JP2021043676A - Abnormality detection device, abnormality detection program, and abnormality detection method - Google Patents

Abstract

To provide an abnormality detection device in which a factor categorized as abnormality and the priority thereof are intuitively presented to investigators.SOLUTION: An abnormality detection device 10 for analyzing logs and displaying abnormality detection results, includes: a log analysis section 11 which extracts features from logs, analyzes the logs using a feature/category correspondence list in which the features are associated with categories, and classifies thereof into either one of the categories, for outputting classification results; a detection result display section 15 which displays abnormality detection results of the logs by each category; a control unit 13 which requests the log analysis section 11 to analyze the logs, and requests the detection result display section 15 to display the abnormality detection results; and a storage section 14 which retains the feature/category correspondence list and the classification results.SELECTED DRAWING: Figure 1

Description

The present invention relates to an abnormality detection device, an abnormality detection program, and an abnormality detection method, and can be applied to, for example, an abnormality detection device that analyzes logs of network devices, detects suspicious logs and communications, and visually displays the detection results. ..

Cyber attacks, which are increasing and evolving year by year, have become a social problem. In the past, protection with network devices such as proxies and firewalls was effective against cyber attacks, but in recent years, attacks that cannot be prevented by the functions of network devices alone are increasing. For such attacks, it is important to analyze the logs of network devices to prevent omission of detection of attacks. However, in a company with a large number of employees, the amount of logs of network equipment is enormous, and it is very difficult to analyze manually. An approach using machine learning is effective for such a huge amount of logs.

In machine learning, suspicious communication features are extracted from the past logs of network devices, and the features are learned by the machine learning device. The trained machine learner (hereinafter referred to as "classifier") classifies and outputs abnormal communication that resembles the characteristics of suspicious communication in the past and normal communication that does not. By applying the current enormous amount of logs to the classifier, it is possible to narrow down the logs to those classified as abnormal communications, which makes the log investigation work of the investigator more efficient.

However, machine learning has aspects such that the cause cannot be explained even if it is classified as an abnormality (it is a black box), and there are many false positives that classify normal communication as an abnormality. In the former case, by using a machine learning device based on a decision tree, features that contributed to the classification can be obtained, and the cause can be estimated from this information. In the latter case, the number of logs classified as abnormal can be adjusted by devising the parameters given to the machine learning device, but it is necessary to allow some false positives in order to prevent detection omission, and there are more than a certain number of logs to be investigated. It will be.

From the above, a method for efficiently investigating the logs of the investigation target classified as abnormal is required. Especially in cyber attacks, there are some that are classified as abnormal and some that are not. For example, in a cyber kill chain that is categorized according to the progress of a cyber attack, it is said that the more the stage is, the higher the urgency is. Therefore, by giving priority to the logs with high urgency among those classified as abnormal and displaying them to the investigator, the logs to be investigated can be prioritized, and the investigation work can be made more efficient. Here, the cyber kill chain stage includes a "reconnaissance stage" for selecting an attack target, a "delivery stage" for downloading malware, and a "remote control stage" for communicating with a C & C (Commund & Response) server after infection. Exists.

For example, Patent Document 1 discloses a technique related to a GUI (Graphical User Interface) that displays abnormality detection results of a plurality of security products and network devices in a computing system. In Patent Document 1, based on the negative results (serious security events, anomalies, vulnerabilities, threats) detected by security products and network devices, if there is a negative result, it is red, and there is no negative result. By displaying it in green, it is possible to intuitively know whether or not the computing system needs to be investigated.

Further, Patent Document 2 discloses a technique relating to a system for presenting to an analyst the content of a countermeasure against an attack activity detected by using a detection rule. In Patent Document 2, past attack activities and countermeasures against attack activities are accumulated. Then, regarding the currently detected attack activity, similar attack activity is acquired from the accumulated past information, and the countermeasure contents for the attack activity are acquired and presented to the analyst. Here, importance is given to past attack activities and countermeasures, and if there are multiple similar attack activities and countermeasures, they are presented in descending order of importance. Since the attack activity and its countermeasures are prioritized and presented by the technique described in Patent Document 2, the analyst can easily know in what order and how to investigate the detected attack activity. be able to.

