JP7574673B2 - Anomaly detection device, anomaly detection program, and anomaly detection method - Google Patents

Description

The present invention relates to an anomaly detection device, an anomaly detection program, and an anomaly detection method, and can be applied to an anomaly detection device that analyzes logs from security devices and detects anomalies such as malware infections and information leaks, for example.

Cyberattacks, which increase and evolve year by year, have become a social problem. In particular, in recent years, there has been an increase in unknown cyberattacks that cannot be prevented by the functions of existing security products alone. In such a situation, there is a method for organizations to protect against cyberattacks by analyzing logs from security products such as proxy servers and firewalls, and monitoring for missed detections by security products.

However, in companies with many employees, the volume of logs from security products is enormous, making manual analysis impractical. For large volumes of logs, an approach that mechanically narrows down abnormal logs is effective.

One approach to mechanically narrowing down logs is to use machine learning to train abnormal communication logs, such as those resulting from malware infections or information leaks caused by cyber attacks, as training data, and then narrow down logs that resemble abnormal communications. Cyber attacks are generally not completed in a single log, and their behavior is often observed across multiple logs. For this reason, the features input to the machine learning machine are extracted from communication logs for each user over a certain period of time. This leads to improved classification accuracy.

Furthermore, when using machine learning, there is an issue of a high number of false positives, but by having an operator investigate the detection results and provide feedback on whether the results are correct, false positives can be reduced during operation. However, there is an issue that abnormal communication logs such as those of cyber attacks are generally difficult to obtain, making it difficult to increase the variety of training data. In such cases, while some of the abnormal communications that have been learned can be detected, other abnormal communications will be overlooked.

In addition, the communication logs of a user who has been subjected to a cyber attack contain not only communications related to the cyber attack, but also that user's normal communications. In other words, even if multiple users are subjected to the same cyber attack, the features formed for each user may be different. In such cases, while a user whose features are close to those of a certain training data may be able to detect an anomaly, a user whose features are not may not be able to detect an anomaly. However, if it is the same cyber attack, there should be common elements that represent the characteristics of that attack.

For example, this would include the hostname of the malware distribution destination or the hostname of a C&C (Command and Control) server. By using such destination hostnames as a key and presenting the features of users who have logs of having accessed the same host to the operator as feedback candidates, it is possible to increase the variety of features that are judged to be abnormal and prevent cyber attacks from being overlooked. A mechanism for presenting such feedback candidate data is needed.

Patent Document 1 discloses a technology in which, in a system for classifying images into several classes, similar images to the misclassified image are searched for in an image database and presented to the operator, and images that have been correctly classified are fed back to the operator in order to improve the classification accuracy of misclassified images. In the technology described in Patent Document 1, supervised machine learning is used to classify images, and unsupervised machine learning is used to search for similar images. An unsupervised machine learning device also classifies images, but the features used can be different from those of a supervised device (e.g., color, texture, shape, etc.). With the technology described in Patent Document 1, images of the same class that have features similar to the misclassified image are fed back as supervised data, thereby efficiently improving classification accuracy.

Patent Document 2 discloses a system that uses supervised learning to determine whether data to be classified is a positive or negative example. The technology described in Patent Document 2 is characterized by the fact that the more recent the feedback date, the greater the weighting of the supervised data. By weighting in this way, data close to the newly fed back feature is more likely to be determined as a positive example, and the variation of positive examples around that feature can be increased.

JP 2017-111731 A Patent No. 5187635

However, the technology described in the above-mentioned Patent Document 1 uses an unsupervised machine learning machine to present multiple images belonging to the same class as feedback candidate images. Although it does not take much time to determine whether multiple images are presented, when investigating a single detection result, such as security logs, it may not be practical to investigate all candidates using this presentation method.

In addition, the technology described in Patent Document 2 only presents data that is close to the features of the training data as feedback candidates, so it is not possible to broadly increase the variation in features.

In view of the above, in order to increase the variety of training data, there is a need for an anomaly detection device, an anomaly detection program, and an anomaly detection method that can preferentially present as feedback candidates data that does not appear in the trends of the training data's features (high dissimilarity) and is highly likely to be abnormal.

