JP6760884B2 - Generation system, generation method and generation program - Google Patents

Description

The present invention relates to a generation system, a generation method and a generation program.

In a local area network (LAN) such as a corporate network, abnormal communication is detected in order to protect the host connected to an unreliable network used by an unspecified number of people such as the Internet from external malicious communication. A network-type security countermeasure device that blocks or shuts down is used. As a network-type security countermeasure device, a firewall, a network-type IDS (Intrusion Detection System), a network-type IPS (Intrusion Prevention System), and the like are known. Further, there is known a method of increasing the detection probability of abnormal communication by installing a system for detecting abnormal communication in multiple layers (see, for example, Non-Patent Document 1 or 2).

Ministry of Economy, Trade and Industry, "Cyber Security Management Guidelines", [online], [Search on June 5, 2017], Internet (http://www.meti.go.jp/press/2015/12/20151228002/20151228002- 2.pdf) IPA, "Cyber Security Management Guideline Manual", [online], [Search on June 5, 2017], Internet (https://www.ipa.go.jp/files/000056148.pdf)

However, the conventional technology has a problem that it may not be possible to suppress the occurrence of false detections and oversights when a plurality of abnormal communication detection systems having different detection rules are multi-layered to detect abnormal communication. ..

For example, a misuse detection type abnormal communication detection system that uses a signature based on data related to malicious communication as a detection rule, and an anomaly detection type abnormal communication detection that uses a mapping function generated by machine learning based on data related to normal communication as a detection rule. Consider the case where the system and the system are multi-layered. In this case, since it is difficult to directly compare the signature and the mapping function to confirm the consistency, there may be a contradiction in the detection operation between the detection systems, and false detection or oversight may occur.

In the generation system of the present invention, the first data related to the communication generated in a predetermined period in the host connected to the network, the second data related to the abnormal communication generated for the test, and the data related to the communication are the data related to the abnormal communication. An abnormal communication identification rule that identifies whether or not the data is normal, an acquisition unit that acquires the acquisition unit, and a normal communication identification rule that identifies whether or not the data related to communication is data related to normal communication, the first data is normal. The generator that generates data to identify the data related to communication and the rule that identifies the first data from the data related to abnormal communication among the rules included in the abnormal communication identification rule are deleted from the abnormal communication identification rule. A deletion unit, an additional unit that adds a rule for identifying data identified as data related to normal communication by the normal communication identification rule to data related to abnormal communication among the second data to the abnormal communication identification rule. It is characterized by having.

According to the present invention, when a plurality of abnormal communication detection systems having different detection rules are multi-layered to detect abnormal communication, it is possible to suppress the occurrence of erroneous detection and oversight.

FIG. 1 is a diagram for explaining an abnormal communication detection system having a multi-layer structure. FIG. 2 is a diagram for explaining an abnormal communication detection system having a multi-layer structure. FIG. 3 is a diagram for explaining an abnormal communication detection system having a multi-layer structure. FIG. 4 is a diagram showing an example of the configuration of the generation system according to the first embodiment. FIG. 5 is a diagram showing an example of the configuration of the detection rule generation control unit according to the first embodiment. FIG. 6 is a flowchart showing a processing flow of the generation system according to the first embodiment. FIG. 7 is a flowchart showing the flow of the false positive inspection process according to the first embodiment. FIG. 8 is a flowchart showing the flow of the overlooked inspection process according to the first embodiment. FIG. 9 is a flowchart showing the flow of the overlooked re-inspection process according to the first embodiment. FIG. 10 is a diagram showing an example of an abnormal communication identification rule according to the first embodiment. FIG. 11 is a diagram showing an example of test data according to the first embodiment. FIG. 12 is a diagram showing an example of traffic capture data of the host according to the first embodiment. FIG. 13 is a diagram showing an example of a normal communication identification rule according to the first embodiment. FIG. 14 is a diagram showing an example of the result of the false positive inspection process according to the first embodiment. FIG. 15 is a diagram showing an example of an abnormal communication identification rule after the false positive inspection process according to the first embodiment. FIG. 16 is a diagram showing an example of the result of the oversight inspection process according to the first embodiment. FIG. 17 is a diagram showing an example of test data after the overlooked inspection process according to the first embodiment. FIG. 18 is a diagram showing an example of the result of the overlooked re-inspection process according to the first embodiment. FIG. 19 is a diagram showing an example of an abnormal communication identification rule after the overlooked re-inspection process according to the first embodiment. FIG. 20 is a diagram showing an example of information regarding false positives according to the first embodiment. FIG. 21 is a diagram for explaining acquisition of captured data when a false positive according to the first embodiment occurs. FIG. 22 is a diagram showing an example of information regarding oversight according to the first embodiment. FIG. 23 is a diagram for explaining acquisition of captured data when an oversight occurs according to the first embodiment. FIG. 24 is a diagram showing an example of a computer that executes a generation program.

Hereinafter, the generation system, the generation method, and the embodiment of the generation program according to the present application will be described in detail with reference to the drawings. The present invention is not limited to the embodiments described below.

