JP2019204407A - Abnormal operation detection device, abnormal operation detection method, and program - Google Patents

Abstract

To provide an abnormal operation detection device capable of detecting abnormal operation in system operation.SOLUTION: An abnormal operation detection device includes a storage section 1, a reception section 2, a processing section 3, and an output section 4. A determination source information storage section 11 in the storage section stores determination source information based on two or more normal operation sets related to two or more pieces of normal operation information for identifying a normal operation for an information system in system operation. The reception section receives an operation set having two or more pieces of operation information for identifying an operation performed to the information system by a user. A determination section acquires abnormality information which is information related to abnormality for the operation set by using the determination source information and the operation set received by the reception section. The output section outputs the abnormality information acquired by the determination section.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an abnormal operation detection device and the like that determines the abnormality of an accepted operation set by using a normal operation set that is a set of two or more normal operations and outputs a determination result.

  2. Description of the Related Art Conventionally, an apparatus for recording and monitoring unauthorized access, operations, and operations by multiplexing and recording computer display screens and operations and other device operations together with moving images on the display screen and storing them as an audit trail. (See Patent Document 1).

JP 2005-295486 A

  However, in the conventional technique, it has been difficult or complicated to detect an abnormal operation using information on the input operation sequence in system operation.

  Further, in the prior art, it has been difficult or complicated to detect an abnormal operation for an input operation sequence using information on past normal operation sequences in system operation.

  Of the security levels of the general area, access area, and high security area, the security level required for system operation corresponds to the high security area. In the high security area, IT system developers and administrators perform operations. When operating the terminal, it is usually necessary to obtain approval in advance, and work is performed in accordance with a predetermined procedure manual.

  However, it has been difficult to detect an abnormal operation with respect to information in an operation sequence corresponding to the procedure manual used in the operation. Note that the abnormal operation is, for example, an operation outside the procedure manual, and is, for example, one or more types of operations among operation mistakes, troubleshooting, and unauthorized operations.

  The abnormal operation detection device according to the first aspect of the present invention is a determination source information in which determination source information based on two or more normal operation sets relating to two or more normal operation information for specifying a normal operation for an information system during system operation is stored. Using a storage unit, a reception unit that receives an operation set having two or more pieces of operation information that specifies an operation performed on the information system by the examinee, determination source information, and an operation set received by the reception unit An abnormal operation detection device including a determination unit that acquires abnormality information that is information related to abnormality in an operation set, and an output unit that outputs abnormality information.

  With this configuration, an abnormal operation can be detected during system operation.

  Further, in the abnormal operation detection device of the second invention, in contrast to the first invention, the normal operation set and the operation information are events generated by operations, and also include internal event information related to events generated by the information system. It is an abnormal operation detection device.

  With this configuration, an abnormal operation can be detected with high accuracy in system operation.

  Further, the abnormal operation detection device according to the third aspect of the present invention is different from the first or second aspect in that the operation set accepted by the accepting unit is 1 from the login to the logout by the examinee to the information system. This is information having operation information of two or more operations performed during the session, and the determination unit applies the entire operation set received by the reception unit to the determination source information and acquires abnormal information. It is a detection device.

  With this configuration, it is possible to appropriately detect an abnormal operation during system operation.

  The abnormal operation detection device according to the fourth aspect of the present invention is directed to any one of the first to third aspects of the invention, wherein the operation set received by the reception unit is a continuous operation performed on the information system by the examinee. An abnormality that has continuous operation information that is operation information of two or more operations to be performed, and the determination unit applies the continuous operation information to two or more normal operation sets in the determination source information storage unit and acquires abnormality information It is an operation detection device.

  With this configuration, it is possible to appropriately detect an abnormal operation during system operation.

  In addition, the abnormal operation detection device of the fifth aspect of the invention is a rare operation in which one or more rare operation information, which is operation information for specifying a rare operation, is stored for any one of the first to fourth inventions. An information storage unit is further provided, and the determination unit acquires rare operation presence information regarding the presence of one or more rare operation information in the rare operation information storage unit in the operation set accepted by the reception unit, and the rare operation exists. It is an abnormal operation detection device that acquires abnormal information using information.

  With this configuration, it is possible to appropriately detect an abnormal operation during system operation.

  Further, in the abnormal operation detection device according to the sixth aspect of the present invention, with respect to any one of the first to fifth aspects, the normal operation set is a normal operation vector composed of two or more normal operation information. The unit is an abnormal operation detection device that configures an input vector from the operation set received by the reception unit, and acquires abnormality information using the input vector and two or more normal operation vectors.

  With this configuration, it is possible to appropriately detect an abnormal operation during system operation.

  Further, in the abnormal operation detection device according to the seventh invention, with respect to any one of the first to sixth inventions, the determination source information is constituted by a machine learning algorithm using two or more normal operation sets. The determination unit is an abnormal operation detection device that applies the operation set received by the reception unit to a learning device using a machine learning algorithm to acquire abnormality information.

  With this configuration, an abnormal operation can be detected with high accuracy in system operation.

  According to the abnormal operation detection device of the present invention, an abnormal operation can be detected in system operation.

Block diagram of abnormal operation detection device A in the first embodiment A flowchart for explaining an operation example of the abnormal operation detection apparatus A Flow chart explaining an example of outlier detection processing A flowchart for explaining an example of the new time series feature detection processing A flowchart for explaining an example of the rare feature detection process Flowchart explaining the learning process First conceptual diagram for explaining the process of accumulating the determination source information Second conceptual diagram for explaining the process of accumulating the determination source information Conceptual diagram explaining cluster selection processing for detecting the abnormality Conceptual diagram for explaining outlier detection processing Conceptual diagram explaining detection processing based on the new time-series features Conceptual diagram explaining detection processing by the rare feature The figure which shows the output example of the abnormal information Overview of the computer system Block diagram of the computer system

  Hereinafter, embodiments of an abnormal operation detection device and the like will be described with reference to the drawings. In addition, since the component which attached | subjected the same code | symbol in embodiment performs the same operation | movement, description may be abbreviate | omitted again.

  (Embodiment 1)

  In the present embodiment, an abnormal operation detection device that determines the abnormality of an accepted operation set using a normal operation set that is a set of two or more normal operations of a user and outputs a determination result will be described. The operation set may include an internal event generated by a user operation. The operation set is preferably a set of operations for one session from login to logout.

  Further, in the present embodiment, abnormality detection is performed by, for example, detecting outliers in log data for each session described later, determination by detecting two or more new continuous operations described later, and detecting rare operations. There may be judgment.