The first invention is an anomaly detection device that detects anomalies by analyzing a log, comprising: (1) a feature vector generation means for generating a feature vector from the log; (2) an anomaly learning and discrimination means for generating an anomaly discriminator by learning the feature vector, which is training data, with a first machine learning device, and discriminating an anomaly in the feature vector using the anomaly discriminator; and (3) a dissimilarity learning and discrimination means for generating a dissimilarity calculator that calculates a dissimilarity between the training data and the feature vector of the training data by learning the training data with a second machine learning device, and for determining whether the dissimilarity is high for the feature vector using the dissimilarity calculator. (4) a feedback priority label assignment means for outputting, as a key element, the value of an abnormal field in the log corresponding to the training data, and assigning a feedback priority label to the feature vector having an element identical to the key element and determined by the dissimilarity learning determination means to have a high dissimilarity; and (5) a feedback candidate display means for preferentially displaying data including the feature vector to which the feedback priority label has been assigned as feedback candidate data, and providing an interface that allows feedback on the accuracy of the feedback candidate data.

The second anomaly detection program of the present invention includes a computer mounted on an anomaly detection device that detects anomalies by analyzing a log, the computer comprising: (1) a feature vector generation means for generating a feature vector from the log; (2) an anomaly learning and discrimination means for generating an anomaly discriminator by learning the feature vector, which is to be training data, with a first machine learning device, and discriminating anomalies in the feature vector using the anomaly discriminator; and (3) a dissimilarity calculator for calculating dissimilarity to the feature vector of the training data by learning the training data with a second machine learning device, and determining whether the dissimilarity is high for the feature vector using the dissimilarity calculator. (4) a feedback priority label assignment means that outputs, as a key element, the value of an abnormal field in the log corresponding to the training data, and assigns a feedback priority label to the feature vector that has an element identical to the key element and is determined to have a high dissimilarity by the dissimilarity learning assignment means; and (5) a feedback candidate display means that preferentially displays data including the feature vector to which the feedback priority label has been assigned as feedback candidate data, and provides an interface that allows feedback on the accuracy of the feedback candidate data.

The third invention is an anomaly detection method used in an anomaly detection device that detects anomalies by analyzing a log, in which (1) a feature vector generation means generates a feature vector from the log, (2) an anomaly learning and discrimination means generates an anomaly discriminator by learning the feature vector, which is teacher data, with a first machine learning device, and discriminates an anomaly in the feature vector using the anomaly discriminator, and (3) a dissimilarity learning and discrimination means generates a dissimilarity calculator that calculates dissimilarity to the feature vector of the teacher data by learning the teacher data with a second machine learning device, and discriminates an anomaly in the feature vector using the dissimilarity calculator. (4) the feedback priority label assignment means outputs, as a key element, the value of an abnormal field in the log corresponding to the training data, and assigns a feedback priority label to the feature vector having an element identical to the key element and determined by the dissimilarity learning judgment means to have a high dissimilarity; (5) the feedback candidate display means preferentially displays data including the feature vector to which the feedback priority label has been assigned as feedback candidate data, and provides an interface that allows feedback on the accuracy of the feedback candidate data.

According to the present invention, in order to increase the variety of training data, data that does not appear in the trend of the features of the training data and is likely to be abnormal can be presented preferentially as feedback candidates.

1 is a block diagram showing an internal configuration of an anomaly detection device according to an embodiment; 11 is an explanatory diagram showing feature amounts for each detection engine for logs for a certain period for each source address according to the embodiment; FIG. 11 is an explanatory diagram showing an example of display of an abnormality determination result according to the embodiment; FIG. 10 is a flowchart illustrating a characteristic operation of the anomaly detection device when a security log is input according to an embodiment. 5 is a flowchart showing a characteristic operation (learning operation of an anomaly discriminator) of an anomaly learning/discrimination unit according to the embodiment; 13 is a flowchart showing a characteristic operation (learning operation of a dissimilarity calculator) of a dissimilarity learning/determination unit according to the embodiment. 10 is a flowchart illustrating a characteristic operation of a feedback candidate display unit according to the embodiment. 10 is a flowchart illustrating a characteristic operation of an abnormality determination result display unit according to the embodiment.

(A) Main embodiment Hereinafter, an embodiment of an anomaly detection device, an anomaly detection program, and an anomaly detection method according to the present invention will be described in detail with reference to the drawings.

