JP6652525B2 - Blacklist setting device, blacklist setting method, and blacklist setting program - Google Patents

Description

  The present invention relates to a blacklist setting device, a blacklist setting method, and a blacklist setting program.

  Conventionally, there has been known a method of detecting a cyber attack via the Internet by setting a known malicious IP, a URL, and a signature (hereinafter, collectively referred to as a blacklist) as detection rules in a device such as a firewall. .

Takaaki Koyama et al., "Realization of Security Orchestration Using Global Threat Information Infrastructure," NTT Technical Journal Vol. 27, No. 10, 2015. (http://www.ntt.co.jp/journal/1510/ files / jn201510023.pdf)

  However, the conventional method has a problem that when the number of rules that can be set for a device is limited, a blacklist with a reduced number of rules may not be generated without significantly lowering a detection rate. There is.

  For example, a method of mechanically selecting items with a high attack frequency from the entire attack, or a method of selecting a fixed number of rules for each attack type can be considered, but there are multiple attack types of cyber attacks, and Since the threat level and attack frequency greatly differ from one another, the detection rate by the blacklist may significantly decrease in such a method.

  The blacklist setting device according to the present invention includes: an acquisition unit that acquires an attack type and the number of attacks for each IP address of an attack source for a cyber attack observed on the Internet; and the number of attacks for each IP address of the attack source. Where the distribution is represented by a predetermined distribution function for each of the attack types, a calculation unit for calculating parameters of the distribution function, and a constraint condition that the number of selectable IP addresses is equal to or less than a predetermined upper limit value A selection unit that selects an IP address to be set in a blacklist from the IP addresses of the attack sources such that a detection rate against a cyber attack predicted based on the distribution function and the parameters of the distribution is maximized. And the following.

  According to the present invention, when the number of rules that can be set for a device is limited, it is possible to generate a blacklist in which the number of rules is reduced without significantly lowering the detection rate.

FIG. 1 is a diagram illustrating an example of a configuration of a blacklist setting device according to the first embodiment. FIG. 2 is a diagram for explaining an outline of a process performed by the blacklist setting device according to the first embodiment. FIG. 3 is a diagram for explaining calculation of distribution parameters by the blacklist setting device according to the first embodiment. FIG. 4 is a diagram for describing selection of an IP address by the blacklist setting device according to the first embodiment. FIG. 5 is a flowchart illustrating a flow of processing of the blacklist setting device according to the first embodiment. FIG. 6 is a diagram illustrating an example of a computer that executes a blacklist setting program.

  Hereinafter, embodiments of a blacklist setting device, a blacklist setting method, and a blacklist setting program according to the present application will be described in detail with reference to the drawings. Note that the present invention is not limited by the embodiments described below.

[Configuration of First Embodiment]
First, the configuration of the blacklist setting device according to the first embodiment will be described with reference to FIG. FIG. 1 is a diagram illustrating an example of a configuration of a blacklist setting device according to the first embodiment. As shown in FIG. 1, the blacklist setting device 10 includes an input / output unit 11, a communication unit 12, a storage unit 13, and a control unit 14.

  The input / output unit 11 receives data input from a user and outputs data. It includes input devices such as a mouse and a keyboard, and display devices such as a display and a touch panel. The communication unit 12 performs data communication with another device via a network. For example, the communication unit 12 is a NIC (Network Interface Card).

  The storage unit 13 is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), and an optical disk. The storage unit 13 may be a rewritable semiconductor memory such as a random access memory (RAM), a flash memory, or a non-volatile random access memory (NVSRAM). The storage unit 13 stores an OS (Operating System) executed by the blacklist setting device 10 and various programs. Further, the storage unit 13 stores various information used in executing the program.

  The control unit 14 controls the entire blacklist setting device 10. The control unit 14 is, for example, an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). Further, the control unit 14 has an internal memory for storing programs and control data defining various processing procedures, and executes each process using the internal memory. The control unit 14 also functions as various processing units when various programs operate. For example, the control unit 14 includes an acquisition unit 141, a calculation unit 142, a selection unit 143, and a generation unit 144.

