JP7408530B2 - Security management system and security management method - Google Patents

Description

The present invention relates to a security management system and a security management method.

Patent Document 1 discloses a method of acquiring IoC (Indicator of Compromise), which is an indicator of compromise, from a plurality of security data providers, and using the acquired IoC to detect the existence of a security threat in telemetry data received from a computer system. It is stated that

Patent Document 2 describes an information processing device that has a function of reflecting the evaluation of posts on SNS (Social Networking Service) in the reliability of cyber threat intelligence. When the information processing device acquires information related to cyber attacks (words and phrases related to cyber attacks included in posted information, etc.), the information processing device stores the acquired information in association with reliability based on the source of the information regarding cyber attacks. , upon detecting that posted information corresponding to the information has been uploaded from an information processing terminal, updates the reliability associated with the information regarding the cyber attack according to the reliability of the posted information.

Special Publication No. 2020-503635 JP 2019-101672 Publication

OSINT (Open Source INTelligence) is attracting attention as a security management method for information processing systems. Freshness of information is important in security management, and it is important to keep a wide range of information and irregularly published information obtained from SNS where highly fresh information is exchanged, incident tickets provided by other companies in the same industry, news articles, etc. It is effective to make active use of it.

In Patent Document 1, a violation of a system to be monitored is detected by acquiring an IoC from an external organization that provides the IoC. However, this document does not consider the use of OSINT. Furthermore, when a monitoring target suffers a cyber attack, there is a possibility that a large number of IoCs will be obtained (for example, multiple IP addresses and hash values will be obtained for each destination of malware infection), but in the same document, This method requires a lot of man-hours to correlate whether or not multiple acquired IoCs are caused by the same cyber attack, which places a heavy burden on the analyst.

The technology described in Patent Document 2 utilizes words and phrases related to cyber attacks included in posted information on SNS as information related to cyber attacks. However, information regarding cyberattacks is checked by humans, and many personnel with specialized knowledge and experience are required to extract security information from the vast amount of information obtained.

The present invention has been made based on this background, and provides a security management system and security system that can efficiently and reliably detect security violations by effectively utilizing information obtained from various information sources. The purpose is to provide a management method.

One of the present inventions for achieving the above object is a security management system configured using an information processing device, which includes an IoC information extraction unit that extracts IoC information from security intelligence acquired from an information provider; An IoC attribute assigning unit that assigns an attribute label, which is information indicating the type of the IoC information, to the extracted IoC information; and an IoC attribute assigning unit that assigns an attribute label, which is information indicating the type of the IoC information, to the extracted IoC information; a relevance adding unit that identifies the IoC information based on a label and stores information indicating the identified relationship; a monitoring target log database that manages log information obtained from a security violation monitoring target; A parser that extracts IoC information from log information, adds the attribute label to the extracted IoC information, and generates an analysis target, which is information to be analyzed, based on the IoC information to which the attribute label has been added. a related IoC acquisition unit that acquires other IoC information related to the new IoC information extracted by the IoC information extraction unit based on security intelligence newly acquired from an information provider; an analysis query generation unit that generates a query to be used for searching the analysis target based on the information and the other IoC information, and searching for the analysis target using the query and determining whether there is a security violation based on the search result. and a matching analysis unit that performs analysis and generates an analysis result that is information regarding the result of the analysis.

Other problems disclosed in the present application and methods for solving the problems will be made clear by the detailed description section and the drawings.

According to the present invention, security violations can be efficiently and reliably detected by effectively utilizing information obtained from various information sources.

1 is a diagram showing a schematic configuration of a security management system. 1 is a diagram illustrating an example of a hardware configuration of an information processing device that constitutes a security management system. It is a flowchart explaining main processing. It is a flowchart explaining IoC information generation processing. This is an example of a collection destination management TBL. This is an example of the IoC information TBL. It is a flowchart explaining log information analysis processing. This is an example of an analysis target TBL. This is an example of the analysis rule TBL. This is an example of an analysis result TBL. This is an example of an analysis result notification screen. This is an example of an IoC information inquiry screen.

Embodiments of the present invention will be described below with reference to the drawings. Note that the following description and drawings are examples for explaining the present invention, and are omitted or simplified as appropriate to clarify the explanation. The present invention can also be implemented in various other forms. Unless otherwise specified, each component may be singular or plural.

In the following description, the same or similar components may be given the same reference numerals and redundant descriptions may be omitted. Further, in the following description, various information may be described using expressions such as "information" and "table", but various information may be expressed using data structures other than these. In addition, as expressions of identification information, there are expressions such as "identification information", "identifier", "name", "ID", and "number", but these expressions can be replaced with each other. Furthermore, in the following description, a "database" may be referred to as "DB" and a "table" may be referred to as "TBL".

