JP6088700B2 - Information processing apparatus, information processing method, and program - Google Patents

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program.

  In recent years, malware typified by computer viruses has become sophisticated and sophisticated in both intrusion methods and attack methods, and it is becoming difficult to prevent damage and to localize damage. In the case of conventional malware, the relationship between the attack and damage can be easily guessed, and it was discovered relatively early, although the degree of difficulty in dealing with it was different. However, in the case of current malware, it is difficult to notice the intrusion, and it has caused tremendous damage until it was discovered.

  As a technique for detecting malware, for example, Patent Document 1 discloses an internal network in which abnormal internal communication is performed a predetermined number of times or more between internal terminals that perform the abnormal external communication a predetermined number of times or more within a predetermined time. A malware detection device that determines that malware is occurring in the network is disclosed.

  Also, for example, in Patent Document 2, for each connection request from the terminal to the in-house network, the elapsed time from the last connection time at the terminal that has made the connection request is calculated, compared with a preset allowable time, and the final A technique is disclosed in which when the elapsed time from the connection time exceeds the allowable time, the terminal that has requested connection is prohibited from being connected to the in-house network as a nonconforming terminal.

JP 2012-84994 A JP 2008-160249 A

In order for a terminal infected with malware to execute processing in accordance with an instruction from the attacker, there may be a case where the terminal periodically communicates with an external attacker's server, for example. However, such communications were confused with other communications for the Internet and were very difficult to find.
An object of the present invention is to facilitate grasping of communication that is repeatedly performed on a network to be monitored.

For this purpose, the present invention provides an acquisition unit for acquiring information included in a communication detected within a target period on a network to be monitored, and information acquired by the acquisition unit. Among these, an extraction unit that extracts a set of communications in which at least a part of information in the communication is common, and a set of communications extracted by the extraction unit are specified within a first period set in the target period. An information processing apparatus comprising: an output unit that outputs information based on a count number that is a number of the first period longer than a second period in which an interval between the communication and the other specific communication is different from the first period provide.
Here, the output unit may display a set of communications extracted by the extraction unit in an order based on the count number.
The output unit may output information on the set of the communication sets extracted by the extraction unit for a set in which the count number satisfies a predetermined criterion.
Further, the extraction means may extract a set of communications in which the data transmission destination and the transmission source in the communication are the same.
In addition, the present invention provides a step of acquiring information included in a communication detected within a target period on a network to be monitored, and at least a part of the information in the communication among the communication by the acquired information Extracting a set of common communication, and for the extracted set of communication, an interval between a specific one communication and a specific other communication within the first period set in the target period is There is also provided an information processing method including a step of outputting information based on a count number that is a number of the first period longer than a second period different from the one period.
Then, the present invention provides a computer with a function of acquiring information included in a communication detected within a target period on a network to be monitored, and the acquired information. A function for extracting a set of communications that are at least partially in common, and an interval between a specific one communication and a specific other communication within the first period set as the target period for the extracted communication set A program for realizing a function of outputting information based on a count number which is the number of the first period longer than the second period different from the first period is also provided.

  According to the present invention, it is possible to easily grasp communication that is repeatedly performed on a monitoring target network.

It is a figure showing the example of whole composition of the computer system to which this embodiment is applied. It is the block diagram which showed the function structural example of the communication analyzer which concerns on this Embodiment. It is the figure which showed an example of the hardware constitutions of the computer suitable for applying a communication analyzer. It is the flowchart which showed an example of the procedure which outputs the information based on a count number based on a communication log. It is a figure which shows an example of the communication log which a communication log acquisition part acquires. (A)-(d) is a figure for demonstrating the specific example of the count process by a count part. It is a figure for demonstrating the specific example of the process which outputs the information based on the count number by a count part.

Embodiments of the present invention will be described below in detail with reference to the accompanying drawings.
<System configuration>
First, a computer system to which this embodiment is applied will be described. FIG. 1 is a diagram showing an example of the overall configuration of a computer system to which the present embodiment is applied. As shown in the figure, in this computer system, client terminals 10a, 10b, and 10c are connected to an in-house LAN (Local Area Network) 40. In addition, the communication analyzer 20 is connected to both the in-house LAN 40 and the Internet 50. Further, the attacker server 30 is connected to the Internet 50.

