JP4096264B2 - Threat detection device, threat detection method, and program - Google Patents

Description

  The present invention relates to a threat detection device, a threat detection method, and a program, and more particularly, to a threat detection device, a threat detection method, and a program for analyzing a threat to a network.

  In recent years, as seen in the explosive spread of the Internet, opportunities to use networks have increased rapidly. By using the network, users can use various services on the network, which improves convenience, but threats to use the network, such as unauthorized access and virus infection, have also increased dramatically. ing. Therefore, there is a demand for a technology that can recognize a threat in the use of a network and ensure security.

As a technique for ensuring security by detecting unauthorized access from the outside, Patent Document 1 describes a technique using an unauthorized intrusion detection device. The unauthorized intrusion detection apparatus includes traffic monitoring means for observing network traffic and packet analysis means for performing unauthorized access analysis on whether a packet is an unauthorized access packet with respect to a predetermined analysis item. In the unauthorized intrusion detection apparatus, the packet analysis means determines which analysis item is to be subjected to unauthorized access analysis based on the traffic value observed by the traffic monitoring means, and detects unauthorized access from the outside.
JP 2003-204358 A (FIG. 1, paragraph 0005)

  By the way, threat measurement in risk analysis has conventionally had no quantitative calculation method, and it was necessary to perform qualitative analysis assuming a threat for each information asset. For this reason, there is a problem that it takes time to analyze the threat. In addition, when the analysis is performed by a plurality of people, there is a problem that the analysis varies because the analysis workers have different ways of thinking. Furthermore, since each threat is captured for each information asset, there is a problem that it becomes a local viewpoint and it is difficult to recognize the threat as the entire network.

  The present invention eliminates the above-mentioned problems of the prior art, can quantitatively analyze network threats, and can detect threats as a whole network, a threat detection device, a threat detection method, and a program. The purpose is to provide.

  In order to achieve the above object, a threat detection apparatus of the present invention collects an access amount between resources generated between resources on a network in a threat detection apparatus that detects threats in a network connecting a plurality of resources. An access amount collection unit, an access state creation unit that creates current access state data in the network based on the access amount between resources collected by the access amount collection unit, and stores the access state data in a storage device, and the access state data creation Analyzing the current access status data created by the unit, detecting a threat to the network based on the analysis result, and detecting the occurrence of the threat by the threat detection unit, And a notification unit for notifying that it has occurred.

  The threat detection method of the present invention is a threat detection method for detecting a threat to a network connecting a plurality of resources using a computer, wherein the computer collects an access amount between resources generated between resources on the network. And the computer creates current access status data in the network based on the access amount between resources collected by the access amount collection step and stores it in a storage device, and the computer Analyzing the current access status data created in the status data creation step, detecting the occurrence of a threat to the network based on the analysis result, and detecting the occurrence of the threat by the computer in the threat detection step And that the threat has occurred Characterized by a step.

  In the threat detection apparatus and method of the present invention, since the occurrence of threats to the network is detected by analyzing the access status data indicating the access status between each resource, a quantitative judgment can be made based on the collected access amount. It is. Moreover, since the entire network is regarded as a plane according to the access status between resources, the threat of the entire network can be recognized.

  In the threat detection device of the present invention, the access amount collection unit collects at least one of an access data amount and an access count generated between each resource during a predetermined unit time dt as the inter-resource access amount, The access status creation unit is configured to obtain current access status data based on a difference between the access amount of the unit time dt collected by the access amount collection unit and the access amount per unit time dt between resources at normal time. It is preferable to create In this case, it can be recognized that a threat has occurred in a resource whose access amount has increased compared to the normal access amount.

  In the threat detection apparatus according to the present invention, the access status creation unit is a matrix of n rows and n columns, where n is the total number of resources, and the access status data is a column with one of the access source and the access destination as a column and the other as a row. Therefore, it is preferable that each element is created as a matrix having the difference. In this case, it can be recognized that a threat has occurred to a specific resource by comparing values for each element, each row, and each column.

In the threat detection device according to the present invention, each element of the matrix of n rows and n columns is changed from the i-th resource (1 ≦ i ≦ n) to the j-th resource (1 ≦ j ≦ n). An inter-resource access amount between resources generated during a time t1 longer than dt is A _ij, and the unit time dt for the j-th resource from the i-th resource collected by the access amount collection unit _Assuming that the access amount is B _ij
C _ij = B _ij − (dt / t1) × A _ij
It is possible to adopt the configuration calculated by The amount of access per unit time dt between elements during normal operation is defined as (dt / t1) × A _ij, and each element of the matrix can be defined in this way.