FIG. 1 shows a schematic configuration (functional block diagram) of an information processing system (hereinafter referred to as "security management system 1") described as an embodiment. As shown in the figure, the security management system 1 includes an intelligence generation device 100, a log analysis device 200, a monitoring target 14, an administrator terminal 15, and a user terminal 16.

The security management system 1 detects whether there is a security violation in the monitored target 14 by acquiring and analyzing various types of log information generated in the monitored target 14. The types of monitoring targets 14 are not particularly limited, but include, for example, information processing devices (server devices, client devices, network devices, etc.) that constitute information communication systems operated by organizations such as companies and government offices, and various types of monitoring targets 14. These are communication devices and IoT devices installed at sites (factories, warehouses, distribution centers, etc.).

The intelligence generation device 100 communicates with a provider (hereinafter referred to as “IoC
provider 11." ), news distribution site 12, SNS 13, and other external organizations to collect security-related information (hereinafter referred to as "security intelligence") such as information related to cyber attacks. Hereinafter, the security intelligence provider will also be referred to as the "information provider".

The intelligence generation device 100 is communicably connected to an administrator terminal 15 and a user terminal 16. The administrator terminal 15 is operated by a user such as an administrator of the security management system 1, for example. Further, the user terminal 16 is operated by a user such as a user of the security management system 1, for example.

The security intelligence collected by the intelligence generation device 100 is used by the log analysis device 200 to analyze log information. Further, the collected security intelligence is provided to the user through an information search service and an information viewing service performed via the user terminal 16.

As shown in the figure, the intelligence generation device 100 includes a crawler management section 101, a crawler section 102, an IoC information extraction section 103, an IoC attribute assignment section 104, a relevance assignment section 105, an IoC information provision section 106, and a collection destination management DB 300. , and a collected data storage DB 400. Details of these functions will be described later.

The log analysis device 200 is communicably connected to the intelligence generation device 100, the monitoring target 14, and the user terminal 16. The log analysis device 200 analyzes whether there is a security violation in the monitored target 14 by matching (contrasting) the information generated by the intelligence generation device 100 based on security intelligence with the log information sent from the monitored target 14. do.

The log analysis device 200 receives information regarding the monitoring target 14 from the user via the user terminal 16. Additionally, the log analysis device 200 provides information such as traces of cyber attacks to the user via the user terminal 16.

As shown in the figure, the log analysis device 200 includes a rule management section 201, a log transfer section 202, a parser section 203, a related IoC acquisition section 204, an analysis rule acquisition section 205, an analysis query generation section 206, a matching analysis section 207, Notification unit 208, monitoring target log DB 500, rule DB 60
0, and result storage DB 700. Details of these functions will be described later.

FIG. 2 is an example of the hardware configuration of the information processing device 20 used to configure the intelligence generation device 100, the log analysis device 200, the administrator terminal 15, and the user terminal 16. The information processing device 20 includes a processor 21 , a main storage device 22 , a communication device 23 , an input device 24 , an output device 25 , and an auxiliary storage device 26 .

Note that the illustrated information processing device 20 is based on virtual information provided using virtualization technology, process space separation technology, etc., such as a virtual server provided by a cloud system, in whole or in part. It may also be realized using processing resources. Further, all or part of the functions provided by the information processing device 20 may be realized by, for example, a service provided by a cloud system via an API (Application Programming Interface) or the like. Further, all or part of the functions provided by the information processing device 20 may be realized using, for example, SaaS (Software as a Service), PaaS (Platform as a Service), IaaS (Infrastructure as a Service), etc. It may be something that

The processor 21 is, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), an AI (Artificial Intelligence) chip, an FPGA (Field Programmable Gate Array), an SoC (System on Chip), or an ASIC. (Application Specific Integrated Circuit) etc.

The main storage device 22 is a device that stores programs and data, and is, for example, a ROM (Read
RAM (Random Access Memory), nonvolatile memory (NVRAM (Non Volatile RAM)), etc.

The communication device 23 communicates with other information processing devices (smartphones, tablets, notebook computers, etc.) via a communication network (LAN (Local Area Network), WAN (Wide Area Network), Internet, leased line, public communication network, etc.). , various mobile information terminals, etc.) and external IoT devices, and is a wireless or wired communication module (wireless communication module, communication network adapter, USB module, etc.).

The input device 24 is a user interface that accepts input from a user or data input from an external device, and is, for example, a keyboard, a mouse, a touch panel, a card reader, a voice input device (for example, a microphone), or the like.

The output device 25 is a display device that outputs various information as an image, an audio output device that outputs audio, a printing device that prints on a paper medium, or the like.

