JP2017199250A - Computer system, data analysis method, and computer - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the reduction and the analysis accuracy of a computer resource quantity that is used in a system having a plurality of analyzers.SOLUTION: In a computer system having a plurality of computers, the plurality of computers each include: a computer having an analysis control part including a plurality of analysis parts for executing analysis processing; a feature amount calculating part for calculating a feature amount used by the analysis parts; and a computer having a sorting part for selecting an analysis part to be used. The sorting part manages sorting information including a plurality of entries including a feature amount, a kind of the analysis processing, and a result of the analysis processing, retrieves the entry including the feature amount similar to the calculated feature amount from the data by referring to the sorting information, selects the analysis processing to be executed on the basis of the result of the analysis processing included in the retrieved entry, and adds the feature amount calculated from the data, the kind of the analysis processing, and the result of the analysis processing to the sorting information when the result of the analysis processing is received.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a system management method including a plurality of analyzers that execute analysis processing using data transmitted and received via a network.

  In recent years, a solution that collects a large amount of information called big data and uses the collected large amount of information is expected. One of the solutions using such a large amount of information is network operation management.

  In network operation management technology using big data, information flowing through a network device is analyzed at a packet level. This technique is used in fields such as an intrusion detection system (IDS).

  The IDS includes a signature type IDS and an anomaly type IDS. The signature type IDS detects unauthorized access by determining whether or not the passing information matches the registered pattern. On the other hand, the anomaly type IDS detects unknown unauthorized access that is not registered in the pattern by analyzing passing information. More specifically, the anomaly type IDS generates a learning model based on machine learning using normal traffic, and compares whether the information is passed with the learning model to determine whether the traffic is normal traffic. judge.

  The above-described analysis based on machine learning is expected not only to detect unauthorized access but also to be applied in various fields such as guaranteeing the operation quality of each device and device management in a system in which multiple devices are distributed. ing.

  Anomaly-type IDS has a problem that the detection rate is low and the false detection rate is high. As a method for solving the above-described problem, a method of improving detection accuracy (analysis accuracy) by using a specialized analyzer for each type of unauthorized access is conceivable. As another solution, an ensemble learning method that constitutes one analyzer with high performance by integrating a plurality of analyzers is conceivable (for example, see Patent Document 1).

  Patent Document 1 states that “abnormalities caused by unauthorized access are classified into multiple groups defined as three types of traffic volume, communication range abnormality, communication procedure abnormality, and transmission / reception data abnormality. Configures a system equipped with a detection module that uses specialized features to detect unauthorized access, and uses feature features specialized for detection of time slot type, flow count type, and flow payload type groups. The system detects the unauthorized access by alerting an alert when any of the detection modules is determined to be abnormal. To do ".

  However, the method described in Patent Document 1 has a problem that the processing load becomes large and the processing time becomes long because a plurality of analyzers operate in parallel. Therefore, the method described in Patent Document 1 degrades the system performance. Therefore, there is a need for a technique for improving the accuracy of analysis and reducing the amount of computer resources used for analysis processing.

  As a method of reducing the amount of computer resources used for analysis processing, a technique described in Patent Document 2 is known. Patent Document 2 states that “the gateway device includes an operation information acquisition unit that acquires operation information of one or more devices on the first network and transmits the operation information to the analysis device. A failure analysis unit that performs a failure analysis of the operation information, and the operation information acquisition unit narrows down the highly important pieces of the acquired operation information according to a predetermined importance and transmits them to the analysis apparatus 300. Have been described.

JP 2006-115129 A JP 2013-34243 A

  Since the technique of Patent Document 2 needs to define a rule in advance, it is necessary for all analyzers to analyze unknown information as in the conventional case. Therefore, the amount of computer resources used for analysis processing cannot be reduced.

  An object of the present invention is to improve analysis accuracy and reduce the amount of computer resources used for analysis processing in a system that performs analysis based on a plurality of machine learnings.

  A typical example of the invention disclosed in the present application is as follows. That is, a computer system including a plurality of computers, each of the plurality of computers has a processor, a memory connected to the processor, an interface connected to the processor and connected to another device, The plurality of computers are used by a computer having an analysis control unit including a plurality of analysis units that execute analysis processing using data transmitted and received via a network, and each of the plurality of analysis units using the data. A feature amount calculating unit that calculates a feature amount, and a computer having a distribution unit that selects the analysis unit to be used, and the distribution unit includes the feature amount used by each of the plurality of analysis units, The distribution information including a plurality of entries including the type of the analysis process and the result of the analysis process is managed, and the result of the analysis process indicates whether the analysis process is necessary or not. The distribution unit refers to the distribution information, searches for a similar entry including a feature amount similar to the feature amount calculated from the data, and results of the analysis process included in the similar entry The analysis unit to be executed is selected based on the analysis unit, and the analysis unit that executes the analysis process selected by the allocating unit executes the analysis process using the feature amount calculated from the data, and the analysis The processing result is transmitted to the allocating unit, and when the allocating unit receives the result of the analysis process, the characteristic amount calculated from the data, the type of the analysis process, and the result of the analysis process are transmitted. An entry including the information is added to the distribution information.