  In the threat detection device of the present invention, as a result of analyzing the access status data, the threat detection unit determines that a value of a specific element of the matrix of n rows and n columns is larger than other elements. A configuration that detects the occurrence of a threat can be adopted. For example, if an unauthorized access occurs, the amount of access from one specific resource to another specific resource will be significantly larger than the amount of access between other resources, and the value of a specific element will increase. . Therefore, the threat detection device can detect the occurrence of a threat when unauthorized access occurs by comparing the values of the respective elements.

  In the threat detection device of the present invention, as a result of analyzing the access status data, the threat detection unit has a larger total value of specific columns of the n-by-n matrix than a total value of other columns. If it is determined, a configuration for detecting the occurrence of a threat can be employed. For example, if a specific resource is exposed to distributed attacks (DDoS), the amount of access to the specific resource from other resources is larger than the amount of access to the other resource, and it corresponds to the specific resource. It is considered that the sum of the elements in the column to be larger than the sum of the elements in the other columns. Therefore, the threat detection device can detect the occurrence of a threat when a distributed attack occurs by comparing the total value of each column with each other.

  In the threat detection device of the present invention, as a result of analyzing the access status data, the threat detection unit has a larger total value of specific rows of the matrix of n rows and n columns than a total value of other rows. If it is determined, a configuration for detecting the occurrence of a threat can be employed. For example, if a specific resource is infected with a virus and the virus is infecting other resources, the amount of access from the specific resource to the other resource becomes the amount of access from the other resource. It is considered that the total of rows corresponding to a specific resource is larger than the sum of other rows. Therefore, the threat detection device can detect the occurrence of a threat when a virus infection occurs by comparing the total value of each row with each other.

  The program of the present invention is a program for a computer for detecting a threat to a network connecting a plurality of resources, and collecting the access amount between resources generated between each resource on the network in the computer. , A step of creating current access status data in the network based on the access amount between resources collected in the access amount collecting step and storing it in a storage device; and a current access created in the access status data creating step Analyzing the status data, detecting the occurrence of a threat to the network based on the result of the analysis, and detecting the occurrence of a threat when the threat detection step detects the occurrence of the threat It is characterized by making it.

  In the threat detection device, the threat detection method, and the program of the present invention, in order to detect the occurrence of a threat to the network by analyzing the access status data indicating the access status between the resources, based on the collected access amount, Quantitative judgment can be made and the threat of the entire network can be recognized.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a functional block diagram showing the configuration of a threat detection apparatus according to an embodiment of the present invention. The threat detection apparatus 100 includes an access amount collection unit 101, an access status creation unit 102, a threat detection unit 103, a notification unit 104, and an access status storage unit 105. The threat detection device 100 is configured as a computer system such as a workstation, for example, and operates based on a predetermined program so that an access amount collection unit 101, an access status creation unit 102, a threat detection unit 103 are installed on the computer system. And the notification part 104 is implement | achieved.

  The threat detection device 100 monitors the access status in the network and monitors whether the network is exposed to threats due to unauthorized access, viruses, or the like. The network to be monitored is configured as a network that performs packet communication. In addition, if the network to be monitored is broken down into elements, for example, in units of departments, services, or systems, and each decomposed element is an information asset, each information asset in the managed network It is always connected in a network with In the monitored network, the amount of access between each asset is analyzed by analyzing the packets that flow on the network at the connection node between each asset and the packet switching network, and measuring the communication source and communication difference of each packet. A device such as a LAN analyzer is installed. The access amount is defined by the data amount or the number of accesses.

  The access amount collection unit 101 collects an access amount between each asset from a device such as a LAN analyzer in-band or out-band by, for example, polling processing. The access status creation unit 102 creates access status data indicating the access status between each asset based on the access amount between each asset collected by the access amount collection unit 101, and stores this in the access status storage unit 105. . The threat detection unit 103 refers to the access status and analyzes it to determine whether the network to be monitored is exposed to a threat. For example, the threat detection unit 103 prepares in advance a condition for determining that the network is in a dangerous state in a storage device (not shown), and whether or not the current access status corresponds to the dangerous state. Detecting threats that occur on the network. Upon receiving the threat detection, the notification unit 104 displays, for example, that a threat has occurred on the display screen, and notifies the network administrator of the occurrence of the threat.

