JP6902211B2 - Event monitoring system, terminal device, monitoring server, event monitoring method and program - Google Patents

Description

The present invention relates to an event monitoring system, a terminal device, a monitoring server, an event monitoring method and a program .

A monitoring server that monitors an event that occurs in a terminal device and detects an abnormality in the terminal device is known. A plurality of terminal devices are connected to the monitoring server via a network, and each terminal device is provided with a function for collecting event information. Each terminal device sends event information to the monitoring server, and the monitoring server records the event information from each terminal device as log information.

In Patent Document 1, when recording new log information, if the content of the new log information has the same content as the content of the log information recorded most recently, the new log information is recorded in a predetermined abbreviation format. The technology is disclosed. As a result, the amount of recorded log information data can be suppressed.

Japanese Unexamined Patent Publication No. 2013-257744

However, in Patent Document 1, since the recording format of new log information is determined based on the comparison with the latest log information, if the same or similar log information is not continuous, the amount of data is determined. It becomes difficult to suppress.

The present invention has been made in view of the above problems, and provides an event monitoring system, a terminal device, a monitoring server, an event monitoring method and a program capable of efficiently suppressing the amount of event information data. With the goal.

According to one aspect of the present invention, the event monitoring system includes a terminal device and a monitoring server that monitors an event that occurs in the terminal device, and the terminal device collects event information related to the event. A plurality of units, a grouping unit that compresses a series of event information based on an event pattern, and an event transmission unit that transmits the event information to the monitoring server, and the monitoring server is a plurality of units received from the terminal device. a pattern extraction unit for extracting the event pattern based on the event information, the event monitoring system according to claim Rukoto a pattern transmitting unit that transmits the event pattern to the terminal device is provided.

According to another aspect of the present invention, it is a terminal device used in an event monitoring system including a terminal device and a monitoring server that monitors an event that occurs in the terminal device, and is an event that collects event information related to the event. The monitoring server includes a collecting unit, a grouping unit that compresses a series of the event information based on the event pattern, and an event transmitting unit that transmits the event information to the monitoring server, and the monitoring server is received from the terminal device. a pattern extraction unit for extracting the event pattern based on the plurality of the event information, the terminal device according to claim Rukoto a pattern transmitting unit that transmits the event pattern to the terminal device is provided.

According to another aspect of the present invention, it is a monitoring server for monitoring an event generated in a terminal device, and the terminal device is an event collecting unit that collects event information related to the event, and a series based on an event pattern. The monitoring server includes a grouping unit that compresses the event information, and an event transmission unit that transmits the event information to the monitoring server, and the monitoring server is based on the plurality of event information received from the terminal device. a pattern extraction unit for extracting an event pattern, the monitoring server, wherein Rukoto a pattern transmitting unit that transmits the event pattern to the terminal device is provided.

According to another aspect of the present invention, a terminal device, a event monitoring method in an event monitoring system comprising a monitoring server for monitoring the events occurring on the terminal device, the terminal device, the event information on the event a step of collecting, said terminal device, and a step of compressing a sequence of the event information based on event pattern, the terminal device, and transmitting the event information to the monitoring server, the monitoring server, the Event monitoring is characterized by comprising a step of extracting the event pattern based on a plurality of the event information received from the terminal device, and a step of the monitoring server transmitting the event pattern to the terminal device. A method is provided.

According to another aspect of the present invention, it is a program for performing event monitoring in an event monitoring system including a terminal device and a monitoring server that monitors an event generated in the terminal device, and the terminal device is the said. a step of collecting event information about an event, comprising: said terminal device, and a step of compressing a sequence of the event information based on event pattern, the terminal device, for transmitting the event information to the monitoring server, the monitoring The server causes the computer to execute a step of extracting the event pattern based on the plurality of event information received from the terminal device and a step of the monitoring server transmitting the event pattern to the terminal device. A program characterized by this is provided.

According to the present invention, an event monitoring system, a terminal device, a monitoring server, an event monitoring method and a program capable of efficiently suppressing the amount of event information data are provided.

