JP3697249B2 - Network status monitoring system and program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network monitoring technique.
[0002]
[Prior art]
An IDS (Intrusion Detection System) that detects various attacks on a network and generates an alert has been developed and used (for example, Patent Document 1). IDS generates an alert when an attack occurs on a device on the network.
[0003]
However, the conventional IDS is designed to respond sensitively to attacks so as not to miss the facts of the attacks. For this reason, a large number of alerts continue to be output from the IDS even in normal operation. Therefore, at present, in the field of security management, filtering is performed so that only alerts that are actually harmful are displayed on the monitoring device to notify the security administrator. Filtered alerts are discarded. Abandoned alerts are believed to contain important information, but how to use it has not been established.
[0004]
In order to effectively use alerts issued from IDS, it is possible to detect fraud by preparing a plurality of detection patterns according to intrusion patterns and comparing the generated alerts with the detection patterns. 1 is disclosed. In the monitoring system disclosed in Patent Document 1, there is a problem that an intrusion pattern that does not match a detection pattern prepared in advance cannot be detected.
[0005]
[Patent Document 1]
JP 2002-342276 A
[0006]
Conventionally, information output from a firewall device or each network device arranged on a network cannot be effectively used for managing the network state. Also, in the past, an overview of the entire information system, whether it is used normally, whether it is used abnormally at some sites, or whether it is used abnormally overall The method to grasp is not established.
[0007]
[Problems to be solved by the invention]
The present invention has been made in view of the above-described circumstances, and an object thereof is to provide a highly reliable network state monitoring system.
[0008]
[Means for Solving the Problems]
In order to achieve the above object, a network state monitoring system according to the first aspect of the present invention provides:
An intrusion detection means that is placed on the network, detects an attack on the network, and generates an alert when an attack is detected,
Alert information collecting means for collecting information for identifying an alert generated by the plurality of intrusion detecting means;
Model storage means for storing a model that associates an output pattern of an alert generated based on information about the alert collected by the alert information collection means and an action for the output pattern;
Alert history information acquisition means for acquiring history information of an alert that has occurred,
The combination of the alert specified by the alert history information acquired by the alert history information acquisition means is compared with the model stored in the model storage means, and if it matches any model, the registered action And if it does not match any model, an anomaly detection means for detecting an anomaly,
It is characterized by providing.
[0009]
For example, the model storage means stores a combination of output alert types and actions in association with each other, and the abnormality detection means identifies an attacker and an alert type when a new alert occurs. Then, from the alert history information stored in the alert history information acquisition means, the type of alert issued by the attacker in the past is obtained, and the combination of alert types issued by the attacker in the past and this time If the combination with the alert type matches one of the combinations of the alert types stored in the model storage means, the registered action is executed. Notify abnormalities.
[0010]
For example, the model storage unit stores the order of the types of output alerts in association with the actions, and the abnormality detection unit identifies the attacker and the type of alert when a new alert occurs. From the alert history information stored in the alert history information acquisition means, the order of the types of alerts issued by the attacker in the past is obtained, and the alert issued by the attacker in the past and the current alert If the order of the type matches with any of the types of alerts stored in the model storage means, the registered action is executed. Notice.
[0011]
For example, the model storage unit stores a time transition model of the output amount of the alert, and the abnormality detection unit stores the amount of the alert acquired by the alert history information acquisition unit and the time transition of the output amount of the alert. The model is compared, and an abnormality is notified based on the comparison result.
[0012]
Classification means for classifying (clustering) alert generators may be arranged based on the type of alert that has occurred. Further, there are means for determining the type and amount of alerts generated for each alert generator, and means for classifying alert generators with the same tendency into the same classification based on the types and amounts of alerts determined. You may arrange.
[0013]
A traffic volume measuring means for measuring the traffic volume is further arranged, the model storage means stores a model of time transition of the traffic volume, and the abnormality detecting means is configured to transmit the traffic volume measured by the traffic volume measuring means and The communication amount may be compared with a time transition model, and an abnormality may be notified based on the comparison result.
[0014]
Access amount measuring means for measuring the access amount is further arranged, the model storage means stores a model of time transition of the access amount, and the abnormality detection means is configured to store the access amount measured by the access amount measuring means. The access amount may be compared with the time transition model, and an abnormality may be notified based on the comparison result.
