JP4328679B2 - Computer network operation monitoring method, apparatus, and program - Google Patents

Description

  The present invention relates to an operation monitoring method, apparatus, and program for monitoring unauthorized intrusion into a computer network.

  With the development of computers and telecommunications networks, data communication has become very popular. Not only companies but also general individuals are connected to the Internet, download various information, and set up their own web pages to transmit information.

  Since the Internet can be used by anyone, some malicious individuals can spread computer viruses, illegally access computers to steal personal information and confidential information, alter web pages, and send to specific servers An attack has occurred that makes it impossible to use it. For this reason, establishment of security for protecting computers and networks is required. Devices to prevent unauthorized access include firewall computers (Fire Wall: FW, hereinafter referred to as “firewalls”) and unauthorized intrusion detection devices (Intrusion Detection System) that detect unauthorized access by monitoring data flowing through the internal network. IDS) is known. SNMP (Simple Network Management Protocol), which is a protocol for monitoring a device connected to an internal network, is known as one that is not intended to prevent direct unauthorized access but is useful for network monitoring. A brief description of these will be given.

(1) Firewall A firewall is a computer provided between an external network such as the Internet and an internal network such as a local area network (LAN). An external network that is open and therefore not necessarily reliable, like a corporate network. It is a device equivalent to a “firewall” that is separated from a highly confidential internal network and protects the internal network from malicious attacks.
The firewall manages the relay of data (packets) according to the policy (rule) as intended by the administrator, and rejects the relay of data that does not conform to the rules, thereby preventing unauthorized data from flowing to the internal network. be able to. Specifically, the firewall performs processing such as access restriction, address conversion, log collection / analysis, and routing.
A firewall alone cannot guarantee complete security. This is because a firewall can deny unauthorized access, but there is a method of unauthorized access using permitted access. For example, many attacks that exploit bugs in server programs are used to alter web pages, but firewalls cannot prevent such attacks. Also, DoS (Denial of Services: Attacks that stop services by sending illegal data to routers and servers, or increase traffic, which is called “Service Stop Attack”) and DDos (Distributed Denial of Services: Attacks) An attack such as a DoS attack by multiple computers involving a user's computer without the intention of the user) cannot be prevented by a firewall.

(2) Intrusion Detection System (IDS)
Also called unauthorized access monitoring system / intrusion detection system, it is a device that monitors packets flowing through the network, displays an alarm when a packet that seems to be unauthorized access is found, and collects and stores the communication records . Can detect Dos attacks and DDos attacks.
There are two types of IDS: network type monitoring (for monitoring packets on the network) and server type monitoring (for monitoring server I / O packets). IDS unauthorized access detection methods include “signature” -based intrusion detection (a technique that detects intrusions by matching intrusion signature patterns called pre-registered signatures) and statistical-based intrusion detection (normally There is a method to detect the behavior different from the above).
IDS is effective for intrusion detection, but has other limitations. For example, it is necessary to pay attention to the following points.
-Even if IDS can detect a suspicious packet, it cannot detect the impact that the packet has on the target server, and whether or not the fraud by the communication was successful.
-As the network speeds up, capturing loss may occur or the speed of packet signature analysis may not be able to follow.
-There are many false detections / excessive detections and there are many cases where they are detected as attacks despite normal communication.

(3) SNMP
SNMP (Simple Network Management Protocol) is one of communication protocols for managing network devices. SNMP is an ordinary protocol for exchanging management information between a device to be managed on the network and a device (referred to as a management station) that manages the device. UDP is used for communication, which can be said to be a management protocol standard based on TCP / IP.
In SNMP, software called an agent resides in a management target device and software called a manager resides in a management station to perform communication. There are five types that can be managed: network device performance, configuration, failure, security, account, etc. (these are examples. SNMP management targets are not limited to these). The manager and the agent store these management information in a database called MIB (Management Information Base). In response to a request from the manager, the agent transmits necessary information from the MIB.
In order to process and graph the data acquired from the SNMP agent, a tool called MRTG (Multi Router Traffic Grapher) is used. According to MRTG, the management information can be converted into a graph image and viewed with a Web browser.

  In addition to SNMP, a log from a computer equipped with anti-virus software, a log of a mail server, or the like can be used to acquire information (log) related to the network status. In the present specification, these and their equivalents may be collectively referred to as “SNMP etc.”.

The following Patent Document 1 discloses firewall technology. The following Patent Document 2 discloses an unauthorized intrusion detection device (IDS).
JP-A-11-167538 JP 2004-164107 A

  Firewalls, unauthorized intrusion detection devices (IDS), SNMP, etc. (including those other than SNMP that can acquire information (logs) on the state of the network. For example, anti-virus software logs, mail server logs, etc.) Although it is effective for detecting unauthorized access, it cannot completely prevent unauthorized access. As mentioned above, firewalls cannot prevent DoS attacks and DDos attacks, and unauthorized intrusion detection devices (IDS) cannot completely prevent unauthorized access due to unknown intrusion techniques, and there are many false positives / excessive detections. In spite of normal communication, there is also a problem that many cases are detected as attacks. SNMP is simply for managing network devices, and even if management information is graphed by MRTG, unauthorized access cannot be detected unless it is an experienced and effective operator. Moreover, the amount of traffic varies greatly depending on where the switch is located, and it is difficult to understand just by displaying it.