  The client terminals 10a, 10b, and 10c are computers used by users, and are realized by, for example, personal computers, workstations, and other computer devices. In the present embodiment, it is assumed that the client terminals 10a, 10b, and 10c may be infected with malware. Here, malware is a general term for malicious software and malicious code created with the intention of performing illegal and harmful operations. For example, a bot that is one type of malware, after infecting a computer, connects to a control server called a C & C (command and control) server, waits for instructions from the attacker, and performs processing as directed on the infected computer. Execute.

  Although FIG. 1 shows the client terminals 10a, 10b, and 10c, they may be referred to as client terminals 10 when it is not necessary to distinguish them. Although only three client terminals 10 are shown in FIG. 1, the number of client terminals 10 is not limited to the three illustrated.

  The communication analyzer 20 targets the network between the in-house LAN 40 and the Internet 50 and outputs information based on the communication interval for the communication detected on the network to be monitored. The information based on the output communication interval is for detecting unauthorized communication that is highly likely to be an attack. Specifically, the communication analysis device 20 outputs information for detecting unauthorized communication due to malware for communication accessing the Internet 50 from the client terminal 10 via the in-house LAN 40. In addition, the communication analysis device 20 also stores, for example, communication logs stored in a proxy server (not shown) installed so as to be accessed when the client terminal 10 accesses the Internet 50 via the in-house LAN 40. And output information.

  The communication analysis device 20 may be provided in a communication device such as a gateway, or may be provided independently of the communication device. In FIG. 1, the communication analysis device 20 is not installed inline on the communication line between the in-house LAN 40 and the Internet 50, but the communication analysis device 20 acquires a communication log from a proxy server, for example. Although it is configured, the communication analyzer 20 may be configured inline. In the present embodiment, the communication analysis device 20 is used as an example of the information processing device.

  The attacker server 30 is a server to which the client terminal 10 infected with malware is a communication connection destination, and is operated by the attacker. For example, when the client terminal 10 is infected with a bot, the attacker server 30 corresponds to a connection control server to which the client terminal 10 is connected in order to wait for an instruction from the attacker. Although only one attacker server 30 is shown in FIG. 1, there may be two or more attacker servers 30 in some cases.

  The in-house LAN 40 is a network in which computers and printers in a company are connected by a dedicated line or the like so that data can be transmitted and received between them.

  The Internet 50 is a huge network that connects networks all over the world using TCP / IP (Transmission Control Protocol / Internet Protocol).

  As described above, in the present embodiment, when the client terminal 10 is infected with malware, the client terminal 10 connects to the attacker server 30 that is an unauthorized server. At that time, the client terminal 10 may repeatedly communicate with the attacker server 30 at intervals of, for example, 10 seconds in order to execute processing in accordance with a command from the attacker server 30. Therefore, the communication analysis device 20 examines the communication interval for communication accessing the Internet 50 from the client terminal 10 via the in-house LAN 40, and may be communication with the attacker server 30. Outputs information for detecting communication to be performed.

<Functional configuration of communication analyzer>
Next, the functional configuration of the communication analyzer 20 will be described. FIG. 2 is a block diagram illustrating a functional configuration example of the communication analysis device 20 according to the present embodiment.

  As illustrated, the communication analyzer 20 includes a communication log acquisition unit 21 that acquires a log of communication detected on the network between the in-house LAN 40 (see FIG. 1) and the Internet 50 (see FIG. 1). A communication log extracting unit 22 that extracts a communication log to be analyzed from the communication logs. In addition, the communication analyzer 20 divides the period for which the communication log is to be acquired by the length of the first period, which is a predetermined period, and the interval between the first communication and the last communication is set for each first period. A count unit 23 that counts if a second period, which is a predetermined period, is exceeded, and a set value storage unit 24 that stores set values for the first period and the second period that are used for the counting process by the count unit 23. And an information output unit 25 that outputs information based on the count number of the count unit 23.

