Back to results
US 12,118,476 B2Granted
Anomaly detection device
AssigneeNEC Corporation
InventorsYoshiaki Sakae, Kazuhiko Isoyama, Takayoshi Asakura
Life of this patent
Estimating the term…
Abstract
Based on a normal model, it is detected whether or not an event signal of a computer system is anomalous. In parallel with the normal-model-based anomaly detection, it is detected based on a rule whether or not the event signal is anomalous. Then, a final anomaly detection result is generated by performing comprehensive determination based on detection results of the normal-model-based anomaly detection and the rule-based anomaly detection.
Claims9
An anomaly detection device comprising:
- a memory containing program instructions;
- and
- a processor coupled to the memory, wherein the processor is configured to execute the program instructions to:
- generate a normal model by performing machine learning with a time sequence of first event signals as a normal state, the first event signals being collected from a computer system and including occurrence time of an event relating to an activity of a resource of the computer system and a content of the activity;
- after generating the normal model, detect, based on the normal model, whether or not a second event signal is anomalous, the second event signal being collected from the computer system and including occurrence time of an event relating to an activity of a resource of the computer system and a content of the activity;
- when the second event signal is detected to be anomalous in anomaly detection based on the normal model, identify the resource associated with the second event signal, and determine a validity degree of each of a plurality of preset rules with respect to the second event signal on a basis of whether or not the each rule is associated with the identified resource;
- from a plurality of the rules, select one or more rules having the validity degree that is equal to or larger than a threshold with respect to the second event signal and, on a basis of the selected one or more rules, detect whether or not the second event signal is anomalous;
- generate a final anomaly detection result related to the second event signal by performing comprehensive determination on a basis of a detection result of the detecting anomaly based on the normal model—and a detection result of the detecting anomaly based on the selected one or more rules;
- and
- automatically handle a detected anomaly based on the final anomaly detection result, wherein handling the detected anomaly includes performing at least one of:
- disconnecting the computer system from the network, adjusting a firewall setting of the computer system, blocking communication from the computer system;
- changing a routing table, disconnecting a process in which the detected anomaly is located, blocking communication from a process in which the detected anomaly is located, or forcibly terminating a process in which the detected anomaly is located;
- in generating the final anomaly detection result, include, in the final anomaly detection result, only the second event signal detected to be anomalous in the detecting anomaly based on the normal model as an anomalous event signal, and when the second event signal is detected to be anomalous in the detecting anomaly based on the each rule, include, in the anomaly detection result, the each rule based on which the second event signal is detected to be anomalous in association with the second event signal;
- in the detecting anomaly based on the normal model, collate the second event signal with the normal model, and generate a normal-model-based detection result including a score whose value becomes larger as a degree of difference from a normal state is higher and the second event signal;
- and
- in the determining the validity degree:
- when the score is less than a threshold set in advance, set the validity degree with respect to the second event signal of each of the plurality of rules to value 0;
- and
- when the score is equal to or larger than the threshold, set the validity degree with respect to the second event signal of a rule associated with the identified resource, among the plurality of rules, to value 1, and set the validity degree with respect to the second event signal not associated with the identified resource to value 0.
