JP7614914B2 - Attack detection device, attack detection support system, attack detection support method, and attack detection support program - Google Patents

Description

This disclosure relates to an attack detection device, an attack detection support system, an attack detection support method, and an attack detection support program.

In control systems that control various plants and equipment, or information processing systems that process information, there is a method of collecting and analyzing logs stored on devices within the system to determine whether there is an attack from outside the system. For example, Patent Document 1 discloses a technology that extracts parts that match predetermined extraction conditions as regular expressions from normal logs, creates a whitelist by converting the extracted parts into regular expressions, and determines that logs to be monitored that do not match the whitelist are abnormal logs.

JP 2017-83947 A

However, the technology described in Patent Document 1 avoids expressing logs in regular expressions except for parts where it is known that the log format is clear and that there is no problem in converting multiple logs into regular expressions and combining them. For this reason, if there is a possibility that the format may change due to equipment replacement or software updates in the system whose logs are being monitored, regular expressions cannot be applied because the format is not clear, and the entire text of the log is recorded as is. To avoid false detections, it is desirable to accumulate various normal logs as a whitelist, and storing the whitelist requires a lot of memory.

The present disclosure has been made in consideration of the above, and aims to provide an attack detection device that can reduce false positives of attacks while suppressing memory usage.

In order to solve the above-mentioned problems and achieve the object, the attack detection device according to the present disclosure includes a list storage unit that stores a harmless list used for matching with a monitored log, which is a log of a monitored object obtained from a monitored device, and an analysis unit that performs a registration process that divides a normal log obtained from the monitored device into words, assigns the words to layers in order from the top layer in the order in which the words are written in the normal log, and associates the words with upper layer information, which is information that identifies words corresponding to each of the layers higher than the words in the normal log, and stores them in the list storage unit as a harmless list. The attack detection device further includes a determination unit that divides the monitored log into words, assigns the monitored words to layers in order from the top layer in the order in which the monitored words, which are words in the monitored log, in order, compares the monitored words with the harmless list for each layer, and determines that there is a possibility of an attack if the monitored words do not match the harmless list.

The present disclosure has the advantage of being able to reduce false positives of attacks while suppressing memory usage.

FIG. 1 is a diagram showing a configuration example of an attack detection support system according to a first embodiment. A flowchart showing an example of a procedure for generating a harmless list according to the first embodiment. A diagram showing the harmless list of the first embodiment in a tree format. FIG. 1 is a diagram showing an example of a harmless list stored in a list storage unit according to the first embodiment; 1 is a flowchart showing an example of an attack detection process according to the first embodiment. FIG. 1 is a diagram showing an example of a screen displayed on the display device of the first embodiment; A tree representation of the harmless list of the first embodiment after new words have been registered. FIG. 1 is a diagram showing an example of the configuration of a computer system that realizes an attack detection device according to a first embodiment. FIG. 1 is a diagram illustrating a configuration example of an attack detection support system according to a second embodiment. FIG. 13 is a diagram showing a configuration example of an attack detection support system according to a third embodiment.

The attack detection device, attack detection support system, attack detection support method, and attack detection support program according to the embodiments are described in detail below with reference to the drawings.

Embodiment 1.
Fig. 1 is a diagram showing a configuration example of an attack detection support system according to a first embodiment. The attack detection support system 1 of this embodiment acquires, from a monitored device 2 that is a device to be monitored for attacks, a log in which various histories such as operations and processes in the monitored device 2 are stored, and detects an external attack on the monitored device 2 using the acquired log. Note that, although Fig. 1 shows one monitored device 2, there may be multiple monitored devices 2.

The monitored device 2 may be, for example, a general computer, a Factory Automation Personal Computer (FAPC), a peripheral device such as an access switch, or a mixture of these, as long as it is a device that records logs. Note that the logs are recorded as text.

The attack detection support system 1 includes an attack detection device 3 that detects the possibility of an attack using logs acquired from the monitored device 2, and a display device 4 that displays the detection results by the attack detection device. The display device 4 and the attack detection device 3 may be integrated by equipping the attack detection device 3 with a display unit. In this embodiment, as described below, the attack detection device 3 divides normal logs into words, organizes the words into a hierarchical structure, and stores them as a tree-shaped harmless list. The harmless list is used to compare with the monitored log, which is a log acquired from the monitored device 2.