  Since firewalls, unauthorized intrusion detection devices (IDS), and SNMP each have advantages and disadvantages, it has been found that it is preferable to effectively detect unauthorized access by combining these to comprehensively monitor and judge. In the prior art, unauthorized access is prevented solely by a firewall alone, or unauthorized access is detected by an unauthorized intrusion detection device (IDS) alone. It has been found that incident analysis by network monitoring is preferable (totally monitoring firewalls, unauthorized intrusion detection devices, and SNMP itself is a new attempt).

  Therefore, the firewall and unauthorized intrusion detection device (IDS) log and SNMP management information are displayed as a graph on the same screen. A plurality of events included in the log and management information are displayed as a time-series graph. The vertical axis (the horizontal axis is the time axis) is the absolute amount of each event. This should allow comprehensive monitoring on a single screen. However, it is difficult to understand simply by displaying together logs obtained from devices of different properties. For example, some events change frequently and others rarely change. The former is easy to understand, but the latter is difficult to understand. It has been found that it is difficult to simply use a firewall and an intrusion detection device (IDS) log and SNMP management information as a graph on the same screen.

  SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and a computer network operation monitoring method and apparatus that can easily monitor the log of the firewall and the intrusion detection device (IDS) and the management information of the SNMP easily. The purpose is to provide a program.

The present invention includes an external network such as the Internet and an internal network such as a local area network (LAN) (herein, the internal network means a network that does not disclose resources to the outside as compared to the Internet), A firewall computer (Fire Wall: FW, hereinafter referred to as “firewall”) that is provided between the external network and the internal network and controls relaying of data between the networks based on a predetermined rule; An intrusion detection system (IDS) that monitors flowing data and detects unauthorized access, and a method for monitoring intrusion in a system comprising:
A data source receiving step for receiving logs from the firewall and the intrusion detection device;
A change amount calculating step for obtaining a change amount of data related to a plurality of events included in the log;
A display step of displaying the amount of change related to the plurality of events as a time-series graph.

For the event included in the log, for example, the amount of change is obtained as follows.
・ Analysis of deviations from normal values using deviations ・ Analysis of deviations from normal values based on probability of distribution Normally, logs of the firewall and the intrusion detection device are usually recorded for each event (security event or port access). Since the frequency of occurrence is different, it is difficult to find abnormalities in events with low frequency of occurrence simply by analyzing quantitative changes. By focusing on the amount of change of each event, the deviation from the normal can be analyzed regardless of the frequency of event occurrence.
The method of detecting the amount of change is also applied to SNMP (CPU, Traffic ...). Management data such as logs and SNMP of the firewall and the intrusion detection device cannot be analyzed on the same axis because the data contents are different. However, by focusing on the amount of change (differentiation), it has become possible to analyze data with different personalities in a correlated and comprehensive manner.

Examples of the system include SNMP (Simple Network Management Protocol), which is a protocol for monitoring devices connected to the internal network (other than SNMP, which can acquire information (log) related to the network state). Anti-virus software logs, mail server logs, etc.)
Receiving device management data from all or a part of devices corresponding to the SNMP;
Obtaining the amount of change for data related to a plurality of events included in the device management data;
And a step of displaying the change amounts related to the plurality of events as a graph together with the change amounts related to the plurality of events included in the logs of the firewall and the unauthorized intrusion detection device.

The change amount calculating step includes, for example,
For a plurality of events included in the log, a normal value (for example, an average value obtained for a certain period or more when there is no unauthorized intrusion, or other statistics. Each of which is not necessarily a premise for
A step of obtaining a deviation from the normal value for each event for the log received in the data source receiving step, and using this as a change amount.

The change amount calculating step includes, for example,
For each of the plurality of events included in the log, obtaining each distribution of the occurrence probability of the event (determining the distribution from the results observed over a certain period or theoretically obtaining the distribution);
Obtaining an actual occurrence frequency of the event included in the log received in the data source receiving step;
Applying the actual occurrence frequency to the distribution of the occurrence probabilities to determine the difficulty of generating an event, and using this as a change amount.

You may make it express a graph planarly (contour line). For example, the display step includes
Displaying a planar graph with one axis as a time axis and the other axis as an event type, and expressing the amount of change by shading or color coding;
Rearranging the order of the types of events to be displayed according to the magnitude of the change amount.

The display step includes, for example,
Determining whether the amount of change exceeds a predetermined threshold;
When the change amount exceeds a predetermined threshold, the display mode of the change amount graph is changed (color is changed, blinking, highlighting such as a bold line is performed), and the like.

The display step includes, for example,
Determining the number of occurrences per unit time for the event;
Determining whether the number of occurrences of the event per unit time exceeds a predetermined threshold;
When the number of occurrences of the event per unit time exceeds a predetermined threshold, changing the display mode of the graph of the amount of change (changing the color, blinking, emphasizing a bold line, etc.); Is provided.