[0015]
In order to achieve the above object, a network state monitoring system according to the second aspect of the present invention provides:
An alert information collecting means for collecting information on the generated alert from a plurality of intrusion detecting means for generating an alert when an attack on the network is detected;
Model generating means for generating a model for associating an alert output pattern with an action for the output pattern based on the alert information collected by the alert information collecting means;
Alert history generation means for generating history information of an alert that has occurred based on the alert information collected by the alert information collection means;
It is characterized by providing.
[0016]
For example, the alert information collecting means collects information on alerts generated by intrusion detection means arranged in a plurality of local systems, and the model generating means is a plurality of local systems collected by the alert information collecting means. Based on the information of the generated alert, a means for generating a model that associates an output pattern of the alert with an action for the output pattern, a means for generating history information of the generated alert, and an abnormality detection device of each local system, Transmitting means for providing the generated model and history information.
[0017]
In order to achieve the above object, a network state monitoring system according to a third aspect of the present invention provides:
An alert receiving means for receiving an alert generated from an intrusion detecting means for detecting an attack on the network;
Model storage means for storing a model that associates an output pattern of the alert with an action for the output pattern;
Alert history storage means for storing history information of alerts generated by the intrusion detection means;
The alert information generated from the new alert received by the alert receiving means and the alert history stored in the alert history storage means is compared with the model stored in the model storage means, and any model If it matches, the registered action is executed, and if it does not match any model, an anomaly detection means for detecting an anomaly,
It is characterized by providing.
[0018]
In order to achieve the above object, a computer program according to the fourth aspect of the present invention provides:
A computer or group of computers
Alert information collection means that collects information on the generated alert from multiple intrusion detection means that generate an alert when an attack on the network is detected,
Model generation means for generating a model that associates an alert output pattern with an action for the output pattern based on the alert information collected by the alert information collection means;
Alert history generation means for generating history information of an alert that has occurred based on the alert information collected by the alert information collection means;
It is made to function as.
[0019]
In order to achieve the above object, a computer program according to the fifth aspect of the present invention provides:
Model storage means for storing a model that associates an output pattern of an alert with an action for the output pattern;
Alert history storage means for storing history information of alerts that have occurred,
An alert receiving means for receiving an alert from an intrusion detecting means for detecting an attack on the network;
The alert information generated from the new alert received by the alert receiving means and the alert history stored in the alert history storage means is compared with the model stored in the model storage means, and any model If it matches, the registered action is executed, and if it does not match any model, an abnormality detection means for detecting an abnormality,
To function as.
[0020]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, a network system including a network state monitoring system according to an embodiment of the present invention will be described.
[0021]
As shown in FIG. 1, the network system 11 according to this embodiment is connected to a plurality of local systems 21 (21-1 to 21-n) and the plurality of local systems 21 via a WAN (Wide Area Network) 25. The cyber attack response center 23 is provided.
[0022]
Each local system 21 includes one or a plurality of intrusion detection systems (IDS) 31, a firewall 33, an abnormality detection device 35, a router 37, and one or a plurality of network devices 39.
[0023]
Each IDS 31 abnormally alerts (alert information) indicating the attack source IP address, port number, attack target IP address, port number, attack content, etc. when there is any attack on the device in the local system 21 Output to the detection device 35.
[0024]
The abnormality detection device 35 determines the presence / absence of an abnormality in the local system 21 based on the alert output from the IDS 31, collects information on the generated alert, and notifies the cyber attack center 23. Further, system abnormalities in the local system 21 are detected, and the information is collected and notified to the cyber attack center 23.
[0025]
As shown in FIG. 2, the abnormality detection device 35 includes a control unit 111, a storage unit 112, a communication unit 113, an input unit 114, and a display unit 115.
[0026]
The control unit 111 is configured by a processor or the like, and performs an abnormality detection operation described later in accordance with an operation program stored in the storage unit 112.
Along with the operation program of the control unit 111, the storage unit 112 stores 1) an alert output pattern model, 2) an alert output sequential pattern model, 3) attacker information 1 and 2, and 4) a time transition model.
[0027]
Here, 1) the alert output pattern model is a model for associating a combination of alert types with an action corresponding thereto, as shown in FIG.
