JP2019103069A - Specific system, specific method and specific program - Google Patents

Abstract

To efficiently detect unknown abnormality and identify a case of the abnormality.SOLUTION: A first generation unit 151 learns a communication feature amount or an operation log during normal operation of a device, and generates a detection model 141 for detecting that the device is in an abnormal state. A second generation unit 153 learns the communication feature amount or the operation log for each cause of abnormality of the device, and generates a specific model 142 for identifying the cause of the abnormality of the device. A detection unit 152 detects that the device is in an abnormal state on the basis of the communication feature amount or the operation log acquired from the detection model 141 and the device. When the detection unit 152 detects that the device is in the abnormal state, an identifying unit 154 identifies a cause of the abnormality of the device on the basis of the communication feature amount or the operation log acquired from the specific model 142 and the device.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a specific system, a specific method, and a specific program.

  As a method of detecting an abnormality due to malware infection or the like in a device such as a PC (Personal Computer), a blacklist method of detecting an abnormality by comparing the behavior pattern of the device with a known abnormality pattern, a behavior pattern of the device and a normal state Conventionally, a whitelist method for detecting abnormalities by comparing behavior patterns has been put to practical use.

  In addition, based on system load information, it performs abnormality determination, identifies the function being executed by the device where the abnormality has occurred, and registers it in the blacklist, while whitelisting the function being performed by the device where no abnormality has occurred. Technologies to register with are known.

JP 2017-84296 A

  However, the prior art has a problem that detection of unknown abnormality and identification of the cause of abnormality may not be efficiently performed. For example, in the blacklist method, since the abnormal pattern is determined in advance, the cause of the abnormality can be identified when the determined abnormal pattern is matched, but it is difficult to detect an abnormality due to unknown malware or the like. On the other hand, in the whitelist method, behavior patterns that do not match the normal state can all be detected as abnormal, but identification of the cause of the abnormality is difficult.

  Also, with the technology that identifies the function being executed on the device where the abnormality has occurred and registers it in the blacklist, and registers the function being performed on the device where the abnormality has not occurred in the whitelist, an abnormal operation is performed. It is only possible to identify the function, and it is difficult to identify the cause of abnormality.

  In order to solve the problems described above and achieve the purpose, the specific system of the present invention collects or learns communication feature values or operation logs during normal operation of the device, and detects that the device is in an abnormal state. First generation unit that generates a detection model of the second, and a second generation unit that collects or learns communication feature amounts or operation logs for each cause of abnormality of the device, and generates a specific model for identifying the cause of abnormality of the device A detection unit for detecting that the first device is in an abnormal state based on the detection model and the communication feature and the operation log acquired from the first device, and the first detection unit using the detection unit An identifying unit that identifies an abnormality cause of the first device based on the specific model and the communication feature or the operation log acquired from the first device when it is detected that the device is in an abnormal state; , And is characterized by.

  According to the present invention, detection of an unknown abnormality and identification of the cause of the abnormality can be efficiently performed.

FIG. 1 is a diagram illustrating an example of the configuration of a specific system according to the first embodiment. FIG. 2 is a diagram illustrating an example of the configuration of the identification device according to the first embodiment. FIG. 3 is a view showing an example of the data configuration of the abnormality cause DB according to the first embodiment. FIG. 4 is a flowchart showing the flow of processing in the initial setting phase of the specific device according to the first embodiment. FIG. 5 is a flowchart showing the flow of processing in the operation phase of the specific device according to the first embodiment. FIG. 6 is a diagram illustrating an example of a computer that executes a specific program.

  Hereinafter, embodiments of a specifying system, a specifying method, and a specifying program according to the present application will be described in detail based on the drawings. The present invention is not limited by the embodiments described below.

Configuration of First Embodiment
First, the configuration of a specific system according to the first embodiment will be described using FIG. FIG. 1 is a diagram illustrating an example of the configuration of a specific system according to the first embodiment. As shown in FIG. 1, the identification system 1 includes an identification device 10, a gateway device 20, and a device 30. Also, the identification device 10 and the gateway device 20 are communicably connected via the network 2. Further, the device 30 is communicably connected to the gateway device 20.