[Structure of the first embodiment]
First, using FIGS. 1 to 3, the installation of an anomaly communication detection system having a multi-layer structure for detecting anomaly communication using the rules for anomaly detection generated by the generation system of the present embodiment will be described. 1 to 3 are diagrams for explaining an abnormal communication detection system having a multi-layer structure.

FIG. 1 shows a network configuration of a general corporate network. As shown in FIG. 1, a LAN 4 to which a plurality of hosts 5 are connected and an unspecified network 1 such as the Internet are connected via a firewall 2. Further, in order to protect the security of the host 5, an abnormal communication detection system having a multi-layer structure is installed in the installation section 3. The multi-layered abnormality communication detection system includes security countermeasure devices such as IDS and IPS.

FIG. 2 shows an in-line type installation method. In this case, as shown in FIG. 2, the abnormal communication detection system 100 of the first layer of the abnormal communication detection system 10a and the abnormal communication detection system 200 of the second layer are connected in-line.

On the other hand, FIG. 3 shows a tap type installation method. In this case, as shown in FIG. 3, the abnormality communication detection system 100 of the first layer and the abnormality communication detection system 200 of the second layer of the abnormality communication detection system 10b are the firewall 2 and the like via the network device 6. Is connected with. The network device 6 has a mirror port and can pass a copy of the traffic to the abnormal communication detection system 10b.

The configuration of the generation system will be described with reference to FIG. FIG. 4 is a diagram showing an example of the configuration of the generation system according to the first embodiment. As shown in FIG. 4, the generation system 300 is provided in the abnormality communication detection system 10. The anomaly communication detection system 10 has a traffic capture system 50, an anomaly communication detection system 100 of the first layer, an anomaly communication detection system 200 of the second layer, and a generation system 300, and is connected to the external system group 400. ing.

The traffic capture system 50 is a system that captures the communication of the host designated by the instruction of the generation system 300. Since the traffic capture system 50 only needs to be able to capture the traffic flowing through the abnormal communication detection system 10, it does not matter whether it is an in-line connection or a tap connection via a device capable of mirroring the traffic.

Further, the abnormal communication detection system 100 of the first layer is a system that detects abnormal communication according to a detection rule (for example, an abnormal communication identification rule) set in itself. Further, the abnormal communication detection system 200 in the second layer is a system that identifies normal communication according to a detection rule set by itself (for example, a normal communication identification rule) and detects communication that cannot be identified as normal communication as abnormal communication. Is. The external system group 400 is a system group that provides data used by the generation system 300 in the rule generation process according to the instruction of the generation system 300. The abnormality communication detection system 100 of the first layer is an example of the first abnormality communication detection system. The abnormality communication detection system 200 of the second stage is an example of the second abnormality communication detection system. Further, the abnormal communication detection system 10 includes an abnormal communication detection system 100 of the first layer that detects abnormal communication using the abnormal communication identification rule and a two-stage that detects abnormal communication using the normal communication identification rule. This is an example of a multi-layered abnormal communication detection system in which the abnormal communication detection system 200 of the eye layer is multi-layered.

Further, as shown in FIG. 4, the generation system 300 includes a detection rule generation control unit 310, a traffic capture management unit 320, a normal communication identification rule generation unit 330, an abnormal communication identification rule generation unit 340, a test traffic management unit 350, and a detection. It has a rule management unit 360.

Further, the traffic capture management unit 320 has capture data 321. Further, the normal communication identification rule generation unit 330 has normal communication identification rule data 331. Further, the abnormal communication identification rule generation unit 340 has abnormal communication identification rule data 341. Further, the test traffic management unit 350 has test data 351. Further, the detection rule management unit 360 has a detection rule data 361 and a detection rule distribution unit 362.

The detection rule generation process by the generation system 300 will be described. The external system group 400 generates a detection rule based on the data input from the traffic capture system 50, the generation system 300, and the like. Further, the generation system 300 outputs the generated detection rule to the abnormal communication detection system 100 of the first layer and the abnormal communication detection system 200 of the second layer.

In the detection rule generation process, the detection rule generation control unit 310 located inside the generation system 300 performs the traffic capture management unit 320, the normal communication identification rule generation unit 330, the abnormal communication identification rule generation unit 340, the test traffic management unit 350, and the test traffic management unit 350. This is done by controlling the detection rule management unit 360.

The configuration of the detection rule generation control unit 310 will be described with reference to FIG. FIG. 5 is a diagram showing an example of the configuration of the detection rule generation control unit according to the first embodiment. As shown in FIG. 5, the detection rule generation control unit 310 includes an acquisition unit 311, a generation unit 312, a false detection inspection unit 313, a missed inspection unit 314, a deletion unit 315, and an additional unit 316.

By controlling the traffic capture management unit 320, the acquisition unit 311 acquires traffic capture data related to the communication generated in a predetermined period on the host connected to the network. The traffic capture management unit 320 acquires the traffic capture data of the host designated by the acquisition unit 311 from the traffic capture system 50. Then, the traffic capture management unit 320 accumulates the acquired traffic capture data in the capture data 321. Further, the traffic capture management unit 320 transmits the traffic capture data accumulated in the capture data 321 to the detection rule management unit 360 according to the instruction from the acquisition unit 311. Further, the traffic capture management unit 320 stores the traffic capture data passed from the detection rule management unit 360 in the capture data 321. The traffic capture data acquired by the traffic capture management unit 320 is an example of the first data.