It is defined that when an alert of the type corresponding to “Conclusion” is generated, the corresponding “Action” is executed when the alert of the type with the flag “1” set earlier is output. To do.
[0028]
Further, 2) the alert output sequential pattern model is a model in which combinations of alert types are associated with actions corresponding thereto in consideration of the order of output as shown in FIG. It is defined that the corresponding “action” is executed when an alert occurs in the registered order.
[0029]
3) The attacker information 1 is information indicating which type of alert is generated for each attacker as shown in FIG. As shown in FIG. 3D, the attacker information 2 is information indicating the order in which alerts are generated for each attacker.
[0030]
4) As shown in FIGS. 4A to 4C, the time transition model is a model for predicting the total amount of alerts output from the IDS 31, the packet amount (traffic amount; traffic amount) determined by the router 37, etc. ) And a model for predicting the access amount (total access amount). For example, it is a model that predicts the total amount of alerts, the amount of communication packets (traffic amount; communication amount), and the amount of access based on past performance, with 1 day, 1 week, 1 hour, etc. as 1 time slot. .
[0031]
The communication unit 113 performs communication via various devices in the local system 21 and the WAN 25 via a LAN (local area network). The input unit 114 inputs various information, commands, and the like. The display unit 115 displays various information.
[0032]
The firewall 33 shown in FIG. 1 protects the local system 21 from the outside by restricting various accesses through the conditions or replacing the contents. For example, by looking at the IP address of the other party on the outside side, control (packet filtering) of allowing or not allowing passage is performed. It also controls whether or not to allow access (application gateway) depending on the protocol to be accessed (http, SMTP, ftp, telnet, etc.) and the access direction (from the local system to the outside or vice versa). Http is a protocol for sending and receiving websites. SMTP is a protocol for sending Internet mail. ftp is a file transfer protocol. Telnet is a protocol for logging into a server and performing operations. Further, the firewall 33 acquires the history of a session such as telnet or ftp, and provides the history information to the abnormality detection device 35.
[0033]
The router 37 enables communication between the local system 21 and the external WAN 25. The router 37 measures a communication amount (total amount of packets; traffic amount) between the local system 21 and the outside, and provides it to the abnormality detection device 35.
[0034]
The network device 39 includes a client terminal, a server device, and the like. The network device 39 accesses the inside of the local system 21 and communicates with the outside through the firewall 33 and the router 37. The IDS 31 monitors the status of access by the network device 39 and access to the network device.
[0035]
On the other hand, the cyber attack response center 23 is for appropriately updating the model stored in the storage unit 112 of each abnormality detection device 35 of each local system 21 and monitoring the entire network. A system (IDS) 31, an abnormality detection device 35, a firewall 33, a router 37, a monitoring device 41, an attacker management system 43, and a DB (database) server 45 are provided.
[0036]
The intrusion detection device (IDS) 31 to the router 37 are substantially the same as those arranged in the local system 21.
The monitoring device 41 is a device that monitors the network conditions of the entire system and each local system 21. For example, the above-described various models are generated by performing data mining processing using regression analysis or the like in batch processing. Then, it is delivered to the abnormality detection device 35 of each local system 21 at midnight or the like.
The attacker management system 43 registers the attackers to be watched based on the clustering results of the attackers described later (classification of the attackers who perform attacks of the same tendency).
[0037]
The DB server 45 includes a history of alerts issued from the IDSs 31 of the plurality of local systems 21, a history of notification of abnormality detection output from the abnormality detection devices 35 of the plurality of local systems 21, and a firewall 33 of the plurality of local systems 21. Information such as the output access frequency history and the total amount of communication packets output from the routers 37 of the plurality of local systems 21 is accumulated, and the history is acquired. The DB server 45 also accumulates information on system failures that have occurred in each local system 21.
[0038]
Next, a monitoring operation by the network state monitoring system having the above configuration will be described.
First, the abnormality detection operation by the abnormality detection device 35 in each local system 21 will be described with reference to the flowcharts of FIGS.
[0039]
First, when the IDS 31 detects an attack on any device in the local system 21, the occurrence time, the attacker (IP address, port number), the attacked (IP address, port number), and the content of the attack , Etc., and issue an alert. This alert is transmitted to the control unit 111 via the communication unit 113 of the abnormality detection device 35.
