JP4559462B2 - Anomaly detection method, apparatus, program, and recording medium due to communication related structure change - Google Patents

Description

  The present invention relates to a technique for analyzing large-capacity data such as traffic transferred over a computer network such as the Internet.

  With an increase in abnormal traffic such as attacks on specific servers on the Internet, there is an increasing demand for detection of abnormal traffic. Various methods have been proposed for detecting anomalies related to traffic such as the number of packets and the number of bytes, including Patent Document 1.

  On the other hand, in recent years, scanning activities for transmitting a small number of packets to a large number of hosts have been reported for the purpose of inspecting the presence or absence of vulnerabilities in order to attack vulnerabilities such as OS and applications. Although these activities are small in traffic volume, the threat to the Internet is great. These abnormal traffics have also been actively studied in recent years. For example, Patent Document 2 discloses an abnormality detection method that does not appear as such traffic volume due to changes in the number of annual flows and the number of communication partners for each host. is suggesting.

  Non-Patent Document 1 proposes a method for detecting anomalies in time series of entropy values by calculating the degree of concentration on a specific host such as the number of communication flows for each host as traffic entropy.

JP 2005-223847 A JP 2007-173907 A Aunkool Lakhina, Mark Crovella and Christophe Diot (2005). Mining Anomalies Using Traffic Feature Distributinons, In: Proceedings of ACM SIGCOMM2005. Pp.217-228. H. Kashima, K. Tsuda and A. Inokuchi: Marginalized Kernels Between Labeled Graphs, In Proc. 20th International Conference on Machine Learning (ICML), 2003 T Gaertner, "A survey of kernels for structured date," SIGKDD Explorations, vol.5, no.1, pp.S268-S275, 2003.

  However, abnormalities that can be detected by these methods are abnormal behaviors of individual hosts. In recent years, anomalous traffic often involves attacks by multiple hosts. Only by monitoring the behavior of individual hosts does not consider the inter-host communication relationship structure, so it is highly possible that an abnormal behavior of the host group cannot be detected. Therefore, in order to detect an abnormal behavior of these host groups, it is necessary to monitor the communication relation structure between the host groups and detect it as a time-series abnormality. However, the commonly used anomaly detection method by time series analysis is intended for time series data of scalar values and vector values. However, these communication methods are not scalar values and vector values, so these methods are used. Is not applicable.

  Non-Patent Documents 2 and 3 propose a method for calculating an inner product value (distance) between data having a graph structure. However, since this method has been proposed for the purpose of classifying labeled graphs, it cannot be applied to the abnormality detection of the communication-related structure as it is.

  The object of the present invention has been made in view of the above-described problems, and is to detect a change in the connection relation structure between the start point and the end point of traffic in time series.

  Of the inventions disclosed in this specification, the outline of typical ones will be briefly described as follows.

Communication relation structure abnormality in communication relation structure abnormality detection device that detects abnormality from time-series change of communication relation structure generated from traffic start point and end point information for a predetermined fixed period and identifies the cause of the abnormality The communication-related structure abnormality detection device includes a traffic data acquisition unit, a communication-related structure extraction unit, a communication-related structure distance calculation unit, a communication-related structure abnormality detection unit, and a communication-related structure abnormality cause identifying unit. The traffic data acquisition unit acquires information on the start and end points of traffic for each fixed period, and the communication relation structure extraction unit extracts information on the start and end points of the traffic for each fixed period. A second step of generating a communication relationship structure; and a third step of calculating a distance between the communication relationship structures by the communication relationship structure distance calculation unit; A fourth step in which the communication-related structure abnormality detecting unit detects an abnormality based on the difference in distance between the communication-related structure and a reference communication-related structure in a certain period; and A communication relationship structure abnormality detection method, comprising: a fifth step of identifying a start point and / or an end point causing an abnormality for the detected communication relationship structure.

  A second invention is characterized in that, in the first invention, a traffic transmission IP address and a destination IP address are used as the information of the start point and the end point.

A third invention is characterized in that, in the first invention, a traffic transmission source AS and a destination AS are used as the information of the start point and the end point.

A fourth invention is characterized in that, in the first invention, a transmission source and a destination of an application layer message are used as the information of the start point and the end point.

According to a fifth invention, in the first invention, in the first step, the traffic to be detected is limited by filtering with packet header information and / or packet payload information.