[Overview of processing]
Here, the outline of the processing of the blacklist setting device 10 will be described with reference to FIG. FIG. 2 is a diagram for explaining an outline of a process performed by the blacklist setting device according to the first embodiment. As shown in FIG. 2, the blacklist setting device 10 first obtains attack information 100a. The attack information 100a is, for example, information collected by an attack observation device that collects information on an attack arriving via the Internet.

  The attack information includes at least the attack type, the number of unique IPs, and the total number of attacks. The attack type is information for identifying and classifying an attack. The attack type may be a name such as "shell", "SQL", or "samba". The number of unique IPs is obtained by counting the number of attack source IP addresses for each attack type without duplication. The total number of attacks is the number of attacks for each attack type. The attack information 100a describes, for example, that the number of unique IPs with an attack type of 1 is “x” and the total number of attacks is “X”. In the following description, the IP address of the attack source may be simply referred to as an IP address.

  Next, as shown in the graph 200a, the blacklist setting device 10 expresses the distribution of the total number of attacks for each IP address by a distribution function for each attack type. For example, the blacklist setting device 10 regards the IP addresses sorted in descending order of the number of corresponding attacks as a zeta distribution, and calculates parameters of the zeta distribution.

  Further, the blacklist setting device 10 selects a combination of IP addresses that maximizes the effect of the protection based on the result of the calculation performed using the distribution function under a predetermined constraint condition. For example, as shown in the graph 300a, the blacklist setting device 10 selects a IP address of the attack type 1, selects b IP addresses of the attack type 2, and selects c IP addresses of the attack type 3 I do. At this time, assuming that the number of IP addresses that can be selected is N, a combination of IP addresses that maximizes the effect of defense by maximizing a / x + b / y + c / z under the constraint condition a + b + c = N Can be selected.

[Calculation of distribution parameters]
The calculation of distribution parameters by the blacklist setting device 10 will be described with reference to FIG. FIG. 3 is a diagram for explaining calculation of distribution parameters by the blacklist setting device according to the first embodiment.

  First, the obtaining unit 141 obtains, for a cyber attack observed on the Internet, an attack type and the number of attacks for each attack source IP address. As shown in FIG. 3, the acquisition unit 141 acquires the attack information 100 in which the IP address, the attack type, and the number of attacks are described. The acquisition unit 141 can count the number of attacks of the acquired attack information for each attack type and IP address. Further, the acquiring unit 141 may acquire, as the attack information 100, the number of attacks that have been counted for each attack type and IP address.

  Further, the attack information 100 may acquire, as the attack information 100, information in which an attack type, an IP address, and an arrival time of the information are listed for each attack. In this case, the acquisition unit 141 totalizes the attack types and the number of attacks for each IP address during a predetermined period based on the arrival time.

  The calculation unit 142 calculates distribution parameters of the distribution function when the distribution of the number of attacks for each IP address of the attack source is represented by a predetermined distribution function for each attack type. In the present embodiment, the calculation unit 142 calculates the parameters of the zeta distribution when the distribution in which the IP addresses of attack sources are arranged in descending order of the number of attacks is represented by a zeta distribution. Note that the distribution used in the calculation unit 142 is not limited to the zeta distribution, and may be an exponential distribution or the like.

Here, when the IP addresses of the attack source are sorted in descending order of the number of attacks, the relationship between the IP address of the attack source and the number of attacks may be approximated to Zip's law which is a part of the power law. Therefore, calculation unit 142 assumes that the number of attacks for each IP address follows a power law. In other words, calculation unit 142 assumes that i-th number of attacks number of attacks often IP address becomes the 1 / i ^k of number of attacks most number of attacks often IP address.

  Therefore, first, as shown in the graph 201, the calculation unit 142 sorts the IP addresses in descending order of the number of corresponding attacks. The graph 201 indicates that, for example, the IP address having the highest number of attacks of attack type 1 is IP1, and the IP address having the second highest number of attacks is IP2. Since the data according to the power law follows the zeta distribution as the probability distribution, the calculation unit 142 regards the relationship between the sorted IP addresses and the number of attacks as the zeta distribution as shown in the graph 301.