  According to the present invention, since an analysis unit is selected based on distribution information, the amount of computer resources used for analysis processing can be reduced. Also, the analysis accuracy can be improved by reflecting the analysis result of the analysis unit in the distribution information. Problems, configurations, and effects other than those described above will become apparent from the following description of embodiments.

1 is a diagram illustrating a configuration example of a computer system according to a first embodiment. FIG. 3 is a diagram illustrating details of a software configuration of the analysis apparatus according to the first embodiment. It is a figure which shows an example of the distribution information contained in the distribution information group of Example 1. It is a flowchart explaining the process which the distribution part of Example 1 performs. FIG. 5 is a diagram illustrating an example of a feature amount space according to the first embodiment. It is a figure which shows the structural example of the computer system of Example 2. FIG.

  Embodiments of the present invention will be described below with reference to the drawings. In addition, the Example described below is only an example, and the Example to which the present invention is applied is not limited to the following Example. Furthermore, the embodiments shown below may be applied singly or in combination of a plurality or all of the embodiments.

  FIG. 1 is a diagram illustrating a configuration example of a computer system according to the first embodiment.

  The computer system includes a data center 100 and a plurality of terminals 101. The data center 100 and the plurality of terminals 101 are connected via an external NW 105.

  The data center 100 includes an NW device 102, a computer 103, and an analysis device 104. Two or more devices may exist. The computer 103 and the analysis device 104 are connected to the NW device 102.

  The NW device 102 is a device that connects an external device and an internal device via a network. Examples of the NW device 102 include a switch, a router, and a gateway. The NW device 102 mirrors data transmitted / received between the terminal 101 and the computer 103, and transmits the mirrored data to the analysis device 104.

  The computer 103 executes various processes based on processing requests from the terminal 101. For example, the computer 103 provides a service to the terminal 101 as a Web server, a database server, or the like. The present embodiment is not limited to the configuration of the computer 103, the type of service provided by the computer 103, and the like.

  The analysis device 104 acquires data (packets) passing through the NW device 102 or a log of the data from the NW device 102 and analyzes the data to extract data, destroy data, tamper data, and the computer 103. Detect unauthorized access for the purpose of malfunction. In the following description, data passing through the NW device 102 or a log of the data is also referred to as observation data.

  As unauthorized access, DoS (Denial of Service) attack, U2R (User to Root) attack, R2L (Remote to Local) attack, Probe attack, and the like are known.

  A DoS attack is an attack that renders a system that has received data inoperable by transmitting a large amount of data or abnormal data. The U2R attack and the R2L attack are attacks that illegally enter a system by transmitting abnormal data. The Probe attack is an attack for investigating system services and protocols.

  The analysis device 104 includes a CPU 110, a memory 111, a storage device 112, and an I / F 113 as hardware. Each component is connected to each other via an internal bus or the like. It is assumed that the hardware of the terminal 101, the NW device 102, and the computer 103 is the same as that of the analysis device 104.

  CPU 110 executes a program stored in memory 111. The functions of the analysis apparatus 104 can be realized by the CPU 110 executing the program. In the following description, when a process is described with a functional unit as a subject, it indicates that the CPU 110 is executing a program that realizes the functional unit.

  The memory 111 stores a program executed by the CPU 110. Further, the memory 111 includes a work area used by the program for processing. The program stored in the memory 111 will be described later.

  The storage device 112 stores information permanently. The storage device 112 may be an HDD (Hard Disk Drive), an SSD (Solid State Drive), or the like. The storage device 112 is used as a storage unit 130 that stores various types of information. Information stored in the storage device 112 will be described later.

  The I / F 113 is an interface for connecting to other devices. For example, the I / F 113 may be a network interface.

  A program stored in the memory 111 will be described. The memory 111 stores a program for realizing the feature amount calculation unit 120, the distribution unit 121, and the analysis control unit 122.

  The feature amount calculation unit 120 calculates various feature amounts used for the analysis processing using the observation data.

  The analysis control unit 122 executes a plurality of analysis processes. The analysis control unit 122 according to the present embodiment includes an analysis unit (analyzer) for detecting each of a DoS attack, a U2R attack, an R2L attack, and a Probe attack. Each analysis unit executes an analysis process for detecting each attack.

  The feature amount used by each analysis unit for analysis processing may be different. In the present embodiment, the following feature amounts are used.

  The U2R attack analysis unit 201 (see FIG. 2) and the R2L attack analysis unit 202 (see FIG. 2) execute an analysis process using a feature amount calculated from one packet. This is because the U2R attack and the R2L attack are caused by abnormal data included in the packet.

