JP7691620B2 - Anomaly detection method and anomaly detection program - Google Patents

Description

The present invention relates to an anomaly detection method and an anomaly detection program.

For example, a business operator that provides a service to a user (hereinafter, also simply referred to as a business operator) constructs and operates a business system for providing the service. Specifically, the business operator operates a business system for providing a service (hereinafter, also referred to as a web service) via a network such as the Internet.

In a business system such as the one described above, the business operator needs to quickly detect the occurrence of events (such as concentrated access or equipment failure) that may cause response delays from the business system in order to prevent, for example, a deterioration in the quality of the service provided to users. For this reason, the business operator performs anomaly detection, which is a method of detecting the occurrence of a failure by analyzing past response times from the business system and modeling a normal state. Specifically, the business operator detects responses whose response time can be determined to be abnormal (responses whose response time deviates from the normal range) by using a normal range of response times (hereinafter also simply referred to as the normal range) that is automatically set from past response times (see, for example, Patent Document 1).

JP 2021-022759 A

In anomaly detection such as the one described above, for example, a normal range is set for each access target accessed by a user based on the statistical values of response times when each access target is accessed.

However, when there is an access target that is infrequently accessed by users, the operator may not be able to secure sufficient data (e.g., access logs) to use in setting the normal range for that access target, and may not be able to set a normal range that allows for accurate anomaly detection. In other words, the operator may not be able to accurately detect anomalies, for example, depending on the access frequency for each access target.

Therefore, in one aspect, the present invention aims to provide an anomaly detection method and an anomaly detection program that enable anomaly detection to be performed with high accuracy.

In one aspect of the embodiment, when it is determined that the number of pieces of response time information for determining a normal range used in detecting an anomaly in the response time of a first access target is below a predetermined value, a first transition status of the response time of the first access target is identified, a second access target whose transition status in response time is similar to the first transition status is identified, a normal range is set from the first transition status and the transition status corresponding to the second access target, and when a new access occurs to the first access target, an anomaly is detected in the response time of the new access by using the normal range.

According to one aspect, it becomes possible to perform anomaly detection with high accuracy.

FIG. 1 is a diagram illustrating a configuration of an information processing system 10. As shown in FIG. FIG. 2 is a diagram illustrating a hardware configuration of the information processing device 1. As shown in FIG. FIG. 3 is a functional block diagram of the information processing device 1. FIG. 4 is a flow chart for explaining an outline of the abnormality detection process in the first embodiment. FIG. 5 is a graph illustrating a specific example of the first embodiment. FIG. 6 is a graph illustrating a specific example of the first embodiment. FIG. 7 is a graph illustrating a specific example of the first embodiment. FIG. 8 is a flowchart illustrating details of the abnormality detection process according to the first embodiment. FIG. 9 is a flowchart illustrating details of the abnormality detection process according to the first embodiment. FIG. 10 is a flowchart illustrating details of the abnormality detection process in the first embodiment. FIG. 11 is a diagram for explaining a specific example of the access log LG. FIG. 12 is a diagram illustrating a specific example of the feature amount information 131. As shown in FIG. FIG. 13 is a diagram illustrating a specific example of the feature amount information 131. As shown in FIG. FIG. 14 is a diagram for explaining a specific example of the normal range information 132. As shown in FIG. FIG. 15 is a graph illustrating a specific example of the processes from S33 to S38. FIG. 16 is a graph illustrating a specific example of the processes from S33 to S38. FIG. 17 is a graph illustrating a specific example of the processes from S33 to S38. FIG. 18 is a diagram for explaining a specific example of the normal range information 132. As shown in FIG. FIG. 19 is a diagram for explaining a specific example of the normal range information 132.

[Configuration of Information Processing System in First Embodiment]
First, a description will be given of the configuration of the information processing system 10. FIG.

As shown in FIG. 1, the information processing system 10 has, for example, a business system 2 consisting of one or more web servers that provide web services to users, and user terminals 3a, 3b, and 3c that each user uses when accessing the business system 2. The user terminals 3a, 3b, and 3c are, for example, mobile terminals such as a PC (Personal Computer) or a smartphone owned by each user. Hereinafter, the user terminals 3a, 3b, and 3c are also collectively referred to simply as user terminals 3. In addition, the following description will be given of a case in which the information processing system 10 has three user terminals 3, but the information processing system 10 may have a number of user terminals 3 other than three.

Specifically, for example, when a user accesses the business system 2 via the user terminal 3, the business system 2 executes a process corresponding to the access target (for example, URL (Uniform Resource Locator)) that was accessed, and transmits the execution result (response) to the user terminal 3. Then, as shown in FIG. 1, the business system 2 accumulates, for example, an access log LG related to the access from the user terminal 3 to the business system 2 in the storage device 2a. Hereinafter, the time from when the user terminal 3 accesses the business system 2 to when it receives a response is referred to as the response time.

As shown in FIG. 1, the information processing system 10 also includes an information processing device 1 that performs anomaly detection using an access log LG stored in a storage device 2a. The information processing device 1 is, for example, one or more physical machines or virtual machines.

Specifically, for example, for each access target accessed by a user, the information processing device 1 automatically sets a normal range corresponding to each access target from the response time statistics included in the access log LG generated when each access target is accessed. Then, the information processing device 1 detects access targets whose response times are longer or shorter than usual by, for example, using the set normal range as a criterion for detecting anomalies.

