JP6962374B2 - Log analyzer, log analysis method and program - Google Patents

Description

The present invention relates to a log analyzer, a log analysis method and a program .

Cyber attacks such as unauthorized access and malware infection may be carried out by abusing the means for operating a computer in a remote location. Means for operating a computer in a remote location include, for example, CUI (Character User Interface) methods such as Telnet (Teletype Network) and SSH (Secure Shell), RDP (Remote Desktop Protocol), and VNC (Virtual Network). A GUI (Graphical User Interface) method such as Computing) is included. When such a cyber attack is carried out, the behavior pattern of the attacker is analyzed in order to clarify the purpose and attack method of the attacker.

Non-Patent Document 1 classifies the types of commands executed after a server intrusion into seven groups for unauthorized access using SSH (Secure Shell), and represents the attacker's behavior pattern as a transition diagram of the command groups. Disclose the techniques shown.

Non-Patent Document 2 proposes a method for detecting a botnet that abuses IRC (Internet Relay Chat) by comparing it with the characteristics of a message input when a human uses an IRC message.

Further, Patent Document 1 describes an unauthorized access detection system and the like. Patent Document 2 describes a device for detecting a threat in a data processing system and the like.

Japanese Unexamined Patent Publication No. 2016-71384 Japanese Patent Application Laid-Open No. 2013-503377

D. Ramsbrock, R. Berthier, and M. Cukier, “Profiling Attacker Behavior Following SSH Compromises,” in 37th Annual IEEE / IFIP International Conference on Dependable Systems and Networks, 2007. DSN ’07, 2007, pp. 119-124. Seiichiro Mizoguchi, “Bot detection method by hierarchical clustering based on mechanical communication behavior model” IPSJ Journal, vol.54, no.3, pp. 1087-1098, Mar. 2013.

As an example of analysis of an attacker's behavior pattern in a cyber attack, it may be determined whether the attack procedure is automated or a manual attack. Then, with respect to the above-mentioned documents, a technique for easily determining the type of attack is required.

The present invention has been made to solve the above problems, and an object of the present invention is to provide a log analysis device that facilitates determination of an attack type in a cyber attack.

The log analyzer according to one aspect of the present invention is an extraction means for extracting information related to the type of attack from the communication log related to the attack, information related to the type of attack, and depending on the type of attack. It is provided with a determination means for determining the type of attack related to the log based on the determination rule.

Further, the log analysis method in one aspect of the present invention extracts information related to the type of attack from the communication log related to the attack, and corresponds to the information related to the type of attack and the type of attack. Determine the type of attack related to the log based on the determination rules.

Further, the program according to one aspect of the present invention is a process of extracting information related to an attack type from a communication log related to an attack to a computer, information related to the attack type, and an attack type. based on the determination rule in accordance with the process of determining the type of serial-related attacks log, Ru is running.

According to the present invention, it is possible to provide a log analysis device that facilitates determination of an attack type in a cyber attack.

It is a figure which shows the log analyzer in 1st Embodiment of this invention. It is a figure which shows the example of the more detailed structure of the log analyzer in 1st Embodiment of this invention. It is a figure which shows the example of the information which is related to the type of an attack extracted by the extraction part. It is a figure which shows an example of the determination rule used in the determination part. It is a figure which shows the example of the automatic operation definition used in the determination part. It is a figure which shows the example of the manual operation definition used in the determination part. It is a flowchart which shows the operation of the log analyzer in 1st Embodiment of this invention. It is a figure which shows the log analyzer in the 2nd Embodiment of this invention. It is a figure which shows the example of the more detailed structure of the log analyzer in the 2nd Embodiment of this invention. It is a figure which shows an example of the table which manages the communication log file stored for each type of attack. It is a flowchart which shows the operation of the log analyzer in 2nd Embodiment of this invention. It is a figure which shows the log analyzer in the 3rd Embodiment of this invention. It is a figure which shows the example of the more detailed structure of the log analyzer in the 3rd Embodiment of this invention. It is a flowchart which shows the operation of the log analyzer in 3rd Embodiment of this invention. It is a figure which shows the log analyzer in the 4th Embodiment of this invention. It is a figure which shows the example of the more detailed structure of the log analyzer in the 4th Embodiment of this invention. It is a flowchart which shows the operation of the log analyzer in 4th Embodiment of this invention. It is a figure which shows the example of the information processing apparatus which realizes the log analysis apparatus and the like in each embodiment of this invention.

Each embodiment of the present invention will be described with reference to the accompanying drawings. In each embodiment of the present invention, each component of each device (system) represents a block of functional units. A part or all of each component of each device (system) is realized by an arbitrary combination of the information processing device 1000 and the program as shown in FIG. 18, for example. The information processing device 1000 includes the following configuration as an example.

-CPU (Central Processing Unit) 1001
-ROM (Read Only Memory) 1002
・ RAM (Random Access Memory) 1003
-Program 1004 loaded into RAM 1003
A storage device 1005 that stores the program 1004.
A drive device 1007 that reads and writes the recording medium 1006.
-Communication interface 1008 for connecting to the communication network 1009
-I / O interface 1010 for inputting / outputting data
-Bus 1011 connecting each component
Each component of each device in each embodiment is realized by the CPU 1001 acquiring and executing the program 1004 that realizes these functions. The program 1004 that realizes the functions of each component of each device is stored in, for example, a storage device 1005 or a RAM 1003 in advance, and is read by the CPU 1001 as needed. The program 1004 may be supplied to the CPU 1001 via the communication network 1009, or may be stored in the recording medium 1006 in advance, and the drive device 1007 may read the program and supply the program to the CPU 1001.

