WO2019043804A1

WO2019043804A1 - Log analysis device, log analysis method, and computer-readable recording medium

Info

Publication number: WO2019043804A1
Application number: PCT/JP2017/031041
Authority: WO
Inventors: 佑典高橋
Original assignee: 日本電気株式会社
Priority date: 2017-08-30
Filing date: 2017-08-30
Publication date: 2019-03-07
Also published as: JP6962374B2; JPWO2019043804A1

Abstract

Provided is a log analysis device which makes it easy to distinguish types of cyber attack, for example, to distinguish between automated and manual attacks. This log analysis device is provided with: an extraction means which extracts attack type related information from a communication log associated with an attack; and a determination means which determines the type of the attack associated with the log, on the basis of the attack type related information and on the basis of determination rules set for each type of attack. The extraction means extracts, as the attack type related information, information relating to time, information relating to data size, and information relating to keyboard input.

Description

Log analyzer, log analysis method and computer readable recording medium

The present invention relates to a log analysis device, a log analysis method, and a computer readable recording medium.

By exploiting a means for operating a remote computer, cyber attacks such as unauthorized access and malware infection may be performed. Examples of means for operating a remote computer include a method of Character User Interface (CUI) such as Telnet (Teletype Network) and SSH (Secure Shell), a Remote Desktop Protocol (RDP), and a Virtual Network (VNC). Methods of Graphical User Interface (GUI) such as Computing) are included. When such a cyber attack is performed, analyzing an attacker's behavior pattern is performed in order to clarify an attacker's purpose and an attack method.

Non-Patent Document 1 classifies the types of commands executed after server intrusion into seven groups and displays the behavior patterns of attackers by representing them as a transition diagram of command groups for unauthorized access using SSH (Secure Shell). Disclose the technology shown.

Non-Patent Document 2 proposes a method for detecting a botnet that exploits IRC (Internet Relay Chat) in comparison with characteristics of a message input when a human uses an IRC message.

Patent Document 1 describes an unauthorized access detection system and the like. Patent Document 2 describes an apparatus and the like for threat detection in a data processing system.

JP, 2016-71384, A Japanese Patent Application Publication No. 2013-503377

As an example of analysis on an attacker's behavior pattern in a cyber attack, it may be determined whether an attack procedure is automated or a manual attack. Then, a technique for easily determining the type of attack is required for the above-described document.

The present invention has been made to solve the above-described problems, and its main object is to provide a log analysis device that facilitates the determination of the type of attack in a cyber attack.

A log analysis device according to one aspect of the present invention extracts extraction means for extracting information related to the type of attack from a log of communication related to the attack, information related to the type of attack, and the type of attack. Determining means for determining the type of attack related to the log based on the determination rule.

In the log analysis method according to one aspect of the present invention, information related to the type of attack is extracted from the log of communication related to the attack, and the information related to the type of attack and the type of attack are determined. Based on the determination rule, the type of attack related to the log is determined.

Further, a computer readable recording medium according to one aspect of the present invention includes, on a computer, a process of extracting information related to the type of attack from a log of communication related to the attack, and information related to the type of attack. And a process of non-temporarily storing a program for executing the process of determining the type of the attack related to the log based on the determination rule corresponding to the type of the attack.

According to the present invention, it is possible to provide a log analysis device that facilitates determination of attack types in cyber attacks.

It is a figure showing a log analysis device in a 1st embodiment of the present invention. It is a figure showing an example of a more detailed composition of a log analysis device in a 1st embodiment of the present invention. It is a figure which shows the example of the information relevant to the classification of attack which is extracted by the extraction part. It is a figure which shows an example of the determination rule used in a determination part. It is a figure which shows the example of the automatic operation definition used in the determination part. It is a figure which shows the example of the manual operation definition used in a determination part. It is a flowchart which shows operation | movement of the log analysis apparatus in the 1st Embodiment of this invention. It is a figure showing a log analysis device in a 2nd embodiment of the present invention. It is a figure showing an example of a more detailed composition of a log analysis device in a 2nd embodiment of the present invention. It is a figure which shows an example of the table which manages the file of the log of communication stored for every classification of attack. It is a flowchart which shows operation | movement of the log analysis apparatus in the 2nd Embodiment of this invention. It is a figure showing the log analysis device in a 3rd embodiment of the present invention. It is a figure showing an example of a more detailed composition of a log analysis device in a 3rd embodiment of the present invention. It is a flowchart which shows operation | movement of the log analysis apparatus in the 3rd Embodiment of this invention. It is a figure which shows the log analyzer in the 4th Embodiment of this invention. It is a figure showing an example of a more detailed composition of a log analysis device in a 4th embodiment of the present invention. It is a flowchart which shows operation | movement of the log analysis apparatus in the 4th Embodiment of this invention. It is a figure which shows the example of the information processing apparatus which implement | achieves the log analysis apparatus etc. in each embodiment of this invention.

Embodiments of the present invention will be described with reference to the accompanying drawings. In each embodiment of the present invention, each component of each device (system) indicates a block of functional units. For example, some or all of the components of each device (system) are realized by any combination of an information processing device 1000 and a program as shown in FIG. 18, for example. The information processing apparatus 1000 includes, for example, the following configuration.