  Here, when n pieces of data are obtained from data that obeys the power law, the ratio of the data to the entire data is calculated by using the cumulative distribution function of the zeta distribution when the entire data is sufficiently large. It is approximated by (1). Further, the calculation unit 142 can calculate the parameter k of the zeta distribution for each attack type by a known parameter calculation method based on the attack information 100 and the like.

  Ζ (k) is the Riemann zeta function and is expressed by equation (2).

[Select IP address]
The selection of an IP address by the blacklist setting device 10 will be described with reference to FIG. FIG. 4 is a diagram for describing selection of an IP address by the blacklist setting device according to the first embodiment.

The selection unit 143 maximizes the detection rate for a cyber attack predicted based on the distribution function and the distribution parameters under the constraint that the number of selectable IP addresses is equal to or less than a predetermined upper limit. Next, the IP address to be set in the blacklist is selected from the attacking IP addresses. In the present embodiment, the selection unit 143, the detection rate against each attack type is to be maximized, selecting the IP address set in the blacklist.

  Here, S is the upper limit of the IP addresses on the blacklist, and the selecting unit 143 determines that the top p items of the number of attacks from the IP address of attack type 1, the top q items of the number of attacks from the IP address of attack type 2, Consider selecting the top r IP addresses with the highest number of attacks from type 3 IP addresses.

At this time, the selection unit 143 calculates p, q, and r that maximize f (p, q, r). Here, it is assumed that the calculation unit 142 calculates the distribution parameter of the attack type 1 as 1.52, the distribution parameter of the attack type 2 as 1.01, and the distribution parameter of the attack type 3 as 1.30. f (p, q, r) is represented as in equation (3) .

  At this time, the selecting unit 143 sets S as the upper limit of the IP addresses on the blacklist, and sets Expression (4) as a constraint.

  The selecting unit 143 can solve the maximization of Expression (3) using Expression (4) as a constraint condition using the Lagrange undetermined multiplier method. The Lagrange undetermined multiplier method in this case is represented by Expression (5-1), Expression (5-2), Expression (5-3), and Expression (5-4).

  Here, equation (5-4) is expressed as equation (6).

  In addition, when the term represented by the sum is replaced by integration, Expression (6) is expressed as Expression (7).

  This replacement is based on the fact that the backward difference of equation (8-1) is equal to the derivative of equation (8-2).

  Calculating the partial differential from Expression (9-1) to Expression (9-5), λ is expressed as Expression (9-6) using p.

  When the same calculation is performed for q and r, λ becomes as shown in Expression (10).

  Equation (10) can be modified as in equation (11). Equation (11) is a relational expression of p, q, and r that maximizes the attack coverage when p + q + r is kept constant.

  By calculation of Expressions (12-1) and (12-2), p can be expressed as Expression (12-3) using λ.

  Similarly, using λ, q and r can be expressed as in equations (13-1) and (13-2), respectively.

  Thus, equation (14-1) can be expressed as equation (14-2). Here, if λ in Expression (14-2) can be expressed by using S, this maximization problem can be solved.

  As a method of expressing λ in Expression (14-2) using S, a method of fixing one of p, q, and r and calculating the remaining two as in Expression (15) There is.

  Further, as another method of expressing λ in Expression (14-2) using S, the calculation of f ′ (λ) = 0 is easy, and the Newton method is used as in Expression (16). There is a method of numerically calculating a solution of f (λ) = 0.

  Here, in Equation (15), when p is fixed, the values of the zeta function for p, q, and r are expressed by Equations (17-1), (17-2), and (17-3), respectively. Therefore, if q and r are represented using p, they are as shown in Expression (18-1) and Expression (18-2), respectively. In this case, if p is fixed to 500, q becomes 301 and r becomes 1021.