  In the present embodiment, the normal operation set corresponds to one of two or more procedure manuals, and abnormality is determined using the normal operation set corresponding to the procedure manual for the accepted operation set. The abnormal operation detection device that outputs the determination result will be described.

  Furthermore, in this embodiment, an abnormal operation detection device that determines abnormality using a machine learning algorithm and outputs a determination result will be described.

  FIG. 1 is a block diagram of an abnormal operation detection device A in the present embodiment. The abnormal operation detection device A includes a storage unit 1, a reception unit 2, a processing unit 3, and an output unit 4.

  The storage unit 1 includes, for example, a determination source information storage unit 11, a rare operation information storage unit 12, and a procedure manual information storage unit 13. The processing unit 3 includes a learning unit 31 and a determination unit 32, for example.

  The determination unit 32 includes, for example, a procedure manual determination unit 321, a normal operation set selection unit 322, and a determination unit 323.

  Various information is stored in the storage unit 1. The various information includes, for example, determination source information described later, rare operation information described later, and procedure manual information described later.

  The determination source information storage unit 11 stores determination source information. The determination source information is information used for determining abnormality. The determination source information is information based on two or more normal operation sets. The normal operation set is information regarding two or more normal operation information. The normal operation information is information that identifies a normal operation for the information system during system operation. The normal operation information is, for example, a command name. The normal operation information includes, for example, a window identifier (for example, window title, window ID, etc.) for identifying a window to be operated and information (for example, command name, command name and argument [for example, database name, File name, variable name, data, etc.]). The normal operation information includes, for example, information that identifies an internal event that has occurred due to a user operation. The internal event is, for example, an event generated by the OS or an event generated by the application.

  The determination source information may be a set of two or more normal operations, or a learning device described later. The determination source information may be two or more normal operation vectors configured from a normal operation set. In addition, the determination source information may include one or more abnormal operation vectors configured from an illegal (abnormal) operation set in addition to two or more normal operation vectors configured from a normal operation set. The determination source information may be information including two or more normal operation sets and one or more abnormal operation sets.

  The normal operation set may be, for example, a normal operation vector that is a vector composed of two or more normal operation information. The normal operation vector is a vector having, for example, the appearance frequency of words (for example, command names, file names, etc.) included in two or more normal operation information as elements. The normal operation vector is, for example, information obtained by vectorizing two or more normal operation information using Bag-of-Words. The algorithm for acquiring the normal operation vector from the normal operation set is not limited.

  The normal operation set is, for example, two or more normal operation information indicating two or more normal operation sequences. The normal operation set is, for example, an operation log for the information system, and is a sequence of two or more normal instructions. For example, “useradd, mkdir, su, passwd,...”, “Useradd, passwd, usermod. "Touch, sudo, useradd ...". The information system is a computer, an application on the computer, a computer system, etc., for example, an information system of a bank. The instruction sequence is usually a time-series instruction sequence.

  The determination source information may be a learning device configured by a machine learning algorithm using two or more normal operation sets. The learning device is, for example, information acquired by the learning unit 31 described later.

  Each normal operation set corresponds to, for example, a procedure manual. Corresponding to the procedure manual may correspond to a procedure manual identifier for identifying the procedure manual, or may correspond to a procedure manual file. The procedure manual is a document used for information system operation and information system operation. The procedure manual may be called a manual. The procedure manual is, for example, a patch application procedure manual that is referred to when a patch is applied to the system, a log acquisition procedure manual that is referred to when an operation log is acquired, or a user addition procedure that is referred to when additionally registering a user. Books.

  Further, it is preferable that two or more normal operation sets are grouped and stored in association with one or more procedure manuals used for the operation. The process of grouping two or more normal operation sets is a process of grouping two or more normal operation vectors. For example, normal operation vectors are grouped using a distance between the vectors. Since the grouping process is a high-tech technique, a detailed description is omitted. It is preferable that the processing unit 3 perform such processing.

  This is because it is effective to classify a normal operation set for each procedure manual or a group of procedure manuals based on the following operation characteristics. That is, operations using procedure manuals are often performed thoroughly at the site of system operation, and the operation contents are similar. It is effective to use the characteristics and detect the abnormal operation as described later by using the collected operation log (operation set) and comparing it with the newly operated content.

  Further, each of the two or more normal operation sets may be stored as a group for each operation target server device. In many cases, a server device in a company is constructed for each application. When viewed for each server device, there are many cases where the work to be performed is from several types to ten or more types such as patch application and log acquisition. It is effective to use the system operation characteristics to group normal operation sets for each server device to be operated, and to detect abnormal operations as described later by using normal operation sets for each group. When grouped for each server device, for example, each of the two or more normal operation sets is associated with a server identifier for identifying the server device.

  The rare operation information storage unit 12 stores one or two or more rare operation information. The rare operation information is operation information that identifies a rare operation. The operation information is information related to the operation. The operation information is, for example, an instruction for specifying an operation, an information name to be used (file name, database name, etc.), an ID for specifying an instruction or information (argument, etc.). The operation information may be an internal event generated by the operation.

  The rare operation information is, for example, a command that identifies a rare operation. The rare operation information may be, for example, a rare information name. The rare operation information is, for example, an ID that identifies a command or information (such as an argument). The rare operation information in the rare operation information storage unit 12 is, for example, information acquired by the processing unit 3 described later from two or more normal operation sets in the determination source information storage unit 11.

  The procedure manual information storage unit 13 stores one or more pieces of procedure manual information. The procedure manual information is information related to the procedure manual. The procedure manual information may be a procedure manual file or a vector composed of the procedure manual file. The procedure manual information is, for example, a vector whose elements are appearance frequencies of terms included in the procedure manual file. The procedure manual information is, for example, information (vector) obtained by vectorizing a procedure manual file using Bag-of-Words.

  Further, two or more pieces of procedure manual information may be grouped in the procedure book information storage unit 13. That is, two or more similar procedure manual information may be grouped in the procedure manual information storage unit 13. When the procedure manual information is, for example, a vector, a set of clustered vectors constitutes a group. Note that the two or more similar procedure manual information is, for example, two or more procedure manual information corresponding to vectors that are close enough to satisfy a predetermined condition of a distance between vectors configured from each procedure manual information. Further, since a technique for classifying and grouping a set of vectors is a known technique, a description thereof will be omitted. Further, when the procedure manual information is grouped, a vector representing each group may be stored in the procedure manual information storage unit 13. The vector representing the group is, for example, an average value vector of one or more vectors belonging to the group.