CPU (Central Processing Unit) 1001
ROM (Read Only Memory) 1002
RAM (Random Access Memory) 1003
A program 1004 loaded to the RAM 1003
A storage device 1005 for storing the program 1004
· Drive device 1007 for reading and writing the recording medium 1006
Communication interface 1008 connected to communication network 1009
・ Input / output interface 1010 for data input / output
.Buses 1011 connecting each component
Each component of each device in each embodiment is realized by the CPU 1001 acquiring and executing a program 1004 for realizing these functions. A program 1004 for realizing the function of each component of each device is stored in advance in, for example, the storage device 1005 or the RAM 1003, and read by the CPU 1001 as necessary. The program 1004 may be supplied to the CPU 1001 via the communication network 1009, or may be stored in advance in the recording medium 1006, and the drive device 1007 may read the program and supply it to the CPU 1001.

There are various modifications in the implementation method of each device. For example, each device may be realized by any combination of a separate information processing device 1000 and program for each component. Also, a plurality of components included in each device may be realized by any combination of one information processing device 1000 and a program.

In addition, part or all of each component of each device is realized by a general purpose or special purpose circuit including a processor or the like, or a combination thereof. These may be configured by a single chip or may be configured by a plurality of chips connected via a bus. A part or all of each component of each device may be realized by a combination of the above-described circuits and the like and a program.

When a part or all of each component of each device is realized by a plurality of information processing devices, circuits, etc., the plurality of information processing devices, circuits, etc. may be arranged centrally or distributedly. It is also good. For example, the information processing apparatus, the circuit, and the like may be realized as a form in which each is connected via a communication network, such as a client and server system, a cloud computing system, and the like.

First Embodiment
First, a first embodiment of the present invention will be described. FIG. 1 is a diagram showing a log analysis device 100 in the first embodiment of the present invention.

As shown in FIG. 1, the log analysis device 100 according to the first embodiment of the present invention includes at least an extraction unit 110 and a determination unit 120. The extraction unit 110 extracts information related to the type of attack from the log of communication related to the attack. The determination unit 120 determines the type of attack related to the log based on the information related to the type of attack and the determination rule according to the type of attack.

Further, FIG. 2 shows an example of a more specific configuration of the log analysis device 100. In the example illustrated in FIG. 2, the log analysis device 100 includes a log acquisition unit 101, an output unit 102, and a storage unit 130 in addition to the extraction unit 110 and the determination unit 120. In this configuration, all elements may be realized as one device, or the storage unit 130 and the other elements may be realized by separate devices connected via a communication network.

The log acquisition unit 101 acquires a log of communication to be a target of attack type determination. The output unit 102 outputs the result of the attack type determined by the determination unit 120 and information related to the result. The storage unit 130 mainly stores information necessary for determining the type of attack in the determination unit 120. In the example illustrated in FIG. 2, the storage unit 130 includes a determination rule storage unit 131, an automatic operation definition storage unit 132, and a manual operation definition storage unit 133. The determination rule storage unit 131 stores conditions for determining the type of attack. The automatic operation definition storage unit 132 stores the features related to the attack performed by the automatic operation. The manual operation definition storage unit 133 stores the features related to the attack performed by the manual operation.

Subsequently, each component of the log analysis device 100 will be described.

The log acquisition unit 101 acquires a log of communication to be a target of attack type determination. It is assumed that the log acquired by the log acquisition unit 101 is mainly a log of communication related to an attack. The type of log acquired by the log acquisition unit 101 is not particularly limited, and may be a binary file such as a pcap (packet capture) file or a text file such as a proxy log. Also, the type of attack is not particularly limited, and, for example, a scan attack or an attack for the purpose of unauthorized access is included in an assumed attack.

The extraction unit 110 extracts information related to the type of attack from the log of communication related to the attack. The communication log is, for example, a log acquired by the log acquisition unit 101. The extraction unit 110 extracts information related to the type of attack on a communication session or other predetermined period basis.

When information related to the type of attack is extracted on a session-by-session basis, the source IP (Internet Protocol) address, source port number, destination IP address, destination port can be used to distinguish sessions. Numbers, protocols and other information are used.

Further, the information related to the type of attack includes, for example, information related to time, information related to the size of data, and information related to input from the keyboard. The extraction unit 110 extracts these pieces of information from the log, as an example. The information related to the type of attack is not limited to these, and the extraction unit 110 may acquire other information as information related to the type of attack.

The information related to time includes, for example, response time from the transmission source, arrival interval of packets, and arrival time difference between a certain packet and the preceding packet. In addition, statistical values such as the mean and standard deviation may be obtained as information on time. The information on the size of the data includes, for example, the packet size received in the target session. In addition, statistical values such as the average and standard deviation of packet sizes may be obtained as information regarding time. The information regarding the input from the keyboard includes, for example, the presence or absence of the input of a specific key. However, each of the information on time, the information on size of data, and the information on input from the keyboard may include information other than the information described above.

The extraction unit 110 extracts the above-described information by sequentially referring to the log. The extraction unit 110 may further obtain the above-described statistical value using the extracted information.
When referring to the log, the extraction unit 110 refers to the log by appropriately using a unit corresponding to the type of the log.