  For example, the device 30 is a terminal device such as a PC or a smartphone. The network 2 is, for example, the Internet. Also, the gateway device 20 is connected to the same LAN (Local Area Network) as the device 30, and captures the communication feature of the communication performed by the device 30 or the operation log of the device 30. In addition, the identification device 10 acquires the communication feature amount or the operation log captured by the gateway device 20, and performs abnormality detection and abnormality cause identification.

  The communication feature amount is, for example, a transmission source IP address, a transmission source MAC address, a transmission destination IP address, a transmission destination MAC address, the number of flows, and the like. The action log is the ID of the executed process, the execution start time of the process, and the like.

  The configuration of the identification device according to the first embodiment will be described with reference to FIG. FIG. 2 is a diagram illustrating an example of the configuration of the identification device according to the first embodiment. As shown in FIG. 2, the identification device 10 includes a communication unit 11, an input unit 12, an output unit 13, a storage unit 14, and a control unit 15.

  The communication unit 11 performs data communication with other devices via the network. For example, the communication unit 11 is a NIC (Network Interface Card). The input unit 12 receives an input of data from the user. The input unit 12 is, for example, an input device such as a mouse or a keyboard. The output unit 13 outputs data by screen display or the like. The output unit 13 is, for example, a display device such as a display.

  The input unit 12 and the output unit 13 may be an input interface and an output interface, respectively. For example, the input unit 12 and the output unit 13 perform data input and output with another device connected to the specific device 10 and a medium such as a memory card or a USB (Universal Serial Bus) memory. Also, the input unit 12 may receive data received by the communication unit 11 as input data. The output unit 13 may also output data to the communication unit 11.

  The storage unit 14 is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), or an optical disk. The storage unit 14 may be a semiconductor memory capable of rewriting data such as a random access memory (RAM), a flash memory, and a non volatile static random access memory (NV SRAM). The storage unit 14 stores an operating system (OS) executed by the specific device 10 and various programs. Furthermore, the storage unit 14 stores various information used in the execution of the program. The storage unit 14 also stores a detection model 141, a specific model 142, and an abnormality cause DB 143.

The detection model 141 is a model for detecting that the device 30 is in an abnormal state.
For example, the detection model 141 includes functions and parameters for calculating an anomaly score from a communication feature or operation log.

  The specific model 142 is a model for identifying an abnormal cause of the device 30. For example, it is a signature file in which a communication feature or action log for identifying an abnormal cause and an abnormal cause is described.

  The abnormality cause DB 143 is a communication feature amount for each abnormality cause. FIG. 3 is a view showing an example of the data configuration of the abnormality cause DB according to the first embodiment. As shown in FIG. 3, for example, in the abnormality cause DB 143, the transmission source IP address "192.0.2.10" and the transmission source MAC address "00-" are used as communication feature quantities for the abnormality cause "malware A". 00-5E-00-53-10 ", transmission destination IP address" 192.0.2.15 ", transmission destination MAC address" 00-00-5E-00-53-15 "and the like are associated with one another. Further, the communication feature amount or operation log of the abnormality cause DB 143 is not limited to that shown in FIG. For example, the communication feature amount or operation log of the abnormality cause DB 143 is a combination of captured data of a network packet, flow information of a payload, logs such as a telnet command used when logging in to resources such as a CPU or other servers, and flow information , A flow log related to Internet Protocol (IP) traffic between network interfaces, a combination of flow logs, and the like.

  In addition, as an abnormality cause of “DoS attack”, transmission source IP address “192.0.2.20”, transmission source MAC address “00-00-5E-00-53-20” as transmission feature amount, transmission Communication to the same destination IP address is increasing as the operation log for the destination IP address "10.10.0.15", destination MAC address "00-00-5E-00-53-25", etc. Etc. are associated. In addition, as an abnormality cause of “DoS attack”, transmission source IP address “192.0.2.21”, transmission source MAC address “00-00-5E-00-53-21”, transmission as a communication feature value Communication to the same destination IP address is increasing as the operation log for the destination IP address “10.20.0.25”, destination MAC address “00-00-5E-00-53-26”, etc. Etc. are associated. As described above, in the abnormality cause DB 143, a plurality of different communication feature amounts or operation logs may be associated with one abnormality cause.