  The DoS attack analysis unit 200 (see FIG. 2) executes an analysis process using a feature amount calculated from a flow in which a plurality of packets are aggregated. This is because the DoS attack is caused by an abnormality in the communication amount and communication range.

  The probe attack analysis unit 203 (see FIG. 2) executes an analysis process using the feature amount calculated from the flow or the feature amount calculated from a plurality of packets acquired in a certain period. This is because the Probe attack may be caused by an abnormality in the communication amount and the communication range, or may be caused by an abnormality in the communication procedure.

  “IPsweep”, which is one of the probe attacks, is an attack that pings an unspecified IP address and identifies an operating system. In order to detect “IPsweep”, for example, the number of packets transmitted from the same transmission source may be used as the feature amount.

  There may be one or more types of feature quantities used by the analysis unit for the analysis processing. The present invention is not limited to the feature amount used for the analysis process.

  The allocating unit 121 selects an analysis unit that instructs execution of the analysis processing based on the various feature amounts calculated by the feature amount calculation unit 120.

  Information stored in the storage unit 130 realized by the storage device 112 will be described. The storage unit 130 stores log information 140, a feature amount information group 141, a distribution information group 142, and a learning data group 143. Information stored in the storage unit 130 may be stored in the memory 111.

  The log information 140 is information for managing observation data acquired from the NW device 102 as a log. The log information 140 includes a plurality of entries including a time stamp, a source IP address, a packet size, and the like.

  The feature quantity information group 141 is information for managing the feature quantities used by each analysis unit. The distribution information group 142 is information for selecting an analysis unit. The learning data group 143 is information for managing learning data used by each analysis unit for machine learning.

  FIG. 2 is a diagram illustrating details of the software configuration of the analysis apparatus 104 according to the first embodiment. In addition, the line which connects each function part shows a logical connection relationship.

  First, details of the analysis control unit 122, the feature amount information group 141, the distribution information group 142, and the learning data group 143 will be described.

  The analysis control unit 122 includes a DoS attack analysis unit 200, a U2R attack analysis unit 201, an R2L attack analysis unit 202, and a Probe attack analysis unit 203. Each analysis unit refers to the feature quantity information group 141 and executes an analysis process related to the received observation data.

  The feature amount information group 141 includes packet feature amount information 210, flow feature amount information 211, and periodic feature amount information 212.

  The packet feature amount information 210 is information for managing a feature amount in units of packets. The flow feature amount information 211 is information for managing a feature amount in units of flows. Periodic feature amount information 212 is information for managing feature amounts calculated using observation data in an arbitrary time range.

  The distribution information group 142 includes packet distribution information 220, flow distribution information 221, and period distribution information 222.

  The packet distribution information 220 is information for selecting an analysis unit based on a feature amount in units of packets. The flow distribution information 221 is information for selecting an analysis unit based on a flow-unit feature amount. The periodic distribution information 222 is information for selecting an analysis unit based on a feature amount calculated using observation data in an arbitrary time range.

  Since there are a plurality of combinations of feature amounts used for analysis, there are a plurality of packet distribution information 220, flow distribution information 221, and period distribution information 222.

  The learning data group 143 includes DoS attack analysis learning data 230, U2R attack analysis learning data 231, R2L attack analysis learning data 232, and Probe attack analysis learning data 233. Each learning data includes data including a characteristic amount of normal communication.

  The DoS attack analysis learning data 230 is learning data used by the DoS attack analysis unit 200. The U2R attack analysis learning data 231 is learning data used by the U2R attack analysis unit 201. The R2L attack analysis learning data 232 is learning data used by the R2L attack analysis unit 202. The probe attack analysis learning data 233 is learning data used by the probe attack analysis unit 203.

  Next, the processing flow of the analyzer 104 will be described.

  The analysis unit included in the analysis control unit 122 performs machine learning using the learning data stored in the learning data group 143. The machine learning may be executed periodically, or may be executed when an instruction from the user is received.

  The feature amount calculation unit 120 stores the observation data received from the NW device 102 in the log information 140 and calculates various feature amounts using the log information 140. For example, the feature amount calculation unit 120 calculates a feature amount in units of packets, a feature amount in units of flows, and a feature amount of observation data in an arbitrary time range.

  The feature amount calculation unit 120 stores the calculated feature amount in the feature amount information group 141, and then instructs the distribution unit 121 to start processing.

  Based on the feature amount information group 141 and the distribution information group 142, the distribution unit 121 determines whether or not the feature amount indicates an abnormality. When it is determined that the feature amount indicates an abnormality, the distribution unit 121 selects an analysis unit that executes an analysis process related to the received observation data based on the feature amount information group 141 and the distribution information group 142 To do.

  The distribution unit 121 instructs the analysis control unit 122 to execute the selected analysis unit. Specifically, the distribution unit 121 calls an analysis function corresponding to the selected analysis unit, and inputs the calculated feature amount as an argument to the analysis control unit 122.