In a sixth aspect based on the first aspect, in the second step, as a communication relation structure, a start point and an end point appearing in traffic for a certain period are set as nodes, and an edge is defined between the start point and the end point where the traffic exists. It is characterized by using a graph.

In a seventh aspect based on the first aspect, in the second step, as the communication-related structure, the start point that appears in the traffic for each fixed period is a node, and the two start points are common to the same end point. It is characterized by using a graph with an interval between the edges.

In an eighth aspect based on the first aspect, in the second step, as the communication-related structure, the end point that appears in the traffic for each predetermined period is defined as a node, and the two end points that have traffic in common at the same start point It is characterized by using a graph with an interval between the edges.

A ninth invention is characterized in that, in the first invention, the inner product of eigenvectors belonging to the maximum eigenvalue of the adjacency matrix of the graph is used in the calculation of the distance between the communication related structures in the third step.

According to a tenth aspect , in the first aspect, in the fourth step, a communication relation structure in a period immediately before the certain period is used as a reference communication relation structure.

An eleventh invention is characterized in that, in the ninth invention, a prediction vector based on a time series model relating to an eigenvector belonging to the largest eigenvalue is used as a reference communication relation structure in the fourth step.

In a twelfth aspect based on the ninth aspect , in the fifth step, the start point or the end point corresponding to a node in which the difference between the inner product values of the eigenvectors is greater than or equal to a reference value is specified as the start point or end point of the cause of abnormality. It is characterized by.

  According to the present invention, it is possible to detect an abnormality in a communication-related structure that has been difficult in the past.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a diagram illustrating an example of a basic configuration of a communication-related structural abnormality detection device according to an embodiment of the present invention that targets traffic data of a computer network (for example, the Internet). In FIG. 1, reference numeral 101 denotes a computer network (monitoring target network). 102 is a traffic transmitting terminal, and 103 is a traffic receiving terminal. Reference numeral 104 denotes traffic from the traffic transmission terminal 102 to the traffic reception terminal 103. Reference numerals 105-1 to 105-4 denote routers through which the traffic 104 passes. Reference numeral 110 denotes a communication-related structural abnormality detection device according to an embodiment of the present invention.

  The communication-related structure abnormality detection device 110 includes a traffic data acquisition unit 111 that acquires information on the start and end points of traffic for each fixed period, and information on the start point and end point of traffic for each fixed period acquired by the traffic data acquisition unit 111. A communication relationship structure extraction unit 112 that generates a communication relationship structure, a communication relationship structure distance calculation unit 113 that calculates a distance between the communication relationship structures generated by the communication relationship structure extraction unit 112, and a communication relationship structure distance calculation unit 113 The communication relationship structure abnormality detection unit 114 that detects an abnormality based on the difference in distance between the communication relationship structure and the reference communication relationship structure for a certain period using the distance calculated by the communication relationship structure abnormality detection unit 114 detects the abnormality. A communication relationship structure abnormality cause identification unit 115 that identifies a start point and / or an end point that cause an abnormality in the communication relationship structure Obtain.

  The traffic data acquisition unit 111 extracts information on the start and end points of traffic for a certain period from packet data transferred on the link or traffic flow data output from the router. As the start point information and end point information, the transmission terminal IP address and the reception terminal IP address may be extracted, the transmission source route and the destination route may be extracted, or the transmission source AS and the destination AS are extracted. Also good. Further, the source and destination of the application layer message may be extracted. This includes, for example, a sender email address and a destination email address in an email application, a file supplier and a delivery destination in a P2P file sharing application. Also, when the traffic between the start point and end point of the communication relationship to be detected is part of the monitored traffic, the start point and end point information can be extracted for the traffic information filtered by the packet header and / or payload information. Good. When large-scale traffic data is targeted, the number of start points and the number of end points become enormous, the target communication relationship structure becomes large, and real-time processing may become difficult. For such cases, a single or multiple hash functions are used to aggregate the number of start points and end points.