  The control unit 15 controls the entire identification device 10. The control unit 15 is, for example, an electronic circuit such as a central processing unit (CPU), a graphics processing unit (GPU), a tensor processing unit (TPU) or a micro processing unit (MPU), an application specific integrated circuit (ASIC), or an FPGA ( An integrated circuit such as a field programmable gate array). The control unit 15 also has an internal memory for storing programs and control data that define various processing procedures, and executes each processing using the internal memory. The control unit 15 also functions as various processing units when various programs operate. For example, the control unit 15 includes a first generation unit 151, a detection unit 152, a second generation unit 153, an identification unit 154, and a storage unit 155.

  The first generation unit 151 learns a communication feature amount or an operation log (hereinafter, normal data) when the device 30 is in normal operation, and generates a detection model 141 for detecting that the device 30 is in an abnormal state. . For example, the first generation unit 151 performs learning so that the detection model 141 outputs an anomaly score that is so high that the input communication feature or operation log and the normal data are not similar, or the detection model 141 Collection is performed so as to output the identification result of the input communication feature amount or the operation log and the normal data.

  The second generation unit 153 learns the communication feature amount for each abnormality cause of the device 30, and generates a specific model 142 for identifying the abnormality cause of the device 30. For example, based on the abnormality cause DB 143, the second generation unit 153 outputs the abnormality cause associated with the communication feature amount or the action log similar to the input communication feature amount or the action log. In this way, learning is performed or collection is performed so that the specific model 142 outputs a communication feature amount that is the same as the input communication feature amount or operation log or an abnormal cause associated with the operation log.

  In addition, the second generation unit 153 can learn the tendency of the communication feature amount for each abnormality cause. That is, the second generation unit 153 can output an abnormality cause having a similar tendency of the communication feature amount even when a combination of communication feature amounts not present in the abnormality cause DB 143 is input to the specific model 142. can do.

  The detection unit 152 detects that the device 30 is in an abnormal state based on the detection model 141 and the communication feature amount or the operation log acquired from the device 30. For example, if the detection unit 152 inputs the communication feature amount or the operation log of the device 30 to be detected to the detection model 141 and the anomaly score output by the detection model 141 is equal to or more than the threshold, the device 30 is in an abnormal state. Detect that.

  When the detecting unit 152 detects that the device 30 is in an abnormal state, the identifying unit 154 identifies an abnormality cause of the device 30 based on the specific model 142 and the communication feature amount or the operation log acquired from the device 30. Do. For example, the specifying unit 154 inputs, to the specific model 142, the communication feature amount or the operation log of the device 30 whose abnormal state is detected by the detecting unit 152, and acquires the abnormal cause output by the specific model 142.

  Further, the output unit 13 outputs the communication feature amount or the operation log acquired from the device 30 and the first cause of abnormality of the device 30 specified by the specifying unit 154. Here, an incident response is performed for the communication feature amount or the operation log output by the output unit 13 and the first abnormality cause. For example, the incident response is that the system administrator specifies the cause of abnormality based on the communication feature amount or the operation log. Then, the input unit 12 receives the input of the second abnormality cause identified by the incident response performed based on the communication feature amount or the operation log output by the output unit 13 and the first abnormality cause.

  Here, it is conceivable that the first abnormality cause identified by the identification unit 154 and the second abnormality cause identified by the incident response are identical or not identical. When the first abnormality cause and the second abnormality cause are not the same, the storage unit 155 stores the second abnormality cause and the communication feature amount in the storage unit 14 in association with each other.

  On the other hand, when the first abnormality cause and the second abnormality cause are the same, the storage unit 155 stores the first abnormality cause and the communication feature amount in the storage unit 14 in association with each other. In this case, the storage unit 155 may store the second cause of abnormality and the communication feature amount in the storage unit 14 in association with each other.