Further, when the abnormal communication detection system 10 detects the communication known to be normal as abnormal communication, the acquisition unit 311 occurs in a predetermined period including the period in which the communication known to be normal occurs. Data related to the communication can be acquired as traffic capture data. Further, when the abnormal communication detection system 10 detects that the communication known to be abnormal is a non-abnormal communication, the acquisition unit 311 receives the communication for a predetermined period including the period in which the communication known to be abnormal occurs. Of these, data related to communication that occurred during a period other than the period when communication known to be abnormal can be acquired can be acquired as traffic capture data.

Further, the generation unit 312 controls the normal communication identification rule generation unit 330 to set the normal communication identification rule for identifying whether or not the data related to communication is the data related to normal communication, and the traffic capture data as data related to normal communication. Generate to identify as. The normal communication identification rule generation unit 330 analyzes the traffic capture data of the host designated by the generation unit 312, newly generates a normal communication identification rule, and stores it in the normal communication identification rule data 331.

By controlling the abnormal communication identification rule generation unit 340, the acquisition unit 311 acquires an abnormal communication identification rule that identifies whether or not the data related to communication is data related to abnormal communication. The abnormal communication identification rule generation unit 340 is provided by the systems of several organizations classified into the external system group 400, such as the vendor that manufactures the abnormal communication detection system 100 of the first layer and the community of the security industry. The abnormal communication identification rule is acquired and stored in the abnormal communication identification rule data 341.

The acquisition unit 311 acquires test data related to abnormal communication generated for testing by controlling the test traffic management unit 350. The test traffic management unit 350 is a device for testing a security countermeasure device that generates test traffic, and is a system of several organizations classified into an external system group 400, such as a vendor that manufactures the device and a community in the security industry. The test data and the like provided by the above are acquired and stored in the test data 351. In addition, the test traffic management unit 350 can automatically generate and transmit unusual communications such as vulnerability diagnosis and reproduction of attack packets performed in the penetration test. The test data acquired by the test traffic management unit 350 is an example of the second data.

The false detection inspection unit 313 executes an inspection related to false detection by controlling the detection rule management unit 360. In addition, the oversight inspection unit 314 controls the detection rule management unit 360 to execute an inspection related to oversight. The detection rule management unit 360 instantiates the virtual machine of the abnormal communication detection system 100 in the first layer according to the instruction from the detection rule generation control unit 310, and receives the abnormal communication identification rule from the abnormal communication identification rule generation unit 340. It is set in the instance, and the communication test is performed by the traffic capture management unit 320 and the test traffic management unit 350. Further, the detection rule management unit 360 instantiates the virtual machine of the abnormal communication detection system 200 in the second layer, sets the normal communication identification rule received from the normal communication identification rule generation unit 330 in the instance, and sets the normal communication identification rule to the instance, and sets the traffic capture management unit. A communication test is carried out by 320 and the test traffic management unit 350.

The detection rule management unit 360 collects log information of hits to the abnormal communication identification rule of the input packet to the virtual machine of the instantiated first-stage layer abnormal communication detection system 100, and performs abnormal communication based on the log information. The identification rule is modified and passed to the abnormal communication identification rule generation unit 340. Further, the detection rule management unit 360 can accumulate the abnormal communication identification rule in the detection rule data 361. By controlling the detection rule management unit 360, the deletion unit 315 deletes from the abnormal communication identification rule the rule that identifies the traffic capture data as the data related to the abnormal communication among the rules included in the abnormal communication identification rule. Further, the additional unit 316 controls the detection rule management unit 360 to set a rule for identifying the data identified as the data related to the normal communication by the normal communication identification rule as the data related to the abnormal communication among the test data. Add to the identification rule.

Further, the detection rule management unit 360 captures the output packet of the virtual machine of the abnormal communication detection system 200 of the second stage instantiated layer, and passes the traffic capture data of the output packet to the traffic capture management unit 320. Further, the detection rule management unit 360 can store the normal communication identification rule in the detection rule data 361.

The detection rule distribution unit 362 of the detection rule management unit 360 distributes the detection rules accumulated in the detection rule data 361 to the abnormal communication detection system 100 of the first layer and the abnormal communication detection system 200 of the second layer. To do.

[Processing of the first embodiment]
Here, the processing of the generation system according to the first embodiment will be described with reference to FIGS. 6 to 9. FIG. 6 is a flowchart showing a processing flow of the generation system according to the first embodiment. Further, FIG. 7 is a flowchart showing the flow of the false positive inspection process according to the first embodiment. Further, FIG. 8 is a flowchart showing the flow of the overlooked inspection process according to the first embodiment. FIG. 9 is a flowchart showing the flow of the overlooked re-inspection process according to the first embodiment.