(A-1) Configuration of the embodiment (A-1-1) Overview of the anomaly detection device First, an overview of the anomaly detection device of this embodiment will be described. This embodiment relates to an anomaly detection device that detects abnormal communication such as a cyber attack from a log of a security product (hereinafter referred to as a "security log") using a supervised machine learning machine. Here, the security log is assumed to be, for example, a log of a proxy server. In the anomaly detection device of this embodiment, multiple detection engines that define abnormal communication behavior are prepared, logs that match the behavior defined from each viewpoint are extracted, and a score indicating anomaly is assigned to the extracted log with a score of 0 to 100 points. An example of a detection engine that defines abnormal communication behavior is "downloading a file with an invalid extension" or "accessing a host that is not usually accessed." Next, the sum of the scores for each detection engine for logs (communication logs) for a certain period for each source address as shown in FIG. 2 is used as a feature vector to be input to the machine learning machine. Then, the anomaly detection device assigns a teacher label to the feature vector including the abnormal communication log, learns, and outputs an anomaly classifier. The anomaly classification result is presented to the operator via a GUI (Graphical User Interface) or the like. The operator uses the anomaly classification result as a starting point to investigate the detection results of the detection engine and communication logs, judges whether the anomaly classification result is correct or not, and feeds it back to the system (anomaly detection device). The anomaly detection device periodically re-learns the anomaly classifier based on the feedback information.

In the anomaly detection device in this embodiment, in addition to the machine learning machine for anomaly detection described above, a machine learning machine is provided that extracts data having features with high dissimilarity to the teacher data. This machine learning machine performs learning so that the input and output are the same when the feature vector of the teacher data is reduced in dimension and the number of dimensions is restored to the original value and output, for example, like an autoencoder. At this time, the dissimilarity is calculated as a value obtained by taking the difference between the input and output vectors for each vector element when a certain data is input to a trained machine learning machine and summing them. Hereinafter, the mechanism that calculates the dissimilarity output by this machine learning machine is called a "dissimilarity calculator". Data that is determined to have high dissimilarity is presented to the operator as feedback candidate data using a GUI or the like. Furthermore, among the feedback candidate data, data that has a key element in common with the teacher data is presented preferentially. The key element represents the value of the field of the log that contributed to determining that the teacher data is abnormal. For example, in the case of an access log of a malware distribution site, the destination host name (destination IP address) of the log is the key element. The feedback candidate data is surveyed by the operator using the same procedure as for the anomaly classification results described above, and the result of the judgment as to whether it is correct or incorrect is fed back to the system (the anomaly detection device). The anomaly detection device periodically retrains the dissimilarity calculator based on the feedback information.

(A-1-2) Detailed configuration of the anomaly detection device 10 Fig. 1 is a block diagram showing the internal configuration of the anomaly detection device according to the embodiment. In Fig. 1, the anomaly detection device 10 includes a processing unit 11, a feature amount generating unit 12, an anomaly learning/discrimination unit 13, a dissimilarity learning/determination unit 14, a feedback priority label assigning unit 15, an anomaly discrimination result display unit 16, a feedback candidate display unit 17, and a storage unit 18.

The anomaly detection device 10 may be constructed, for example, by installing a program on a computer having a processor, memory, etc. Also, the anomaly detection device 10 may be constructed in part or in whole using hardware (for example, a dedicated semiconductor chip, an electric circuit, etc.).

The processing unit 11 has a means for receiving security logs from outside. The processing unit 11 provides the received security logs to the feature generation unit 12 and requests the generation of features. Furthermore, when the processing unit 11 receives an abnormal security log that can be used as training data, it also notifies the feature generation unit 12 of that fact. It is assumed that it is explicitly indicated from outside that the provided security log is training data.

The processing unit 11 further has a means for receiving a GUI display request for the anomaly determination result and the feedback candidates. In response to the display request (for example, when the processing unit 11 receives a display request from the operator via a dedicated interface), it requests the anomaly determination result display unit 16 or the feedback candidate display unit 17 to display the GUI.

When the feature generation unit 12 receives a security log from the processing unit 11, it has means for executing each detection engine, calculating a score, and generating a feature vector to be input to the machine learning device. If a detection engine is executed using multiple security logs, the detection engine is executed when the required number of logs are collected. Each detection engine is associated with viewpoint information of the detection engine, which indicates which element of the log to focus on for detection, and is stored in the memory unit 18.