When the log is a pcap file, the extraction unit 110 acquires values stored in the pcap header and the header of each protocol layer in order from the top of the file. The extraction unit 110 may also acquire information not recorded in the header, such as the size of a Transmission Control Protocol (TCP) payload or an input from a keyboard. The extraction unit 110 groups the acquired values for each session, and stores the values in the storage unit 130 or other elements as needed, for example, in a format as shown in FIG. 3 described later. When reference is made to the end of the pcap file, the extraction unit 110 may further obtain other information including the average and standard deviation such as the packet arrival interval and the packet size from the information recorded for each session.

FIG. 3 illustrates an example of the information extracted by the extraction unit 110 when the information related to the type of attack is extracted for each session. In FIG. 3, "id" indicates an identification number assigned to each session. “Src_ip” indicates the IP address of the transmission source, and “src_port” indicates the port number of the transmission source. Also, “dst_ip” indicates the IP address of the destination, and “dst_port” indicates the port number of the destination. A specific address or port number may be described in each of “src_ip”, “src_port”, “dst_ip” and “dst_port”. “Type” indicates the type of protocol used in the session. The example shown in FIG. 3 indicates that SSH is used in the session. Also, "keyboard_input" indicates the presence or absence of the input of the indicated key. In the example shown in FIG. 3, the value for the item is "backspace": True. That is, it is shown that the keyboard backspace key input is included.

The number of sessions extracted by the extraction unit 110 is not particularly limited. Further, in the example illustrated in FIG. 3, the number of pieces of information related to the type of attack is not limited for each unit of extraction of a session or the like. That is, in the example shown in FIG. 3, other information such as a statistical value of response time from the transmission source and a packet size may be further included. Depending on the procedure of the determination by the determination unit 120 and the like, at least a part of each of the information listed in FIG. 3 may not be extracted.

The determination unit 120 determines the type of attack related to the log based on the information related to the type of attack extracted by the extraction unit 110 and the determination rule corresponding to the type of attack. Whether the attack related to the log is an automatic attack automatically performed by a script, malware or the like, or a manual attack in which an attacker sequentially executes a procedure for each unit described above Determine

More specifically, the determination unit 120 compares the information related to the type of attack extracted by the extraction unit 110 with the determination rule according to the type of attack, so that the attack related to the log is automatically detected. Determine if it is an attack or a manual attack. The procedure of determination unit 120 will be further described.

FIG. 4 shows an example of the determination rule used by the determination unit 120. The determination rule is stored in advance in the determination rule storage unit 131, for example. The determination unit 120 is not limited to the determination rule stored in advance in the determination rule storage unit 131. For example, the determination may be made using a determination rule appropriately acquired from an external server or another external device.

In the example shown in FIG. 4, “ID” is assigned to each determination rule, and indicates identification information for identifying each determination rule. "Protocol" indicates the type of protocol targeted by each determination rule. “Attack type” indicates the type of attack targeted by each determination rule.
The “rule” indicates a condition to be satisfied in order to determine that the log in which the item “protocol” matches is related to the type of attack indicated in the “attack type”.

That is, the determination rule that "ID" is "R1" can be determined that the log is a log related to an automatic attack when conditions A1 and A2 both hold for the communication log whose protocol is Telnet. Show. Similarly, the determination rule “ID” is “R2” indicates that it is possible to determine that the log is a log related to a manual attack when the condition M2 is satisfied for a communication log whose protocol is SSH.

The details of the rules shown in FIG. 4 are defined as an automatic operation definition or a manual operation definition. FIG. 5 shows an example of the automatic operation definition. Further, FIG. 6 shows an example of the manual operation definition.

Each of the automatic operation definition or the manual operation definition is stored in advance in, for example, the automatic operation definition storage unit 132 or the manual operation definition storage unit 133. The determination unit 120 is not limited to the determination rule stored in advance in the automatic operation definition storage unit 132 or the manual operation definition storage unit 133, and may perform determination using a determination rule appropriately acquired from an external server or the like. Good.

In the example shown in FIG. 5 and FIG. 6, the “identifier” is an identifier for identifying each rule. "Feature" indicates a feature related to the type of attack in the log. "Condition" indicates a condition for a feature for which it is determined that the rule is satisfied.

In each of FIGS. 5 and 6, "response_time" in the "feature" column indicates the response time from the other party designated by the transmission source IP address. Also, "std" indicates the standard deviation, and "mean" indicates the mean. Further, in each of FIG. 5 and FIG. 6, "s" in the "condition" column indicates a second, and "is_true" indicates that the keyboard input specified in the "feature" column is present. That is, when the standard deviation of the response time from the other party designated by the transmission source IP address is less than 5 seconds, it can be determined that the rule A1 shown in FIG. 5 is satisfied.

In the example shown in FIG. 4, one determination rule is set for each protocol. However, a plurality of determination rules may be set for each protocol. The type of protocol is not limited to Telnet or SSH, and may be another protocol. Further, in the example shown in FIG. 4, one determination rule is set for each of the automatic attack and the manual attack. However, multiple decision rules may be set for each of the automatic attack and the manual attack.

Further, the number of conditions is not limited to the illustrated number for each of the automatic operation definition shown in FIG. 4 and the manual operation definition shown in FIG. The conditions are not limited to response time or input from the keyboard. For example, conditions related to packet size or other conditions may be included as conditions shown in FIG. 4 or FIG. By setting many judgment rules or conditions therefor, it is possible to make judgments on more types of attacks.

