JP7005278B2 - Abnormal log detection device, abnormal log detection method and program - Google Patents

Description

The present invention relates to a technique for detecting an abnormality log due to a malicious program.

In order to detect malicious programs such as so-called malware, there is known a method of executing malware in a virtual network environment that can be connected to a real network and grasping the behavior caused by the malware (for example, non-patent documents). See 1).

Kazushi Aoki, Makoto Iwamura, Mitsuyasu Ito, "Proposal of Dynamic Analysis Method for Bots Using Semipermeable Virtual Network", IEICE 2008 General Conference, March 18, 2008

As a technique for detecting the infection of this kind of malicious program, there is a technique of collating the communication log accumulated in the proxy server device or the like with the detection pattern of the communication log peculiar to the malicious program infection. However, this detection pattern is difficult to create unless it is an expert who is familiar with programming, and there is a problem that it takes a long time such as two weeks to create it. Further, this detection pattern is created by obtaining information on an attack by a malicious program when it is published on, for example, a WEB site, but it takes a certain amount of time to publish or obtain this attack information. Further, regarding a malicious program targeting a specific organization, there is also a problem that the attack information is not disclosed and the organization itself must detect the attack by the malicious program.

The present invention has been made in consideration of such circumstances, and an object of the present invention is to detect an abnormality log due to a malicious program without depending on a conventional detection pattern.

In order to solve the above problems, the present invention comprises a division unit that divides a plurality of communication logs into communication log groups according to a predetermined standard, and a feature amount extraction unit that extracts the feature amount of each of the divided communication log groups. An abnormality log detection unit that extracts an abnormality log for each communication log group based on the extracted feature amount is provided , and the abnormality log detection unit performs compression processing on each communication log group and performs compression processing on each of the communication log groups. Provided is an abnormality log detection device characterized in that an error between the communication log group and data obtained by performing compression processing on the communication log group is calculated and the abnormality log is extracted based on the calculated error .

A feature amount storage unit for storing information including an analysis viewpoint of the feature amount, an analysis target of the feature amount, a notation method of the feature amount, and a number of dimensions of the feature amount is provided, and the feature amount extraction unit is the feature amount. Based on the information stored in the storage unit, the feature amount of the communication log group represented by a multidimensional matrix is extracted, and the abnormality log detection unit dimensionally reduces the feature amount as the compression process. The compression process may be performed.

Further, the present invention has a division unit that divides a plurality of communication logs into communication log groups according to a predetermined standard, a feature amount extraction unit that extracts the feature amount of each of the divided communication log groups, and the extracted feature amount extraction unit. An abnormality log detection unit that extracts an abnormality log for each communication log group based on the feature amount is provided, and the feature amount extraction unit is specified in relation to each communication log included in the divided 1 communication log group. Provided is an abnormality log detection device characterized by extracting a feature amount to be obtained.

Further, the present invention includes a division unit that divides a plurality of communication logs into communication log groups according to a predetermined standard, a feature amount extraction unit that extracts the feature amount of each of the divided communication log groups, and the extracted above. It is equipped with an anomaly log detection unit that extracts anomalies logs for each communication log group based on the feature amount, and among a plurality of communication devices to be monitored for communication logs, the destination to which the communication device equal to or higher than the threshold communicates is In some cases, the present invention provides an abnormality log detection device characterized by excluding a communication log including the destination from the detection target of the abnormality log.

Among the communication logs including the same source, the division unit divides one or a plurality of communication logs whose time interval between the generation dates and times of consecutive communication logs is less than the threshold value into one communication log group. May be good.