The viewpoint information of the detection engine is, for example, information indicating the field of the accessed host if the detection engine is "accessing a host that is not usually accessed". When security logs for the period required to generate features are collected, the feature generation unit 12 generates a feature by summing the detection engine scores for that period per source address and concatenating each feature (for example, FIG. 2 above). At this time, if the log used to generate the feature contains teacher data, a teacher label indicating an anomaly is assigned to this feature vector. The feature generation unit 12 saves the security log and the generated feature vector in the memory unit 18. The feature generation unit 12 requests the dissimilarity learning/judgment unit 14 and the anomaly learning/discrimination unit 13 to judge dissimilarity and judge anomaly.

The anomaly learning/discrimination unit 13 has a means for creating an anomaly discriminator that discriminates whether an input feature vector is normal or abnormal through supervised learning. The supervised learner uses a device that can obtain features that contribute to anomaly discrimination (hereinafter referred to as "feature importance information"). For example, it is a decision tree-based supervised learner. The anomaly learning/discrimination unit 13 periodically obtains supervised data from the memory unit 18, and performs learning if there has been an update since the previous learning.

After learning, the anomaly learning/discrimination unit 13 requests the feedback priority label assignment unit 15 to estimate key elements of the teacher data and assign feedback priority labels (described below) to the non-teacher data. Here, the key elements are, for example, the destination host name and the download file name.

The anomaly learning/discrimination unit 13 has a means for discriminating an anomaly from the feature vector using the generated anomaly discriminator when the feature vector is received from the feature generation unit 12. The anomaly learning/discrimination unit 13 stores the anomaly discriminator, feature importance information, and anomaly discrimination results in the memory unit 18.

The dissimilarity learning/determination unit 14 has a means for generating a dissimilarity calculator that calculates the dissimilarity between an input feature vector and a feature vector of training data. For example, an autoencoder is used as the machine learning device, and training is performed so that the input feature vector is encoded (dimensionality reduction) and the encoded result is decoded to output a feature vector identical to the input. As a result of training in this way, a dissimilarity calculator is generated in which the error is small when the feature vector used in training is decoded, and the error is large when a feature vector that has not been trained is decoded. The magnitude of this error is treated as the level of dissimilarity. The dissimilarity learning/determination unit 14 periodically acquires training data from the storage unit 18, and performs training when the training data has been updated since the previous training.

When the dissimilarity learning/determination unit 14 receives a feature vector from the feature generation unit 12, it has a means for determining whether the dissimilarity of the feature data is high using the generated dissimilarity calculator. The dissimilarity learning/determination unit 14 determines that the dissimilarity is high when the dissimilarity calculated by the dissimilarity calculator is equal to or greater than a predetermined threshold. The dissimilarity learning/determination unit 14 requests the feedback priority label assignment unit 15 to assign a feedback priority label to a feature vector determined to have a high dissimilarity. The dissimilarity learning/determination unit 14 stores the dissimilarity calculator and the dissimilarity determination result in the memory unit 18.

The feedback priority label assignment unit 15 has a means for estimating key elements in a series of security logs constituting each teacher data from the feature vector of the teacher data, feature importance information of the anomaly discriminator, and viewpoint information of the detection engine. Key elements are, for example, the access destination host name and the download file name. The key element estimation method in the feedback priority label assignment unit 15 first extracts features of teacher data with high importance from the feature vector and feature importance information of the teacher data. The extraction method is not particularly limited, but for example, it checks whether the value of the feature of the corresponding teacher data is greater than 0, starting from the feature with the highest importance in the feature importance information, and the first feature that meets the condition is set as the feature with high importance.

Next, the feedback priority label assignment unit 15 acquires viewpoint information of the detection engine in the detection engine corresponding to the feature with high importance. For example, if the detection engine corresponding to the feature with high importance is "accessing a host that is not usually accessed," field information of the access destination host is acquired. Finally, a log detected by the detection engine with high importance is acquired from the security log of the teacher data, and the value of the field of the viewpoint information in the log is output as a key element. At this time, if the detection engine is detected in multiple logs and multiple key elements exist, all of them may be output, or only the element of the log with the highest score may be output. The feedback priority label assignment unit 15 stores the estimated key element in the memory unit 18 in association with the teacher data.

The feedback priority label assignment unit 15 also has a means for assigning a feedback priority label to an unlearned feature vector that has the same elements as key elements of the training data. The feedback priority label assignment unit 15 stores the feature vector with the feedback priority label in the storage unit 18.