The present invention includes an external network such as the Internet and an internal network such as a local area network (LAN) (herein, the internal network means a network that does not disclose resources to the outside as compared to the Internet), A firewall that is provided between the external network and the internal network and controls the relay of data between the networks based on a predetermined rule, and an unauthorized intrusion that detects unauthorized access by monitoring data flowing through the internal network A method for monitoring unauthorized intrusion in a system comprising a detection device and a device compatible with SNMP, which is a protocol for monitoring a device connected to the internal network,
Data is received from two or more predetermined devices among the devices corresponding to the firewall, the unauthorized intrusion detection device, the SNMP, and the like, and any two of them are included in the first data source and the second data. A data source receiving step as a source; and
A first change amount calculating step for obtaining a change amount of the first data source;
A second change amount calculating step for obtaining a change amount of the second data source;
A correlation calculation step for arranging a change amount of the first data source and a change amount of the second data source in time series and obtaining a correlation between them,
And an output step for outputting a calculation result of the correlation calculation step.

Other data received from two or more predetermined devices among the devices corresponding to the firewall, the unauthorized intrusion detection device, the SNMP, and the like as a third data source,
A third change amount calculating step for obtaining a change amount of the third data source;
A correlation calculation step for obtaining a correlation between a change amount of the first data source and / or a change amount of the second data source and a change amount of the third data source;
An output step of outputting a calculation result of the correlation calculation step.

  You may make it provide the determination step which determines the presence or absence of unauthorized intrusion by comparing the calculation result by the said correlation calculation step with a predetermined threshold value.

The present invention is based on a predetermined rule for relaying data between an external network such as the Internet, an internal network such as a local area network (LAN), and the external network and the internal network. A firewall to be controlled, an unauthorized intrusion detection device that detects unauthorized access by monitoring data flowing through the internal network, and a device that is compatible with SNMP, which is a protocol for monitoring devices connected to the internal network, A method for monitoring unauthorized intrusion in a system comprising:
Receiving data from one or more predetermined devices among the devices corresponding to the firewall, the unauthorized intrusion detection device, the SNMP, and the like;
Determining the amount of change in the received data;
Correlation calculation step for arranging the amount of change for the received data in time series and obtaining a correlation;
And an output step for outputting a calculation result of the correlation calculation step.

The present invention is based on a predetermined rule for relaying data between an external network such as the Internet, an internal network such as a local area network (LAN), and the external network and the internal network. A device for monitoring unauthorized intrusion in a system comprising a firewall to be controlled and an unauthorized intrusion detection device that detects unauthorized access by monitoring data flowing through the internal network,
A data source receiving unit that receives a log from the firewall and the intrusion detection device, a change amount calculating unit that obtains a change amount of data related to a plurality of events included in the log, and a change amount related to the plurality of events over time. And a display unit that displays the graph with a common axis.

The present invention is based on a predetermined rule for relaying data between an external network such as the Internet, an internal network such as a local area network (LAN), and the external network and the internal network. A device that supports a firewall to be controlled, an intrusion detection device that detects unauthorized access by monitoring data flowing through the internal network, and SNMP that is a protocol for monitoring devices connected to the internal network ( In addition to SNMP, including information that can acquire information (logs) on the state of the network (for example, logs of computers equipped with anti-virus software, logs of mail servers, etc.) for monitoring unauthorized intrusions Equipment Te,
Data is received from two or more predetermined devices among the devices corresponding to the firewall, the unauthorized intrusion detection device, the SNMP, and the like, and any two of them are included in the first data source and the second data. A data source receiving unit that outputs as a source, a first change amount calculation unit that calculates a change amount of the first data source, a second change amount calculation unit that calculates a change amount of the second data source, and the first data A change amount of the source and a change amount of the second data source are arranged in time series, and a correlation calculation unit that obtains a correlation between them and an output unit that outputs a calculation result by the correlation calculation unit are provided.

The present invention relates to a program for causing a computer to execute the above method.
The program according to the present invention is recorded on a recording medium, for example.
Examples of the medium include EPROM device, flash memory device, flexible disk, hard disk, magnetic tape, magneto-optical disk, CD (including CD-ROM and Video-CD), DVD (DVD-Video, DVD-ROM, DVD- RAM), ROM cartridge, RAM memory cartridge with battery backup, flash memory cartridge, nonvolatile RAM cartridge, and the like.

  In addition, a communication medium such as a wired communication medium such as a telephone line and a wireless communication medium such as a microwave line is included. The Internet is also included in the communication medium here.

  A medium is a medium in which information (mainly digital data, a program) is recorded by some physical means, and allows a processing device such as a computer or a dedicated processor to perform a predetermined function. is there.

  According to the present invention, the amount of change in a plurality of events (including not only all but also a part of what should be displayed) included in the log of the firewall and intrusion detection device (IDS) and SNMP management information. And displaying them as a graph on the same screen makes it possible to easily perform comprehensive monitoring.

  Further, by obtaining a correlation between the graphs, an alarm regarding unauthorized access can be automatically issued.