Further, the present invention has been extracted by a division step of dividing a plurality of communication logs into communication log groups according to a predetermined standard, and a feature amount extraction step of extracting the feature amount of each of the divided communication log groups. An abnormality log detection step for extracting an abnormality log for each communication log group based on the feature amount is provided , and in the abnormality log detection step, each communication log group is compressed.
, And the error between each communication log group and the data obtained by compressing the communication log group is calculated, and the abnormality log is extracted based on the calculated error. Provide a method.
Further, the present invention has a division step of dividing a plurality of communication logs into communication log groups according to a predetermined standard, a feature amount extraction step of extracting the feature amount of each of the divided communication log groups, and the extracted feature amount extraction step. An abnormality log detection step for extracting an abnormality log for each communication log group based on a feature amount is provided, and in the feature amount extraction step, it is specified in relation to each communication log included in the divided 1 communication log group. Provided is an abnormality log detection method characterized by extracting a feature amount to be obtained.
Further, the present invention has a division step of dividing a plurality of communication logs into communication log groups according to a predetermined standard, a feature amount extraction step of extracting the feature amount of each of the divided communication log groups, and the extracted feature amount extraction step. It is equipped with an abnormality log detection step that extracts an abnormality log for each communication log group based on the feature amount, and among a plurality of communication devices to be monitored for the communication log, the destination to which the communication device equal to or higher than the threshold communicates is In some cases, an abnormality log detection method is provided, which comprises excluding the communication log including the destination from the detection target of the abnormality log.

The present invention also provides a program for causing a computer to execute the abnormality log detection method described above .

According to the present invention, it is possible to detect an abnormality log due to a malicious program without depending on a conventional detection pattern.

It is a block diagram which shows the hardware composition of the abnormality log detection apparatus which concerns on one Embodiment of this invention. It is a block diagram which shows the functional structure of an abnormality log detection apparatus. It is a figure which shows an example of a communication log. It is a figure which shows the division example of a communication log. It is a figure which illustrates the feature amount of the communication log stored in the feature amount storage part. It is a figure which illustrates the feature amount of the communication log stored in the feature amount storage part. It is a figure which illustrates the feature amount of the communication log stored in the feature amount storage part. It is a figure which illustrates the feature amount of the communication log stored in the feature amount storage part. It is a figure which illustrates the feature amount of the communication log stored in the feature amount storage part. It is a flowchart which shows the procedure of the process which detects an abnormality log. It is a figure which illustrates the feature quantity which pays attention in the feature quantity detection. It is a figure which shows the example which detects the feature quantity from a certain communication log. It is a flowchart which shows the procedure of the process which detects an abnormality log in a modification.

[Embodiment]
[Constitution]
FIG. 1 is a diagram showing a hardware configuration of an abnormality log detection device 10 according to an embodiment of the present invention. The abnormality log detection device 10 is realized by a computer. The abnormality log detection device 10 is connected to a gateway facility that relays data between an open network such as the Internet and a closed network such as an in-house LAN (Local Area Network).

As shown in FIG. 1, the abnormality log detection device 10 includes at least a control unit 11, a communication unit 12, and a storage unit 13. The control unit 11 includes an arithmetic unit such as a CPU (Central Processing Unit) and a storage device such as a ROM (Read Only Memory) and a RAM (Random Access Memory). The ROM stores programs and various data used by the CPU. The communication unit 12 is an interface for communicating with another computer (communication device). The storage unit 13 is a large-capacity storage means such as a hard disk, and stores programs and various data used by the CPU. The CPU realizes various functions shown in FIG. 2 by expanding a program or data stored in a ROM or a storage unit 13 into a RAM and performing processing according to the procedure described in the program.

FIG. 2 is a block diagram showing a functional configuration of the abnormality log detection device 10. The abnormality log detection device 10 includes a session division unit 111, a feature amount extraction unit 112, a feature amount storage unit 113, a compression processing unit 114, an error calculation unit 115, an abnormality determination unit 116, an erroneous detection log storage unit 118, and an erroneous detection log exclusion unit. It has a function called unit 119. All of these functions are realized by the control unit 11 performing processing according to the procedure described in the program. These functions mainly use so-called unsupervised learning to detect abnormal logs at the time of malicious program infection from a huge amount of communication logs. The false detection log extraction process 117 shown in FIG. 2 is not an essential configuration for the abnormality log detection device 10, but represents, for example, a process (work) performed by an expert who is familiar with programming.

Communication logs related to communication between a computer (communication device) included in a closed network and a computer (communication device) included in an open network are, for example, a proxy server device, a DSN (Domain Name System) server device, and a firewall server. It is stored in a server device group such as a device or a mail server device, and is further collected and stored in a log server device from those server device groups.