  Then, the second generation unit 153 learns the cause of the abnormality acquired from the storage unit 14 and the communication feature amount or the operation log, or collects the abnormality cause and the communication feature amount or the operation log acquired from the storage unit 14 . Thereby, the identification device 10 can reflect the result of the incident response on the identification model 142.

  For example, as communication feature quantities of the device 30 to be detected, a transmission source IP address “192.0.2.22”, a transmission source MAC address “00-00-5E-00-53-22”, a transmission destination IP address “ It is assumed that the transmission destination MAC address “00-00-5E-00-53-27” and the communication protocol “UDP protocol” are input to the identification device 10. Further, in this case, it is assumed that the detection unit 152 detects that the device 30 is in an abnormal state.

  At this time, the specifying unit 154 sets the transmission source IP address “192.0.2.22”, the transmission source MAC address “00-00-5E-00-53-22”, and the transmission destination IP address “as communication feature values. 192.0.2.27 ", the transmission destination MAC address" 00-00-5E-00-53-27 ", and the communication protocol" UDP protocol "are input to the specific model 142. Then, the specific model 142 outputs “DoS attack” as an abnormal cause corresponding to the input communication feature amount.

  Here, the output unit 13 outputs “DoS attack” as an abnormality cause, and as a communication feature, a transmission source IP address “192.0.2.22”, a transmission source MAC address “00-00-5E-00”. -53-22 ", destination IP address" 192.0.2.27 ", destination MAC address" 00-00-5E-00-53-27 ", and communication protocol" UDP protocol ".

  Thereafter, it is assumed that the system administrator performs an incident response based on the communication feature amount and the abnormality cause output by the output unit 13 and identifies that the abnormality cause is “malware C”. The system administrator inputs the abnormality cause “malware C” identified by the incident response to the input unit 12.

  Here, “DoS attack” is the first cause of abnormality. Also, "malware C" is a first cause of abnormality. As described above, since the first abnormality cause and the second abnormality cause are not the same, the storage unit 155 associates the second abnormality cause “malware C” with the communication feature value, and the abnormality cause DB 143 of the storage unit 14 is associated. Store in

  There is the following example as a method of abnormality detection including the above. In the case of "DoS attack", it can be detected from the fact that the communication to the same destination IP address is increasing and the amount of data contained in the flow information is small, and in the case of "brute force attack" other servers The telnet communication and the SSH communication which are used when logging in are performed multiple times, and it is possible to detect from login failure multiple times in the operation log, and in the case of "port scan", access a port not communicating at normal time It can be detected from the fact that the same port of a plurality of destination IP addresses is being repeated, and that every port of the same destination IP address is sequentially accessed. Further, in the case of “malware”, taking the malware MIRAI as an example, transmitting destination IP address and login information successfully logged in by the telnet communication to an external C & C (Command and Control) server, the C & C It can be detected from the fact that a malicious program is downloaded to the device by the telnet communication from the server and downloaded to the device, and that the C & C server instructs the device to perform the “DoS attack”.

Processing of the First Embodiment
The process flow of the identification device 10 will be described with reference to FIGS. 4 and 5. The processing of the specific device 10 is roughly divided into an initialization phase and an operation phase. In the initial setting phase, the identification device 10 mainly performs collection or initial learning. Further, in the operation phase, the identification device 10 mainly performs abnormality detection of the device and identification of the cause of the abnormality.

  FIG. 4 is a flowchart showing the flow of processing in the initial setting phase of the specific device according to the first embodiment. As shown in FIG. 4, first, the second generation unit 153 checks whether or not there is a communication feature amount or an operation log of an abnormality cause in the abnormality cause DB 143 (step S101).

  Here, if there is a communication feature amount or operation log of the abnormality cause in the abnormality cause DB 143 (Yes at step S101), the second generation unit 153 collects the abnormality cause or performs initial learning, and generates the specific model 142. (Step S102). On the other hand, when the communication feature amount or the operation log of the abnormality cause does not exist in the abnormality cause DB 143 (No in step S101), the second generation unit 153 does not collect the abnormality cause or perform initial learning. Thus, the second generation unit 153 may generate the specific model 142 only when the abnormality cause DB 143 stores the abnormality cause and the communication feature amount or the operation log.