The auxiliary storage device 26 is a device that stores programs and data, and includes, for example, an SSD (Solid State Drive), a hard disk drive, and an optical storage medium (CD (Compact Disc)).
, DVD (Digital Versatile Disc), etc.), IC card, SD card, etc. All or part of the auxiliary storage device 26 may be a virtual storage area provided by a cloud. The auxiliary storage device 26 stores programs and data for realizing the functions of the security management system 1. Programs and data can be read into the auxiliary storage device 26 via the recording medium reading device and the communication device 23. Programs and data stored in the auxiliary storage device 26 are read into the main storage device 22 at any time. The processor 21 implements various functions by reading programs stored in the auxiliary storage device 26 into the main storage device 22 and executing them.

For example, an operating system, a file system, a DBMS (DataBase Management System) (relational database, NoSQL, etc.), a KVS (Key-Value Store), etc. may be installed in the information processing device 20.

FIG. 3 is a flowchart illustrating main processing (hereinafter referred to as "main processing") performed in the security management system 1. The main processing will be explained below with reference to the same figure.

The intelligence generation device 100 collects security intelligence from information providers, and based on the collected security intelligence, generates information (hereinafter referred to as "IoC information TBL 401") that the log analysis device 200 uses when analyzing log information. Perform processing. Hereinafter, the above process will be referred to as "IoC information generation process S1."

When the timing to analyze log information arrives, such as when new log information is acquired from the monitoring target 14 or when there is an instruction from the user via the user terminal 16, the log analysis device 200 analyzes the log information (S2: YES). Performs processing to analyze log information. Hereinafter, the above process will be referred to as "log information analysis process S3."

When the intelligence generation device 100 and the log analysis device 200 receive a viewing request from the user via the user terminal 16 (S4), they transmit the requested information to the user terminal 16, and the user terminal 16 receives the requested information. The information obtained is presented to the user (S5). For example, the intelligence generation device 100 transmits information based on the IoC information TBL 401 to the user terminal 16. Further, the log analysis device 200 transmits information to be notified to the user, such as a report of traces of infringement, to the user terminal 16. Note that the log analysis device 200 may actively transmit information that should be urgently notified to the user, such as a report of traces of infringement, to the user terminal 16 regardless of a viewing request from the user.

In the security management system 1, the above main processing is repeatedly executed, for example, during a period when the monitoring target 14 is being monitored for the presence or absence of a security violation.

FIG. 4 is a flowchart illustrating details of the IoC information generation process S1 shown in FIG. 3. The IoC information generation process S1 will be described below with reference to the same figure.

First, the crawler management unit 101 of the intelligence generation device 100 transmits, via the administrator terminal 15, information regarding the security intelligence information provider, information to be obtained from the information provider, and a method for obtaining information from the information provider. , is received from the user, and the received information is registered in the collection destination management TBL 301 (S11).

FIG. 5 shows an example of the collection destination management TBL 301. As shown in the figure, the illustrated collection destination management TBL 301 includes one or more entries (records) having the following items: registration number 302, registration date 303, information provider 304, confirmation frequency 305, and information type 306. It is configured. One entry in the collection destination management TBL 301 corresponds to one information provider.

Among the above items, the registration number 302 is set to a registration number that is an identifier given to each information provider. The registration date 303 is set to the date (or date and time) when the information on the information provider of the entry was registered. Information indicating the location of the information provider of the entry (for example, details of a resource such as "Ioc.com/list") is set in the information provider 304. In the confirmation frequency 305, information indicating the frequency of acquiring information from the information provider is set. The information type 306 is set with information indicating the format of the information acquired from the information provider. For example, when information in a structural IoC format (hereinafter referred to as "IoC information") is provided, such as security intelligence provided by the IoC provider 11, "IoC" is set in the information type 306. . Furthermore, for example, when information is provided in natural language (unstructured format), such as information provided from the news distribution site 12 or SNS 13, "natural language" is set in the information type 306.

Returning to FIG. 4, in S12, the crawler unit 102 acquires security information from the information provider by accessing (crawling, etc.) the information provider registered in the collection destination management TBL 301 via the communication network 10 (Internet, etc.). Collect.

The subsequent processes of S13 to S16 are performed for each security intelligence acquired from each of the information providers registered in the collection destination management TBL 301.

First, in S13, the IoC information extraction unit 103 extracts IoC information from the security intelligence acquired by the crawler unit 102. For example, when the IoC information extraction unit 103 acquires security intelligence written in an unstructured format written in natural language from the news distribution site 12 or SNS 13, the IoC information extraction unit 103 extracts well-known regular expressions from the acquired security intelligence. For example, "IP address", "URL", "name of threat actor", etc. are extracted as IoC information by applying a unique expression extraction technique. In addition, for example, if the provider of the acquired security intelligence is the IoC provider 11 and the security intelligence is originally written in an IoC format (xml, etc.), the IoC information extraction unit 103 extracts the information as is as IoC information. do.