There are various modifications in the method of realizing each device. For example, each device may be realized by any combination of the information processing device 1000 and the program, which are separate for each component. Further, a plurality of components included in each device may be realized by any combination of one information processing device 1000 and a program.

Further, a part or all of each component of each device is realized by a general-purpose or dedicated circuit including a processor or the like, or a combination thereof. These may be composed of a single chip or may be composed of a plurality of chips connected via a bus. A part or all of each component of each device may be realized by a combination of the above-mentioned circuit or the like and a program.

When a part or all of each component of each device is realized by a plurality of information processing devices and circuits, the plurality of information processing devices and circuits may be centrally arranged or distributed. May be good. For example, the information processing device, the circuit, and the like may be realized as a form in which each is connected via a communication network, such as a client-and-server system and a cloud computing system.

(First Embodiment)
First, the first embodiment of the present invention will be described. FIG. 1 is a diagram showing a log analyzer 100 according to the first embodiment of the present invention.

As shown in FIG. 1, the log analyzer 100 according to the first embodiment of the present invention includes at least an extraction unit 110 and a determination unit 120. The extraction unit 110 extracts information related to the type of attack from the communication log related to the attack. The determination unit 120 determines the type of attack related to the log based on the information related to the type of attack and the determination rule according to the type of attack.

Further, FIG. 2 shows an example of a more specific configuration of the log analyzer 100. In the example shown in FIG. 2, the log analysis device 100 includes a log acquisition unit 101, an output unit 102, and a storage unit 130 in addition to the extraction unit 110 and the determination unit 120. In this configuration, all the elements may be realized as one device, or the storage unit 130 and other elements may be realized by separate devices connected via a communication network.

The log acquisition unit 101 acquires the communication log that is the target of the attack type determination. The output unit 102 outputs the result of the attack type determined by the determination unit 120 and the information related to the result. The storage unit 130 mainly stores information necessary for determining the type of attack in the determination unit 120. In the example shown in FIG. 2, the storage unit 130 includes a determination rule storage unit 131, an automatic operation definition storage unit 132, and a manual operation definition storage unit 133. The determination rule storage unit 131 stores the conditions for determining the type of attack. The automatic operation definition storage unit 132 stores features related to an attack performed by an automatic operation. The manual operation definition storage unit 133 stores features related to an attack performed by a manual operation.

Subsequently, each component of the log analyzer 100 will be described.

The log acquisition unit 101 acquires the communication log that is the target of the attack type determination. It is assumed that the log acquired by the log acquisition unit 101 is mainly a log of communication related to some kind of attack. The type of log acquired by the log acquisition unit 101 is not particularly limited, and may be a binary file such as a pcap (packet capture) file or a text file such as a proxy log. The type of attack is not particularly limited, and for example, a scan attack and an attack aimed at unauthorized access are included in the assumed attacks.

The extraction unit 110 extracts information related to the type of attack from the communication log related to the attack. The communication log is, for example, a log acquired by the log acquisition unit 101. The extraction unit 110 extracts information related to the type of attack in units of communication sessions and other predetermined periods.

When information related to the type of attack is extracted on a session-by-session basis, the session can be distinguished by the source IP (Internet Protocol) address, source port number, destination IP address, and destination port. Numbers, protocols and other information are used.

In addition, the information related to the type of attack includes, for example, information on time, information on the size of data, and information on input from the keyboard. The extraction unit 110 extracts this information from the log as an example. The information related to the type of attack is not limited to these, and the extraction unit 110 may acquire other information as information related to the type of attack.

The time information includes, for example, the response time from the source, the packet arrival interval, and the arrival time difference between one packet and the previous packet. In addition, statistical values such as these averages and standard deviations may be obtained as information on time. Information about the size of the data includes, for example, the packet size received in the session of interest. Further, statistical values such as the average packet size and the standard deviation may be obtained as information on time. Information about keyboard input includes, for example, the presence or absence of a particular key input. However, each of the information regarding time, the information regarding the size of data, and the information regarding input from the keyboard may include information other than the above-mentioned information.

The extraction unit 110 sequentially refers to the log and extracts the above-mentioned information. Further, the extraction unit 110 may further obtain the above-mentioned statistical value by using the extracted information.
When referring to the log, the extraction unit 110 refers to the log by appropriately using means according to the type of the log.

When the log is a pcap file, the extraction unit 110 acquires the values stored in the pcap header and the header of each protocol layer in order from the beginning of the file. The extraction unit 110 may also acquire information that is not recorded in the header, such as the size of the TCP (Transmission Control Protocol) payload and the input from the keyboard. The extraction unit 110 collects the acquired values for each session, and appropriately stores the acquired values in the storage unit 130 and other elements as needed, for example, in the format shown in FIG. 3, which will be described later. When referred to the end of the pcap file, the extraction unit 110 may further obtain other information including the average and standard deviation such as the packet arrival interval and the packet size from the information recorded for each session.