Here, FIG. 3 is a diagram showing an example of a communication log. The information for one line in FIG. 3 is one communication log corresponding to one communication (access). In the example of FIG. 3, each communication log has "time", "source IP", and "method". , "Url", "Status Code", "UserAgent" and "Send Data Size". However, the log related to communication is not limited to the example of FIG. 3, and can include all the logs that can be acquired as a communication log such as "referrer".

The session division unit 111 acquires a plurality of communication logs from the log server device 20 and divides them into a communication log group called a session according to a predetermined standard. The session dividing unit 111 does not acquire the communication log from the log server device 20, but directly acquires the communication log from the server device group such as the proxy server device described above without going through the log server device 20. You may.

The session referred to here is one unit divided according to the criteria regarding the generation date and time of the communication log. This session includes one or more communication logs, and the abnormality log is detected in this session as a unit. Regarding the session division, more specifically, among the communication logs including the addresses of the same source computers included in the closed network, the communication logs in which the time interval between the occurrence dates and times of the temporally continuous communication logs is less than the threshold value. The group is included in one session. For example, when the threshold value is set to 30 seconds, all the communication log groups of the communication performed without a period of 30 seconds before and after are included in one session. Further, the communication log of the communication performed with a period of 30 seconds before and after is treated as one session even if it is one communication. In many cases, it cannot be estimated as an abnormal log at the time of infection by an unauthorized program just by observing each communication log, but as in the present embodiment, when observing a unit of a plurality of communication logs called a session, the abnormal log is observed. It is more likely that it can be estimated.

FIG. 4 is a diagram showing an example of dividing the communication log. Here, an example is shown in which the communication log shown in FIG. 3 is divided when the threshold value is set to 30 seconds. As shown in the figure, No. The communication log of No. 1 is the No. 1 generated next. Since the communication log of 2 and the period of 30 seconds or more are free, it is divided as one session S1. In addition, No. 2-No. The communication log of No. 7 is a communication log including the same source IP, and the time interval between the generation dates and times of the time-consecutive communication logs is within 30 seconds, and No. There are 8 communication logs and a period of 30 seconds or more. Therefore, these No. 2-No. The communication log of 7 is divided as one session S2. Similarly, No. The communication log of No. 8 is the previous No. Since the communication log of 7 and the period of 30 seconds or more are free, it is divided as one session S3.

The feature amount extraction unit 112 extracts the feature amount of the communication log based on the predetermined feature amount information for each divided session. The feature amount of the communication log referred to here is a known feature amount that has already been confirmed to be useful in detecting malicious programs, as well as a processing load when detecting malicious programs, although it is highly possible that it is useful. It includes features that have not been adopted so far in consideration of the above, features that are unclear whether they are useful or not, and the like.

Here, FIGS. 5 to 9 are diagrams illustrating information regarding the feature amount of the communication log stored in the feature amount storage unit 113. Here, the number of feature quantities of the communication log used for the abnormality log detection in the abnormality log detection device 10 is expressed as "the number of dimensions". The feature amount is represented by the total number of dimensions of all the feature amounts. Features are represented by a matrix of dimensions. In the feature amount storage unit 113, a "name" which is an identifier of the feature amount, a "feature type" which classifies the feature amount into types from three viewpoints, an "analysis viewpoint" of the feature amount, and an "analysis target" of the feature amount, "Explanation about analysis", "notation method of feature amount", and "number of dimensions" of feature amount are stored in association with each other to explain the analysis contents of feature amount. The notation method of the feature amount defines whether the feature amount is represented only by a value of 0/1 or a non-negative integer value. When the feature quantity has a plurality of dimensions, a plurality of items are predetermined for the feature quantity. For example, No. In the case of the feature amount of "17", which is the "browser version", the number of dimensions is 30. This is a communication log in the item group corresponding to each of the 30 browser name and version sets, specifically, in the 30 item groups such as "BrowserA ver50, BrowserA ver51, BrowserB ver8, BrowserB ver9 ..., etc." The value "1" is written in the item of the browser name and the version corresponding to, and the value "0" is written in the item of the other browser name and the version. Each item such as "analysis viewpoint", "analysis target", and "number of dimensions" of the feature amount is defined in advance by the user and stored in the feature amount storage unit 113. The feature amount extraction unit 112 extracts the feature amount of each communication log group (session) based on the information stored in the feature amount storage unit 113. It should be noted that the feature quantity is not limited to a matrix, but may be represented by a notation method representing another dimension.