  The communication log acquisition unit 21 as an example of an acquisition unit targets a network between the company LAN 40 and the Internet 50 and acquires a log of communication detected on the network to be monitored. Here, the communication log acquisition unit 21 acquires, from a proxy server (not shown), a communication log for accessing the Internet 50 from the client terminal 10 via the in-house LAN 40, for example, triggered by an administrator's operation.

  As the communication log, for example, a period specified by the administrator or a predetermined period such as one week is acquired as a target period for acquisition, and data detected within the target period is acquired. In addition, the communication log includes, for example, information on the data transmission destination in the communication, information on the data transmission source, and information such as the date and time when the communication was performed. The communication log is not limited to the configuration obtained from the proxy server, and may be stored in the communication analysis device 20 when the communication analysis device 20 is installed inline, for example.

  The communication log extraction unit 22 as an example of an extraction unit extracts a set of communication logs to be analyzed from the communication logs acquired by the communication log acquisition unit 21. Here, for each communication log acquired by the communication log acquisition unit 21, the communication log extraction unit 22 can identify information (hereinafter referred to as transmission destination information) that can identify a data transmission destination and a data transmission source. Information (hereinafter referred to as source information) is specified. The destination information includes, for example, information such as the domain name and IP address of the device that is the data destination, and the URL (Uniform Resource Locator) of the destination. The transmission source information includes, for example, the IP address of the client terminal 10 that is the data transmission source, the user name set as the user who uses the client terminal 10, the computer name set in the client terminal 10, and the like. Contains information.

  Then, the communication log extracting unit 22 analyzes a plurality of communication logs having the same transmission destination and transmission source pair as analysis targets based on the transmission destination information and transmission source information of each communication log. Extract. For example, if there are 1000 communication logs having the transmission destination domain “domain A” and the transmission source user name “user A” among the communication logs acquired by the communication log acquisition unit 21, the communication log extraction is performed. The unit 22 extracts the set of 1000 communication logs as an analysis target.

  In the following description, the communication log extraction unit 22 describes a case where a plurality of communication logs having the same transmission destination and transmission source pair are extracted as analysis targets. However, at least the communication log having the same data transmission destination May be extracted as an analysis target. In this case, for example, if there are 2000 communication logs whose destination domain is “domain A”, the 2000 communication logs are collectively extracted as an analysis target.

  The counting unit 23 as an example of a counting unit divides a set of communication logs extracted as an analysis target by the communication log extraction unit 22 in order of the length of the first period in order from the acquisition target period. Then, the count unit 23 determines whether or not the interval between the first communication and the last communication in the first period is longer than the second period for each of the divided first periods. Here, if the interval between the first communication and the last communication exceeds the second period, the count unit 23 performs a process of increasing the count number by one. On the other hand, if the interval between the first communication and the last communication does not exceed the second period, the counting unit 23 does not count.

  For example, when there are 100 divided first periods, the count unit 23 sets the interval between the first communication and the last communication of the communication log to be analyzed for each of the 100 first periods. It is determined whether or not it is longer than two periods. And the count part 23 counts whenever it determines with having exceeded the 2nd period. For example, if there are 60 of the 100 first periods in which the interval between the first communication and the last communication exceeds the second period, the count number is 60.

  The set value storage unit 24 stores the set values for the first period and the second period that are used in the counting process by the count unit 23. As the first period, for example, a period such as 10 minutes, 5 minutes, and 1 minute is set. The second period is shorter than the first period. For example, when the first period is 10 minutes, the second period is 8 minutes, and when the first period is 5 minutes, the second period is 4 minutes, When the first period is 1 minute, the second period is set to 40 seconds or the like. It is assumed that the values of the first period and the second period are set in advance by an administrator input, for example.

  The information output unit 25 as an example of an output unit outputs information based on the count number by the count unit 23. Here, the information output unit 25 acquires the count number counted by the counting unit 23 for the set of communication logs extracted as the analysis target by the communication log extracting unit 22. Then, the information output unit 25 outputs information based on the acquired count number. For example, the information output unit 25 displays a set of communication logs on a display unit (not shown) in an order based on the count number, such as the order with the largest count number or the order with the smallest count number.