Patent No. 5869676 Japanese Unexamined Patent Publication No. 2019-28891

However, in the above-mentioned Patent Document 1, although it is possible to know that there is an abnormality in the computing system, it is not possible to know from the GUI which log should be prioritized for investigation. Similarly, the factors that resulted in negative results cannot be known from the GUI.

On the other hand, in Patent Document 2, it is necessary for the analyst to manually give the content of the attack activity and the corresponding importance, and the countermeasure content and the corresponding importance for each detected attack activity log (communication). The increase in the work man-hours of the investigator becomes a problem.

Based on the above, anomaly detection devices, anomaly detection programs, and anomaly detection programs that can intuitively present the factors classified as anomalies and their priorities to the investigator and reduce the man-hours of the analyst to create the information necessary for presentation. An abnormality detection method is desired.

The first invention is an abnormality detection device that analyzes a log and displays an abnormality detection result. (1) A feature / category correspondence list in which a feature is extracted from the log and the feature and a category are associated with each other. A log analysis unit that analyzes the log using the above and classifies it into one of the categories and outputs the classification result, and (2) a detection result display unit that displays the abnormality detection result of the log in units of categories. 3) Holds a control unit that requests the log analysis unit to analyze the log and the detection result display unit to display the abnormality detection result, (4) the feature / category correspondence list, and the classification result. It is characterized by having a storage unit to be used.

The second abnormality detection program of the present invention analyzes the log and displays the abnormality detection result on the computer mounted on the abnormality detection device. (1) Extracts the feature from the log and associates the feature with the category. The log analysis unit analyzes the log using the attached feature / category correspondence list, classifies it into one of the categories, and outputs the classification result, and (2) displays the abnormality detection result of the log in each category. A detection result display unit, (3) a control unit that requests the log analysis unit to analyze the log, and the detection result display unit to display the abnormality detection result, and (4) the feature / category correspondence list. , And to function as a storage unit for holding the classification result.

The third invention is an abnormality detection method used in an abnormality detection device that analyzes a log and displays an abnormality detection result. (1) The log analysis unit extracts a feature from the log and uses the feature. The log is analyzed using the feature / category correspondence list associated with the category, classified into one of the categories, and the classification result is output. (2) The detection result display unit displays the log in units of categories. The abnormality detection result is displayed, (3) the control unit requests the log analysis unit to analyze the log, the detection result display unit requests the display of the abnormality detection result, and (4) the storage unit receives. It is characterized by holding the feature / category correspondence list and the classification result.

According to the present invention, the factors classified as abnormal and their priorities are intuitively presented to the investigator, and the man-hours of the analyst for creating the information necessary for the presentation can be reduced.

It is a block diagram which shows the internal structure of the abnormality detection result display device which concerns on embodiment. It is explanatory drawing which shows an example of the feature list analyzed by the log analysis part which concerns on embodiment. It is explanatory drawing which shows an example of the interface which inputs the category of the cyber kill chain corresponding to each feature used in the input part which concerns on embodiment. It is a flowchart which shows the feature operation (feature / category correspondence list creation operation) of the abnormality detection result display device which concerns on embodiment. It is explanatory drawing which shows an example of the feature-category correspondence list which associated the cyber kill chain category with each feature which concerns on embodiment. It is a flowchart which shows the characteristic operation (learning and classification operation of a machine learning device) of the abnormality detection result display device which concerns on embodiment. It is explanatory drawing which shows an example of the feature importance list which shows the importance of the feature of the classifier created by the log analysis part which concerns on embodiment. It is a flowchart which shows the characteristic operation (the operation which displays the abnormality detection result) of the abnormality detection result display device which concerns on embodiment. It is explanatory drawing which shows an example of the detection result for each category to be displayed on the detection result display part which concerns on embodiment. It is explanatory drawing which shows an example of the category list which defined the category which concerns on another embodiment and the sequence number thereof. It is explanatory drawing which shows an example of the detection result of the hierarchical category which concerns on other embodiment. It is explanatory drawing (the 1) which shows an example of the drill-down function of the detection result to be displayed on the detection result display part in another embodiment. It is explanatory drawing (the 2) which shows an example of the drill-down function of the detection result to be displayed on the detection result display part in another embodiment.

(A) Main Embodiments Hereinafter, one embodiment of an abnormality detection device, an abnormality detection program, and an abnormality detection method according to the present invention will be described in detail with reference to the drawings.