Embodiment 1 of the Invention
FIG. 1 shows an example of a system to which the present invention is applied. In FIG. 1, 1 is an external network such as the Internet, and 2 is an internal network such as a local area network (LAN). Here, the internal network 2 means a network that does not disclose resources to the outside as compared to the Internet 1. Reference numeral 3 denotes a firewall computer (Fire Wall: FW, hereinafter referred to as “firewall”) that is provided between the external network 1 and the internal network 2 and controls data relay between the networks based on a predetermined rule. The internal network 2 includes a LAN and PC terminals 5a to 5c connected thereto, a printer 6, WWW servers 7a and 7b, and the like. Reference numeral 4 denotes an intrusion detection system (IDS) that monitors data flowing through the internal network 2 to detect unauthorized access.

  A method for monitoring unauthorized intrusion in the system illustrated in FIG. 1 will be described with reference to the flowchart of FIG.

S1: Receive logs from the firewall (FW) 3 and the intrusion detection device (IDS) 4.
Firewall logs are appropriate to capture large changes in port access. On the other hand, since attacks and normal accesses are not distinguished, it is difficult to capture small changes such as unauthorized access.
The IDS log sensitively records changes in the security status of the network. The behavior of worms in particular is recorded as Sweep and Scan events, so it is possible to catch the occurrence of worms at an early stage by combining these event changes with firewall log changes. .

S2: When the system shown in FIG. 1 includes a device compatible with SNMP (Simple Network Management Protocol) which is a protocol for monitoring a device connected to the internal network 2, a device compatible with SNMP (SNMP agent or manager) Device management data is received from all or part of the device management data. Any information other than SNMP that can acquire information (log) about the state of the network can be used here. For example, logs from computers installed with anti-virus software, mail server logs, and the like can also be used as monitoring targets.
S3: Data relating to a plurality of events included in the log and device management data received in S1 and S2 are extracted.

S4: The amount of change is obtained for the data extracted in S3.
Although simple count analysis is an important technique for capturing large changes, it cannot capture the initial subtle changes. In addition, since the data recorded in S1 and S2 includes access such as worms and viruses as background noise, it cannot be separated. Therefore, by analyzing the amount of change by S4, the influence of background noise is minimized, and subtle changes at the beginning of activities such as worms are captured.

Therefore, in S4, the amount of change is determined for at least the IDS log.

S5: The amount of change related to the plurality of events obtained in S4 is displayed as a time series graph.

  A procedure for obtaining the amount of change will be described with reference to FIG.

S10: A normal value (or an equivalent) indicating a state without unauthorized intrusion is obtained for the event.
S11: A deviation from the normal value is obtained for each event, and this is used as a change amount.

  Alternatively, the amount of change may be obtained as shown in FIG.

S12: The distribution of the probability of occurrence of the event is calculated theoretically or statistically.
S13: The actual occurrence frequency (occurrence probability) is obtained for each event.
S14: The actual occurrence frequency is applied to the distribution of the occurrence probability, the difficulty of occurrence of the event is obtained, and this is set as the amount of change.

  The device / method of the first embodiment of the present invention aims to quickly capture suspicious movements on the Internet using a firewall log and an intrusion detection device (IDS) log. In analysis of these logs, analysis using tables and numerical values is also effective, but it is thought that changes and transitions can be easily grasped by graphing the data.

  Even if the log data is simply graphed, the transition of the event can be grasped, but this method cannot grasp small movements hidden in a large number of events. In addition, the logs of devices with completely different characteristics, such as firewalls and intrusion detection devices (IDS), are handled, and the number of devices handled for each system and the characteristics of the monitored network are different. Considering these matters, even if an attempt is made to monitor the entire system based on the absolute amount (absolute number) of events, the data cannot be compared and it is difficult to grasp the situation of the entire system.

  To solve this, I tried to analyze the log with the number of events divided by the average value (number of events (count) ÷ average value), but the maximum value was too large and each item was graphed. I found that I couldn't draw properly on top.

  Therefore, in Embodiment 1 of the invention, attention is paid to the amount of change, not the absolute amount of data. As the amount of change, there are one using a deviation shown in FIG. 3A and another using a probability distribution shown in FIG.

An example of the deviation equation of FIG.
N = deviation value = (COUNT (I: n) -Average (I)) / standard deviation (I)
However, COUNT is the event count value (detection count), and Average is the normal value.
Firewall and IDS events appear to have a normal or Poisson distribution. In the Poisson distribution, when the probability of occurrence increases, the distribution becomes very close to the normal distribution.
Deviation analysis is extremely sensitive and can accurately capture small event changes.

  The method of using the probability distribution of FIG. 3B is an analysis method that is less sensitive than the deviation of FIG. 3A, and in the case of the deviation, an excessively sensitive value is generated in some logs. Therefore, it is possible to avoid the problem that an appropriate distribution cannot be obtained. Specifically, the method using the probability distribution calculates the occurrence probability of the Poisson distribution or the normal distribution based on the occurrence frequency of the event, and uses the difficulty of the event as analysis data. Normalization of the data is necessary to calculate the probability of occurrence, but this data is very close to the graph imaged just by count / average, so normalized data in addition to the probability of occurrence is also used for analysis can do.