It is a block diagram of the event monitoring system which concerns on 1st Embodiment. It is a block diagram which shows the hardware configuration of the terminal apparatus and the monitoring server which concerns on 1st Embodiment. It is a conceptual diagram which shows the operation of the process which concerns on 1st Embodiment. It is a figure for demonstrating event information which concerns on 1st Embodiment. This is an example of compression of event information according to the first embodiment. This is an example of complementing the event information according to the first embodiment. It is a flowchart which shows the process of the terminal apparatus which concerns on 1st Embodiment. It is a flowchart which shows the process of the monitoring server which concerns on 1st Embodiment. It is a block diagram of the monitoring server which concerns on 2nd Embodiment. It is a flowchart which shows the process of the monitoring server which concerns on 2nd Embodiment. It is a schematic block diagram of the event monitoring system which concerns on 3rd Embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[First Embodiment]
FIG. 1 is a block diagram of the event monitoring system according to the first embodiment. The event monitoring system 1 includes a terminal device 10 and a monitoring server 20. The terminal device 10 constitutes a monitored system 11 to be monitored by the monitoring server 20. The terminal device 10 is, for example, a personal computer used by the user, a host computer of the monitoring target system 11, and communicates with the monitoring server 20 and another terminal device 10 via the network 30. The terminal device 10 may communicate with another terminal device 10 via the local network in the monitored system 11. Further, the number of terminal devices 10 is not limited.

An agent program capable of collecting process-level event information is installed in the terminal device 10 in advance. The agent program collects information (event information) about an event generated in the terminal device 10 and transmits the event information 40 to the monitoring server 20. The monitoring server 20 detects an abnormality in the terminal device 10 based on the event information 40 from the agent program. For example, the monitoring server 20 can detect that a malicious program has been executed on the terminal device 10 due to a cyber attack, a computer virus, or the like. The network 30 is a communication network such as an in-house LAN (Local Area Network), and connects the terminal device 10 and the monitoring server 20 to each other.

The terminal device 10 includes an event collecting unit 101, an event buffer 102, a grouping unit 103, an event transmitting unit 104, a pattern receiving unit 105, and a pattern storage unit 106. The event collecting unit 101 detects the operation of the process generated by the OS (Operating System) of the terminal device 10, and outputs the information for each operation to the event buffer 102 as event information. The event buffer 102 temporarily stores event information from the event collecting unit 101.

The grouping unit 103 groups the collected event information based on the event pattern stored in advance in the pattern storage unit 106. Specifically, the grouping unit 103 extracts a series of event information from the plurality of event information stored in the event buffer 102, and collates the extracted event information pattern with the event pattern. Here, the series of event information is, for example, a plurality of event information related to one process. When the pattern of a series of event information matches the event pattern, the grouping unit 103 groups the series of event information. Further, the grouping unit 103 compresses the grouped event information according to the compression rule corresponding to the event pattern. For example, the grouping unit 103 can replace a plurality of event information with one event information.

Further, the grouping unit 103 can supplement the event information that the event collecting unit 101 failed to collect based on the event pattern. For example, the grouping unit 103 can generate event information missing in the series of event information so that the pattern indicated by the series of event information matches the event pattern.

The event transmission unit 104 transmits the event information grouped by the grouping unit 103 to the monitoring server 20. The event transmission unit 104 also transmits event information that has not been grouped by the grouping unit 103 to the monitoring server 20. The pattern receiving unit 105 receives the event pattern and the compression rule from the monitoring server 20. The event pattern and the compression rule are stored in the pattern storage unit 106.

The monitoring server 20 includes an event receiving unit 201, an event storage unit 202, an abnormality detection unit 203, a pattern extraction unit 204, a pattern registration unit 205, and a pattern transmission unit 206. The event receiving unit 201 receives event information from the terminal device 10. The event information is stored in the event storage unit 202.

The abnormality detection unit 203 detects an abnormality in the terminal device 10 based on a plurality of event information stored in the event storage unit 202. The abnormality detection unit 203 has an operation model that models the operation of the terminal device 10 in a normal state, and by comparing the current operation of the terminal device 10 grasped from the event information with the operation model, the terminal device 10 It is possible to determine whether or not there is an abnormality in the current operation of.