(A-1) Configuration of Embodiment First, the outline of this embodiment will be described. In this embodiment, the logs classified as abnormal are displayed according to the progress of the cyber kill chain. In the present embodiment, each feature of the log to be learned by the machine learning device is defined in advance at which stage of the cyber kill chain the feature appears, and is classified as abnormal from the defined information and the importance information of the classifier. Estimate and display the classification factor (progress of cyber kill chain) of the log. The details will be described below.

FIG. 1 is a block diagram showing an internal configuration of an abnormality detection result display device according to an embodiment.

In FIG. 1, the abnormality detection result display device 10 includes a log analysis unit 11, an input unit 12, a control unit 13, a storage unit 14, and a detection result display unit 15.

The abnormality detection result display device 10 may be constructed, for example, by installing a program on a computer having a processor, a memory, or the like. Further, the abnormality detection result display device 10 may be partially or wholly configured by using hardware (for example, a dedicated semiconductor chip, an electric circuit, or the like).

The log analysis unit 11 extracts features from the log of the network device (network device log 20 in FIG. 1), learns the extracted features as learning data with a machine learning device, and creates a classifier for classifying normal / abnormal. Have means. The network device log 20 to be used is not limited, but for example, a proxy or firewall log is used. The method of extracting features from the log is also not limited, but for example, a method of extracting features according to a predetermined rule, a method of extracting features using another machine learning device, a combination thereof, and the like can be considered.

The extracted features include, for example, proxy log download size and upload size, destination host character string, etc., which are used as they are, download size is relatively larger than other logs (abnormal), and destination host is rare. It is conceivable that it is converted into a qualitative variable by rules or machine learning, such as not appearing (rare). The log analysis unit 11 stores in the storage unit 14 a name that can identify the extracted features as a feature list (feature list L in FIG. 1) as shown in FIG.

The machine learning device used by the log analysis unit 11 is a learning device from which the importance of the features that contributed to the creation of the classifier can be obtained, and for example, a decision tree-based learning device is used. Depending on the machine learning device used, it is necessary to label the training data as abnormal or normal for training. The method of labeling the learning data is not limited, but for example, a method of labeling the log investigated by the investigator can be considered when it is determined whether the log is truly normal or abnormal. The log analysis unit 11 stores in the storage unit 14 a classifier obtained by learning with the machine learning device and a feature importance list (feature importance list N in FIG. 7, which will be described later).

Further, the log analysis unit 11 applies the features of the network device log 20 to the classifier to classify normal / abnormal, and further uses the feature / category correspondence list M of FIG. 5 to be described later, and the log classified abnormally is cyber. It has a means of estimating which category of the kill chain it belongs to. Here, the content output by the classifier is not limited. For example, depending on the machine learning device (or how to give parameters of the machine learning device), there is a device that outputs the probability of being abnormal instead of classifying whether it is normal or abnormal, and the probability may be output. The log analysis unit 11 stores the classification result and the category estimation result in the storage unit 14.

The input unit 12 has a means for providing the investigator with an input interface for setting which category of the cyber kill chain applies to each feature of the log given to the machine learning device. For example, the screen (input screen 30) as shown in FIG. 3 is displayed. On the input screen 30 of FIG. 3, an input box 31 (31 to 1-31-3) in which the category of the cyber kill chain can be input is drawn for each feature (each feature of the feature list L of FIG. 2), and the investigator is characterized. Enter the category corresponding to. The input unit 12 stores the correspondence between the input feature and the category in the storage unit 14 as the feature / category correspondence list M.

The control unit 13 instructs the log analysis unit 11 to perform machine learning and log abnormality classification by the classifier, and instructs the detection result display unit 15 to display the abnormality detection result. Have the means to do. Further, the control unit 13 has a means for receiving an abnormality detection result display request from the investigator.

The storage unit 14 has means for storing various types of information (feature list L, feature / category correspondence list M, feature importance list N, etc.).

The detection result display unit 15 has a means for displaying the results for each category of the cyber kill chain to the investigator from the abnormal classification result of the log and the category estimation result.

(A-2) Operation of the Embodiment Next, the operation of the abnormality detection result display device 10 according to the embodiment having the above configuration will be described.