The abnormality determination result display unit 16 has a means for displaying the abnormality determination result to the operator. There are no particular limitations on the method for displaying the abnormality determination result. For example, when the abnormality discriminator outputs a probability value that the input feature vector is abnormal, a display method that shows the magnitude of the probability in a circle as shown in FIG. 3 to make it easier to distinguish abnormal data is conceivable. In addition, the abnormality determination result display unit 16 presents the detection result of the detection engine corresponding to the feature of the feature vector that was determined to be abnormal and the security log to the operator. Furthermore, the abnormality determination result display unit 16 has a means for feeding back to the system the correct/incorrect judgment result of the result of the operator's investigation of the abnormality determination result. There are no particular limitations on the feedback method, but a method of feeding back through an interface such as a radio button that allows the operator to select abnormal or normal for each security log is conceivable. When there is feedback, the abnormality determination result display unit 16 updates the teacher label of the feature vector including the log and stores it in the memory unit 18.

The feedback candidate display unit 17 has a means for displaying to the operator feature vectors that are feedback candidates using feedback priority label information for feature vectors with high dissimilarity. There are no limitations on the method for displaying feedback candidates, but one possible method is to display feature data with high dissimilarity and feedback priority labels using large circles, as in the example of the display of the anomaly determination result in FIG. 3 described above.

Furthermore, like the anomaly discrimination result display unit 16, the feedback candidate display unit 17 has a means for presenting to the operator, for feature vectors with high dissimilarity, the detection results of the detection engine corresponding to the features of the feature vector and security logs. Furthermore, the feedback candidate display unit 17 has a means for allowing the operator to feed back to the system the correctness judgment results of the investigation results. When there is feedback, the feedback candidate display unit 17 updates the teacher label of the feature vector for the fed back log and stores it in the memory unit 18.

The memory unit 18 has means for storing security logs, feature vectors, teacher labels, feedback priority labels, key elements of teacher data, detection engines, viewpoint information of the detection engines, feature importance information, etc.

(A-2) Operation of the embodiment Next, the operation of the anomaly detection device 10 according to the embodiment having the above configuration will be described. Below, the operation at the time of security log input in the anomaly detection device 10, the learning operation of the anomaly discriminator, the learning operation of the dissimilarity calculator, the feedback candidate investigation operation, and the anomaly discrimination result investigation operation will be described respectively.

(A-2-1) Operation at the Time of Entering a Security Log FIG. 4 is a flowchart showing a characteristic operation of the anomaly detection device at the time of entering a security log according to this embodiment.

When a security log (hereinafter simply referred to as "log") is input to the processing unit 11, the processing unit 11 provides the log to the feature generation unit 12 and requests the generation of features (S101).

The feature generation unit 12 checks whether logs for the period required for feature generation have been accumulated based on the input log and logs input so far (S102). If no logs have been accumulated, the feature generation unit 12 ends the series of processes (i.e., waits for the next log to be input), whereas if the feature generation unit 12 determines that logs have been accumulated, it executes the next process.

When the feature generation unit 12 determines that logs have been accumulated, it executes each detection engine on the log group (S103).

The feature generation unit 12 confirms that there are no more incomplete detection engines (i.e., confirms that all detection engines have been executed). If all detection engines have been executed, the feature generation unit 12 executes the following process (S104).

When the execution of all the detection engines is completed, the feature generation unit 12 sums up the scores for each detection engine for each source address for the logs during the period of the feature generation unit to generate a feature vector (for example, FIG. 2 described above) (S105). The feature generation unit 12 stores the generated feature vector and the entered security log in the memory unit 18.

The feature generation unit 12 checks whether the log contains teacher data (S106). If the log contains teacher data (e.g., an abnormal communication log), the feature generation unit 12 executes the following process, whereas if the log does not contain teacher data, the feature generation unit 12 executes the process of step S108 described below.

If training data is included in the log, the feature generation unit 12 assigns an abnormal training label to the feature vector of the training data (S107).

On the other hand, if the generated feature vector is not teacher data, the feature generation unit 12 requests the anomaly learning/discrimination unit 13 to discriminate anomalies in the feature vector (S108). The anomaly learning/discrimination unit 13 discriminates normality/abnormality using an anomaly discriminator and stores the discrimination result in the memory unit 18.

