JP7311402B2 - Threshold output device, threshold output method and threshold output program - Google Patents

Description

The present invention relates to a threshold output device, a threshold output method, and a threshold output program.

In recent years, there have been attacks on the Internet called DDоS (Distributed Denial of Service) attacks, which generate a large amount of communication and overload the target servers and lines, making it impossible to provide services. .

Conventionally, in order to detect abnormal network traffic, an appropriate threshold was set in the monitoring system for the volume of traffic flowing, and if the threshold was exceeded, it was determined whether there was abnormal traffic.

The setting of such a threshold has been performed in advance by collecting long-term data on the communication of the target network line, and based on statistics and operator's empirical rules based on the trends. Alternatively, in actual operation, the size of the threshold is manually adjusted by trial and error.

JP 2007-173907 A

However, the conventional method has a problem that it may not be possible to easily and accurately set a threshold value for detecting abnormal traffic. For example, when setting thresholds based on statistics, it is necessary to collect long-term data on communications on the target network line. For this reason, for example, when there is a new network line for which anomaly detection is desired, the threshold cannot be easily set.

In addition, for example, manual threshold setting based on operator's empirical rule or trial and error requires training of the operator, and the threshold cannot be easily set. In addition, there is a problem that the threshold cannot be set with high accuracy because the accuracy varies from operator to operator.

In order to solve the above-described problems and achieve the object, the threshold value output device of the present invention includes: a first acquisition unit for acquiring traffic data of a second network including a first network for anomaly detection; a generation unit that generates a statistical model using the traffic data acquired by the first acquisition unit; a second acquisition unit that acquires the traffic data of the first network; and acquisition by the second acquisition unit. an updating unit for updating the statistical model generated by the generating unit using the generated traffic data; and detecting a communication abnormality in the first network using the statistical model updated by the updating unit. and a threshold value output unit for outputting a threshold value for the threshold value.

Further, a threshold output method of the present invention is a threshold output method executed by a threshold output device, comprising: a first acquisition step of acquiring traffic data of a second network including a first network for anomaly detection; , a generating step of generating a statistical model using the traffic data obtained by the first obtaining step; a second obtaining step of obtaining traffic data of the first network; and a second obtaining step. an updating step of updating the statistical model generated by the generating step using the traffic data acquired by; and a threshold output step of outputting a threshold for detecting.

Further, the threshold output program of the present invention includes: a first acquisition step of acquiring traffic data of a second network including the first network for anomaly detection; a generating step of generating a statistical model using a generating step; a second obtaining step of obtaining traffic data of the first network; and using the traffic data obtained by the second obtaining step, by the generating step an updating step of updating the generated statistical model; and a threshold output step of outputting a threshold value for detecting communication anomalies in the first network using the statistical model updated by the updating step. It is characterized by being executed by a computer.

ADVANTAGE OF THE INVENTION According to this invention, it is effective in the ability to set the threshold value for detecting abnormal traffic simply and accurately.

FIG. 1 is a block diagram showing a configuration example of a threshold value output device according to the first embodiment. FIG. 2 is a diagram showing an example of traffic data. FIG. 3 is a diagram for explaining a wide range of network lines including network lines for which abnormality detection is to be performed. FIG. 4 is a diagram for explaining an overview of threshold output processing by the threshold output device according to the first embodiment. FIG. 5 is a flowchart showing an example of the flow of threshold output processing in the threshold output device according to the first embodiment. FIG. 6 is a diagram showing a computer that executes a threshold output program.

Embodiments of a threshold output device, a threshold output method, and a threshold output program according to the present application will be described below in detail with reference to the drawings. Note that the threshold output device, the threshold output method, and the threshold output program according to the present application are not limited by this embodiment.

[First embodiment]
In the following embodiments, the configuration of the threshold value output device 10 according to the first embodiment and the processing flow of the threshold value output device 10 will be described in order, and finally the effects of the first embodiment will be described.

[Configuration of threshold output device]
First, the configuration of the threshold value output device 10 will be described with reference to FIG. FIG. 1 is a block diagram showing a configuration example of a threshold value output device according to the first embodiment. As shown in FIG. 1, the threshold value output device 10 is connected to a user terminal 20 via a network 30 .