Among the operations of the abnormality detection result display device 10 (feature operations of the present embodiment), the operation of associating the cyber kill chain category with each feature of the log and creating the feature / category correspondence list M is shown in FIG. The learning and classification operations of the machine learning device will be described with reference to FIG. 6, and the operations of displaying the abnormality detection result on the detection result display unit 15 will be described with reference to FIG.

(A-2-1) Feature / Category Correspondence List Creation Operation FIG. 4 is a flowchart showing a feature operation (feature / category correspondence list creation operation) of the abnormality detection result display device according to the embodiment.

Upon receiving an input request from the investigator, the input unit 12 acquires the feature list L of the network device log 20 from the storage unit 14 (S101).

Further, the input unit 12 acquires the category list of the cyber kill chain from the storage unit 14 (S102). Here, the acquired cyber kill chain category (a list in which categories such as delivery and remote control are described) may be used when selecting in the input box 31 of the input screen 30. Further, the process may be omitted, but in that case, the investigator needs to directly input the cyber kill chain category in the input box 31. The category list here may be, for example, the category list O of FIG. 10 described later, or another category list in which the sequence number is omitted from the category list O.

Next, the input unit 12 draws and displays the input screen 30 (FIG. 3 described above) for inputting the category of the cyber kill chain corresponding to the feature using the acquired feature list L (S103).

The input unit 12 transitions to a state in which the investigator waits for the completion of the input (selection) operation of the cyber kill chain category on the input screen 30 (S104). When the input unit 12 receives the input completion (for example, pressing the input completion button (not shown)), the input unit 12 performs the next process.

Based on the input information, the input unit 12 creates a feature / category correspondence list M (FIG. 5) in which categories for the features are associated with each other, and stores the list M (FIG. 5) in the storage unit 14 (S105).

(A-2-2) Learning and Classification Operation of Machine Learning Device FIG. 6 is a flowchart showing a characteristic operation (learning and classification operation of the machine learning device) of the abnormality detection result display device according to the embodiment.

The log analysis unit 11 performs the following processing in response to a request (learning or classification) from the control unit 13 (S201).

First, the learning process (S201 to S205) will be described first. The control unit 13 requests the log analysis unit 11 to learn, and at this time, notifies the log analysis unit 11 of the target period of the network device log 20 to be learned at the same time.

The log analysis unit 11 acquires a log for a specified period from the network device log 20 (S202), then extracts features from the log and creates learning data (S203). Here, the log analysis unit 11 stores the extracted feature list L in the storage unit 14.

Next, the log analysis unit 11 trains the training data with a machine learning device and creates a classifier (S204).

Finally, the log analysis unit 11 stores the created classifier and the feature importance list N (FIG. 7) indicating the importance of the features of the classifier in the storage unit 14.

Next, the classification operation (S206 to S210) will be described. The control unit 13 requests the log analysis unit 11 to classify as normal or abnormal. At this time, the control unit 13 notifies the log analysis unit 11 of the target period of the network device log 20 to be classified.

The log analysis unit 11 acquires a log for a specified period from the network device log 20 (S206), and extracts features from the log (S207).

Next, the log analysis unit 11 acquires a classifier from the storage unit 14 and classifies each log as normal / abnormal (S208).

Next, the log analysis unit 11 estimates which category of the cyber kill chain belongs to each of the abnormally classified logs (S209). For this purpose, the log analysis unit 11 first acquires the feature / category correspondence list M from the storage unit 14. Next, the log analysis unit 11 multiplies the feature amount and the feature importance for each category by using the following equation (1) based on the information in the feature / category correspondence list M. The sum of the information is calculated as the category score. Here, the formula (1) represents a formula for calculating the score of the delivery category, and the scores of other categories (for example, the reconnaissance category score, the remote control category score, etc.) are also calculated by the same method.

Then, the log analysis unit 11 uses the following equation (2) to find the category having the maximum category score and use it as the estimation result.

Finally, the log analysis unit 11 stores the abnormality classification result (if the output of the classifier has a probability of being abnormal, its value) and the category estimation result in the storage unit 14.

(A-2-3) Abnormality Detection Result Display Operation FIG. 8 is a flowchart showing a characteristic operation (operation of displaying the abnormality detection result) of the abnormality detection result display device according to the embodiment.