The feature generator 12 requests the dissimilarity learning/determination unit 14 to determine the dissimilarity of the feature vector (S109). The dissimilarity learning/determination unit 14 calculates the dissimilarity using a dissimilarity calculator, and when the calculated dissimilarity is equal to or greater than a threshold, determines that the dissimilarity is high and stores it in the memory unit 18.

For feature vectors determined to have high dissimilarity, the dissimilarity learning/determination unit 14 requests the feedback priority label assignment unit 15 to assign a feedback priority label (S110). The feedback priority label assignment unit 15 obtains key elements of the teacher data from the storage unit 18 and searches for whether the key elements are included in the logs that make up the feature vector. If the key elements are included in any of the logs, the feature vector is assigned a feedback priority label and stored in the storage unit 18.

(A-2-2) Characteristic Operation of the Anomaly Learning/Discrimination Unit 13 (Learning Operation of the Anomaly Discriminator)
FIG. 5 is a flowchart showing a characteristic operation (learning operation of the anomaly discriminator) of the anomaly learning/discrimination unit according to the embodiment.

The anomaly learning/discrimination unit 13 periodically acquires teacher data from the memory unit 18 and checks whether the teacher data has been updated since the previous learning (S201).

When the teacher data is updated, the anomaly learning/discrimination unit 13 performs learning using a machine learning device (S202, S203). The machine learning device used here is one that can obtain the importance of features. The anomaly learning/discrimination unit 13 stores the anomaly discriminator and feature importance generated as a result of the learning in the memory unit 18.

The anomaly learning/discrimination unit 13 requests the feedback priority label assignment unit 15 to estimate a key element for teacher data to which no key element is linked (S204). The feedback priority label assignment unit 15 acquires feature importance information from the storage unit 18, and checks whether the value of the corresponding feature in the feature vector of the teacher data is greater than 0, starting from the feature with the highest importance in the feature importance information. For the first feature found, the feedback priority label assignment unit 15 acquires from the storage unit 18 the log of the teacher data for which the corresponding detection engine score is greater than 0 and the viewpoint information of the detection engine, and estimates the value of the field of the log that matches the viewpoint information as the key element. The feedback priority label assignment unit 15 associates the estimated key element with the teacher data and stores it in the storage unit 18.

The feedback priority label assignment unit 15 further acquires feature vectors with high dissimilarity and logs that constitute the feature vectors from the storage unit 18, assigns feedback priority labels to the feature vectors of the logs that contain the estimated key elements, and stores them in the storage unit 18.

(A-2-3) Characteristic Operation of Dissimilarity Learning/Determination Unit 14 (Learning Operation of Dissimilarity Calculator)
FIG. 6 is a flowchart showing a characteristic operation (learning operation of the dissimilarity calculator) of the dissimilarity learning/determination unit according to the embodiment.

The dissimilarity learning/determination unit 14 periodically acquires the teacher data from the memory unit 18 and checks whether the teacher data has been updated since the previous learning (S301, S302).

When the teacher data is updated, the dissimilarity learning/determination unit 14 performs learning using a machine learning device (S303). For example, an autoencoder is used as the machine learning device to generate a dissimilarity calculator that reproduces the feature vector of the teacher data. The dissimilarity learning/determination unit 14 stores the generated dissimilarity calculator in the memory unit 18.

(A-2-4) Characteristic Operation of the Feedback Candidate Display Unit 17 Fig. 7 is a flowchart showing the characteristic operation of the feedback candidate display unit according to the embodiment. That is, it shows a series of operations from when an operator requests the system to display feedback candidates, to when the operator investigates the results and provides feedback.

When the processing unit 11 receives a feedback candidate display request (for example, when it receives a feedback candidate display request from an operator via a dedicated interface), it requests the feedback candidate display unit 17 to display them (S401).

The feedback candidate display unit 17 acquires feature vectors with high dissimilarity and feedback priority label information from the storage unit 18. The feedback candidate display unit 17 then displays feature vectors with high dissimilarity, and among those, prioritizes and displays those to which feedback priority labels have been assigned (S402).

The feedback candidate display unit 17 determines whether or not there is any feedback from the operator regarding the feature vector (S403).

When the feedback candidate display unit 17 receives feedback from the operator regarding the feature vector, it assigns an abnormal/normal label to the feature vector and stores it in the storage unit 18 (S404). The fed back feature vector may be deleted from the feedback candidate display screen.