  Details of processing executed by the allocating unit 121 will be described with reference to FIG.

  The analysis control unit 122 instructs the analysis unit corresponding to the called analysis function to execute the analysis process. The analysis unit executes analysis processing for detecting unauthorized access based on the feature amount input as an argument. The analysis control unit 122 outputs the result of the analysis process executed by the analysis unit to the distribution unit 121.

  The distribution unit 121 updates the distribution information group 142 based on the result of the analysis process.

  As described above, the distribution unit 121 selects an analysis unit that performs an analysis process based on the feature amount information group 141 and the distribution information group 142 when detecting a feature amount indicating abnormality. As a result, only necessary analysis processing is executed, so that the amount of computer resources used by the analysis device 104 can be reduced. Further, since the distribution information group 142 is updated based on the result of the analysis process, the accuracy of detecting unauthorized access in the analysis device 104 is improved.

  FIG. 3 is a diagram illustrating an example of distribution information included in the distribution information group 142 according to the first embodiment. FIG. 3 shows an example of flow distribution information 221.

  The flow distribution information 221 includes a plurality of entries including a feature quantity 301, an analysis type 302, and an analysis result 303.

  The feature quantity 301 is a feature quantity that serves as an index for selecting an analysis unit. 3 includes the number of transmitted packets 311 and the connection ratio 312.

  The number of transmitted packets 311 is the number of packets transmitted from the terminal 101 to the computer 103 via an arbitrary flow. Of the connections generated during a predetermined period (for example, 5 seconds before the time when the packet was transmitted), this is the ratio of connections generated between the terminal 101 that sent the packet and the computer 103.

  The analysis type 302 is a type of analysis process. The analysis result 303 is a result of the analysis process. The analysis result 303 stores either “normal” indicating normal communication or “abnormal” indicating abnormal communication. In the present embodiment, the analysis result 303 is used as information indicating whether or not to execute the analysis process. That is, when the analysis result 303 is “normal”, it is determined that the analysis process is not necessary, and when the analysis result 303 is “abnormal”, it is determined that the analysis process is necessary.

  FIG. 4 is a flowchart illustrating processing executed by the distribution unit 121 according to the first embodiment. FIG. 5 is a diagram illustrating an example of the feature amount space according to the first embodiment.

  When the distribution unit 121 receives a process start instruction from the feature amount calculation unit 120, the distribution unit 121 starts the process described below. Note that the feature amount calculation unit 120 inputs the identification information of the feature amount information and the identification information of the entry of the feature amount information updated with the reception of the observation data to the distribution unit 121.

  The distribution unit 121 selects one distribution information from the distribution information group 142 (step S401).

  Specifically, the distribution unit 121 searches for distribution information including the updated feature amount, and generates a list of searched distribution information. The distribution unit 121 refers to the distribution information list and selects one distribution information. At this time, the distribution unit 121 acquires a feature amount corresponding to the feature amount 301 of the distribution information selected from the updated feature amount information of the feature amount information group 141.

  Next, the distribution unit 121 refers to the selected distribution information, and determines whether there is an entry similar to the feature amount of the entry from which the feature amount 301 is acquired (step S402). Specifically, the following processing is executed.

  The distribution unit 121 plots the feature amount of each entry in the feature amount space with the feature amount 301 of the selected distribution information as an axis. When the flow distribution information 221 shown in FIG. 3 is selected, the feature amount of each entry is plotted in the feature amount space as shown in FIG. Since the flow distribution information 221 shown in FIG. 3 includes two feature amounts, the feature amount space is two-dimensional. Therefore, in the case of distribution information including n feature quantities, the feature quantity space is n-dimensional.

  White circles and black circles indicate feature amounts of entries in the flow distribution information 221. A white circle indicates a feature amount of an entry whose analysis result 303 of an arbitrary analysis process is “normal”. A black circle indicates a feature amount of an entry whose analysis result 303 of an arbitrary analysis process is “abnormal”. Here, the analysis result 303 of the analysis process of the Probe attack is assumed. The distinction between white circles and black circles is made for the purpose of explanation.

  The allocating unit 121 acquires an entry including the updated feature value from the updated feature value information, and plots the updated feature value of the entry in the feature value space. The feature value points of the entry from which the cross mark of the feature value space shown in FIG. 5 is acquired are shown.

  The allocating unit 121 calculates a distance between the feature amount of each entry in the feature amount space and the feature amount of the acquired entry. The allocating unit 121 identifies the entry having the shortest distance (first entry) among the entries whose analysis result 303 is “normal”, and the entry having the shortest distance among the entries whose analysis result 303 is “abnormal”. Specify (second entry).

  In the example shown in FIG. 5, the entry corresponding to the point (α2, β2) is the first entry, and the entry corresponding to the point (α3, β3) is the second entry.