FIG. 4 is a block diagram of an apparatus according to Embodiment 1 of the invention.
Reference numerals 10a and 10b denote data source receivers that receive logs from the firewall (FW) 3 and the intrusion detection device (IDS) 4. Reference numerals 11a and 11b denote change amount calculation units that extract data relating to a plurality of events included in the received log and obtain the change amounts. When the system shown in FIG. 1 includes a device that supports SNMP (Simple Network Management Protocol), which is a protocol for monitoring a device connected to the internal network 2, a device that supports SNMP (SNMP agent or manager). May include a data source receiving unit 10c that receives device management data from all or a part thereof, and a change amount calculation unit 11c that extracts data related to a plurality of events included in the device management data and obtains the amount of change. Reference numeral 12 denotes a graph generation unit that creates changes in a plurality of events in a time-series graph, and reference numeral 13 denotes a display unit that displays the graph.

  In addition to the line graph (see FIGS. 5 and 6), the graph generation unit 12 displays a planar display (one axis is a time axis, the other axis is a type of event, and a planar graph is displayed. The amount of change expressed by shading or color coding (see FIG. 7) can also be performed. In this case, the rearrangement processing unit 12a rearranges the order of the types of events to be displayed according to the magnitude of the change amount (in FIG. 7, events are arranged from top to bottom in the order of the magnitude of the change amount). .

  When an abnormality that seems to be an unauthorized intrusion occurs in an event, the graph generation unit 12 changes the display mode of the event and notifies it (changes the color, blinks, highlights a bold line, etc.), and sets the display mode A portion 12b is provided. For example, the display mode setting unit 12b determines whether the change amount of the event exceeds a predetermined threshold value, and changes the display mode of the graph of the change amount when the change amount exceeds the predetermined threshold value. Alternatively, the display mode setting unit 12b obtains the number of occurrences per unit time for the event, determines whether the number of occurrences per unit time exceeds a predetermined threshold, and the number of occurrences per unit time of the event is determined in advance. You may make it change the display mode of the graph of the said variation | change_quantity when it exceeds the defined threshold value.

  Next, the graph obtained by the apparatus / method according to Embodiment 1 of the invention will be described with reference to an example.

  The upper part of FIG. 5 simply represents the number of detections with a line graph, and the lower part of FIG. 5 represents the deviation according to the first embodiment of the present invention with a line graph.

Graph of the number of data detections near 10/06 10:15: I do not know the relationship between one of the events Win_Rpc_TCP (symbol a in FIG. 5) and other events.
Deviation graph: In addition to Win_Rpc_TCP, it can be easily determined that other events are changing. In addition to Win_Rpc_TCP, at least four events (WEB_MISC_HTTP, SMB_malformed, Port_445_TCP, SSH_Deattack_IO, HTTP_Field_With_Binary) have changed.

Graph of the number of data detections of 10/06 10: 50-13: 00: Changes in other events cannot be grasped due to the influence of Win_Rpc_TCP.
Deviation graph: It can be easily determined that there is an event that has changed significantly during this time period. For example, BugBear-B (symbol d in FIG. 5), HTTP_cookieOverflow (same sign e), HTTP_Field_With_Binary (same sign f), HTTP_GET_DotDot_Data (same sign g), and HTTP_IIS_Double_Eval_Evation (same sign h).

Graph of the number of detected data near 10/06 13:35: Win_Rpc_TCP (same sign a) seems to change more greatly than SMB_malformed (same sign b).
Deviation graph: In terms of the amount of change, it can be seen that SMB_malformed (same sign b) changes more greatly than Win_Rpc_TCP (same sign a). That is, it can be determined that the possibility of attack is high.

  According to FIG. 5, it can be understood that the movement of various events can be grasped at a glance by using the deviation.

The same applies to FIG.
Graph of the number of detected data near 10/06 10:15: Difficult to detect except increase in Win_Rpc_TCP (symbol a in FIG. 6).
Deviation graph: In addition to Win_Rpc_TCP, you can see the following increase in events:
・ WEB-MISC HTTP OPTIONS
・ SSH_Deattack_IO
・ DNS_Spoof_Failed
・ TCP_Port_Scan
・ SQL_SSRP_Slammer_Worm
・ 445 / TCP
This analysis seems to suggest Nachi's access pattern (135 / TCP, access to WebDav).

  FIG. 6 also shows that the movement of various events can be grasped at a glance by using the deviation.

  In the line graphs of FIG. 5 and FIG. 6, it is impossible to capture changes in low value items. If a flat display as shown in FIG. 7 is performed, a change in a low value item can be captured. The horizontal axis in FIG. 7 is the time axis (same as in FIGS. 5 and 6), and the vertical axis is the event. The amount of change of an event is expressed in shades or colors on the plane of FIG. 7 (FIG. 7 is a schematic diagram and the representation of shades or colors is omitted). For example, when the amount of change is zero, the color is changed to white, and from a cold color such as light blue to a warm color such as red as the amount of change increases. The maximum level is red.