Here, for example, if there is an access target that is infrequently accessed by users, the information processing device 1 cannot secure a sufficient amount of access log LG to be used for setting the normal range, and cannot set a normal range that enables accurate anomaly detection.

Specifically, for example, even if an access target has a response time between 2 and 10 seconds that should be within the normal range, if an access log LG with a response time between 6 and 10 seconds is temporarily generated at a frequency lower than normal (for example, lower than the frequency of access logs LG with response times between 2 and 6 seconds), the information processing device 1 may set the range between 2 and 6 seconds as the normal range. Therefore, in this case, the information processing device 1 may detect an access whose response time should be determined to be within the normal range (for example, an access with a response time of 8 seconds) as an abnormal access.

Also, for example, even if an access target has a response time between 2 and 10 seconds that should be within the normal range, if an access log LG with a response time between 10 and 15 seconds is temporarily generated at a frequency higher than normal (for example, at a frequency equivalent to that of access logs with response times between 2 and 10 seconds), the information processing device 1 may set the range between 2 and 15 seconds as the normal range. Therefore, in this case, the information processing device 1 may detect an access whose response time should not be determined to be within the normal range (for example, an access with a response time of 13 seconds) as a normal access.

In other words, the information processing device 1 may not be able to perform anomaly detection with high accuracy, for example, depending on the access frequency for each access target.

The information processing device 1 in this embodiment therefore identifies, for example, a transition status (hereinafter also referred to as a first transition status) of the response time of access to a specific access target (hereinafter also referred to as a first access target) included in the multiple access targets. Specifically, the information processing device 1 identifies the first transition status of the response time of the first access target when, for example, it is determined that the number of pieces of response time information for determining a normal range used when performing anomaly detection for the response time of the first access target falls below a predetermined value. The response time information is, for example, information indicating the response time when each access target is accessed.

Then, the information processing device 1 identifies an access target (hereinafter also referred to as a second access target) from among the multiple access targets, whose response time transition status has a predetermined relationship with the first transition status. Specifically, the information processing device 1 identifies, for example, from among the multiple access targets, a second access target whose response time transition status is similar to the first transition status.

Then, the information processing device 1 sets a normal range for the response time of access, for example, from the response time of access to each of the first access target and the second access target. Then, when a new access to the first access target occurs, the information processing device 1 performs anomaly detection (anomaly detection) for the response time of the new access, for example, by using the normal range.

In other words, if the transition status of the response time of access to the first access target and the transition status of the response time of access to the second access target are similar over a specified period of time in the past, it can be determined that the transition status of each response time is highly likely to be similar even now. Therefore, in this case, the first access target and the second access target can be determined to be a combination of access targets for which the normal range can be set collectively. Therefore, in the information processing device 1 in this embodiment, if the transition status of the response time of access to the first access target and the transition status of the response time of access to the second access target are similar over a specified period of time in the past, the first access target and the second access target are combined to form a single access target, and then the normal range is set.

On the other hand, for example, if the number of response times corresponding to the first access target (i.e., the access frequency to the first access target) is sufficiently large, combining the normal range of the first access target with the normal range of the second access target may unnecessarily widen the normal range of the first access target, which may actually worsen the accuracy of anomaly detection. Therefore, the information processing device 1 in this embodiment performs a process of combining the normal range of the first access target with the normal range of the second access target when it is determined that the number of response time information corresponding to the first access target is below a predetermined value.

As a result, the information processing device 1 in this embodiment can secure sufficient access logs to be used to set the normal range for an access target that is infrequently accessed by users, and can set a normal range that enables accurate anomaly detection. Therefore, the information processing device 1 can improve the accuracy of anomaly detection determination.

[Hardware configuration of information processing system]
Next, a description will be given of the hardware configuration of the information processing system 10. FIG.

As shown in FIG. 2, the information processing device 1 has a processor, a CPU 101, a memory 102, an I/O interface 103, and a storage medium 104. Each part is connected to each other via a bus 105.

The storage medium 104 has, for example, a program storage area (not shown) that stores a program 110 for performing a process for detecting accesses with abnormal response times (hereinafter also referred to as anomaly detection process). The storage medium 104 also has, for example, an information storage area 130 that stores information used when performing the anomaly detection process. The storage medium 104 may be, for example, a hard disk drive (HDD) or a solid state drive (SSD).

The CPU 101 executes the program 110 loaded from the storage medium 104 to the memory 102 to perform anomaly detection processing.

The I/O interface 103 is, for example, an interface device such as a network interface card, and is capable of accessing the storage device 2a via a network such as the Internet.

[Functions of the information processing system]
Next, the functions of the information processing system 10 will be described.

As shown in FIG. 3, the information processing device 1 realizes various functions including a situation identification unit 111, a target identification unit 112, a range setting unit 113, a group division unit 114, an anomaly detection unit 115, and a result output unit 116 by organically cooperating with hardware such as a CPU 101 and a memory 102 and a program 110.

In addition, the information processing device 1 stores, for example, feature information 131 and normal range information 132 in the information storage area 130.

The situation identification unit 111, for example, identifies a first transition situation regarding the response time for a first access target included in the multiple access targets.

Specifically, the situation identification unit 111 acquires, for example, access logs LG generated during a predetermined past period (hereinafter also referred to as a first period) from among the access logs LG accumulated in the storage device 2a. Then, the situation identification unit 111 identifies, for example, a first transition status for the response time included in each of the acquired access logs LG.

