Patent ID: 12206689

DESCRIPTION OF EMBODIMENT

Hereinafter, an embodiment for implementing the present invention will be described with reference to the accompanying drawings. The present invention is not limited to the present embodiment.

[Configuration and Overview]

First, a configuration example of a system including an anomaly detection device of the present embodiment will be described usingFIG.1. As shown, for example, inFIG.1, the system is provided with a communication apparatus10, a gateway device20and an anomaly detection device30. The communication apparatus10and the gateway device20are connected together via a LAN (local area network) or the like. The gateway device20and the anomaly detection device30are connected together via a network such as the Internet.

The communication apparatus10is a communication apparatus, which is a target of anomaly detection in the present system. The communication apparatus10is, for example, a PC. The gateway device20is a device that connects the communication apparatus10to an external device via a network such as the Internet or to another communication apparatus10within the same LAN. The gateway device20acquires information indicating a behavior of the communication apparatus10. Information indicating a behavior of the communication apparatus10includes information on network flows transmitted/received by the respective communication apparatuses10, communication feature values of the network flows and operation logs of the respective communication apparatuses10or the like.

Note that examples of information on a network flow (network flow information) include a source IP (internet protocol) address of the network flow, a source MAC (media access control) address, a destination IP address, a destination MAC address, a communication port number, the number of reception packets, the number of transmission packets, a communication payload. Examples of the communication feature value include a source IP address of the network flow, a source MAC address, a destination IP address, a destination MAC address, an average value of the total number of reception packets, a variance of the total number of transmission packets. Examples of the operation log include an ID of a process executed by the communication apparatus10, a start time at which the process is executed.

The anomaly detection device30learns information indicating a behavior of each communication apparatus10in a normal state acquired from the gateway device20. Thus, the anomaly detection device30detects abnormalities such as unauthorized access to each communication apparatus10or viral infection. The anomaly detection device30generates an anomaly detection type detection model using network flow information of each communication apparatus10in a normal state, a communication feature value of the network flow, an operation log of each communication apparatus or the like (which are collectively called “communication log”) as learning data. The anomaly detection device30performs anomaly detection type anomaly detection using the generated detection model and the network flow information, the communication feature value, the operation log and the like of the communication apparatus10, which is a detection target.

Here, the anomaly detection device30follows changes in a normal state caused by setting changes or the like of each communication apparatus10. Therefore, the anomaly detection device30relearns communication logs of each communication apparatus10in the normal state and updates the detection model using the relearning result.

For example, the anomaly detection device30acquires a communication log (learning data set B) of each communication apparatus10generated after a communication log (learning data set A) used to generate the current detection model A. Here, when the difference information between the acquired learning data set B and the learning data set A satisfies predetermined evaluation criteria, the anomaly detection device30performs relearning using the learning data set B. In this way, the anomaly detection device30can relearn the behavior of the communication apparatus10in the normal state at appropriate timing even in an environment that cannot afford additional computation cost.

[Anomaly Detection Device]

The anomaly detection device30will continue to be described in detail usingFIG.1. The anomaly detection device30is provided with a learning unit31, an anomaly detection unit32and a relearning execution determination unit33.

The learning unit31generates a detection model to detect anomaly of the communication apparatus10using a communication log of the communication apparatus10in a normal state as learning data. For example, when the learning unit31acquires a communication log of each communication apparatus10in a normal state from the gateway device20, the learning unit31generates a detection model to detect anomaly of each communication apparatus10using the communication log as learning data.

When the learning using learning data is completed and the detection model is generated, the learning unit31causes the anomaly detection unit32to start anomaly detection (analysis for anomaly detection) using the detection model. The learning unit31saves the following three items in the relearning execution determination unit33. The first one is identification information of the communication apparatus10used for the learning, the second one is the communication log (learning data set A) and the third one is the detection model (detection model A) generated by learning of the communication log.

The anomaly detection unit32performs anomaly detection type anomaly detection on the communication apparatus10using the detection model generated by the learning unit31and the communication log of the communication apparatus10. For example, when the anomaly detection unit32acquires the communication log of the communication apparatus10, which is the detection target, from the gateway device20, the anomaly detection unit32performs anomaly detection of the communication apparatus10using the detection model generated by the learning unit31.