  Instead of fixing the position of the event on the vertical axis, it is better to sort by the level. For example, if the events are arranged in order from the highest level, it is easy to understand what the amount of event change is large and to grasp the system status.

Embodiment 2 of the Invention
Receive data from at least two (or all three) devices among firewalls, intrusion detection devices (IDS) and SNMP devices, determine the amount of event change included in these, and The presence / absence of unauthorized access may be determined by obtaining the correlation and comparing the correlation calculation result with a predetermined threshold value. The type of unauthorized access to be detected is determined depending on which event is to be correlated.

  A method for determining the presence or absence of unauthorized intrusion in the system illustrated in FIG. 1 will be described with reference to the flowchart of FIG.

S20: Receive logs from the firewall (FW) 3 and the intrusion detection device (IDS) 4.
S21: When the system shown in FIG. 1 includes a device compatible with SNMP (Simple Network Management Protocol), which is a protocol for monitoring a device connected to the internal network 2, a device compatible with SNMP (SNMP agent or manager) Device management data is received from all or part of the device management data.
S22: Data related to a plurality of events included in the log and device management data received in S20 and S21 are extracted.
S23: A change amount of the data extracted in S22 is obtained.
S24: A correlation between a plurality of predetermined events is obtained based on the change amounts relating to the plurality of events obtained in S23. For example, a change amount of a certain event (first data source) and a change amount of another event (second data source) are arranged in time series, and the correlation is obtained based on a formula for obtaining a known correlation. Note that it is sufficient that there are at least two data sources, and the correlation can be obtained even when there are three or more data sources.
S25: The correlation graph obtained in S24 is displayed.
S26: The threshold value determined in advance is compared with the correlation graph obtained in S24. If the threshold value is exceeded, it is determined that an unauthorized intrusion has occurred, and this is notified by a display device or the like.

  FIG. 9 is a block diagram of an apparatus according to Embodiment 2 of the invention. In FIG. 9, the same or corresponding parts as those in FIG.

  In FIG. 9, reference numeral 14 denotes a correlation calculation unit that arranges a change amount of a certain event (first data source) and a change amount of another event (second data source) in time series, and obtains a correlation based on a formula for obtaining a known correlation. It is. The correlation calculation unit 14 includes an unauthorized intrusion determination unit 14a that compares the obtained correlation value with a predetermined threshold value and determines that an unauthorized intrusion has occurred when the threshold value is exceeded.

  When it is determined by the unauthorized intrusion determination unit 14a that an abnormality that seems to be an unauthorized intrusion has occurred in the event, the correlation calculation unit 14 changes the display mode of the event and notifies it (changes the color, blinks, emphasizes bold lines, etc. Display). The correlation calculation unit 14 obtains the number of occurrences per unit time for the event, determines whether or not the number of occurrences of the event per unit time exceeds a predetermined threshold, and the number of occurrences of the event per unit time is a predetermined threshold. The display mode of the graph of the change amount may be changed when the value exceeds.

  According to the second embodiment of the present invention, it is possible to automatically determine unauthorized intrusion. Some examples are listed.

(1) As described for the data near 10/06 13:35 in FIG. 5, in the deviation graph, SMB_malformed (symbol b) changes more greatly than Win_Rpc_TCP (symbol a), and the attack It can be judged that the possibility is high. Therefore, a correlation between the amount of change in SMB_malformed (symbol b) and the amount of change in Win_Rpc_TCP (symbol a) is obtained, and when this exceeds a predetermined threshold, it can be determined as an attack.

(2) As explained for the data near 10/06 10:15 in FIG. 6, the correlation between the following changes is obtained, and when this exceeds a predetermined threshold, Nachi's access pattern (to 135 / TCP, WebDav) Access).
・ Win_Rpc_TCP
・ WEB-MISC HTTP OPTIONS
・ SSH_Deattack_IO
・ DNS_Spoof_Failed
・ TCP_Port_Scan
・ SQL_SSRP_Slammer_Worm
・ 445 / TCP

(3) When a problem (such as an increase in CPU utilization) occurs in the DNS server, the cause is analyzed and identified, and if it is an attack packet, for example, the following is performed.
The correlation between the change amount of the Zone_Transfer and the change amount of the CPU usage rate is obtained, and when this exceeds a predetermined threshold, it is determined that Zone_Transfer has an influence on the CPU usage rate. An alarm to that effect is generated so that the setting is reviewed.

  In general, operations are performed on two data sources when obtaining a correlation, but the present invention is not limited to this (for example, a correlation analysis of 3 or 10 is also possible). Correlation may be determined for more than two data sources. Three or more data sources may be operated at the same time, or three or more data sources are each set in two sets to obtain a correlation between them, and these results are comprehensively determined according to some evaluation function. Also good.

  For example, receiving three or more data from a plurality of devices corresponding to firewalls, unauthorized intrusion detection devices, SNMP, etc., obtaining the amount of change for each received data, arranging the amount of change for each received data in time series, A correlation may be obtained for all of them (for example, a multivariate function is used).