For example, a process started by an application program for e-mail (hereinafter referred to as a mail process) is usually limited in the folders and file types to be accessed, such as a mailbox and a mail file. When the mail process performs an unusual operation such as reading a password file, the abnormality detection unit 203 detects the operation as an abnormality. The motion model can be built in advance by machine learning or the like. The method of detecting an abnormality by the abnormality detecting unit 203 is not particularly limited.

The pattern extraction unit 204 extracts an event pattern from the event information stored in the event storage unit 202. The event pattern is represented as a series of operations of a process, such as file open, file read, ..., File read, file close, and so on. When the pattern extraction unit 204 discovers a new event pattern that is not registered in the pattern registration unit 205, the pattern extraction unit 204 registers the new event pattern in the pattern registration unit 205.

Further, the pattern extraction unit 204 generates a compression rule corresponding to each event pattern. Compression rules are used to compress grouped event information. The extraction of the event pattern and the generation of the compression rule are performed periodically or at an arbitrary timing, and a new event pattern and the compression rule are added to the pattern registration unit 205.

The pattern registration unit 205 stores various event patterns and compression rules extracted by the pattern extraction unit 204. When a new event pattern and compression rule are registered in the pattern registration unit 205, the pattern transmission unit 206 transmits the new event pattern and compression rule to the terminal device 10.

FIG. 2 is a block diagram showing a hardware configuration of a terminal device and a monitoring server according to the present embodiment. Since the terminal device 10 and the monitoring server 20 may have the same hardware configuration, the terminal device 10 will be described here as an example.

The terminal device 10 includes a CPU (Central Processing Unit) 111, a ROM (Read Only Memory) 112, a RAM (Random Access Memory) 113, a communication I / F (Interface) 114, a storage device 115, an input device 116, a display 117, and a storage device. It is equipped with an I / F 118. The CPU 111 realizes the functions of each part of the terminal device 10 by reading a predetermined program such as an agent program from the ROM 112 and executing the program. The ROM 112 is composed of a non-volatile memory and stores a basic program such as an OS, an application program (hereinafter referred to as an application), and the like. The RAM 113 is composed of a volatile memory and provides a memory area necessary for the operation of the CPU 111.

The communication I / F 114 is, for example, a communication interface based on the Ethernet (registered trademark) standard, and is connected to the network 30 via a communication cable. The storage device 115 is a large-capacity storage device such as a hard disk, and stores event information, event patterns, compression rules, and the like. The input device 116 is an input device such as a keyboard and a mouse and is operated by the user. The display 117 is, for example, a liquid crystal display, and displays an OS, a GUI (Graphical User Interface) provided by an application, and the like. The storage I / F 118 is detachably connected to a portable storage medium such as an optical disk or a USB (Universal Serial Bus) memory.

FIG. 3 is a conceptual diagram showing the operation of the process according to the present embodiment. In the terminal device 10, when the application is started by the user account, the OS creates a plurality of processes. These processes are associated with user accounts and applications. Each process launches one or more processes. Also, each process accesses one or more files. Also, each process accesses one or more sockets. The process that accessed the socket communicates with another terminal device 10.

FIG. 4 is a diagram for explaining event information according to the present embodiment. As shown in the upper part of FIG. 4, the event information 40 is described using at least the subject of the action, the object of the action, (content) of the action, and the time when the action is performed. The event information 40 is classified into four types: (a) process event, (b) file event, (c) IP channel event, and (d) path event.

A process event is an event in which a process starts another process, the subject and the object are the process, and the content of the operation is the start or end. A file event is an event in which a process accesses a file, the subject is the process, the object is the file, and the content of the action is open, closed, read or write. The event information 40 regarding the file event may include a read amount, a write amount, and the like. An IP channel event is an event in which a process communicates via a socket, the subject is a process, the object is a socket, and the content of the operation is open, closed, send or receive. The event information 40 regarding the IP channel event may include a transmission amount, a reception amount, a destination address, and the like. A path event is an event in which a process accesses a file, the subject is the process, the object is the file, and the content of the action is move or delete. The event information 40 regarding the path event may include a file path before the event occurs, a file path after the event occurs, and the like.