  The accepting unit 2 accepts various instructions and information. The various instructions and information are, for example, an operation set, a determination instruction, and a learning instruction. The operation set is information having two or more pieces of operation information for specifying an operation performed on the information system by the examinee. The operation set is, for example, a set of operation information for one session from login to logout, but may be a set of operation information in an amount satisfying a predetermined condition. The amount of operation that satisfies a predetermined condition includes an operation in units of one hour, operation information that exceeds a predetermined amount, and the like. The inspected person is a user who is inspected whether or not an abnormal operation has been performed.

  The determination instruction is an instruction for making a determination regarding the abnormality of the operation set. The determination instruction includes an operation set or information specifying the operation set. The determination instruction may have a procedure manual identifier. Further, the determination instruction may include a server identifier for identifying the server device.

  The learning instruction is an instruction for configuring a learning device described later using two or more normal operation sets. The learning instruction may include information for specifying the procedure manual. The information for specifying the procedure manual is, for example, a procedure manual identifier and a group identifier for specifying a group of procedure manuals.

  The operation set is information obtained by recording a set of operations performed by the subject on the information system by a recording unit (not shown) included in the information system. The operation set is preferably information having operation information of two or more operations performed by the examinee on the information system during one session from login to logout. However, the operation set may be information on operation information of an operation during a partial period during one session.

  Here, reception means reception of information transmitted via a wired or wireless communication line, reception of information read from a recording medium such as an optical disk, a magnetic disk, or a semiconductor memory, a keyboard, a mouse, a touch panel, etc. It is a concept that includes receiving information input from an input device.

  The processing unit 3 performs various processes. The various processes are processes performed by the learning unit 31 and the determination unit 32, for example.

  The learning unit 31 performs a learning process on two or more normal operation sets by a machine learning algorithm to configure a learning device.

  For example, when the receiving unit 2 receives a learning instruction, the learning unit 31 performs a learning process on two or more normal operation sets according to the learning instruction, and configures a learning device.

  When the learning instruction includes information for specifying the procedure manual, the learning unit 31 determines two or more normal operation sets corresponding to the procedure manual specified by the information for specifying the procedure manual as the determination source information storage unit. 11 and performing learning processing on the two or more normal operation sets to configure a learning device. The learning unit 31 acquires two or more normal operation sets from the determination source information storage unit 11 for each of one or two or more groups, performs learning processing on the two or more normal operation sets, and learners Is preferable. With this process, a learning device can be configured for each procedure manual or for each group.

  The machine learning algorithm is, for example, deep learning, SVM, SVR, decision tree, random forest, etc.

  The learning unit 31 may perform a learning process using two or more normal operation sets (positive examples) and two or more abnormal operation sets (negative examples) by a machine learning algorithm to configure a learning device. . In such a case, the negative example is preferably given in advance, but the learning unit 31 may automatically generate it. For example, the learning unit 31 automatically generates one or more vectors whose distances from two or more vectors composed of two or more normal operation sets are equal to or greater than a threshold. For example, the learning unit 31 has a distance from an average value vector of two or more vectors composed of two or more normal operation sets (a vector having an average value of elements of two or more vectors as an element) equal to or greater than a threshold value. Automatically generate one or more vectors.

  The determination unit 32 acquires abnormality information using the determination source information and the operation set received by the reception unit 2. The abnormality information is information relating to abnormality with respect to the operation set received by the reception unit 2. The abnormality information is, for example, information indicating abnormality, information indicating normality, information indicating an abnormal location in the operation set received by the receiving unit 2, and the like. The information indicating the abnormal part is, for example, information that specifies an abnormal instruction sequence, rare operation information, or rare operation information in the operation set received by the receiving unit 2. The abnormality information is, for example, a report regarding abnormality. The abnormality information is, for example, information on the abnormality for each group described above.

  For example, the determination unit 32 configures an input vector from the operation set received by the reception unit 2 and acquires abnormality information using the input vector and two or more normal operation vectors. The input vector may be referred to as an operation set vector.

  For example, the determination unit 32 determines a procedure manual corresponding to the operation set received by the reception unit 2 and acquires abnormality information using two or more normal operation sets corresponding to the procedure manual.

  For example, the determination unit 32 applies the operation set received by the reception unit 2 to a learning device using a machine learning algorithm, and acquires abnormality information.

For example, the determination unit 32 determines an abnormality by one or more of the following (1) to (3). Note that (1) is outlier detection, (2) is detection by a new time series feature, and (3) is detection by a rare feature.
(1) Outlier detection

  Outlier detection is to determine whether or not the entire operation set to be judged for anomaly is out of the normal operation set.

  For example, the determination unit 32 applies the entire operation set received by the reception unit 2 to the determination source information, and acquires abnormality information regarding an outlier.

  The determination unit 32 includes, for example, an operation set vector that is a vector configured from the entire operation set received by the reception unit 2 and each normal operation set vector that is a vector configured from two or more normal operation sets. The distance is acquired, and it is determined whether or not the average value of the distance is equal to or greater than a threshold value. For example, when the average distance value is equal to or greater than the threshold value or greater than the threshold value, the determination unit 32 acquires abnormality information indicating that the distance is abnormal, and when the average distance value is equal to or less than the threshold value or less than the threshold value, the determination unit 32 is normal. Abnormal information indicating that there is.

  Further, the determination unit 32 acquires, for example, an average value of normal operation set vectors including two or more normal operation sets, and a distance between the average value and an operation set vector including the entire operation set. To determine whether the distance is greater than or equal to the threshold value. For example, when the distance is equal to or larger than the threshold value or larger than the threshold value, the determination unit 32 acquires abnormality information indicating that the distance is abnormal, and when the distance is equal to or smaller than the threshold value or less than the threshold value, the abnormal information indicating that the distance is normal. To get.

  For example, the determination unit 32 may compare the operation set received by the reception unit 2 with the determination source information in the determination source information storage unit 11 and detect outliers using lof. More specifically, the determination unit 32 compares, for example, the operation set vector acquired from the operation set received by the reception unit 2 with each of the two or more normal operation set vectors of the determination source information storage unit 11, Outlier detection by lof may be performed. In addition, since the outlier detection by lof is a known technique, description thereof is omitted.

For example, the determination unit 32 applies the entire operation set received by the reception unit 2 to the learning device described above, and acquires abnormality information by a machine learning algorithm. When the learning device is a learning device that classifies whether it is abnormal or normal, the determination unit 32 applies the entire operation set received by the receiving unit 2 to the above-described learning device, and uses a machine learning algorithm. Acquires abnormality information indicating whether it is abnormal or normal.
(2) Detection by new time series features

  The detection based on the new time-series feature is detection of abnormality relating to the presence of a time-series operation sequence that does not appear in the normal operation set or is difficult to appear in the operation set to be determined for abnormality.