  The allocating unit 121 is based on the distance r1 between the feature value of the first entry and the acquired feature value of the entry, and the distance r2 between the feature value of the second entry and the acquired feature value of the entry. Identify similar entries. Specifically, the distribution unit 121 identifies similar entries based on the following four conditions.

(Condition 1) r1 ≦ R1 and r2> R
(Condition 2) r1> R1 and r2 ≦ R
(Condition 3) r1 ≦ R1 and r2 ≦ R
(Condition 4) r1> R1 and r2> R2

  R1 represents a reference distance determined to be similar to an entry whose analysis result 303 is “normal”. R2 represents a reference distance determined to be similar to an entry whose analysis result 303 is “abnormal”. However, R2 is larger than R1.

  Usually, most of the traffic is normal communication content, and there is little traffic including abnormal communication content. For this reason, the entry whose analysis result 303 is “abnormal” exists in an area different from the area where the entries whose analysis result 303 is “normal” are distributed. In general, there is no entry whose analysis result 303 is “normal” around the entry whose analysis result 303 is “abnormal”. Therefore, by sufficiently increasing R2, there is an effect of improving the accuracy of detecting the feature amount indicating abnormality.

  (Condition 1) indicates that the feature amount of the acquired entry is included in a circular area centered on the first entry. (Condition 2) indicates that the feature amount of the acquired entry is included in a circle area centered on the second entry. (Condition 3) indicates that the feature amount of the acquired entry is included in both the circle area centered on the first entry and the circle area centered on the second entry. (Condition 4) indicates that the feature quantity of the acquired entry is not included in any of the circle area centered on the first entry and the circle area centered on the second entry.

  When (Condition 1) is satisfied, the distribution unit 121 determines that the feature value of the acquired entry is similar to the feature value 301 of the first entry. When (Condition 2) is satisfied, the distribution unit 121 determines that the feature amount of the acquired entry is similar to the feature amount 301 of the second entry. When (Condition 3) is satisfied, the distribution unit 121 determines that the feature value of the acquired entry is similar to the feature value 301 of the second entry. When (Condition 4) is satisfied, the allocating unit 121 determines that there is no entry having a similar feature amount 301. The above is the description of the process in step S402.

  If it is determined that there is no entry similar to the feature amount of the entry for which the feature amount 301 is acquired, the allocating unit 121 selects all the analysis units, and executes the analysis processing for all the analysis units. An instruction is given (step S409). Thereafter, the allocating unit 121 proceeds to step S406.

  When the distribution unit 121 receives the analysis result from the analysis control unit 122, the distribution unit 121 displays an entry that associates the identification information of the selected distribution information, the feature amount of the acquired entry, the analysis type, and the analysis result. It is temporarily stored in the memory 111.

  If it is determined that there is an entry similar to the feature value of the entry for which the feature value 301 is acquired, the distribution unit 121 selects one analysis process based on the analysis type 302 of the similar entry (step S403). Then, it is determined whether or not the analysis result 303 corresponding to the analysis process is “normal” (step S404).

  If it is determined that the analysis result 303 corresponding to the selected analysis process is “normal”, the distribution unit 121 proceeds to step S405.

  When it is determined that the analysis result 303 corresponding to the selected analysis process is “abnormal”, the allocating unit 121 selects an analysis unit corresponding to the analysis process, and analyzes the selected analysis unit. The execution of the process is instructed (step S410). Thereafter, the allocating unit 121 proceeds to step S405.

  When the distribution unit 121 receives the analysis result from the analysis control unit 122, the distribution unit 121 displays an entry that associates the identification information of the selected distribution information, the feature amount of the acquired entry, the analysis type, and the analysis result. It is temporarily stored in the memory 111.

  In step S405, the distribution unit 121 determines whether or not the processing has been completed for all analysis types 302 of similar entries (step S405).

  If it is determined that processing has not been completed for all analysis types 302 of similar entries, the distribution unit 121 returns to step S403 and executes similar processing.

  When it is determined that processing has been completed for all analysis types 302 of similar entries, the distribution unit 121 determines whether processing has been completed for all distribution information (step S406).

  Specifically, the distribution unit 121 determines whether or not processing has been completed for all distribution information included in the distribution information list.

  If it is determined that the processing has not been completed for all the distribution information, the distribution unit 121 returns to step S401 and executes the same processing.

  When it is determined that the processing has been completed for all distribution information, the distribution unit 121 determines whether or not the analysis unit has been selected one or more times (step S407). That is, it is determined whether or not the process of step S409 or step S410 has been executed once or more.

  When it is determined that the analysis unit is not selected, the distribution unit 121 ends the process.

  When it is determined that the analysis unit has been selected one or more times, the distribution unit 121 updates the distribution information group 142 after receiving all the results of the analysis processing from the analysis control unit 122 (step S408). The process ends.