FIG. 5 is an example of compression of event information according to the present embodiment. FIG. 5A shows a series of event information 40a to 40d that matches the event pattern including file open, file read, and file close. The event information 40a to 40d are file events, and include an operation 401, a subject 402, an object 403, and a time 404. The event information 40b and 40c further include a read amount 405. Although the time 404 is represented by hours and minutes in FIG. 5, the time 404 may be represented by hours, minutes, and seconds, or may include a date.

Since the main body 402 and the object 403 are common to the event information 40a to 40d, one event information 40g can be replaced. For example, the operation 401 of the event information 40g is represented by a file open / read / close that summarizes a series of operations of file open, file read, and file close. The time 404 of the event information 40g is represented by the time 404 of the first event information 40a and the last event information 40d in the series of event information 40a to 40d. The read amount 405 of the event information 40 g is represented by the total of the read amounts 405 of the event information 40b and 40c related to the file read in the series of event information 40a to 40d.

The time 404 of the event information 40g may be represented with reference to the time 404 of the first event information 40a. Assuming that the times of event information 40a to 40d and 40g are times 404a to 404d and 404g, respectively, time 404g is the difference between time 404a, time 404a and time 404b, the difference between time 404a and time 404c, and the difference between time 404a and time 404d. Can be represented by.

FIG. 6 is an example of complementing the event information according to the present embodiment. FIG. 6A shows a series of event information 40a to 40c similar to an event pattern consisting of file open, file read, and file close. Although the series of event information 40a to 40c matches the file open and file read portions of the event pattern, the event information 40d corresponding to the file close of the event pattern is missing. In such a case, the missing event information 40d can be complemented so as to match the event pattern. That is, it is possible to complement the missing elements among the elements constituting the event pattern. The number of elements in the event pattern and the number of complemented elements are not limited.

An event pattern can include two paired elements (event pairs). For example, in an event pattern related to a file event, file open and file close are event pairs. In the event pattern related to process events, the process start and process end are event pairs. Similarly, in the event pattern for IP channel events, socket open and socket close are event pairs.

In the example of FIG. 6, the event information 40d regarding the other event pair (file close) is complemented based on one of the event pairs (file open). The subject 402 and the object 403 of the supplemented event information 40d are the same as the subject 402 and the object 403 of the event information 40a to 40c. The time 404 of the event information 40d may be complemented based on the time 404 of the last event information 40c in the series of event information 40a to 40c.

FIG. 7 is a flowchart showing the processing of the terminal device according to the present embodiment. The processing of this flowchart is repeatedly executed in the terminal device 10. First, the pattern receiving unit 105 determines whether or not the event pattern has been received from the monitoring server 20 (step S101). When the event pattern is received (YES in step S101), the pattern receiving unit 105 stores the received event pattern in the pattern storage unit 106 (step S102). The pattern receiving unit 105 also stores the compression rule received together with the event pattern in the pattern storage unit 106. If the event pattern is not received (NO in step S101), the process proceeds to step S103.

The event collecting unit 101 determines whether or not an event has been detected in the terminal device 10 (step S103). When an event is detected (YES in step S103), the event collecting unit 101 generates event information of the detected event and stores it in the event buffer 102 (step S104). If no event is detected (NO in step S103), the process proceeds to step S105.

The grouping unit 103 determines whether or not a series of event information collection is completed based on the event information stored in the event buffer 102 (step S105). For example, the grouping unit 103 extracts the event information common to the subject 402 and the object 403 from the event buffer 102 in the order of time 404, and groups the extracted series of event information. The grouping unit 103 receives the series of event information when a predetermined time (for example, a few minutes) elapses without collecting new event information after the latest event information in the group is collected. Judge that the collection of In the example shown in FIG. 5A, the time when the event information 40d is collected serves as a timekeeping reference. On the other hand, in the example shown in FIG. 6A, the time when the event information 40c is collected serves as a timekeeping reference.