FIG. 3 shows an example of the information extracted by the extraction unit 110 when the information related to the type of attack is extracted for each session. In FIG. 3, “id” indicates an identification number assigned to each session. “Src_ip” indicates the IP address of the source, and “src_port” indicates the port number of the source. Further, "dst_ip" indicates the IP address of the destination, and "dst_port" indicates the port number of the destination. Specific addresses and port numbers may be described in the respective sections of "src_ip", "src_port", "dst_ip" and "dst_port". “Type” indicates the type of protocol used in the session. The example shown in FIG. 3 shows that SSH was used in the session. Further, "keyboard_input" indicates whether or not the indicated key is input. In the example shown in FIG. 3, the value for the item is "" backspace ": True". That is, it is shown to include keyboard backspace key input.

The number of sessions extracted by the extraction unit 110 is not particularly limited. Further, in the example shown in FIG. 3, the number of information related to the type of attack is not limited for each extraction unit such as a session. That is, in the example shown in FIG. 3, other information such as the statistical value of the response time from the source and the packet size may be further included. Depending on the determination procedure by the determination unit 120 and the like, at least a part of each of the information listed in FIG. 3 may not be extracted.

The determination unit 120 determines the type of attack related to the log based on the information related to the type of attack extracted by the extraction unit 110 and the determination rule according to the type of attack. In the determination unit 120, for each of the above-mentioned units, whether the attack related to the log is an automatic attack automatically performed by a script, malware, or the like, or a manual attack in which the attacker sequentially executes the procedure. To judge.

More specifically, the determination unit 120 automatically performs an attack related to the log by collating the information related to the type of attack extracted by the extraction unit 110 with the determination rule according to the type of attack. Determine if it is an attack or a manual attack. The procedure by the determination unit 120 will be further described.

FIG. 4 shows an example of the determination rule used by the determination unit 120. The determination rule is stored in advance in, for example, the determination rule storage unit 131. The determination unit 120 is not limited to the determination rule stored in advance in the determination rule storage unit 131, and may make a determination using, for example, a determination rule appropriately acquired from an external server or another external device.

In the example shown in FIG. 4, "ID" is assigned to each determination rule and indicates identification information for identifying each determination rule. “Protocol” indicates the type of protocol targeted by each determination rule. "Attack type" indicates the type of attack targeted by each judgment rule.
Then, the "rule" indicates a condition to be satisfied in order to determine that the log matching the item "protocol" is related to the type of attack shown in the "attack type".

That is, the determination rule in which the "ID" is "R1" can determine that the log is a log related to an automatic attack when the conditions A1 and A2 are both satisfied for the communication log whose protocol is Telnet. show. Similarly, the determination rule in which the "ID" is "R2" indicates that, when the condition M2 is satisfied for the communication log whose protocol is SSH, it can be determined that the log is a log related to a manual attack.

Further, the details of the rule shown in FIG. 4 are defined as an automatic operation definition or a manual operation definition. FIG. 5 shows an example of an automatic operation definition. Further, FIG. 6 shows an example of a manual operation definition.

Each of the automatic operation definition and the manual operation definition is stored in advance in, for example, the automatic operation definition storage unit 132 or the manual operation definition storage unit 133. The determination unit 120 is not limited to the determination rule stored in advance in the automatic operation definition storage unit 132 or the manual operation definition storage unit 133, and may make a determination using a determination rule appropriately acquired from an external server or the like. good.

In the examples shown in FIGS. 5 and 6, the "identifier" is an identifier that identifies each rule. “Characteristics” indicates the characteristics related to the type of attack in the log. “Condition” indicates a condition for a feature for determining that the rule is satisfied.

In each of FIGS. 5 and 6, "response_time" in the "feature" column indicates the response time from the other party specified by the source IP address. Further, "std" indicates the standard deviation, and "mean" indicates the average. Further, in each of FIGS. 5 and 6, "s" in the "condition" column indicates seconds, and "is_true" indicates that the keyboard input specified in the "feature" column exists. That is, it can be determined that the rule A1 shown in FIG. 5 is satisfied when the standard deviation of the response time from the other party specified by the source IP address is less than 5 seconds.

In the example shown in FIG. 4, one determination rule is set for each protocol. However, a plurality of determination rules may be set for each protocol. The type of protocol is not limited to Telnet or SSH, and other protocols may be used. Further, in the example shown in FIG. 4, one determination rule is set for each of the automatic attack and the manual attack. However, a plurality of determination rules may be set for each of the automatic attack and the manual attack.

Further, the number of conditions is not limited to the number shown in each of the automatic operation definition shown in FIG. 4 and the manual operation definition shown in FIG. The conditions are not limited to response time or keyboard input. For example, a condition relating to packet size and other conditions may be included as the conditions shown in FIG. 4 or FIG. By setting many judgment rules or conditions for them, it is possible to judge against a larger number of types of attacks.

The process when the determination unit 120 determines the type of attack for the information related to the type of attack extracted by the extraction unit 110 will be described with reference to the examples shown in FIGS. 3 to 6.