  Specifically, the distribution unit 121 refers to the entries stored in the memory 111, identifies distribution information to be updated, and adds one entry to the identified distribution information. The allocating unit 121 sets the acquired feature amount of the entry in the added entry feature amount 301, generates a row of all analysis types in the analysis type 302, and sets the analysis result in the analysis result 303 of each row To do. It should be noted that “normal” is set in the analysis result 303 of the analysis process for which execution is not instructed.

  In FIG. 3, the distribution information analysis type 302 includes all analysis processing rows, but the present invention is not limited to this. For example, only the row of the analysis process using the feature quantity 301 may be included.

  In the first embodiment, the system that performs the analysis processing using the feature amount of the packet has been described as an example, but the present invention is not limited to this. A system having a plurality of analysis units that analyze data other than packets also has the same effect.

  According to the first embodiment, the analysis apparatus 104 determines the presence or absence of a feature quantity similar to a feature quantity whose arbitrary analysis result indicates abnormality based on the distribution information, and a feature quantity similar to the feature quantity indicating abnormality. Is detected, an analysis unit that executes an analysis process using the feature amount is selected, and execution of the analysis process is instructed. As a result, the amount of computer resources used by the analysis apparatus 104 for analysis processing can be reduced.

  Further, by updating the distribution information based on the analysis result of the analysis unit, the amount of data used for determining the similarity of the feature amount increases, so that the analysis unit can be appropriately selected. Thereby, the analysis accuracy of the entire system can be improved.

  The second embodiment is different from the first embodiment in that the distribution unit 121 and the analysis control unit 122 are mounted on different devices. Hereinafter, the second embodiment will be described focusing on differences from the first embodiment.

  FIG. 6 is a diagram illustrating a configuration example of a computer system according to the second embodiment.

  In the second embodiment, the configuration in the data center 100 is different from the data center 100 in the first embodiment. Specifically, the data center 100 includes an NW device 102, a computer 103, a distribution device 600, and an analysis device 601. Two or more devices may exist. The computer 103 and the distribution device 600 are connected to the NW device 102.

  The data center 100 according to the second embodiment is different from the first embodiment in that a sorting apparatus 600 that selects an analysis process and an analysis apparatus 601 that executes the analysis process are included as separate apparatuses.

  The memory 111 of the distribution device 600 stores a program for realizing the feature amount calculation unit 120 and the distribution unit 121. The storage unit 130 of the distribution device 600 stores log information 140, a feature amount information group 141, and a distribution information group 142.

  The memory 111 of the analysis apparatus 601 stores a program that implements the analysis control unit 122. The storage unit 130 of the analysis device 601 stores a learning data group 143.

  The processing executed by the feature amount calculation unit 120 and the analysis control unit 122 is the same as that in the first embodiment. The contents of the log information 140, the feature amount information group 141, the distribution information group 142, and the learning data group 143 are the same as those in the first embodiment.

  The processing executed by the distribution unit 121 is partly different from that of the first embodiment. Specifically, the method for instructing execution of the analysis process is different from that in the first embodiment.

  For example, in step S410, the allocating unit 121 transmits an analysis processing execution instruction including the type of analysis processing and the calculated feature amount as arguments to the analysis apparatus 601.

  Moreover, the structure which has the analyzer 601 for every analysis process may be sufficient. In this case, the distribution unit 121 holds the identification information of the analysis device 601 and information including the type of analysis processing. When instructing the execution of the analysis process, the allocating unit 121 specifies the analysis device 601 that executes the selected analysis process based on the information, and uses the feature amount calculated by the specified analysis device 601 as an argument. The execution instruction of the analysis process included as is transmitted.

  The second embodiment has the same effect as the first embodiment. In addition, since the distribution device 600 and the analysis device 601 are separate devices, there is no restriction on addition and deletion of the analysis device 601, so that the system configuration can be flexibly changed. Further, by adding the distribution device 600 to the existing computer system, a computer system having the effects of the present invention can be realized.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. Further, for example, the above-described embodiments are described in detail for easy understanding of the present invention, and are not necessarily limited to those provided with all the described configurations. In addition, a part of the configuration of the embodiment can be added to, deleted from, or replaced with another configuration.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. The present invention can also be realized by software program codes that implement the functions of the embodiments. In this case, a storage medium in which the program code is recorded is provided to the computer, and a CPU included in the computer reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the program code itself and the storage medium storing it constitute the present invention. As a storage medium for supplying such a program code, for example, a flexible disk, CD-ROM, DVD-ROM, hard disk, SSD (Solid State Drive), optical disk, magneto-optical disk, CD-R, magnetic tape, A non-volatile memory card, ROM, or the like is used.

  The program code for realizing the functions described in the present embodiment can be implemented by a wide range of programs or script languages such as assembler, C / C ++, perl, Shell, PHP, Java (registered trademark).

  Furthermore, by distributing the program code of the software that implements the functions of the embodiments via a network, the program code is stored in a storage means such as a hard disk or memory of a computer or a storage medium such as a CD-RW or CD-R The CPU included in the computer may read and execute the program code stored in the storage unit or the storage medium.