[0040]
In response to the alert, the control unit 111 starts the abnormality detection process shown in the flowchart of FIG. 5, and first identifies the content of the alert (attacker, attack target, type of alert) (step S11).
Next, the number of alerts in the current time slot is incremented by 1 (step S12).
Subsequently, abnormality detection based on the alert output pattern is performed (step S13).
Subsequently, abnormality detection is performed based on a sequential pattern of alert output (step S14).
[0041]
Next, the abnormality detection process based on the alert output pattern in step S13 will be described with reference to FIG.
First, the attacker information 1 stored in the storage unit 112 shown in FIG. 3C is searched using the alert attacker identified in step S11 as a key, and what alert the attacker has generated in the past. That is, the alert occurrence history is specified (step S21).
[0042]
Next, it is determined whether or not the combination of the specified past alert history and the current alert is registered in the alert output pattern model shown in FIG. 3A (step S22). That is, it is determined whether or not the alert combination of the current alert is “conclusion” and the alert combination with the past alert occurrence history as a condition is registered in the alert output pattern model (step S22).
[0043]
If registered, the action (ignore or alarm generation) set in the model is executed (step S23).
On the other hand, if not registered, an alarm is generated (step S24).
[0044]
Next, it is determined whether or not the current alert is registered in the attacker information 1 (step S25), and if not registered, it is registered (step S26).
[0045]
The above operation will be described based on a specific example. For example, the attacker information 1 immediately before a certain alert is generated is the content shown in FIG. 3C, and the alert output pattern model is the content shown in FIG. In this state, it is assumed that an alert C by the attacker β occurs.
[0046]
The control unit 111 searches the attacker information 1 using the attacker β as a key and obtains (1, 0, 0, 1...) For (alerts A, B, C, D...) (Step) S21). (It is assumed that the flag “1” indicates that the alert has occurred in the past).
[0047]
Next, on the condition of the determined past alert, it is determined whether or not the pattern resulting from the current alert matches any pattern registered in the alert output pattern model of FIG. Step S22). Then, it is determined that the pattern matches the pattern shown in the third row of FIG. Therefore, an “alarm” that is an action set in the row is executed, and an alarm indicating an abnormality is issued in step S23.
[0048]
Subsequently, it is determined whether or not the current alert is registered in the attacker information 1 (step S25). In this example, since the flag is not set for the combination of the attacker β and the alert C in FIG. 3C, a new flag is set and the attacker information 1 is set to (1, 0, 1, 1 (Step S26).
[0049]
Note that, if the determined past alert is a condition, the pattern resulting from the current alert does not match any of the patterns registered in the alert output pattern model of FIG. 3A (step S22; No) ) Is issued in step S24.
[0050]
Next, the abnormality detection process based on the sequential pattern of the alert output in step S14 will be described with reference to FIG.
First, the attacker information 2 shown in FIG. 3D is searched using the alert attacker identified in step S11 as a key, and the order in which the attacker has generated alerts in the past is identified ( Step S31).
[0051]
Next, an alert generated this time is added to the tail of the searched alert history (sequence) to generate a new alert sequence (step S32).
[0052]
Next, for the generated alert sequence, all sequential patterns that can be taken by the alert are created (step S33). If there are n alert sequences, first, any two are extracted and these sequential patterns are created. Next, arbitrary three are extracted to create these sequential patterns. . . . The same processing is repeated until n are extracted and a sequential pattern is created.
[0053]
Next, it is determined whether or not each of the sequential patterns that can be taken by the alert generated in step S33 matches one of the sequential models shown in FIG. 3B (step S34).
If there is a match, the action (ignore or alarm issuance) set in the model is executed (step S35). If a plurality of possible sequential patterns match the model, an action is executed for each of them.
[0054]
On the other hand, if there is no match, an alarm is generated (step S36). If there are multiple items that do not match, an alarm is generated for each.
Next, the current alert is registered in the attacker information 2 (step S37).
[0055]
The above operation will be described with a specific example. For example, the attacker information 2 immediately before a certain alert is generated is as shown in FIG. 3D, and the alert output sequential pattern model is shown in FIG. 3B. In this state, it is assumed that the alert C by the attacker β occurs.