  For example, three data (may be four or more) are received from a firewall, an intrusion detection device, and a device corresponding to the SNMP, and the first data source, the second data source, and the third data source are received. When these three variations are obtained, the three variations are arranged in time series, the correlation between the first data source and the second data source, the correlation between the second data source and the third data source, and the first data. The correlation between the source and the third data source is obtained, and these three correlation results are integrated by some evaluation function (for example, simply added or added with weights), and comprehensively determined according to this. Also good. The same applies to the case of four or more.

Note that correlation analysis may be applied within one data source. For example, this is the case.
(1) Correlate web access and email access in firewall log (2) Correlate DDoS and port scan in intrusion detection device log (3) Support SNMP The present invention is also applicable to correlation analysis within one data source including the above example.

  The present invention is not limited to the above embodiments, and various modifications can be made within the scope of the invention described in the claims, and these are also included in the scope of the present invention. Needless to say.

  Further, in the present specification, the term “unit” does not necessarily mean a physical means, but includes a case where the function of each unit is realized by software. Furthermore, the function of one part may be realized by two or more physical means, or the function of two or more parts may be realized by one physical means.

It is a figure which shows an example of the system with which embodiment of invention is applied. It is a process flowchart which concerns on Embodiment 1 of invention. It is a variation | change_quantity calculation process flowchart which concerns on Embodiment 1 of invention. It is a block diagram of the apparatus which concerns on Embodiment 1 of invention. It is an example of the graph by the apparatus / method which concerns on Embodiment 1 of invention (the upper stage is a graph which displayed the number of detections as it is, and the lower stage is a graph which displayed deviation). It is another example of the graph by the apparatus / method which concerns on Embodiment 1 of invention (the upper stage is a graph which displayed the number of detections as it is, and the lower stage is a graph which displayed deviation). It is an example of the graph of the plane display by the apparatus / method which concerns on Embodiment 1 of invention. It is a process flowchart which concerns on Embodiment 2 of invention. It is a block diagram of the apparatus which concerns on Embodiment 2 of invention.

Explanation of symbols

1 Internet (external network)
2 Internal network 3 Firewall (FW)
4 Intrusion Detection Device (IDS)
DESCRIPTION OF SYMBOLS 10 Data source receiving part 11 Change amount calculating part 12 Graph production | generation part 12a Rearrangement process part 12b Display mode setting part 13 Display part 14 Correlation calculating part 14a Unjust intrusion determination part

Claims (9)