With reference to the information shown in FIG. 3 in which the “id” extracted by the extraction unit 110 is “00001”, the “type” is “SSH”. Therefore, the determination unit 120 acquires the rule whose protocol is "SSH" from the determination rules shown in FIG. 4 and makes a determination. That is, the determination unit 120 determines whether or not the information shown in FIG. 3 satisfies the rule R2 in which the protocol is “SSH” among the determination rules shown in FIG. That is, the determination unit 120 determines whether or not the rule M2 is satisfied. When the information shown in FIG. 3 satisfies the rule M2, the determination unit 120 determines that the attack related to the log from which the information is extracted is a manual attack.

Referring to FIG. 6, rule M2 has a feature of "keyboard_input [" backspace "]" and a condition of "is_true". That is, it is shown that the rule holds when the backspace key of the keyboard is input. On the other hand, referring to FIG. 3, there is an item of "keyboard_input", and the value for the item is "" backspace ": True". This indicates that, as mentioned above, the input of the backspace key on the keyboard is included. That is, the rule M2 holds.

Therefore, in this case, the determination unit 120 determines that the attack related to the log from which the information whose “id” is “00001” is the extraction source is a manual attack.

The output unit 102 outputs the result of the attack type determined by the determination unit 120 and the information related to the result. The target of output by the output unit 102 is not particularly limited, and may be, for example, a console displayed on an arbitrary display device (not shown) or a file. Further, the result and other information output by the output unit 102 may be all the determined results, or may be either the result determined to be an automatic attack or a manual attack. Further, the output unit 102 may output other information including the unit when the information is extracted by the extraction unit 110 and the extraction reference. When the attack type is determined for each communication session, the output unit 102, together with the determination result, outputs the source IP address, the source port number, the destination IP address, and the destination port number. , Protocol, etc. may be output as information related to the result of the determined attack type.

Subsequently, the operation of the log analyzer 100 according to the present embodiment will be described with reference to the flowchart shown in FIG. In this operation example, it is assumed that the log analyzer 100 has the configuration shown in FIG.

First, the log acquisition unit 101 acquires the communication log to be determined for the attack type (step S101). In this step, the log acquisition unit 101 may acquire a plurality of logs.

Next, the extraction unit 110 extracts information related to the type of attack from the communication log acquired in step S101 in units of a predetermined period, session, or the like (step S102). When a plurality of logs are acquired in step S101, the operation of step S102 is repeated as appropriate.

Next, the determination unit 120 determines the type of attack based on the information related to the type of attack extracted in step S102 and the determination rule according to the type of attack (step S103). When information is extracted for a plurality of periods, sessions, or the like in step S102, the process of step S103 is repeated as appropriate.

Next, the output unit 102 outputs information such as the result of the attack type determined in step S103 (step S104).

As described above, the log analysis device 100 in the present embodiment extracts information related to the attack type from the communication log, and is related to the log based on the information and the determination rule according to the attack type. Determine the type of attack to make. In the analysis by the log analyzer 100, various information can be used as information related to the type of attack, and a plurality of determination rules according to the type of attack can be used.
Therefore, the log analysis device 100 can determine the type of attack with respect to the communication log including various patterns of attacks. Therefore, the log analysis device 100 makes it easy to determine the type of attack in a cyber attack.

(Second Embodiment)
Next, a second embodiment of the present invention will be described. FIG. 8 is a diagram showing a log analyzer 200 according to a second embodiment of the present invention.

As shown in FIG. 8, the log analyzer 200 according to the second embodiment of the present invention includes an extraction unit 110, a determination unit 120, and a determination rule generation unit 240. The extraction unit 110 and the determination unit 120 are elements similar to the elements included in the log analyzer 100 in the first embodiment. The determination rule generation unit 240 generates a determination rule based on the communication log in which the type of attack is determined. That is, the log analysis device 200 is different from the log analysis device 100 in that the determination rule generation unit 240 is provided.

Further, FIG. 9 shows an example of a more specific configuration of the log analyzer 200. In the example shown in FIG. 9, the log analysis device 200 includes a log acquisition unit 101, an output unit 102, and a storage unit 130 in addition to the extraction unit 110, the determination unit 120, and the determination rule generation unit 240. The log acquisition unit 101 and the output unit 102 are the same elements as those with the same reference numerals in FIG. Further, in the example shown in FIG. 9, the storage unit 130 includes a determination rule storage unit 131, an automatic operation definition storage unit 132, a manual operation definition storage unit 133, and a communication data storage unit 234. Each of the determination rule storage unit 131, the automatic operation definition storage unit 132, and the manual operation definition storage unit 133 is the same element as the element with the same reference numeral in FIG. The communication data storage unit 234 stores a communication log related to the attack for which the type of attack has been determined. That is, in the example shown in FIG. 9, the storage unit 130 further includes the communication data storage unit 234, which is different from the specific configuration example of the log analyzer 200 shown in FIG.

Subsequently, each component of the log analyzer 200 will be described. The description of the same elements as those included in the log analyzer 100 described above will be omitted as appropriate.

The determination rule generation unit 240 generates a determination rule based on the communication log in which the type of attack is determined. The generated determination rule is represented, for example, in the format shown in FIGS. 4 to 6 described above, but the present invention is not limited to this, and may be appropriately determined according to the method for generating the determination rule. The determination unit 120 determines the type of attack based on the determination rule generated by the determination rule generation unit 240, not limited to the determination rule prepared in advance.