  The determination unit 32 applies the continuous operation information to two or more normal operation sets in the determination source information storage unit 11 and acquires abnormality information. The continuous operation information is operation information of two or more operations that are continuous in time. The continuous operation information has two or more pieces of operation information.

For example, the determination unit 32 acquires one or two or more pieces of operation information that is information of two or three or more consecutive operation sequences from the operation set received by the reception unit 2, and the acquired operation information is stored as determination source information. It is detected whether it is included in two or more normal operation sets of the part 11. Then, the determination unit 32 acquires, for example, the number of appearances or the appearance ratio of new continuous operation information that is not included in the two or more normal operation sets in the determination source information storage unit 11. Then, for example, when the number of appearances or the appearance ratio is equal to or larger than the threshold value or larger than the threshold value, the determination unit 32 acquires abnormality information indicating abnormality, and indicates that it is normal when the value is equal to or smaller than the threshold value or smaller than the threshold value. Get anomaly information. Note that the determination unit 32 may acquire, for example, a value calculated using an increasing function using the number of appearances or the appearance ratio as a parameter as an abnormal score. The abnormality score is an example of abnormality information. In addition, the appearance ratio of new continuous operation information is, for example, “number of new continuous operation information in the operation set received by the receiving unit 2 / continuous operation information in the operation set received by the receiving unit 2”. Calculated by “number”.
(3) Detection by rare features

  The detection based on the rare feature is detection of an abnormality related to the presence of an operation that does not appear or is difficult to appear in the normal operation set in the operation set to be judged for anomaly.

  The determination unit 32 acquires rare operation presence information on the presence of one or more rare operation information in the rare operation information storage unit 12 in the operation set accepted by the acceptance unit 2 and uses the rare operation presence information to indicate an abnormality. Get information. The rare operation presence information includes, for example, the content ratio of rare operation information (number of rare operation information / number of operation information), the number of rare operation information, whether or not rare operation information exists.

  The procedure manual determination unit 321 determines the procedure manual using the operation set received by the receiving unit 2. For example, the procedure manual determination unit 321 constructs a vector from the operation set received by the receiving unit 2 and calculates the distance between the vector and two or more pieces of procedure manual information that are vectors of the procedure manual information storage unit 13. The procedure manual corresponding to the procedure manual information having the shortest distance is determined as the procedure manual to be adopted. For example, the procedure manual determining unit 321 constructs a vector from the operation set received by the receiving unit 2, calculates the distance between the vector and the vector of each group stored in the procedure manual information storage unit 13, and calculates the distance. The procedure manual corresponding to the group with the smallest is determined as the procedure manual to be adopted.

  The procedure manual determination unit 321 may determine the procedure manual by acquiring the procedure manual identifier received by the receiving unit 2.

  The normal operation set selection unit 322 acquires two or more normal operation sets corresponding to the procedure manual determined by the procedure manual determination unit 321 from the determination source information storage unit 11. In such a case, the normal operation set corresponds to the procedure manual. The normal operation set selection unit 322 acquires, for example, two or more normal operation sets that are paired with the procedure manual identifier acquired by the procedure manual determination unit 321 from the determination source information storage unit 11. The normal operation set selection unit 322 may acquire two or more normal operation sets that are paired with the server identifier included in the determination instruction received by the reception unit 2 from the determination source information storage unit 11.

  The determination unit 323 acquires abnormality information using two or more normal operation sets acquired by the normal operation set selection unit 322. Note that the determination unit 323 may not include the procedure manual determination unit 321 and the normal operation set selection unit 322, and may acquire abnormality information using all normal operation sets.

  In addition, since the process in which the determination unit 323 acquires abnormality information using two or more normal operation sets has been described above, a description thereof will be omitted. The process in which the determination unit 323 acquires abnormality information using two or more normal operation sets includes, for example, (1) detection of outliers, (2) detection by new time series features, and (3) rare features. It is detection by.

  The output unit 4 outputs the abnormality information acquired by the determination unit 32. Here, output refers to display on a display, projection using a projector, printing with a printer, sound output, transmission to an external device, storage in a recording medium, and output to other processing devices or other programs. It is a concept that includes delivery of processing results.

  The storage unit 1, the determination source information storage unit 11, the rare operation information storage unit 12, and the procedure manual information storage unit 13 are preferably non-volatile recording media, but can also be realized by volatile recording media.

  The process in which information is stored in the storage unit 1 or the like is not limited. For example, information may be stored in the storage unit 1 or the like via a recording medium, information transmitted via a communication line or the like may be stored in the storage unit 1 or the like, Alternatively, information input via the input device may be stored in the storage unit 1 or the like.

  The processing unit 3, the learning unit 31, the determination unit 32, the procedure manual determination unit 321, the normal operation set selection unit 322, and the determination unit 323 can be normally realized by an MPU, a memory, or the like. The processing procedure of the processing unit 3 is usually realized by software, and the software is recorded on a recording medium such as a ROM. However, it may be realized by hardware (dedicated circuit).

  The output unit 4 may be considered as including or not including an output device such as a display or a speaker. The output unit 4 can be realized by driver software for an output device or driver software for an output device and an output device.

  Next, an operation example of the abnormal operation detection device A will be described using the flowchart of FIG.

  (Step S201) The accepting unit 2 judges whether a judgment instruction has been accepted. If a determination instruction is accepted, the process proceeds to step S202. If a determination instruction is not accepted, the process proceeds to step S208.

  (Step S202) The determination unit 32 acquires an operation set corresponding to the determination instruction in step S201. For example, the determination unit 32 acquires an operation set included in the determination instruction.

  (Step S203) The determination unit 32 performs an outlier detection process on the operation set acquired in Step S202. An example of outlier detection processing will be described with reference to the flowchart of FIG.

  (Step S204) The determination unit 32 performs detection processing based on the new time-series feature on the operation set acquired in Step S202. An example of new time-series feature detection processing will be described with reference to the flowchart of FIG.

  (Step S205) The determination unit 32 performs a rare feature detection process on the operation set acquired in Step S202. An example of the rare feature detection process will be described with reference to the flowchart of FIG.

  (Step S206) The processing unit 3 configures abnormality information to be output using one or more abnormality information among the abnormality information acquired in Step S203, Step S204, and Step S205.

  (Step S207) The output unit 4 outputs the abnormality information configured in Step S206. The process returns to step S201.

