type of access source IP and the type of unit time of each access log included in the target access log group, and generates an empty cross tabulation table (S105). ). Hereinafter, the generated cross tabulation table is referred to as “target cross tabulation table”. Specifying the type of unit time means specifying a unit time including an access time of one or more access logs among a plurality of unit times dividing the i-th generation period. The generated cross tabulation table uses the specified type of access source IP address as a row and the specified type of unit time as a column.

  Subsequently, the cross tabulation table generation unit 11 generates an ordered set of access destination paths for each unit time for each access source IP for the target access log group (S106). When a plurality of access destination paths are included in one ordered set, the plurality of access destination paths are arranged in ascending order of access times (that is, in time series).

  Subsequently, the cross tabulation table generation unit 11 registers each generated ordered set in a cell corresponding to the access source IP and unit time of each ordered set in the target cross tabulation table (S107). Subsequently, the cross tabulation table generation unit 11 stores the target cross tabulation table in the memory device 103 or the auxiliary storage device 102 (S108).

  FIG. 8 is a diagram illustrating a configuration example of the cross tabulation table. As shown in FIG. 8, in the cross tabulation table, an ordered set of access destinations for each unit time is registered for each access source IP. The cross tabulation table shown in FIG. 8 is a cross tabulation table based on the access log group for the generation period for one day on April 1.

  Subsequently, the cross tabulation table generation unit 11 determines whether all access logs in the target analysis period have been read (S109). When there is an access log that has not been read yet (No in S109), the cross tabulation table generation unit 11 adds 1 to i (S110), and repeats Step S104 and subsequent steps. When all access logs have been read (Yes in S109), the cross tabulation table generation unit 11 ends the processing procedure of FIG.

  By executing the processing procedure of FIG. 6, a cross tabulation table is generated for each generation period included in the target analysis period.

  FIG. 9 is a flowchart for explaining an example of the processing procedure of the continuation event specifying process.

  In step S201, the continuation event specifying unit 12 substitutes 1 for a variable i. In FIG. 9, a variable i is a variable for storing the order of the cross tabulation table to be processed (attention). The order of the cross tabulation table follows the context of the generation period of the cross tabulation table. That is, the cross tabulation table whose generation period is relatively earlier is the previous in the order.

  Subsequently, the continuation event specifying unit 12 determines whether or not the value of i is equal to or less than the number N of cross tabulation tables generated for the target analysis period (S202). When the value of i is N or less (Yes in S202), the continuation event specifying unit 12 extracts one unprocessed ordered set from the i-th cross tabulation table (S203). Here, “unprocessed” means that steps S204 to S207 are unprocessed. Hereinafter, the ordered set extracted in step S203 is referred to as “target ordered set”.

  Subsequently, the continuation event specifying unit 12 compares the target ordered set with the ordered set of each group (S204). The group here means a group formed by classifying each ordered set based on the identity of the ordered set (arrangement order of access destination paths) in step S206 or S207 described later. Does not exist at the start of processing. Therefore, if at least i = 1 and the target ordered set is the first extracted ordered set, there is no group to which the ordered set that matches the target ordered set belongs.

  When there is no group to which the ordered set that matches the target ordered set belongs (No in S205), the continuation event specifying unit 12 generates a new group and includes the target ordered set in the group (S206). On the other hand, when there is a group to which the ordered set that matches the target ordered set belongs (Yes in S205), the continuation event specifying unit 12 includes the target ordered set in the group (S207).

  When steps S203 to S208 are executed for all the ordered sets included in the i-th cross tabulation table (Yes in S208), the continuation event specifying unit 12 adds 1 to the variable i (S209), and the step S202 and subsequent steps are repeated. When the value of the variable i exceeds the number N of the cross tabulation table (No in S202), the process proceeds to step S210. At this time, each ordered set of each cross tabulation table is classified into a plurality of groups.

  In step S210, the continuation event specifying unit 12 determines whether or not there is a group to which the ordered set extracted from all the cross tabulation tables belongs. That is, it is determined whether or not there is a group to which the ordered set that appears on each day (each generation cycle) belongs.

  When there are one or more corresponding groups (Yes in S210), the continuation event specifying unit 12 stores the ordered set belonging to each group in the continuation event storage unit 14 (S211). That is, the ordered set of each group is specified as a continuation event. This is because the ordered set of each group appears periodically continuously.

