JP6800744B2 - Whitelisting device - Google Patents

Description

The present invention relates to a whitelist creating device, and relates to a whitelist creating device suitable for creating a whitelist for a terminal newly introduced in a business system in a short period of time to improve the availability of the system.

In recent years, malicious malicious programs (malware) such as computer viruses, spyware, and bot programs that pose threats such as information leakage and unauthorized access have been increasing. To protect your system or network from malware threats, you first need to detect malware. Here, there are various methods for detecting malware. For example, there is a method for recognizing malware based on statistical data, but such a method has a problem that it takes time to detect. In addition, there is a problem that the detection accuracy is lowered for advanced malware. Furthermore, in recent years, so-called "targeted attacks" that skillfully utilize advanced malware to infiltrate the networks of specific government offices, companies, and organizations to steal confidential information and destroy systems have become a major security issue. It is a threat.

As one of the countermeasures against these attacks, there is a whitelist type countermeasure. In the whitelist type countermeasures, normal activities required for business (starting a specific process, accessing a specific WEB server, etc.) are defined in advance for each system, terminal, and user, and recorded in a database called a whitelist. To do. Then, if an activity not recorded in the whitelist is found during the work after the whitelist is created, it is determined that the system, terminal, or user who carried out the activity may have been attacked.

There are various ways to create a whitelist, but the most common is to whitelist the activities performed by the device within a certain period of time when it is guaranteed that no attacks have occurred. Is. In the following, the period required to create a whitelist is referred to as a "learning period", and the period during which an attack is actually detected using the whitelist after learning is referred to as an "operation period".

Here, as one of the issues of whitelist operation, false detection occurs when the terminal carries out an activity that happened not to be performed during the learning period during the operation period after the whitelist is created. There is. The easiest possible measure to prevent false positives is to take a long learning period and create a whitelist with no omissions. However, the lengthening of the learning period increases the operating cost because (1) the period for which it is necessary to guarantee that there is no attack increases, and (2) the activity by malware that attacks during the learning period is mixed in the whitelist. The problem arises that the risk of doing so increases.

In response to such a problem, in Patent Document 1, when a program not listed in the white list is started on the terminal during the operation period, the electronic signature or the like is verified to determine whether or not there is any harm. Then, when it is determined that there is no harm, an information processing system for preventing false detection is disclosed by adding it to the white list.

Japanese Unexamined Patent Publication No. 2014-96143

In the system described in Patent Document 1, it is premised that the target terminal has already created a reference white list. However, in an actual business system, new terminals are introduced even during operation for various reasons. Since these new terminals do not have a whitelist at the time of introduction, it is necessary to create a new whitelist. For this reason, in a system in which new terminals are frequently introduced, the period in which terminals exist during the learning period increases, and the above-mentioned problems of increased operating costs and contamination by malware activities cannot be solved.

An object of the present invention is to reduce the operation cost and ensure security by shortening the learning period required for creating a whitelist on a newly introduced terminal in a business system that introduces whitelist-type security. May improve system availability.

The configuration of the whitelist creation device of the present invention is a whitelist creation device that creates a whitelist that records activities executed in a business system as a whitelist, and is a means for holding a whitelist of an existing operation terminal and a new one. It has a means of recording activities that occurred within a certain period of time on the introduced terminal, and a means of calculating the correlation between the activities that occurred within a certain period of time on the newly introduced terminal and the activities recorded as a whitelist of existing operation terminals. It is a thing. Then, the activity that occurred within a certain period and the activity recorded as a whitelist of the existing operation terminal are associated based on the correlation, and the activity that occurred within a certain period on the newly introduced terminal and the associated activity are described above. Record as a new whitelist on newly introduced terminals.

According to the present invention, in a business system that introduces whitelist-type security, the learning period required for creating a whitelist on a newly introduced terminal is shortened to reduce operating costs and ensure security. The availability of the system can be improved.

It is a figure which shows the outline of the process of making a whitelist in the business system which concerns on one Embodiment. It is a system block diagram of the business system which concerns on one Embodiment. It is a hardware software configuration diagram of the whitelist making apparatus. It is a figure which shows an example of the activity record table 100. It is a figure which shows an example of the existing operation terminal white list 200. It is a figure which shows an example of the activity correlation rule table 300. It is a figure which shows an example of the activity correlation table 400. It is a figure which shows an example of the instant white list 500. It is a figure which shows an example of the performance record table 600. It is a flowchart which shows the process of the activity information receiving part 1000. It is a flowchart which shows the process of a whitelist making part. It is a flowchart which shows the processing of the activity correlation part. It is a flowchart which shows the process of the instant white list creation part. It is a figure explaining the concept of a learning slot.