  The communication relationship structure extraction unit 112 generates a communication relationship structure between the start point and the end point observed within a predetermined time interval from the traffic information acquisition unit 111. An undirected bipartite graph having a start point and an end point as nodes and a start point and end point where communication exists as an edge can be set as a communication relation structure. In addition, when there is communication with an end point (start point) in which the start point (end point) is a node and two start points (end points) are in common, a communication relation structure having these two start points (end points) as edges can be used. The edge may be given a weight according to the amount of traffic between the start point and the end point. When the start point and end point are aggregated using a hash function, a weight corresponding to the number of start / end point pairs before aggregation may be given to the edge. Further, as the number of start point / end point pairs, an estimated number of pairs using a BloomFilter based on the hash value of the start point / end point pair information may be used.

  The communication relationship structure distance calculation unit 113 calculates the distance between the two communication relationship structures. For the calculation of the distance, the method described in Non-Patent Document 2 may be used, or the inner product of eigenvectors belonging to the maximum eigenvalue of the adjacency matrix of the graph may be used. In the latter case, the communication relation structure graph is expressed as an adjacency matrix, the eigenvector belonging to the maximum eigenvalue of the adjacency matrix is obtained, and the distance is calculated using the inner product value of the eigenvector. As the distance between eigenvectors using the inner product value, the reciprocal of the cosine value V · V ′ / (| V || V ′ |) of the angle between eigenvectors may be used, or the Euclidean distance (V · V + V ′ · V−2V · V ′) ^ (1/2) may be used. Note that the physical meaning of this eigenvector is an existence probability vector in a steady state when the adjacency matrix is regarded as a Markov transition matrix. In the adjacency matrix representation of the graph, the matrix elements corresponding to the nodes where the edges exist may be constant. As a communication-related structure, a graph is used in which a start point (end point) that appears in traffic for a certain period is a node, and an edge is between two start points (between two end points) where traffic exists in common at the same end point (start point). In this case, a distance corresponding to the common start point number (end point number) may be calculated as a distance between nodes, and a numerical value corresponding to the distance may be used as a matrix element. In order to guarantee the uniqueness of the eigenvectors, the graph must be strongly connected. For this purpose, a certain value is added between any two nodes, or a number proportional to the order of the node is determined. A method such as adding to the line corresponding to is conceivable.

  The communication relationship structure abnormality detection unit 114 detects an abnormality using the distance calculated by the communication relationship structure distance calculation unit 113 with respect to communication relationship structure data generated every moment. That is, the communication-related structure abnormality detection unit 114 detects an abnormality based on the distance difference between the communication-related structure and the reference communication-related structure for a certain period, using the distance calculated by the communication-related structure distance calculation unit 113. The communication relationship structure of the immediately preceding period can be used as the reference communication relationship structure. In this method, whether or not the communication relationship structure at a certain time is abnormal is calculated by calculating the distance from the latest communication relationship structure (which is determined to be normal), and this distance is a predetermined threshold value, or When a threshold value dynamically generated by a moving average or the like is exceeded, it is determined as abnormal. In addition, when the communication relationship structure distance calculation unit 113 uses the inner product of eigenvectors belonging to the maximum eigenvalue of the adjacency matrix of the graph in the calculation of the distance between the communication relationship structures, it is generated from the communication relationship structure generated every moment. For the eigenvector, a prediction vector is generated from the time-series model, and the distance between the prediction vector and the eigenvector generated from the communication relation structure of the target time is used, and the distance is determined in advance, a moving average, etc. Can be determined as abnormal when the dynamically generated threshold value is exceeded.

  The communication-related structure abnormality cause identifying unit 115 identifies the cause for the detected communication-related structure abnormality. That is, the communication relationship structure abnormality cause identification unit 115 identifies the start point and / or the end point that cause the abnormality for the communication relationship structure in which the communication relationship structure abnormality detection unit 114 detects the abnormality. Generally, when an abnormality in the communication structure is detected, it is necessary to investigate the cause of the abnormality and eliminate the cause, but the communication structure distance calculation unit 113 calculates the distance between the communication structures. In the calculation, when using the inner product of eigenvectors belonging to the maximum eigenvalue of the adjacency matrix of the graph, in the communication relation structure determined to be abnormal, the starting point corresponding to the node whose numerical value difference between the eigenvector inner product values is equal to or greater than the reference value, or Specify the end point as the start point or end point of the cause of the abnormality.