Here, the user terminal 20 is, for example, an information processing device such as a desktop PC, tablet PC, notebook PC, mobile phone, smart phone, PDA (Personal Digital Assistant).

Moreover, as shown in FIG. Processing of each unit of the threshold value output device 10 will be described below.

The communication processing unit 11 controls communication regarding various information. For example, the communication processing unit 11 transmits an anomaly alarm when an anomaly occurs in the network targeted for anomaly detection. In this embodiment, the case where the threshold value output device 10 and the user terminal 20 communicate via the network 30 is described as an example. However, the threshold output device 10 may operate in a local environment.

The storage unit 13 stores data and programs required for various processes by the control unit 12, and has a statistical model storage unit 13a. For example, the storage unit 13 is a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. The statistical model storage unit 13a stores the statistical model generated by the generating unit 12b and the statistical model updated by the updating unit 12d.

The control unit 12 has an internal memory for storing programs defining various processing procedures and required data, and executes various processing using these. It has a first acquisition unit 12a, a generation unit 12b, a second acquisition unit 12c, an update unit 12d, a threshold output unit 12e, and a detection unit 12f. Here, the control unit 12 is an electronic circuit such as a CPU (Central Processing Unit) or MPU (Micro Processing Unit) or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

The processing executed by each functional unit of the control unit 12 includes a threshold output phase in which a statistical model is generated and updated (re-learning), a threshold is output using the statistical model, and the threshold output in the threshold output phase It is roughly divided into an anomaly detection phase in which an anomaly in the network line to be anomaly detected is detected using The first acquisition unit 12a, the generation unit 12b, the second acquisition unit 12c, the update unit 12d, and the threshold output unit 12e in the control unit 12 are functional units that perform processing in the threshold output phase. A functional unit 12f performs processing in the anomaly detection phase.

The threshold value output device 10 according to the first embodiment will be described as a device that performs both the threshold value output process in the threshold value output phase and the abnormality detection process in the abnormality detection phase. Only threshold output processing in the output phase may be performed. In this case, using the threshold output by the threshold output device 10, another device detects an abnormality in the network line to be detected. Each functional unit in the control unit 12 will be described below.

The first acquisition unit 12a acquires traffic data of network lines including the network line for which anomaly detection is to be performed. For example, the first acquisition unit 12a may acquire traffic data in real time from communication devices in a network wider than the network for anomaly detection, or may acquire traffic data automatically or manually input at a predetermined timing. It may be acquired. When acquiring traffic data from a communication device in real time, the first acquisition unit 12a continuously collects traffic data for a preset period. Further, the first acquisition unit 12a may perform existing data preprocessing such as null value interpolation processing and normalization processing on the acquired traffic data.

Here, a specific example of traffic data acquired by the first acquisition unit 12a will be described with reference to FIG. FIG. 2 is a diagram showing an example of traffic data. As illustrated in FIG. 2, for example, the first acquisition unit 12a uses "Src IP" indicating a source IP address, "Dst IP" indicating a destination IP address, and "Dst IP" indicating a source IP address as traffic data. "Src Port", "Dst Port" indicating the destination IP address, "packet" indicating information about the packet (for example, the number of bytes of the packet), "Time" indicating the packet transmission or reception time, etc. are acquired.

Further, the wide network line described above may include the network line whose abnormality is to be detected, as illustrated in FIG. 3 . FIG. 3 is a diagram for explaining a wide range of network lines including network lines for which abnormality detection is to be performed. A specific example of a wide network line will be described. For example, when the network targeted for anomaly detection is a LAN (Local Area Network) at a predetermined location, the first acquisition unit 12a acquires the LAN at that location. and traffic data from a wide range of network lines including LANs at other sites. Further, for example, when it is desired to detect a communication abnormality with respect to a predetermined web server, the first acquisition unit 12a may acquire traffic data from a wide range of network lines including the web server.

The generation unit 12b generates a statistical model using the traffic data acquired by the first acquisition unit 12a. Specifically, the generation unit 12b performs statistical modeling on the traffic data acquired by the first acquisition unit 12a to obtain a statistical model.