Hereinafter, an embodiment according to the present invention will be described with reference to FIGS. 1 to 14.

In this embodiment, a business system composed of three existing operation terminals is assumed. Then, when one newly introduced terminal is introduced, an instant whitelist, which is a whitelist for newly introduced terminals, is created based on the whitelist of the existing three terminals.

First, the outline of the whitelist creation process in the business system according to the embodiment will be described with reference to FIG.

First, in the existing operation terminal, a whitelist is created at the timing when the learning period ends. Here, the length of the learning period on the existing operation terminal is referred to as Ltime.

After that, a newly introduced terminal is introduced and an instant whitelist is created. The instant whitelist is an existing whitelist in the business system of the present embodiment, in addition to activities during the learning period (as described above, details such as activation of a specific process and access to a specific WEB server). It is a whitelist created based on the list, and "instant" suggests that it can be created in a shorter period of time than a normal whitelist. It is assumed that the maximum value of the learning period length of the instant whitelist is Time'. Here, Ltime'<Ltime holds. Ltime'is the maximum value to the last, and depending on the conditions, learning is completed in a shorter period than Ltime'. The instant whitelist is created based on the activities that occur during Time'for newly introduced terminals and the whitelist of existing operating terminals.

Next, the system configuration and the data flow of the business system according to the embodiment of the present invention will be described with reference to FIGS. 2 and 3.

As shown in FIG. 2, the business system of the present embodiment includes a whitelist creation device 10, an existing operation terminal X20a, an existing operation terminal X20b, an existing operation terminal Z20c, a newly introduced terminal 30, and a communication network 40. Further, the whitelist creation device 10 is operated by the operator 50.

The whitelist creation device 10 is a device that creates a whitelist of existing operating terminals and an instant whitelist of newly introduced terminals and manages them.

The activity information receiving unit 1000 receives the activity information 1 from the existing operation terminal X20a, the existing operation terminal Y20b, and the existing operation terminal Z20c, and receives the activity information 2 from the newly introduced terminal 30. The activity information 1 and the activity information 2 include information on the activity status (when and what kind of activity was performed) of each terminal. The activity information 1 and the activity information 2 may be recorded by introducing an agent program into each terminal, or communication on the communication network 40 may be acquired. Types of activities include activities performed by ordinary terminals, such as process startup, WEB communication, file access, and registry access. The activity information receiving unit 1000 receives the acquired activity information via the communication network 40 and records it in the activity record table 100. Further, when the terminal that has transmitted the activity information is in operation, the determination result of the whitelist collation is recorded in the performance record table 600.

The performance record table 600 is a table that records information about the whitelist of terminals in operation, and manages the number of times that activities included in the whitelist in operation occur and the number of times activities that are not included occur. ..

The whitelist creation unit 1100 creates a whitelist for existing operation terminals based on the activity information stored in the activity record table 100, and stores it in the existing operation terminal whitelist 200.

The activity correlation calculation unit 1200 calculates the correlation between activities based on the existing operation terminal whitelist 200 and the activity correlation rule table 300, and stores the correlation in the activity correlation table 400.

The instant whitelist creation unit 1300 creates an instant whitelist of the newly introduced terminal 30 based on the activity record table 100 and the activity correlation table 400 of the newly introduced terminal 30, and stores the instant whitelist in the instant whitelist 500.

The existing operation terminal X20a, the existing operation terminal Y20b, the existing operation terminal Z20c, and the newly introduced terminal 30 have computer resources (hardware resources, software resources) such as general personal computers, servers, smartphones, and mobile terminals. Applicable.

The communication network 40 may be a public network that communicates with a WAN (World Area Network), a LAN (Local Area Network), a mobile phone, a PHS, or the like. Communication between the devices is performed via the communication network 40.

The operator 50 controls each unit of the whitelist creation device 10 via the operation unit 3. The operation contents include creating an existing operation terminal whitelist, calculating activity correlation, and creating an instant whitelist. In addition, the instant whitelist 500 and the existing operation terminal whitelist 200 are accessed in a timely manner to make changes such as manually updating the whitelist.