Next, the IoC attribute adding unit 104 adds an “attribute label” that is information indicating the attributes (IP address, URL, MD5, etc.) of the IoC information to the IoC information extracted by the IoC information extracting unit 103 (S14). . The IoC attribute assigning unit 104 specifies the format of the IoC information (IP address, URL, MD5, etc.) using a method such as regular expression extraction or named entity extraction, and assigns an attribute label (IP, (URL, MD5, etc.) to the IoC information.

Subsequently, the association adding unit 105 associates the IoC information with each other (S15). The association assigning unit 105 performs the association based on the attribute label of the IoC information. For example, if IoC information with duplicate attribute labels exists in the collected data storage DB 400, the association adding unit 105 compares the security intelligence from which each IoC information is extracted, and depending on the result of the comparison, Correlate other IoC information extracted from security intelligence. For example, one of two news articles may contain the URL "URL_a" as IoC information.
” and the IP address “IP_a”, and the other article contains the URL “URL_a” and the IP address “IP_b”, the relevance assignment unit 105 sets the URL “URL_a” in the two news articles. ” are common, the IP address “IP_a” and the IP address “IP_b
” is determined to be “related,” and the related IP address “URL_a” and IP address “IP_b” are given relevance.

Subsequently, the association adding unit 105 registers the IoC information in the IoC information TBL 401 (S16).

FIG. 6 shows an example of the IoC information TBL 401. As shown in the figure, the IoC information TBL 401 is composed of one or more entries (records) having the following items: registration number 402, acquisition date 403, extracted IoC 404, IoC attribute 405, acquisition source 406, and relevance 407. has been done. One entry in the IoC information TBL 401 corresponds to one piece of IoC information.

A registration number that is an identifier of the IoC information is set in the registration number 402. Information indicating the date and time when the IoC information was registered as the IoC information TBL 401 is set in the acquisition date 403. The content of the IoC information (“IP address”, “URL”, “hash value”, “name of threat actor”, etc.) is set in the extracted IoC 404. The IoC attribute 405 is set with an attribute label assigned by the IoC attribute assignment unit 104. In the acquisition source 406, information indicating the acquisition source (information provider) of the IoC information (for example, information indicating the location of the acquisition source of the IoC information) is set. In the relevance 407, the registration number of other IoC information associated with the relevant IoC information is set by the relevance assigning unit 105.

FIG. 7 is a flowchart illustrating the log information analysis process S3 of FIG. The log information analysis process S3 will be described below with reference to the same figure. It is assumed that the log transfer unit 202 of the log analysis device 200 acquires log information from the monitoring target 14 set by the user terminal 16 at any time, and registers the acquired log information in the monitoring target log DB 500 ( Hereinafter, the registered log information will be referred to as "log information 510").

First, the parser unit 203 of the log analysis device 200 generates an analysis target log TBL 501 based on the log information 510, and registers the generated analysis target log TBL 501 in the monitoring target log DB 500 (S31). More specifically, the parser unit 203 first extracts the IoC information included in the log information 510 using techniques such as regular expression extraction and parsing, and adds attributes (hereinafter referred to as , referred to as "log attributes"). Next, the parser unit 203 generates information in which predetermined information of the log information 510 is associated with each extracted IoC information, and the generated information (hereinafter referred to as "analysis target") is stored in the monitoring target log DB 500. Register in the analysis target log TBL 501.

FIG. 8 shows an example of the analysis target log TBL501. As shown in the figure, the analysis target log TBL 501 includes one or more entries (records) having the following items: registration number 502, acquisition date and time 503, log attribute 504, original file name 505, raw data 506, and parse IoC 507. It consists of One entry in the analysis target log TBL 501 corresponds to one analysis target.

Among the above items, the registration number 502 is set to a registration number that is an identifier of the analysis target. The acquisition date and time 503 is set to the date and time when the log information 510 from which the analysis target is extracted is registered. The log attribute 504 is set with information indicating the type of log information 510 from which the analysis target is extracted (hereinafter referred to as "log attribute"). The original file name 505 is set to the file name of the log information 510 from which the analysis target is extracted. The raw data 506 is set with information indicating the portion where the IoC information is described in the log information 510 from which the analysis target is extracted. IoC information extracted by the parser unit 203 from the raw data 506 is set in the parse IoC 507. For example, the parse IoC 507 is set with information (IP address, URL, etc.) added to the IoC information extracted from the raw data 506 according to the type of the analysis target. In this example, the parse IoC 507 includes "source IP" indicating the IP address of the terminal that accessed the monitoring target 14, "destination URL" indicating the URL to which the terminal accessed, and "status" indicating the access status. is set.

Returning to FIG. 7, the rule management unit 201 acquires, for example, information defining rules for analyzing logs of the monitoring target 14 from the user via the user terminal 16, and the acquired information (hereinafter referred to as , referred to as "analysis rule") in the analysis rule TBL 601 of the rule management DB 600 (S32).