  FIG. 2 is a flowchart showing an outline of the communication-related structural abnormality detection method of this embodiment. In the first step (S1), the traffic data acquisition unit 111 acquires information on the start point and end point of traffic for each fixed period. In the second step (S2), the communication relationship structure extraction unit 112 generates a communication relationship structure from the traffic start point and end point information acquired by the traffic data acquisition unit 111 at regular intervals. In the third step (S3), the communication relationship structure distance calculation unit 113 calculates the distance between the communication relationship structures generated by the communication relationship structure extraction unit 112. In the fourth step (S4), the communication-related structure abnormality detecting unit 114 uses the distance calculated by the communication-related structure distance calculating unit 113 to use the distance difference between the communication-related structure and the reference communication-related structure for a certain period. Detect anomalies based on In the fifth step (S5), the communication-related structure abnormality cause identifying unit 115 identifies the start point and / or the end point causing the abnormality for the communication-related structure in which the communication-related structure abnormality detecting unit 114 detects the abnormality.

  In the first step (S1), the transmission source address and destination IP address of the traffic may be used as the information of the start point and the end point to be acquired, the source route and destination route of the traffic may be used, The transmission source AS and the destination AS may be used, or the transmission source and the destination of the application layer message may be used. In the first step (S1), the traffic to be detected can be limited by filtering with packet header information and / or packet payload information. In the first step (S1), single or plural hash values of communication-related start point information and end point information can be used by using a single or plural hash functions.

  In the second step (S2), as a communication relation structure to be generated, a graph may be used in which a start point and an end point appearing in traffic for a certain period are nodes, and an edge is between the start point and the end point where the traffic exists. Further, as a communication relation structure to be generated, a graph may be used in which a start point appearing in traffic for a certain period is a node, and an edge is between two start points where traffic exists in common at the same end point. Further, as a communication relation structure to be generated, a graph may be used in which an end point appearing in traffic for a certain period is a node, and an edge is between two end points where traffic exists in common at the same start point.

  In the third step (S3), the inner product of eigenvectors belonging to the maximum eigenvalue of the adjacency matrix of the graph may be used in the calculation of the distance between the communication related structures.

  In the fourth step (S4), the communication relationship structure of the immediately preceding period may be used as the reference communication relationship structure. Further, in the fourth step (S4), when the inner product of eigenvectors belonging to the maximum eigenvalue of the adjacency matrix of the graph is used in the third step (S3), the reference communication relation structure is related to the eigenvector belonging to the maximum eigenvalue. A prediction vector based on a series model may be used.

  In the fifth step (S5), when the inner product of eigenvectors belonging to the maximum eigenvalue of the adjacency matrix of the graph is used in the third step (S3), it corresponds to a node in which the difference between the inner product values of the eigenvectors is greater than or equal to the reference value. The start point or end point may be specified as the start point or end point of the abnormality cause.

  The communication-related structural abnormality detection apparatus described above can be configured using one or a plurality of computers and programs. Moreover, you may comprise using a hardware instead of a part or all of the program.

  As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiments. However, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. Of course.

It is a block diagram which shows the structural example of the communication related structure abnormality detection apparatus in the Example of this invention. It is a flowchart which shows the outline | summary of the communication related structure abnormality detection method of the Example of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 ... Computer network (monitoring object network) 102 ... Traffic transmission terminal, 103 ... Traffic reception terminal, 104 ... Traffic, 105-1 to 105-4 ... Router, 110 ... Communication related structure abnormality detection apparatus, 111 ... Traffic data acquisition 112: Communication relationship structure extraction unit 113: Communication relationship structure distance calculation unit 114: Communication relationship structure abnormality detection unit 115: Communication relationship structure abnormality cause identification unit

Claims (15)