  Thus, the selection unit 143 selects an IP address based on the graphs 301 and 302 in FIG. For example, as shown in the graph 401, the selecting unit 143 selects the IP addresses IP1, IP2, IP3, IP4, and IP5 for the attack type 1. As shown in the graph 402, the selecting unit 143 selects the IP addresses IP8 and IP9 for the attack type 2.

  Further, the generation unit 144 generates a blacklist 500 listing the IP addresses selected by the selection unit 143. At this time, the predicted coverage of the attack of the attack type 1 according to the blacklist 500 is 60%, the predicted coverage of the attack of the attack type 2 is 40%, and the predicted average coverage of the entire attack type is 50%. is there. The cover rate is a ratio of the number of attacks estimated to be detectable by the blacklist 500 to the total number of attacks, and can be referred to as a detection rate.

[Processing of First Embodiment]
The flow of processing of the blacklist setting device 10 will be described with reference to FIG. FIG. 5 is a flowchart illustrating a flow of processing of the blacklist setting device according to the first embodiment.

  As shown in FIG. 5, first, the obtaining unit 141 obtains attack information (step S101). The attack information is, for example, information collected by an attack observation device. The attack information includes, for example, an attack type, an attack source IP address, and the number of attacks.

  Next, the calculation unit 142 calculates a parameter of the distribution of the number of attacks for each attack type (step S102). The calculation unit 142 represents, for example, the distribution of the number of attacks for each attack type as a zeta distribution, and calculates parameters of the zeta distribution.

Then, the selection unit 143 selects an IP address such that the detection rate for each of the attack types is maximized (Step S103). The selecting unit 143 can determine the IP address to be selected by maximizing the sum of the cumulative distribution functions of the zeta distribution for each attack type, with the upper limit number of selectable IP addresses as a constraint, for example.

  Then, the generation unit 144 generates a blacklist based on the IP address selected by the selection unit 143 (Step S104). For example, the IP address selected by the selection unit 143 is listed in the blacklist generated by the generation unit 144.

[Effect of First Embodiment]
The acquisition unit 141 acquires an attack type and the number of attacks per IP address of an attack source regarding a cyber attack observed on the Internet. Further, the calculation unit 142 calculates the parameters of the distribution function when the distribution of the number of attacks for each IP address of the attack source is represented by a predetermined distribution function for each of the attack types. Further, under the constraint that the number of selectable IP addresses is equal to or less than a predetermined upper limit, the selection unit 143 maximizes the detection rate for a cyber attack predicted based on the distribution function and the parameters of the distribution. As described above, the IP address to be set in the black list is selected from the IP addresses of the attack sources. As described above, in the present embodiment, since the distribution of the number of attacks for each IP address is represented by the distribution function, the detection rate of the generated blacklist can be easily predicted. Also, in the present embodiment, the maximum number of IP addresses that can be set in the blacklist is set as a constraint, and the detection rate for each attack type is maximized, so that the number of rules that can be set for the device is limited. However, the number of rules can be reduced without significantly lowering the detection rate.

  The calculation unit 142 calculates the parameters of the zeta distribution when the distribution in which the attacking IP addresses are arranged in descending order of the number of attacks is represented by a zeta distribution. Thus, the maximization of the detection rate can be solved by using the Lagrange undetermined multiplier method.

Selecting unit 143, the detection rate against each attack type is to be maximized, selecting the IP address set in the blacklist. There are a plurality of types of cyber attacks, and the degree of threat and the frequency of attacks vary greatly for each type of attack. For this reason, it is desirable that the blacklist has a high detection rate even for attacks of the attack type in which the observed number of attacks is small. According to this embodiment, since the detection rates for each attack type can be averaged with equal weights, it is possible to generate a blacklist in which the detection rates are not biased for each attack type.

[System configuration, etc.]
Each component of each device illustrated is a functional concept and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed / arbitrarily divided into arbitrary units according to various loads and usage conditions. Can be integrated and configured. Further, all or any part of each processing function performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware by wired logic.

  Further, of the processes described in the present embodiment, all or a part of the processes described as being performed automatically can be manually performed, or the processes described as being performed manually can be performed. All or part can be performed automatically by a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified.