One method of detecting attacks using logs is to define rules for attack detection in advance, but in this case, if an event such as equipment replacement or software update occurs in the system whose logs are being monitored, the rules must be updated each time, which creates an operational burden. In addition, in order to define rules in advance, it is necessary to know information such as the format of the logs in advance, and this may not be applicable to systems where it is difficult to collect information in advance. As a method of detecting attacks using logs without knowing the information in advance, there is a method of detecting attacks by machine learning using collected logs, but inference using machine learning may result in erroneous judgments, such as judging normal logs as abnormal or judging abnormal logs as normal. For this reason, one method of improving the accuracy of attack detection is to judge whether the logs being monitored are normal by comparing them with logs that are known to be normal. However, memory usage increases when a large number of full-text normal logs are stored as a harmless list. In this embodiment, words are organized into a hierarchy and stored as a tree-shaped harmless list, and the logs to be managed are compared with the tree-shaped harmless list, making it possible to reduce memory usage and false positives compared to when normal logs are stored as a full-text harmless list.

The monitored device 2 includes a processing unit 21, a communication unit 22, and a log storage unit 23. The processing unit 21 performs predetermined processing, processing according to instructions from an operator, etc., and stores various histories together with date and time as logs in the log storage unit 23. The communication unit 22 transmits the logs stored in the log storage unit 23 to the attack detection device 3. The communication unit 22 may transmit the logs when a request to transmit the logs is received from the attack detection device 3, or may transmit the logs periodically at a predetermined cycle. The log storage unit 23 stores the logs.

The attack detection device 3 includes a communication unit 31, a log storage unit 32, an analysis unit 33, a list storage unit 34, a determination unit 35, and a notification information generation unit 36. The communication unit 31 communicates with the monitored device 2 and the display device 4. For example, the communication unit 31 receives logs of the monitored device from the monitored device 2, stores the received logs in the log storage unit 32, and passes the logs received as normal logs to the analysis unit 33. Normal logs will be described later.

The analysis unit 33 performs a registration process in which the normal log acquired from the monitored device 2 is divided into words, the words are assigned to layers in the order in which the words are written in the normal log, starting from the top layer, and the words are associated with upper layer information, which is information identifying words corresponding to each of the layers higher than the words in the normal log, and stored in the list storage unit 34 as a harmless list. In detail, the analysis unit 33 divides the normal log received from the communication unit 31 into words, hierarchizes the words in the order in which they are written in the log, and stores the hierarchized words together with upper layer information indicating a link with the upper layer as a harmless list in the list storage unit 34. In this embodiment, the harmless list is a list in which the words in the normal log are hierarchized and associated in a tree shape. The harmless list in this embodiment will be described in detail later. A normal log is, for example, a log acquired during a period known to be normal, and when this period is specified by the user, for example, the communication unit 31 receives logs for this period from the monitored device 2 and outputs them to the analysis unit 33 as normal logs. Furthermore, as described below, when the display device 4 displays information indicating that the attack detection device 3 has detected a log that may be an attack, the display device 4 accepts input from the user as to whether the log is normal or not. When the communication unit 31 receives a log that the user has determined to be normal from the display device 4, the communication unit 31 also outputs the log to the analysis unit 33 as a normal log.

The determination unit 35 divides the log to be monitored into words, assigns the monitored words to layers in the order in which they are written in the log to be monitored, starting from the top layer, and compares the monitored words for each layer with the harmless list. If the monitored words do not match the harmless list, the determination unit 35 determines that there is a possibility of an attack. In detail, the determination unit 35 reads the log to be monitored stored in the log storage unit 32, and determines whether the log to be monitored is harmless by comparing the read log with the harmless list. If it determines that the log to be monitored is not harmless, it determines that there is a possibility of an attack, and notifies the notification information generation unit 36 of the determination result together with the contents of the log determined to be a possible attack.

When the determination unit 35 determines that there is a possibility of an attack, the notification information generation unit 36 generates notification information including information indicating the possibility of an attack and a log to be checked, which is a log of a monitoring target determined to be a possible attack. In detail, when the notification information generation unit 36 receives a determination result indicating that there is a possibility of an attack from the determination unit 35, the notification information generation unit 36 generates notification information indicating that there is a possibility of an attack. The notification information generation unit 36 includes the contents of the log determined to be a possible attack in the notification information. The notification information generation unit 36 transmits the notification information to the display device 4 via the communication unit 31.

The log storage unit 32 stores logs of monitored items. The list storage unit 34 stores the harmless list.

The display device 4 displays the notification information received from the attack detection device 3. The display device 4 includes a control unit 41, a communication unit 42, and a display unit 43. When the communication unit 42 receives the notification information from the attack detection device 3, it passes it to the control unit 41. The control unit 41 uses the notification information received from the communication unit 42 to generate display information to be displayed on the display unit 43 and outputs it to the display unit 43. The display information includes the contents of the notification information received from the attack detection device 3, that is, information indicating that a possible attack has been detected and the contents of the corresponding log. The display unit 43 displays the display information. In addition, when an input means not shown in the figure or an input means integrated with the display unit 43 receives an input from a user indicating that the log displayed on the display unit 43 is normal, the control unit 41 determines that the log displayed on the display unit 43, that is, the log included in the notification information received from the attack detection device 3, is a normal log. Then, the control unit 41 transmits the log to the attack detection device 3 together with information indicating that the log is normal. The display unit 43 displays the display information received from the control unit 41.