FIG. 6 shows a processing flow when a new detection rule needs to be registered (step S102, with registration) and when a detection rule needs to be updated (step S102, with update). .. The case where new registration of the detection rule is required is, for example, the case where the host is newly connected to the LAN. Further, the case where the detection rule needs to be updated is, for example, the case where false detection or oversight occurs a predetermined number of times in the detection using the detection rule in use.

Further, when the host is newly connected to the LAN, the acquisition unit 311 acquires the abnormal communication identification rule and the test data from the external system group 400 based on the set attribute information of the host.

FIG. 10 is a diagram showing an example of an abnormal communication identification rule according to the first embodiment. As shown in FIG. 10, for example, among the abnormal communication identification rules, the rule content of the rule whose abnormal communication identification rule ID is "A1" is that the communication partner is "arbitrary", the protocol is "FTP", and the packet size is "A1". "50 or more" and the character string is "arbitrary".

FIG. 11 is a diagram showing an example of test data according to the first embodiment. As shown in FIG. 11, among the test data, the communication content of the test data whose test data ID is "T1" is "a to z" for the communication partner, "FTP" for the protocol, and "30 or more and 40" for the packet size. Below ", the character string is" TARGET ".

The acquisition unit 311 confirms whether or not a new host is registered and whether or not there is a host that needs to newly update the detection rule (step S101). In the following description, the host for which the detection rule needs to be registered or updated is referred to as a new host.

Here, when new registration of the detection rule is required (step S102, with registration), the acquisition unit 311 acquires and accumulates the traffic capture data of the new host (step S103). FIG. 12 is a diagram showing an example of traffic capture data of the host according to the first embodiment. As shown in FIG. 12, among the traffic capture data, the communication content of the data whose packet ID is "P1" is that the communication partner is "a", the protocol is "FTP", the packet size is "10", and the character string is. It is "GET".

Next, the generation unit 312 generates a normal communication identification rule from the traffic capture data of the new host (step S104). At this time, the generation unit 312 may use the whitelist normal communication identification rule created based on the contents of the traffic capture data, or the mapping function generated by performing machine learning using the traffic capture data as the normal behavior. It may be a communication identification rule. FIG. 13 is a diagram showing an example of a normal communication identification rule according to the first embodiment. As shown in FIG. 13, among the normal communication identification rules, the rule contents of the rule whose normal communication identification rule ID is "N1" are that the communication partner is "a or b", the protocol is "FTP", and the packet size is "N1". "10 or more and 50 or less", and the character string is "GET".

Here, the detection rule generation control unit 310 generates an instance I1 of the abnormal communication detection system 100 of the first layer and an instance I2 of the abnormal communication detection system 200 of the second layer (step S105).

The false positive inspection unit 313 performs false positive inspection processing (step S200). The false positive inspection unit 313 performs false positive inspection processing by executing the subroutine shown in FIG. 7. As shown in FIG. 7, the false positive inspection unit 313 sets the test environment as instance I1 (instantiated virtual machine of the abnormal communication detection system 100 in the first layer), and sets the input traffic as the traffic capture data of the new host. , The usage rule is tested as an abnormal communication identification rule (step S201). At this time, the false detection inspection unit 313 records the abnormality detection identification rule that hits the communication as a detection log, and performs the inspection depending on whether or not the detection log of the instance I1 is output. That is, in the false positive inspection process, the false positive inspection unit 313 considers the traffic capture data to be normal, and when the traffic capture data is identified as abnormal communication, it considers that false positive has occurred.

When the detection log is output (step S202, Yes), the deletion unit 315 removes the abnormal communication identification rule that hits the communication from the abnormal identification rule for the new host, and removes the new abnormality for the new host. It is a communication rule (step S203). On the other hand, when there is no output of the detection log (step S202, No), the false detection inspection unit 313 considers that there is no false detection, and terminates the subroutine without deleting the rule.

FIG. 14 is a diagram showing an example of the result of the false positive inspection process according to the first embodiment. Further, FIG. 15 is a diagram showing an example of an abnormal communication identification rule after the false positive inspection process according to the first embodiment. As shown in FIG. 14, when the rule whose abnormal communication identification rule ID is "A1" causes a false detection, the deletion unit 315 deletes the rule as shown in FIG. As a result, it is possible to prevent the traffic capture data from being identified as abnormal based on the abnormal communication identification rule.

Here, returning to FIG. 6, after the false detection inspection process is performed, the missed inspection unit 314 performs the missed inspection process (step S300). The overlook inspection unit 314 performs the overlook inspection process by executing the subroutine shown in FIG. As shown in FIG. 8, the overlook inspection unit 314 sets the test environment as instance I2 (instantiated virtual machine of the abnormal communication detection system 200 in the second layer), and inputs input traffic to the test traffic management unit 350. (Communication based on test data), a test is performed using the usage rule as a normal communication identification rule (step S301). At this time, the instance I2 discards the packet that did not hit the normal communication identification rule. That is, the instance I2 outputs only the packets that hit the normal communication identification rule. Then, the overlook inspection unit 314 inspects based on the presence or absence of the packet output from the instance I2. In addition, the missed inspection unit 314 acquires a capture of the packet output from the instance I2. That is, in the missed inspection process, the missed inspection unit 314 considers the communication of the test traffic management unit 350 to be abnormal, and if the communication is identified as normal communication, it considers that the missed communication has occurred.