  Next, the first generation unit 151 performs normal operation collection or initial learning based on the communication feature amount or the operation log during normal operation of the device, and generates a detection model 141 (step S103). Note that, for example, initial learning is processing of newly generating the detection model 141 or the specific model 142 based on the normal data or the abnormality cause and the communication feature amount or the operation log stored in the abnormality cause DB 143. On the other hand, for example, the relearning is the abnormality cause and the communication feature amount or operation log stored in the abnormality cause DB 143, and the abnormality cause and the communication feature amount or operation that were not stored in the initial learning. This is a process of updating the specific model 142 based on the log.

  FIG. 5 is a flowchart showing the flow of processing in the operation phase of the specific device according to the first embodiment. As illustrated in FIG. 5, first, the detection unit 152 acquires a communication feature amount or an operation log of the device 30 to be detected (step S201). Next, the detection unit 152 inputs the acquired communication feature amount or operation log into the detection model 141 (step S202). Here, when an abnormality is not detected by the detection unit 152 (No at step S202), the process is returned to step S201, and the detection unit 152 acquires the communication feature amount or the operation log of the device 30 to be detected next. (Step S201).

  On the other hand, when an abnormality is detected by the detection unit 152 (Step S202, Yes), the identification unit 154 inputs the communication feature amount or operation log of the device 30 to be detected to the specific model 142, and identifies the abnormality cause ( Step S203). Then, the output unit 13 outputs the communication feature amount or the operation log of the device 30 to be detected and the abnormality cause identified by the identification unit 154 (step S204). Then, the input unit 12 receives an input of an incident response result (step S205).

  Here, when the abnormality cause identified by the identification unit 154 and the abnormality cause of the incident response result are the same (Yes at step S206), the process returns to step S201, and the detection unit 152 detects the next device 30 to be detected. The communication feature amount and the operation log are acquired (step S201).

  On the other hand, when the abnormality cause specified by the identification unit 154 and the abnormality cause of the incident response result are not the same (step S206, No), the storage unit 155 detects the communication cause of the device 30 for detection of the abnormality cause of the incident response result. It stores in the abnormality cause DB 143 together with the operation log (step S207).

  Here, if the collection or initial learning of the abnormal cause in the initial setting phase (step S102 in FIG. 4) has already been executed (step S208, Yes), the second generation unit 153 communicates with the abnormal cause from the abnormal cause DB 143. The feature amount or the operation log is acquired, and the cause of abnormality is collected or relearned (step S209).

  On the other hand, if the initial learning of the cause of the abnormality (step S102 in FIG. 4) in the initial setting phase has not been executed (No in step S208), the second generation unit 153 selects the abnormality cause and the communication feature amount or the operation from the abnormality cause DB 143 The log is acquired, and the cause of abnormality is collected or initial learning is performed (step S210).

  When the collection or relearning of the cause of the abnormality (step S209) or the collection or the initial learning (step S210) is performed, the process returns to step S201, and the detection unit 152 detects the communication feature of the device 30 to be detected next or An operation log is acquired (step S201).

[Effect of First Embodiment]
The first generation unit 151 learns a communication feature amount or an operation log at the time of normal operation of the device 30, and generates a detection model 141 for detecting that the device 30 is in an abnormal state. The second generation unit 153 collects or learns the communication feature amount or operation log for each cause of abnormality of the device 30, and generates a specific model 142 for identifying the cause of the abnormality of the device 30. The detection unit 152 detects that the device 30 is in an abnormal state based on the detection model 141 and the communication feature amount or the operation log acquired from the device 30. When the detecting unit 152 detects that the device 30 is in an abnormal state, the identifying unit 154 identifies an abnormality cause of the device 30 based on the specific model 142 and the communication feature amount or the operation log acquired from the device 30. Do.

  Thus, the specific system 1 has an architecture capable of both detecting the abnormality and identifying the cause of the abnormality. For example, the identification system 1 can perform both the abnormality detection using the whitelist method and the identification of the abnormality cause using the blacklist method. In addition, since the identification device 10 can identify the cause of the abnormality only when the abnormality is detected, the processing load required to identify the cause of the abnormality can be reduced. For this reason, according to the present embodiment, detection of an unknown abnormality and identification of an abnormality cause can be efficiently performed.