For example, the generation unit 12b may generate a statistical model of extreme value distribution using extreme value statistics as the statistical model. In other words, by generating a large amount of communication such as a DDOS attack, in order to detect attacks that impose a load on the attacked server or line and make it impossible to provide services, a threshold for communication with an abnormally large amount of communication , one might consider fitting the data to an extreme value distribution using extreme value statistics.

The second acquisition unit 12c acquires traffic data of a network targeted for anomaly detection. For example, the second acquisition unit 12c may acquire traffic data in real time from a communication device in the network targeted for anomaly detection, or may acquire traffic data automatically or manually input at a predetermined timing. good too. When acquiring traffic data from a communication device in real time, the second acquisition unit 12c continuously collects traffic data for a preset period. Further, the second acquisition unit 12c may perform existing data preprocessing such as null value interpolation processing and normalization processing on the acquired traffic data.

For example, when a LAN at a predetermined base is a network for abnormality detection, the second acquisition unit 12c acquires traffic data from a communication device such as an edge router of the LAN. Further, for example, when the second acquisition unit 12c wants to detect an abnormality in communication to a predetermined web server, the second acquisition unit 12c acquires traffic data of communication destined for the web server from the network connected to the web server. You may do so.

The update unit 12d uses the traffic data acquired by the second acquisition unit 12c to update the statistical model generated by the generation unit 12b. That is, the updating unit 12d re-learns the generated statistical model using the traffic data collected from the network line for which anomaly detection is to be performed. As for the re-learning method, any existing method may be applied.

The threshold output unit 12e uses the statistical model updated by the update unit 12d to output a threshold for detecting communication anomalies in the anomaly detection target network. Here, the threshold value output unit 12e may output the threshold value for detecting an abnormality in communication in the network targeted for abnormality detection to another functional unit in the own device, or may output the threshold value to an external device (system). good too. In the present embodiment, a case where the threshold output unit 12e outputs and sets a threshold to a detection unit 12f, which will be described later, will be described as an example. For example, in order to detect a DDoS attack, the threshold output unit 12e uses the statistical model updated by the update unit 12d to set the threshold for the amount of traffic for the same source or destination during a predetermined period in the detection unit 12f. do. In other words, the threshold output unit 12e sets the threshold so that an abnormality in the communication can be detected when a large amount of communication occurs with the same transmission source or the same transmission destination in a short period of time. As for the method of determining the threshold value from the statistical model, any existing method may be applied. For example, the threshold output unit 12e may specify the communication traffic for which the area of the extreme value distribution is 1% of the total, and set the specified communication traffic as the threshold. Further, for example, the threshold output unit 12e may specify an abnormal amount of traffic that occurs once a year, and set the specified traffic as a threshold.

In this way, the threshold output device 10 collects traffic data not only from the network for anomaly detection but also from a wide range of networks, so that statistical modeling can be performed based on a sufficient amount of data for statistical modeling. can. In addition, the threshold value output device 10 can set a threshold suitable for the network to be detected as an anomaly by re-learning the statistical model even with a relatively small amount of data collected from the network as an anomaly detected.

Here, an overview of threshold output processing by the threshold output device 10 will be described with reference to FIG. FIG. 4 is a diagram for explaining an overview of threshold output processing by the threshold output device according to the first embodiment. As illustrated in FIG. 4, the first acquisition unit 12a of the threshold value output device 10 collects traffic data from network lines wider than the network line for which anomaly detection is to be performed.

The generation unit 12b then performs statistical modeling on the traffic data acquired by the first acquisition unit 12a to obtain a statistical model. Subsequently, the second acquisition unit 12c acquires traffic data of the network targeted for anomaly detection.

Then, the update unit 12d updates the statistical model generated by the generation unit 12b using the traffic data acquired by the second acquisition unit 12c. After that, the threshold output unit 12e uses the statistical model updated by the update unit 12d to output a threshold for detecting communication anomalies in the network targeted for anomaly detection.

Returning to the description of FIG. 1, the detection unit 12f detects an abnormality in the network targeted for abnormality detection when communication exceeding the threshold output by the threshold output unit 12e occurs. Further, when detecting an anomaly in an anomaly detection target network, the detection unit 12f may output an alarm to the user terminal 20 to notify that an anomaly has occurred in the communication of the anomaly detection target network. For example, the detection unit 12f may output, as an alarm, a warning message indicating that the network targeted for anomaly detection is under DDoS attack, or may output a sound to notify the warning.