When there is an output packet (step S302, Yes), the missed inspection unit 314 registers the captured data of the packet output from the instance I2 in the captured data 321 as missed traffic data (step S303). On the other hand, when there is no output packet (step S302, No), the overlook inspection unit 314 registers the normal communication identification rule as the detection rule for the new host in the detection rule data 361 (step S304). Here, the overlooked inspection unit 314 targets the overlooked test traffic data for the overlooked re-inspection process.

FIG. 16 is a diagram showing an example of the result of the oversight inspection process according to the first embodiment. Further, FIG. 17 is a diagram showing an example of test data after the overlooked inspection process according to the first embodiment. As shown in FIG. 16, when the data having the test data ID “T1” and the data having the test data ID “T2” cause an oversight, as shown in FIG. 17, the oversight inspection unit 314 misses the data. The test data excluding the data whose test data ID is "T3" is used as the overlooked traffic data.

Here, returning to FIG. 6, after the missed detection inspection process is performed, the missed inspection unit 314 performs the missed re-inspection process (step S400). The overlooked inspection unit 314 performs the overlooked re-inspection process by executing the subroutine shown in FIG. As shown in FIG. 9, when the normal communication identification rule for the new host is registered in the detection data (step S401, Yes), the missed inspection unit 314 does not perform the missed re-inspection process, and the abnormal communication identification rule Is registered in the detection rule data 361 as a detection rule for the new host (step S402).

On the other hand, when the normal communication identification rule for the new host is not registered in the detection data (step S401, No), the missed inspection unit 314 sets the test environment as instance I1, misses the input traffic, and abnormally communicates the usage rule. A test is performed as an identification rule (step S403). At this time, the instance I1 discards the packet that does not hit the abnormal communication identification rule. That is, the instance I1 outputs only the packet that hits the abnormal communication identification rule. Then, the overlook inspection unit 314 inspects based on the presence or absence of the packet output from the instance I1. In addition, the missed inspection unit 314 acquires a traffic capture of the packet output from the instance I1. That is, in the overlooked re-inspection process, if the overlooked traffic data is not identified as abnormal by the overlooked inspection unit 314, such abnormal traffic data is transmitted to the abnormal communication detection system 100 of the first layer and the second stage. It is considered that an oversight occurs in both of the abnormal communication detection system 200 of the layer.

When there is an output packet (step S404, Yes), the addition unit 316 generates an abnormal communication identification rule from the captured data of the packet output from the instance I1 and adds it to the abnormal communication identification rule data 341 (step S406). ). Then, the false positive inspection unit 313 performs the false positive inspection process (step S200). Here, when all the abnormal communication identification rules added in step S406 do not remain (step S407, No), the additional unit 316 further generates an abnormal communication identification rule from the captured data of the packet output from the instance I1. Then, it is added to the abnormal communication identification rule data 341 (step S406). On the other hand, when all the abnormal communication identification rules added in step S406 remain (step S407, Yes), the overlook inspection unit 314 registers the normal communication identification rule as the detection rule for the new host in the detection rule data 361.

Further, even when there is no output packet (step S404, No), the missed inspection unit 314 registers the normal communication identification rule as the detection rule for the new host in the detection rule data 361 (step S405). Then, the overlook inspection unit 314 registers the abnormal communication identification rule as the detection rule for the new host in the detection rule data 361 (step S402).

FIG. 18 is a diagram showing an example of the result of the overlooked re-inspection process according to the first embodiment. Further, FIG. 19 is a diagram showing an example of an abnormal communication identification rule after the overlooked re-inspection process according to the first embodiment. As shown in FIG. 18, since the data whose test data ID is "T1" was not identified as abnormal even in the overlooked re-inspection process, the additional unit 316 has an abnormal communication identification rule of "A5" from the data. A rule is generated and added to the abnormal communication identification rule data 341.

Here, returning to FIG. 6, after the overlooked re-inspection process is performed, the detection rule distribution unit 362 moves to the abnormal communication detection system 100 of the first layer and the abnormal communication detection system 200 of the second layer. The detection rule of the new host is distributed (step S106). Then, the detection rule generation control unit 310 deletes the instance I1 of the abnormal communication detection system 100 in the first layer and the instance I2 of the abnormal communication detection system 200 in the second layer (step S107). Then, the detection rule generation control unit 310 returns the process to step S101, and further executes the detection rule generation process.

Further, as shown in FIG. 6, when the detection rule needs to be updated (step S102, with update), the acquisition unit 311 confirms whether the update type of the detection rule is erroneous detection or overlooked. (Step S501).