  The output unit 13 outputs the communication feature amount or the operation log acquired from the device 30 and the first cause of abnormality of the device 30 identified by the identification unit 154. The input unit 12 receives an input of the second abnormality cause identified by the incident response performed based on the communication feature amount or the operation log output by the output unit 13 and the first abnormality cause. When the first abnormality cause and the second abnormality cause are not the same, the storage unit 155 associates the second abnormality cause with the communication feature amount or the operation log, and stores them in the storage unit 14. The second generation unit 153 collects or learns the abnormality cause and the communication feature amount or the operation log acquired from the storage unit 14.

  In the incident response, it is conceivable that identification of a highly accurate abnormality cause is performed using knowledge of a system administrator or the like and an existing abnormality cause identification method. For this reason, in the present embodiment, by reflecting the result of the incident response on the model for identifying the cause of abnormality, it is possible to improve the identification accuracy of the cause of abnormality by the specific system 1.

  The second generation unit 153 may generate the specific model 142 only when the abnormality cause DB 143 stores the abnormality cause, the communication feature amount, or the operation log. Thereby, the specific system 1 can start the process even when the abnormality cause DB 143 does not store the abnormality cause and the communication feature amount or the operation log.

  In this case, the abnormal cause identified by the incident response is stored in the abnormal cause DB 143, and learning based on the abnormal cause is performed, whereby the specific cause of the abnormality can be identified by the specific system 1.

Other Embodiments
The device configuration of the specific system 1 is not limited to that of FIG. For example, the identification system 1 includes a detection device having a function corresponding to the first generation unit 151 and the detection unit 152, and an identification device having a function corresponding to the second generation unit 153 and the identification unit 154. It may be one. Also, the identification device 10 may directly acquire the communication feature amount or the operation log of the device 30 without passing through the gateway device 20.

  Also, the “communication feature or operation log” in the above description may be replaced with “communication feature”, “operation log” or “communication feature and operation log”. For example, the detection model 141 may be generated from both the communication feature and the operation log. Further, for example, the abnormality cause DB 143 may store an abnormality cause and an operation log.

  For example, the first generation unit 151 learns an operation log at the time of normal operation of the device 30, and generates a detection model 141 for detecting that the device 30 is in an abnormal state. The second generation unit 153 collects or learns the communication feature value for each abnormality cause of the device 30, and generates a specific model 142 for specifying the abnormality cause of the device 30. The detection unit 152 detects that the device 30 is in an abnormal state based on the detection model 141 and the operation log acquired from the device 30. When the detection unit 152 detects that the device 30 is in an abnormal state, the identification unit 154 identifies the cause of the abnormality of the device 30 based on the specific model 142 and the communication feature acquired from the device 30.

[System configuration etc.]
Further, each component of each device illustrated in the drawings is functionally conceptual, and does not necessarily have to be physically configured as illustrated. That is, the specific form of the dispersion and integration of each device is not limited to that shown in the drawings, and all or a part thereof is functionally or physically dispersed in any unit depending on various loads, usage conditions, etc. It can be integrated and configured. Furthermore, all or any part of each processing function performed in each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as wired logic hardware.

  Also, among the processes described in the present embodiment, all or part of the process described as being automatically performed can be manually performed, or the process described as being manually performed. All or part of them can be automatically performed by a known method. In addition to the above, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified.

[program]
In one embodiment, the specific device 10 can be implemented by installing a specific program that executes the above-described abnormality detection processing and abnormality source identification processing as packaged software or online software on a desired computer. For example, the information processing apparatus can function as the identification apparatus 10 by causing the information processing apparatus to execute the above-described identification program. The information processing apparatus referred to here includes a desktop or laptop personal computer. In addition, information processing apparatuses include server devices, mobile communication terminals such as smart phones, mobile phones and PHS (Personal Handyphone System), and slate terminals such as PDA (Personal Digital Assistant). included.