In FIG. 5, for example, No. The name of the feature amount of "1" is "direct_ip_ratio". Here, since it is rare for a user to directly specify the IP address itself as the destination computer in normal communication, communication in which the destination is directly specified by the IP address in the communication log included in one session. The ratio of logs is set as a feature amount. Since this feature amount is a feature amount specified when observed in session units corresponding to the divided communication log group, the feature type is "feature amount obtained from one session".

On the other hand, for example, No. The feature amount of "38" is the IP address and port of the destination computer in the open network. Since this is a feature amount that can be specified when observing only one communication, the feature type is "feature amount obtained from one communication".

Also, for example, No. The feature amount of "5" is a file extension at the end of a URL (Uniform Resource Locator) that specifies a destination computer. From the viewpoint that this corresponds to the substantive content of communication, the feature type is "feature amount obtained from one session" and "feature amount in the substantive content of communication". The "feature amount in the actual content of communication" is, more specifically, a feature amount based on the size or character string of the data to be communicated.

Among the features illustrated in FIGS. 5 to 9, for example, No. 1 is considered to be useful as a feature in a session. It is a feature amount related to communication with an IP address as a destination in a session, such as "1", "2", and "3" (particularly, the ratio of directly specifying the IP address of NO. "1"). This is because, as described above, in most of the normal communication, the communication in which the domain is specified is observed, whereas in the case of infection with a malicious program, the communication with the IP address as the transmission destination is often observed.

In addition, as a feature quantity considered to be useful in a session, for example, No. There are also features such as "7", "8", and "9" related to communication in which the destination port is directly specified in the session (particularly, the ratio in which the port of No. "9" is directly specified). This is also because communication that directly specifies the destination port is often observed when the amount of malicious program infection is high.

In addition, as a feature quantity considered to be useful in a session, for example, No. There is also a feature amount related to the average length of the parameter values (arguments) in the URL in the session, such as "11". This is also because when an unauthorized program is infected, communication with extremely short parameters continues, or vice versa.

In addition, as a feature quantity considered to be useful in a session, for example, No. There are also features related to the appearance of specific methods (especially POST) in the session, such as "22", "23", "24". This is because it is observed that information is repeatedly and repeatedly transmitted to the outside (from a closed network to an open network) by POST when an unauthorized program is infected.

Returning to the description of FIG. The error log detection unit 101 is configured by the compression processing unit 114, the error calculation unit 115, the abnormality determination unit 116, the erroneous detection log storage unit 118, and the erroneous detection log exclusion unit 119. The abnormality log detection unit 101 has a function of detecting a communication log group (session) having a feature amount different from that of other communication log groups (session) as an abnormality log based on the feature amount extracted by the feature amount extraction unit 112. be. More specifically, when the feature amount of each communication log group (session) is extracted by the feature amount extraction unit 112, the compression processing unit 114 with respect to the feature amount of each extracted communication log group (session). Performs compression processing such as dimension reduction. The error calculation unit 115 calculates an error between the feature amount before the compression process and the feature amount after the compression process for each communication log group (session). When the vector X expressing the D-dimensional features is reduced to the D'dimensional vector X'(D> D'), and the transformation matrix is A, it is expressed by the formula X'= A · X. However, the error here corresponds to the distance between the vector X'and the vector X. By performing such compression processing and error calculation processing for each of the divided communication log groups (sessions), the feature amount for each communication log group (session), the feature amount after the compression processing, and these The error between them will be required. The abnormality determination unit 116 refers to the error obtained for each communication log group (session), and outputs the communication log group (session) whose error is equal to or greater than the threshold value as the first abnormality log. The threshold value used by the abnormality determination unit 116 may be predetermined, or may be dynamically determined such that the lower limit of 5% is set as the threshold value based on the error of each communication log group (session).