When the update type is false positive (step S501, false positive), the acquisition unit 311 selects and acquires the traffic capture data of the new host during the period including the false positive occurrence period (step S502). FIG. 20 is a diagram showing an example of information regarding false positives according to the first embodiment. Based on the information shown in FIG. 20, the acquisition unit 311 needs to update the detection rule, and determines that the update type is erroneous detection. FIG. 20 shows that an erroneous detection occurred at 10:10:10 on December 1, 2016 in the abnormal communication detection system 100 of the first layer and the abnormal communication detection system 200 of the second layer. ..

FIG. 21 is a diagram for explaining acquisition of captured data when a false positive according to the first embodiment occurs. As shown in FIG. 21, in this case, the acquisition unit 311 selects and acquires the traffic capture data of the period D002 before and after the time when the false detection occurs. The period D002 may be the same length as the period D001 in which the traffic capture data is acquired when the detection rule is registered.

On the other hand, when the update type is overlooked (step S501, overlooked), the acquisition unit 311 selects the traffic capture data of the new host during the period excluding the overlook occurrence period, and overlooks the overlooked traffic capture data. Include in traffic data (step S503). FIG. 22 is a diagram showing an example of information regarding oversight according to the first embodiment. Based on the information shown in FIG. 22, the acquisition unit 311 determines that the detection rule needs to be updated and the update type is overlooked. In FIG. 22, in the abnormal communication detection system 100 of the first layer and the abnormal communication detection system 200 of the second layer, an oversight occurred at 15:00:00 on January 1, 2017, and the communication contents at that time. However, it indicates that the protocol was "HTTP", the packet size was "20", and the character string was "MARICIOUS".

FIG. 23 is a diagram for explaining acquisition of captured data when an oversight occurs according to the first embodiment. As shown in FIG. 23, in this case, the acquisition unit 311 selects and acquires the traffic capture data of the period D003 before and after the time when the oversight occurs and does not include the period in which the oversight occurs. In addition, the acquisition unit 311 acquires the traffic capture data of the period in which the oversight occurred as the overlooked traffic data. The period D003 may be the same length as the period D001 in which the traffic capture data is acquired when the detection rule is registered.

[Effect of the first embodiment]
The acquisition unit 311 determines whether the traffic capture data related to the communication generated in the predetermined period on the host connected to the network, the test data related to the abnormal communication generated for the test, and the data related to the communication are the data related to the abnormal communication. Acquires an abnormal communication identification rule that identifies the data. Further, the generation unit 312 generates a normal communication identification rule that identifies whether or not the data related to communication is data related to normal communication so as to identify the traffic capture data from the data related to normal communication. Further, the deletion unit 315 deletes the rule that identifies the traffic capture data from the data related to the abnormal communication among the rules included in the abnormal communication identification rule from the abnormal communication identification rule. In addition, the additional unit 316 adds a rule for identifying the data identified as the data related to the normal communication by the normal communication identification rule to the data related to the abnormal communication among the test data to the abnormal communication identification rule. As described above, in the first embodiment, since the detection rule is evaluated via the traffic capture data and the test data, even if the detection rules are different, the contradiction between the detection rules is eliminated and the consistency is improved. Can be kept. Therefore, according to the first embodiment, even when a plurality of abnormal communication detection systems having different detection rules are multi-layered to detect abnormal communication, it is possible to suppress the occurrence of erroneous detection and oversight. For example, according to the first embodiment, in an abnormal communication detection system in which a misuse detection type abnormal communication detection system and an anomaly detection type abnormal communication detection system are multi-layered, it is possible to suppress the occurrence of false detections and oversights. it can. Further, in the first embodiment, since the detection rule is automatically generated, it is possible to generate a consistent detection rule with less operation than before at the time of initial introduction or operation of the host.

The additional unit 316 sets a rule for identifying data that is identified as data related to normal communication by the normal communication identification rule but not data related to abnormal communication by the abnormal communication identification rule as data related to abnormal communication among the test data. , Can be added to the anomaly identification rule. As a result, it becomes possible to detect abnormal communication that is overlooked only by the normal communication identification rule by using the abnormal communication identification rule.

An abnormal communication detection system 100 in the first layer that detects abnormal communication using the abnormal communication identification rule, and an abnormal communication detection system 200 in the second layer that detects abnormal communication using the normal communication identification rule. When a communication known to be normal is detected as an abnormal communication by the multi-layered abnormal communication detection system, the acquisition unit 311 includes a period during which the communication known to be normal occurs. Data related to communication that occurred in a predetermined period can be acquired as traffic capture data. As a result, for example, even when a false positive occurs due to a change in traffic characteristics during the operation of the host, the detection rule can be updated at any time so as to respond to the false positive.

An abnormal communication detection system 100 in the first layer that detects abnormal communication using the abnormal communication identification rule, and an abnormal communication detection system 200 in the second layer that detects abnormal communication using the normal communication identification rule. When a communication known to be abnormal is detected as a non-abnormal communication by the multi-layered abnormal communication detection system, the acquisition unit 311 is in the period when the communication known to be abnormal occurs. Of the predetermined period including the period, data related to the communication generated in the period excluding the period in which the communication known to be abnormal occurred can be acquired as the traffic capture data. As a result, for example, even if an oversight occurs due to a change in a cyber attack, the detection rule can be updated at any time so that the oversight can be dealt with.