The determination rule generation unit 240 generates a determination rule by using a machine learning method as an example. In this case, the determination rule generation unit 240 generates a determination rule by using a method called, for example, a random forest.

An example of the case where the judgment rule generation unit 240 generates the judgment rule by the random forest will be described. In this case, the determination rule generation unit 240 extracts information related to the above-mentioned attack type from each of the logs determined in advance to be related to the automatic attack or the manual attack. That is, the determination rule generation unit 240 extracts various information including information on time, information on data size, or information on input from the keyboard from each of these logs. The extracted information is represented, for example, as shown in FIG. 3 described above.

Then, the determination rule generation unit 240 generates a plurality of decision trees that classify the information related to the type of attack described above into an automatic attack and a manual attack. The number of decision trees to be generated is not particularly limited, and may be appropriately determined according to the amount of extracted information and the like. When the determination rule is generated in this way, the determination unit 120 determines the type of attack based on the generated decision tree. That is, the determination unit 120 determines the type of attack by the majority of the classification results of the automatic attack or the manual attack by each of the generated decision trees.

The determination rule generation unit 240 may generate a determination rule based on a machine learning method other than the random forest. Further, the generated determination rule is appropriately stored in each of the determination rule storage unit 131, the automatic operation definition storage unit 132, or the manual operation definition storage unit 133 of the storage unit 130. The determination unit 120 determines the type of attack by referring to the determination rule stored in each element of the storage unit 130.

The communication log used by the determination rule generation unit 240 when generating the determination rule is stored in, for example, in the communication data storage unit 234 in advance. The communication log stored in the communication data storage unit 234 is a log that has been determined to be either an automatic attack or a manual attack. The communication log stored in the communication data storage unit 234 may be a log in which the type of attack is determined by the determination unit 120. By doing so, the communication log in which the type of attack is determined by the determination unit 120 based on the highly accurate determination rule can be used in the generation of the determination rule.

In the communication data storage unit 234, the communication log is stored as a separate file according to the type of attack. Therefore, the communication data storage unit 234 holds a table for managing files. FIG. 10 shows an example of a table for managing files. In the table as shown in FIG. 10, information for identifying the attack type and the file is described for each of the stored files. The file path and the hash value of the file are used as the information for identifying the file.
In the example shown in FIG. 10, the log file related to the automatic attack is the file specified by <file path>. In addition, the log file related to manual attacks is a file specified by <file hash value>.

The determination rule generation unit 240 may generate a determination rule using a log different from the communication log stored in the communication data storage unit 234. For example, the determination rule generation unit 240 may appropriately acquire a log of communication related to an attack whose type has been determined in advance from an external server or the like, and create a determination rule using the acquired determination rule.

Subsequently, the operation related to the generation of the determination rule of the log analyzer 200 in the present embodiment will be described with reference to the flowchart shown in FIG. In this operation example, it is assumed that the log analyzer 200 has the configuration shown in FIG. The log analysis device 200 performs information extraction, determination of the type of attack, and the like in the same operation as the log analysis device 100.

First, the determination rule generation unit 240 acquires the communication log used when generating the determination rule (step S201). The determination rule generation unit 240 appropriately refers to the communication data storage unit 234 of the storage unit 130 to acquire the communication log.

Next, the determination rule generation unit 240 generates a determination rule using the communication log acquired in step S201 (step S202).

Next, the determination rule generation unit 240 updates the contents of the storage unit 130 so that the determination rule generated in step S202 is stored in each element of the storage unit 130 (step S203).

As described above, the log analyzer 200 in the present embodiment further includes a determination rule generation unit 240 that generates a determination rule. By providing the determination rule generation unit 240, the determination unit 120 can determine the type of attack using more determination rules. Further, the determination rule generation unit 240 can generate a determination rule using the communication log determined by the determination unit 120. That is, when the machine learning method is used in the determination rule generation unit 240, more data can be used as the learning data. Therefore, the log analysis device 200 has the same effect as the log analysis device 100, and enables the determination of the attack type with higher accuracy.

(Third Embodiment)
Next, a third embodiment of the present invention will be described. FIG. 12 is a diagram showing a log analyzer 300 according to a third embodiment of the present invention.

As shown in FIG. 12, the log analyzer 300 according to the third embodiment of the present invention includes an extraction unit 110, a determination unit 120, a determination rule generation unit 240, a reception unit 350, and a first observation unit 360. To be equipped. The extraction unit 110 and the determination unit 120 are elements similar to the elements included in the log analyzer 100 in the first embodiment. The determination rule generation unit 240 is an element similar to the element included in the log analysis device 200 in the second embodiment. The receiving unit 350 receives the communication related to the attack. The first observation unit 360 observes the communication received by the reception unit 350. That is, the log analysis device 300 is different from the log analysis device 200 in that it includes a reception unit 350 and a first observation unit 360.

Further, FIG. 13 shows an example of a more specific configuration of the log analyzer 300. In the example shown in FIG. 13, the log analysis device 300 includes a log acquisition unit 101 and an output unit 102 in addition to the extraction unit 110, the determination unit 120, the determination rule generation unit 240, the reception unit 350, and the first observation unit 360. And a storage unit 130. The log acquisition unit 101 and the output unit 102 are the same elements as those with the same reference numerals in FIG.