It cannot be denied that the first abnormality log may include a log that is erroneously detected as being caused by an infection of a malicious program even though the communication is normal. Therefore, after the work of extracting the false positive log from the first abnormal log by a programming expert or the like (false positive log extraction process 117), the first abnormal log determined to be false positive is the false positive log storage unit 118. Is remembered in. The false positive log exclusion unit 119 performs so-called supervised learning based on the false positive log stored in the false positive log storage unit 118. Then, the false detection log exclusion unit 119 excludes the communication log group (session) including the false detection log from the first abnormal log according to the learning result, and excludes the false detection log from the first abnormal log. The communication log group (session) is output as the second error log.

[motion]
The outline of the operation of the abnormality log detection device 10 will be described with reference to the flowchart shown in FIG. In FIG. 10, first, the session dividing unit 111 acquires a plurality of communication logs from the log server device 20 (step S11), and divides them into sessions according to the above-mentioned criteria regarding the generation date and time of the communication log (step S12). .. Next, the feature amount extraction unit 112 extracts the feature amount of the communication log in each divided session according to the contents stored in advance in the feature amount storage unit 113 (step S13).

Here, an example in which a feature amount is detected from a certain communication log group (session) by paying attention to the information on the feature amount shown in FIG. 11 will be described with reference to FIG. The number of dimensions of the feature quantity shown in FIG. 11 is "8". Of the five communication logs shown in FIG. 12, No. The communication log of No. 2 is No. 11 in FIG. 1 It corresponds to the feature amount "direct_ip_ratio", that is, the direct hitting of the IP address. Since this feature amount is expressed as a ratio (number of dimensions 1, non-negative integer value) in the communication log group included in the session (see FIG. 5), it is expressed as 1/5 = "0.2". In addition, No. 2 The feature amount "direct_ip_flag", that is, the presence or absence of an IP address is expressed as "1" which means "existence" in "0/1".

The average value of the transmission data sizes of the five communication logs shown in FIG. 12 (feature amount of No. 3 “send_size_mean”) is (1000 + 100,000 + 100,000 + 100,000 + 1000) / 5 = 60040. When this is expressed as a non-negative integer value as the number of dimensions 1, it becomes "60040".

Further, the methods used in the five communication logs shown in FIG. 12 include GET and CONNECT. No. 4 In the feature amount "method_flag", the notation order of the methods is predetermined, and here, it is "GET, CONNECT, POST, PUT, HEAD". Therefore, the feature amount of presence / absence of the appearance of the method is expressed in the matrix format of "1,1,0,0,0". The feature amount extracted based on the information regarding the feature amount in FIG. 11 is an 8-dimensional matrix “0.2,1,600,400,1,1,0,0,0”.

The compression processing unit 114 performs compression processing such as dimension reduction described above for each of the divided communication log groups, and associates the communication log group with the corresponding compressed feature amount (step S14). The error calculation unit 115 calculates an error between the feature amount of the divided communication log group and the compressed feature amount of the communication log group for each of the communication log groups, and corresponds to each communication log group. The feature amount after compression is associated with the calculated error (step S15). The abnormality determination unit 116 extracts an error exceeding a predetermined threshold value based on each calculated error, and outputs a communication log group associated with the error as a first abnormality log (step S16). Then, the erroneous detection log exclusion unit 119 excludes what is presumed to be a erroneous detection log from the first abnormality log and outputs it as a second abnormality log (step S17).

[effect]
According to this embodiment, by using unsupervised learning that does not depend on attack information by a known malicious program, it is possible to detect an abnormal log due to the malicious program from a huge amount of communication logs. Further, since the false detection log is excluded by using supervised learning, the possibility of falsely detecting the normal communication log as an abnormal log can be reduced. As a result, it is possible to significantly reduce the labor and time involved in detecting malicious programs.

