Log analyzing device, attack detecting device, attack detection method, and program

1. A log analyzing device that analyzes an access log collected from an information processing apparatus connected to a network, the log analyzing device comprising:

a memory that stores a profile that is a criteria for determining whether analysis-target data indicates an attack on the information processing apparatus; and

processing circuitry configured to

perform an extraction of each parameter from a request, received from a client device via the network, in the access log;

with regard to each parameter extracted perform a class conversion to compare each part of a parameter value, from a first character, with a previously defined character string class, replace the part with a longest character string class that matches the character string class, and conduct conversion for a class sequence in which replaced character string classes are sequentially arranged;

store, as the profile in the memory, a class sequence with an appearance frequency of equal to or more than a predetermined value in a group of the class sequences that are obtained by the parameter extraction and the class conversion with regard to the access log of normal data as learning data; and

calculate a degree of similarity between the profile and the class sequence that is obtained by the parameter extraction and the class conversion with regard to the access log in the analysis-target data and determine whether an attack on the information processing apparatus occurs in accordance with the degree of similarity.

2. An attack detecting device that detects an attack on an information processing apparatus connected to a network, the attack detecting device comprising:

a memory that stores a profile that is a criteria for determining whether an access request for the information processing apparatus attacks the information processing apparatus; and

processing circuitry configured to

perform an extraction of each parameter from the access request;

with regard to each parameter extracted, compare each part of a parameter value, from a first character, with a previously defined character string class, replace the part with a longest character string class that matches the character string class, and conduct conversion for a class sequence in which replaced character string classes are sequentially arranged;

store, as the profile in the memory, a class sequence with an appearance frequency of equal to or more than a predetermined value in a group of the class sequences that are obtained by the parameter extraction and the class conversion with regard to the access request of normal data as learning data; and

calculate a degree of similarity between the profile and the class sequence that is obtained by the parameter extraction and the class conversion with regard to the access request, which is an analysis target, and determine whether an attack on the information processing apparatus occurs in accordance with the degree of similarity.

3. The attack detecting device according to claim 2 , wherein the processing circuitry stores, as the profile in the memory, a single class sequence with the appearance frequency of maximum in the group of the class sequences.

4. The attack detecting device according to claim 2 , wherein the processing circuitry stores, as the profile in the memory, multiple class sequences with the appearance frequency of equal to or more than a predetermined value in the group of the class sequences.

5. The attack detecting device according to claim 2 , wherein

in a case where the group of the class sequences satisfies a predetermined condition, the processing circuitry stores, as the profile in the memory, a unique group of all the character string classes, included in the group of the class sequences, and

the processing circuitry

in a case where the group of the class sequences satisfies a predetermined condition, determines whether an attack occurs depending on whether the profile includes the entire unique group of the character string classes in the class sequence of the analysis-target data during determination by using the degree of similarity, and

in a case where the group of class sequences does not satisfy the predetermined condition, calculates the degree of similarity between the profile and the class sequence of the analysis-target data.

6. The attack detecting device according to claim 4 , wherein

the processing circuitry

in a case where the multiple class sequences satisfy a predetermined condition, stores, as the profile in the memory, a unique group of all the character string classes included in the multiple class sequences,

in a case where the group of the multiple class sequences satisfies a predetermined condition, determines whether an attack occurs depending on whether the profile includes the entire unique group of the character string classes in the class sequence of the analysis-target data during determination by using the degree of similarity, and

in a case where the group of the multiple class sequences does not satisfy the predetermined condition, makes a determination by using a degree of similarity of a maximal value among the degrees of similarity between the class sequence of the analysis-target data and each of the multiple class sequences included in the profile.

7. An attack detection method by an attack detecting device that detects an attack on an information processing apparatus connected to a network,

extracting each parameter from an access request in normal data, received from a client device via the network, as learning data for the information processing apparatus, comparing each part of a parameter value, from a first character, with a previously defined character string class with regard to each parameter, replacing the part with a longest character string class that matches the character string class, conducting conversion for a class sequence in which replaced character string classes are sequentially arranged, and storing, in a storage unit as a profile that is a criteria for determining whether analysis-target data indicates an attack on the information processing apparatus, a class sequence with an appearance frequency of equal to or more than a predetermined value in a group of the class sequences;

extracting a parameter from the access request in the analysis-target data;

converting a value of the extracted parameter into the class sequence in accordance with the character string class;

calculating a degree of similarity between the class sequence and the profile; and

determining whether an attack on the information processing apparatus occurs in accordance with the degree of similarity.

8. A non-transitory computer-readable recording medium having stored a program causing a computer, which detects an attack on an information processing apparatus connected to a network, to execute a process comprising:

a step of extracting each parameter from an access request in normal data, received from a client device via the network, as learning data for the information processing apparatus, comparing each part of a parameter value, from a first character, with a previously defined character string class with regard to each parameter, replacing the part with a longest character string class that matches the character string class, conducting conversion for a class sequence in which replaced character string classes are sequentially arranged, and storing, in a storage unit as a profile that is a criteria for determining whether analysis-target data indicates an attack on the information processing apparatus, a class sequence with an appearance frequency of equal to or more than a predetermined value in a group of the class sequences;

a step of extracting a parameter from the access request in the analysis-target data;

a step of converting a value of the extracted parameter into the class sequence in accordance with the character string class;

a step of calculating a degree of similarity between the class sequence and the profile; and

a step of determining whether an attack on the information processing apparatus occurs in accordance with the degree of similarity.