JP7595915B2 - Information analysis device and information analysis method - Google Patents

Description

The present invention relates to an information analysis device and an information analysis method.

For example, Non-Patent Document 1 describes a monolithically designed technology that consistently performs a series of processes, such as collecting cybersecurity-related information from information sources, storing the collected information in a database, and analyzing the stored information. Analysis refers to, for example, finding meaning from connections between IoCs (Indicators of Compromise) or clusters consisting of multiple IoCs, and modeling the associations between IoCs from cybersecurity-related articles written in natural language.

Onuki Ito, Tatsuya Nagai, Kenta Nomura, Hidenori Kondo, Masaki Kamizono, Yoshiaki Shiraishi, Keisuke Furumoto, Maki Takita, Kumi Mori, Tadashi Takano, Masakatsu Morii. Diamond Model-Based Threat Analysis System for Threat Intelligence. Transactions of the Institute of Electronics, Information and Communication Engineers, Vol. J101-D, No. 10, pp. 1427-1437, 2018.

However, the conventional method described in Non-Patent Document 1 has a problem that the analysis results are not linked to natural language, making them difficult for users to understand. In addition, the conventional method described in Non-Patent Document 1 does not take into consideration the search speed of a database that accumulates cybersecurity-related information, and there is a problem that the search speed may be easily reduced when the amount of information accumulated in the database becomes bloated. Furthermore, the conventional method described in Non-Patent Document 1 uses a monolithic design, making it difficult to ensure scalability and flexibility, and there is a problem that costs are likely to be high when improving the processing.

One aspect of the embodiment of the present invention aims to provide an information analysis device that makes the analysis results easy for users to understand, is less likely to slow down search speed, and ensures scalability and flexibility.

An information analysis device that analyzes security-related information, which is information related to security, including threat information, which is information on observed security threats, transmitted from a threat observation device, and usage example information, which is information on usage examples of security threats, and generates analysis result information, which is information resulting from the analysis, is provided, the information analysis device comprising: a publisher message receiving unit that receives the security-related information; a pre-processing unit that generates multiple types of index information for searching for security-related information from the threat information, and performs pre-processing to input entity information, which is threat information linked to the index information, into a database storage unit that stores a key-value database; a cross-sectional analysis unit that searches for other index information that is not linked to the entity information as an exact match search key, extracts associations between multiple types of index information, searches for the usage example information as an exact match search key, and generates analysis result information in which phrase information, which is a phrase in natural language stored in the index information as part of the usage example information, is linked to the index information; and a subscriber transmitting/receiving unit that transmits the analysis result information to a user terminal used by a user who analyzes the security-related information.

An information analysis method is provided which is executed by an information analysis device that analyzes security-related information, which is information related to security, including threat information, which is information on observed security threats transmitted from a threat observation device, and usage example information, which is information on usage examples of security threats, and generates analysis result information, which is information resulting from the analysis, and which includes a first step of receiving the security-related information; a second step of performing preprocessing to generate multiple types of index information for searching the security-related information from the threat information and inputting entity information, which is threat information linked to the index information, into a database storage unit that stores a key-value database; a third step of searching other index information not linked to the entity information as an exact match search key to extract associations between the multiple types of index information, searching the usage example information as an exact match search key, and generating analysis result information in which phrase information, which is a phrase in natural language stored in the index information as part of the usage example information, is linked to the index information; and a fourth step of transmitting the analysis result information to a user terminal used by a user who analyzes the security-related information.

According to one aspect of the embodiment of the present invention, it is possible to realize an information analysis device that makes the analysis results easy for the user to understand, is less likely to slow down the search speed, and ensures scalability and flexibility.

FIG. 1 is a block diagram showing a configuration of an information analysis system including an information analysis device according to this embodiment. FIG. 2 is a diagram showing an overview of a key-value database stored in the information analysis device according to this embodiment. FIG. 3 is a diagram showing the concept of the data structure of the key-value database stored in the information analysis device according to this embodiment. FIG. 4 shows a screen displayed on a user terminal by the information analysis device according to this embodiment. FIG. 5 is a flowchart showing the procedure of the information analysis process.

One embodiment of the present invention will be described in detail below with reference to the drawings.