Further, for example, when the detection unit 12f detects an abnormality in the network targeted for abnormality detection, the detection unit 12f may issue an instruction to the communication device of the network targeted for abnormality detection to take measures against the abnormal communication. For example, when the detection unit 12f detects an anomaly in the network targeted for anomaly detection, the detection unit 12f bypasses communication of the network targeted for anomaly detection to an analysis device, identifies a source generating a large amount of communication, Communication from the specified source may be blocked.

In this manner, the threshold value output device 10 can detect anomalies in the network targeted for anomaly detection using an optimum threshold value. Further, when the threshold output device 10 detects an anomaly in the network to be anomaly detection target, it outputs an alarm to the user terminal 20 or issues an instruction to the communication device, thereby appropriately responding to the anomalous communication. measures can be taken.

[Processing Procedure of Threshold Output Device]
Next, an example of a processing procedure by the threshold value output device 10 according to the first embodiment will be described with reference to FIG. FIG. 5 is a flowchart showing an example of the flow of threshold output processing in the threshold output device according to the first embodiment.

First, the flow of threshold output processing in the threshold output device 10 will be described with reference to FIG. As exemplified in FIG. 5, when the first acquisition unit 12a acquires traffic data of network lines wider than the network line for which anomaly detection is to be performed (Yes at step S101), the first acquisition unit 12a adds null values to the acquired traffic data. Data pre-processing such as complementary processing and normalization processing is performed (step S102).

Subsequently, the generation unit 12b generates a statistical model using the traffic data acquired by the first acquisition unit 12a (step S103). Specifically, the generation unit 12b performs statistical modeling on the traffic data acquired by the first acquisition unit 12a to obtain a statistical model.

Then, the second acquisition unit 12c acquires traffic data of the network targeted for abnormality detection (step S104). Note that the second acquisition unit 12c may perform data preprocessing such as null value interpolation processing and normalization processing on the acquired traffic data, as in S102.

Subsequently, the updating unit 12d uses the traffic data acquired by the second acquiring unit 12c to update the statistical model generated by the generating unit 12b (step S105). Then, the threshold output unit 12e uses the statistical model updated by the update unit 12d to output a threshold for detecting communication anomalies in the anomaly detection target network (step S106).

(Effect of the first embodiment)
The threshold value output device 10 according to the first embodiment acquires traffic data of the second network including the first network for anomaly detection, and uses the acquired traffic data to generate a statistical model. Subsequently, the threshold output device 10 acquires traffic data of the first network and uses the acquired traffic data to update the generated statistical model. Then, the threshold output device 10 uses the updated statistical model to output a threshold for detecting communication anomalies in the first network. As a result, the threshold output device 10 can easily and accurately set a threshold for detecting abnormal traffic.

In other words, the threshold output device 10 collects traffic data from a wide range of networks in addition to the network targeted for anomaly detection, thereby obtaining a sufficient amount of data for statistical modeling without collecting long-term data. It is possible to obtain Also, the threshold output device 10 can perform statistical modeling based on a sufficient amount of data for statistical modeling. Furthermore, the threshold output device 10 can set a threshold suitable for the network to be anomaly detected by re-learning the statistical model even with a relatively small amount of data collected from the network to be anomaly detected. Therefore, the threshold output device 10 can easily and accurately set a threshold for detecting abnormal traffic.

(system configuration, etc.)
Also, each component of each device illustrated is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution and integration of each device is not limited to the one shown in the figure, and all or part of them can be functionally or physically distributed and integrated in arbitrary units according to various loads and usage conditions. Can be integrated and configured. Furthermore, all or any part of each processing function performed by each device is realized by a CPU or GPU and a program analyzed and executed by the CPU or GPU, or as hardware by wired logic can be realized.

In addition, among the processes described in the present embodiment, all or part of the processes described as being performed automatically can be performed manually, or the processes described as being performed manually can be performed manually. can also be performed automatically by known methods. In addition, information including processing procedures, control procedures, specific names, and various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified.