  FIG. 10 is a diagram illustrating a configuration example of the continuation event storage unit 14. As shown in FIG. 10, the continuation event storage unit 14 stores a continuation event ID, an ordered set, a corresponding portion in the cross tabulation table, and the like for each continuation event.

  The continuation event ID is identification information assigned for each continuation event. The ordered set is an ordered set identified as a continuation event. The corresponding part in the cross tabulation table is information indicating a part where the ordered set appears in the cross tabulation table. In FIG. 10, the corresponding part in the cross tabulation table includes items such as a generation period, an access source IP, and a unit time. The generation period is a generation period of the cross tabulation table in which the ordered set appears. The access source IP is an item for specifying a row including the ordered set in the cross tabulation table. The unit time is an item for specifying a column including the ordered set in the cross tabulation table.

  Note that, in the comparison of the ordered sets in step S204, the comparison result as “match” may be output not only when the match is complete but also when they are similar. That is, not only completely matched ordered sets but also similar ordered sets may be classified into the same group. For example, the compared ordered sets may be determined to be similar when the access destination paths of a predetermined ratio or more of the access destination paths included in the ordered set match. In this case, it may be required to be similar to all ordered sets in the group, or may be required to be similar to any M or more ordered sets.

  In step S210, for example, it may be determined whether or not there is a group to which an ordered set extracted from a cross tabulation table having a predetermined ratio or more with respect to all the cross tabulation tables belongs. Alternatively, the presence / absence of a group to which an ordered set appearing in the cross tabulation table at substantially constant intervals may be determined. For example, an ordered set whose appearance interval is 2, such as first, third, and fifth, corresponds to an ordered set that appears in the cross tabulation table at a substantially constant interval.

  FIG. 11 is a flowchart for explaining an example of the processing procedure of the access log classification processing.

  In step S301, the access log classification unit 13 reads all continuation events stored in the continuation event storage unit 14. Subsequently, the access log classification unit 13 reads one access log whose access time is included in the analysis target period from the file server 20 (S302). Hereinafter, the read access log is referred to as “target log”.

  Subsequently, the access log classification unit 13 determines whether there is a continuation event in which the target period and unit time include the access time of the target log and the access source IP matches the access source IP of the target log (S303). That is, it is determined whether or not the target log is an access log that constitutes one of the continuation events.

  If there is a corresponding continuation event (Yes in S303), the access log classification unit 13 classifies the target log as a machine access candidate log (S304). If there is no corresponding continuation event (No in S303), the access log classification unit 13 classifies the target log as a user access candidate log (S305). Note that the access log classified as the machine access candidate log and the access log classified as the user access candidate log may be stored in different folders in the auxiliary storage device 102 of the analyzer 10, for example.

  Steps S301 to S305 are executed for all access logs within the analysis target period (S306).

  As described above, according to the present embodiment, the access log group can be classified into a user access candidate log and a machine access candidate log. Therefore, for example, when the possibility of fraud due to user access is high, the user access candidate log can be the analysis target. Similarly, when the possibility of fraud due to machine access is high, machine access candidate logs can be analyzed. As a result, the access logs to be analyzed can be reduced, and the work burden of access log analysis can be reduced.

  Further, in this embodiment, in order to pay attention to whether or not a similar ordered set continues to appear as to whether or not it is machine access, access that does not occur regularly (that is, periodicity or repeatability is determined). The access log related to (access not having) can be excluded from the machine access candidate log.

  Further, in the present embodiment, since attention is paid to the order in which accesses occur, machine accesses whose access times are not strictly constant can be determined to be machine accesses.

  In the present embodiment, the analysis device 10 is an example of an access log analysis device. The cross tabulation table generation unit 11 is an example of an extraction unit. The continuation event specifying unit 12 is an example of a specifying unit. The file server 20 is an example of a storage device. The access log classification unit 13 is an example of a classification unit. The machine access candidate log is an example of a first access log. The user access candidate log is an example of a second access log.

  Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications can be made within the scope of the gist of the present invention described in the claims. Deformation / change is possible.