The relearning execution determination unit33determines whether or not the learning unit31should execute relearning of the communication log. The relearning execution determination unit33is provided with a data acquisition unit330, an additional information identification unit331, a difference information identification unit332, a deletion information identification unit333and a determination unit334.

Every predetermined period or when an instruction is inputted from an administrator of the anomaly detection device30, the data acquisition unit330acquires a communication log (second communication log) for a predetermined period from the point in time about the predetermined communication apparatus10from the gateway device20.

The additional information identification unit331identifies the communication log of the second communication log acquired by the data acquisition unit330in which anomaly is detected by the detection model (detection model A) currently used in the anomaly detection unit32as additional information.

The difference information identification unit332compares the communication log (learning data set A) used to generate the detection model A with the second communication log (learning data set B) acquired by the data acquisition unit330and determines the presence or absence of the difference information.

For example, when the learning data sets A and B to be compared are the network flow information or communication feature values of the communication apparatus10, the difference information identification unit332compares 5-tuple information (source/destination IP address, source/destination MAC address and communication port number) of the learning data sets A and B. For example, when the learning data sets A and B are operation logs of the communication apparatus10, the difference information identification unit332compares the IP address, MAC address and communication port of the destination communication apparatus of the communication apparatus10.

The deletion information identification unit333identifies deletion information obtained by removing the additional information from the difference information between the first communication log (learning data set A) and the second communication log (learning data set B).

The additional information and the deletion information will be described in detail with reference toFIG.2.

For example, as shown inFIG.2, a case will be assumed where the learning data set A (network flow information A-1, A-2, A-3, . . . ) used to generate the pre-update detection model (detection model A) and the latest learning data set (learning data set B, network flow information B-1, B-2, B-3, . . . ) are given. Each piece of network flow information may include not only the 5-tuple information but also non-5-tuple information (e.g., the number of reception packets, the number of transmission packets, payload) as shown inFIG.2.

In such a case, the additional information identification unit331checks the presence or absence of anomaly detection in the learning data set B using the pre-update detection model (detection model A), and can thereby not only know the presence or absence of an additional flow (additional information) in the learning data set B but also identify the additional flow (additional information) ((1)).

That is, the fact that anomaly has been detected in the learning data set B using the detection model A means that the learning data set B includes a communication log (communication log of the additional flow) with the communication destination, which is not found in the learning data set A. Thus, if there is a communication log of the learning data set B in which anomaly is detected using the detection model A, the difference information identification unit332identifies the communication log as additional information.

Next, the difference information identification unit332checks a difference (difference information) between both data sets using 5-tuple information of the learning data set A and the learning data set B, and if difference information is found, the deletion information identification unit333removes the additional flow (additional information) from the difference information. This allows the deletion information identification unit333not only to know the presence or absence of a deletion flow (deletion information) but also to identify the deletion flow (deletion information) ((2)).

That is, the fact that although there is a difference (difference information) between the learning data set A and the learning data set B, there is information (communication log) other than the additional flow (additional information) means that there is a communication destination not included in the learning data set B among the communication destinations included in the learning data set A. That is, it means that there is a deletion flow. Therefore, if information (communication log) other than the additional information is found in the difference information between the learning data set A and the learning data set B, the deletion information identification unit333identifies the communication log as the deletion information.

Returning toFIG.1, the determination unit334will be described. When there is difference information between the first communication log (learning data set A) and the second communication log (learning data set B), the determination unit334instructs the learning unit31to generate (to relearn) an anomaly detection model using the second communication log (learning data set B) as the learning data.

For example, when there is difference information between the first communication log (learning data set A) and the second communication log (learning data set B), if the number of pieces of additional information or the number of pieces of deletion information included in the difference information satisfies predetermined evaluation criteria, the determination unit334instructs the learning unit31to execute relearning using the second communication log (learning data set B) as the learning data.

For example, (1) when the number of pieces of additional information exceeds a predetermined threshold, (2) when the number of pieces of deletion information exceeds a predetermined threshold, or (3) when the total number of pieces of additional information and deletion information exceeds a predetermined threshold, the determination unit334instructs the learning unit31to execute relearning.

Note that the thresholds used in (1) to (3) may be determined by the user of the anomaly detection device30or may be determined by the anomaly detection device30based on past statistical values or the like.