Next, the hardware configuration and the software configuration of the whitelist creation device 10 will be described with reference to FIG.

As shown in FIG. 3, the whitelist creation device 10 is connected to a CPU (Central Processing Unit) 11, a main memory 12, an external storage device 13, a network I / F (Interface) 14, and an input / output device 15 by a bus 16. It is a configured configuration.

The CPU 11 controls each part of the whitelist making device 10, executes a program stored in the main memory 12, and executes each functional part (activity information receiving part 1000, whitelist making part 1100, activity correlation calculation part 1200). , Instant whitelist creation unit 1300) is realized.

The main memory 12 is a volatile semiconductor memory, and stores programs, work data, and the like loaded from the external storage device 13.

The external storage device 13 is composed of a magnetic storage device such as an HDD (Hard Disk Drive) and an SDD (Solid State Drive) and a non-volatile semiconductor storage device, and is used for long-term storage of data. The external storage device 13 includes each table (activity record table 100, existing operation terminal white list 200, activity correlation rule table 300, activity correlation table 400, instant white list 500, achievement record table 600) included in the whitelist creation device 10. ) Is stored. Further, a group of programs (activity information receiving program 31, whitelist creating program 32, activity correlation calculation program 33, instant whitelist creating program 34) that realizes the whitelist function are installed in the external storage device 13. The activity information receiving program 31, the whitelist creating function program 32, the activity correlation calculation function program 33, and the instant whitelist creating program 34 are the activity information receiving unit 1000, the whitelist creating unit 1100, and the activity correlation shown in FIG. 2, respectively. This is a program that realizes the functions of the sex calculation unit 1200 and the instant whitelist creation unit 1300.

The network I / F 14 is a portion that connects the whitelist creating device 10 to the communication network 40 and has an interface for transmitting and receiving data.

The input / output device 15 is a device for inputting various information and outputting stored information by the user and the administrator of the white list creating device 10, for example, a liquid crystal display, a touch panel, a keyboard, a mouse, and a printer. And so on.

The bus 16 connects the CPU 11, the memory 12, the external storage device 13, the network I / F 14, and the input / output device 15, and realizes the exchange of information between the functions.

The hardware configuration of the existing operation terminal and the newly introduced terminal 30 can also be realized by a general computer in the same manner as the whitelist creation device 10.

Next, the data structure used by the whitelisting apparatus will be described with reference to FIGS. 4 to 9.

The activity record table 100 is a table for recording the activity generated in each terminal, and as shown in FIG. 4, each field of ID 101, activity start time 102, activity terminal 103, activity type 104, and activity content 105. Has. An identifier for uniquely identifying each record is stored in the ID 101. The activity start time 102 stores the time when the activity occurred. The activity terminal 103 stores an identifier that uniquely indicates the terminal that has performed the activity. The activity type 104 stores an identifier indicating the type of activity. Specific examples include process, communication, file access, and registry access. Information on specific activity content is stored in the activity content 105, and the content depends on the activity type 104. For example, when the activity type 104 is a process, the started process name is recorded, and when the activity type 104 is communication, the communication destination (URL (Uniform Resource Location), IP (Internet Protocol) address) and the like are recorded.

For example, in the example shown in FIG. 4, in the record with ID 101 = 1, the activity start time 102 is "2016-07-16 10:00", the activity terminal 103 is "existing operation terminal X", and the activity type 104 is " "P1" is set for "process" and activity content 105. In the record with ID 101 = 4, the activity start time 102 is "2016-07-16 10:20", the activity terminal 103 is "existing operation terminal Z", the activity type 104 is "communication", and the activity content 105 is " WEB1 ”is set.

The existing operation terminal white list 200 is a list showing the white list generated by each existing operation terminal for each terminal, and as shown in FIG. 5, each field of ID 201, terminal 202, and white certification activity 203 is displayed. Have. The ID 201 stores an identifier for uniquely identifying each whitelist. The terminal 202 stores an identifier for uniquely identifying the target terminal. The activity included in the white list is stored in the white certification activity 203.

In the example shown in FIG. 5, the record of ID201 = 1 shows that the white certification activity 203 of the terminal 202 = "existing operation terminal X" is "P1, P3, P4, P5, P10, P14 ...". Has been done.