The display device 4 may be a personal computer, a tablet, a smartphone, or the like. For example, the attack detection device 3 may function as a web server, and the notification information generation unit 36 may generate notification information in a format that can be viewed in a browser, such as an html file.

Next, the operation of this embodiment will be described. FIG. 2 is a flowchart showing an example of a procedure for generating a harmless list in this embodiment. As shown in FIG. 2, the attack detection device 3 receives logs to be registered in the harmless list (step S1). In detail, the communication unit 31 receives the normal log described above as a log to be registered in the harmless list, and passes it to the analysis unit 33.

Next, the attack detection device 3 divides the log to be registered in the harmless list into words (step S2). In detail, the analysis unit 33 divides the normal log from the communication unit 31 into words at a unit of a predetermined separator such as a space. Note that the separator of the word is not limited to a space and may be a comma or the like, and is set by the user, for example.

The attack detection device 3 then records the words in association with the upper hierarchy (step S3), and ends the process. In detail, the analysis unit 33 associates the words with the hierarchy in the order in which they are written in the log. For example, the first word written is the first hierarchy, the next word written is the second hierarchy, and so on. Then, the words in each hierarchy are associated with the words in the higher hierarchy, and the words associated with the higher hierarchy are stored in the list storage unit 34 as a harmless list.

For example, suppose a normal log contains the entry "I amn't hacker." This log is split into three words, "I", "amn't", and "hacker.", where "I" is a word in the first hierarchy, "amn't" is a word in the second hierarchy, and "hacker." is a word in the third hierarchy. "amn't" in the second hierarchy is connected to "I" in the higher hierarchy, and "hacker." in the third hierarchy is connected to "I" in the first hierarchy and "amn't" in the second hierarchy. In this case, "amn't" in the second hierarchy is associated with "I" in the higher hierarchy, and "hacker." in the third hierarchy is associated with "I" in the first hierarchy and "amn't" in the second hierarchy.

If the same word is already included in the harmless list, including the associations in the upper layers, the analysis unit 33 does not add the word to the harmless list, and adds a new word to the harmless list if the same word is not included in the harmless list, including the associations in the upper layers. For example, in the case of a word in the second layer, the same word is not only the same word when viewed in the second layer alone, but also the same word in the first layer associated with the second layer. In other words, if the analysis unit 33 processes the above "I amn't hacker." as a normal log and registers the word in the harmless list, and then obtains a normal log "I amn't attacker.", the "I" in the first layer is already registered, so it is not registered in the harmless list, and the "amn't" in the second layer is not registered because the "I" in the upper layer is also the same "amn't" in the second layer.

Figure 3 is a diagram showing the harmless list of this embodiment in the form of a tree. As described above, by relating each word in the log to a higher level, the analysis unit 33 can determine a tree-like relationship as shown in Figure 3. In the example shown in Figure 3, "I" is shown as a word in the first level, and word 1 is written above "I" as information identifying this word along with its relationship to a higher level. Since the first level does not have a higher level, only the identification number 1 within the first level is assigned to "I".

Figure 3 shows two words in the second hierarchy, "amn't" and "didn't," both of which are associated with "I" in the higher-level first hierarchy. Here, the identification numbers for "amn't" and "didn't" in the second hierarchy are 1 and 2, respectively, and word 1-1 is written above "amn't," and word 1-2 is written above "didn't." In word 1-1, the final number 1 indicates the identification number of the word in the second hierarchy, and the 1 before the hyphen indicates the identification number of the associated word in the first hierarchy.

Figure 3 shows three words in the third hierarchy: "hacker\.", "attacker\.", and "attack\.". Of these, "hacker\." and "attacker\." are both associated with "I" in the first hierarchy and "amn't" in the second hierarchy, while "attack\." is associated with "I" in the first hierarchy and "didn't" in the second hierarchy. Since a period is used in regular expressions to mean any one character, "\" is placed before the period to indicate that it is the period character itself, rather than any one character. In the example shown in Figure 3, the identification number of "hacker\." in the third hierarchy is 1, and above "hacker\.", word 1-1-1 is written as information including its relationship to the upper hierarchy. Similarly, words 1-1-2 and 1-2-1 are written for "attacker\." and "attack\.", respectively, as information including its relationship to the upper hierarchy.