An external network such as the Internet, an internal network such as a local area network (LAN), and a firewall provided between the external network and the internal network to control data relay between the networks based on a predetermined rule An SNMP (Simple Network) which is a protocol for monitoring a computer, an intrusion detection system (Intrusion Detection System) that detects unauthorized access by monitoring data flowing through the internal network, and a device connected to the internal network A method for monitoring unauthorized intrusion in a system including a device compatible with Management Protocol) ,
A data source receiving step for receiving logs from the firewall computer and the unauthorized intrusion detection device, and device management data from all or part of the devices corresponding to the SNMP ;
A change amount calculating step for obtaining a first change amount for data related to a plurality of events included in the log and a second change amount for data related to the plurality of events included in the device management data ,
The event included in the log is an event included in a log related to port access from the firewall computer, and an event included in a log related to security status from the intrusion detection device,
The event included in the device management data is an event included in a log related to a network state from a device corresponding to the SNMP,
The first change amount is a deviation between a normal value indicating an intrusion-free state and a value for an event included in the log, or an occurrence frequency of the event included in the log theoretically or statistically. The change amount calculating step, which is the difficulty of occurrence of an event determined by applying the distribution of the occurrence probability of the obtained event,
A display step of displaying the first change amount as a time-series graph having a time axis in common with the second change amount . The display step includes
Displaying a planar graph with one axis as a time axis and the other axis as a type of event, and expressing the amount of change by shading or color coding;
Rearranging the order of the types of events to be displayed according to the magnitude of the change amount. The display step includes
Determining whether the amount of change exceeds a predetermined threshold;
The method according to claim 1, further comprising: changing a display form of a graph of the change amount when the change amount exceeds a predetermined threshold value. The display step includes
Determining the number of occurrences per unit time for the event;
Determining whether the number of occurrences of the event per unit time exceeds a predetermined threshold;
The method according to claim 1, further comprising: changing a display mode of the graph of the amount of change when the number of occurrences of the event per unit time exceeds a predetermined threshold. An external network such as the Internet, an internal network such as a local area network (LAN), and a firewall provided between the external network and the internal network to control data relay between the networks based on a predetermined rule An SNMP (Simple Network) which is a protocol for monitoring a computer, an intrusion detection system (Intrusion Detection System) that detects unauthorized access by monitoring data flowing through the internal network, and a device connected to the internal network A method for monitoring unauthorized intrusion in a system including a device compatible with Management Protocol),
Data is received from the firewall computer and one of devices corresponding to the unauthorized intrusion detection device and the SNMP, and the first data source received from the firewall computer, the unauthorized intrusion detection device and the SNMP A second data source received from any one of the corresponding devices, a third data source received from any one of the devices corresponding to the unauthorized intrusion detection device, the SNMP, or the like that is not the source of the second data source A data source receiving step for receiving,
The first data source is an event included in a log relating to port access from the firewall computer;
The second data source and the third data source are events included in a log related to a security status from the unauthorized intrusion detection apparatus or events related to a network status from a device corresponding to the SNMP. ,
Receiving the data source;
A first change amount calculating step for obtaining a change amount of the first data source, wherein the change amount is a deviation between a normal value indicating a state without unauthorized intrusion and a value of an event included in the log; or The first change amount calculation step, which is the difficulty of occurrence of an event obtained by applying the occurrence frequency of the event included in the log to the distribution of the occurrence probability of the event theoretically or statistically obtained,
A second change amount calculation step for obtaining a change amount of the second data source, wherein the second change amount is a deviation between a normal value indicating a state without unauthorized intrusion and a value for an event included in the log; Or the second change amount calculating step, wherein the event occurrence frequency obtained by applying the occurrence frequency of the event included in the log to the distribution of the occurrence probability of the event theoretically or statistically obtained is difficult ,
A third change amount calculating step for obtaining a change amount of the third data source, wherein the third change amount is a deviation between a normal value indicating a state where there is no unauthorized intrusion and a value regarding an event included in the log; Or the third change amount calculating step, wherein the occurrence frequency of the event included in the log is the difficulty of occurrence of the event obtained by applying the occurrence frequency of the event theoretically or statistically obtained to the distribution. ,
The change amount of the first data source, the change amount of the second data source, and the change amount of the third data source are arranged in time series, and the change amount of the first data source or the change amount of the second data source A correlation calculating step for obtaining a correlation with the change amount of the third data source ;
An operation monitoring method for a computer network, comprising: an output step of outputting a calculation result of the correlation calculation step. The method according to claim 5 , further comprising: a determination step of determining the presence or absence of unauthorized intrusion by comparing a calculation result of the correlation calculation step with a predetermined threshold value. An external network such as the Internet, an internal network such as a local area network (LAN), and a firewall provided between the external network and the internal network to control data relay between the networks based on a predetermined rule An SNMP (Simple Network) which is a protocol for monitoring a computer, an intrusion detection system (Intrusion Detection System) that detects unauthorized access by monitoring data flowing through the internal network, and a device connected to the internal network A device for monitoring unauthorized intrusions in a system equipped with a device compatible with Management Protocol) ,
A data source receiving unit that receives logs from the firewall computer and the unauthorized intrusion detection device, and device management data from all or a part of the devices corresponding to the SNMP ;
A change amount calculation unit that obtains a first change amount for data related to a plurality of events included in the log and a second change amount for data related to a plurality of events included in the device management data ;
The event included in the log is an event included in a log related to port access from the firewall computer, and an event included in a log related to security status from the intrusion detection device,
The event included in the device management data is an event included in a log related to a network state from a device corresponding to the SNMP,
The first change amount is a deviation between a normal value indicating an intrusion-free state and a value for an event included in the log, or an occurrence frequency of the event included in the log theoretically or statistically. The change amount calculation unit, which is the difficulty of occurrence of the event determined by applying to the distribution of the occurrence probability of the determined event,
An operation monitoring apparatus for a computer network, comprising: a display unit configured to display the first change amount as a time-series graph having a time axis in common with the second change amount . An external network such as the Internet, an internal network such as a local area network (LAN), and a firewall provided between the external network and the internal network to control data relay between the networks based on a predetermined rule An SNMP (Simple Network) which is a protocol for monitoring a computer, an intrusion detection system (Intrusion Detection System) that detects unauthorized access by monitoring data flowing through the internal network, and a device connected to the internal network A device for monitoring unauthorized intrusions in a system equipped with a device compatible with Management Protocol) ,
Data is received from the firewall computer and one of devices corresponding to the unauthorized intrusion detection device and the SNMP, and the first data source received from the firewall computer, the unauthorized intrusion detection device and the SNMP A second data source received from any one of the corresponding devices, a third data source received from any one of the devices corresponding to the unauthorized intrusion detection device, the SNMP, or the like that is not the source of the second data source A data source receiver for receiving,
The first data source is an event included in a log relating to port access from the firewall computer;
The second data source and the third data source are events included in a log related to a security status from the unauthorized intrusion detection apparatus or events related to a network status from a device corresponding to the SNMP. ,
The data source receiver;
It is a change amount calculation part which calculates | requires the 1st-3rd change amount of each of the said 1st-3rd data source, Comprising: The previous 1st-3rd change amount is a normal value which shows a state without unauthorized intrusion, and the said log It is difficult to generate an event obtained by applying the deviation from the value of the event included in the event or the occurrence frequency of the event included in the log to the distribution of the event occurrence probability obtained theoretically or statistically. , said change amount calculating unit is,
The change amount of the first data source, the change amount of the second data source, and the change amount of the third data source are arranged in time series, and the change amount of the first data source or the change amount of the second data source A correlation calculation unit for obtaining a correlation with the change amount of the third data source ;
An operation monitoring apparatus for a computer network, comprising: an output unit that outputs a calculation result by the correlation calculation unit. To execute the steps of the method according to any one of claims 1 to 6 computer, the computer program.

Images