More specifically, the situation identification unit 111 identifies a first transition situation for the response time of the first access target, for example, when it is determined that the number of response time information corresponding to the first access target falls below a predetermined value.

The target identification unit 112, for example, identifies a second access target from among multiple access targets, whose response time transition status has a predetermined relationship with the first transition status.

Specifically, the target identification unit 112, for example, identifies a second access target from among multiple access targets, whose response time transition during a first period is similar to the first transition.

The range setting unit 113, for example, sets a normal range of response time for access to either the first access target or the second access target.

Specifically, the range setting unit 113 sets the normal range of the response time of access to the first access target by, for example, using the average and standard deviation of the response time of access to the first access target and the second access target.

For example, when the size of the normal range set by the range setting unit 113 is equal to or larger than a predetermined value, the group division unit 114 divides the response time of access to either the first access target or the second access target into multiple groups by using association information between the first access target and the second access target. Then, the range setting unit 113 sets the normal range again for each of the multiple groups divided by the group division unit 114.

Specifically, the group division unit 114 divides, for example, the response time of access to either the first access target or the second access target by the size of the data transmitted and received in association with the access to either the first access target or the second access target. In addition, the group division unit 114 divides, for example, the response time of access to either the first access target or the second access target by the user who accessed either the first access target or the second access target.

The anomaly detection unit 115 detects an anomaly in the response time of access to either the first access target or the second access target, for example, by using the normal range set by the range setting unit 113.

Specifically, for example, when new access occurs to either the first access target or the second access target, the anomaly detection unit 115 performs anomaly detection (anomaly detection) on the response time of the new access by using the normal range set by the range setting unit 113.

The result output unit 116 outputs, for example, the detection result by the anomaly detection unit 115 to an administrator terminal (not shown). The administrator terminal is, for example, a terminal that can be viewed by an administrator (hereinafter also simply referred to as the administrator) who manages the business system 2.

[Outline of the first embodiment]
Next, an overview of the first embodiment will be described with reference to Fig. 4. Fig. 4 is a flow chart for explaining an overview of anomaly detection processing in the first embodiment.

As shown in FIG. 4, the information processing device 1 waits, for example, until the timing to start processing arrives (NO in S11). The timing to start processing is, for example, a timing that is preset by the business operator.

Then, when the processing start timing arrives (YES in S11), the information processing device 1, for example, identifies a first transition status of the response time of access to a first access target included in the multiple access targets (S12).

Specifically, the situation identification unit 111 identifies a first transition situation for the response time of the first access target, for example, when it is determined that the number of response time information corresponding to the first access target falls below a predetermined value.

Next, the information processing device 1 identifies, for example, a second access target among the multiple access targets, whose access response time transition status has a predetermined relationship with the first transition status (S13).

Then, the information processing device 1 sets a normal range for the response time of access to the first access target, for example, from the response time of access to the first access target and the second access target (S14).

Then, when new access occurs to either the first access target or the second access target, the information processing device 1 uses the normal range set in the processing of S14 to detect an anomaly in the response time of the new access that has occurred (S15).

As a result, even if there is an access target that is infrequently accessed by users, the information processing device 1 in this embodiment can secure sufficient access logs to be used to set the normal range for that access target, and can set the normal range that enables accurate anomaly detection. Therefore, the information processing device 1 can improve the accuracy of anomaly detection determination. A specific example of the first embodiment will be described below.

[Specific example of the first embodiment]
5 to 7 are graphs for explaining a specific example of the first embodiment. The horizontal and vertical axes in the graphs shown in Fig. 5 to 7 correspond to the generation time of the access log LG and the response time to the business system 2, respectively. In Fig. 5 to 7, points (circular points) indicating the response time when an access is made to URL 11a, points (star-shaped points) indicating the response time when an access is made to URL 11b, points (triangular points) indicating the response time when an access is made to URL 11c, and points (square points) indicating the response time when an access is made to URL 11d are distributed.

In the following explanation, it is assumed that each URL to be accessed includes the function name (e.g., search, list display, download, etc.) and operation target (e.g., user name, folder name, file name, etc.) that will be performed in response to the access to each URL.

For example, if it is determined that the transition status of the point corresponding to URL11a is similar to the transition status of the point corresponding to URL11b based on the transition status of the points corresponding to each URL shown in FIG. 5, the information processing device 1 performs clustering so that the point corresponding to URL11a and the point corresponding to URL11b belong to cluster CA, as shown in FIG. 6 (S12, S13).

In addition, for example, when the information processing device 1 determines from the transition status of the points corresponding to each URL shown in FIG. 5 that the transition status of the point corresponding to URL11c is not similar to the transition status of the points corresponding to other URLs, it performs clustering so that only the point corresponding to URL11c belongs to cluster CB, as shown in FIG. 6 (S12, S13).

Furthermore, for example, when the information processing device 1 determines from the transition status of the points corresponding to each URL shown in FIG. 5 that the transition status of the point corresponding to URL 11d is not similar to the transition status of the points corresponding to other URLs, it performs clustering so that only the point corresponding to URL 11d belongs to cluster CC, as shown in FIG. 6 (S12, S13).

Then, the information processing device 1 sets normal ranges corresponding to the points included in each cluster, for example, for each of clusters CA, CB, and CC. Specifically, as shown in FIG. 7, the information processing device 1 sets normal range RA from response times corresponding to points included in cluster CA, sets normal range RB from response times corresponding to points included in cluster CB, and further sets normal range RC from response times corresponding to points included in cluster CC.