As shown in FIG. 3, if a normal log contains both "I amn't hacker." and "I amn't attacker.", in this embodiment, the common part "I amn't" only needs to be registered as a word once each. Note that the example shown in FIG. 3 shows a simple model, so the number of words is small, but generally there are more hierarchies and a large number of logs are registered, so a large amount of memory is used to hold the entire text as a normal log. In this embodiment, the harmless list is stored in a hierarchical tree structure, so memory usage can be reduced compared to when the entire text of a normal log is stored.

In FIG. 3, the harmless list is displayed in a tree format to show the associations, but in reality, the words are stored in the list storage unit 34 as the harmless list together with information showing the association with the upper layer. FIG. 4 is a diagram showing an example of the harmless list stored in the list storage unit 34 of this embodiment. In the example shown in FIG. 4, the identification number of the word, the word, and the upper layer link are stored for each layer as the harmless list. The upper layer link is upper layer information that identifies the associated word in the upper layer. In the example shown in FIG. 4, when the upper layer is the first layer, the identification number of the associated word in the upper layer is stored in the upper layer link field. In addition, when the upper layer is two layers or more, when j is an integer of 3 or more, the upper layer link of the jth layer is shown by the identification numbers of the words associated with each of the first layer, second layer, ..., (j-1)th layer, in that order, separated by hyphens. In addition, as shown in FIG. 4, an identification number is assigned to each associated upper layer link, that is, when the upper layer link is 1-1 and when it is 1-2. Note that the harmless list shown in Figure 4 is just an example, and it is sufficient if the same content can be recorded; the specific method of assigning identification numbers and the format are not limited to the example shown in Figure 4.

In the examples shown in Figures 3 and 4, the words themselves contained in the normal log are used, but at least some of the words contained in the harmless list may be expressed by regular expressions. For example, if all single-letter uppercase alphabet characters are registered in the first hierarchical level as normal logs, a single regular expression "[A-Z]" may be used in place of each of these words A-Z. By using regular expressions in this way, the size of the harmless list can be further reduced. Note that in this embodiment, a group of parts expressed in this way using regular expressions is also called a word. Note that a part of a word may be expressed in a regular expression.

Next, attack detection using the logs of the monitored object in this embodiment will be described. FIG. 5 is a flowchart showing an example of an attack detection processing procedure in this embodiment. As shown in FIG. 5, the attack detection device 3 acquires the logs of the monitored object (step S11). In detail, the communication unit 31 receives the logs of the monitored object from the monitored object device 2, and stores the received logs in the log storage unit 32.

Next, the attack detection device 3 divides the log of the monitoring target into words (step S12). In detail, the determination unit 35 divides the log of the monitoring target stored in the log storage unit 32 into words. The method of dividing into words is the same as the method described in step S2.

Next, the attack detection device 3 sets i, a variable indicating the layer to be processed, to 1 (step S13). Next, the attack detection device 3 determines whether the words in the i-th layer of the log match the words in the i-th layer of the harmless list, including their links (step S14). In detail, the determination unit 35 first arranges the words divided in step S12 in the order of description, and associates the layers in the order of description, starting from the first layer. Then, the determination unit 35 determines whether the words in the first layer among the words divided in step S12 match the words in the first layer of the harmless list stored in the list storage unit 34, including their links. In the case of the first layer, since there is no upper layer, it is determined whether any of the words in the first layer of the harmless list stored in the list storage unit 34 that match the words in the first layer among the words divided in step S12. When i is 2 or more, the determination unit 35 determines whether or not there is a word in the i-th layer of the harmless list stored in the list storage unit 34 that matches a word in the i-th layer of the log to be monitored, and whether or not there is a word in a layer higher than the i-th layer in the log to be monitored that matches a higher layer link.

For example, when the harmless list shown in FIG. 4 is stored in the list storage unit 34, if a log "I amn't attacker." is acquired as a log to be monitored, the determination unit 35 determines Yes in step S14 when i=1 because "I" in the first layer of the log to be monitored is included in the words in the first layer of the harmless list. Also, when i=2, "amn't" in the second layer of the log to be monitored is included in the words in the second layer of the harmless list, and the 1 shown in the upper layer link of "amn't" in the second layer is an identification number corresponding to "I" in the first layer and matches including the link destination, so the determination unit 35 determines Yes in step S14. Similarly, when i=3, "attacker." matches including the words in the third layer of the harmless list, so the determination unit 35 determines Yes in step S14.

On the other hand, for example, when the harmless list shown in FIG. 4 is stored in the list storage unit 34, if a log "I am not traitor." is acquired as a log to be monitored, the judgment unit 35 judges Yes in step S14 when i=1 and when i=2, but judges No in step S14 when i=3 because "traitor." is not in the third hierarchical level of the harmless list.