The process in the case where the determination unit 120 determines the attack type for the information related to the attack type extracted by the extraction unit 110 will be described using the examples illustrated in FIGS. 3 to 6.

Referring to the information shown in FIG. 3 in which the “id” extracted by the extraction unit 110 is “00001”, the “type” is “SSH”. Therefore, the determination unit 120 performs determination by acquiring a rule whose protocol is “SSH” among the determination rules illustrated in FIG. 4. That is, the determination unit 120 determines whether the information shown in FIG. 3 satisfies the rule R2 whose protocol is “SSH” among the determination rules shown in FIG. That is, the determination unit 120 determines whether the rule M2 is satisfied. When the information illustrated in FIG. 3 satisfies the rule M2, the determination unit 120 determines that the attack related to the log that is the extraction source of the information is a manual attack.

Referring to FIG. 6, the rule M2 has the feature "keyboard_input [" backspace "]" and the condition "is_true". That is, it is shown that the rule holds when there is an input of the backspace key of the keyboard. On the other hand, referring to FIG. 3, there is an item “keyboard_input”, and the value for the item is ““ backspace ”: True”. This indicates that the keyboard backspace key input is included as described above. That is, rule M2 holds.

Therefore, in this case, the determination unit 120 determines that the attack related to the log that is the extraction source of the information whose "id" is "00001" is a manual attack.

The output unit 102 outputs the result of the attack type determined by the determination unit 120 and information related to the result. The target of the output by the output unit 102 is not particularly limited, and may be, for example, a console displayed on any display device (not shown) or a file. Further, the result and other information output by the output unit 102 may be all the determined results or may be any one of the results determined as the automatic attack or the manual attack. In addition, the output unit 102 may output other information including the unit when information is extracted by the extraction unit 110, and the extraction criterion. When the attack type is determined on a communication session basis, the output unit 102 combines the determination result with the IP address of the transmission source, the port number of the transmission source, the IP address of the destination, and the port number of the destination. , A protocol, etc. may be output as information related to the result of the determined attack type.

Subsequently, the operation of the log analysis device 100 according to the present embodiment will be described with reference to the flowchart shown in FIG. Note that this operation example assumes that the log analysis device 100 has the configuration shown in FIG.

First, the log acquisition unit 101 acquires a log of communication to be a target of attack type determination (step S101). In this step, the log acquisition unit 101 may acquire a plurality of logs.

Next, the extraction unit 110 extracts, from the communication log acquired in step S101, information related to the type of attack in units of a predetermined period, session, or the like (step S102). When a plurality of logs are acquired in step S101, the operation of step S102 is repeated as appropriate.

Next, the determination unit 120 determines the type of attack based on the information related to the type of attack extracted in step S102 and the determination rule according to the type of attack (step S103). In step S102, when information is extracted for a plurality of periods, sessions, and the like, the process of step S103 is repeated as appropriate.

Next, the output unit 102 outputs information such as the result of the attack type determined in step S103 (step S104).

As described above, the log analysis device 100 according to the present embodiment extracts information related to the type of attack from the log of communication, and relates to the log based on the information and the determination rule corresponding to the type of attack. Determine the type of attack to be made. In the analysis by the log analysis device 100, various types of information can be used as information related to the type of attack, and a plurality of determination rules can be used according to the type of attack.
Therefore, the log analysis device 100 can determine the type of attack regarding the log of communication including attacks of various patterns. Therefore, the log analysis device 100 facilitates the determination of the attack type in the cyber attack.

Second Embodiment
Next, a second embodiment of the present invention will be described. FIG. 8 is a diagram showing a log analysis device 200 in the second embodiment of the present invention.

As shown in FIG. 8, the log analysis device 200 according to the second embodiment of the present invention includes an extraction unit 110, a determination unit 120, and a determination rule generation unit 240. The extraction unit 110 and the determination unit 120 are elements similar to the elements included in the log analysis device 100 in the first embodiment. The determination rule generation unit 240 generates a determination rule based on the communication log for which the type of attack has been determined. That is, the log analysis device 200 differs from the log analysis device 100 in that the log analysis device 200 includes the determination rule generation unit 240.

Further, FIG. 9 shows an example of a more specific configuration of the log analysis device 200. In the example illustrated in FIG. 9, the log analysis device 200 includes a log acquisition unit 101, an output unit 102, and a storage unit 130 in addition to the extraction unit 110, the determination unit 120, and the determination rule generation unit 240. The log acquisition unit 101 and the output unit 102 are elements similar to the elements denoted by the same reference numerals in FIG. Further, in the example illustrated in FIG. 9, the storage unit 130 includes a determination rule storage unit 131, an automatic operation definition storage unit 132, a manual operation definition storage unit 133, and a communication data storage unit 234. Each of the determination rule storage unit 131, the automatic operation definition storage unit 132, and the manual operation definition storage unit 133 is an element similar to the element denoted by the same reference numeral in FIG. The communication data storage unit 234 stores a log of communication related to the attack for which the type of attack has been determined. That is, the example shown in FIG. 9 is different from the specific configuration example of the log analysis device 200 shown in FIG. 2 in that the storage unit 130 further includes the communication data storage unit 234.

Subsequently, each component of the log analysis device 200 will be described. The description of the same elements as the elements included in the above-described log analysis device 100 will be omitted as appropriate.