(A-2-5) Characteristic Operation of the Anomaly Determination Result Display Unit 16 Fig. 8 is a flowchart showing a characteristic operation of the anomaly determination result display unit according to the embodiment. That is, Fig. 8 shows a series of operations from when an operator requests the system to display an anomaly determination result, until the operator investigates the result and provides feedback.

When the processing unit 11 receives a request to display the abnormality determination result (for example, when it receives a request to display the feedback abnormality determination result from the operator via a dedicated interface), it requests the abnormality determination result display unit 16 to display it (S501).

The abnormality determination result display unit 16 retrieves the feature vector determined to be abnormal from the memory unit 18 and displays it (S502).

The anomaly detection result display unit 16 determines whether or not there is feedback from the operator regarding the feature vector (S503).

When the operator provides feedback on the feature vector, the anomaly determination result display unit 16 assigns an anomaly/normal label to the feature vector and stores it in the storage unit 18 (S504).

(A-3) Effects of the Embodiment According to the present embodiment, the following effects are obtained.

The anomaly detection device 10 of this embodiment is characterized in that, in addition to the machine learning device (anomaly learning/discrimination unit 13) that performs anomaly discrimination, it also has another machine learning device (dissimilarity learning/judgment unit 14) that judges data that has a feature vector that is highly dissimilar to the feature vector of the teacher data, and presents this to the operator as a feedback candidate separately from the anomaly discrimination result. With this configuration, when the feedback candidate data is investigated and the judgment result is fed back to the system, the amount of teacher data with new feature vector trends increases, increasing the variety of teacher data, leading to improved discrimination accuracy and preventing missed detection of anomalous communications.

The anomaly detection device 10 is also characterized by estimating key elements in the teacher data log and prioritizing and displaying feedback candidates that have the same elements. By prioritizing, items that are more likely to be determined to be abnormal are investigated first, making it possible to find data that has missed anomaly detection early and feed it back to the system. In addition, by operating in such a way that only prioritized items are investigated, it also leads to a reduction in the amount of investigation man-hours required by the operator.

(B) Other Embodiments The present invention is not limited to the above-described embodiment, and modified embodiments such as those exemplified below can also be mentioned.

(B-1) In the above embodiment, a method for automatically estimating key elements using feature importance information has been described, but the present invention is not limited to this. For example, a method can be considered in which the operator explicitly provides the elements that contributed to determining an anomaly when providing feedback to the system. When automatically estimating key elements, there is a possibility that the estimation will be erroneous, but when providing the elements explicitly, the possibility of error can be avoided and the probability that the priority candidate for feedback is truly an anomaly can be increased. In addition, when providing a security log that serves as training data to the anomaly detection device 10, the key elements may be explicitly provided along with the log.

(B-2) In the above embodiment, an autoencoder is used as the machine learning machine for calculating dissimilarity, but this is not limited to this. For example, a conceivable method is to classify training data into several classes by clustering, and use a machine learning machine that outputs the distance from each class (ease of belonging to a class) when data is input, and when non-training data is input to this machine learning machine, if the distance from each class is large, it is determined that the dissimilarity is high.

10: anomaly detection device, 11: processing unit, 12: feature generation unit, 13: discrimination unit, 14: judgment unit, 15: feedback priority label assignment unit, 16: anomaly discrimination result display unit, 17: feedback candidate display unit, 18: memory unit.

Claims (9)