  Moreover, the information output part 25 may display the information regarding the communication on a display part about the communication which satisfy | fills the reference | standard with which the count number was predetermined. For example, the information output unit 25 displays a message indicating that there is a possibility of unauthorized communication, or displays an alert for a set of communication logs whose count number exceeds a predetermined threshold. In addition, for example, the information output unit 25 performs a display indicating that the communication is normal communication for a set of communication logs whose count number is equal to or less than a predetermined threshold.

<Hardware configuration example of communication analyzer>
Next, the hardware configuration of the communication analyzer 20 according to the present embodiment will be described. FIG. 3 is a diagram illustrating an example of a hardware configuration of a computer suitable for applying the communication analysis device 20. As shown in the figure, the communication analysis device 20 includes a CPU (Central Processing Unit) 20a that is a calculation means and a memory 20c that is a main storage means. As external devices, a hard disk drive (HDD) 20g, a network interface 20f, a display mechanism 20d including a display device, an audio mechanism 20h, an input device 20i such as a keyboard and a mouse, and the like are provided.

  In the configuration example shown in FIG. 3, the memory 20c and the display mechanism 20d are connected to the CPU 20a via the system controller 20b. The network interface 20f, the magnetic disk device 20g, the sound mechanism 20h, and the input device 20i are connected to the system controller 20b via the I / O controller 20e. Each component is connected by various buses such as a system bus and an input / output bus.

  In FIG. 3, the magnetic disk device 20g stores an OS program and application programs. These programs are read into the memory 20c and executed by the CPU 20a, whereby the communication log acquisition unit 21, the communication log extraction unit 22, the count unit 23, and the information output unit of the communication analysis apparatus 20 according to the present embodiment. 25 functions are realized. Further, for example, the set value storage unit 24 is realized by a storage unit such as the magnetic disk device 20g.

  FIG. 3 merely exemplifies a hardware configuration of a computer suitable for application of the present embodiment. The present embodiment can be widely applied to devices that output information based on the number of counts, and the present embodiment is not realized only in the illustrated configuration.

<Processing procedure of communication analyzer>
Next, a procedure of processing in which the communication analysis apparatus 20 outputs information based on the count number based on the communication log will be described. FIG. 4 is a flowchart showing an example of a procedure for outputting information based on the count number based on the communication log.

  First, the communication log acquisition unit 21 is a log of communication detected in the acquisition target period on the network between the in-house LAN 40 and the Internet 50, and proxy the communication log for accessing the Internet 50 from the client terminal 10. Obtain from the server (step 101). Next, the communication log extraction unit 22 extracts a set of communication logs to be analyzed from the communication logs acquired by the communication log acquisition unit 21 (step 102). Here, the communication log extracting unit 22 collectively extracts a plurality of communication logs having the same transmission destination and transmission source pair based on the transmission destination information and transmission source information of each communication log. Usually, a large number of communication logs in the target period are accumulated, and there are a large number of pairs of transmission sources and transmission destinations. Therefore, the communication log extraction unit 22 extracts a set of communication logs for each pair of transmission destination and transmission source.

  Next, the count unit 23 selects one of the extracted set of communication logs (step 103). The count unit 23 then divides the set of selected communication logs by the length of the first period in order from before the target period (step 104). Next, the count unit 23 selects one of the divided first periods (step 105). Then, the count unit 23 calculates the interval between the first communication and the last communication that occurred within the selected first period based on the occurrence date and time of the communication log, and the calculated interval exceeds the second period. It is determined whether or not there is (step 106).

  When it is determined that the interval between the first communication and the last communication exceeds the second period (Yes in Step 106), the count unit 23 increases the count number by 1 (Step 107). On the other hand, when it is determined that the interval between the first communication and the last communication does not exceed the second period (No in step 106), the count unit 23 does not increase the count number.

  Next, the count unit 23 determines whether or not all of the first period divided in Step 104 has been selected (Step 108). When it is determined that there is a first period that has not yet been selected (No in Step 108), the process proceeds to Step 105. On the other hand, when it is determined that all the first periods have been selected (Yes in Step 108), the counting unit 23 determines whether or not all of the set of communication logs extracted in Step 102 have been selected (Step). 109).