[Details of the First Embodiment]
Next, the details of the first embodiment will be described. Figures 8 to 10 are flow charts for explaining the details of the abnormality detection process in the first embodiment. Figures 11 to 19 are diagrams for explaining the details of the abnormality detection process in the first embodiment.

[Normal range setting process]
First, the process of setting a normal range (hereinafter also referred to as normal range setting process) in the abnormality detection process will be described.

As shown in FIG. 8, the situation determination unit 111 waits, for example, until the range setting timing arrives (NO in S21). The range setting timing may be, for example, a regular timing such as once a day.

Then, when the time to set the range arrives (YES in S21), the situation identification unit 111 identifies, for example, one of the multiple access targets (S22).

Specifically, the situation identification unit 111, for example, identifies an access target among multiple access targets accessed by a user, the number of pieces of response time information (i.e., access frequency) of which is below a predetermined value.

The initial value of the specified value may be, for example, the number of samples (e.g., 100) that can keep the allowable error within 10%. The initial value of the specified value may be, for example, the number of samples (e.g., 400) that can keep the allowable error within 5%. Furthermore, the administrator may change the specified value as appropriate, for example, depending on the operational status of the information processing device 1.

In this case, the situation identification unit 111 also identifies one unit period (e.g., one week) included in a predetermined first period (e.g., six months) (S23).

Specifically, for example, if the first period is six months from January to June, the situation identification unit 111 identifies the unit period in order, for example, starting from the first week of January.

The situation identification unit 111 then identifies a feature (hereinafter also simply referred to as a feature) that indicates a change in the response time for the access target identified in the process of S22 during the unit period identified in the process of S23 (S24). After that, the situation identification unit 111 stores the identified feature in the information storage area 130 as feature information 131, for example.

Specifically, the situation identification unit 111 acquires, for example, from the access log LG stored in the storage device 2a, logs that were generated during the unit period identified in the process of S23 and that were generated in association with access to the access target identified in the process of S22. Then, the situation identification unit 111 calculates, for example, a combination of multiple percentile values for the response time included in the acquired access log LG as a feature.

This enables the situation identification unit 111 to identify features that indicate the transition of the response time for the access target identified in the processing of S22. Specific examples of the access log LG and feature information 131 are described below.

[Example of access log]
First, a specific example of the access log LG will be described with reference to FIG.

The access log LG shown in FIG. 11 has, for example, items such as a "timestamp" in which the time each log was generated is set, and a "data size" in which the size of data transmitted and received between the user terminal 3 and the business system 2 is set. The access log LG shown in FIG. 11 also has, for example, items such as a "user IP" in which the IP address of the user (user terminal 3) who accessed the business system 2 is set, a "response time" in which the response time of the access to the business system 2 is set, and a "URL" in which the URL of the access target accessed by the user is set.

Specifically, in the example shown in FIG. 11, the access log LG in the first line has, for example, a "timestamp" of "20210519120001," a "data size" of "3.0 (MiB)," a "user IP" of "192.168.3.xxx," a "response time" of "6 (seconds)," and a "URL" of "/user3/folder3/file3/search."

In the example shown in FIG. 11, the access log LG in the second line has, for example, "20210519120003" set as the "timestamp", "12.4 (MiB)" set as the "data size", "192.168.8.xxx" set as the "user IP", "2 (seconds)" set as the "response time", and "/user1/folder1/download/" set as the "URL". Explanation of other information included in FIG. 11 will be omitted.

[Specific example of feature amount information (1)]
Next, a specific example of the feature amount information 131 will be described. Fig. 12 and Fig. 13 are diagrams for explaining a specific example of the feature amount information 131. Specifically, Fig. 12 shows the feature amount information 131 generated when the URL to be accessed identified in the process of S22 is "A" and the unit period identified in the process of S23 is "first week of January."

The feature information 131 shown in FIG. 12 has the following items: "URL," in which the URL of the access target identified in the process of S22 is set; and "10% 1st week of January," "50% 1st week of January," and "90% 1st week of January," in which the 10th, 50th, and 90th percentile values of the response time included in the access log LG generated during the unit period identified in the process of S23 are set, respectively.

Specifically, in the feature information 131 shown in FIG. 12, "A" is set as the "URL", "4 (seconds)" is set as the "1st week of January 10%", "6 (seconds)" is set as the "1st week of January 50%", and "8 (seconds)" is set as the "1st week of January 90%".

Note that in the process of S24, the situation identification unit 111 may calculate, for example, a combination of the logarithms of multiple percentile values for the response times contained in the access log LG as the feature amount. This allows the situation identification unit 111 to suppress the influence of an outlier on the feature amount even if, for example, there is an access log LG (hereinafter also referred to as an outlier) whose response time is much slower than other access logs LG. Also, for example, even if there is an access target whose access frequency differs greatly depending on the time of day, the situation identification unit 111 can suppress the influence of the difference in access frequency on the feature amount.

Returning to FIG. 8, the situation identification unit 111 determines, for example, whether all unit periods have been identified in the processing of S23 (S25).

As a result, if it is determined that not all unit periods have been identified in the processing of S23 (NO in S25), the situation identification unit 111 performs the processing from S23 onwards again.

On the other hand, if it is determined in the processing of S23 that all unit periods have been identified (YES in S25), the situation identification unit 111 determines, for example, whether all access targets have been identified in the processing of S22 (S26).