Further, in the example shown in FIG. 13, the storage unit 130 includes a determination rule storage unit 131, an automatic operation definition storage unit 132, a manual operation definition storage unit 133, a communication data storage unit 234, and an observation data storage unit 335. Have. Each of the determination rule storage unit 131, the automatic operation definition storage unit 132, the manual operation definition storage unit 133, and the communication data storage unit 234 is the same element as the element with the same reference numeral in FIG. 2 or FIG. The observation data storage unit 335 stores a communication log obtained by the first observation unit 360 observing the communication of the reception unit 350.

In the examples shown in FIGS. 12 and 13, a configuration including a determination rule generation unit 240 and a communication data storage unit 234 is shown. However, the log analyzer 300 does not have to include these elements. That is, the log analysis device 300 may be configured to further include a reception unit 350 and a first observation unit 360 with respect to the log analysis device 100 in the first embodiment.

Subsequently, each component of the log analyzer 300 will be described. The description of the same elements as those included in the log analysis device 100 or the log analysis device 200 described above will be omitted as appropriate.

The receiving unit 350 receives the communication related to the attack. That is, the receiving unit 350 receives at least the communication transmitted from the outside in connection with the attack. The communication related to the attack includes, for example, a scan attack and a communication for the purpose of unauthorized access, but other communication may be included in the communication related to the attack. Further, the receiving unit 350 may be able to receive other communications. The receiving unit 350 may be further configured to respond to the received communication.

The receiver 350 is implemented by Telnet, SSH, or a honeypot that emulates other protocols. Further, the receiving unit 350 may be realized by any kind of computer on which Telnet, SSH or other services are operated. The receiving unit 350 may be realized by other means as long as the communication related to the attack can be received.

The first observation unit 360 observes the communication received by the reception unit 350. The first observation unit 360 is realized by, for example, tcpdump, Wireshark, or the like, but is not limited thereto. The first observation unit 360 records the observed communication in the above-mentioned pcap file, text file, or other type of log file.

Further, in the present embodiment, the receiving unit 350 may transmit data in response to communication from the outside. However, the data transmitted from the receiving unit 350 is generally data that is not related to an attack from the outside. Therefore, the first observation unit 360 excludes the data transmitted from the reception unit 350 and records it in the log. However, the first observation unit 360 may record the data including the data transmitted from the reception unit 350 in the log.

In the present embodiment, the log acquisition unit 101 acquires the communication log obtained by the first observation unit 360 observing the communication of the reception unit 350. When the log analyzer 300 includes the storage unit 130, the log acquisition unit 101 may acquire the log observed by the first observation unit 360 and stored in the observation data storage unit 335. With such a configuration, when an attack is made, it is possible to quickly determine the type of attack.

Subsequently, with reference to the flowchart shown in FIG. 14, the operation mainly related to the receiving unit 350 and the first observing unit 360 of the log analyzer 300 in the present embodiment will be described. The log analysis device 300 performs information extraction, determination of the type of attack, and the like by the same operation as the log analysis device 100. When the log analysis device 300 includes the determination rule generation unit 240, the determination rule generation unit 240 generates the determination rule by the same operation as the log analysis device 200.

First, the first observation unit 360 starts observation (step S301). The observation by the first observation unit 360 is started prior to the start of reception by the reception unit 350 so that the observation of the communication received by the reception unit 350 does not leak.

Next, the receiving unit 350 starts receiving the communication related to the attack (step S302).

Next, the receiving unit 350 processes the received communication, and the first observing unit 360 observes the communication (step S303). That is, when the receiving unit 350 receives a packet from the outside, the receiving unit 350 processes and responds to the packet as necessary. In this case, the first observation unit 360 observes the communication performed by the reception unit 350. The first observation unit 360 may rotate the log file and perform other necessary processing at regular intervals according to the amount of communication and other conditions.

As described above, the log analyzer 300 in the present embodiment further includes a receiving unit 350 and a first observing unit 360. The reception unit 350 and the first observation unit 360 receive and observe communications related to the attack. The type of attack is determined based on the communication log related to the observed attack. Therefore, the log analyzer 300 has at least the same effect as the log analyzer 100 in the first embodiment. In addition, the log analysis device 300 enables quick determination of the attack type.

(Fourth Embodiment)
Next, a fourth embodiment of the present invention will be described. FIG. 15 is a diagram showing a log analyzer 400 according to a fourth embodiment of the present invention.

As shown in FIG. 15, the log analyzer 400 includes an extraction unit 110, a determination unit 120, a determination rule generation unit 240, a reception unit 350, a first observation unit 360, a malware execution unit 470, and a second. The observation unit 480 and the control unit 490 are provided.

The extraction unit 110 and the determination unit 120 are elements similar to the elements included in the log analyzer 100 in the first embodiment. The determination rule generation unit 240 is an element similar to the element included in the log analysis device 200 in the second embodiment. Further, the receiving unit 350 and the first observation unit 360 are the same elements as the elements included in the log analyzer 300 in the third embodiment.

The malware execution unit 470 executes the acquired malware. The second observation unit 480 observes the communication by the malware executed by the malware execution unit 470. The control unit 490 controls the operations of the malware execution unit 470 and the second observation unit 480.