  If it is determined that there is a set of communication logs not yet selected (No in step 109), the process proceeds to step 103. On the other hand, when it is determined that all of the communication log set has been selected (Yes in Step 109), the information output unit 25 acquires a count number for each communication log set, and based on the acquired count number Information is output (step 110). Here, the information output unit 25 acquires the count number counted in steps 105 to 108 for each set of communication logs, and outputs information based on the acquired count number. For example, the information output unit 25 may display a set of communication logs arranged in order of increasing count number, or the communication log set having a count number exceeding a predetermined threshold may have unauthorized communication. Is displayed. Then, this processing flow ends.

<Example of communication log>
Next, the communication log acquired by the communication log acquisition unit 21 will be described. FIG. 5 is a diagram illustrating an example of a communication log acquired by the communication log acquisition unit 21.

  The communication log shown in FIG. 5 includes the IP address of the device that is the data transmission destination, the IP address of the client terminal 10 that is the data transmission source, the user name of the client terminal 10 that is the transmission source, and the client terminal that is the transmission source. 10 computer names and information on the date and time when communication occurred are included. For example, in the communication log of number 1, the IP address of the device that is the transmission destination is “50.1.1.1”, and the IP address of the client terminal 10 that is the transmission source is “111.2.33.34”. Further, the user name of the transmission source client terminal 10 is “UserA”, the computer name of the transmission source client terminal 10 is “LAN-PC1”, and the date and time of occurrence of communication is “10:00 on January 1, 2015”.

  For example, for the communication logs of number 1, number 3, and number 4, the destination IP address is “50.1.1.1”, and the source IP address is “111.2.33.34”. The destination and source pairs are the same. Therefore, when extracting a set of communication logs to be analyzed from the communication log illustrated in FIG. 5, the communication log extraction unit 22 extracts the communication logs of number 1, number 3, and number 4.

  Here, in the communication log shown in FIG. 5, the transmission source information includes a transmission source IP address, a transmission source user name, and a transmission source computer name, and the communication log extraction unit 22 selects any of these transmission source information. A set of communication logs may be extracted using such information. However, for example, when an IP address is automatically assigned to the client terminal 10 by DHCP (Dynamic Host Configuration Protocol), communication may be performed with a different IP address even for the same client terminal 10. In such a case, the communication log extraction unit 22 may identify the client terminal 10 that is the transmission source based on the transmission source computer name, the transmission source user name, and the like and extract a set of communication logs. Note that the type of information included in the communication log is not limited to that shown in FIG. 5. For example, the domain name of the device that is the transmission destination may be used as the transmission destination information.

<Specific example of count processing>
Next, the counting process by the counting unit 23 will be described with a specific example. FIGS. 6A to 6D are diagrams for explaining a specific example of the counting process performed by the counting unit 23. FIG. In the example shown in the figure, two first periods are shown. However, communication in the first first period will be described below.

First, in the example illustrated in FIG. 6A, communication is repeatedly performed, and communication is performed eight times within the first period. The interval between the first communication and the last communication exceeds the second period. Therefore, the count unit 23 performs a process of increasing the count number by one.
In the example shown in FIG. 6B, two communications occur within the first period, and the interval between the first communication and the last communication exceeds the second period. Therefore, in the case of FIG. 6B, the number of occurrences of communication is smaller than in the case of FIG.

In the example shown in FIG. 6C, five communications occur within the first period, but five communications are performed in a short time, and the interval between the first communications and the last communications is The second period has not been exceeded. Therefore, the count unit 23 does not count.
In the example shown in FIG. 6D, 10 times of communication has occurred within the first period, and the interval between the first communication and the last communication exceeds the second period. Therefore, the count unit 23 performs a process of increasing the count number by one.

  Here, in the example shown in the figure, assuming that the first period is 1 minute and the second period is 40 seconds, in the example of FIG. 6A, communication repeatedly occurs at intervals of about 8 seconds. As described above, when the client terminal 10 is infected with malware, communication may be repeatedly performed with the attacker server 30. When such repeated communication occurs, if counting by the counting unit 23 is performed in a certain first period, it is highly possible that the counting is performed in another first period. Therefore, by outputting information indicating that the communication has a large number of counts, it is grasped that the communication is repeated and there is a possibility of communication by malware.