[program]
As one embodiment, the blacklist setting device 10 can be implemented by installing a blacklist setting program for executing the above blacklist generation as package software or online software on a desired computer. For example, by causing the information processing apparatus to execute the above blacklist setting program, the information processing apparatus can function as the blacklist setting apparatus 10. The information processing apparatus referred to here includes a desktop or notebook personal computer. In addition, the information processing apparatus includes mobile communication terminals such as a smartphone, a mobile phone, and a PHS (Personal Handyphone System), and a slate terminal such as a PDA (Personal Digital Assistant).

  In addition, the blacklist setting device 10 may be implemented as a generation server device that provides a terminal device used by a user as a client and provides the client with a service related to the generation of the blacklist. For example, the generation server device is implemented as a server device that provides a generation service that receives attack information as input and outputs a blacklist. In this case, the generation server device may be implemented as a Web server, or may be implemented as a cloud that provides a service related to the above blacklist generation by outsourcing.

  FIG. 6 is a diagram illustrating an example of a computer that executes a blacklist setting program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to the display 1130, for example.

  The hard disk drive 1090 stores, for example, the OS 1091, the application program 1092, the program module 1093, and the program data 1094. That is, a program that defines each process of the blacklist setting device 10 is implemented as a program module 1093 in which codes executable by a computer are described. The program module 1093 is stored in, for example, the hard disk drive 1090. For example, a program module 1093 for executing the same processing as the functional configuration of the blacklist setting device 10 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD.

  The setting data used in the processing of the above-described embodiment is stored as the program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 as needed, and executes them.

  The program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), or the like). Then, the program module 1093 and the program data 1094 may be read from another computer by the CPU 1020 via the network interface 1070.

Reference Signs List 10 blacklist setting device 11 input / output unit 12 communication unit 13 storage unit 14 control unit 141 acquisition unit 142 calculation unit 143 selection unit 144 generation unit

Claims (4)

An acquisition unit that acquires the number of attacks for each type of attack and the source IP address of the cyber attack observed on the Internet;
A calculation unit that calculates a parameter of the distribution function when the distribution of the number of attacks for each of the attack source IP addresses is represented by a predetermined distribution function for each of the attack types;
Under the constraint that the number of selectable IP addresses is equal to or less than a predetermined upper limit, the detection rate is a detection rate calculated based on the distribution function and the parameters of the distribution. A selector for selecting an IP address to be set in a blacklist from the IP addresses of the attack sources so as to be maximized;
A blacklist setting device, comprising:   The black calculator according to claim 1, wherein the calculation unit calculates a parameter of the zeta distribution when a distribution in which the IP addresses of the attack sources are arranged in descending order of the number of attacks is represented by a zeta distribution. List setting device. A blacklist setting method executed by a blacklist setting device,
An acquisition step of acquiring the number of attacks for each type of attack and the IP address of the attack source for cyber attacks observed on the Internet;
A calculating step of calculating parameters of the distribution function when the distribution of the number of attacks for each IP address of the attack source is represented by a predetermined distribution function for each of the attack types;
Under the constraint that the number of selectable IP addresses is equal to or less than a predetermined upper limit, the detection rate is a detection rate calculated based on the distribution function and the parameters of the distribution. A selecting step of selecting an IP address to be set in a blacklist from the attacking IP addresses so as to be maximized;
A blacklist setting method comprising: An acquisition step of acquiring the number of attacks for each type of attack and the IP address of the attack source for cyber attacks observed on the Internet;
A calculating step of calculating parameters of the distribution function when the distribution of the number of attacks for each IP address of the attack source is represented by a predetermined distribution function for each of the attack types;
Under the constraint that the number of selectable IP addresses is equal to or less than a predetermined upper limit, the detection rate is a detection rate calculated based on the distribution function and the parameters of the distribution. A selecting step of selecting an IP address to be set in a blacklist from the IP addresses of the attack sources so as to be maximized;
A blacklist setting program for causing a computer to execute the program.

Images