When there is difference information between the first communication log (learning data set A) and the second communication log (learning data set B), if evaluation criteria described by any one of (1) to (3) or a combination of (1) to (3) is satisfied, the determination unit334may instruct the learning unit31to execute relearning. Note that the user of the anomaly detection device30can set as appropriate what evaluation criteria should be used by the determination unit334in making a determination.

When the relearning by the learning unit31is completed and a new detection model (detection model B) is generated, the learning unit31causes the anomaly detection unit32to start anomaly detection (analysis for anomaly detection) using the detection model B. The learning unit31overwrites and saves the identification information of the communication apparatus10used for relearning, the communication log (learning data set B) and the detection model (detection model B) generated by learning the communication log into the relearning execution determination unit33.

Note that a relationship between the pre-update learning data set (learning data set A) and the latest learning data set (learning data set B) can be assumed to be patterns 1 to 4 shown inFIG.3. That is, it is possible to assume a case where all the latest learning data set is included in the pre-update learning data set as in pattern 1, a case where part of the pre-update learning data set is included in part of the latest learning data set as in pattern 2, a case where all the pre-update learning data set is included in the latest learning data set as in pattern 3 and a case where the pre-update learning data set is completely different from the latest learning data set as in pattern 4.

Note that hatched areas in patterns 1 to 4 inFIG.3represent difference information between the pre-update learning data set and the latest learning data set in the respective patterns. In the case of pattern 1, the difference information does not include additional information but does include deletion information. In the cases of patterns 2 and 4, the difference information includes both additional information and deletion information. In the cases of pattern 3, the difference information includes additional information, but does not include deletion information. Thus, in the case of pattern 1, the learning unit31can generate a detection model with few overlooked abnormalities by learning the latest learning data set. In the cases of patterns 2 and 4, the learning unit31can generate a detection model with few overlooked abnormalities and few erroneous detections by learning the latest learning data set. In the case of pattern 3, the learning unit31can generate a detection model with few erroneous detections by learning the latest learning data set.

In the anomaly detection device30, the determination unit334makes a determination whether or not to execute relearning according to evaluation criteria using additional information or deletion information (or combination of these pieces of information). This allows the anomaly detection device30to instruct the learning unit31to execute relearning at appropriate timing in any one of the above patterns.

The above examples are given below. (1) When the number of pieces of additional information exceeds a predetermined value, the determination unit334instructs the learning unit31to perform relearning, and can thereby realize relearning using the latest learning data set in pattern 2, 3 or 4. As a result, the learning unit31can generate a detection model with few erroneous detections. (2) When the number of pieces of deletion information exceeds a predetermined value, the determination unit334instructs the learning unit31to perform relearning, and can thereby realize relearning using the latest learning data set in pattern 1, 2 or 4. As a result, the learning unit31can generate a detection model with few overlooked abnormalities. (3) When the total number of pieces of additional information and deletion information exceeds a predetermined value, the determination unit334instructs the learning unit31to perform relearning, and can thereby realize relearning using the latest learning data set in pattern 2 or 4. As a result, the learning unit31can generate a detection model with few erroneous detections and few overlooked abnormalities.

[Processing Procedure]

Next, a processing procedure of the anomaly detection device30will be described usingFIG.4. The processing of the anomaly detection device30can be divided into the following two phases. The first phase is an initial learning phase of generating an initial detection model and the second phase is an operation phase of updating a detection model by relearning. Description will start with the initial learning phase.

(Initial Learning Phase)

First, the learning unit31learns normal operation (learning data set A) of the communication apparatus10and generates a detection model A (S1). The learning unit31then saves the learning data set A and the detection model A in the relearning execution determination unit33(S2). The learning unit31causes the anomaly detection unit32to start analysis operation of anomaly detection using the detection model (S3).

(Operation Phase)

Next, an operation phase will be described. After S3, the data acquisition unit330acquires a communication log (learning data set B) after learning data set A (S11). After that, the additional information identification unit331checks the presence or absence of additional information using the detection model A and the learning data set B (S12). That is, the additional information identification unit331checks whether or not the learning data set B includes a communication log in which anomaly is detected using the detection model A. If the communication log is found, the additional information identification unit331identifies the communication log as additional information. After that, the deletion information identification unit333checks the presence or absence of deletion information using the learning data set A, the learning data set B and the additional information (S13). That is, first, the difference information identification unit332checks the presence or absence of a difference between the learning data set A and the learning data set B. If there is a difference, the deletion information identification unit332identifies a communication log of the difference as difference information. The deletion information identification unit333checks whether or not the difference information includes a communication log other than the additional information identified in S12. If the communication log is found, the deletion information identification unit333identifies the communication log as deletion information.