[System configuration, etc.]
Further, each component of each of the illustrated devices is a functional concept, and does not necessarily have to be physically configured as shown in the figure. That is, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or part of the device is functionally or physically distributed in arbitrary units according to various loads and usage conditions. It can be integrated and configured. Further, each processing function performed by each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic.

Further, among the processes described in the present embodiment, all or part of the processes described as being automatically performed can be manually performed, or the processes described as being manually performed can be performed. All or part of it can be done automatically by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[program]
As one embodiment, the generation system 30 can be implemented by installing a generation program that executes the generation of the above detection rule as package software or online software on a desired computer. For example, by causing the information processing apparatus to execute the above generation program, the information processing apparatus can function as the generation system 30. The information processing device referred to here includes a desktop type or notebook type personal computer. In addition, the information processing device includes mobile communication terminals such as smartphones, mobile phones and PHS (Personal Handyphone System), and slate terminals such as PDAs (Personal Digital Assistants).

Further, the generation system 30 can be implemented as a generation server device in which the terminal device used by the user is a client and the service related to the generation of the above detection rule is provided to the client. For example, the generation server device is implemented as a server device that provides a generation service that inputs the attribute information of the new host and outputs the generated detection rule. In this case, the generation server device may be implemented as a Web server, or may be implemented as a cloud that provides the service related to the generation of the above detection rule by outsourcing.

FIG. 24 is a diagram showing an example of a computer that executes a generation program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. Each of these parts is connected by a bus 1080.

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, the display 1130.

The hard disk drive 1090 stores, for example, the OS 1091, the application program 1092, the program module 1093, and the program data 1094. That is, the program that defines each process of the generation system 30 is implemented as a program module 1093 in which a code that can be executed by a computer is described. The program module 1093 is stored in, for example, the hard disk drive 1090. For example, a program module 1093 for executing a process similar to the functional configuration in the generation system 30 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD.

Further, the setting data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, a memory 1010 or a hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1090 into the RAM 1012 and executes them as needed.

The program module 1093 and the program data 1094 are not limited to those stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN, WAN (Wide Area Network), etc.). Then, the program module 1093 and the program data 1094 may be read by the CPU 1020 from another computer via the network interface 1070.

1 Network 2 Firewall 3 Installation section 4 LAN
5 Host 6 Network device 10, 10a, 10b Abnormal communication detection system 50 Traffic capture system 100 Abnormal communication detection system for the first layer 200 Abnormal communication detection system for the second layer 300 Generation system 310 Detection rule generation control unit 311 Acquisition unit 312 Generation unit 313 False detection inspection unit 314 Overlooked inspection unit 315 Deleted unit 316 Addition unit 320 Traffic capture management unit 321 Captured data 330 Normal communication identification rule generation unit 331 Normal communication identification rule data 340 Abnormal communication identification rule generation unit 341 Abnormality Communication identification rule data 350 Test traffic management unit 351 Test data 360 Detection rule management unit 361 Detection rule data 362 Detection rule distribution unit 400 External system group

Claims (6)