FIG. 9 shows an example of the analysis rule TBL 601. As shown in the figure, the analysis rule TBL 601 is composed of one or more entries (records) having the following items: registration number 602, registration date 603, IoC attribute 604, log attribute 605, generated query 606, and score 607. has been done. One entry in the analysis rule TBL 601 corresponds to one analysis rule.

Among the above items, the registration number 602 is set to a registration number that is an identifier of the analysis rule. The registration date 603 is set to the date (or date and time) when the analysis rule was registered in the rule management DB 500. The above-mentioned IoC attribute is set in the IoC attribute 604. The log attributes described above are set in the log attributes 605. A template of a query used to search the analysis target log TBL 501 corresponding to traces of security violation from the monitoring target log DB 500 is set in the generated query 606. The score 607 is set with a degree of risk that is added to the total score value, which will be described later, when traces of a security violation are detected through analysis based on the analysis rule. In this example, it is assumed that the larger the score value, the higher the risk level.

Returning to FIG. 7, the related IoC acquisition unit 204 constantly monitors whether new IoC information is registered in the IoC information TBL 401 (S33). When detecting that new IoC information has been registered in the IoC information TBL 401 (S33: YES), the related IoC acquisition unit 204 retrieves the registered new IoC information and other IoC information related to the new IoC information. (IoC information determined to be related based on the relevance 407 of the IoC information TBL 401) is acquired (S34), and the acquired IoC information (new IoC information and other IoC information) is input to the analysis rule acquisition unit 205.

Next, the analysis rule acquisition unit 205 determines, for each IoC information input from the related IoC acquisition unit 204, whether an analysis rule corresponding to the IoC attribute of the IoC information is registered in the analysis rule TBL 601 ( S35). If an analysis rule corresponding to the IoC attribute is registered in the analysis rule TBL 601 (S35: YES), the analysis rule acquisition unit 205 determines whether the same attribute label as the IoC attribute of the input IoC information is set in the IoC attribute 604. All the analysis rules that are present are extracted from the analysis rule TBL 601, and the extracted analysis rules are input to the analysis query generation unit 206. After that, the process proceeds to S36. On the other hand, if the analysis rule corresponding to the IoC attribute is not extracted from the rule DB 600 (S35: NO), the log information analysis process S3 ends.

In S36, the analysis query generation unit 206 edits the analysis rule generation query 606 (query template) input from the analysis rule acquisition unit 205 to create a query (hereinafter referred to as “analysis template”) to be applied to the monitored log DB 500. query") and inputs the generated analysis query to the matching analysis unit 207.

For example, if the IoC attribute of the IoC information acquired by the related IoC acquisition unit 204 is a specific IP address, the analysis rule acquisition unit 205 sends an analysis query to all analysis rules TBL 601 for which an IP address is set in the IoC attribute 604. Input to the generation unit 206. For example, if the analysis rule TBL 601 has the contents shown in FIG. "ip" included in the generated query 606 "grep [ip(class C)] proxy_log" whose number is "1" is the above specific IP address (IP address of the IoC information acquired by the related IoC acquisition unit 204) An analysis query is generated by assigning to the query template.

Subsequently, the matching analysis unit 207 applies the analysis query input from the analysis query generation unit 206 to the analysis target log TBL 501 of the monitoring target log DB 500 (S37), and searches for the corresponding analysis target (log information).

Next, the matching analysis unit 207 refers to the score 607 set in the analysis rule TBL 601 used to generate the analysis query, and calculates the score 607 of the analysis rule used to search for the analysis object for each searched analysis object. A cumulative value (hereinafter referred to as "score total value") is calculated (S38). Note that if the corresponding log information is not retrieved, the matching analysis unit 207 sets the total score value to zero.

Subsequently, the matching analysis unit 207 registers information including the obtained total score (hereinafter referred to as "analysis result") in the analysis result TBL 701 (S39).

FIG. 10 shows an example of the analysis result TBL 701. The illustrated analysis result TBL 701 is composed of one or more entries (records) having the following items: analysis number 702, analysis date and time 703, suspect terminal 704, trace location 705, analysis result 706, and score 707. One entry in the analysis result TBL 701 corresponds to one analysis result generated at a certain analysis date and time.

The analysis number 702 is set with an analysis number that is an identifier of the analysis result. The analysis date and time 703 is set to the date and time when the matching analysis unit 207 performed an analysis of the analysis result. The suspect terminal 704 is set with information (for example, the IP address of the monitored target 14) that identifies the monitored target 14 (hereinafter referred to as "suspected terminal") that has been confirmed to have a security violation. In the trace location 705, information indicating the location of traces of security violation is set. In the analysis result 706, specific contents of the analysis result (information regarding traces, etc.) are set. The score 707 is set to the total score value.