As a result, if it is determined that not all access targets have been identified in the processing of S22 (NO in S26), the situation identification unit 111 performs the processing from S22 onwards again.

On the other hand, if it is determined in the process of S22 that all access targets have been identified (YES in S26), the target identification unit 112 performs clustering of the access targets, for example, by using the feature amount calculated in the process of S24 (S27).

Specifically, the target identification unit 112 performs clustering of the access targets by, for example, referring to the feature amount information 131 accumulated in the information storage area 130 by repeatedly performing the process of S24. A specific example of the feature amount information 131 referred to in the process of S27 will be described below.

[Specific example of feature amount information (2)]
9, the feature amount information 131 shown in Fig. 13 further includes items such as "10% in the second week of January", "50% in the second week of January", and "90% in the second week of January" in which the 10th, 50th, and 90th percentile values of the response time included in the access log LG generated in the second week of January are set, respectively. The feature amount information 131 shown in Fig. 13 further includes items such as "10% in the third week of January", "50% in the third week of January", and "90% in the third week of January" in which the 10th, 50th, and 90th percentile values of the response time included in the access log LG generated in the third week of January are set, respectively.

Specifically, in the information in the first row of the feature information 131 shown in FIG. 13, for example, "A" is set as the "URL", "4 (seconds)" is set as "10% first week of January", "6 (seconds)" is set as "50% first week of January", "8 (seconds)" is set as "90% first week of January", "4 (seconds)" is set as "10% second week of January", "6 (seconds)" is set as "50% second week of January", and "8 (seconds)" is set as "90% second week of January".

In addition, in the information in the second row of the feature amount information 131 shown in FIG. 13, for example, "B" is set as the "URL", "20 (seconds)" is set as "10% 1st week of January", "21 (seconds)" is set as "50% 1st week of January", "22 (seconds)" is set as "90% 1st week of January", "19 (seconds)" is set as "10% 2nd week of January", "21 (seconds)" is set as "50% 2nd week of January", and "22 (seconds)" is set as "90% 2nd week of January". Explanation of the other information included in FIG. 13 is omitted.

Then, in the process of S27, the target identification unit 112 distributes points in a multidimensional space whose coordinates are the combination of percentile values of each URL for each URL to be accessed. Furthermore, the target identification unit 112 performs clustering for each point distributed in the multidimensional space (each point corresponding to the URL to be accessed) by, for example, using the k-means method using Euclidean distance.

In other words, it is possible to determine that a combination of access targets with a short Euclidean distance in a multidimensional space is a combination of access targets with similar transitions in access response time. Therefore, in the process of S27, the target identification unit 112 performs clustering for each access target, for example, by using the Euclidean distance in a multidimensional space.

In addition, in the process of S27, the target identification unit 112 may use, for example, any one of the Mahalanobis distance, the cosine distance, the Manhattan distance, the Chebyshev distance, and the Minkowski distance instead of the Euclidean distance. Also, in the process of S27, the target identification unit 112 may use, for example, any one of the Ward method, the group average method, the shortest distance method, and the longest distance method instead of the k-means method.

Returning to FIG. 9, the range setting unit 113, for example, identifies one cluster that was clustered in the processing of S27 (S31).

Then, the range setting unit 113 sets, for example, a normal range of response time for each of the access targets included in the cluster identified in the processing of S31 (S32).

Specifically, the range setting unit 113 acquires, for example, from the access logs LG stored in the storage device 2a, logs that were generated in association with access to an access target included in the cluster identified in the processing of S31 and that were generated during a period after a predetermined timing included in the first period (i.e., the most recent period shorter than the first period). Then, the range setting unit 113 calculates, for example, the average value μ and standard deviation σ for the response time included in the acquired access logs LG. Furthermore, the range setting unit 113 identifies, for example, μ±3σ as the normal range.

Then, the range setting unit 113 stores, for example, normal range information 132 indicating the set normal range in the information storage area 130. A specific example of the normal range information 132 will be described below.

[Specific example of normal range information (1)]
14, 18, and 19 are diagrams for explaining specific examples of the normal range information 132. FIG.

The normal range information 132 shown in FIG. 14 etc. has the following items: "URL," in which the URL to be accessed is set; "Lower Range Limit," in which the lower limit of the normal range is set; and "Upper Range Limit," in which the upper limit of the normal range is set.

Specifically, in the information on the first line of the normal range information 132 shown in FIG. 14, "/user1/folder1/download" and "/user1/folder1/upload" are set as the "URL", "2 (seconds)" is set as the "lower range limit", and "3 (seconds)" is set as the "upper range limit".

In addition, in the information on the second line of the normal range information 132 shown in FIG. 14, "/user2/folder2/list" is set as the "URL", "0 (seconds)" is set as the "lower range limit", and "1 (seconds)" is set as the "upper range limit". Explanation of the other information included in FIG. 14 is omitted.

In other words, the normal range information 132 shown in FIG. 14 indicates that in the processing of S27, clustering was performed such that "/user1/folder1/download" and "/user1/folder1/upload" are included in the same cluster.

Returning to FIG. 9, the group division unit 114 determines, for example, whether the normal range set in the processing of S32 satisfies a predetermined condition (S33).

Specifically, the group division unit 114 determines that the normal range satisfies a predetermined condition if, for example, the upper limit of the response time included in the normal range is equal to or greater than a predetermined multiple of the lower limit.