The activity correlation rule table 300 is a table for storing rules for measuring the correlation of activities, and has ID 301, correlation condition 302, correlation value calculation 303, and weight 304 fields as shown in FIG. The ID 301 stores an identifier for uniquely identifying each record for which the rules for calculating the correlation are defined. The correlation condition 302 stores a condition indicating whether or not an activity is included in the target of the record. A specific correlation calculation method is stored in the correlation value calculation 303. In this field, a general correlation calculation method such as Pearson correlation coefficient or cosine similarity (described later) may be used, or a unique method may be used. The weight 304 stores the weight of the correlation value calculation 303.

As described above, the activity correlation rule table 300 records an index (method for calculating the correlation value) for quantitatively calculating the correlation of each activity and its weighting. The index to be calculated differs depending on the type of activity. For example, both of the two activities are evaluated by "process name similarity" when they are process activities, and by "domain name similarity" when they are communication activities. Then, the correlation value of the two activities is determined by the weighted average of the correlation value calculation 303 obtained in the record to which the correlation condition corresponds.

In the example shown in FIG. 7, the record with ID 301 = 1 indicates that the correlation condition 302 is "all activities", the correlation value calculation 303 is "cosine similarity of the terminal vector used", and the weight 304 is "W1". ing.

Since the setting of the correlation condition 302 is "all activities", this record is used to calculate the similarity of all activities.

Here, the cosine similarity of the used terminal vector will be described. The used terminal vector is a vector that expresses whether or not each terminal has carried out the activity, or the frequency of carrying out the activity. The use terminal vector of a certain activity is defined as a vector having a flag indicating whether or not the terminal is used at each coordinate. The terminal vector used for activity A in the present embodiment is (whether or not the existing terminal X of activity A is implemented, whether or not the existing terminal Y of activity A is implemented, and whether or not the existing terminal Z of activity A is implemented). .. For example, according to the example of the existing operation terminal whitelist 200 of FIG. 5, the terminal that executed the process P1 is only the existing operation terminal X, and the existing operation terminal Y and the existing operation terminal Z are not performed. Therefore, the use terminal vector of the process P1 is v1 = (1,0,0). Similarly, since the process P4 is executed by two terminals, the used terminal vector is v2 = (1, 1, 0). Finally, the cosine similarity of the two used terminal vectors v1 and v2 is obtained by v1 · v2 / (| v1 || v2 |). In the example of P1 and P2, it is 1 / √2. Here, · represents the inner product of the vectors, and || represents the length of the vectors.

The record with ID 301 = 2 indicates that the correlation condition 302 is "process activity", the correlation value calculation 303 is "process name similarity", and the weight 304 is W2. Since the correlation condition 302 here is "process activity", the target activity is only the process. The process name similarity is the similarity of the name of each process, and any index for evaluating the name can be used. Specifically, there are indicators such as the minimum editing distance.

In calculating the correlation of process activities, the similarity of the contents of the executable file that is the start source of the process, the similarity of the creation period of the executable file, and the like can also be used for the correlation calculation.

The record with ID 301 = 3 indicates that the correlation condition 302 is "communication activity", the correlation value calculation 303 is "domain name similarity", and the weight 304 is W3. Since the correlation condition 302 here is "communication activity", the target activity is only communication. The domain name similarity is the similarity of the communication destination domain name of each communication, and any index related to the name can be used. Specifically, there are indicators such as the minimum editing distance.

In calculating the correlation of communication activities, the similarity of IP addresses obtained by reverse lookup of domain names, the similarity of registrars, and the like can also be used in the correlation calculation.

Hereinafter, a specific example of calculating the correlation value will be described. For example, when the activities A1 and A2 for which the correlation value is calculated are both related to the process, the records of ID301 = 1 and ID302 = 2 are applied, and the correlation value can be obtained by the following (Equation 1). ..

Further, when the activity A1 is a process and the activity A2 is a communication, only the rule of ID301 = 1 is applied, so that the correlation value between the two is only the cosine similarity (A1, A2).