If the collection of a series of event information is not completed (NO in step S105), the event collection process (steps S103 and S104) is repeated. The event collection process may be executed at all times regardless of the determination result in step S105. Further, in step S105, the grouping unit 103 performs a plurality of grouping in parallel.

When the collection of a series of event information is completed (YES in step S105), it is determined whether or not the grouped event information pattern matches the event pattern (step S106). That is, the grouping unit 103 collates the patterns of the grouped event information by using all the event patterns stored in the pattern storage unit 106.

Examples of event patterns include an event pattern consisting of file open, file read, and file close, and an event pattern consisting of file open, file write, and file close. Here, the number of file reads and file writes can be plural. That is, there may be multiple file reads (or file writes) between file open and file close. In addition, examples of other event patterns include an event pattern consisting of a process start and a process end, an event pattern consisting of a socket open, a send (or receive), and a socket close. The event pattern related to the process event may be a hierarchical event pattern corresponding to the parent process and the child process.

When the event information pattern matches the event pattern (YES in step S106), the grouping unit 103 compresses the grouped series of event information according to the compression rule (step S109). For example, as shown in FIG. 5, the grouping unit 103 replaces the four event information 40a to 40d with one event information 40g. The amount of data of the event information 40g is smaller than the total amount of data of the event information 40a to 40d. The event transmission unit 104 transmits the compressed event information to the monitoring server 20 (step S110).

When the event information pattern does not match the event pattern (NO in step S106), the grouping unit 103 determines whether or not the grouped event information pattern is similar to the event pattern (step S107). When the event information pattern is similar to the event pattern (YES in step S107), the grouping unit 103 complements the missing event information in the grouped series of event information (step S108).

For example, as shown in FIG. 6, the grouping unit 103 complements the missing event information 40d with respect to the series of event information 40a to 40c based on the event pair included in the event pattern. That is, the event information 40d regarding the file close is generated by the grouping unit 103 so as to be paired with the event information 40a regarding the file open. If the event information corresponding to the complemented event information is collected after the event information complement processing (step S108), the delayedly collected event information may be discarded.

Subsequently, the grouping unit 103 compresses the complemented series of event information (step S109). The event transmission unit 104 transmits the compressed event information to the monitoring server 20 (step S110).

When the event information pattern is not similar to the event pattern (NO in step S107), the event transmission unit 104 transmits the grouped event information to the monitoring server 20 (step S110). Further, the event transmission unit 104 also transmits the event information that has not been grouped to the monitoring server 20. The event information transmitted from the event transmission unit 104 is deleted from the event buffer 102.

FIG. 8 is a flowchart showing the processing of the monitoring server according to the present embodiment. The processing of this flowchart is repeatedly executed on the monitoring server 20. First, the event receiving unit 201 determines whether or not the event information has been received from the terminal device 10 (step S201). If the event information is not received (NO in step S201), the event receiving unit 201 waits until the event information is received. When the event information is received (YES in step S201), the event receiving unit 201 stores the received event information in the event storage unit 202 (step S202).

The abnormality detection unit 203 detects an abnormality in the terminal device 10 based on the event information stored in the event storage unit 202 (step S203). When the abnormality detection unit 203 detects an abnormality in the terminal device 10, the abnormality detection unit 203 takes measures such as isolating the terminal device 10. The pattern extraction unit 204 learns the pattern of the event information stored in the event storage unit 202, and attempts to extract a new event pattern that is not registered in the pattern registration unit 205. If a new event pattern is not extracted (NO in step S204), the process returns to step S201. When a new event pattern is extracted (YES in step S204), the pattern extraction unit 204 registers the new event pattern in the pattern registration unit 205 (step S205). Further, the pattern extraction unit 204 generates a compression rule corresponding to the event pattern and registers it in the pattern registration unit 205. The pattern transmission unit 206 transmits a new event pattern registered in the pattern registration unit 205 to the terminal device 10 together with the compression rule (step S206).

According to the present embodiment, since the information is compressed in units of a series of event information based on the event pattern, the amount of event information data can be efficiently suppressed. Further, by compressing the event information in the terminal device 10, the amount of communication when transmitting the event information to the monitoring server 20 is reduced, so that the pressure on the communication path can be avoided. Further, since the missing event information can be complemented based on the event pattern, the ability of the terminal device 10 to collect the event information can be improved.