Further, FIG. 16 shows an example of a more specific configuration of the log analyzer 400. In the example shown in FIG. 16, the log analyzer 400 includes a log acquisition unit 101, an output unit 102, a storage unit 130, and a malware acquisition unit 451 in addition to the above-mentioned elements. Each of the log acquisition unit 101, the output unit 102, and the storage unit 130 is an element similar to the element having the same reference numeral in each of the first to third embodiments. The malware acquisition unit 451 acquires the malware received by the receiving unit 350.

In the examples shown in FIGS. 15 and 16, a configuration including a determination rule generation unit 240 and a communication data storage unit 234 is shown. However, the log analyzer 300 does not have to include these elements.

Subsequently, each component of the log analyzer 400 will be described. The description of the same elements as those described in each of the above-described embodiments will be omitted as appropriate.

The malware acquisition unit 451 acquires the malware received by the receiving unit 350. More specifically, the malware acquisition unit 451 detects and acquires malware from the data received by the receiving unit 350.

The malware acquisition unit 451 detects malware in the same manner as general anti-virus software, for example. That is, the malware acquisition unit 451 detects and acquires malware depending on whether or not the received data matches a predefined feature. When the receiving unit 350 is configured not to actively communicate with the outside, the malware acquisition unit 451 acquires the transmitted program assuming that all the programs transmitted to the receiving unit 350 are malware. May be good. The acquired malware may be stored together with an identifier in any storage means (not shown).

The malware execution unit 470 executes, for example, the malware acquired by the malware acquisition unit 451. The malware execution unit 470 may execute the malware acquired by means other than the malware acquisition unit 451.

The malware execution unit 470 is realized in a general environment for executing malware. That is, the malware execution unit 470 is realized by an emulator, a virtual machine, or the like that simulates the operation of the OS (Operating System). The means for realizing the malware execution unit 470 is not limited to these, but it is preferable that the problem caused by the operation of the malware does not spread to other components or another device. Further, since the malware generally attacks the outside, the malware execution unit 470 may control the access of the communication so as not to have an influence on the outside. For example, the malware execution unit 470 may be controlled so that communication can be performed only to a specific external server. Further, when controlling access to the outside, the malware execution unit 470 may include a dummy server corresponding to the external server.

The second observation unit 480 observes the communication by the malware executed by the malware execution unit 470. For example, the second observation unit 480 observes communication between an emulator, a virtual machine, or the like and an external server, a dummy server, or the like. The second observation unit 480 is realized by, for example, the tcpdump command or the like. The second observation unit 480 records the observed communication in the above-mentioned pcap file, text file, or other type of log file. The observed result is appropriately stored in the communication data storage unit 234 together with the information for identifying the malware.

The control unit 490 controls the operations of the malware execution unit 470 and the second observation unit 480. The control unit 490 transfers the malware to the malware execution unit 470, executes or stops the malware by the malware execution unit 470, starts or stops the observation by the second observation unit 480, or performs other necessary control. The control unit 490 may control each operation of the malware acquisition unit 451.

The control unit 490 transfers the malware to the malware execution unit 470 by means such as CP (Secure Copy), SFTP (Secure File Transfer Protocol), or a shared folder. In this case, it is preferable to carry out the procedure in which security is ensured.

Further, the control unit 490 controls, for example, so that the observation by the second observation unit 480 is generally performed only while the malware is being executed by the malware execution unit 470. That is, in this example, the control unit 490 controls so that the observation by the second observation unit 480 is started immediately before the execution of the malware by the malware execution unit 470 is started. Then, the control unit 490 controls to stop the observation by the second observation unit 480 immediately after the execution of the malware by the malware execution unit 470 is completed.

The malware is executed by the malware execution unit 470, and the second observation unit 480 observes the malware communication to obtain a communication log. The obtained communication log becomes a log related to automatic attacks. A new determination rule is generated by the determination rule generation unit 240 using the communication log obtained in this way. Then, the determination unit 120 further uses the generated determination rule to determine the type of attack. The accuracy of the analysis can be improved by determining the type of attack using the determination rule generated by the determination unit 120.

Subsequently, with reference to the flowchart shown in FIG. 17, the operations of the log analyzer 400 according to the present embodiment mainly related to the malware acquisition unit 451, the malware execution unit 470, and the second observation unit 480 will be described.

First, the malware acquisition unit 451 acquires malware from the data received by the reception unit 350 (step S401). In step S401, the malware acquisition unit 451 may operate so as to acquire only the malware that has not been acquired.

Next, the control unit 490 controls the second observation unit 480 to start observing the communication by the malware (step S402). Depending on the control, the second observation unit 480 starts observing the communication.

Next, the control unit 490 controls the malware execution unit 470 to execute the malware (step S403). Depending on the control, the malware execution unit 470 starts executing the malware.

Next, the control unit 490 controls the malware execution unit 470 to stop the execution of the malware (step S404). Depending on the control, the malware execution unit 470 stops the execution of the malware.

Next, the control unit 490 controls the second observation unit 480 so as to stop the observation of the communication by the malware (step S405). Depending on the control, the second observation unit 480 stops the observation of the communication.

Finally, the control unit 490 stores the communication log observed by the second observation unit 480 in the communication data storage unit 234 (step S406).