FIG. 1 is a block diagram showing the configuration of an information analysis system including an information analysis device 1 according to this embodiment. The information analysis system includes an information analysis device 1, a threat observation device 2, a use example enumeration device 3, and a user terminal 4.

In the information analysis system shown in FIG. 1, the information analysis device 1 receives threat information (hereinafter, this may be referred to as IoC), which is information on observed security threats, sent from the threat observation device 2, and usage example information, which is information on usage examples of security threats, sent from the usage example enumeration device 3.

Security-related information including threat information and usage example information may be referred to as security-related information. When the information analysis device 1 receives the security-related information, it analyzes the security-related information, generates analysis result information that is information on the results of the analysis, and transmits it to the user terminal 4.

The threat observation device 2 may be one or more, such as a honeypot device that is subject to unauthorized access without conducting legitimate communications, or a darknet observation device that observes unused IP addresses known as the darknet.

For example, a honeypot device transmits threat information including IP addresses and file hash values to the information analysis device 1. Also, for example, a darknet monitoring device transmits threat information including IP addresses and domain names to the information analysis device 1.

The use example enumeration device 3 may be one or more, and may be, for example, an ATT&CK providing device that provides ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge), a structured list of known attacker behaviors in which MITRE is summarized into tactics and techniques and expressed not only in a small number of matrices but also in STIX (Structured Threat Information eXpression)/TAXII (Trusted Automated eXchange of Indicator Information).

Another example of the usage example enumeration device 3 is an article extraction phrase providing device that obtains the contents of articles from an RSS feed, extracts phrases written in natural language from the obtained article contents, and provides them.

The usage example information includes threat information, and for example, the usage example information sent to the information analysis device 1 by the ATT&CK providing device or the article extracted phrase providing device includes IP addresses, domain names, and file hash values.

The user terminal 4 is one or more terminals used by a user who uses the information analysis device 1 to analyze security-related information, and may be a personal computer, a tablet terminal, a smartphone, or the like. The user terminal 4 may be a threat information platform providing device that is a device that aggregates and accumulates threat information, or a Security Information and Event Management (SIEM) device that provides security-related information and manages events, which are actions and occurrences that occur within a program.

The information analysis device 1 includes a publisher message receiving unit 5, a preprocessing unit 6, a cross-sectional analysis unit 7, a database storage unit 8, and a subscriber transmission/reception unit 9. The publisher message receiving unit 5 receives security-related information from the threat observation device 2 and the use case enumeration device 3, which are publishers to the information analysis device 1. The publisher message receiving unit 5 receives the security-related information each time the security-related information is issued.

The preprocessing unit 6 includes an index information generating unit 10 that generates multiple types of index information for searching for security-related information from threat information, and an entity information input unit 11 that inputs entity information, which is threat information linked to the index information, into the database storage unit 8.

The cross-sectional analysis unit 7 includes an association extraction unit 12 and a semantic assignment unit 13. The association extraction unit 12 extracts associations between multiple types of index information by searching for other index information that is not linked to the entity information as a search key for an exact match. The semantic assignment unit 13 searches for the use example information as a search key for an exact match, and generates analysis result information that links the index information with word information, which is a phrase in natural language that is stored in the index information as part of the use example information.

The database storage unit 8 stores a key-value database DB1, which is a key-value type database in which values are associated with search keys. In the key-value database DB1, values are searched for using search keys.

The subscriber transmission/reception unit 9 transmits the analysis result information to the user terminal 4, which is the subscriber. The subscriber transmission/reception unit 9 may transmit information related to the requested index information included in the analysis result acquisition request from the user terminal 4 in the requested order. For example, the publisher message reception unit 5, preprocessing unit 6, cross-sectional analysis unit 7, database storage unit 8, and subscriber transmission/reception unit 9 are integrated circuits.

Next, an overview of the key-value database DB1 will be described with reference to FIG. 2. FIG. 2 is a diagram showing an overview of the key-value database DB1 stored in the information analysis device 1 according to this embodiment. The key-value database DB1 includes key-value databases DB11 to DB18.

As shown in Figure 2, a search key is composed of at least one or more index information and phrase information, and is processed in order. As also shown in Figure 2, a search key can have a specific value and a generic value, and when the search key is a specific value, it links multiple types of index information and phrase information. When the search key is composed only of a generic value, the search key serves as a table of contents.