[Second Embodiment]
Subsequently, the event monitoring system according to the second embodiment will be described. The monitoring server 20 of the present embodiment can restore a series of compressed event information. Hereinafter, the points different from those of the first embodiment will be mainly described.

FIG. 9 is a block diagram of the monitoring server according to the present embodiment. The monitoring server 20 includes an event receiving unit 201, an event storage unit 202, an abnormality detection unit 203, a pattern extraction unit 204, a pattern registration unit 205, a pattern transmission unit 206, and an event restoration unit 207. The event restoration unit 207 acquires the compressed event information from the event storage unit 202 based on the compression rule registered in the pattern registration unit 205, and restores a series of event information. The event restoration unit 207 stores the restored series of event information in the event storage unit 202.

FIG. 10 is a flowchart showing the processing of the monitoring server according to the present embodiment. Since the event information reception process and the event information storage process (steps S301 and S302) are the same as those in steps S201 and S202 of the first embodiment, the description thereof will be omitted. In step S303, first, the event restoration unit 207 acquires the compression rule from the pattern registration unit 205. All the compression rules may be acquired, and for example, the compression rules specified by the abnormality detection unit 203 or the user may be acquired. Next, the event restoration unit 207 acquires the compressed event information from the event storage unit 202 based on the compression rule. For example, as shown in FIG. 5B, the event restoration unit 207 acquires 40 g of event information described by using file open / read / close as the operation 401.

The event restoration unit 207 restores a series of event information before compression by performing the reverse processing of the compression rule on the compressed event information. For example, it is possible to restore three event information described by using file open, file read, and file close as operation 401 from one event information described by using file open, read, and close as operation 401. it can. In the example shown in FIG. 5, since the event information 40g does not include all the information of the event information 40b and 40c, the event information 40b and 40c cannot be accurately restored, but a reversible compression rule is applied. By using it, it is possible to perform accurate restoration.

The event restoration unit 207 stores the restored series of event information in the event storage unit 202. The event information of the restoration source may be deleted from the event storage unit 202. Subsequent processes from abnormality detection to event pattern transmission (steps S304 to S307) are the same as steps S203 to S206 of the first embodiment, and thus the description thereof will be omitted.

According to the present embodiment, the event information compressed in the terminal device 10 can be restored in the monitoring server 20, so that the accuracy of abnormality detection can be improved while reducing the amount of communication.

[Third Embodiment]
FIG. 11 is a schematic configuration diagram of the event monitoring system according to the present embodiment. The event monitoring system 1 includes a terminal device 10 and a monitoring server 20 that monitors an event that occurs in the terminal device 10. The terminal device 10 includes an event collection unit 101 that collects event information related to an event, a grouping unit 103 that compresses a series of event information based on an event pattern, and an event transmission unit 104 that transmits event information to the monitoring server 20. Be prepared.

[Other Embodiments]
The present invention is not limited to the above-described embodiment, and can be appropriately modified without departing from the spirit of the present invention. For example, in the above-described embodiment, the event pattern is extracted on the monitoring server 20 side, but the terminal device 10 may be configured to extract the event pattern. It is also possible to apply the present invention to monitoring events related to the operation of an application.

A program (more specifically, a program that causes a computer to execute the processing of the flowcharts of FIGS. 7, 8 and 10) that operates the configuration of the embodiment so as to realize the functions of the above-described embodiment is used as a recording medium. A processing method of recording, reading a program recorded on the recording medium as a code, and executing the program in a computer is also included in the category of each embodiment. That is, a computer-readable recording medium is also included in the scope of each embodiment. Further, not only the recording medium on which the above-mentioned program is recorded but also the program itself is included in each embodiment.

As the recording medium, for example, a floppy (registered trademark) disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a magnetic tape, a non-volatile memory card, or a ROM can be used. Further, not only the program that executes the processing by the program recorded on the recording medium alone, but also the one that operates on the OS and executes the processing in cooperation with the functions of other software and the expansion board is also in each embodiment. It is included in the category of.