For example, when the harmless list shown in FIG. 4 is stored in the list storage unit 34, if a log "I attacker amn't." is acquired as a log to be monitored, the determination unit 35 determines Yes in step S14 when i=1, but determines No in step S14 when i=2 because "attacker" is not in the second hierarchical level of the harmless list. In this way, even if a word is included in the harmless list by itself, if the hierarchical level is different, the determination in step S14 will be No.

Return to the explanation of FIG. 5. If the answer to step S14 is Yes, the determination unit 35 of the attack detection device 3 determines whether i is equal to imax (step S16). imax is the number of words in the log of the monitoring target determined when the log is divided into words in step S12. If i is equal to imax (step S16 Yes), the attack detection device 3 ends the process. If the answer to step S16 is Yes, the log is determined to match the harmless list at all levels, so the determination unit 35 of the attack detection device 3 determines that the log of the monitoring target is normal. Here, an example is shown in which the attack detection device 3 does not perform any processing when it determines that the log of the monitoring target is normal, but even if it determines that the log of the monitoring target is normal, it may notify the notification information generation unit 36 of the determination result. In this case, the notification information generation unit 36 transmits notification information indicating that the log of the monitoring target is normal to the display device 4 via the communication unit 31.

If i is not equal to imax (step S16 No), the determination unit 35 of the attack detection device 3 sets i=i+1 (step S17) and performs the process of step S14 again. If the determination is No in step S14 (step S14 No), the attack detection device 3 notifies the possibility of an attack (step S15) and ends the process. In detail, in step S15, the determination unit 35 notifies the notification information generation unit 36 of the possibility of an attack together with the corresponding log, and the notification information generation unit 36 generates notification information indicating the possibility of an attack and transmits it to the display device 4 via the communication unit 31. As described above, the notification information includes the contents of the log that is determined to be the possibility of an attack. When the notification information generation unit 36 generates the notification information as an html file, the notification information is transmitted to the display device 4 when the corresponding URL (Uniform Resource Locator) is specified by the display device 4.

By performing the above process, the attack detection device 3 can determine whether or not there is a possibility of an attack by comparing the logs of the monitored objects with the tree-shaped harmless list. When the display device 4 receives the notification information, it displays it on the display unit 43. This allows the user to recognize that there is a log indicating a possible attack.

Figure 6 is a diagram showing an example of a screen displayed on the display device 4 of the present embodiment. When the display device 4 receives notification information, for example, as shown in Figure 6, it displays a message indicating that a log with a possible attack has been detected, the corresponding log, and information prompting the user to select a countermeasure. In the example shown in Figure 6, a message "A log with a possible attack has been detected" is displayed as a message indicating that a log with a possible attack has been detected, and the contents of the corresponding log are displayed below it. Figure 6 shows an example in which a log "I am not traitor." is determined not to match the harmless list. In addition, Figure 6 shows three options for countermeasures: "Do not take action," "Register in harmless list," and "Warning," which are buttons that accept input. The user can select a countermeasure by clicking or touching one of these three buttons. Note that the specific contents, arrangement, and method of accepting input of countermeasures, etc., of the message to be displayed are not limited to the example of Figure 6, and any format may be used as long as the equivalent contents are displayed.

When "Do not deal with" is selected, no particular action is taken. When "Alert" is selected, an alert is issued, such as by sending a message indicating that an attack has been detected to a person in charge of handling a detected attack. When "Register in harmless list" is selected, the control unit 41 of the display device 4 transmits the corresponding log to the attack detection device 3 via the communication unit 42 together with information indicating that the log is normal. As a result, the attack detection device 3 performs the harmless list registration process shown in FIG. 2 and registers the harmless list corresponding to "I amn't traitor." That is, after transmitting notification information including the log to be checked to the display device 4, when the communication unit 31 of the attack detection device 3 receives information indicating that the log to be checked is a normal log from the display device 4, it notifies the analysis unit 33 of the received information, and the analysis unit 33 performs registration processing of the log to be checked as a normal log.

Figure 7 is a diagram showing the harmless list of this embodiment in the form of a tree after a new word has been registered. Figure 7 corresponds to an example in which, when the harmless list is in the state shown in Figure 3, the log "I amn't traitor." is judged to be a possible attack by the attack detection process, this is displayed by the display device 4, and the user judges "I amn't traitor." to be normal and selects "Register to harmless list" as shown in Figure 6. The attack detection device 3 then carries out the process shown in Figure 2, and "traitor\." is added to the third level, as indicated by the dashed line in Figure 7.

Although the above describes an example in which all divided words are matched, if there are words that change frequently, such as dates and times, that you want to exclude from matching, you can provide a section to exclude them. For example, if the log begins with a date and time, the first word in the log's order of appearance can be excluded from matching, and the second word in the order of appearance can be treated as the first hierarchical level, and the above-mentioned harmless list registration process and attack detection process can be performed. Also, the user may be able to set which words are to be excluded from matching.