16 more elements
An anomaly detection method comprising:
- generating a normal model by performing machine learning with a time sequence of first event signals as a normal state, the first event signals being collected from a computer system and including occurrence time of an event relating to an activity of a resource of the computer system and a content of the activity;
- after generating the normal model, detecting, based on the normal model, whether or not a second event signal is anomalous, the second event signal being collected from the computer system and including occurrence time of an event relating to an activity of a resource of the computer system and a content of the activity;
- when the second event signal is detected to be anomalous in anomaly detection based on the normal model, identifying the resource associated with the second event signal, and determining a validity degree of each of a plurality of preset rules with respect to the second event signal on a basis of whether or not the each rule is associated with the identified resource;
- from a plurality of the rules, selecting one or more rules having the validity degree that is equal to or larger than a threshold with respect to the second event signal and, on a basis of the selected one or more rules, detecting whether or not the second event signal is anomalous;
- generating a final anomaly detection result related to the second event signal by performing comprehensive determination on a basis of detection results of the detecting anomaly based on the normal model and the detecting anomaly based on the selected one or more rules;
- and
- automatically handling a detected anomaly based on the final anomaly detection result, wherein handling the detected anomaly includes performing at least one of:
- disconnecting the computer system from the network, adjusting a firewall setting of the computer system, blocking communication from the computer system;
- changing a routing table, disconnecting a process in which the detected anomaly is located, blocking communication from a process in which the detected anomaly is located, or forcibly terminating a process in which the detected anomaly is located;
- in generating the final anomaly detection result, include, in the final anomaly detection result, only the second event signal detected to be anomalous in the detecting anomaly based on the normal model as an anomalous event signal, and when the second event signal is detected to be anomalous in the detecting anomaly based on the each rule, include, in the anomaly detection result, the each rule based on which the second event signal is detected to be anomalous in association with the second event signal;
- in the detecting anomaly based on the normal model, collate the second event signal with the normal model, and generate a normal-model-based detection result including a score whose value becomes larger as a degree of difference from a normal state is higher and the second event signal;
- and
- in the determining the validity degree:
- when the score is less than a threshold set in advance, set the validity degree with respect to the second event signal of each of the plurality of rules to value 0;
- and
- when the score is equal to or larger than the threshold, set the validity degree with respect to the second event signal of a rule associated with the identified resource, among the plurality of rules, to value 1, and set the validity degree with respect to the second event signal not associated with the identified resource to value 0.
13 more elements
A computer-readable recording medium with a program recorded thereon, the program comprising instructions for causing a computer to execute:
- a process to generate a normal model by performing machine learning with a time sequence of first event signals as a normal state, the first event signals being collected from a computer system and including occurrence time of an event relating to an activity of a resource of the computer system and a content of the activity;
- after executing the process to generate the normal model, a process to detect, based on the normal model, whether or not a second event signal is anomalous, the second event signal being collected from the computer system and including occurrence time of an event relating to an activity of a resource of the computer system and a content of the activity;
- a process to, when the second event signal is detected to be anomalous in anomaly detection based on the normal model, identify the resource associated with the second event signal, and determine a validity degree of each of a plurality of preset rules with respect to the second event signal on a basis of whether or not the each rule is associated with the identified resource;
- a process to, from a plurality of the rules, select one or more rules having the validity degree that is equal to or larger than a threshold with respect to the second event signal and, on a basis of the selected one or more rules, detect whether or not the second event signal is anomalous;
- a process to generate a final anomaly detection result related to the second event signal by performing comprehensive determination on a basis of detection results of the detecting anomaly based on the normal model and the detecting anomaly based on the selected one or more rules;
- and
- a process to automatically handle a detected anomaly based on the final anomaly detection result, wherein handling the detected anomaly includes performing at least one of:
- disconnecting the computer system from the network, adjusting a firewall setting of the computer system, blocking communication from the computer system;
- changing a routing table, disconnecting a process in which the detected anomaly is located, blocking communication from a process in which the detected anomaly is located, or forcibly terminating a process in which the detected anomaly is located;
- in generating the final anomaly detection result, include, in the final anomaly detection result, only the second event signal detected to be anomalous in the detecting anomaly based on the normal model as an anomalous event signal, and when the second event signal is detected to be anomalous in the detecting anomaly based on the each rule, include, in the anomaly detection result, the each rule based on which the second event signal is detected to be anomalous in association with the second event signal;
- in the detecting anomaly based on the normal model, collate the second event signal with the normal model, and generate a normal-model-based detection result including a score whose value becomes larger as a degree of difference from a normal state is higher and the second event signal;
- and
- in the determining the validity degree:
- when the score is less than a threshold set in advance, set the validity degree with respect to the second event signal of each of the plurality of rules to value 0;
- and
- when the score is equal to or larger than the threshold, set the validity degree with respect to the second event signal of a rule associated with the identified resource, among the plurality of rules, to value 1, and set the validity degree with respect to the second event signal not associated with the identified resource to value 0.
13 more elements
Dependencies are inferred from the claim text.