Some or all of the above embodiments may also be described, but not limited to:

(Appendix 1)
An event monitoring system including a terminal device and a monitoring server that monitors events that occur in the terminal device.
The terminal device includes an event collecting unit that collects event information related to the event, a grouping unit that compresses a series of the event information based on the event pattern, and an event transmitting unit that transmits the event information to the monitoring server. An event monitoring system characterized by being prepared.

(Appendix 2)
It has an event buffer that temporarily stores the event information.
The event monitoring system according to Appendix 1, wherein the grouping unit discovers the series of event information from a plurality of event information stored in the event buffer.

(Appendix 3)
The monitoring server is characterized by including a pattern extraction unit that extracts the event pattern based on a plurality of the event information received from the terminal device, and a pattern transmission unit that transmits the event pattern to the terminal device. The event monitoring system according to Appendix 1 or 2.

(Appendix 4)
The event monitoring system according to any one of Supplementary note 1 to 3, wherein the pattern indicated by the series of event information matches the event pattern.

(Appendix 5)
Any of Appendix 1 to 3, wherein the grouping unit complements the event information missing in the series of event information so that the pattern indicated by the series of event information matches the event pattern. Event monitoring system described in Crab.

(Appendix 6)
The event monitoring system according to Appendix 5, wherein the event pattern includes an event pair, and the grouping unit complements event information regarding the other of the event pairs based on one of the event pairs.

(Appendix 7)
The event monitoring system according to any one of Supplementary note 1 to 6, wherein the series of event information is related to one process generated by the OS (Operating System) of the terminal device.

(Appendix 8)
The event monitoring system according to any one of Supplementary note 1 to 7, wherein the event information is described using at least the subject of the operation, the object of the operation, the content of the operation, and the time when the operation is performed.

(Appendix 9)
The event monitoring system according to Appendix 8, wherein the subject is a process and the object is any of a process, a file, and a socket.

(Appendix 10)
The event monitoring system according to Appendix 8 or 9, wherein the grouping unit replaces a plurality of the event information common to the subject and the object with one event information.

(Appendix 11)
The event monitoring system according to any one of Supplementary note 1 to 10, wherein the monitoring server restores the compressed series of event information.

(Appendix 12)
A terminal device used in an event monitoring system including a terminal device and a monitoring server that monitors an event that occurs in the terminal device.
It is characterized by including an event collecting unit that collects event information related to the event, a grouping unit that compresses a series of the event information based on the event pattern, and an event transmitting unit that transmits the event information to the monitoring server. Terminal device.

(Appendix 13)
A monitoring server for monitoring events that occur in terminal devices.
The terminal device includes an event collecting unit that collects event information related to the event, a grouping unit that compresses a series of the event information based on the event pattern, and an event transmitting unit that transmits the event information to the monitoring server. A monitoring server characterized by being equipped.

(Appendix 14)
An event monitoring method in an event monitoring system including a terminal device and a monitoring server that monitors an event that occurs in the terminal device.
A step in which the terminal device collects event information related to the event, a step in which the terminal device compresses a series of the event information based on the event pattern, and a step in which the terminal device transmits the event information to the monitoring server. An event monitoring method characterized by providing.

(Appendix 15)
A recording medium in which a program for monitoring an event in an event monitoring system including a terminal device and a monitoring server for monitoring an event generated in the terminal device is recorded.
Computer,
As the terminal device including an event collecting unit that collects event information related to the event, a grouping unit that compresses a series of the event information based on the event pattern, and an event transmitting unit that transmits the event information to the monitoring server. A recording medium on which a program characterized by functioning is recorded.

This application claims priority on the basis of Japanese application Japanese Patent Application No. 2017-146748 filed on July 28, 2017 and incorporates all of its disclosures herein.