As a result, if it is determined that the normal range set in the processing of S32 does not satisfy the predetermined condition (NO in S34), the information processing device 1 performs the processing from S31 onwards again.

On the other hand, if it is determined that the normal range set in the process of S32 satisfies the predetermined condition (YES in S34), the group division unit 114 divides, for example, the response times corresponding to each of the access targets included in the cluster identified in the process of S31 into multiple groups based on the related information of each access target (S35).

Next, the range setting unit 113 identifies, for example, one of the groups divided in the processing of S35 (S36).

Then, the range setting unit 113 sets, for example, a normal range for the response times included in the group identified in the processing of S36 (S37). Furthermore, the range setting unit 113 stores, for example, normal range information 132 indicating the set normal range in the information storage area 130.

Then, the range setting unit 113 determines, for example, whether all of the groups divided in the processing of S35 have been identified (S38).

As a result, if it is determined that not all of the groups divided in the process of S35 have been identified (NO in S38), the range setting unit 113 performs the processes from S36 onwards again. Below, a specific example of the processes from S33 to S38 will be described.

[Specific example of processing from S33 to S38]
Figures 15 to 17 are graphs for explaining a specific example of the processes from S33 to S38. The horizontal and vertical axes in the graphs shown in Figures 15 to 17 correspond to the generation time of the access log LG and the response time to the business system 2, respectively. Figures 15 to 17 show a distribution of points (triangular points) indicating the response time when URL 11c is accessed.

For example, as shown in FIG. 15, if the upper limit included in the normal range RB calculated for cluster CB is more than twice the lower limit, the group division unit 114 divides the response time corresponding to each of the access targets included in the cluster identified in the processing of S31 according to the size of the data transmitted and received in association with the access to each access target, as shown in FIG. 16, for example. Specifically, as shown in FIG. 16, the group division unit 114 divides the points indicating the response time when URL 11c is accessed into points (shaded points) where the data size transmitted and received in association with the access to each access target is equal to or greater than a threshold, and points (non-shaded points) where the data size transmitted and received in association with the access to each access target is less than the threshold.

Then, as shown in FIG. 17, the range setting unit 113 calculates, for example, a correct answer range RB1 for group CB1 consisting of points (shaded points) where the data size transmitted and received in association with access to each access target is equal to or greater than a threshold, and a correct answer range RB2 for group CB1 consisting of points (shaded points) where the data size transmitted and received in association with access to each access target is equal to or greater than a threshold.

This enables the range setting unit 113 to set a correct answer range that further improves the accuracy of anomaly detection.

The group division unit 114 may, for example, determine whether the set normal range satisfies a predetermined condition (i.e., the same process as S33) each time the normal range is set in the process of S37. Then, for example, if it is determined that the set normal range satisfies the predetermined condition in the process of S37, the range setting unit 113 and the group division unit 114 may, for example, perform the processes from S35 to S38 again.

Returning to FIG. 9, if it is determined that all of the groups divided in the processing of S35 have been identified (YES in S38), the range setting unit 113 determines, for example, whether all of the clusters have been identified in the processing of S31 (S39).

As a result, if it is determined in the processing of S31 that not all clusters have been identified (NO in S39), the range setting unit 113 performs the processing from S31 onwards again.

On the other hand, if it is determined in the processing of S31 that all clusters have been identified (YES in S39), the information processing device 1 ends the normal range setting processing.

[Specific example of normal range information (2)]
Next, a specific example of the normal range information 132 when the process of S35 is performed based on the data size transmitted and received in association with the access to each access target will be described. Fig. 18 is a diagram illustrating a specific example of the normal range information 132 when the process of S35 is performed based on the data size transmitted and received in association with the access to each access target.

The normal range information 132 shown in FIG. 18 includes the items of the normal range information 132 described in FIG. 14 as well as a "data size" item that sets the size of data transmitted and received between the user terminal 3 and the business system 2.

Specifically, in the information on the first line of the normal range information 132 shown in FIG. 18, "/user1/folder1/download" and "/user1/folder1/upload" are set as the "URL," "-" is set as the "data size" indicating that no information is set, "2 (seconds)" is set as the "lower range limit," and "3 (seconds)" is set as the "upper range limit."

In addition, in the information on the second line of the normal range information 132 shown in FIG. 18, "/user2/folder2/list" is set as the "URL," "-" is set as the "data size," "0 (seconds)" is set as the "lower range limit," and "1 (seconds)" is set as the "upper range limit."

In addition, in the information on the third line of the normal range information 132 shown in FIG. 18, the "URL" is set to "/user3/folder3/file3/search," the "data size" is set to "0 (MiB) to 128 (MiB)," the "lower range limit" is set to "10 (seconds)," and the "upper range limit" is set to "50 (seconds)."

Furthermore, in the information on the fourth line of the normal range information 132 shown in FIG. 18, the "URL" is set to "/user3/folder3/file3/download", the "data size" is set to "128 (MiB)~", the "lower range limit" is set to "5 (seconds)", and the "upper range limit" is set to "30 (seconds)".

In other words, the normal range information 132 shown in FIG. 18 indicates that the cluster with the "URL" of "/user3/folder3/file3/search" was split in the processing of S35.

In the process of S35, the group division unit 114 may divide, for example, the points indicating the response time when URL 11c is accessed for each user who accessed each access target. Below, a specific example of the normal range information 132 when the process of S35 is performed based on the user who accessed each access target will be described.