(program)
It is also possible to create a program in which the processing executed by the threshold value output device described in the above embodiment is described in a computer-executable language. For example, it is also possible to create a threshold output program in which the processing executed by the threshold output device 10 according to the embodiment is described in a computer-executable language. In this case, the same effects as those of the above embodiment can be obtained by executing the threshold output program by the computer. Furthermore, by recording such a threshold output program in a computer-readable recording medium and causing a computer to read and execute the threshold output program recorded in this recording medium, the same processing as in the above embodiment may be realized. good.

FIG. 6 is a diagram showing a computer that executes a threshold output program. As illustrated in FIG. 6, computer 1000 includes, for example, memory 1010, CPU 1020, hard disk drive interface 1030, disk drive interface 1040, serial port interface 1050, video adapter 1060, and network interface 1070. , and these units are connected by a bus 1080 .

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012 as illustrated in FIG. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). Hard disk drive interface 1030 is connected to hard disk drive 1090 as illustrated in FIG. Disk drive interface 1040 is connected to disk drive 1100 as illustrated in FIG. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100 . The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120 as illustrated in FIG. Video adapter 1060 is connected to display 1130, for example, as illustrated in FIG.

Here, as illustrated in FIG. 6, the hard disk drive 1090 stores an OS 1091, application programs 1092, program modules 1093, and program data 1094, for example. That is, the threshold output program described above is stored, for example, in the hard disk drive 1090 as a program module in which instructions to be executed by the computer 1000 are described.

Various data described in the above embodiments are stored as program data in the memory 1010 or the hard disk drive 1090, for example. Then, the CPU 1020 reads the program modules 1093 and program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 as necessary, and executes various processing procedures.

Note that the program module 1093 and the program data 1094 related to the threshold output program are not limited to being stored in the hard disk drive 1090. For example, they are stored in a detachable storage medium and read by the CPU 1020 via a disk drive or the like. good too. Alternatively, the program module 1093 and program data 1094 related to the threshold output program are stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.), and the network interface 1070 may be read by CPU 1020 via

The above-described embodiments and modifications thereof are included in the scope of the invention described in the claims and their equivalents, as well as in the technology disclosed in the present application.

10 threshold output device 11 communication processing unit 12 control unit 12a first acquisition unit 12b generation unit 12c second acquisition unit 12d update unit 12e threshold output unit 12f detection unit 13 storage unit 13a statistical model storage unit 20 user terminal 30 network

Claims (6)

a first acquisition unit that acquires traffic data of a second network including the first network for anomaly detection;
a generation unit that generates a statistical model using the traffic data acquired by the first acquisition unit;
a second acquisition unit that acquires traffic data of the first network;
an updating unit that updates the statistical model generated by the generating unit using the traffic data obtained by the second obtaining unit;
and a threshold value output unit that outputs a threshold value for detecting a communication abnormality in the first network using the statistical model updated by the update unit. 2. The threshold value output apparatus according to claim 1, wherein the generating unit generates, as the statistical model, a statistical model of extreme value distribution using extreme value statistics. 2. The apparatus according to claim 1, further comprising a detection unit that detects an abnormality in said first network when communication exceeding the threshold output by said threshold output unit occurs in said first network. threshold output device. 4. The threshold according to claim 3, wherein, when detecting an abnormality in the first network, the detection unit outputs an alarm notifying that an abnormality has occurred in communication of the first network. output device. A threshold output method performed by a threshold output device, comprising:
a first acquisition step of acquiring traffic data of a second network including the first network for anomaly detection;
a generating step of generating a statistical model using the traffic data obtained by the first obtaining step;
a second acquiring step of acquiring traffic data of the first network;
an updating step of updating the statistical model generated by the generating step using the traffic data obtained by the second obtaining step;
and a threshold value output step of outputting a threshold value for detecting a communication abnormality in the first network, using the statistical model updated by the update step. a first acquisition step of acquiring traffic data of a second network including the first network for anomaly detection;
a generating step of generating a statistical model using the traffic data obtained by the first obtaining step;
a second acquiring step of acquiring traffic data for the first network;
an updating step of updating the statistical model generated by the generating step using the traffic data obtained by the second obtaining step;
and a threshold output step of outputting a threshold for detecting an abnormality in communication in the first network using the statistical model updated by the update step.

Images