Returning to FIG. 7, the notification unit 208 then determines whether the total score of the new analysis results registered in the result storage DB 700 is equal to or greater than a preset threshold (S40). If the total score is equal to or greater than the above threshold (S40: YES), the notification unit 208 transmits the analysis result to the user terminal 16 (S41). On the other hand, if the total score value is less than the above threshold (S40: NO), the log information analysis process S3 ends.

In S41, the notification unit 208 generates a screen for notifying analysis results (hereinafter referred to as "analysis result notification screen 900"), and the generated analysis result notification screen 900 is accessed, for example, through an authentication procedure. It is sent to the user terminal 16. The user terminal 16 displays the sent analysis result notification screen 900 and presents it to the user.

FIG. 11 shows an example of an analysis result notification screen 900. As shown in the figure, a mouse pointer 901 is displayed on the illustrated analysis result notification screen 900. The notification unit 208 provides a user interface that accepts mouse operations on the analysis result notification screen 900.

The analysis result notification screen 900 includes a notification area 902 where information about the suspect terminal 704 is displayed, a damage status display area 903 where the contents of the analysis results are displayed, and traces of security violation regarding the suspect terminal 704 are displayed in chronological order. It has a time series display area 904.

In the notification area 902, analysis results (in this example, the date and time when the analysis results were generated and the IP address of the suspected terminal) whose score 707 is equal to or higher than the above-mentioned threshold are displayed. Note that the date and time when the analysis result was generated is, for example, the date and time when traces of security violation were detected. When the user designates a predetermined suspect terminal in the notification area 902, the notification unit 208 displays information regarding the security violation of the suspect terminal in the damage status display area 903. Further, the notification unit 208 extracts IoC information including traces of security violation against the suspect terminal 704 from the analysis target log TBL 501 shown in FIG. It is displayed in the series display area 904.

<IoC information provision function>
The intelligence generation device 100 has a function of presenting IoC information to the user via the user terminal 16. The IoC information providing unit 106 of the intelligence generation device 100 provides the user terminal 16 with a search function for IoC information via, for example, a web page, and provides the user terminal 16 with the search results of the IoC information.

FIG. 12 is an example of a screen (hereinafter referred to as "IoC information inquiry screen 800") displayed on the user terminal 16 when presenting IoC information. As shown in the figure, the illustrated IoC information inquiry screen 800 includes a search area 801 for allowing the user to set search conditions for searching IoC information, a result notification area 802 where search results are displayed, and IoC information It has a detailed notification area 803 in which detailed contents of TBL 401 are displayed.

The search area 801 includes a keyword input field 805, a period specification field 806, an IoC attribute input field 807 for specifying an attribute label in a pull-down list format, and the transmission of information set in each of these input fields to the intelligence generation device 100. It includes a search execution button 808 for instructing.

When the IoC information providing unit 106 receives information input into each of the above input fields from the user terminal 16, it transmits the received information to the intelligence generation device 100. The intelligence generation device 100 searches the IoC information TBL 401 for IoC information corresponding to the sent information, and transmits information based on the searched IoC information to the user terminal 16. The user terminal 16 displays the sent information in the result notification area 802.

In the result notification area 802, for example, other IoC information that is related to the IoC information corresponding to the IoC attribute selected in the IoC attribute input field 807 is displayed. In this example, specific IoC information "APT_AA" that corresponds to the IoC attribute "Actor" specified in the IoC attribute input field 807, multiple pieces of IoC information related to "APT_AA", and related IoC information Each publication date and time “date” and its information provider “source” are displayed in the result notification area 802. Note that if the user does not input anything in the IoC attribute input field 807 in the search area, for example, information listing IoC information corresponding to the input keyword or specified period is displayed in the result notification area 802. .

When the user specifies any of the IoC information displayed in the result notification area 802, the IoC information providing unit 106 generates a correlation diagram 810 expressing the relevance of the specified IoC information, and the generated correlation diagram 810 is displayed in the detailed notification area 803. In the example detailed notification area 803, a list 811 "IoC list" of IoC information included in the correlation diagram 810 and time series information 812 "Timeline" of IoC information specified by the user in the result notification area 802 are displayed. In the illustrated IoC information inquiry screen 800, information regarding security intelligence including IoC information specified by the user and the date and time when the security intelligence was collected by the crawler unit 102 are displayed as time series information 812 "Timeline". .

In this way, the IoC information providing unit 106 generates the correlation diagram 810 that expresses the relevance of the specified IoC information and presents it to the user, so the user can understand one cyber attack and the information derived from that cyber attack. It is possible to visually and efficiently understand relationships with a large amount of IoC information.