Regarding the above description, the following items are further disclosed.
(Appendix 1)
A time-series set of access destinations by access source is recorded for each unit time from an access log in which information indicating access time, access source and access destination files is recorded for each access to each file stored in the storage device. An extractor for extracting;
A specifying unit that specifies the time series set that appears in a plurality of the unit times;
An access log analyzer characterized by comprising:
(Appendix 2)
The specifying unit specifies the time series set that periodically appears in the plurality of unit times.
The access log analyzer according to appendix 1, characterized by the above.
(Appendix 3)
The specifying unit is configured such that, for each fixed period, each time series set extracted in any of the plurality of unit times included in the fixed period and any of the plurality of unit times included in another fixed period. Comparing each time series set extracted in step (b) to identify the time series set that appears periodically;
The access log analyzer according to appendix 2, characterized by the above.
(Appendix 4)
A classification unit that classifies each of the access logs into a first access log related to any one of the time-series sets specified by the specification unit and a second access log that does not correspond to the first access log. ,
The access log analyzer according to any one of appendices 1 to 3, characterized by comprising:
(Appendix 5)
A time-series set of access destinations by access source is recorded for each unit time from an access log in which information indicating access time, access source and access destination files is recorded for each access to each file stored in the storage device. Processing to extract,
A process of identifying the time-series set that appears in a plurality of the unit times;
An access log analysis method characterized in that the computer executes.
(Appendix 6)
The specifying process specifies the time series set that periodically appears in the plurality of unit times.
The access log analysis method according to appendix 5, characterized in that:
(Appendix 7)
The specifying process includes, for each fixed period, any one of the time series sets extracted in any of the plurality of unit times included in the fixed period and the plurality of unit times included in another fixed period. Comparing each time series set extracted in or above to identify the time series set that appears periodically;
The access log analysis method according to appendix 6, wherein:
(Appendix 8)
A process of classifying each of the access logs into a first access log related to any one of the time-series sets specified by the specifying unit and a second access log not corresponding to the first access log;
The access log analysis method according to any one of appendices 5 to 7, wherein the computer executes
(Appendix 9)
A time-series set of access destinations by access source is recorded for each unit time from an access log in which information indicating access time, access source and access destination files is recorded for each access to each file stored in the storage device. Processing to extract,
A process of identifying the time-series set that appears in a plurality of the unit times;
An access log analysis program characterized by causing a computer to execute.
(Appendix 10)
The specifying process specifies the time series set that periodically appears in the plurality of unit times.
The access log analysis program according to appendix 9, wherein
(Appendix 11)
The specifying process includes, for each fixed period, any one of the time series sets extracted in any of the plurality of unit times included in the fixed period and the plurality of unit times included in another fixed period. Comparing each time series set extracted in or above to identify the time series set that appears periodically;
The access log analysis program according to supplementary note 10, characterized by that.
(Appendix 12)
A process of classifying each of the access logs into a first access log related to any one of the time-series sets specified by the specifying unit and a second access log not corresponding to the first access log;
The access log analysis program according to any one of appendices 9 to 11, characterized in that the computer is executed.

DESCRIPTION OF SYMBOLS 10 Analysis apparatus 11 Cross tabulation table production | generation part 12 Continuation event specific | specification part 13 Access log classification | category part 14 Continuation event memory | storage part 20 File server 30 User terminal 100 Drive apparatus 101 Recording medium 102 Auxiliary storage apparatus 103 Memory apparatus 104 CPU
105 Interface device B bus

Claims (6)

A time-series set of access destinations by access source is recorded for each unit time from an access log in which information indicating access time, access source and access destination files is recorded for each access to each file stored in the storage device. An extractor for extracting;
A specifying unit that specifies the time series set that appears in a plurality of the unit times;
An access log analyzer characterized by comprising: The specifying unit specifies the time series set that periodically appears in the plurality of unit times.
The access log analyzer according to claim 1, wherein: The specifying unit is configured such that, for each fixed period, each time series set extracted in any of the plurality of unit times included in the fixed period and any of the plurality of unit times included in another fixed period. Comparing each time series set extracted in step (b) to identify the time series set that appears periodically;
The access log analyzer according to claim 2, wherein A classification unit that classifies each of the access logs into a first access log related to any one of the time-series sets specified by the specification unit and a second access log that does not correspond to the first access log. ,
The access log analyzer according to any one of claims 1 to 3, wherein the access log analyzer is provided. A time-series set of access destinations by access source is recorded for each unit time from an access log in which information indicating access time, access source and access destination files is recorded for each access to each file stored in the storage device. Processing to extract,
A process of identifying the time-series set that appears in a plurality of the unit times;
An access log analysis method characterized in that the computer executes. A time-series set of access destinations by access source is recorded for each unit time from an access log in which information indicating access time, access source and access destination files is recorded for each access to each file stored in the storage device. Processing to extract,
A process of identifying the time-series set that appears in a plurality of the unit times;
An access log analysis program characterized by causing a computer to execute.

Images