The activity correlation table 400 is a table showing the clusters to which each activity belongs, and has ID 401, correlation cluster 402, and cluster element 403 fields as shown in FIG. 7. Each record of the activity correlation table 400 is described by grouping the activities judged to have high correlation by the clustering process based on the activity correlation rule table 300. An identifier for uniquely identifying each group is stored in the ID 401. The cluster name of each cluster is stored in the correlation cluster 402. The cluster element 403 stores the identifier of the activity included in each cluster.

In the example shown in FIG. 7, the record with ID 401 = 1 indicates a cluster in which the correlation cluster 402 is “cluster 1” and the cluster element 403 is “P4, P10”.

The instant white list 500 is a table showing a white list of newly introduced terminals, and has ID 501, terminal 502, type 503, and white certification activity 504 fields as shown in FIG.

An identifier for uniquely identifying each record is stored in the ID 501. The name or identifier of the target terminal is stored in the terminal 502. In the type 503, a type indicating whether the whitelist shown in the record is an activity carried out by the terminal during the learning period Time'or an activity added by the method (FIG. 13) described later is stored. To. In the former case, the type 503 is described as "original", and in the latter case, "additional" is described. Unlike the existing operation terminal whitelist 200 shown in FIG. 5, the instant whitelist of newly introduced terminals is described over a plurality of records.

In the example of FIG. 8, the record with ID 501 = 1 shows a white list in which the terminal 502 is "newly introduced terminal", the type 503 is "original", and the white certification activity 504 is "P4, P5".

The record with ID 501 = 2 shows a white list in which the terminal 502 is "newly introduced terminal", the type 503 is "additional", and the white certification activity 504 is "P10, P14".

In this example, it is shown that P10 and P14 are also included in the instant whitelist of newly introduced terminals that have implemented P4 and P5. This is because P4 and P10, and P5 and P14 are included in the same cluster, as shown in the activity correlation table 400 of FIG. 7, and each is "added" and added to the whitelist. (Details will be described later with reference to FIG. 13).

The performance record table is a table that records the operation status of each whitelist as statistics, and as shown in FIG. 9, each of ID601, terminal 602, type 603, operation start 604, false alert number 605, and match number 606. Has a field. An identifier for uniquely identifying each record is stored in the ID 601. The terminal 602 stores the name or identifier of the terminal targeted by the whitelist. Type 603 stores the type of whitelist of interest. In type 603, "normal" is described for a whitelist for existing operation terminals, and "instant" is described for an instant whitelist for newly introduced terminals. The operation start 604 stores the time when the whitelist was operated. The false alert number 605 stores the number of activities that occurred during operation that were not listed in the whitelist and that were found to be not similar to malware or attacks by subsequent investigations. Here, the name "erroneous alert" is due to generating an alert for all activities that are not listed in the whitelist, even if they are not malware (described later with reference to FIG. 10). The number of matches 606 stores the number of whitelisted activities that occurred during operation.

A whitelist having a larger number of matches 606 than the number of false alerts 605 can be said to be a good whitelist with high accuracy. Conversely, a whitelist with a large number of false alerts is a whitelist with low accuracy and may need to be relearned.

In such a case, the operator 50 may upgrade a good instant whitelist to a normal whitelist in consideration of the implementation situation. The instant whitelist, which is usually upgraded to a whitelist, is reprinted on the existing operation terminal whitelist 200 and used to create a record of the activity correlation table 400.

On the contrary, for the whitelist with low accuracy, the operator 50 may add a new activity according to the knowledge obtained from the operation, or discard the whitelist and perform learning again.

In the example shown in FIG. 9, the record with ID601 = 1 is terminal 602 = "existing operation terminal X", type 603 = "normal", operation start 604 = "2016/01/01", number of false alerts. It shows a record showing the operation results of the whitelist, in which 605 = "34444" and the number of matches 606 = "100,000".

The record of ID601 = 4 is terminal 602 = "new operation terminal", type 603 = "instant", operation start 604 = "2016/09/01", false alert number 605 = "3", match number 606 = It is a record showing the operation results of the white list, which is "333013".

Here, the record with ID601 = 1 has a very large number of false alerts 605 as compared with other records. Therefore, the operator 50 may determine the existing operation terminal X as a re-learning target.

On the other hand, the record with ID601 = 4 has a smaller number of false alerts 605 than other records. Therefore, the instant whitelist shown in this record may be upgraded to a regular type whitelist.

Next, the processing of the whitelisting apparatus will be described with reference to FIGS. 10 to 14.