[0056]
Then, the control unit 111 determines that the attacker is β and the alert is C (step S11), searches the attacker information 2 using the attacker β as a key (step S31), and the attacker β An attack sequence (in this example, alert A, alert D) is obtained. Next, the current alert is added to the end of the alert sequence to obtain a sequence (alert A, alert D, alert C) (step S32).
[0057]
This alert sequence is developed into possible sequential patterns (step S33), and four sequential patterns shown in FIG. 8A are obtained.
Next, it is determined whether or not any of the patterns matches any of the sequential models (step S34). In this example, since the pattern of the fourth row (alert A, alert D, alert C) matches the pattern of the third row of the alert output sequential pattern model, the action “alarm” registered there is executed ( Step S35). Subsequently, the current alert is added to the attacker information 2 and updated as shown in FIG. 8B (step S37).
[0058]
If any of the possible sequential patterns shown in FIG. 8A does not match any of the alert output sequential pattern models shown in FIG. 3B (step S34; No), the alarm is set in step S36. Issued at.
[0059]
Above, description of operation | movement of the abnormality detection apparatus 35 at the time of alert generation is complete | finished.
[0060]
On the other hand, the control unit 111 of the abnormality detection device 35 executes the process illustrated in FIG. 9 according to a timer interrupt or the like at a timing when a time slot set in advance based on the time transition model ends.
[0061]
First, it is determined to which time slot on the time transition model the current time belongs (step S41).
[0062]
Next, the number of alerts of the current time slot stored in the storage unit 112 (the one counted in step S12) is read (step S42), and the time transition alert model stored in the storage unit 112 ( 4A is read (step S43), and it is determined whether or not the number of alerts is out of the prediction range (step S44). For example, if the actual number of alerts is in the range of 2/3 to 4/3 of the number of alerts predicted by the prediction model, it is determined that this is within the predicted range. It is determined that the predicted range is deviated. If the actual number of alerts deviates from the predicted range, an alarm is generated (step S45). On the other hand, if it is within the prediction range, for example, nothing is done.
[0063]
Next, a history of packet input / output amount (number) is obtained by inquiring the router 37 (step S46), and the time transition prediction model of packet input / output amount shown in FIG. 4B is read from the storage unit 112 (step S47). ), It is determined whether or not the actual number of packets in the current time slot is out of the prediction range (step S48). For example, if the actual number of packets is in the range of 2/3 to 4/3 of the number of packets predicted by the prediction model, it is determined that this is within the predicted range. It is determined that the predicted range is deviated. When the actual number of packets deviates from the prediction range, an alarm is generated (step S49), and nothing is done when it is within the prediction range.
[0064]
Next, the firewall 33 is inquired to obtain the actual access frequency (amount) of telnet, ftp, etc. in the current time slot (step S50), and the access amount shown in FIG. The prediction model is read (step S51), and it is determined whether or not the access frequency is out of the prediction range (step S52). For example, if the actual access frequency is in the range of 2/3 to 4/3 of the access frequency predicted by the prediction model, it is determined that this is within the prediction range, and if it is outside this range, It is determined that the predicted range is deviated. If the actual access frequency deviates from the predicted range, an alarm is generated (step S53). On the other hand, if it is within the prediction range, nothing is done.
[0065]
Thus, the current interrupt process is completed.
[0066]
Next, the operation of the cyber attack response center 23 will be described.
As described above, the cyber attack response center 23 has two functions. The first is a process of appropriately updating the model stored in the storage unit 112 of each abnormality detection device 35 described above, and the second is a process of monitoring the entire local system 21.
[0067]
First, a process for generating and distributing a model will be described with reference to FIG. The DB server 45 accesses the abnormality detection devices 35 of all the local systems 21 at midnight or the like, and all the log information (alert log, packet input / output amount, number of error packets, unauthorized traffic and permitted). Even when there is a session such as telnet, login, ftp, etc., information on the log, the amount of incoming / outgoing packets, the number of error packets, etc.) and the information on the abnormality occurring in the local system 21 are acquired (step S61).
[0068]
On the other hand, the monitoring device 41 uses a data mining technique to associate the alert set and the result with the log collected and accumulated by the DB server 45 (step S62). Here, the alert group includes, for example, both a combination of alert types (the order is not a problem) and an alert sequence (the order is a problem).