  (Step S208) The reception unit 2 determines whether a learning instruction has been received. When the learning instruction is accepted, the process goes to step S209, and when the learning instruction is not accepted, the process returns to step S201.

  (Step S209) The learning unit 31 performs a learning process. The process returns to step S201. The learning process will be described with reference to the flowchart of FIG.

  In the flowchart of FIG. 2, the process is terminated by powering off or a process termination interrupt.

  Next, an example of outlier detection processing in step S203 will be described using the flowchart of FIG.

  (Step S301) The determination unit 32 assigns 1 to the counter i.

  (Step S <b> 302) The determination unit 32 determines whether or not the i-th normal operation set exists in the determination source information storage unit 11. If the i-th normal operation set exists, go to step S303; otherwise, go to step S305.

  (Step S303) The determination unit 32 acquires the i-th normal operation set from the determination source information storage unit 11, and acquires a vector from the i-th normal operation set. Such a vector is a normal operation vector.

  (Step S304) The determination unit 32 increments the counter i by one. The process returns to step S302.

  (Step S305) The determination unit 32 acquires an operation set vector from the operation set acquired in step S202.

  (Step S306) The determination unit 32 determines whether or not the operation set vector acquired in step S305 is an outlier with respect to the two or more normal operation vectors acquired in step S303. If there is an outlier, go to step S307, and if not, go to step S308. In addition, whether it is an outlier is acquired by lof, for example.

  (Step S307) The determination unit 32 substitutes a value indicating “abnormal” into the variable “first abnormality information”. Return to upper process. This value indicates that the operation set to be examined is an outlier.

  (Step S308) The determination unit 32 substitutes a value indicating “normal” into the variable “first abnormality information”. Return to upper process. This value indicates that the operation set to be examined is not an outlier.

  Next, an example of the new time-series feature detection process in step S204 will be described using the flowchart of FIG.

  (Step S401) The determination unit 32 substitutes 1 for a counter i.

  (Step S402) The determination unit 32 determines whether or not the i-th continuous operation information exists in the operation set acquired in step S202. If the i-th continuous operation information exists, the process goes to step S403. If the i-th continuous operation information does not exist, the process goes to step S406.

  (Step S403) The determination unit 32 acquires the i-th continuous operation information from the operation set acquired in Step S202. For example, the determination unit 32 shifts the current operation information from an operation set that is a sequence of two or more pieces of operation information while shifting n pieces (n is a natural number of 2 or 3) of continuous operation information. Get continuous operation information that is a column. The interval for shifting is usually 1, but n or the like may be acceptable.

  (Step S404) The determination unit 32 acquires the number of appearances of the i-th continuous operation information acquired in step S403 in two or more normal operation sets in the determination source information storage unit 11.

  (Step S405) The determination unit 32 increments the counter i by 1. The process returns to step S402.

  (Step S406) The determination unit 32 acquires the second abnormality information using the number of appearances of the continuous operation information acquired in Step S404. Return to upper process.

  The determination unit 32 acquires, for example, the number of continuous operation information whose number of appearances acquired in step S404 is equal to or less than the first threshold value or less than the first threshold value (for example, 0), and the number is the second value. When the value is greater than or equal to the threshold value or greater than the second threshold value, a value indicating “abnormal” is substituted into the variable “second abnormality information”. For example, the determination unit 32 acquires the number of continuous operation information in which the number of appearances acquired in step S404 is equal to or less than the first threshold or less than the first threshold (for example, 0), and the number is the second If the value is equal to or less than the threshold value or less than the second threshold value, a value indicating “normal” is substituted into the variable “second abnormality information”.

  Further, the determination unit 32 acquires, for example, the number of continuous operation information whose number of appearances acquired in step S404 is equal to or less than the first threshold value or less than the first threshold value (for example, 0), and uses the number, A ratio in the operation set to be inspected is acquired, and when the ratio is equal to or greater than the second threshold value or greater than the second threshold value, a value indicating “abnormal” is substituted into the variable “second abnormality information”. In addition, the determination unit 32 acquires, for example, the ratio of continuous operation information whose number of appearances acquired in step S404 is equal to or less than the first threshold value or less than the first threshold value (for example, 0), and the ratio is the second threshold value. If the value is equal to or less than the threshold value or less than the second threshold value, a value indicating “normal” is substituted into the variable “second abnormality information”.

  Next, the rare feature detection process in step S205 will be described with reference to the flowchart of FIG.

  (Step S501) The determination unit 32 performs an initialization process. The initialization process includes a process of substituting 0 for the variable “number of rare operations”.

  (Step S502) The determination unit 32 acquires the number of appearances of each element in the acquired operation set (operation set to be inspected). The element is usually operation information.

  (Step S503) The determination unit 32 substitutes 1 for a counter i.

  (Step S504) The determination unit 32 determines whether or not the i-th element exists in the acquired operation set (operation set to be inspected). When the i-th element exists, the process goes to step S505, and when the i-th element does not exist, the process goes to step S509.

  (Step S505) The determination unit 32 acquires the i-th element in the acquired operation set (operation set to be inspected).

  (Step S506) The determination unit 32 determines whether or not the i-th element acquired in step S505 is rare operation information. If the i-th element is rare operation information, the process goes to step S507. If the i-th element is not rare operation information, the process goes to step S508. Whether or not the i-th element is rare operation information is determined by whether or not the i-th element exists in the rare operation information storage unit 12, for example. That is, when the i-th element exists in the rare operation information storage unit 12, the determination unit 32 determines that the i-th element is rare operation information. In addition, the determination unit 32 calculates the number or ratio in which the i-th element is present in two or more normal operation sets of the determination source information storage unit 11, and the i-th element Is determined to be rare operation information.

  (Step S507) The determination unit 32 increments the variable “number of rare operations” by one.

  (Step S508) The determination unit 32 increments the counter i by one. The process returns to step S504.

  (Step S509) The determination unit 32 determines whether or not the value of the variable “number of rare operations” satisfies the condition. If the condition is satisfied, the process goes to step S510. If the condition is not satisfied, the process goes to step S511. Here, the determination unit 32 determines whether the value of the variable “number of rare operations” is large enough to satisfy a predetermined condition.

  (Step S510) The determination unit 32 substitutes a value indicating “abnormal” into the variable “third abnormality information”. Return to upper process. When the variable “third abnormality information” is a value indicating “abnormal”, it indicates that many rare operations have been performed.

  (Step S511) The determination unit 32 assigns a value indicating “normal” to the variable “third abnormality information”. Return to upper process.