For example, in the key-value database DB11, when the search key is "cure:pub:ip-index", the search key consists only of generic values such as "cure", "pub", and "ip-index". The value associated with the search key consisting only of generic values acts as a table of contents. Note that when the search key is "cure:pub:ip-index", the value will be an IP address such as "203.0.113.1".

For example, in the key-value database DB12, when the search key is "cure:pub:ip:203.0.113.1", the search key consists of generic values such as "cure", "pub", and "ip" indicating an IP address, and a specific value such as "203.0.113.1".

If the search key is "cure:pub:ip:203.0.113.1", the value will be entity information such as "timestamp:159356923, publisher_id:300, dst_ip:"203.0.113.1", dst_port:443, ..., content:"SuspiciousFileDownload"". The specific value of the IP address, "203.0.113.1", becomes index information linked to the entity information.

For example, in the key-value database DB13, when the search key is "cure:pub:ip:203.0.113.1:domain", the search key consists of generic values such as "cure", "pub", "ip" indicating an IP address, and "domain" indicating a domain name, as well as the specific value of the IP address, "203.0.113.1". Therefore, the specific value of the IP address, "203.0.113.1", links the IP address, which is the index information, with the domain name, which is the index information.

If the search key is "cure:pub:ip:203.0.113.1:domain", the value will be a specific domain name such as "www.example.net". The specific IP address value "203.0.113.1" becomes index information linked to the specific domain name value.

For example, in the key-value database DB14, when the search key is "cure:pub:ip:203.0.113.1:file", the search key is made up of generic values such as "cure", "pub", "ip" indicating an IP address, and "file" indicating a hash value of a file, as well as the specific value of the IP address, "203.0.113.1". Therefore, the specific value of the IP address, "203.0.113.1", links the IP address, which is index information, with the hash value of the file, which is index information.

If the search key is "cure:pub:ip:203.0.113.1:file", the value will be the specific value of the file's hash value, such as "73336a8e9ea4345084c903336be41264". The specific IP address value "203.0.113.1" becomes index information linked to the specific value of the file's hash value.

For example, in the key-value database DB15, when the search key is "cure:pub:ip:203.0.113.1:tag", the search key is made up of generic values such as "cure", "pub", "ip" indicating an IP address, and "tag" indicating phrase information, as well as the specific value of the IP address, "203.0.113.1". Therefore, the IP address "203.0.113.1" links the IP address, which is index information, with the phrase information.

When the search key is "cure:pub:ip:203.0.113.1:tag", the value is a specific value of the phrase information such as "Group123". The specific value of the IP address, "203.0.113.1", becomes index information linked to the specific value of the phrase information. As an even easier-to-understand example, specific values of the phrase information include "WannaCry" and "Ransomeware".

For example, in the key-value database DB16, when the search key is "cure:pub:tag:Group123:ip", the search key is made up of generic values such as "cure", "pub", "tag" indicating phrase information, and "ip" indicating an IP address, as well as "Group123", which is a specific value of the phrase information. Therefore, "Group123", which is phrase information, links between the phrase information and the IP address, which is index information.

When the search key is "cure:pub:tag:Group123:ip", the value is a specific IP address such as "203.0.113.1". The specific value of the phrase information, "Group123", becomes index information linked to the specific value of the IP address.

For example, in the key-value database DB17, when the search key is "cure:pub:tag:Group123:domain", the search key is made up of generic values such as "cure", "pub", "tag" indicating phrase information, and "domain" indicating a domain name, as well as "Group123", which is a specific value of the phrase information. Therefore, "Group123", which is phrase information, links between the phrase information and the domain name, which is index information.

When the search key is "cure:pub:tag:Group123:domain", the value is a specific domain name such as "www.example.org". The specific value of the phrase information, "Group123", becomes index information linked to the specific value of the domain name.

For example, in the key-value database DB18, when the search key is "cure:pub:tag:Group123:file", the search key is made up of generic values such as "cure", "pub", "tag" indicating phrase information, and "file" indicating the hash value of the file, as well as "Group123", which is a specific value of the phrase information. Therefore, "Group123", which is the phrase information, links the phrase information with the hash value of the file, which is index information.