[0069]
Next, the monitoring device 41 compares the result of the alert combination with an arbitrarily set criterion, and if the result is equal to or greater than the criterion (serious), sets “alarm occurrence” as an action, and the result is less than the criterion. If (minor), “ignore” is set as an action (step S63). For example, when it is determined that a serious result exceeding the reference occurs (highly likely) after a specific combination of alerts is established, “occurrence of alarm” is set as an action. On the other hand, if it is determined that nothing changes (highly likely) even if a specific combination of alerts is established, “ignore” is set as the action.
[0070]
Further, the monitoring device 41 sorts and arranges the alert history for each attacker, and updates the attacker information 1 and the attacker information 2 (step S64).
[0071]
In addition, the monitoring device 41 uses the collected alert history, communication packet amount, error packet amount, access amount and the like in each local system 21 to generate an alert amount, communication packet The expected value of the amount and the access amount is obtained (step S65). When obtaining this predicted value, the month, day, day of the week, etc. are taken into account. This is because attackers have a tendency to attack continuously for a certain period of time, a tendency to attack multiple attackers at the same time, and a tendency to attack on specific days and times. It is a thing. In this way, a time transition model is generated. Such a prediction is possible by, for example, regression analysis in which the month, day, day of the week, etc. are added to the explanatory variables.
[0072]
In this way, an alert output pattern model, an alert output sequential pattern model, and three time transition models are generated and distributed to each abnormality detection device 35 (step S66). Each abnormality detection device 35 receives these models and stores them in the storage unit 112.
[0073]
On the other hand, as shown in FIG. 11, the attacker management system 43 receives a log of alert information from the DB server 45 (step S71).
[0074]
Next, as shown in FIG. 11, the types of alerts for each attacker and how to generate the alerts are summarized as shown in FIG. 12, and how the alerts are generated is vectorized (step S72). That is, a vector having the number of occurrences for each type of alert as an element is generated. Vectorize how each attacker generates alerts. The generated vector is called a feature vector. For example, if it is attacker α of FIG. 12, the feature vector of (24, 20, 0, 0) will be obtained. Next, the attacker is clustered using the feature vector (step S73). In other words, the degree of similarity of each feature vector is obtained (for example, the inner product of unit vectors of feature vectors is obtained and those having a smaller inner product can be recognized as similar), and an attacker who makes a similar attack based on a certain standard The attackers are classified as a unit. Further, as illustrated in FIG. 13, the clustered attacker is visualized (step S74) and displayed on the display device in response to an operator request (step S75). The security administrator can see the classification results, understand the characteristics of the attacker, pick up the attacker who needs attention, and use it for future monitoring methods. By performing such processing, for example, it can be easily determined that the attackers α and γ in FIG. 12 are similar.
[0075]
Note that the method of vectorizing how alerts are generated is arbitrary. For example, each attacker can be expressed by the number of alerts generated per unit time.
[0076]
The monitoring device 41 monitors the entire network, detects an alarm signal from each local system 21, and determines an abnormal state for each local system 21 and for the entire network. In other words, an overview of the information system is used to determine whether it is being used normally, whether it is being used abnormally at some sites, or whether it is being used abnormally overall. To do. If necessary, the abnormality detection threshold value of each local system 21 is corrected, or the safety (network condensation) of the entire system is adjusted.
[0077]
For example, when an abnormal state is notified from the abnormality detection device 35 of a specific local system 21-k, the monitoring device 41 determines the network condition (how safe the information system is of the local system 21-k). The IDS 31 signature of the local system 21-k (which is a pattern of the characteristics of the packet presumed to be an attack) is instructed to switch to a signature for a higher risk state. In response to this instruction, the IDS 31 of the local system 21-k switches the signature.
[0078]
In addition, the monitoring device 41 raises the network condition of the information system when an abnormal state is notified from, for example, the abnormality detection devices 35 of a specific number or more of the local systems 21, for example, two or more local systems 21. Instruct to switch the signature of IDS 31 of each local system 21 to a signature for a more dangerous state. In response to this instruction, the IDS 31 of each local system 21 switches the signature.