Next, the hardware configuration of each device will be described. In this embodiment, the attack detection device 3 functions as the attack detection device 3 by executing a program describing the processing in the attack detection device 3 on the computer system. FIG. 8 is a diagram showing an example of the configuration of a computer system that realizes the attack detection device 3 of this embodiment. As shown in FIG. 8, this computer system includes a control unit 101, an input unit 102, a memory unit 103, a display unit 104, a communication unit 105, and an output unit 106, which are connected via a system bus 107.

In FIG. 8, the control unit 101 is a processor such as a CPU (Central Processing Unit), and executes a program in which the processing in the attack detection device 3 of this embodiment is described. The input unit 102 is composed of, for example, a keyboard, a mouse, and the like, and is used by the user of the computer system to input various information. The storage unit 103 includes various memories such as a RAM (Random Access Memory) and a ROM (Read Only Memory), and a storage device such as a hard disk, and stores the program to be executed by the control unit 101, necessary data obtained in the process of processing, and the like. The storage unit 103 is also used as a temporary storage area for the program. The display unit 104 is composed of a display, an LCD (Liquid Crystal Display Panel), and the like, and displays various screens to the user of the computer system. The communication unit 105 is a receiver and a transmitter that perform communication processing. The output unit 106 is a printer, etc. Note that FIG. 8 is an example, and the configuration of the computer system is not limited to the example of FIG. 8.

Here, an example of the operation of the computer system until the program of this embodiment is in a state where it can be executed will be described. In the computer system having the above-mentioned configuration, for example, the program is installed in the storage unit 103 from a CD-ROM or DVD-ROM set in a CD (Compact Disc)-ROM drive or DVD (Digital Versatile Disc)-ROM drive (not shown). Then, when the program is executed, the program read from the storage unit 103 is stored in the main memory area of the storage unit 103. In this state, the control unit 101 executes processing as the attack detection device 3 of this embodiment according to the program stored in the main memory area of the storage unit 103.

In the above explanation, a program describing the processing in the attack detection device 3 is provided on a CD-ROM or DVD-ROM as a recording medium, but this is not limiting. Depending on the configuration of the computer system and the capacity of the program to be provided, for example, a program provided via a transmission medium such as the Internet via the communication unit 105 may be used.

Of the attack detection device 3 shown in FIG. 1, the analysis unit 33, the determination unit 35, and the notification information generation unit 36 are realized by the control unit 101 shown in FIG. 8 executing a program stored in the memory unit 103 shown in FIG. 8. The log memory unit 32 and the list memory unit 34 shown in FIG. 1 are part of the memory unit 103 shown in FIG. 8. The communication unit 31 shown in FIG. 1 is realized by the communication unit 105 shown in FIG. 8. The attack detection device 3 may be realized by multiple computer systems. The attack detection device 3 may also be realized by a cloud system.

The attack detection support program, in which the processing in the attack detection device 3 is described, causes the computer system to execute, for example, the steps of dividing a normal log acquired from the monitored device 2 into words, assigning the words to hierarchies in the order in which the words are written in the normal log, starting from the top layer, and storing the words in a harmless list in association with upper layer information, which is information identifying words corresponding to each of the higher layers in the normal log from the words in question. Furthermore, the attack detection support program causes the computer system to execute the steps of dividing a monitored log, which is a log acquired from the monitored device 2, into words, assigning monitored words to hierarchies in the order in which the monitored words, which are words in the monitored log, starting from the top layer, and comparing the monitored words with the harmless list for each layer, and determining that there is a possibility of an attack if the monitored words do not match the harmless list.

Similarly, the display device 4 can be realized by the computer system illustrated in FIG. 8. For example, the control unit 41 is realized by the control unit 101 illustrated in FIG. 8 executing a program stored in the storage unit 103 illustrated in FIG. 8. The display unit 43 illustrated in FIG. 1 is realized by the display unit 104 illustrated in FIG. 8. The communication unit 42 illustrated in FIG. 1 is realized by the communication unit 105 illustrated in FIG. 8. As described above, the display device 4 may be a tablet, a smartphone, etc., and in this case, the hardware configuration is the same as the example illustrated in FIG. 8.

As described above, in this embodiment, normal logs are divided into words, the words are hierarchically organized in the order in which they appear in the log, and the hierarchical words are stored as a harmless list together with information indicating links to higher levels. Logs to be monitored are then divided into words and compared against the harmless list. This makes it possible to reduce false positives of attacks while suppressing memory usage.

Embodiment 2.
9 is a diagram showing a configuration example of an attack detection support system according to a second embodiment. An attack detection support system 1a according to this embodiment is obtained by adding a relay device 5 to the attack detection support system 1 according to the first embodiment. Components having the same functions as those in the first embodiment are given the same reference numerals as those in the first embodiment, and duplicated explanations will be omitted. Below, differences from the first embodiment will be mainly explained.