  In the above-described embodiments, the control lines and information lines indicate what is considered necessary for the explanation, and not all control lines and information lines on the product are necessarily shown. All the components may be connected to each other.

100 Data Center 101 Terminal 102 NW Device 103 Computer 104 Analysis Device 105 External NW
110 CPU
111 Memory 112 Storage device 113 I / F
DESCRIPTION OF SYMBOLS 120 Feature-value calculation part 121 Distribution part 122 Analysis control part 130 Storage part 140 Log information 141 Feature-value information group 142 Distribution information group 143 Learning data group 200 DoS attack analysis part 201 U2R attack analysis part 202 R2L attack analysis part 203 Probe Attack analysis unit 210 Packet feature amount information 211 Flow feature amount information 212 Periodic feature amount information 220 Packet distribution information 221 Flow distribution information 222 Periodic distribution information 230 Learning data for DoS attack analysis 231 Learning data for U2R attack analysis 232 R2L attack analysis learning data 233 Probe attack analysis learning data 600 Distribution device 601 Analysis device

Claims (15)

A computer system comprising a plurality of computers,
Each of the plurality of computers has a processor, a memory connected to the processor, an interface connected to the processor and connected to another device,
The plurality of computers are:
A computer having an analysis control unit including a plurality of analysis units that perform analysis processing using data transmitted and received via a network;
A feature amount calculation unit that calculates a feature amount used by each of the plurality of analysis units using the data, and a computer that includes a distribution unit that selects the analysis unit to be used.
The distribution unit manages distribution information including a plurality of entries including the feature amount used by each of the plurality of analysis units, the type of the analysis process, and a result of the analysis process,
The result of the analysis process is a value indicating whether or not the analysis process is necessary,
The distribution unit is
With reference to the distribution information, a similar entry including a feature amount similar to the feature amount calculated from the data is searched,
Based on the result of the analysis process included in the similar entry, the analysis process to be executed is selected,
The analysis unit that executes the analysis process selected by the allocating unit performs an analysis process that uses the feature amount calculated from the data, and transmits the result of the analysis process to the allocating unit.
When the distribution unit receives the result of the analysis process, the distribution unit adds an entry including the feature amount calculated from the data, the type of the analysis process, and the result of the analysis process to the distribution information. A featured computer system. The computer system according to claim 1,
The feature amount calculation unit calculates a plurality of feature amounts of different types used by each of the plurality of analysis units,
The entry included in the distribution information includes the plurality of feature amounts,
The distribution unit is
A distance between the plurality of feature amounts included in the plurality of entries and the plurality of feature amounts calculated from the data in a feature amount space having one type of feature amount as one component is calculated. ,
A computer system characterized in that an entry having the smallest distance is specified as the similar entry among entries whose distance is equal to or less than a predetermined threshold. The computer system according to claim 2,
The distribution unit selects all of the analysis processes when there is no entry whose distance is equal to or less than the predetermined threshold. The computer system according to claim 2,
The distribution unit is
A first entry having a minimum distance is identified from entries including a value indicating that the analysis process is unnecessary, as a result of the analysis process;
A second entry having a minimum distance is identified from entries including a value indicating that the analysis process is necessary, as a result of the analysis process;
A first distance between a plurality of feature amounts included in the first entry and a plurality of feature amounts calculated from the data is equal to or less than a first threshold, and the plurality of feature amounts included in the second entry; If the second distance between the plurality of feature amounts calculated from the data is greater than a second threshold, the first entry is identified as the similar entry;
If the first distance is greater than the first threshold and the second distance is less than or equal to the second threshold, the second entry is identified as the similar entry;
The computer system characterized by specifying the second entry as the similar entry when the first distance is equal to or less than the first threshold and the second distance is equal to or less than the second threshold. A computer system according to claim 4, wherein
The computer system according to claim 1, wherein the first threshold value is smaller than the second threshold value. A method for analyzing data in a computer system comprising a plurality of computers,
Each of the plurality of computers has a processor, a memory connected to the processor, an interface connected to the processor and connected to another device,
The plurality of computers are:
A computer having an analysis control unit including a plurality of analysis units that perform analysis processing using data transmitted and received via a network;
A feature amount calculation unit that calculates a feature amount, and a calculator that includes a distribution unit that selects the analysis unit to be used.
The distribution unit manages distribution information including a plurality of entries including the feature amount used by each of the plurality of analysis units, the type of the analysis process, and a result of the analysis process,
The result of the analysis process is a value indicating whether or not the analysis process is necessary,
The data analysis processing method is:
A first step in which the feature amount calculation unit calculates a feature amount used by each of the plurality of analysis units using the data;
A second step in which the allocating unit searches for a similar entry including a feature quantity similar to the feature quantity calculated from the data with reference to the distribution information;
A third step in which the allocating unit selects the analysis process to be executed based on a result of the analysis process included in the similar entry;
The analysis unit that executes the analysis process selected by the allocating unit executes an analysis process that uses the feature amount calculated from the data, and transmits a result of the analysis process to the allocating unit. And the steps