  Next, the learning process of step S209 will be described using the flowchart of FIG.

  (Step S601) The learning unit 31 substitutes 1 for a counter i.

  (Step S602) The learning unit 31 determines whether or not the i-th normal operation set exists. When the i-th normal operation set exists, the process goes to step S603, and when the i-th normal operation set does not exist, the process goes to step S605.

  (Step S603) The learning unit 31 configures a normal operation vector from the i-th normal operation set.

  (Step S604) The learning unit 31 increments the counter i by 1. The process returns to step S602.

  (Step S605) The learning unit 31 substitutes 1 for the counter j.

  (Step S606) The learning unit 31 determines whether or not the j-th abnormal operation set exists. When the j-th abnormal operation set exists, the process goes to step S603, and when the j-th abnormal operation set does not exist, the process goes to step S605.

  (Step S607) The learning unit 31 constructs an abnormal operation vector from the j-th abnormal operation set.

  (Step S608) The learning unit 31 increments the counter j by 1. The process returns to step S602.

  (Step S609) The learning unit 31 performs a learning process using two or more normal operation vectors and one or more abnormal operation vectors, and configures a learning device for determining whether the operation set is normal.

  (Step S610) The learning unit 31 accumulates the learning device configured in step S609 in the determination source information storage unit 11. Return to upper process.

  In the flowchart of FIG. 6, it is preferable that the learning unit 31 configures and stores a learning device for each procedure manual, for each group of procedure manuals, or for each server device.

Hereinafter, a specific operation example of the abnormal operation detection device A in the present embodiment will be described. First, two specific examples (specific example 1 and specific example 2) in which the determination source information is stored in the determination source information storage unit 11 will be described. Next, cluster selection processing for abnormality detection will be described in a specific example 3. Next, detection of abnormalities of outlier detection, detection based on new time-series features, and detection based on rare features will be described using specific example 4, specific example 5, and specific example 6.
(Specific example 1)

  Specific example 1 in which the determination source information is stored in the determination source information storage unit 11 will be described with reference to FIG. In the first specific example, it is assumed that the user performs various normal operations for system operation during a period from when the user logs in to the server device using the terminal device and when the user logs out. It is assumed that the user has performed work based on the procedure manual.

  In a terminal device (not shown), it is assumed that operation information (window title and keyboard input) of a normal operation input by the user based on the procedure manual is recorded and log data is accumulated. Then, it is assumed that the log data and the server identifier are transmitted from the terminal device to the abnormal operation detection device A. The log data is a set of normal operations, and is a set of operations for one session (from login to logout). Further, it is assumed that the server identifier is a server device constituting a system operated by the user and is stored in the terminal device.

  Next, the receiving unit 2 of the abnormal operation detection device A receives the normal operation set and the server identifier from the terminal device.

  Next, the processing unit 3 of the abnormal operation detection device A vectorizes the normal operation set using, for example, Bag-of-Words, forms a normal operation set vector, associates it with the server identifier, Accumulate in the information storage unit 11.

  The processing unit 3 also clusters two or more normal operation set vectors associated with each server identifier. As a result of such clustering, it is assumed that two or more normal operation set vectors corresponding to each server identifier are grouped for each procedure manual.

  Note that log data, a server identifier, and a procedure manual identifier may be transmitted from the terminal device to the abnormal operation detection device A. In such a case, the receiving unit 2 of the abnormal operation detection device A receives the normal operation set, the server identifier, and the procedure manual identifier from the terminal device. Then, the processing unit 3 vectorizes the normal operation set using, for example, Bag-of-Words to form a normal operation set vector, and the normal operation set vector is received from the received server identifier and procedure manual identifier. Are stored in the determination source information storage unit 11 in association with each other.

  It is assumed that the above processing has been performed for many user operations. Then, two or more normal operation set vectors are accumulated in the determination source information storage unit 11 of the abnormal operation detection device A. The normal operation set vector is an example of determination source information.

FIG. 7 shows an outline of the processing of the specific example 1 described above. In FIG. 7, the word appearance frequency matrix is formed on the normal operation set by Bag-of-Words. For example, the normal operation set in which the operation information “ls” is “3” and “ping” is “2”. A vector is constructed. Further, clustering corresponding to the server identifier and the procedure manual identifier is performed on the normal operation set vector. In FIG. 7, one user operates one server apparatus based on a plurality of procedure manuals. However, one user operates a plurality of server apparatuses based on a plurality of procedure manuals. Or a plurality of users may perform operations on one server device, or a plurality of users may perform one operation.
(Specific example 2)

  Specific example 2 in which the determination source information is stored in the determination source information storage unit 11 will be described with reference to FIG. In specific example 2, it is assumed that two or more pieces of procedure manual information are stored in the procedure manual information storage unit 13. Here, the procedure manual information is, for example, a file in which an operation procedure is described.

  Then, the processing unit 3 vectorizes two or more pieces of procedure manual information using, for example, Bag-of-Words. Then, the processing unit 3 clusters the acquired procedure manual vectors, generates a set of similar procedure manuals, and determines the clustered procedure manual vectors (for example, associated with the group identifiers of the procedure manuals). It accumulates in the procedure manual information storage unit 13. The algorithm for vectorizing the procedure manual information is not limited.

  In the second specific example, it is assumed that the user logs in to the server device using the terminal device for system operation and performs various normal operations during the period until the user logs out. It is assumed that the user has performed work based on a procedure manual.

  In a terminal device (not shown), it is assumed that operation information (window title and keyboard input) of a normal operation input by the user based on the procedure manual is recorded and log data is accumulated. Then, it is assumed that log data is transmitted from the terminal device to the abnormal operation detection device A. The log data is a set of normal operations, and is a set of operations for one session (from login to logout).

  Next, the receiving unit 2 of the abnormal operation detection device A receives a normal operation set from the terminal device.

  Next, the processing unit 3 of the abnormal operation detection apparatus A vectorizes the normal operation set using, for example, Bag-of-Words, forms a normal operation set vector, and stores the normal operation set vector in the determination source information storage unit 11. .

  Next, the processing unit 3 determines a set of procedure manual vectors corresponding to the acquired normal operation set vector from the acquired normal operation set vector and the set of procedure manual vectors in the procedure manual information storage unit 13. For example, for each group of procedure manuals, the processing unit 3 acquires a representative vector that is a representative value of the vector of the procedure manual and associates it with the representative vector that is closest to the normal operation set vector. The representative vector is, for example, a set of elements including average values of the elements of the vectors in the procedure manual.