Identify whether the first data related to communication that occurred in a predetermined period on a host connected to the network, the second data related to abnormal communication generated for testing, and the data related to communication are data related to abnormal communication. Abnormal communication identification rule to acquire, acquisition unit to acquire,
A generator that generates a normal communication identification rule that identifies whether or not the data related to communication is data related to normal communication so as to identify the first data from the data related to normal communication.
Among the rules included in the abnormal communication identification rule, a deletion unit that deletes the rule that identifies the first data as data related to abnormal communication from the abnormal communication identification rule, and
Of the second data, an additional part that adds a rule for identifying data identified as data related to normal communication by the normal communication identification rule to data related to abnormal communication to the abnormal communication identification rule, and
Have a,
The first abnormal communication detection system that detects abnormal communication using the abnormal communication identification rule and the second abnormal communication detection system that detects abnormal communication using the normal communication identification rule are multi-layered. When the communication known to be normal is detected as abnormal communication by the multi-layered abnormal communication detection system, the acquisition unit is in the predetermined period including the period in which the communication known to be normal occurs. A generation system characterized in that data relating to the generated communication is acquired as the first data . Identify whether the first data related to communication that occurred in a predetermined period on a host connected to the network, the second data related to abnormal communication generated for testing, and the data related to communication are data related to abnormal communication. Abnormal communication identification rule to acquire, acquisition unit to acquire,
A generator that generates a normal communication identification rule that identifies whether or not the data related to communication is data related to normal communication so as to identify the first data from the data related to normal communication.
Among the rules included in the abnormal communication identification rule, a deletion unit that deletes the rule that identifies the first data as data related to abnormal communication from the abnormal communication identification rule, and
Of the second data, an additional part that adds a rule for identifying data identified as data related to normal communication by the normal communication identification rule to data related to abnormal communication to the abnormal communication identification rule, and
Have,
The first abnormal communication detection system that detects abnormal communication using the abnormal communication identification rule and the second abnormal communication detection system that detects abnormal communication using the normal communication identification rule are multi-layered. When the multi-layered abnormal communication detection system detects a communication known to be abnormal as a non-abnormal communication, the acquisition unit receives the predetermined period including a period in which the communication known to be abnormal occurs. Among the generation systems, the generation system is characterized in that data related to communication generated during a period other than a period in which communication known to be abnormal is acquired is acquired as the first data . A generation method performed by a computer
Identify whether the first data related to communication that occurred in a predetermined period on a host connected to the network, the second data related to abnormal communication generated for testing, and the data related to communication are data related to abnormal communication. Abnormal communication identification rule to be performed, acquisition process to acquire, and
A generation step of generating a normal communication identification rule for identifying whether or not the data related to communication is data related to normal communication so as to identify the first data from the data related to normal communication.
Among the rules included in the abnormal communication identification rule, a deletion step of deleting the rule for identifying the first data as data related to abnormal communication from the abnormal communication identification rule, and
Among the second data, an additional step of adding a rule for identifying data identified as data related to normal communication by the normal communication identification rule to data related to abnormal communication to the abnormal communication identification rule, and
Only including,
The first abnormal communication detection system that detects abnormal communication using the abnormal communication identification rule and the second abnormal communication detection system that detects abnormal communication using the normal communication identification rule are multi-layered. When the multi-layered abnormal communication detection system detects the communication known to be normal as abnormal communication, the acquisition step is performed in the predetermined period including the period in which the communication known to be normal occurs. A generation method characterized in that data relating to the generated communication is acquired as the first data . A generation method performed by a computer
Identify whether the first data related to communication that occurred in a predetermined period on a host connected to the network, the second data related to abnormal communication generated for testing, and the data related to communication are data related to abnormal communication. Abnormal communication identification rule to be performed, acquisition process to acquire, and
A generation step of generating a normal communication identification rule for identifying whether or not the data related to communication is data related to normal communication so as to identify the first data from the data related to normal communication.
Among the rules included in the abnormal communication identification rule, a deletion step of deleting the rule for identifying the first data as data related to abnormal communication from the abnormal communication identification rule, and
Among the second data, an additional step of adding a rule for identifying data identified as data related to normal communication by the normal communication identification rule to data related to abnormal communication to the abnormal communication identification rule, and
Including
The first abnormal communication detection system that detects abnormal communication using the abnormal communication identification rule and the second abnormal communication detection system that detects abnormal communication using the normal communication identification rule are multi-layered. When the multi-layered abnormal communication detection system detects a communication known to be abnormal as a non-abnormal communication, the acquisition step is performed in the predetermined period including a period in which the communication known to be abnormal occurs. Among the generation methods, the generation method is characterized in that data relating to communication generated in a period other than the period in which communication known to be abnormal is generated is acquired as the first data. On the computer
Identify whether the first data related to communication that occurred in a predetermined period on a host connected to the network, the second data related to abnormal communication generated for testing, and the data related to communication are data related to abnormal communication. Abnormal communication identification rule to acquire, acquisition step to acquire,
A generation step of generating a normal communication identification rule for identifying whether or not the data related to communication is data related to normal communication so as to identify the first data from the data related to normal communication.
Among the rules included in the abnormal communication identification rule, a deletion step of deleting the rule that identifies the first data as data related to abnormal communication from the abnormal communication identification rule, and
Among the second data, an additional step of adding a rule for identifying data identified as data related to normal communication by the normal communication identification rule as data related to abnormal communication to the abnormal communication identification rule, and
To execute ,
The first abnormal communication detection system that detects abnormal communication using the abnormal communication identification rule and the second abnormal communication detection system that detects abnormal communication using the normal communication identification rule are multi-layered. When the multi-layered abnormal communication detection system detects communication known to be normal as abnormal communication, the acquisition step is performed during the predetermined period including the period during which the communication known to be normal occurs. A generation program characterized by acquiring data related to generated communication as the first data . On the computer
Identify whether the first data related to communication that occurred in a predetermined period on a host connected to the network, the second data related to abnormal communication generated for testing, and the data related to communication are data related to abnormal communication. Abnormal communication identification rule to acquire, acquisition step to acquire,
A generation step of generating a normal communication identification rule for identifying whether or not the data related to communication is data related to normal communication so as to identify the first data from the data related to normal communication.
Among the rules included in the abnormal communication identification rule, a deletion step of deleting the rule that identifies the first data as data related to abnormal communication from the abnormal communication identification rule, and
Among the second data, an additional step of adding a rule for identifying data identified as data related to normal communication by the normal communication identification rule as data related to abnormal communication to the abnormal communication identification rule, and
To execute,
The first abnormal communication detection system that detects abnormal communication using the abnormal communication identification rule and the second abnormal communication detection system that detects abnormal communication using the normal communication identification rule are multi-layered. When the multi-layered abnormal communication detection system detects a communication known to be abnormal as a non-abnormal communication, the acquisition step is the predetermined period including a period during which the communication known to be abnormal has occurred. Among the generation programs, the generation program is characterized by acquiring data related to communication generated in a period excluding the period in which communication known to be abnormal occurs as the first data.

Images