First, when the control unit 13 receives the detection result display request from the investigator, the control unit 13 requests the detection result display unit 15 to display the detection result of the abnormality log. At this time, the control unit 13 notifies the detection result display unit 15 of the period of the log for displaying the result.

The detection result display unit 15 acquires the classification result of the log that has been abnormally classified in the designated period (S301). Further, the detection result display unit 15 acquires the category estimation result of the abnormally classified log from the storage unit 14 (S302).

Next, the detection result display unit 15 draws the detection results for each category (S303). Although the specific drawing content is not limited, for example, as shown in FIG. 9, the drawing content in which each log is plotted is conceivable, with the progress of the cyber kill chain on the horizontal axis and the abnormality degree of the log on the vertical axis.

Finally, the detection result display unit 15 displays the drawing result on the investigator (S304).

(A-3) Effect of Embodiment According to this embodiment, the following effects are exhibited.

The abnormality detection result display device 10 analyzes the log of the network device and displays the abnormality detection result, and associates the characteristics of the log given to the machine learning device with the category of the cyber kill chain, and lists the feature importance of the machine learning device. It is characterized in that the cyber kill chain progress of the log classified as abnormal is estimated and displayed according to the progress.

By displaying by the progress of the cyber kill chain, the investigator can grasp the urgency of the log to be investigated and prioritize it. Therefore, the investigation work can be made more efficient. In addition, the work performed by the researcher to display the results is less burdensome for the researcher because it is only necessary to associate each feature of machine learning with the category of the cyber kill chain.

(B) Other Embodiments The present invention is not limited to the above embodiments, and modified embodiments as illustrated below can also be mentioned.

(B-1) In the above embodiment, the abnormality detection result is displayed by the progress of the cyber kill chain, but the present invention is not limited to this. For example, if the investigator can freely define the category in the input section, such as the detection of a terminal setting error or failure, and the log features are associated with the defined category, the abnormality detection result can be obtained in any category unit. Can be displayed.

(B-2) In the above embodiment, as a method of estimating the category, the score of each category is calculated and the category of the maximum score is used as the estimation result, but the present invention is not limited to this. For example, when there is an order in the categories as in the stage of the cyber kill chain, a category list O (FIG. 10) in which the categories and their order numbers are defined can be created. Then, a method is also conceivable in which the expected value of the order number of the category is obtained by the following formula (3) using the score of each category obtained by the above-mentioned formula (1), and the calculation result is used as the estimation result.

By using the expected value, the result can be expressed as a continuous value, so that the detection result screen can be plotted in more detail, and the log to be investigated with higher priority can be clarified.

(B-3) In the above embodiment, the categories are treated in the same row, but a method of defining the categories hierarchically and displaying the detection results in a subdivided manner is also conceivable. For example, for the delivery category in the cyber kill chain, subcategories such as abnormal download size and rare download extension are defined, and the subcategories are associated with the characteristics of logs. Then, the abnormality detection result display device 10 calculates the score of the subcategory of the abnormality log using the equations (1) and (2), and displays the detection result hierarchically on the detection result screen as shown in FIG. This makes it possible to prioritize the investigator's investigation log more efficiently.

In order to define the categories hierarchically, for example, an input box field for inputting a subcategory is provided on the input screen 30 displayed on the input unit 12, and the input result is used as the hierarchical information of the category in the storage unit 14. You can save it.

(B-4) As a modification of the above embodiment, in the abnormality detection result display, it is also conceivable to add another step action to the log of the network device classified as each abnormality and drill down to display another information. Be done. For example, when the log plotted on the abnormality detection result display screen as shown in FIG. 12 is moused over, the abnormality classification result of the past log of the source IP address (terminal) of the log can be displayed in chronological order, or the figure. The features and categories that caused the abnormal classification of the log as in 13 are displayed in a pie chart format. By presenting additional information in this way, the priority of the survey log of the surveyor can be made more efficient.

(B-5) In the above embodiment, one classifier is created using all the features extracted from the network device log to classify normal / abnormal, but the features are grouped by category during machine learning and are classified into categories. A method of creating a classifier and classifying abnormally may also be used.