  It is assumed that the above processing has been performed for a large number of user operations. Then, two or more normal operation set vectors are stored in the determination source information storage unit 11 of the abnormal operation detection device A in association with the procedure manual.

FIG. 8 shows an outline of the processing of the specific example 1 described above. In FIG. 8, a vector is composed of procedure manual information, and a vector is composed of a normal operation set (log data). In addition, the procedure manual vectors are clustered. Further, a set of clustered procedure manual vectors is associated with a set of normal operation set vectors.
(Specific example 3)

  Specific example 3 for explaining the cluster selection process for detecting an abnormality will be described with reference to FIG. In the specific example 3, it is assumed that the subject performs various operations based on the procedure manual A during the period from the time of logging in to the server device using the terminal device and the time of logging out for system operation.

  In the terminal device, it is assumed that the operation information (window title and keyboard input) of the operation input by the subject based on the procedure manual A is recorded and the log data is accumulated. Then, it is assumed that a determination instruction including log data is transmitted from the terminal device to the abnormal operation detection device A. The log data is an operation set to be inspected, and is an operation set for one session (from login to logout). The server identifier is a server device constituting a system operated by the user.

  Next, the reception unit 2 of the abnormal operation detection device A receives a determination instruction including an operation set from the terminal device.

  The determination unit 32 acquires an operation set corresponding to the determination instruction. Next, the determination unit 32 constructs an operation set vector from the operation set using, for example, Bag-of-Words.

  Next, the procedure manual determination unit 321 of the determination unit 32 uses the operation set vector to determine a vector group of the procedure manual A, which is a vector group that is closest to the operation set vector. That is, the procedure manual determination unit 321 determines the procedure manual A.

  Next, the normal operation set selection unit 322 acquires two or more normal operation sets corresponding to the procedure manual A from the determination source information storage unit 11. That is, the normal operation set selection unit 322 acquires log information according to the procedure manual A.

FIG. 9 is a diagram illustrating the concept of the processing of the specific example 3 described above.
(Specific example 4)

  Specific example 4 for explaining the outlier detection process will be described with reference to FIG.

  For example, the determination unit 32 acquires a normal operation set vector from each of two or more normal operation sets corresponding to the procedure manual A acquired in the specific example 3. The two or more normal operation set vectors (which may be referred to as learning data) are assumed to be 1001 in FIG. Note that reference numeral 1001 in FIG. 10 denotes a normal log group.

  Next, the determination unit 32 acquires an operation set vector from the operation set received from the terminal device. Such an operation set vector is assumed to be 1002 in FIG. Note that reference numeral 1002 in FIG. 10 is a new log.

  Then, the determination unit 32 compares the operation set vector 1002 with two or more normal operation set vectors 1001, detects outliers using lof, and determines that the operation set vector 1002 is an outlier. .

Next, the determination unit 32 substitutes a value indicating “abnormal” into the variable “first abnormality information”.
(Specific example 5)

  Specific example 5 for explaining the detection process based on the new time-series feature will be described with reference to FIG. In the specific example 5, for example, the determination unit 32 converts the log data in one session to feature-time data by bigram. The determination unit 32 counts the number of time-series features that do not exist in the past learning data, and detects an abnormality based on whether or not the threshold value is exceeded.

  For example, the determination unit 32 acquires two or more normal operation sets corresponding to the procedure manual A acquired in the specific example 3.

  Next, the determination unit 32 acquires continuous operation information that is two pieces of operation information from the operation set that is a new log received from the terminal device while shifting the operation information one by one. Then, the determination unit 32 determines whether each continuous operation information appears in two or more normal operation sets. In FIG. 11, the continuous operation information “E → B” in the operation set which is a new log does not appear in two or more normal operation sets.

  Next, the determination unit 32 calculates the number of pieces of continuous operation information that did not appear in two or more normal operation sets.

  Next, the determination unit 32 determines whether or not the number of continuous operation information that did not appear in the two or more normal operation sets is equal to or greater than a threshold value. Here, it is assumed that the determination unit 32 determines that the value is less than the threshold value.

Next, the determination unit 32 substitutes a value indicating “normal” into the variable “second abnormality information”.
(Specific example 6)

  A specific example 6 for explaining the detection process based on the rare feature will be described with reference to FIG. In the specific example 6, for example, the determination unit 32 performs feature extraction on the log data in one session, and whether or not the content rate of the feature that exists in the past learning data only in the number equal to or less than the threshold A exceeds the threshold B An abnormality is detected. The feature here is operation information.

  First, the determination unit 32 acquires a large number of sets of operation information and the number of appearances from two or more normal operation sets corresponding to the procedure manual A acquired in the specific example 3. Then, the determination unit 32 accumulates, in the rare operation information storage unit 12, operation information (here, “Z”) whose number of appearances is equal to or less than the threshold A as rare operation information.

  Next, the determination unit 32 acquires two or more pieces of operation information in order from the operation set that is a new log received from the terminal device. Then, the determination unit 32 determines whether or not two or more pieces of operation information exist in the rare operation information storage unit 12, and operation information corresponding to the rare operation information present in the rare operation information storage unit 12. The percent (content rate) is calculated.

  Next, the determination unit 32 determines whether the content rate is greater than or equal to the threshold value B or greater than the threshold value B. Here, the determination unit 32 determines that the content rate is greater than or equal to the threshold value B or greater than the threshold value B, and substitutes a value indicating “abnormal” into the variable “third abnormality information”.

  Then, for example, the processing unit 3 includes, for example, the first abnormality information and the third abnormality information determined to be “abnormal” among the acquired first abnormality information, second abnormality information, and third abnormality information. It is assumed that the abnormality information to be output is configured.

  Next, the output unit 4 outputs the configured abnormality information. An example of such output is shown in FIG. In FIG. 13, the new log is an outlier and the rare feature (Z) in the new log is clearly shown.

  As described above, according to the present embodiment, an abnormal operation can be detected in system operation. As a result, the labor of the auditor can be reduced.

  Further, according to the present embodiment, it is possible to specify a portion having a high degree of abnormality in one log, and to expect a reduction in the amount of auditing in general.

  In the present embodiment, abnormality is detected mainly using log data in one session. However, for example, the abnormal operation detection device A may receive the operation information from the terminal device operated by the subject in real time, and perform a process of detecting abnormality with respect to the two or more accumulated operation information. In addition, the trigger which starts the process which the abnormal operation detection apparatus A detects abnormality is when the amount of the received two or more pieces of operation information increases so as to satisfy a predetermined condition, or the operation time of the subject A case where the length becomes long enough to satisfy a predetermined condition is suitable.