  The identification device 10 can also be implemented as an identification server device that uses a terminal device used by a user as a client and provides the client with a service related to the above-described abnormality detection processing and identification processing of an abnormality cause. For example, the specific server device is implemented as a server device that provides a specific service that receives as input the communication feature of the device and the operation log, and outputs as to whether or not it is in an abnormal state and an abnormal cause in the abnormal state. Ru. In this case, the specific server device may be implemented as a Web server, or may be implemented as a cloud that provides a service related to the abnormality detection process and the process of identifying an abnormality cause by outsourcing.

  FIG. 6 is a diagram illustrating an example of a computer that executes a specific program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. Disk drive interface 1040 is connected to disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, the display 1130.

  The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program defining each process of the identification device 10 is implemented as a program module 1093 in which a computer-executable code is described. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing the same processing as the functional configuration in the specific device 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD.

  The setting data used in the process of the above-described embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 and program data 1094 stored in the memory 1010 and the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

  The program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN, WAN (Wide Area Network), etc.). The program module 1093 and the program data 1094 may be read by the CPU 1020 from another computer via the network interface 1070.

DESCRIPTION OF SYMBOLS 1 specific system 2 network 10 specific apparatus 11 communication part 12 input part 13 output part 14 memory part 15 control part 20 gateway apparatus 30 apparatus 141 detection model 142 specific model 143 abnormality cause DB
151 first generation unit 152 detection unit 153 second generation unit 154 identification unit 155 storage unit

Claims (5)

A first generation unit that collects or learns a communication feature or operation log during normal operation of the device, and generates a detection model for detecting that the device is in an abnormal state;
A second generation unit that collects or learns a communication feature amount or an operation log for each malfunction cause of the device, and generates a specific model for identifying the malfunction cause of the device;
A detection unit configured to detect that the first device is in an abnormal state based on the detection model and a communication feature or operation log acquired from the first device;
When the detection unit detects that the first device is in an abnormal state, the first device is detected based on the specific model and the communication feature or the operation log acquired from the first device. A specific part that identifies the cause of the abnormality;
A specific system characterized by having: An output unit that outputs the communication feature amount or operation log acquired from the first device and the first cause of abnormality of the first device identified by the identification unit;
An input unit that receives an input of a second abnormality cause specified by an incident response performed based on the communication feature amount output by the output unit or the operation log and the first abnormality cause;
A storage unit that stores the second abnormality cause and the communication feature amount or the operation log in the storage unit in association with each other when the first abnormality cause and the second abnormality cause are not the same;
And have
The identification system according to claim 1, wherein the second generation unit learns the cause of abnormality acquired from the storage unit and the communication feature amount or the operation log.   The specific system according to claim 2, wherein the second generation unit generates the specific model only when an abnormality cause and a communication feature amount or an operation log are stored in the storage unit. A specific method implemented in a specific system,
A first collecting step or learning step of learning a communication feature amount or an operation log during normal operation of the device, and generating a detection model for detecting that the device is in an abnormal state;
A second collecting step or learning step of collecting or learning the communication feature value or operation log for each device abnormality cause, and generating a specific model for identifying the device abnormality cause;
A detection step of detecting that the first device is in an abnormal state based on the detection model and a communication feature or operation log acquired from the first device;
When it is detected in the detection step that the first device is in an abnormal state, the first device is detected based on the specific model and the communication feature or operation log acquired from the first device. A specific process of identifying the cause of abnormality;
Specific method characterized in that it contains. On the computer
A first generation step of learning a communication feature amount or an operation log at the time of normal operation of the device, and generating a detection model for detecting that the device is in an abnormal state;
A second generation step of collecting or learning communication feature quantities or operation logs for each device abnormality cause, and generating a specific model for identifying the device abnormality cause;
Detecting that the first device is in an abnormal state based on the detection model and a communication feature or operation log acquired from the first device;
When it is detected in the detection step that the first device is in an abnormal state, the cause of the abnormality of the first device is determined based on the specific model and the communication feature obtained from the first device. Specific steps to identify,
A specific program characterized by causing it to execute.

Images