First, the processing of the activity information receiving unit 1000 will be described with reference to FIG.

The activity information receiving unit 1000 is continuously executed during the activation of the whitelist creating device 10.

First, the activity information receiving unit 1000 receives the activity information from each terminal (S2001).

Next, the activity information receiving unit 1000 adds the received activity information to the activity record table 100 (S2002).

The activity information receiving unit 1000 determines whether or not the terminal that has transmitted the activity information is in operation (S2003), and if it is not in operation (S2003: No), that is, if the whitelist is being learned. Returns to S2001. If it is in operation (S2003: Yes), the process proceeds to S2004. Whether the terminal is in operation or learning is not shown, but it can be known by referring to the operation history of the terminal of the system.

The activity information receiving unit 1000 determines whether or not the activity information received in S2001 is included in the whitelist of the terminal (S2004), and if it is included (S2004: Yes), proceeds to process S2007 and includes the activity information. If not (S2004: No), the process proceeds to process S2005.

When S2004 is Yes, the activity information receiving unit 1000 updates the performance record table 600 (S2008). In this case, since the activity is included in the whitelist, the number of matches 6060 is incremented accordingly.

If S2004 is No, the activity information receiving unit 1000 notifies the operator 50 of an alert regarding activities not included in the whitelist (S2005). As the alert notification method, means generally used for alert transmission such as display on an interface screen on a display device, e-mail, SNMP (Simple Network Management Protocol) trap, and use of a unique communication protocol are used.

The activity information receiving unit 1000 receives feedback on the alert from the operator 50 (S2006). Feedback includes information on whether the activity being alerted is similar to malware or an attack, or a false alert.

Next, the activity information receiving unit 1000 updates the performance record table 600 (S2008). If the activity is included in the whitelist, the number of matches 606 of the corresponding record is incremented. On the other hand, if the feedback obtained in S2006 includes an erroneous alert, the number of matches 6060 is incremented accordingly. After the update process, the process returns to S2001.

Next, the processing of the whitelist creation unit will be described with reference to FIG.

The whitelist creation unit is executed by the operation of the operator 50.

The whitelist creation unit 1100 acquires the activity of each existing operating terminal during the past period from the activity record table 100 (S2101). Although any period can be set for Time, it is considered that a reasonable value is several weeks to several months in normal operation.

The whitelist creation unit 1100 extracts the activities acquired in S2101 whose frequency of occurrence is at least a certain level (S2102). For example, an activity having an occurrence frequency of 10 times or more during the period of Ltime is extracted.

The whitelist creation unit 1100 creates and records a new record of the existing operation terminal whitelist 200 in which the activity extracted in S2102 is set as the white certification activity 203 (S2103).

Next, the processing of the activity correlation calculation unit 1200 will be described with reference to FIG.

The activity correlation calculation unit 1200 is executed by the operation of the operator 50.

First, the activity correlation calculation unit 1200 reads the record in the existing operation terminal whitelist 200 (S2201).

The activity correlation calculation unit 1200 calculates the correlation value between the plurality of read activities and performs clustering based on the correlation area (S2202).

Finally, the activity correlation calculation unit 1200 records the result of clustering in the activity correlation table at 400 (S2203).

The details of crystalling will be described below.

Each rule defined in the activity correlation rule table 300 is used for calculating the correlation value. In the example shown in the existing operation terminal whitelist 200 of FIG. 5, since P4 and P10 are both executed by the existing operation terminal X and the existing operation terminal Y, the cosine similarity of the used terminal vector is high and the correlation is high. The value is judged to be high. Similarly, P5 and P14 and P8 and P11 are also judged to have high correlation values. On the contrary, in other combinations (for example, P5 and P8), the correlation value is judged to be low.

The method used for clustering may be a clustering algorithm based on a correlation value or a distance (generally, the distance is inversely proportional to the correlation value), and examples thereof include a K-means method, a 2-means method, and a dendrogram. There are two types of clustering algorithms, one that recursively creates a cluster by aggregating individual elements and the other that recursively divides one cluster into subclusters. Criteria for clustering are needed. This standard may be set arbitrarily, but here, the standard when the 2-means method is used will be described.