An anomaly detection device that analyzes logs to detect anomalies,
a feature vector generating means for generating a feature vector from the log;
an anomaly learning and discrimination means for generating an anomaly discriminator by learning the feature vector serving as training data with a first machine learning device, and discriminating an anomaly in the feature vector using the anomaly discriminator;
a dissimilarity learning and determination means for generating a dissimilarity calculator that calculates a dissimilarity between the training data and a feature vector by training the training data with a second machine learning device, and determining whether the dissimilarity between the training data and the feature vector is high using the dissimilarity calculator;
a feedback priority label assignment means for outputting an abnormal field value as a key element in the log corresponding to the training data, and assigning a feedback priority label to the feature vector having an element identical to the key element and determined by the dissimilarity learning determination means to have a high dissimilarity;
and a feedback candidate display means for preferentially displaying data including the feature vector to which the feedback priority label has been assigned as feedback candidate data, and providing an interface enabling feedback on the accuracy of the feedback candidate data. The anomaly detection device according to claim 1, further comprising an anomaly discrimination result display means for displaying an anomaly discrimination result, which is a result of the anomaly discrimination of the feature vector by the anomaly learning discrimination means, and providing an interface that allows feedback on the correctness of the anomaly discrimination result. the feature vector is composed of features extracted from a plurality of perspectives for the log,
the first machine learning machine obtains feature importance information indicating whether any feature of the feature vector strongly contributes to anomaly determination in the anomaly discriminator,
The method of outputting the key elements in the feedback priority labeling means is as follows:
extracting a feature quantity having a high importance among the feature quantity importance information from the feature quantity vector of the training data;
The anomaly detection device according to claim 1 or 2, further comprising: a field value of the log corresponding to the feature amount having a high degree of importance being output as the key element. The method of outputting the key elements in the feedback priority labeling means is as follows:
When the log, which is the training data, is input from the outside, the key element is explicitly given together with the training data,
3. The anomaly detection device according to claim 2, wherein the anomaly determination result display means and/or the feedback candidate display means are capable of selecting and accepting the key element when accepting input of the teacher data by feedback. The method of calculating the dissimilarity in the dissimilarity learning and determining means includes the steps of:
the second machine learning machine reduces the dimensions of the feature vector of the training data, learns so that a value output when the feature vector is restored to the original dimensions is identical to the feature vector of the input, and generates the dissimilarity calculator that outputs a difference in each dimension between the feature vector of the input and the vector of the output as the dissimilarity;
5. The anomaly detection device according to claim 1, wherein when the input feature vector is applied to the dissimilarity calculator, if the dissimilarity is equal to or greater than a threshold, the dissimilarity is determined to be high. The method of calculating the dissimilarity in the dissimilarity learning and determining means includes the steps of:
the second machine learning machine learns to classify the training data into a plurality of classes by clustering, and generates the dissimilarity calculator that outputs a distance to each class;
5. The anomaly detection device according to claim 1, wherein when the input feature vector is applied to the dissimilarity calculator, if a distance between the input feature vector and any class is equal to or greater than a threshold, the dissimilarity is determined to be high. The anomaly detection device according to any one of claims 1 to 6, characterized in that the key element is a value of any field in the log of the security device. A computer installed in an anomaly detection device that analyzes logs and detects anomalies,
a feature vector generating means for generating a feature vector from the log;
an anomaly learning and discrimination means for generating an anomaly discriminator by learning the feature vector serving as training data with a first machine learning device, and discriminating an anomaly in the feature vector using the anomaly discriminator;
a dissimilarity learning and determination means for generating a dissimilarity calculator that calculates a dissimilarity between the training data and a feature vector by training the training data with a second machine learning device, and determining whether the dissimilarity between the training data and the feature vector is high using the dissimilarity calculator;
a feedback priority label assignment means for outputting an abnormal field value as a key element in the log corresponding to the training data, and assigning a feedback priority label to the feature vector having an element identical to the key element and determined by the dissimilarity learning determination means to have a high dissimilarity;
and causing the program to function as a feedback candidate display means for preferentially displaying data including the feature vector to which the feedback priority label has been assigned as feedback candidate data and providing an interface through which the program can provide feedback on the accuracy of the feedback candidate data. An anomaly detection method for use in an anomaly detection device that detects anomalies by analyzing logs, comprising:
The feature vector generating means generates a feature vector from the log;
the anomaly learning and discrimination means generates an anomaly discriminator by learning the feature vector serving as training data with a first machine learning device, and discriminates an anomaly in the feature vector using the anomaly discriminator;
the dissimilarity learning determination means generates a dissimilarity calculator that calculates a dissimilarity between the teacher data and a feature vector of the teacher data by learning the teacher data with a second machine learning device, and determines whether the dissimilarity between the teacher data and the feature vector is high using the dissimilarity calculator;
a feedback priority label assignment means for outputting, as a key element, a value of an abnormal field in the log corresponding to the training data, and assigning a feedback priority label to the feature vector having an element identical to the key element and determined by the dissimilarity learning determination means to have a high dissimilarity;
the feedback candidate display means displays, with priority, data including the feature vector to which the feedback priority label has been assigned as feedback candidate data, and provides an interface that enables feedback on the accuracy of the feedback candidate data.

Images