[0079]
In this way, the monitoring device 41 gives an overview of the entire information system and determines whether it is used normally, whether it is used abnormally at some sites, or how it is used abnormally overall. If it is used normally, maintain its state (or lower the network condition) and use abnormally at some sites Raise the level of network conditions at the local site, and if the system is used abnormally as a whole, raise the network conditions of the information system as a whole to increase the safety of the information system as appropriate. Can do.
[0080]
As described above, according to this embodiment, the alert output log of the IDS 31 is used to represent each local system 21 using an alert output pattern model, an alert output sequential pattern model, an alert output amount transition model, and the like. It is possible to detect an abnormality in how the IDS 31 alert is output and to execute a corresponding action.
In addition, when an alert occurs, the alert output log of IDS 31 is used to register an abnormality in the pattern model by notifying either of the alert output pattern model and the alert output sequential pattern model. Can detect abnormalities.
[0081]
Further, it is possible to model the traffic (packet amount) of each local system 21 and detect a traffic abnormality at each site.
Furthermore, it is possible to model the state of the information system at a steady state (frequency of Telnet, ftp session, etc.) using the accumulated log of the firewall 33, and to detect an abnormal frequency of the session.
[0082]
Furthermore, by monitoring the entire system with the monitoring device and determining the network conditions of the entire system, actions such as changing the signature of the IDS 31 and changing the rule of the firewall 33 can be instructed uniformly.
Also, by classifying attackers by alert feature vectors, it becomes easier to identify attackers to watch.
[0083]
In addition, this invention is not limited to the said embodiment, A various deformation | transformation and application are possible.
[0084]
Further, by installing the program from the medium (flexible disk, CD-ROM, etc.) storing the above-described mouse pointer utility program in the computer or the computer group, that is, the above-mentioned operation is performed. A computer or the like that executes processing can be configured. Note that, when the OS realizes the above functions by sharing or jointly of the OS and the application, only the part other than the OS may be stored in the medium.
[0085]
It is also possible to modulate the carrier wave with a program signal and distribute it via communication.
[0086]
【The invention's effect】
As described above, according to the present invention, a highly reliable network state monitoring system can be provided.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a configuration example of a network including a monitoring system according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating a configuration example of the abnormality detection apparatus illustrated in FIG. 1;
FIG. 3 is a diagram illustrating an example of data stored in an abnormality monitoring device.
FIG. 4 is a diagram illustrating an example of data stored in an abnormality monitoring device.
FIG. 5 is a flowchart for explaining the operation of the abnormality detection apparatus when an alert is generated from IDS.
6 is a flowchart for explaining an abnormality detection operation based on an alert output pattern model in the flowchart of FIG. 5;
7 is a flowchart for explaining an abnormality detection operation based on a sequential pattern model of alert output in the flowchart of FIG. 5;
8A is a diagram for explaining processing for obtaining a sequential pattern that can be taken by an alert executed in step S33 in FIG. 7, and FIG. 8B is a diagram showing an updated state of attacker information 2. FIG. It is.
FIG. 9 is a flowchart for explaining abnormality detection processing based on a time transition model.
FIG. 10 is a diagram for explaining model update processing;
FIG. 11 is a diagram for explaining processing for clustering attackers;
FIG. 12 is a diagram for explaining a process for clustering attackers;
FIG. 13 is a diagram for explaining an example in which attackers are clustered and visualized.
[Explanation of symbols]
21 Local system
23 Cyber Attack Response Center
33 Firewall
35 Anomaly detection device
37 routers
41 Monitoring device
43 Attacker management system
45 DB server

Claims (13)

An intrusion detection means that is placed on the network, detects an attack on the network, and generates an alert when an attack is detected,
Alert information collecting means for collecting information for identifying an alert generated by the plurality of intrusion detecting means;
Model storage means for storing a model that associates an output pattern of an alert generated based on information about the alert collected by the alert information collection means and an action for the output pattern;
Alert history information acquisition means for acquiring history information of an alert that has occurred,
The combination of the alert specified by the alert history information acquired by the alert history information acquisition means is compared with the model stored in the model storage means, and if it matches any model, the registered action And if it does not match any model, an anomaly detection means for detecting an anomaly,
A network state monitoring system comprising: The model storage means stores a combination of an output alert type and an action in association with each other,
The anomaly detection means identifies an attacker and the type of alert when a new alert occurs, and causes the attacker to issue in the past from the alert history information stored in the alert history information acquisition means. The combination of the alert type issued by the attacker in the past and the present alert type is one of the alert type combinations stored in the model storage means. If it matches, execute the registered action, and if it does not match any of them, notify the abnormality.