1 Event monitoring system 10 Terminal device 11 Monitoring target system 20 Monitoring server 30 Network 40 Event information 101 Event collection unit 102 Event buffer 103 Grouping unit 104 Event transmission unit 105 Pattern reception unit 106 Pattern storage unit 111 CPU
112 ROM
113 RAM
114 Communication I / F
115 Storage device 116 Input device 117 Display 118 Storage I / F
201 Event reception unit 202 Event storage unit 203 Anomaly detection unit 204 Pattern extraction unit 205 Pattern registration unit 206 Pattern transmission unit 207 Event restoration unit 401 Operation 402 Subject 403 Object 404 Time 405 Read amount

Claims (14)

An event monitoring system including a terminal device and a monitoring server that monitors events that occur in the terminal device.
The terminal device includes an event collecting unit that collects event information related to the event, a grouping unit that compresses a series of the event information based on the event pattern, and an event transmitting unit that transmits the event information to the monitoring server. Prepare ,
The monitoring server includes a pattern extraction unit for extracting the event pattern based on the plurality of the event information received from the terminal device, the Rukoto a pattern transmitting unit that transmits the event pattern to the terminal device A featured event monitoring system. It has an event buffer that temporarily stores the event information.
The event monitoring system according to claim 1, wherein the grouping unit discovers the series of event information from a plurality of event information stored in the event buffer. The event monitoring system according to claim 1 or 2 , wherein the pattern indicated by the series of event information matches the event pattern. The grouping unit according to claim 1 or 2 , wherein the grouping unit complements the event information missing in the series of event information so that the pattern indicated by the series of event information matches the event pattern. The event monitoring system described. The event monitoring system according to claim 4 , wherein the event pattern includes an event pair, and the grouping unit complements event information regarding the other of the event pairs based on one of the event pairs. The event monitoring system according to any one of claims 1 to 5 , wherein the series of event information is related to one process generated by an OS (Operating System) of the terminal device. The event according to any one of claims 1 to 6 , wherein the event information is described using at least the subject of the action, the object of the action, the content of the action, and the time when the action is performed. Monitoring system. The event monitoring system according to claim 7 , wherein the subject is a process, and the object is any of a process, a file, and a socket. The event monitoring system according to claim 7 or 8 , wherein the grouping unit replaces a plurality of the event information common to the subject and the object with one event information. The event monitoring system according to any one of claims 1 to 9 , wherein the monitoring server restores the compressed series of event information. A terminal device used in an event monitoring system including a terminal device and a monitoring server that monitors an event that occurs in the terminal device.
It includes an event collecting unit that collects event information related to the event, a grouping unit that compresses a series of the event information based on the event pattern, and an event transmitting unit that transmits the event information to the monitoring server .
The monitoring server includes a pattern extraction unit for extracting the event pattern based on the plurality of the event information received from the terminal device, the Rukoto a pattern transmitting unit that transmits the event pattern to the terminal device Characteristic terminal device. A monitoring server for monitoring events that occur in terminal devices.
The terminal device includes an event collecting unit that collects event information related to the event, a grouping unit that compresses a series of the event information based on the event pattern, and an event transmitting unit that transmits the event information to the monitoring server. Prepare ,
The monitoring server includes a pattern extraction unit for extracting the event pattern based on the plurality of the event information received from the terminal device, the Rukoto a pattern transmitting unit that transmits the event pattern to the terminal device A featured monitoring server. An event monitoring method in an event monitoring system including a terminal device and a monitoring server that monitors an event that occurs in the terminal device.
The terminal device includes the steps of collecting event information on the event,
Before SL terminal device, and a step of compressing a sequence of the event information based on event patterns,
Before SL terminal device, and transmitting the event information to the monitoring server,
A step in which the monitoring server extracts the event pattern based on a plurality of the event information received from the terminal device.
A step in which the monitoring server transmits the event pattern to the terminal device,
An event monitoring method characterized by providing. A program for monitoring events in an event monitoring system including a terminal device and a monitoring server that monitors events that occur in the terminal device.
A step in which the terminal device collects event information regarding the event,
A step in which the terminal device compresses a series of the event information based on the event pattern.
A step in which the terminal device transmits the event information to the monitoring server,
A step in which the monitoring server extracts the event pattern based on a plurality of the event information received from the terminal device.
A step in which the monitoring server transmits the event pattern to the terminal device,
A program characterized by having a computer execute.

Images