Furthermore, according to the experiments by the present inventors, it was difficult to detect by the mechanism using the conventional detection pattern, so-called C & C communication (illegal control of sending a command to a group of computers infected with malware and turned into bots). It turned out that the communication performed below) can be detected.

[Modification example]
The above-described embodiment can be modified as follows. Moreover, the following modification examples may be carried out in combination with each other.
[Modification 1]
Abnormal log detection based on error calculation before and after compression processing as described in the embodiment is not always essential. For example, the compression processing unit 114 performs compression processing such as dimension reduction on the feature amount of each communication log group (session) extracted by the feature amount extraction unit 112, and this modification replaces the abnormality determination unit 116 according to the embodiment. The outlier extraction unit of the example performs, for example, LOF (Local Outlier Factor) processing based on the feature amount after compression, and outputs the communication log group (session) corresponding to the feature amount corresponding to the outlier value as an abnormal log. You may try to do it. However, the abnormality log detection based on the error calculation before and after the compression processing as described in the embodiment has the advantages that the abnormality log detection rate is higher and the processing load is smaller than the case where the above LOF processing is performed. ..

FIG. 13 is a flowchart showing a processing procedure of the information processing apparatus according to this modification. In FIG. 13, the same reference numerals are given to the processes common to those in FIG. The information processing apparatus according to this modification is the same as the embodiment in terms of hardware, but functionally includes an outlier extraction unit instead of the abnormality determination unit 116. In FIG. 13, first, the session dividing unit 111 acquires a plurality of communication logs from the log server device 20 (step S11), and divides them into a communication log group (session) (step S12). Next, the feature amount extraction unit 112 extracts the feature amount of the communication log in each of the divided communication log groups according to the contents stored in advance in the feature amount storage unit 113 (step S21). The compression processing unit 114 performs compression processing such as dimension reduction for the feature amount represented by the multidimensional matrix extracted by the feature amount extraction unit 112 (step S14). The outlier extraction unit analyzes the feature amount after compression using LOF, extracts the outliers, and outputs the communication log group corresponding to the outliers as the first abnormality log (step S22). Then, the erroneous detection log exclusion unit 119 excludes what is presumed to be a erroneous detection log from the first abnormality log and outputs it as a second abnormality log (step S17).

It should be noted that the process of excluding the erroneous detection log from the first abnormality log as described in the embodiment and the above modification and outputting the second abnormality log is not essential, and only the first abnormality log may be output. However, according to the experiments by the present inventors, it is better to exclude the false detection log from the first abnormal log and output the second abnormal log, as compared with the case of outputting the first abnormal log. It is known that it can be reduced by 10%.

As described above, in short, the abnormality log detection unit 101 may extract the abnormality log based on the feature amount extracted for each communication log group (session).

[Modification 2]
When the abnormality log detection unit 101 has a transmission destination with which a computer (communication device) having a threshold value or higher among a plurality of computers (communication devices) to be monitored in the communication log communicates with each other, the abnormality log detection unit 101 determines the address of the transmission destination. The included communication log may be excluded from the detection target of the abnormality log. This is because, for example, the communication log including the domain of the destination to which the computer (communication device) having communication with the threshold value (for example, 5 units) or more included in the closed network to be monitored may be the communication due to the malicious program infection. This is due to the idea that the sex is small. From the viewpoint of reducing the processing load, the timing for excluding such communication logs is preferably before the session division described in the embodiment, but is not limited to this, and is not limited to this, for example, between the session division and the feature amount extraction process. It may be between the feature amount extraction and the abnormality log detection process.

[Modification 3]
The feature quantities of the communication logs shown in FIGS. 3 to 9 are merely examples, and are not limited to the contents shown.

[Modification 4]
The present invention can be implemented not only in the form of an abnormality log detection device, but also in the form of a detection method performed by the abnormality log detection device or a program for making a computer function as an abnormality log detection device. This program may be provided to the computer in the form of being recorded on a recording medium such as an optical disk, or may be provided to the computer via a network such as the Internet.