  In the example shown in FIG. 6 (b), communication has occurred twice during the first period, and has occurred repeatedly due to malware, or has occurred as a single normal communication regardless of malware. Is not determined. Here, if two communications occur once, it is unlikely that they will continue to be counted even in other first periods. For this reason, information indicating that the communication is a single communication as a normal communication is a communication with a small number of counts. On the other hand, if the two communications are communications that repeatedly occur due to malware, there is a high possibility that the count will be performed in the other first period. Therefore, as in the case shown in FIG. 6A, information indicating that the communication has a large number of counts is output, and it is recognized that the communication is repeated and may be communicated by malware.

  Here, even if the communication occurs repeatedly due to malware, if the communication interval exceeds 1 minute of the first period, the communication is not performed twice or more within the first period. Will not be counted. In such a case, if the setting value of the first period is changed to be longer, the counting by the counting unit 23 is performed.

  Next, the example illustrated in FIG. 6C illustrates a case where normal communication continuously occurs in a short time by a user browsing a web page via the Internet, for example. Although communication has occurred many times within the first period, since the interval between the first communication and the last communication is shorter than the second period, the counting by the counting unit 23 is not performed. That is, for example, normal communication that occurs continuously in a short time instead of periodically repeated communication is not counted, and information indicating that the communication has a small count is output.

  On the other hand, in the example shown in FIG. 6 (d), for example, when a user browses a different web page after browsing a web page, the communication occurs continuously after a short period of continuous communication. Shows the case. In this case, although the communication is not normal communication repeated by the malware but normal communication, since the interval between the first communication and the last communication exceeds the second period, the count unit 23 performs a process of increasing the count number by one. .

  As described above, when the user browses the web page, continuous communication may occur at a plurality of locations by browsing various web pages, and the interval between the first communication and the last communication may exceed the second period. is there. However, in browsing a web page, usually, the user frequently changes the web page to browse and continuous communication does not always occur at a plurality of locations. In addition, the time for which the user browses the web page is also considered to be a limited time such as several hours. Therefore, even if counting by the counting unit 23 is performed in a certain first period, it is not always counted in another first period. Furthermore, the number of times counted is limited to the time when the user browses the web page, and the number of counts is reduced as compared with repeated communications. As a result, when normal communication that continues within the first period occurs at a plurality of locations, information indicating that the communication has a small number of counts is output.

  In this way, the count unit 23 performs a process of incrementing the count number by 1 if the interval between the first communication and the last communication within the first period exceeds the second period. Therefore, when communication is repeatedly performed by malware, the number is counted in the first period and the number of counts is increased, so that the administrator can easily recognize that there is a possibility of unauthorized communication by malware.

  On the other hand, the counting unit 23 may count even when communication occurs in a single shot or continuous communication occurs in a plurality of places instead of repeated communication. However, it is unlikely that the count number of such communication is continuously added, and the longer the target period for acquiring the communication log is, the smaller the count number is compared to the repeated communication.

<Specific example of processing for outputting information based on count number>
Next, the process of outputting information based on the count number by the count unit 23 will be described with a specific example. FIG. 7 is a diagram for explaining a specific example of the process of outputting information based on the count number by the count unit 23. In the example illustrated in FIG. 7, for example, among communication logs accumulated in one day, a collection of communication logs having the same pair of transmission destination IP address and transmission source IP address is set as an analysis target. The set is arranged from the top.

  For example, as a set of communication logs indicated by number 1, for a set of communication logs having a transmission destination IP address “50.1.1.1” and a transmission source IP address “111.22.33.44”, the count number Is shown to be 1000. Similarly, count numbers are also shown for other communication log sets, and the sets are arranged from the top in order of increasing count numbers. By displaying in this way, the administrator determines, for example, that there is a possibility of unauthorized communication for a communication log with a large number of counts, and may take measures such as examining the corresponding communication log in detail.