  FIG. 2 shows a network to be monitored. In the figure, the network to be monitored has three information assets. Hereinafter, with reference to FIG. 1 and FIG. 2, the operation of the threat detection device 100 when quantitatively determining the threat of the network in a certain unit time dt will be described in detail.

The access status creation unit 102 periodically collects the access amount between each information asset generated in the unit time dt from the access amount collection unit 101. Collected access in this way from one information asset i (i: natural number less than the number of information assets) to another information asset j (j: natural number less than the number of information assets) in unit time dt The quantity is defined as B _ij . For example, in FIG. 2, the access amount generated from the information asset 1 to the information asset 3 is defined as B ₁₃ . Based on the access amount between each information asset per unit time dt when the network is in a normal state and the access amount B _ij between each information asset per unit time dt collected. The access status data is created and stored in the access status storage unit 105.

The amount of access between information assets in unit time dt when the network is normal is defined as described below, for example. First, A _ij is measured for the access amount generated from the information asset i to the information asset j during an arbitrary time t1 that is sufficiently longer than the unit time dt. Here, it is assumed that each information asset does not generate access to itself, and Aii where i = j is all 0. Next, the access amount A _ij between the measured information assets is multiplied by (dt / t1), and (dt / t1) × A _ij is accessed per unit time dt in a normal state between the information assets. Define as quantity.

For example, assuming that the increase in the access amount is a threat, the difference between the current access amount and the access amount in the normal state is calculated as C _ij = B _ij − (dt / t1) between the information assets of the monitored network. ) × A _ij The access status creating unit 102 stores the i-row / j-column matrix C having C _ij defined in this way as elements in the access status storage unit 105 as the access status. The threat detection unit 103 checks the access status stored in the access status storage unit 105 to check whether a threat has occurred on the network.

For example, when an unauthorized access occurs in the network, the amount of access from a specific information asset x to another specific information asset y is prominently larger than the access amount between other information resources. Conceivable. In the matrix C, the threat detection unit 103 stores a state in which a specific element C _ij protrudes and is larger than other elements as a “dangerous state”. If the threat detection unit 103 determines that the specific element of the matrix C stored in the access status storage unit 105 has a value that is, for example, more than twice the average of other elements, the threat detection unit 103 detects the occurrence of the threat. This is input to the notification unit 104. The notification unit 104 displays a warning indicating that “unauthorized access has occurred” on the display screen to alert the network administrator.

  Further, when a specific information asset of the network is exposed to a distributed attack (DDos), the access amount to the specific information asset is considered to be larger than the access amount to other information assets. The threat detection unit 103 stores, as a “dangerous state”, a state in which the total value of elements in a specific column protrudes higher than the total value of elements in other columns in the matrix C. . When the threat detection unit 103 determines that the total value of a specific column of the matrix C stored in the access status storage unit 105, for example, exceeds twice the average of the total values of other columns, for example, the threat detection unit 103 detects the occurrence of a threat. This is input to the notification unit 104. The notification unit 104 displays a warning indicating that “there is an information asset subject to a distributed attack” on the display screen, and alerts the network administrator.

  When there is an information asset infected with a virus in the network and the virus is infecting other information assets, the amount of access from a specific information asset is larger than the amount of access from other information assets. It is considered to be. In the matrix C, the threat detection unit 103 stores a state in which the total value of elements in a specific row protrudes as the total value of elements in other rows as a “dangerous state”. If the threat detection unit 103 determines that the total value of elements in a specific row of the matrix C stored in the access status storage unit 105 exceeds, for example, twice the total value of other rows, the threat detection unit 103 detects the occurrence of the threat. This is input to the notification unit 104. The notification unit 104 displays a warning indicating that “there is an information asset infected with a virus” on the display screen, and alerts the network administrator.

  In the present embodiment, since threats to the network can be determined quantitatively using the access amount, it is possible to prevent a situation in which the determination of threats varies among observers. In addition, since the quantitative value can be analyzed using a computer, the threat analysis work can be automated. For this reason, it is possible to analyze threats in near real time, and countermeasures can be taken immediately and automatically.