When abnormality is detected from a change in the sequence abnormality communication relationship structure in a communication relationship structures abnormality detection device to identify the cause of abnormality of the communication relationship structures generated from the starting point and end point information of traffic every fixed period determined in advance A detection method,
The communication relationship structure abnormality detection device includes a traffic data acquisition unit, a communication relationship structure extraction unit, a communication relationship structure distance calculation unit, a communication relationship structure abnormality detection unit, and a communication relationship structure abnormality cause identification unit,
A first step in which the traffic data acquisition unit acquires information of a start point and an end point of traffic for a certain period;
A second step in which the communication relationship structure extraction unit generates a communication relationship structure from information on a start point and an end point of traffic for each predetermined period;
A third step in which the communication-related structure distance calculating unit calculates a distance between the communication-related structures;
A fourth step in which the communication-related structure abnormality detecting unit detects an abnormality based on the difference in the distance between the communication-related structure and the reference communication-related structure for a certain period;
A communication relationship structure abnormality detection method, wherein the communication relationship structure abnormality cause identification unit includes a fifth step of identifying a start point and / or an end point that cause an abnormality for the communication relationship structure in which the abnormality is detected.   2. The communication related structure abnormality detection method according to claim 1, wherein a transmission IP address and a destination IP address of traffic are used as the information of the start point and the end point.   2. The communication-related structure abnormality detection method according to claim 1, wherein a traffic source AS and a destination AS are used as the information of the start point and the end point.   2. The communication-related structure abnormality detection method according to claim 1, wherein a source and destination of an application layer message are used as the information of the start point and the end point.   2. The communication-related structure abnormality detection method according to claim 1, wherein in the first step, the traffic to be detected is limited by filtering with packet header information and / or packet payload information.   In the second step, a graph having a start point and an end point appearing in traffic every predetermined period as nodes and an edge between the start point and the end point where traffic exists is used as the communication relation structure. The communication-related structure abnormality detection method described.   In the second step, as a communication relation structure, a graph is used in which a start point appearing in traffic for a certain period is a node and an edge is between two start points where traffic exists in common at the same end point. The communication-related structural abnormality detection method according to claim 1.   In the second step, as the communication relation structure, a graph is used in which an end point appearing in traffic for a certain period is a node, and an edge is between two end points where traffic exists in common at the same start point. The communication-related structure abnormality detection method according to claim 1.   2. The communication-related structure abnormality detection method according to claim 1, wherein, in the third step, an inner product of eigenvectors belonging to the maximum eigenvalue of the adjacency matrix of the graph is used in calculating the distance between the communication-related structures. The communication relation structure abnormality detection method according to claim 1, wherein, in the fourth step, a communication relation structure in a period immediately before the certain period is used as a reference communication relation structure. 10. The communication relationship structure abnormality detection method according to claim 9 , wherein, in the fourth step, a predicted vector based on a time series model regarding the eigenvector belonging to the maximum eigenvalue is used as a reference communication relationship structure. 10. The communication relation structure according to claim 9 , wherein, in the fifth step, a start point or an end point corresponding to a node having a difference between inner product values of the eigenvectors equal to or larger than a reference value is specified as a start point or an end point of an abnormality cause. Anomaly detection method. A communication relationship structure abnormality detection device that detects an abnormality from a time-series change of a communication relationship structure generated from information on the start point and end point of traffic every predetermined period, and identifies the cause of the abnormality,
A traffic data acquisition unit that acquires information on the start and end points of traffic at regular intervals;
A communication relation structure extraction unit that generates a communication relation structure from information on a start point and an end point of traffic for each predetermined period;
A communication relation structure distance calculation unit for calculating a distance between the communication relation structures;
A communication relationship structure abnormality detection unit that detects an abnormality based on the difference in distance between the communication relationship structure and the reference communication relationship structure for a certain period;
A communication-related structure abnormality detection device comprising: a communication-related structure abnormality cause identifying unit that identifies a start point and / or an end point that causes an abnormality for a communication-related structure in which an abnormality is detected. Communication relationship for a communication relationship structure anomaly detection device that detects anomalies from time-series changes in the communication relationship structure generated from information on the start and end points of traffic at predetermined fixed intervals and identifies the cause of the abnormality A structural abnormality detection program,
Computer
A traffic data acquisition unit that acquires information on the start and end points of traffic at regular intervals,
A communication relation structure extraction unit that generates a communication relation structure from information on a start point and an end point of traffic for each predetermined period;
A distance calculation unit between communication related structures for calculating a distance between the communication related structures;
The communication relationship structure abnormality detection unit that detects an abnormality based on the difference in distance between the communication relationship structure and the reference communication relationship structure for a certain period, and the start point and / or the end point that cause the abnormality for the communication relationship structure that detects the abnormality Communication related structure abnormality cause identification part to be identified,
Communication related structure abnormality detection program to function as The computer-readable recording medium which recorded the communication related structure abnormality detection program of Claim 14 .

Images