In this embodiment, the relay device 5 receives logs from the monitored device 2, performs a predetermined process on the received logs, and transmits the processed logs to the attack detection device 3. The predetermined process performed by the relay device 5 is, for example, a process to correct an error when there is an error in the time information of the monitored device 2, and a process to change the host name in the log when it is desired to change the host name to a different name and input it to the monitored device 2. These correction and change processes can also be performed by the attack detection device 3, but the load on the attack detection device 3 is high due to the monitoring of logs. By having the relay device 5 perform these correction and change processes, the logs to be input to the attack detection device 3 can be converted into a format suitable for analysis without increasing the load on the attack detection device 3.

As described above, there may be multiple monitored devices 2, and multiple monitored devices 2 may send logs to the relay device 5, and the relay device 5 may process the logs received from these monitored devices 2 and send them to the attack detection device 3. Also, multiple relay devices 5 may be provided, and each relay device 5 may process the logs received from multiple monitored devices 2 and send them to the attack detection device 3.

As shown in FIG. 9, the relay device 5 includes a communication unit 51 and a conversion unit 52. The communication unit 51 receives logs from the monitored device 2 and outputs the received logs to the conversion unit 52. The conversion unit 52 performs processing on the logs received from the communication unit 51, such as correcting the time and modifying predetermined items such as the host name, and transmits the processed logs to the attack detection device 3 via the communication unit 51. Other than as described above, the configuration and operation of this embodiment are the same as those of embodiment 1.

The relay device 5 of this embodiment is also realized by a computer system, similar to the attack detection device 3 of embodiment 1.

As described above, in this embodiment, the relay device 5 receives logs from the monitored device 2, processes the received logs, and transmits the processed logs to the attack detection device 3. This makes it possible to make the logs input to the attack detection device 3 suitable for analysis without increasing the load on the attack detection device 3.

Embodiment 3.
Fig. 10 is a diagram showing an example of the configuration of an attack detection support system according to the third embodiment. The attack detection support system 1 according to the first embodiment includes one attack detection device 3, but the attack detection support system 1b according to the present embodiment includes two attack detection devices 3. The attack detection devices 3-1 and 3-2 shown in Fig. 10 are each the attack detection device 3 according to the first embodiment. Components having the same functions as those in the first embodiment are given the same reference numerals as those in the first embodiment, and duplicated explanations will be omitted. Below, differences from the first embodiment will be mainly explained.

In this embodiment, two attack detection devices 3 are provided to provide redundancy for the attack detection devices 3. When two attack detection devices 3 are provided for redundancy, typically one of them is used for operation, while the other is on standby, for example in a sleep state, and if an abnormality occurs in the attack detection device 3 in operation, the other attack detection device 3 automatically switches over to execute processing. In the example shown in FIG. 10, the attack detection devices 3-1 and 3-2 synchronize their logs and harmless lists. For example, the attack detection devices 3-1 and 3-2 communicate via their respective communication units 31, so that when data is updated in one device, the data is also updated in the other device.

In this embodiment, when two attack detection devices 3 are provided for redundancy as described above, one of the two performs processing by the analysis unit 33 but not by the determination unit 35, and the other performs processing by the determination unit 35 but not by the analysis unit 33. For example, the attack detection device 3 in operation performs log collection and registration processing, and the other attack detection device 3 performs attack detection processing of the logs by the determination unit 35. In this way, by having the attack detection device 3 in standby also share some of the processing, the processing load of the attack detection device 3 can be reduced and processing delays can be suppressed. Note that the processing performed by each of the two attack detection devices 3 is not limited to the above-mentioned division, and it is sufficient that the processing is shared between the two devices.

It is also possible to provide three or more attack detection devices 3 and share the processing among the three or more attack detection devices 3. Also, in this embodiment, the relay device 5 described in the second embodiment may be used. For example, the relay device 5 may also be made redundant.

The configurations shown in the above embodiments are merely examples, and may be combined with other known technologies, or the embodiments may be combined with each other. In addition, parts of the configurations may be omitted or modified without departing from the spirit of the invention.

1, 1a, 1b Attack detection support system, 2 Monitored device, 3, 3-1, 3-2 Attack detection device, 4 Display device, 5 Relay device, 21 Processing unit, 22, 31, 42, 51 Communication unit, 23, 32 Log storage unit, 33 Analysis unit, 34 List storage unit, 35 Determination unit, 36 Notification information generation unit, 41 Control unit, 43 Display unit, 52 Conversion unit.