In the 2-means method, first, one cluster including all activities is formed, and the K-means method is applied to recursively divide into two. Here, the criteria for whether or not a cluster C = {a1, a2, a3, a4} should be divided into two subclusters C1 = {a1, a2}, C2 = {a3, a4} will be described. As will be described later, the newly introduced terminal that has executed one activity in the cluster during Time'has all the other activities included in the same cluster in the instant whitelist (described later with reference to FIG. 13). Here, let H be a set of existing operating terminals that have performed the activities included in C at least once during the learning period. At this time, among the activities included in C, the number of activities performed by the terminal h ∈ H is defined as f (C, h) (≦ | C |, where | C | is the number of activities included in C). To do. The larger f (C, h), the more activities the terminal will carry out in the cluster. On the other hand, in order not to register unnecessary activities, it is desirable that the size of C is smaller than that of f (C, h). Therefore, the quality Q (C) of a certain cluster C is defined by the following (Equation 2).

And
Q (C) <Q (C1) + Q (C2)
Clustering shall be continued as long as the above holds, that is, as long as the quality is higher when divided.

Next, the process of the instant whitelist creation unit 1300 will be described with reference to FIGS. 13 and 14.

The instant whitelist creation unit 1300 is executed by the operation of the operator 50. The instant whitelist creation unit 1300 creates an instant whitelist in a learning period of up to Time'(<Ltime). The whitelist creation unit 1100 performs learning and verification of learning results at regular intervals, and discontinues learning when satisfactory performance is obtained. Therefore, for a terminal with good learning efficiency, learning can be completed earlier than Time'. The instant whitelist creation unit 1300 operates a newly introduced terminal for a certain period of time called a learning slot to perform business (S2301). Here, the learning slot is a subdivision unit of the learning period (FIG. 14), and the following (Equation 3) holds.
Time'= K x learning slot ... (Equation 3)
However, K can set an integer Time'with K> 1 and an arbitrary period for the learning slot, but one of the typical settings to be assumed is Time = 2 weeks and learning slot = 1 day (that is,). , K = 14) is conceivable.

The instant whitelist creation unit 1300 acquires the activity contents for one past learning slot from the activity record table 100 (S2302).

Next, the instant whitelist creation unit 1300 extracts unique entries whose frequency of occurrence is a certain number of times or more from the activity contents acquired in S2302 and adds them to the instant whitelist 500 (S2303). The type 503 is "original".

Next, the instant whitelist creation unit 1300 extracts the activities belonging to the same cluster as the individual entries added in S2303 from the activity correlation table 400 and adds them to the instant whitelist 500 (S2304). In this case, the type 503 is "additional".

For example, if one of the entries acquired in S2303 is P4, P10 with ID 401 = 1 is added (see FIG. 7).

The instant whitelist creation unit 1300 applies S2306 to all the entries, and after completion (S2305: Yes), proceeds to S2306.

When S2305 is Yes, the instant whitelist creation unit 1300 adds a learning slot to a variable indicating the total learning period (total learning period ← total learning period + learning slot) (S2306).

The instant whitelist creation unit 1300 operates the instant whitelist during the period of the next learning slot (S2307). The purpose of the operation here is to measure the performance (false alerts and number of matches) in the current instant whitelist. Therefore, S2003 for the terminal is temporarily set to "Yes". During this period, the achievements are recorded in the achievement recording table 600.

That is, the performance of the instant whitelist obtained from the learning results in the 1st to nth learning slots is evaluated in the period of the n + 1th learning slots.

Next, the instant whitelist creation unit 1300 acquires the number of erroneous alerts generated during the learning slot period from the performance record table 600, and determines whether or not the number is equal to or greater than the threshold value (S2308). When the erroneous alert is equal to or greater than the threshold value and the total learning period is less than Time'(S2308: Yes), it is determined that there is still room for learning, and the process returns to S2302. In this case, the activity during the period when the false alert occurs above the threshold value will be added to the whitelist.

Learning is completed when the number of false alerts does not exceed the threshold value or when the total learning period exceeds Ltime'. The number of false alerts does not exceed the threshold because it is considered that there are not many activities to be included in the whitelist that do not belong to the instant whitelist, that is, the learning effect has disappeared.

As described above, the whitelist creation device of the present embodiment analyzes the whitelist created in advance for the existing operation terminal in the business system and classifies the highly correlated activities as clusters. Then, when introducing a newly introduced terminal, the newly introduced terminal is operated for a shorter period of time compared to the learning period of the existing operation terminal, and the activities generated during that period and the activities of the cluster that are highly correlated with these activities are newly introduced. It is stored in the whitelist of the installed terminal.