  In the present embodiment, the threat detection unit 103 detects a threat to the network based on the access status stored in the access status storage unit 105. The access status storage unit 105 has an access status between resources in the entire network as a matrix, and by analyzing such a matrix, various threats are recognized not as a local viewpoint but as a whole network. can do.

  In the above-described embodiment, the value of a specific element, column, or row in the matrix protrudes and is larger than the value of another element, column, or row. Alternatively, the determination is made by comparing with the average value of the row, but the present invention is not limited to this. For example, instead of the average value, a median (median value) or mode (mode) may be used for comparison.

  Although the present invention has been described based on the preferred embodiments, the threat detection device, the threat detection method, and the program of the present invention are not limited to the above-described embodiment examples. Those in which various modifications and changes have been made to the configuration are also included in the scope of the present invention.

The block diagram which shows the structure of the threat detection apparatus of one Embodiment of this invention. The block diagram which shows the network of a monitoring object.

Explanation of symbols

100: Threat detection device 101: Access amount collection unit 102: Access status creation unit 103: Threat detection unit 104: Notification unit 105: Access status storage unit

Claims (9)

In a threat detection device for detecting a threat in a network connecting a plurality of resources,
An access amount collection unit that collects an access amount between resources generated between resources on the network;
Based on the access amount between resources collected by the access amount collection unit, an access state creation unit that creates current access state data in the network and stores it in a storage device;
A threat detection unit that refers to current access status data created by the access status creation unit, analyzes the amount of access between resources , and detects the occurrence of a threat to the network based on the analysis result; ,
When a threat occurrence is detected by the threat detection unit, a threat detection apparatus comprising: a notification unit that notifies that a threat has occurred. The access amount collection unit collects at least one of an access data amount and an access count generated between each resource during a predetermined unit time dt as the inter-resource access amount,
The access status creation unit is configured to determine a current access status based on a difference between the access amount of the unit time dt collected by the access amount collection unit and an access amount per unit time dt between resources at normal time. The threat detection device according to claim 1 which creates data.   The access status creation unit is a matrix of n rows and n columns, where n is the total number of resources, and the access status data has one of the access source and the access destination as columns and the other as rows. The threat detection apparatus according to claim 2, wherein the threat detection apparatus is created as a matrix. Each element of the matrix of n rows and n columns is a time t1 longer than the unit time dt from the i-th (1 ≦ i ≦ n) resource to the j-th (1 ≦ j ≦ n) resource. A _ij is an access amount between resources between the resources generated during, and an access amount of the unit time dt from the i-th resource collected by the access amount collection unit to the j-th resource is B _ij .
C _ij = B _ij − (dt / t1) × A _ij
The threat detection device according to claim 3, calculated by:   The threat detection unit detects the occurrence of a threat when determining that the value of a specific element of the matrix of n rows and n columns is larger than other elements as a result of analyzing the access status data. Item 5. The threat detection device according to Item 4.   As a result of analyzing the access status data, the threat detection unit determines that the total value of a specific column of the matrix of n rows and n columns is larger than the total value of other columns, and detects the occurrence of a threat. The threat detection device according to claim 4, which detects the threat.   As a result of analyzing the access status data, the threat detection unit determines that the total value of a specific row of the matrix of n rows and n columns is larger than the total value of other rows, and detects the occurrence of a threat. The threat detection device according to claim 4, which detects the threat. In a threat detection method for detecting a threat to a network connecting a plurality of resources using a computer,
The computer collects an access amount between resources generated between resources on the network;
The computer creates current access status data in the network based on the access amount between resources collected by the access amount collection step and stores it in a storage device;
The computer refers to the current access status data created in the access status data creation step, analyzes the amount of access between the resources , and detects the occurrence of a threat to the network based on the analysis result And steps to
A threat detection method comprising: when the occurrence of a threat is detected by the threat detection step, the computer notifying that the threat has occurred. A program for a computer for detecting a threat to a network connecting a plurality of resources, the computer comprising:
Collecting the amount of access between resources generated between resources on the network;
Based on the access amount between resources collected by the access amount collecting step, creating current access status data in the network and storing it in a storage device;
Referring to the current access status data created in the access status data creation step, analyzing the inter-resource access amount mutually, and detecting the occurrence of a threat to the network based on the analysis results;
When the occurrence of a threat is detected by the threat detection step, a program for notifying that the threat has occurred is executed.

Images