  Furthermore, the processing in the present embodiment may be realized by software. Then, this software may be distributed by software download or the like. Further, this software may be recorded and distributed on a recording medium such as a CD-ROM. This also applies to other embodiments in this specification. Note that the software that implements the information processing apparatus according to the present embodiment is the following program. In other words, this program accesses, for example, a judgment source information storage unit that stores judgment source information based on two or more normal operation sets relating to two or more normal operation information that specifies normal operations on the information system during system operation. An accepting unit that accepts an operation set having two or more pieces of operation information for specifying an operation performed by the user on the information system, the determination source information, and the operation set accepted by the accepting unit. Thus, the program is made to function as a determination unit that acquires abnormality information that is information relating to abnormality of the operation set and an output unit that outputs the abnormality information.

  FIG. 14 shows the external appearance of a computer that executes the program described in this specification to realize the abnormal operation detection device A and the like according to various embodiments described above. The above-described embodiments can be realized by computer hardware and a computer program executed thereon. FIG. 14 is an overview diagram of the computer system 300, and FIG. 15 is a block diagram of the system 300.

  In FIG. 14, a computer system 300 includes a computer 301 including a CD-ROM drive, a keyboard 302, a mouse 303, and a monitor 304.

  15, in addition to the CD-ROM drive 3012, the computer 301 includes an MPU 3013, a bus 3014 connected to the MPU 3013 and the CD-ROM drive 3012, a ROM 3015 for storing a program such as a bootup program, and an MPU 3013. And a RAM 3016 for temporarily storing instructions of the application program and providing a temporary storage space, and a hard disk 3017 for storing the application program, the system program, and data. Although not shown here, the computer 301 may further include a network card that provides connection to a LAN.

  A program that causes the computer system 300 to execute functions such as the abnormal operation detection device A according to the above-described embodiment is stored in the CD-ROM 3101, inserted into the CD-ROM drive 3012, and further transferred to the hard disk 3017. good. Alternatively, the program may be transmitted to the computer 301 via a network (not shown) and stored in the hard disk 3017. The program is loaded into the RAM 3016 at the time of execution. The program may be loaded directly from the CD-ROM 3101 or the network.

  The program does not necessarily include an operating system (OS), a third-party program, or the like that causes the computer 301 to execute functions such as the abnormal operation detection device A according to the above-described embodiment. The program only needs to include an instruction portion that calls an appropriate function (module) in a controlled manner and obtains a desired result. How the computer system 300 operates is well known and will not be described in detail.

  In the above program, in the step of transmitting information, the step of receiving information, etc., processing performed by hardware, for example, processing performed by a modem or an interface card in the transmission step (only performed by hardware) Processing) is not included.

  Further, the computer that executes the program may be singular or plural. That is, centralized processing may be performed, or distributed processing may be performed.

  Further, in each of the above embodiments, it goes without saying that two or more communication units existing in one apparatus may be physically realized by one medium.

  The present invention is not limited to the above-described embodiments, and various modifications are possible, and it goes without saying that these are also included in the scope of the present invention.

  As described above, the abnormal operation detection device according to the present invention has an effect of detecting an abnormal operation in system operation, and is useful as such.

A abnormal operation detection device 1 storage unit 2 reception unit 3 processing unit 4 output unit 11 determination source information storage unit 12 rare operation information storage unit 13 procedure manual information storage unit 31 learning unit 32 determination unit 321 procedure manual determination means 322 normal operation set Selection means 323 Determination means

Claims (9)

A determination source information storage unit for storing determination source information based on two or more normal operation sets relating to two or more normal operation information for specifying normal operations on the information system during system operation;
A reception unit that receives an operation set having two or more pieces of operation information for specifying an operation performed by the user on the information system;
Using the determination source information and the operation set received by the reception unit, a determination unit that acquires abnormality information that is information related to abnormality with respect to the operation set;
An abnormal operation detection device comprising: an output unit that outputs the abnormality information. The abnormal operation detection device according to claim 1, wherein the normal operation set and the operation information are events generated by an operation and include internal event information related to an event generated by an information system. The operation set received by the reception unit is:
Information having operation information of two or more operations performed by the user during one session from login to logout with respect to the information system;
The determination unit
The abnormal operation detection device according to claim 1, wherein the entire operation set received by the reception unit is applied to the determination source information to acquire abnormality information. The operation set received by the reception unit is:
Continuous operation information that is operation information of two or more consecutive operations performed by the user on the information system;
The determination unit
The abnormal operation detection apparatus according to any one of claims 1 to 3, wherein the continuous operation information is applied to two or more normal operation sets of the determination source information storage unit to acquire abnormality information. A rare operation information storage unit that stores one or more rare operation information that is operation information for identifying a rare operation;
The determination unit
The rare operation presence information on the presence of one or more rare operation information in the rare operation information storage unit is acquired in the operation set received by the reception unit, and abnormality information is acquired using the rare operation presence information. The abnormal operation detection device according to any one of claims 1 to 4. The normal operation set is
A normal operation vector composed of two or more normal operation information,
The determination unit
The abnormality information is obtained according to any one of claims 1 to 5, wherein an input vector is configured from an operation set received by the reception unit, and the abnormality information is acquired using the input vector and the two or more normal operation vectors. Abnormal operation detection device. The determination source information is:
A learning device configured by a machine learning algorithm using the two or more normal operation sets;
The determination unit
The abnormal operation detection apparatus according to claim 1, wherein the operation set received by the reception unit is applied to the learning device by a machine learning algorithm to acquire abnormality information. A determination source information storage unit that stores determination source information based on two or more normal operation sets relating to two or more normal operation information that identifies normal operations on the information system during system operation, a reception unit, a determination unit, An abnormal operation detection method realized by an output unit,
A receiving step for receiving an operation set having two or more pieces of operation information for specifying an operation performed by the user on the information system;
The determination unit uses the determination source information and the operation set received in the reception step to determine abnormality information that is information related to abnormality with respect to the operation set;
An abnormal operation detection method, wherein the output unit includes an output step of outputting the abnormality information. A computer accessible to a determination source information storage unit in which determination source information based on two or more normal operation sets relating to two or more normal operation information for specifying a normal operation on an information system during system operation
A reception unit that receives an operation set having two or more pieces of operation information for specifying an operation performed by the user on the information system;
Using the determination source information and the operation set received by the reception unit, a determination unit that acquires abnormality information that is information related to abnormality with respect to the operation set;
A program for functioning as an output unit that outputs the abnormality information.