As described above, the log analyzer 400 in the present embodiment further includes a configuration for executing the acquired malware and observing the communication by the malware. With such a configuration, a judgment rule regarding an automatic attack is further generated based on a log of communication by the observed malware. Then, the type of attack is determined using the generated determination rule.

Therefore, the log analyzer 400 has at least the same effect as the log analyzer 100 in the first embodiment. In addition, the log analysis device 400 enables highly accurate determination of the attack type.

A part or all of the present invention may be described as in the appendix below, but is not limited to the following.
(Appendix 1)
An extraction means for extracting information related to the type of attack from the communication log related to the attack, and
A determination means for determining the type of attack related to the log based on information related to the type of attack and a determination rule according to the type of attack.
A log analyzer equipped with.
(Appendix 2)
The log analysis device according to claim 1, wherein the determination means determines whether the attack is an automatic attack or a manual attack.
(Appendix 3)
The determination means is an automatic attack based on whether the information related to the type of attack matches the determination rule regarding the automatic attack or the determination rule regarding the manual attack. The log analyzer according to Appendix 2, which determines whether the attack is a manual attack or a manual attack.
(Appendix 4)
The log according to any one of Appendix 1 to 3, wherein the information related to the type of attack includes one or more of information on time, information on data size, or information on keyboard input. Analysis equipment.
(Appendix 5)
Receiving means to receive communication related to the attack,
A first observing means for observing the communication received by the receiving means,
The log analyzer according to any one of Supplementary Provisions 1 to 4, further comprising.
(Appendix 6)
The determination means extracts information related to the type of attack from the communication log observed by the first observation means.
The log analyzer according to Appendix 5.
(Appendix 7)
A determination rule generating means that generates the determination rule based on the communication log for which the type is determined.
The log analyzer according to any one of Appendix 1 to 6.
(Appendix 8)
Malware execution means to execute malware,
A second observation means for observing the communication by the malware executed by the malware execution means, and
A control means for controlling the malware execution means and the second observation means, and
7. The log analyzer according to Appendix 7.
(Appendix 9)
The determination rule generating means generates the determination rule regarding the automatic attack based on the communication log observed by the second observation means.
The log analyzer according to claim 8.
(Appendix 10)
Information related to the type of attack is extracted from the communication log related to the attack.
The type of the attack related to the log is determined based on the information related to the type of the attack and the determination rule according to the type of the attack.
Log analysis method.
(Appendix 11)
On the computer
The process of extracting information related to the type of attack from the communication log related to the attack, and
A process of determining the type of attack related to the log based on information related to the type of attack and a determination rule according to the type of attack.
A program that executes.

100 Log analyzer 110 Extraction unit 120 Judgment unit 101 Log acquisition unit 102 Output unit 130 Storage unit 131 Judgment rule storage unit 132 Automatic operation definition storage unit 133 Manual operation definition storage unit 234 Communication data storage unit 335 Observation data storage unit 240 Judgment rule Generation unit 350 Reception unit 360 First observation unit 451 Malfunction acquisition unit 470 Malfunction execution unit 480 Second observation unit 490 Control unit

Claims (11)

From the communication packet related logs attack, extraction means for extracting the type of protocol, and information relevant to the type of the attack,
Among the plurality of judgment rules, the judgment rule associated with the extracted protocol type is acquired, and the communication packet log is based on the information related to the attack type and the acquired judgment rule. Judgment means for determining the type of the attack related to
A log analyzer equipped with. The log analysis device according to claim 1, wherein the determination means determines whether the type of attack is an automatic attack or a manual attack. Said determination means, information relevant to the type of the attack, the determination rule or based on whether or not match any of the manual attack about the decision rule for the automatic attack, the type of the attack the automatic The log analyzer according to claim 2, wherein it determines whether the attack is an attack or the manual attack. The information related to the type of attack is described in any one of claims 1 to 3, which includes one or more of information on time, information on data size, or information on keyboard input. Log analyzer. Receiving means to receive communication related to the attack,
A first observing means for observing the communication received by the receiving means,
The log analyzer according to any one of claims 1 to 4. The extraction means extracts information related to the type of attack from the communication log observed by the first observation means.
The log analyzer according to claim 5. A determination rule generating means that generates the determination rule based on the communication packet log for which the type has been determined.
The log analyzer according to any one of claims 1 to 6. Malware execution means to execute malware,
A second observation means for observing the communication by the malware executed by the malware execution means, and
A control means for controlling the malware execution means and the second observation means, and
7. The log analyzer according to claim 7. The determination rule generating means generates the determination rule regarding the automatic attack based on the communication log observed by the second observation means.
The log analyzer according to claim 8. The computer
From the communication packet related logs attack, extracts a type of protocol, and information relevant to the type of the attack,
Of the plurality of judgment rules, the judgment rule associated with the extracted protocol type is acquired, and the judgment rule is acquired.
Based on the information related to the attack type and the acquired determination rule, the attack type related to the communication packet log is determined.
Log analysis method. On the computer
From the communication packet related logs attack, the process of extracting the type of protocol, and information relevant to the type of the attack,
Among the plurality of judgment rules, the judgment rule associated with the extracted protocol type is acquired, and the communication packet log is based on the information related to the attack type and the acquired judgment rule. And the process of determining the type of attack related to
A program that executes.

Images