The network state monitoring system according to claim 1. The model storage means stores the order of the types of output alerts in association with actions,
The anomaly detection means identifies an attacker and the type of alert when a new alert occurs, and causes the attacker to issue in the past from the alert history information stored in the alert history information acquisition means. The order of the types of alerts obtained is determined, and the order of the types of alerts issued by the attacker in the past and the alerts of this time match one of the orders of types of alerts stored in the model storage unit In the case, the registered action is executed, and if it does not match any of them, an abnormality is notified.
The network state monitoring system according to claim 1 or 2, characterized in that The model storage means stores a time transition model of an alert output amount,
The abnormality detection means compares the amount of alert acquired by the alert history information acquisition means with a model of time transition of the output amount of the alert, and notifies the abnormality based on the comparison result.
The network state monitoring system according to claim 1, 2 or 3. The network state monitoring system according to any one of claims 1 to 4, further comprising a classifying unit that classifies an alert generator based on a type of an alert that has occurred. A means for determining the type and amount of alerts generated for each alert generator, and a classifying means for classifying those who generate alerts of the same tendency into the same classification based on the types and amounts of alerts determined. The network state monitoring system according to claim 1, further comprising: A communication amount measuring means for measuring the communication amount;
The model storage means stores a model of time transition of the traffic volume,
The abnormality detection unit compares the communication amount measured by the communication amount measurement unit with a model of time transition of the communication amount, and notifies the abnormality based on the comparison result.
The network state monitoring system according to any one of claims 1 to 6. It further comprises an access amount measuring means for measuring the access amount,
The model storage means stores a model of time transition of the access amount,
The abnormality detection unit compares the access amount measured by the access amount measurement unit with a model of time transition of the access amount, and notifies the abnormality based on the comparison result.
The network state monitoring system according to any one of claims 1 to 7, wherein An alert information collecting means for collecting information on the generated alert from a plurality of intrusion detecting means for generating an alert when an attack on the network is detected;
Model generating means for generating a model for associating an alert output pattern with an action for the output pattern based on the alert information collected by the alert information collecting means;
Alert history generation means for generating history information of an alert that has occurred based on the alert information collected by the alert information collection means;
A network state monitoring system comprising: The alert information collecting means collects information on alerts generated by intrusion detection means arranged in a plurality of local systems,
The model generating means generates a model for associating an alert output pattern with an action for the output pattern, based on the alert information generated in the plurality of local systems collected by the alert information collecting means, Means for generating history information of the alert, and transmission means for providing the generated model and history information to the abnormality detection device of each local system,
The network state monitoring system according to claim 9. An alert receiving means for receiving an alert generated from an intrusion detecting means for detecting an attack on the network;
Model storage means for storing a model that associates an output pattern of the alert with an action for the output pattern;
Alert history storage means for storing history information of alerts generated by the intrusion detection means;
The alert information generated from the new alert received by the alert receiving means and the alert history stored in the alert history storage means is compared with the model stored in the model storage means, and any model If it matches, the registered action is executed, and if it does not match any model, an anomaly detection means for detecting an anomaly,
A network state monitoring system comprising: A computer or group of computers
Alert information collection means that collects information on the generated alert from multiple intrusion detection means that generate an alert when an attack on the network is detected,
Model generation means for generating a model that associates an alert output pattern with an action for the output pattern based on the alert information collected by the alert information collection means;
Alert history generation means for generating history information of an alert that has occurred based on the alert information collected by the alert information collection means;
A computer program that functions as a computer program. A computer or group of computers
Model storage means for storing a model that associates an output pattern of an alert with an action for the output pattern;
Alert history storage means for storing history information of alerts that have occurred,
An alert receiving means for receiving an alert from an intrusion detecting means for detecting an attack on the network;
The alert information generated from the new alert received by the alert receiving means and the alert history stored in the alert history storage means is compared with the model stored in the model storage means, and any model If it matches, the registered action is executed, and if it does not match any model, an abnormality detection means for detecting an abnormality,
A computer program that functions as a computer program.

Images