The determination rule generation unit 240 generates a determination rule based on the communication log for which the type of attack has been determined. Although the determination rule to be generated is expressed, for example, in the format as shown in FIG. 4 to FIG. 6 described above, it is not limited thereto, and may be appropriately determined according to the method of generating the determination rule. The determination unit 120 determines the type of attack based on the determination rule generated by the determination rule generation unit 240 as well as the determination rule prepared in advance.

As an example, the determination rule generation unit 240 generates a determination rule using a method of machine learning. In this case, the determination rule generation unit 240 generates a determination rule using, for example, a method called a random forest.

An example in which the determination rule generation unit 240 generates a determination rule by random forest will be described. In this case, the determination rule generation unit 240 extracts information related to the above-described type of attack from each of the logs determined in advance to be related to the automatic attack or the manual attack. That is, from each of these logs, the determination rule generation unit 240 extracts various types of information including information on time, information on data size, or information on input from a keyboard. The extracted information is represented, for example, as shown in FIG. 3 described above.

Then, the determination rule generation unit 240 generates a plurality of decision trees that classify information related to the type of attack described above into an automatic attack and a manual attack. The number of decision trees to be generated is not particularly limited, and may be appropriately determined according to the amount of extracted information or the like. When the determination rule is generated as described above, the determination unit 120 determines the type of attack based on the generated determination tree. That is, the determination unit 120 determines the type of attack by majority of the classification results of the automatic attack or the manual attack by each of the generated decision trees.

The determination rule generation unit 240 may generate a determination rule based on another machine learning method other than random forest. In addition, the generated determination rule is appropriately stored in each of the determination rule storage unit 131, the automatic operation definition storage unit 132, and the manual operation definition storage unit 133 of the storage unit 130. The determination unit 120 determines the type of attack with reference to the determination rule stored in each element of the storage unit 130.

The communication log used when the determination rule generation unit 240 generates the determination rule is stored, for example, in the communication data storage unit 234 in advance. The communication log stored in the communication data storage unit 234 is a log that is determined to be either an automatic attack or a manual attack. The communication log stored in the communication data storage unit 234 may be a log for which the type of attack has been determined by the determination unit 120. By doing this, the log of the communication whose attack type has been determined by the determination unit 120 based on the highly accurate determination rule can also be used for generation of the determination rule.

In the communication data storage unit 234, communication logs are stored as separate files according to the type of attack. Therefore, the communication data storage unit 234 holds a table for managing files. FIG. 10 shows an example of a table for managing files. In the table as shown in FIG. 10, the attack type and information for identifying the file are described for each of the stored files. A file path or a hash value of a file is used as information for identifying the file.
In the example shown in FIG. 10, the log file relating to the automatic attack is a file specified by <file path>. Also, the log file related to the manual attack is a file specified by <file hash value>.

The determination rule generation unit 240 may generate a determination rule using a log different from the communication log stored in the communication data storage unit 234. For example, the determination rule generation unit 240 may appropriately acquire, from an external server or the like, a log of communication related to an attack whose type is determined in advance from an external server or the like, and create the determination rule using the acquired determination rule.

Next, with reference to a flowchart shown in FIG. 11, an operation related to generation of a determination rule of the log analysis device 200 in the present embodiment will be described. This operation example assumes that the log analysis device 200 has the configuration shown in FIG. The log analysis device 200 extracts information, determines the type of attack, and the like by the same operation as the log analysis device 100.

First, the determination rule generation unit 240 acquires a log of communication used when generating a determination rule (step S201). The determination rule generation unit 240 appropriately refers to the communication data storage unit 234 of the storage unit 130 to acquire a communication log.

Next, the determination rule generation unit 240 generates a determination rule using the communication log acquired in step S201 (step S202).

Next, the determination rule generation unit 240 updates the content of the storage unit 130 so as to store the determination rule generated in step S202 in each element of the storage unit 130 (step S203).

As described above, the log analysis device 200 in the present embodiment further includes the determination rule generation unit 240 that generates the determination rule. By including the determination rule generation unit 240, the determination unit 120 can determine the type of attack using more determination rules. In addition, the determination rule generation unit 240 can generate a determination rule using the log of the communication determined by the determination unit 120. That is, when the machine learning method is used in the determination rule generation unit 240, more data can be used as learning data. Therefore, the log analysis device 200 has the same effect as the log analysis device 100, and enables discrimination of attack types with higher accuracy.

Third Embodiment
Next, a third embodiment of the present invention will be described. FIG. 12 is a diagram showing a log analysis device 300 according to the third embodiment of the present invention.

As shown in FIG. 12, the log analysis device 300 according to the third embodiment of the present invention includes an extraction unit 110, a determination unit 120, a determination rule generation unit 240, a reception unit 350, and a first observation unit 360. Equipped with The extraction unit 110 and the determination unit 120 are elements similar to the elements included in the log analysis device 100 in the first embodiment. The determination rule generation unit 240 is an element similar to the element included in the log analysis device 200 in the second embodiment. The receiving unit 350 receives the communication related to the attack. The first observation unit 360 observes the communication received by the reception unit 350. That is, the log analysis device 300 differs from the log analysis device 200 in that the log analysis device 300 includes the reception unit 350 and the first observation unit 360.