When the search key is "cure:pub:tag:Group123:file", the value is a specific value of the file's hash value, such as "73336a8e9ea4345084c903336be41264". The specific value of the phrase information, "Group123", becomes index information linked to the specific value of the file's hash value.

Next, the data structure of the key-value database DB1 will be described with reference to FIG. 3. FIG. 3 is a diagram showing the concept of the data structure of the key-value database DB1 stored in the information analysis device 1 according to this embodiment. As shown in FIG. 3, the key-value database DB1 has a hierarchical structure, and for example, the top layer is linked by index information, and the bottom layer is linked by word information.

Specifically, the first hierarchical level, which is the highest hierarchical level, is key-value database DB11, the second hierarchical level is key-value databases DB12, DB13, and DB15, and the third hierarchical level, which is the lowest hierarchical level, is key-value databases DB16, DB17, and DB18.

The first and second hierarchical levels are linked by the specific value of the IP address, "203.0.113.1," and the second and third hierarchical levels are linked by the specific value of the phrase information, "Group123."

Next, the screen 20 displayed on the user terminal 4 will be described with reference to FIG. 4. FIG. 4 shows the screen 20 displayed on the user terminal 4 by the information analysis device 1 according to this embodiment. As shown in FIG. 4, the screen 20 includes, for example, an API (Application Programming Interface) in JSON (JavaScript Object Notation) format and a web user interface.

Screen 20 displays information appropriate to the user's use case. Screen 20 displays an IP address and phrase information. Since information that displays phrases in natural language is transmitted to user terminal 4, screen 20 displays the phrase information.

Screen 20 will now be described in detail. Screen 20 includes areas 21 to 30. Area 21 displays the IP address that is the subject of analysis. Area 22 displays options for selecting the type of the subject of analysis. Area 23 displays the region that is the subject of analysis.

In area 24, phrase information is displayed. In area 25, the year, month, day, hour, minute, and second when index information or phrase information was last issued by a publisher are displayed. In area 26, link information to information sources other than the information analysis device 1 is displayed.

Area 27 displays information about which publisher information was received from and when. Area 28 displays information about the proportion of each publisher to all publishers that are the issuers of information received by the information analysis device 1 within a specified period. Area 29 displays details of the information received by the information analysis device 1 within a specified period. Area 30 displays all index information and phrase information handled by the information analysis device 1.

Next, the information analysis process performed by the information analysis device 1 will be described with reference to FIG. 5. FIG. 5 is a flowchart showing the processing steps of the congestion control process. When a publisher issues security-related information, the publisher message receiving unit 5 receives the security-related information (S1).

Next, the index information generation unit 10 generates index information, for example, a key-value database DB11 (S2). Next, the entity information input unit 11 inputs entity information, such as a key-value database DB12, into the database storage unit 8 (S3).

Then, the relation extraction unit 12 extracts relations between multiple types of index information by searching for other index information that is not linked to the entity information, for example, in the key-value database DB13, using the index information as a search key that matches exactly (S4). Next, the meaning assignment unit 13 assigns meaning, for example, in the key-value databases DB15-18 (S5). Next, the subscriber transmission/reception unit transmits the analysis result information to the subscriber in response to the analysis result acquisition request received from the subscriber (S6).

As described above, the information analysis device 1 according to this embodiment makes it easy for the user to understand the results of the analysis by the information analysis device 1 because, for example, word information is displayed on the screen 20. Furthermore, the information analysis device 1 according to this embodiment uses a publisher-subscriber model in which security-related information is issued by a publisher and the results of the analysis are received by a subscriber (hereinafter, this may be referred to as subscribing).

In this embodiment, the information analysis device 1 uses a publisher-subscriber model, so it is easy to expand functions such as adding new use cases by adding publishers such as a threat observation device 2 and a use case enumeration device 3.

For example, the SIEM device or threat information platform providing device serving as the user terminal 4 can also transmit security-related information to the information analysis device serving as the threat observation device 2 or the use case enumeration device 3 based on the received analysis result information. In this way, the information analysis device 1 can easily expand its functions.