When the distribution unit receives the result of the analysis process, the distribution unit adds an entry including the feature amount calculated from the data, the type of the analysis process, and the result of the analysis process to the distribution information. And a data analysis method comprising the steps of: The data analysis method according to claim 6, comprising:
The entry included in the distribution information includes a plurality of feature amounts of different types,
The first step includes a step in which the feature amount calculation unit calculates the plurality of feature amounts used by each of the plurality of analysis units,
The second step includes
The allocating unit includes a plurality of feature amounts included in the plurality of entries and a plurality of feature amounts calculated from the data in a feature amount space having one type of feature amount as one component. A sixth step of calculating a distance between;
The distribution unit includes: a seventh step of identifying, as the similar entry, an entry having the smallest distance among entries whose distance is equal to or less than a predetermined threshold. Method. The data analysis method according to claim 7, comprising:
The second step includes a method of analyzing data, wherein the distribution unit includes a step of selecting all the analysis processes when there is no entry whose distance is equal to or less than the predetermined threshold. The data analysis method according to claim 7, comprising:
The seventh step includes
The allocating unit identifying a first entry having a minimum distance among entries including a value indicating that the result of the analysis process does not require the analysis process;
The allocating unit identifying a second entry having the minimum distance among entries including a value indicating that the analysis process requires the analysis process; and
A first distance between a plurality of feature amounts included in the first entry and a plurality of feature amounts calculated from the data is equal to or less than a first threshold, and the plurality of feature amounts included in the second entry; When the second distance between the plurality of feature amounts calculated from the data is greater than a second threshold, the allocating unit identifies the first entry as the similar entry;
When the first distance is greater than the first threshold and the second distance is less than or equal to the second threshold, the allocating unit identifies the second entry as the similar entry;
When the first distance is equal to or smaller than the first threshold and the second distance is equal to or smaller than the second threshold, the allocating unit specifies the second entry as the similar entry. Data analysis method characterized by The data analysis method according to claim 9, comprising:
The data analysis method, wherein the first threshold value is smaller than the second threshold value. A computer comprising a processor, a memory connected to the processor, an interface connected to the processor and connected to another device,
The calculator is
An analysis control unit including a plurality of analysis units that perform analysis processing using data transmitted and received via a network;
A feature value calculation unit that calculates a feature value used by the analysis unit using the data;
A sorting unit for selecting the analysis unit to be used,
Holding distribution information including a plurality of entries including the feature amount used by each of the plurality of analysis units, the type of the analysis process, and a result of the analysis process;
The result of the analysis process is a value indicating whether or not the analysis process is necessary,
The distribution unit is
With reference to the distribution information, a similar entry including a feature amount similar to the feature amount calculated from the data is searched,
Based on the result of the analysis process included in the similar entry, the analysis process to be executed is selected,
The analysis unit that executes the analysis process selected by the allocating unit executes an analysis process that uses the feature amount calculated from the data, and outputs the result of the analysis process to the allocating unit;
When the distribution unit receives the result of the analysis process, the distribution unit adds an entry including the feature amount calculated from the data, the type of the analysis process, and the result of the analysis process to the distribution information. A featured calculator. The computer according to claim 11, wherein
The feature amount calculation unit calculates a plurality of feature amounts of different types used by each of the plurality of analysis units,
The entry included in the distribution information includes the plurality of feature amounts,
The distribution unit is
A distance between the plurality of feature amounts included in the plurality of entries and the plurality of feature amounts calculated from the data in a feature amount space having one type of feature amount as one component is calculated. ,
A computer characterized in that an entry having the smallest distance is specified as the similar entry among entries whose distance is equal to or less than a predetermined threshold. The computer according to claim 12, comprising:
The distribution unit selects all the analysis processes when there is no entry whose distance is equal to or less than the predetermined threshold. The computer according to claim 12, comprising:
The distribution unit is
A first entry having a minimum distance is identified from entries including a value indicating that the analysis process is unnecessary, as a result of the analysis process;
A second entry having a minimum distance is identified from entries including a value indicating that the analysis process is necessary, as a result of the analysis process;
A first distance between a plurality of feature amounts included in the first entry and a plurality of feature amounts calculated from the data is equal to or less than a first threshold, and the plurality of feature amounts included in the second entry; If the second distance between the plurality of feature amounts calculated from the data is greater than a second threshold, the first entry is identified as the similar entry;
If the first distance is greater than the first threshold and the second distance is less than or equal to the second threshold, the second entry is identified as the similar entry;
The computer is characterized in that when the first distance is equal to or less than the first threshold and the second distance is equal to or less than the second threshold, the second entry is specified as the similar entry. The computer according to claim 14, wherein
The computer according to claim 1, wherein the first threshold value is smaller than the second threshold value.

Images