After S13, when there is additional information or deletion information (that is, there is difference information) (Yes in S14), and the number of pieces of additional information or the number of pieces of deletion information satisfies predetermined evaluation criteria (e.g., (1) to (3) described above) (Yes in S15), the determination unit334instructs the learning unit31to relearn the normal operation and generate the detection model B (S16). That is, the determination unit334instructs the learning unit31to learn the learning data set B and generate the detection model B. In this way, the learning unit31generates the detection model B. After that, the learning unit31overwrite the learning data set A of the relearning execution determination unit33with the learning data set B and overwrites the detection model A with the detection model B (S17). The learning unit31causes the anomaly detection unit32to start analysis operation of anomaly detection using the detection model (detection model B) overwritten in S17(S18). After that, the process of the anomaly detection device30returns to S11.

Note that when the determination unit334determines that there is neither additional information nor deletion information (that is, there is no difference information) (No in S14), the process of the anomaly detection device30returns to S11. When the determination unit334determines that the number of pieces of additional information or the number of pieces of deletion information does not satisfy predetermined evaluation criteria (e.g., (1) to (3) described above) (No in S15), the process of the anomaly detection device30also returns to S11.

Thus, the anomaly detection device30determines whether or not to execute relearning based on the evaluation criteria using the number of pieces of additional information or the number of pieces of deletion information in the learning data set. That is, the anomaly detection device30determines whether or not to execute relearning based on the number of additional flows or the number of deletion flows after generating the current detection model. As a result, the anomaly detection device30can execute relearning at appropriate timing.

Note that although it has been assumed that the anomaly detection device30determines whether or not to execute relearning based on the evaluation criteria using the number of pieces of additional information or the number of pieces of deletion information in the learning data set, the present invention is not limited to this. For example, the anomaly detection device30may determine to execute relearning when there is difference information regardless of the presence or absence of additional information or deletion information in the learning data set.

[Program]

The functions of the anomaly detection device30described in the above embodiment can be implemented by installing a program for implementing such functions in a desired information processing device (computer). For example, by causing an information processing device to execute the above program provided as package software or on-line software, it is possible to cause the information processing device to function as the anomaly detection device30. Examples of the information processing device referred to here include a desktop type or notebook type personal computer. In addition, the category of the information processing device includes mobile communication terminals such as smartphones, mobile phone sets, and PHS (personal handyphone system) or PDA (personal digital assistant). Moreover, the anomaly detection device30may be implemented on a cloud server.

An example of the computer that executes the above program (management program) will be described usingFIG.5. As shown inFIG.5, a computer1000includes, for example, a memory1010, a CPU1020, a hard disk drive interface1030, a disk drive interface1040, a serial port interface1050, a video adapter1060and a network interface1070. These components are connected by a bus1080.

The memory1010includes a ROM (read only memory)1011and a RAM (random access memory)1012. The ROM1011stores, for example, a boot program such as BIOS (basic input output system). The hard disk drive interface1030is connected to a hard disk drive1090. The disk drive interface1040is connected to a disk drive1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive1100. For example, a mouse1110and a keyboard1120are connected to the serial port interface1050. For example, a display1130is connected to the video adapter1060.

Here, as shown inFIG.5, the hard disk drive1090stores, for example, an OS1091, an application program1092, a program module1093and program data1094. Various kinds of data and information described in the above embodiment are stored, for example, in the hard disk drive1090and the memory1010.

The CPU1020reads the program module1093and the program data1094stored in the hard disk drive1090into the RAM1012as needed and executes the respective aforementioned procedures.

Note that program module1093and the program data1094associated with the above management program are not only stored in the hard disk drive1090, but those programs may be stored in a removable storage medium and may be read by the CPU1020via the disk drive1100or the like. Alternatively, the program module1093and the program data1094associated with the above program may be stored in other computers connected via a network such as a LAN (local area network) or a WAN (wide area network) and read by the CPU1020via the network interface1070.

REFERENCE SIGNS LIST

10communication apparatus20gateway device30anomaly detection device31learning unit32anomaly detection unit33relearning execution determination unit330data acquisition unit331additional information identification unit332difference information identification unit333deletion information identification unit334determination unit