10 ... Abnormality detection result display device, 11 ... Log analysis unit, 12 ... Input unit, 13 ... Control unit, 14 ... Storage unit, 15 ... Detection result display unit, 20 ... Network device log, 30 ... Input screen, 31 ... Input Box, L ... feature list, M ... category correspondence list, N ... feature importance list, O ... category list.

Claims (12)

An anomaly detection device that analyzes logs and displays anomaly detection results.
A log analysis unit that extracts features from the log, analyzes the log using a feature / category correspondence list that associates the feature with a category, classifies the log into one of the categories, and outputs the classification result.
A detection result display unit that displays the abnormality detection result of the log in units of categories,
A control unit that requests the log analysis unit to analyze the log and the detection result display unit to display the abnormality detection result.
An abnormality detection device having the feature / category correspondence list and a storage unit for holding the classification result. The storage unit has a category list in which one or more categories are described.
It is characterized by further including an input unit that draws and displays an input screen that associates the feature with the category of the category list and saves the input result in which the category corresponding to the feature is input as the feature / category correspondence list. The abnormality detection device according to claim 1. The log analysis unit converts the features extracted from the log into feature quantities and analyzes them by machine learning.
The machine learning device used in the machine learning can create a classifier that learns the feature and outputs the probability of being abnormal, and can output the importance of the feature that contributes to the classification of the classifier. Yes,
The abnormality detection device according to claim 2, wherein the log analysis unit estimates the category using the feature / category correspondence list, the feature amount of the log, and the importance of the feature. In the method of estimating the category, the score of the category is obtained by multiplying each feature amount of the log by the importance of the corresponding feature and summing the features for each feature associated with the category. The abnormality detection device according to claim 3, wherein the category having the maximum score of the category is used as the estimation result. In the method of estimating the category, the categories having an order relationship are numbered in order, and each feature associated with the category is multiplied by the importance of each feature amount of the log and the corresponding feature. The sum is taken as the score of the category, and the result of calculating the expected value of the sequence number of the category, which is obtained by multiplying the sequence number of the category and the score of the corresponding category and taking the sum, is the estimation result. The abnormality detection device according to claim 3, wherein the abnormality detection device is characterized. The detection result display unit plots the analysis result of the log on a graph centered on the category and the abnormality probability output by the classifier, using the category estimation result of the log and the abnormality probability. The abnormality detection device according to any one of claims 3 to 5, wherein the abnormality detection device is characterized. The input unit further draws and displays the input screen in which the category can be defined hierarchically, and stores the hierarchical information of the category input to the input screen in the storage unit.
The log analysis unit estimates the category of the log using the hierarchical information.
The detection result display unit according to any one of claims 3 to 5, wherein the detection result display unit draws the category hierarchically using the hierarchical information and plots the analysis result of the log in the corresponding category. The described anomaly detection device. The detection result display unit displays the analysis result of the log in chronological order by using the analysis result of the log in the past and displays the transition of the category from the past to the present for each terminal. The abnormality detection device according to any one of 5. The abnormality detection device according to claim 8, wherein the time-series display of the analysis result of the log from the past to the present is displayed by hovering the mouse over a portion where the analysis result of the log is plotted. The abnormality detection device according to any one of claims 1 to 9, wherein the category is a cyber kill chain category. The computer installed in the anomaly detection device that analyzes the log and displays the anomaly detection result,
A log analysis unit that extracts features from the log, analyzes the log using a feature / category correspondence list that associates the feature with a category, classifies the log into one of the categories, and outputs the classification result.
A detection result display unit that displays the abnormality detection result of the log in units of categories,
A control unit that requests the log analysis unit to analyze the log and the detection result display unit to display the abnormality detection result.
An abnormality detection program characterized in that it functions as a storage unit that holds the feature / category correspondence list and the classification result. This is an anomaly detection method used for anomaly detection devices that analyze logs and display anomaly detection results.
The log analysis unit extracts features from the log, analyzes the log using a feature / category correspondence list in which the feature and the category are associated with each other, classifies the log into one of the categories, and outputs the classification result.
The detection result display unit displays the abnormality detection result of the log in units of categories, and the detection result display unit displays the abnormality detection result of the log.
The control unit requests the log analysis unit to analyze the log, and requests the detection result display unit to display the abnormality detection result.
An abnormality detection method in which a storage unit holds the feature / category correspondence list and the classification result.

Images