In addition, in this embodiment, the information analysis device 1 uses a key-value database, so the search performance in the case of an exact match is O(1) in terms of the amount of calculation, and the search performance in the case of a partial match is O(N) in terms of the amount of calculation, so the search speed is unlikely to decrease.

N is the total number of search information items plus the number of phrase information items. In this embodiment, the search information items consist of three items: IP address, domain name, and file hash value, so N is set to 4. The meaning can also be expanded.

In the above embodiment, the search information is described as consisting of three items: IP address, domain name, and file hash value, but this is not limited to these. For example, an email address may be added to the search information.

As described above, one aspect of the embodiment of the present invention makes it possible to provide an information analysis device that makes the analysis results easy for the user to understand, is less likely to slow down the search speed, and ensures scalability and flexibility.

In the above embodiment, the publisher message receiving unit 5, preprocessing unit 6, cross-sectional analysis unit 7, database storage unit 8, and subscriber transmitting/receiving unit 9 are described as integrated circuits, but this embodiment is not limited to this. The publisher message receiving unit 5, preprocessing unit 6, cross-sectional analysis unit 7, database storage unit 8, and subscriber transmitting/receiving unit 9 may be implemented by a program stored in a server, for example.

In addition, the publisher message receiving unit 5, preprocessing unit 6, cross-sectional analysis unit 7, database storage unit 8, and subscriber transmission/reception unit 9 may not be implemented in a single device, but may be distributed across multiple devices connected via a network, for example.

1... Information analysis device, 2... Threat observation device, 3... Usage example enumeration device, 4... User terminal, 5... Publisher message receiving unit, 6... Preprocessing unit, 7... Cross-sectional analysis unit, 8... Database storage unit, 9... Subscriber transmission/reception unit.

Claims (5)

An information analysis device that analyzes security-related information, which is information related to security, including threat information, which is information obtained by observing security-related threats transmitted from a threat observation device, and usage example information, which is information about usage examples of the security-related threats, and generates analysis result information, which is information on the results of the analysis,
a publisher message receiving unit for receiving the security-related information;
a pre-processing unit that performs a pre-processing to generate a plurality of types of index information for searching for the security-related information from the threat information, and to input entity information, which is the threat information linked to the index information, into a database storage unit that stores a key-value database;
a cross-sectional analysis unit that extracts associations between a plurality of types of index information by searching for other index information not linked to the entity information using an exact match search key, searches for the index information using the index information as an exact match search key for the usage example information, and generates analysis result information in which phrase information, which is a phrase in natural language stored in the index information as a part of the usage example information, is linked to the index information;
a subscriber transceiver unit for transmitting the analysis result information to a user terminal used by a user who analyzes the security-related information;
An information analysis device comprising: The search key is composed of at least one of the index information or a plurality of the index information items and the phrase information items and is processed in order, the search key has a specific value and a generic value, and when the search key is a specific value, a link is made between a plurality of types of the index information items and the phrase information items.
The information analysis device according to claim 1 . the analysis result information has a hierarchical structure, the top layer is linked by the index information, and the bottom layer is linked by the word/phrase information;
The information analysis device according to claim 1 . The subscriber transceiver unit transmits information related to the requested index information included in the analysis result information acquisition request transmitted from the user terminal in a requested order, and information for displaying the phrase in the natural language is transmitted to the user terminal.
The information analysis device according to claim 1 . An information analysis method executed by an information analysis device that analyzes security-related information, which is information related to security, including threat information, which is information obtained by observing security-related threats transmitted from a threat observation device, and usage example information, which is information about usage examples of the security-related threats, and generates analysis result information, which is information on the results of the analysis,
a first step of receiving said security related information;
a second step of performing a pre-processing of generating a plurality of types of index information for searching the security-related information from the threat information, and inputting entity information, which is the threat information linked to the index information, into a database storage unit that stores a key-value database;
a third step of extracting associations between a plurality of types of index information by searching other index information not linked to the entity information using an exact match search key, searching the index information using the exact match search key for the usage example information, and generating analysis result information in which phrase information, which is a phrase in natural language stored in the index information as a part of the usage example information, is linked to the index information;
a fourth step of transmitting the analysis result information to a user terminal used by a user who analyzes the security-related information;
The information analysis method includes:

Images