Also, FIG. 13 shows an example of a more specific configuration of the log analysis device 300. In the example illustrated in FIG. 13, the log analysis device 300 includes the log acquisition unit 101 and the output unit 102 in addition to the extraction unit 110, the determination unit 120, the determination rule generation unit 240, the reception unit 350, and the first observation unit 360. And a storage unit 130. The log acquisition unit 101 and the output unit 102 are elements similar to the elements denoted by the same reference numerals in FIG.

Further, in the example illustrated in FIG. 13, the storage unit 130 includes a determination rule storage unit 131, an automatic operation definition storage unit 132, a manual operation definition storage unit 133, a communication data storage unit 234, and an observation data storage unit 335. Have. Each of the determination rule storage unit 131, the automatic operation definition storage unit 132, the manual operation definition storage unit 133, and the communication data storage unit 234 is an element similar to the element to which the same reference numeral is attached in FIG. The observation data storage unit 335 stores the communication log obtained by the first observation unit 360 observing the communication of the reception unit 350.

In the examples shown in FIGS. 12 and 13, a configuration including the determination rule generation unit 240 and the communication data storage unit 234 is shown. However, log analyzer 300 may not include these elements. That is, the log analysis device 300 may be configured to further include at least the reception unit 350 and the first observation unit 360 in addition to the log analysis device 100 in the first embodiment.

Subsequently, each component of the log analysis device 300 will be described. The description of the same elements as the elements included in the log analysis device 100 or the log analysis device 200 described above is appropriately omitted.

The receiving unit 350 receives the communication related to the attack. That is, the receiving unit 350 receives at least a communication transmitted from the outside in association with an attack. The communication related to the attack includes, for example, a scan attack and a communication for the purpose of unauthorized access, but other communication may be included in the communication related to the attack. Also, the receiving unit 350 may be capable of receiving other communications. The receiving unit 350 may be further configured to respond to the received communication.

The receiving unit 350 is realized by a honeypot or the like that emulates Telnet, SSH, or other protocols. Also, the receiving unit 350 may be implemented by any type of computer on which Telnet, SSH, or other services operate. The receiving unit 350 may be realized by other means as long as communication related to the attack can be received.

The first observation unit 360 observes the communication received by the reception unit 350. The first observation unit 360 is realized by, for example, tcpdump, Wireshark or the like, but is not limited thereto. The first observation unit 360 records the observed communication in the above-described pcap file, text file, or other type of log file.

Further, in the present embodiment, the receiving unit 350 may transmit data in response to communication from the outside. However, the data transmitted from the reception unit 350 is generally data that is not related to an external attack. Therefore, the first observation unit 360 excludes the data transmitted from the reception unit 350 and records the data in a log. However, the first observation unit 360 may record data including the data transmitted from the reception unit 350 in a log.

In the present embodiment, the log acquisition unit 101 acquires the log of the communication obtained by the first observation unit 360 observing the communication of the reception unit 350. When the log analysis device 300 includes the storage unit 130, the log acquisition unit 101 may observe the first observation unit 360 and acquire the log stored in the observation data storage unit 335. Such an arrangement makes it possible to quickly determine the type of attack when an attack is made.

Next, with reference to the flowchart shown in FIG. 14, the operations relating mainly to the reception unit 350 and the first observation unit 360 of the log analysis device 300 in the present embodiment will be described. The log analysis device 300 extracts information, determines the type of attack, and the like by the same operation as the log analysis device 100. When the log analysis device 300 includes the determination rule generation unit 240, the determination rule generation unit 240 generates the determination rule by the same operation as the log analysis device 200.

First, the first observation unit 360 starts observation (step S301). The observation by the first observation unit 360 is started prior to the start of reception by the reception unit 350 so that no leakage occurs in the observation of the communication received by the reception unit 350.

Next, the reception unit 350 starts reception of the communication related to the attack (step S302).

Next, processing of the received communication by the reception unit 350 and observation of the communication by the first observation unit 360 are performed (step S303). That is, when the receiving unit 350 receives a packet from the outside, the receiving unit 350 performs processing and response of the packet as necessary. In this case, the first observation unit 360 observes the communication performed by the reception unit 350. The first observation unit 360 may rotate the log file and perform other necessary processing at regular intervals, depending on the amount of communication and other conditions.

As described above, the log analysis device 300 in the present embodiment further includes the reception unit 350 and the first observation unit 360. The reception unit 350 and the first observation unit 360 perform reception and observation of communication regarding an attack. For the communication log related to the observed attack, the type of attack is determined. Therefore, the log analysis device 300 has at least the same effect as the log analysis device 100 in the first embodiment. In addition, the log analysis device 300 enables quick determination of attack type.

Fourth Embodiment
Next, a fourth embodiment of the present invention will be described. FIG. 15 is a diagram showing a log analysis device 400 according to the fourth embodiment of the present invention.

As illustrated in FIG. 15, the log analysis device 400 includes an extraction unit 110, a determination unit 120, a determination rule generation unit 240, a reception unit 350, a first observation unit 360, a malware execution unit 470, and a second And a control unit 490.

The extraction unit 110 and the determination unit 120 are elements similar to the elements included in the log analysis device 100 in the first embodiment. The determination rule generation unit 240 is an element similar to the element included in the log analysis device 200 in the second embodiment. Also, the reception unit 350 and the first observation unit 360 are the same elements as the elements included in the log analysis device 300 in the third embodiment.