As explained in detail above, the security management system 1 of the present embodiment proactively collects a wide range of information obtained from IoC providers, news distribution sites, SNS, etc. and security intelligence (IoC information) issued irregularly. Since the monitoring target 14 is monitored by utilizing the above information, security violations can be efficiently and reliably detected.

In addition, by associating the IoC information extracted from the acquired security intelligence, the security management system 1 expands the range of log information to be analyzed, performs analysis from a wide and appropriate perspective, and calculates the total score. Since the presence or absence of a security violation is determined while grasping the overall picture of a cyber attack, it is possible to accurately and reliably detect the presence or absence of a security violation.

Additionally, the log analysis device 200 generates a query by applying (substituting) the value of the attribute included in the IoC information to an analysis rule (generated query (query template)) corresponding to the attribute label of the IoC information. Since the log information is searched using the above information, traces of security violations against the monitored target 14 can be efficiently and reliably detected.

In addition, when the log analysis device 200 discovers traces of a security violation in the analysis result TBL 701, it notifies the user of the occurrence and contents of the security violation, so even those who do not have specialized knowledge or experience can monitor the It is possible to reliably and quickly grasp the traces of a security violation, and to quickly take an appropriate response to the security violation.

In this way, according to the security management system 1 of the present embodiment, it is possible to efficiently and reliably detect security violations by effectively utilizing information obtained from various information sources.

Although one embodiment of the present invention has been described above, it goes without saying that the present invention is not limited to the above-described embodiment and can be modified in various ways without departing from the gist thereof. For example, the above embodiments have been described in detail to explain the present invention in an easy-to-understand manner, and the present invention is not necessarily limited to having all the configurations described. Furthermore, it is possible to add, delete, or replace some of the configurations of the above embodiments with other configurations.

For example, the security management system 1 may be configured to function as the administrator terminal 15 and the user terminal 16.

Further, in the above embodiment, the notification unit 208 of the log analysis device 200 sends the analysis result notification screen 900 to the user terminal 16 that has accessed it, thereby informing the user of traces of security violations against the monitored target 14. However, for example, the notification unit 208 may notify information about traces of security violation against the monitoring target 14 by e-mail addressed to a preset user e-mail address. In that case, the user who has received the e-mail notification may be able to access the log analysis device 200 via the user terminal 16 and obtain more detailed information about the traces of the security violation.

Part or all of the above-mentioned configurations, functional units, processing units, processing means, etc. may be realized by hardware, for example, by designing an integrated circuit. Furthermore, each of the above configurations, functions, etc. may be realized by software by a processor interpreting and executing a program for realizing each function. Information such as programs, tables, files, etc. that realize each function can be stored in a recording device such as a memory, a hard disk, an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

The arrangements of the various functional units, various processing units, and various databases of each information processing device described above are merely examples. The layout of the various functional units, the various processing units, and the various databases can be changed to an optimal layout from the viewpoint of the performance, processing efficiency, communication efficiency, etc. of the hardware and software included in these devices.

The configuration of the database (schema, etc.) that stores the various types of data described above can be flexibly changed from the viewpoints of efficient use of resources, improvement in processing efficiency, improvement in access efficiency, improvement in search efficiency, etc.

1 security management system, 10 communication network, 11 IoC provider, 12 news distribution site, 13 SNS, 14 monitoring target, 15 administrator terminal, 16 user terminal, 100 intelligence generation device, 101 crawler management section, 102 crawler section, 103 IoC information extraction unit, 104 IoC attribute assignment unit, 105 relevance assignment unit, 106 IoC information provision unit, 200 log analysis device, 201 rule management unit, 202 log transfer unit, 203 parser unit, 204 related IoC acquisition unit, 205 analysis Rule acquisition section, 206 Analysis query generation section, 207 Matching analysis section, 208 Notification section, 300 Collection destination management information, 301 Collection destination management TBL, 400 Collected data storage DB, 401 IoC information TBL, 500 Monitoring target log DB, 501 Analysis Target log TBL, 510 Log information, 600 Rule DB, 601 Analysis rule TBL, 700 Result storage DB, 701 Analysis result TBL, 800 IoC information inquiry screen, 900 Analysis result notification screen

Claims (15)