Claims (9)

a list storage unit that stores a harmless list used for matching with a monitoring target log, which is a log of a monitoring target acquired from a monitoring target device;
an analysis unit that performs a registration process of dividing a normal log acquired from the monitored device into words, allocating the words to hierarchies in the order in which the words are written in the normal log, starting from the highest hierarchies, and associating the words with upper layer information that identifies the words corresponding to each of the higher hierarchies in the normal log from the words, and storing the association results in the harmless list in the list storage unit;
a determination unit that divides the monitoring target log into words, assigns the monitoring target words to hierarchies in the order in which the monitoring target words, which are the words, are written in the monitoring target log, starting from the highest hierarchical level, compares the monitoring target words with the harmless list for each hierarchical level, and determines that there is a possibility of an attack if the monitoring target words do not match the harmless list;
An attack detection device comprising: a notification information generating unit that generates notification information including information indicating the possibility of an attack and a check-required log that is the monitoring target log determined to have the possibility of an attack when the determining unit determines that there is a possibility of an attack;
A communication unit that transmits the notification information to a display device;
The attack detection device according to claim 1 , further comprising: When the communication unit receives information indicating that the confirmation-required log is a normal log after transmitting the notification information to the display device, the communication unit notifies the analysis unit of the received information;
The attack detection device according to claim 2 , wherein the analysis unit performs the registration process by treating the check-required log as the normal log. An attack detection device according to any one of claims 1 to 3, characterized in that at least some of the words included in the harmless list are expressed by regular expressions. an attack detection device that determines whether or not there is a possibility of an attack using a monitoring target log that is a log of the monitoring target acquired from the monitoring target device;
A display device;
Equipped with
The attack detection device is
a list storage unit that stores a harmless list used for checking against the monitoring target log;
an analysis unit that performs a registration process of dividing a normal log acquired from the monitored device into words, allocating the words to hierarchies in the order in which the words are written in the normal log, starting from the highest hierarchies, and associating the words with upper layer information that identifies the words corresponding to each of the higher hierarchies in the normal log from the words, and storing the association results in the harmless list in the list storage unit;
a determination unit that divides the monitoring target log into words, assigns the monitoring target words to hierarchies in the order in which the monitoring target words, which are the words, are written in the monitoring target log, starting from the highest hierarchical level, compares the monitoring target words with the harmless list for each hierarchical level, and determines that there is a possibility of an attack if the monitoring target words do not match the harmless list;
a notification information generating unit that generates notification information including information indicating the possibility of an attack and a check-required log that is the monitoring target log determined to have the possibility of an attack when the determining unit determines that there is a possibility of an attack;
a communication unit that transmits the notification information to the display device;
Equipped with
The display device is an attack detection support system characterized in that it displays the notification information. The attack detection support system according to claim 5, further comprising a relay device that acquires the monitored logs and the normal logs from the monitored devices, performs a predetermined process on the acquired monitored logs and the normal logs, and transmits them to the attack detection device. The attack detection device is provided with two units,
An attack detection support system as described in claim 5 or 6, characterized in that one of the two attack detection devices performs processing using the analysis unit and does not perform processing using the judgment unit, and the other of the two attack detection devices performs processing using the judgment unit and does not perform processing using the analysis unit. 1. An attack detection support method in an attack detection device that determines whether or not there is a possibility of an attack using a monitoring target log, which is a log of a monitoring target acquired from a monitoring target device, comprising:
a step of dividing a normal log acquired from the monitored device into words, allocating the words to hierarchies in the order in which the words are written in the normal log, starting from the highest hierarchies, and storing the words in association with higher-level hierarchical information, which is information identifying the words corresponding to each of the higher hierarchies in the normal log from the words in question, as a harmless list;
a step of dividing a monitoring target log, which is a log acquired from the monitoring target device, into words, allocating the monitoring target words to hierarchies in the order in which the words, which are the monitoring target words, are written in the monitoring target log, starting from the top layer, comparing the monitoring target words for each layer with the harmless list, and determining that there is a possibility of an attack if the monitoring target words do not match the harmless list;
An attack detection support method comprising: A computer system for determining whether or not there is a possibility of an attack using a monitoring target log, which is a log of a monitoring target acquired from a monitoring target device,
a step of dividing a normal log acquired from the monitored device into words, allocating the words to hierarchies in the order in which the words are written in the normal log, starting from the highest hierarchies, and storing the words in association with higher-level hierarchical information, which is information identifying the words corresponding to each of the higher hierarchies in the normal log from the words in question, as a harmless list;
a step of dividing a monitoring target log, which is a log acquired from the monitoring target device, into words, allocating the monitoring target words to hierarchies in the order in which the words, which are the monitoring target words, are written in the monitoring target log, starting from the top layer, comparing the monitoring target words for each layer with the harmless list, and determining that there is a possibility of an attack if the monitoring target words do not match the harmless list;
An attack detection support program comprising:

Images