The malware execution unit 470 executes the acquired malware. The second observing unit 480 observes the communication by the malware executed in the malware execution unit 470. The control unit 490 controls the operation of the malware execution unit 470 and the second observation unit 480.

Further, FIG. 16 shows an example of a more specific configuration of the log analysis device 400. In the example illustrated in FIG. 16, the log analysis device 400 includes the log acquisition unit 101, the output unit 102, the storage unit 130, and the malware acquisition unit 451, in addition to the above-described elements. Each of the log acquisition unit 101, the output unit 102, and the storage unit 130 is an element similar to an element to which the same reference numeral is attached in each of the first to third embodiments. The malware acquisition unit 451 acquires the malware received by the reception unit 350.

In the examples shown in FIGS. 15 and 16, a configuration including the determination rule generation unit 240 and the communication data storage unit 234 is shown. However, log analyzer 300 may not include these elements.

Subsequently, each component of the log analysis device 400 will be described. The description of the same elements as the elements described in the above-described embodiments will be omitted as appropriate.

The malware acquisition unit 451 acquires the malware received by the reception unit 350. More specifically, the malware acquisition unit 451 detects and acquires malware from the data received by the reception unit 350.

The malware acquisition unit 451 detects malware in the same manner as, for example, general antivirus software. That is, the malware acquisition unit 451 detects and acquires malware based on whether or not the received data matches a previously defined feature. When the receiving unit 350 is not configured to actively communicate with the outside, the malware acquiring unit 451 acquires the transmitted program as all programs transmitted to the receiving unit 350 are malware. It is also good. The acquired malware may be stored together with the identifier in any storage means (not shown).

The malware execution unit 470 executes, for example, the malware acquired by the malware acquisition unit 451. The malware execution unit 470 may execute the malware acquired by means other than the malware acquisition unit 451.

The malware execution unit 470 is implemented in a general environment for executing malware. That is, the malware execution unit 470 is realized by an emulator, a virtual machine, or the like that simulates the operation of the OS (Operating System). The means for realizing the malware execution unit 470 is not limited to the above, but it is preferable that the means resulting from the operation of the malware does not spread to other components or another device. In addition, since malware generally attacks outside, in the malware execution unit 470, access control of communication may be performed so as not to affect the outside. For example, in the malware execution unit 470, control may be performed so as to enable communication only to a specific external server. When controlling access to the outside, the malware execution unit 470 may include a dummy server corresponding to an external server.

The second observing unit 480 observes the communication by the malware executed in the malware execution unit 470. For example, the second observation unit 480 observes communication between an emulator, a virtual machine, and the like, and an external server, a dummy server, and the like. The second observation unit 480 is realized by, for example, a tcpdump command or the like. The second observation unit 480 records the observed communication in the above-described pcap file, text file, and other types of log files. The observed result is appropriately stored in the communication data storage unit 234 together with the information for identifying the malware.

The control unit 490 controls the operation of the malware execution unit 470 and the second observation unit 480. The control unit 490 performs transfer of malware to the malware execution unit 470, execution or stop of the malware by the malware execution unit 470, start or stop of observation by the second observation unit 480, or other necessary control. The control unit 490 may control each operation of the malware acquisition unit 451.

The control unit 490 transfers the malware to the malware execution unit 470 using, for example, a means such as SCP (Secure Copy), SFTP (Secure File Transfer Protocol), or a shared folder. In this case, it is preferable to carry out in a procedure in which security is secured.

Also, as an example, the control unit 490 controls the observation by the second observation unit 480 to be generally performed only while the malware execution unit 470 is executing malware. That is, in this example, the control unit 490 controls the second observation unit 480 to start observation immediately before the malware execution unit 470 starts the execution of the malware. The control unit 490 controls the second observation unit 480 to stop observation immediately after the execution of the malware by the malware execution unit 470 is ended.

The malware execution unit 470 executes the malware, and the second observation unit 480 observes the communication of the malware to obtain a communication log. The obtained communication log is a log on automatic attacks. The determination rule generation unit 240 generates a new determination rule using the communication log obtained in this way. Then, the determination unit 120 further determines the type of attack by further using the generated determination rule. By determining the type of attack using the generated determination rule, the determination unit 120 can improve the accuracy of analysis.

Subsequently, operations related to the malware acquisition unit 451, the malware execution unit 470, and the second observation unit 480 of the log analysis device 400 in the present embodiment will be described with reference to the flowchart illustrated in FIG.

First, the malware acquiring unit 451 acquires malware from the data received by the receiving unit 350 (step S401). In step S401, the malware acquisition unit 451 may operate to acquire only the malware that has not been acquired.

Next, the control unit 490 controls the second observation unit 480 to start observation of communication by malware (step S402). In response to the control, the second observation unit 480 starts observation of communication.

Next, the control unit 490 controls the malware execution unit 470 to execute the malware (step S403). In response to the control, the malware execution unit 470 starts the execution of the malware.

Next, the control unit 490 controls the malware execution unit 470 to stop the execution of the malware (step S404). In response to the control, the malware execution unit 470 stops the execution of the malware.

Next, the control unit 490 controls the second observation unit 480 to stop observation of communication by malware (step S405). In response to the control, the second observation unit 480 stops observation of communication.