  Further, if the count number exceeds a predetermined threshold, the information output unit 25 may perform display indicating that there is a possibility of unauthorized communication for the set of communication logs. For example, if the predetermined threshold value is 500, a set of communication logs with numbers 1 to 4 shown in FIG. 7 is displayed as a possibility of unauthorized communication.

  As described above, the communication analysis device 20 according to the present embodiment calculates the interval between the first communication and the last communication for each communication period for the communication log detected on the monitoring target network. Then, it is determined whether or not the calculated interval exceeds the second period. Then, if the calculated interval exceeds the second period, the communication analysis device 20 increases the count number by 1, and outputs information based on the count number added for each first period.

  Therefore, when the client terminal 10 infected with malware repeatedly performs communication, the number of counts increases, and the administrator can easily grasp that there is a possibility of unauthorized communication based on the output information. Here, the communication that repeatedly occurs is not limited to that caused by malware. For example, normal communication that is performed for updating anti-virus software may be repeatedly performed. In the present embodiment, normal communication that is repeatedly performed instead of being caused by malware may be recognized as having a high number of counts and the possibility of unauthorized communication. However, for such normal communication, the administrator may register, for example, in advance as normal or determine that the communication is normal based on the transmission destination IP address. And about the communication registered as normal, what is necessary is just to exclude from the object of a count, for example, and to display as normal communication on the display screen alert | reported to an administrator.

  Further, the communication analysis device 20 may count the traffic currently flowing on the network instead of the communication log accumulated in the proxy server or the like. In this case, the communication analyzer 20 grasps the communication within the first period for each pair of the transmission destination and the transmission source, determines whether to count, and increases the count number. Then, for example, when the count number exceeds a predetermined threshold, the information output unit 25 displays an alert on the display mechanism 20d and notifies the administrator.

  The program for realizing the embodiment of the present invention is a computer-readable recording medium such as a magnetic recording medium (magnetic tape, magnetic disk, etc.), an optical recording medium (optical disk, etc.), a magneto-optical recording medium, or a semiconductor memory. Can be provided in a state stored in the memory. It can also be provided using communication means such as the Internet.

  Moreover, although this invention was demonstrated using embodiment, the technical scope of this invention is not limited to the said embodiment. It will be apparent to those skilled in the art that various modifications and alternative embodiments can be made without departing from the spirit and scope of the invention.

10a, 10b, 10c ... Client terminal, 20 ... Communication analyzer, 21 ... Communication log acquisition unit, 22 ... Communication log extraction unit, 23 ... Count unit, 24 ... Setting value storage unit, 25 ... Information output unit, 30 ... Attack Server

Claims (6)

An acquisition means for acquiring information included in communications detected within a target period on a network to be monitored;
Extraction means for extracting a set of communications in which at least a part of the information in the communication is common among the communications based on the information obtained by the obtaining means;
For a set of communications extracted by the extraction means, a second period in which an interval between a specific communication and a specific other communication is different from the first period within a first period set in the target period An information processing apparatus comprising: output means for outputting information based on a count number that is a longer number of the first period. The information processing apparatus according to claim 1, wherein the output unit displays a set of communications extracted by the extraction unit in an order based on the count number. The output means outputs information related to the set of the communication sets extracted by the extracting means for a set whose count number satisfies a predetermined criterion. The information processing apparatus described in 1. The information processing apparatus according to claim 1, wherein the extraction unit extracts a set of communications in which a data transmission destination and a transmission source in the communication are the same. Obtaining information included in communications detected within a target period on a network to be monitored;
Extracting a set of communications in which at least a part of the information in the communication is common among the communications based on the acquired information;
For the extracted set of communication, the interval between the specific one communication and the specific other communication within the first period set in the target period is longer than the second period different from the first period. Outputting information based on a count that is the number of first periods. On the computer,
A function to acquire information included in communications detected within the target period on the network to be monitored;
A function of extracting a set of communications in which at least a part of the information in the communication is common among the communications based on the acquired information;
For the extracted set of communication, the interval between the specific one communication and the specific other communication within the first period set in the target period is longer than the second period different from the first period. A program for realizing a function of outputting information based on a count number which is the number of first periods.

Images