The whitelisting apparatus of this embodiment is based on the following two points of view.

The first point of view is that there is a correlation between the patterns of individual activities that occur at each terminal. For example, in a terminal that performs one activity, there is a relationship that another activity that correlates with it is likely to be performed within a certain period of time.

The second point of view is that there is a high possibility that there is an existing operation terminal in the business system that has a part of the configuration and role that matches the newly introduced terminal, and most of the configurations and roles of the newly introduced terminal are all existing. It means that it can be regarded as a subset of the set of configurations and roles of the operation terminal. For example, when an old terminal used for a certain business is changed to a new terminal, the business of the new terminal becomes the same as the previous business even if the operating system (OS) configuration changes. It also means that a terminal having the same OS configuration as the new terminal exists in the business system.

The whitelist creating device of the present embodiment is particularly effective in a business system / terminal in which these two points of view are established.

As described above, in the present embodiment, when a new terminal is introduced, an instant white list is created by a clustering process that considers the correlation of activities based on the white list created by the existing operation terminal. As a result, it is possible to significantly reduce the time and effort required to create the whitelist when introducing a new terminal.

1 ... Activity information, 2 ... Activity information, 3 ... Operation unit, 10 ... Whitelist creation device, 20a ... Existing operation terminal X, 20b ... Existing operation terminal Y, 20c ... Existing operation terminal Z, 30 ... Newly introduced terminal, 40 ... communication network, 50 ... operator, 100 ... activity record table, 200 ... existing operation terminal whitelist, 300 ... activity correlation rule table, 400 ... activity correlation table, 500 ... instant whitelist, 600 ... achievement record table, 1000 ... Activity information receiving unit, 1100 ... Whitelist creation unit, 1200 ... Activity correlation calculation unit, 1300 ... Instant whitelist creation unit

Claims (7)

It is a whitelist creation device that creates a whitelist that records the activities executed in the business system as a whitelist.
A means to keep a whitelist of existing operating terminals,
A means of recording activities that have occurred within a certain period of time on newly introduced terminals,
It has a means for calculating the correlation between the activity that occurred in the newly introduced terminal within the certain period and the activity recorded as the whitelist of the existing operation terminal.
The activity that occurred within the fixed period and the activity recorded as the whitelist of the existing operation terminal are associated based on the correlation, and the activity that occurred within the fixed period on the newly introduced terminal and the associated activity are associated with each other. A whitelist creating device characterized in that it records as a new whitelist in the newly introduced terminal. In the association based on the correlation between the activity generated within the fixed period and the activity recorded as the whitelist of the existing operation terminal, the activity recorded in the whitelist of the existing operation terminal is correlated. The first aspect of claim 1, wherein the clustering is performed in a plurality of clusters based on the above, and the activities in the cluster including the activities generated in the newly introduced terminal within the fixed period are taken into a new whitelist in the newly introduced terminal. Whitelisting device. In calculating the correlation, a vector is generated for each activity based on the presence or absence of execution at each terminal, and two activities having a high degree of similarity between the vectors are judged to have a high correlation. The whitelist creating device according to claim 1. When calculating the correlation, when the activity type is a process, the similarity of the process name, the similarity of the contents of the executable file that is the start source of the process, and the similarity of the creation period of the executable file are used. The whitelisting apparatus according to claim 1. The whitelist creating apparatus according to claim 1, wherein when the type of activity is communication, the similarity of domain names and the similarity of IP addresses are used in calculating the correlation. The fixed period is the learning period of the new terminal introduced terminal.
The learning period was divided into a plurality of time widths, and the number of activities included in the new whitelist on the newly introduced terminal was verified for each time width, and the number of the activities became less than a certain threshold value. The whitelisting apparatus according to claim 1, wherein the learning period is sometimes terminated. It is a method of evaluating the quality of each cluster when clustering the activities recorded in the whitelist of the existing operation terminal, and clustering until the total quality of the clusters is maximized.
The quality index of the cluster in the clustering is proportional to the sum of the squares of the number of activities included in the cluster by each existing operating terminal, and is inversely proportional to the size of the cluster. Whitelisting device.

Images