10 ... Abnormal log detection device, 11 ... Control unit, 12 ... Communication unit, 13 ... Storage unit, 101 ... Abnormal log detection unit, 111 ... Session division unit, 112 ... -Feature amount extraction unit, 113 ... Feature amount storage unit, 114 ... Compression processing unit, 115 ... Error calculation unit, 116 ... Abnormality determination unit, 117 ... False detection log extraction processing, 118 ... False detection log storage unit, 119 ... False detection log exclusion unit, 20 ... Log server device.

Claims (9)

A partition that divides multiple communication logs into communication log groups according to a predetermined standard,
A feature amount extraction unit that extracts the feature amount of each of the divided communication log groups, and a feature amount extraction unit.
It is provided with an abnormality log detection unit that extracts an abnormality log for each communication log group based on the extracted feature amount .
The abnormality log detection unit is
Each of the communication log groups is compressed and processed.
The error between each communication log group and the data obtained by compressing the communication log group is calculated.
Extract the abnormality log based on the calculated error.
An abnormality log detection device characterized by this. It is provided with a feature amount storage unit for storing information including the analysis viewpoint of the feature amount, the analysis target of the feature amount, the notation method of the feature amount, and the number of dimensions of the feature amount.
The feature amount extraction unit extracts the feature amount of the communication log group represented by a multidimensional matrix based on the information stored in the feature amount storage unit.
The abnormality log detection device according to claim 1 , wherein the abnormality log detection unit performs, as the compression process, a compression process for reducing the dimension of the feature amount. A partition that divides multiple communication logs into communication log groups according to a predetermined standard,
A feature amount extraction unit that extracts the feature amount of each of the divided communication log groups, and a feature amount extraction unit.
It is provided with an abnormality log detection unit that extracts an abnormality log for each communication log group based on the extracted feature amount.
The feature amount extraction unit is an abnormality log detection device characterized by extracting feature amounts specified in relation to each communication log included in one of the divided communication log groups. A partition that divides multiple communication logs into communication log groups according to a predetermined standard,
A feature amount extraction unit that extracts the feature amount of each of the divided communication log groups, and a feature amount extraction unit.
It is provided with an abnormality log detection unit that extracts an abnormality log for each communication log group based on the extracted feature amount.
If there is a destination that has communicated with a communication device that exceeds the threshold value among multiple communication devices that are to be monitored for communication logs, the communication log that includes that destination is excluded from the detection target of the error log. Characteristic anomaly log detector. Among the communication logs including the same source, the division unit divides one or a plurality of communication logs whose time interval between the generation dates and times of consecutive communication logs is less than the threshold value as one communication log group. The abnormality log detection device according to claim 4 . A division step that divides multiple communication logs into communication log groups according to predetermined criteria, and
A feature amount extraction step for extracting the feature amount of each of the divided communication log groups, and
It is provided with an abnormality log detection step of extracting an abnormality log for each communication log group based on the extracted feature amount .
In the abnormality log detection step
Each of the communication log groups is compressed and processed.
The error between each communication log group and the data obtained by compressing the communication log group is calculated.
Extract the abnormality log based on the calculated error.
Anomalous log detection method characterized by this. A division step that divides multiple communication logs into communication log groups according to predetermined criteria, and
A feature amount extraction step for extracting the feature amount of each of the divided communication log groups, and
It is provided with an abnormality log detection step of extracting an abnormality log for each communication log group based on the extracted feature amount.
In the feature amount extraction step, the feature amount specified in the relationship of each communication log included in the divided 1 communication log group is extracted.
Anomalous log detection method characterized by this. A division step that divides multiple communication logs into communication log groups according to predetermined criteria, and
A feature amount extraction step for extracting the feature amount of each of the divided communication log groups, and
It is provided with an abnormality log detection step of extracting an abnormality log for each communication log group based on the extracted feature amount.
If there is a destination with which a communication device equal to or higher than the threshold value communicates among multiple communication devices to be monitored in the communication log, the communication log including the destination is excluded from the detection target of the abnormality log.
Anomalous log detection method characterized by this. A program for causing a computer to execute the abnormality log detection method according to any one of claims 6 to 8 .

Images