Finally, the control unit 490 stores the communication log observed by the second observation unit 480 in the communication data storage unit 234 (step S406).

As described above, the log analysis device 400 according to the present embodiment further includes a configuration for executing the acquired malware and observing the communication by the malware. With such a configuration, the determination rule regarding the automatic attack is further generated based on the log of the communication by the observed malware. Then, the type of attack is determined using the generated determination rule.

Therefore, the log analysis device 400 has at least the same effect as the log analysis device 100 in the first embodiment. Further, the log analysis device 400 enables highly accurate determination of attack type.

Part or all of the present invention may be described as in the following appendices, but is not limited to the following.
(Supplementary Note 1)
Extracting means for extracting information related to the type of the attack from a log of communication related to the attack;
Determining means for determining the type of the attack related to the log based on the information related to the type of the attack and the determination rule according to the type of the attack;
A log analyzer comprising:
(Supplementary Note 2)
The log analysis device according to claim 1, wherein the determination means determines whether the attack is an automatic attack or a manual attack.
(Supplementary Note 3)
The determination means determines that the attack is an automatic attack based on whether the information related to the type of the attack matches the determination rule regarding the automatic attack or the determination rule regarding the manual attack. The log analyzer according to appendix 2, wherein it is determined whether it is a manual attack or a manual attack.
(Supplementary Note 4)
The log according to any one of Appendices 1 to 3, wherein the information related to the type of attack includes one or more of information on time, information on size of data, and information on input from a keyboard Analysis equipment.
(Supplementary Note 5)
Receiving means for receiving communications related to the attack;
First observing means for observing communication received by the receiving means;
The log analyzer according to any one of appendices 1 to 4, comprising:
(Supplementary Note 6)
The determination unit extracts information related to the type of the attack from the log of the communication observed by the first observation unit.
The log analyzer according to appendix 5.
(Appendix 7)
A determination rule generation unit configured to generate the determination rule based on the log of the communication of which the type is determined;
The log analyzer according to any one of appendices 1 to 6, comprising:
(Supplementary Note 8)
Malware execution means for executing malware,
A second observation unit for observing the communication by the malware executed in the malware execution unit;
Control means for controlling the malware execution means and the second observation means;
The log analyzer according to appendix 7, comprising:
(Appendix 9)
The determination rule generation unit generates the determination rule regarding the automatic attack based on the log of the communication observed by the second observation unit.
The log analyzer according to claim 8.
(Supplementary Note 10)
Extract information related to the type of the attack from the log of communication related to the attack,
The type of the attack related to the log is determined based on the information related to the type of the attack and the determination rule according to the type of the attack.
Log analysis method.
(Supplementary Note 11)
On the computer
A process of extracting information related to the type of the attack from a log of communication related to the attack;
A process of determining the type of the attack related to the log based on the information related to the type of the attack and the determination rule according to the type of the attack;
A program that runs

100 log analyzer 110 extraction unit 120 determination unit 101 log acquisition unit 102 output unit 130 storage unit 131 determination rule storage unit 132 automatic operation definition storage unit 133 manual operation definition storage unit 234 communication data storage unit 335 observation data storage unit 240 determination rule Generation unit 350 Reception unit 360 First observation unit 451 Malware acquisition unit 470 Malware execution unit 480 Second observation unit 490 Control unit

Claims

Extracting means for extracting information related to the type of the attack from a log of communication related to the attack;
Determining means for determining the type of the attack related to the log based on the information related to the attack and the determination rule according to the type of the attack;
A log analyzer comprising:
The log analysis device according to claim 1, wherein the determination means determines whether the attack is an automatic attack or a manual attack.
The determination means determines whether the attack is the automatic attack based on whether the information indicating the type of the attack matches the determination rule regarding the automatic attack or the determination rule regarding the manual attack. The log analyzer according to claim 2, wherein it is determined whether it is the manual attack.
The information according to any one of claims 1 to 3, wherein the information related to the type of attack includes one or more of information on time, information on size of data, and information on input from a keyboard. Log analyzer.
Receiving means for receiving communications related to the attack;
First observing means for observing communication received by the receiving means;
The log analyzer according to any one of claims 1 to 4, comprising:
The determination unit extracts information related to the type of the attack from the log of the communication observed by the first observation unit.
The log analyzer according to claim 5.
A determination rule generation unit configured to generate the determination rule based on the log of the communication of which the type is determined;
The log analyzer according to any one of claims 1 to 6, comprising:
Malware execution means for executing malware,
A second observation unit for observing the communication by the malware executed in the malware execution unit;
Control means for controlling the malware execution means and the second observation means;
The log analyzer according to claim 7, comprising:
The determination rule generation unit generates the determination rule regarding an automatic attack based on the log of the communication observed by the second observation unit.
The log analyzer according to claim 8.
Extract information related to the type of the attack from the log of communication related to the attack,
The type of the attack related to the log is determined based on the information related to the type of the attack and the determination rule according to the type of the attack.
Log analysis method.
On the computer
A process of extracting information related to the type of the attack from a log of communication related to the attack;
A process of determining the type of the attack related to the log based on the information related to the type of the attack and the determination rule according to the type of the attack;
A non-transitory computer-readable storage medium storing a program for executing the program.