A security management system configured using an information processing device,
an IoC information extraction unit that extracts IoC information from security intelligence obtained from an information provider;
an IoC attribute adding unit that adds an attribute label, which is information indicating the type of the IoC information, to the extracted IoC information;
a relevance assigning unit that specifies the relevance between the plurality of pieces of IoC information assigned by the IoC attribute assigning unit based on the respective attribute labels, and assigns and stores information indicating the identified association to the IoC information; ,
a monitoring target log database that manages log information obtained from targets to be monitored for security violations;
Extract IoC information from the log information, add the attribute label to the extracted IoC information, and generate an analysis target, which is information to be analyzed, based on the IoC information to which the attribute label has been added. Parser section and
a related IoC acquisition unit that acquires other IoC information related to the new IoC information extracted by the IoC information extraction unit based on security intelligence newly acquired from an information provider;
an analysis query generation unit that generates a query for use in searching for the analysis target based on each of the new IoC information and the other IoC information;
a matching analysis unit that searches for the analysis target using the query, analyzes the presence or absence of a security violation based on the search results, and generates an analysis result that is information regarding the result of the analysis;
Security management system. The security management system according to claim 1,
a rule management database that manages a plurality of analysis rules that are information that defines the query template;
an analysis rule acquisition unit that acquires the analysis rule according to information included in the new IoC information or the other IoC information;
an analysis query generation unit that generates the query by applying information included in the new IoC information or the other IoC information to the analysis rule;
A security management system further equipped with. The security management system according to claim 2,
The analysis rule is prepared for each attribute label,
Further comprising an analysis rule acquisition unit that acquires the analysis rule corresponding to each attribute label for each of the new IoC information and the other IoC information,
The analysis query generation unit generates the query by applying information included in each of the new IoC information and the other IoC information to analysis rules acquired for each of the new IoC information and the other IoC information.
Security management system. The security management system according to claim 2,
When generating the analysis target, the parser section gives the generated analysis target a log attribute that is information indicating an attribute of the log information of the generation source of the analysis target,
The analysis rule is prepared for each attribute label and each log attribute,
Further comprising an analysis rule acquisition unit that acquires the analysis rule corresponding to each of the attribute label and log attribute for each of the new IoC information and the other IoC information,
The analysis query generation unit generates the query by applying information included in each of the new IoC information and the other IoC information to analysis rules acquired for each of the new IoC information and the other IoC information.
Security management system. The security management system according to claim 2,
Each of the plurality of analysis rules managed by the rule management database is attached with a score indicating the degree of risk of security violation,
The matching analysis unit calculates the cumulative value of the score of the analysis rule that is the generation source of the query used to search for the analysis target, and provides information indicating a warning when the cumulative value is equal to or higher than a preset threshold. output,
Security management system. The security management system according to claim 5,
a communication device that communicates with an information processing device operated by a user;
a notification unit that transmits information indicating the warning to the information processing device;
A security management system that further includes: The security management system according to claim 1,
a communication device that communicates with an information processing device operated by a user;
a notification unit that transmits information based on the analysis result to the information processing device using the communication device;
A security management system that further includes: The security management system according to claim 1,
a communication device that communicates with other information processing devices via a communication network;
a crawler unit that acquires the security intelligence from another information processing device that is the information provider by the communication device via the communication network;
A security management system that further includes: The security management system according to claim 8,
a collection destination management database that manages information regarding the information provider;
a crawler management unit that provides a user interface that accepts settings for information regarding the information provider;
further comprising;
The crawler unit acquires the security intelligence from the other information processing device specified by the information regarding the information provider.
Security management system. The security management system according to claim 2,
further comprising a rule management unit that provides a user interface for registering the analysis rule in the rule management database;
Security management system. The security management system according to claim 1,
an IoC information providing unit that provides a user with information regarding the IoC information extracted by the IoC information extraction unit;
A security management system that further includes: The security management system according to claim 11,
The IoC information providing unit generates a diagram representing the relationship between the IoC information and provides the diagram to the user.
Security management system. The information processing device
extracting IoC information from security intelligence obtained from an information provider;
adding an attribute label, which is information indicating the type of the IoC information, to the IoC information;
specifying the relationships between the plurality of pieces of IoC information based on the respective attribute labels, and adding and storing information indicating the specified relationships to the IoC information;
managing log information obtained from a target to be monitored for security breaches in a database;
Extract IoC information from the log information, add the attribute label to the extracted IoC information, and generate an analysis target, which is information to be analyzed, based on the IoC information to which the attribute label has been added. step and
a step of acquiring other IoC information related to the new IoC information extracted based on security intelligence newly acquired from the information provider;
generating a query for use in searching for the analysis target based on each of the new IoC information and the other IoC information;
searching for the analysis target using the query, analyzing whether there is a security violation based on the search results, and generating an analysis result that is information about the result of the analysis;
A security management method to implement. 14. The security management method according to claim 13,
The information processing device
a step of managing a plurality of analysis rules that are information defining a template for the query;
acquiring the analysis rule according to information included in the new IoC information or the other IoC information;
generating the query by applying information contained in the new IoC information or the other IoC information to the analysis rule;
A security management method that further implements. 15. The security management method according to claim 14,
The analysis rule is prepared for each attribute label,
The information processing device
acquiring the analysis rule corresponding to each attribute label for each of the new IoC information and the other IoC information;
generating the query by applying information included in each of the new IoC information and the other IoC information to analysis rules obtained for each;
A security management method that further implements.

Images