[Specific example of normal range information (3)]
FIG. 19 is a diagram illustrating a specific example of the normal range information 132 when the process of S35 is performed based on the user who has accessed each access target.

The normal range information 132 shown in FIG. 19 includes the items of the normal range information 132 described in FIG. 14 as well as a "user IP" item in which the IP address of the user who accessed the business system 2 is set.

Specifically, in the information on the first line of the normal range information 132 shown in FIG. 19, "URL" is set to "/user1/folder1/download" and "/user1/folder1/upload", "-" is set as the "User IP", "2 (seconds)" is set as the "Lower range limit", and "3 (seconds)" is set as the "Upper range limit".

In addition, in the information on the second line of the normal range information 132 shown in FIG. 19, "/user2/folder2/list" is set as the "URL," "-" is set as the "User IP," "0 (seconds)" is set as the "Lower range limit," and "1 (seconds)" is set as the "Upper range limit."

In addition, in the information on the third line of the normal range information 132 shown in FIG. 19, "/user3/folder3/file3/search" is set as the "URL", "192.168.1.xxx" is set as the "User IP", "10 (seconds)" is set as the "Lower Range Limit", and "30 (seconds)" is set as the "Upper Range Limit".

Furthermore, in the information on the fourth line of the normal range information 132 shown in FIG. 19, "/user3/folder3/file3/download" is set as the "URL," "192.168.2.xxx" is set as the "User IP," "20 (seconds)" is set as the "Lower Range Limit," and "50 (seconds)" is set as the "Upper Range Limit."

In other words, the normal range information 132 shown in FIG. 19 indicates that the cluster with the "URL" of "/user3/folder3/file3/search" was split in the processing of S35.

[Main processing of abnormality detection processing]
Next, the main process of the anomaly detection process will be described. Note that hereinafter, clusters that have not been divided in the process of S35 may also be referred to as groups.

As shown in FIG. 10, the abnormality detection unit 115 waits until the timing for detecting an abnormality comes (NO in S41). The timing for detecting an abnormality may be a regular timing such as at one-minute intervals.

When the timing for detecting an abnormality arrives (YES in S41), the abnormality detection unit 115 acquires, for example, the access log LG output within the target period (S42). The target period is, for example, the period after the previous timing for detecting an abnormality. In other words, the abnormality detection unit 115 acquires, for example, from the access logs LG stored in the storage device 2a, logs for which an abnormality has not yet been detected.

Next, the anomaly detection unit 115 identifies, for example, one of the groups divided in the processing of S35 (clusters clustered in the processing of S27) (S43).

Next, the anomaly detection unit 115 identifies, for example, from among the access logs LG (access logs LG acquired in the process of S42) corresponding to the access targets included in the group identified in the process of S43, logs whose response times are not within the normal range (S44).

Then, the anomaly detection unit 115 calculates, for example, the percentage of access logs LG corresponding to the access targets included in the group identified in the processing of S43, whose response times are not within the normal range (S45).

As a result, if the proportion of access logs LG whose response times are outside the normal range is equal to or greater than a predetermined threshold (YES in S46), the anomaly detection unit 115 determines that the response times corresponding to the access targets included in the group identified in the processing of S43 are abnormal (S47).

On the other hand, if the percentage of access logs LG whose response times are not within the normal range is not equal to or greater than the predetermined threshold (NO in S46), the anomaly detection unit 115 does not perform processing in S47.

Then, the anomaly detection unit 115 determines whether all groups have been identified in the processing of S43 (S48).

As a result, if it is determined in the processing of S43 that not all groups have been identified (NO in S48), the anomaly detection unit 115 performs the processing from S43 onwards again.

On the other hand, if it is determined in the process of S43 that all groups have been identified (YES in S48), the result output unit 116 outputs information indicating the access targets included in the group determined to be abnormal in the process of S47 to the administrator terminal (not shown) (S49).

In this manner, the information processing device 1 in this embodiment, for example, identifies a first transition status of the response time for a first access target included in the multiple access targets. Then, the information processing device 1 identifies a second access target, among the multiple access targets, whose transition status of the response time has a predetermined relationship with the first transition status.

Then, the information processing device 1 sets, for example, a normal range of the response time for the first access target and the second access target. Then, the information processing device 1 uses the set normal range to detect anomalies in the response time for the first access target and the second access target.

In other words, the response time for access to each access target may change due to, for example, an increase or decrease in the number of records to be searched, changes to software or hardware, etc. The response time for access to each access target may also change due to, for example, the occurrence of a failure. Therefore, for example, if there are multiple access targets that use the same resource in the same way, it can be determined that the response times for access to these access targets are likely to change in the same way at the same time.

In this embodiment, the information processing device 1 determines that, for example, if the transition status of the response time for access to the first access target and the transition status of the response time for access to the second access target are similar over a specified period in the past, there is a high possibility that the transition status of each response time is also similar at present. Therefore, in this case, the information processing device 1 combines the first access target and the second access target into a single access target and then sets the normal range.

As a result, the information processing device 1 in this embodiment can secure sufficient access logs to be used to set the normal range for an access target that is infrequently accessed by users, and can set a normal range that enables accurate anomaly detection. Therefore, the information processing device 1 can improve the accuracy of anomaly detection determination.

The above embodiments can be summarized as follows:

(Appendix 1)
identifying a first transition status of the response time of the first access target when it is determined that the number of pieces of response time information for determining a normal range used in detecting an anomaly in the response time of the first access target is less than a predetermined value;
Identifying a second access target whose response time transition status is similar to the first transition status;
setting a normal range based on the first transition status and the transition status corresponding to the second access target;
when a new access occurs to the first access target, detecting an anomaly in a response time of the new access by using the normal range;
An anomaly detection method, characterized in that processing is executed by a computer.

(Appendix 2)
In Appendix 1,
In the process of identifying the first transition state, a first feature amount indicating a transition of a response time of an access to the first access target is identified for each unit period included in a first period;
In the process of identifying the second access target,
calculating another feature amount indicating a transition of a response time of an access to another access target included in the plurality of access targets for each unit period included in the first period;
When the first feature amount for the unit period and the other feature amount for the unit period are similar to each other, the other access target is identified as the second access target.
The anomaly detection method according to the present invention is characterized in that

(Appendix 3)
In Appendix 1,
In the process of setting the normal range, the normal range is set by using a response time corresponding to a period after a predetermined timing included in the first period, among response times of access to either the first access target or the second access target.
The anomaly detection method according to the present invention is characterized in that

(Appendix 4)
In Appendix 1, further:
When the size of the set normal range satisfies a predetermined condition, each of the response times of access to either the first access target or the second access target is divided into a plurality of groups using information related to each of the first access target and the second access target;
and performing the process of setting the normal range again for each of the divided groups.
An anomaly detection method comprising the steps of: causing a computer to execute a process.

(Appendix 5)
In Appendix 4:
In the process of dividing the groups, each of the response times of access to either the first access target or the second access target is divided according to the size of data transmitted and received in association with the access to each of the first access target and the second access target.
The anomaly detection method according to the present invention is characterized in that

(Appendix 6)
In Appendix 5:
In the process of dividing the plurality of groups, each of the response times of access to either the first access target or the second access target is divided for each user who has accessed the first access target and the second access target.
The anomaly detection method according to the present invention is characterized in that

(Appendix 7)
identifying a first transition status of the response time of the first access target when it is determined that the number of pieces of response time information for determining a normal range used in detecting an anomaly in the response time of the first access target is less than a predetermined value;
Identifying a second access target whose response time transition status is similar to the first transition status;
setting a normal range based on the first transition status and the transition status corresponding to the second access target;
when a new access occurs to the first access target, detecting an anomaly in a response time of the new access by using the normal range;
An anomaly detection program characterized in that processing is executed by a computer.

(Appendix 8)
In Appendix 7:
In the process of identifying the first transition state, a first feature amount indicating a transition of a response time of an access to the first access target is identified for each unit period included in a first period;
In the process of identifying the second access target,
calculating another feature amount indicating a transition of a response time of an access to another access target included in the plurality of access targets for each unit period included in the first period;
When the first feature amount for the unit period and the other feature amount for the unit period are similar to each other, the other access target is identified as the second access target.
The anomaly detection program according to the present invention.

1: Information processing device 2: Business system 2a: Storage device 3a: User terminal 3b: User terminal 3c: User terminal 10: Information processing system LG: Access log

Claims (7)

identifying a first transition status of the response time of the first access target when it is determined that the number of pieces of response time information for determining a normal range used in detecting an anomaly in the response time of the first access target is less than a predetermined value;
Identifying a second access target whose response time transition status is similar to the first transition status;
setting a normal range based on the first transition status and the transition status corresponding to the second access target;
when a new access occurs to the first access target, detecting an anomaly in a response time of the new access by using the normal range;
An anomaly detection method, characterized in that processing is executed by a computer. In claim 1,
In the process of identifying the first transition state, a first feature amount indicating a transition of a response time of an access to the first access target is identified for each unit period included in a first period;
In the process of identifying the second access target,
calculating another feature amount indicating a transition of a response time of an access to another access target included in the plurality of access targets for each unit period included in the first period;
When the first feature amount for the unit period and the other feature amount for the unit period are similar to each other, the other access target is identified as the second access target.
The anomaly detection method according to the present invention is characterized in that In claim 1,
In the process of setting the normal range, the normal range is set by using a response time corresponding to a period after a predetermined timing included in the first period, among response times of access to either the first access target or the second access target.
The anomaly detection method according to the present invention is characterized in that In claim 1, further comprising:
When the size of the set normal range satisfies a predetermined condition, each of the response times of access to either the first access target or the second access target is divided into a plurality of groups using information related to each of the first access target and the second access target;
and performing the process of setting the normal range again for each of the divided groups.
An anomaly detection method comprising the steps of: causing a computer to execute a process. In claim 4,
In the process of dividing the groups, each of the response times of access to either the first access target or the second access target is divided according to the size of data transmitted and received in association with the access to each of the first access target and the second access target.
The anomaly detection method according to the present invention is characterized in that In claim 5,
In the process of dividing the plurality of groups, each of the response times of access to either the first access target or the second access target is divided for each user who has accessed the first access target and the second access target.
The anomaly detection method according to the present invention is characterized in that identifying a first transition status of the response time of the first access target when it is determined that the number of pieces of response time information for determining a normal range used in detecting an anomaly in the response time of the first access target is less than a predetermined value;
Identifying a second access target whose response time transition status is similar to the first transition status;
setting a normal range based on the first transition status and the transition status corresponding to the second access target;
when a new access occurs to the first access target, detecting an anomaly in a response time of the new access by using the normal range;
An anomaly detection program characterized in that processing is executed by a computer.

Images