Communication system, anomaly detection apparatus, anomaly detection method, and program
A communication system that performs communication among a plurality of nodes by a broker-less type publishing/subscribing model, includes: a computer including a memory and a processor configured to, in a case where a network configuration of the communication system changes, detect an anomaly of the communication system based on configuration information indicating the network configuration and at least one of a predefined white list or black list.
1 . A communication system that performs communication among a plurality of nodes by a broker-less type publishing/subscribing model, the communication system comprising:
a computer including a memory and a processor configured to
in a case where a network configuration of the communication system changes, detect an anomaly of the communication system based on configuration information indicating the network configuration and at least one of a predefined white list or black list,
wherein the configuration information comprises multi-level relationship information between nodes extracted from communication traffic in the broker-less type publishing/subscribing model, and
the communication system further comprises a configuration management unit configured to perform network configuration control in response to detection of the anomaly,
wherein the configuration information is information in which, using first relationship information indicating a relationship among the nodes regarding transmission and reception of the communication, second relationship information indicating a relationship among the nodes regarding a belonging domain and whether the nodes are on a publisher side or on a subscriber side, and third relationship information indicating a relationship among the nodes regarding a topic to be published and subscribed, the first relationship information and the second relationship information are associated with each other by IP addresses and port numbers, and the second relationship information and the third relationship information are associated with each other by identifiers used in the broker-less type publishing/subscribing model.
2 . The communication system according to claim 1 , wherein the white list is information in which a condition for determining a normality is defined for a tree represented by one or more IP addresses held by each of the nodes, one or more port numbers corresponding to the IP addresses, identifiers corresponding to the IP addresses and the port numbers, and topic names corresponding to the identifiers,
the black list is information in which a condition for determining an anomaly is defined for a tree represented by one or more IP addresses held by each of the nodes, one or more port numbers corresponding to the IP addresses, identifiers corresponding to the IP addresses and the port numbers, and topic names corresponding to the identifiers, and
the processor detects an anomaly of the communication system by determining an anomaly of the communication system based on the configuration information and at least one of the white list or the black list.
3 . An anomaly detection apparatus that detects an anomaly of a communication system that performs communication among a plurality of nodes by a broker-less type publishing/subscribing model, the anomaly detection apparatus comprising:
a memory; and
a processor configured to
in a case where a network configuration of the communication system changes, detect an anomaly of the communication system based on configuration information indicating the network configuration and at least one of a predefined white list or black list,
wherein the configuration information comprises multi-level relationship information between nodes extracted from communication traffic in the broker-less type publishing/subscribing model, and
the communication system comprises a configuration management unit configured to perform network configuration control in response to detection of the anomaly,
wherein the configuration information is information in which, using first relationship information indicating a relationship among the nodes regarding transmission and reception of the communication, second relationship information indicating a relationship among the nodes regarding a belonging domain and whether the nodes are on a publisher side or on a subscriber side, and third relationship information indicating a relationship among the nodes regarding a topic to be published and subscribed, the first relationship information and the second relationship information are associated with each other by IP addresses and port numbers, and the second relationship information and the third relationship information are associated with each other by identifiers used in the broker-less type publishing/subscribing model.
4 . The anomaly detection apparatus according to claim 3 , wherein the configuration information is information in which, using first relationship information indicating a relationship among the nodes regarding transmission and reception of the communication, second relationship information indicating a relationship among the nodes regarding a belonging domain and whether the nodes are on a publisher side or on a subscriber side, and third relationship information indicating a relationship among the nodes regarding a topic to be published and subscribed, the first relationship information and the second relationship information are associated with each other by IP addresses and port numbers, and the second relationship information and the third relationship information are associated with each other by identifiers used in the broker-less type publishing/subscribing model.
5 . The anomaly detection apparatus according to claim 4 , wherein the white list is information in which a condition for determining a normality is defined for a tree represented by one or more IP addresses held by each of the nodes, one or more port numbers corresponding to the IP addresses, identifiers corresponding to the IP addresses and the port numbers, and topic names corresponding to the identifiers,
the black list is information in which a condition for determining an anomaly is defined for a tree represented by one or more IP addresses held by each of the nodes, one or more port numbers corresponding to the IP addresses, identifiers corresponding to the IP addresses and the port numbers, and topic names corresponding to the identifiers, and
the processor detects an anomaly of the communication system by determining an anomaly of the communication system based on the configuration information and at least one of the white list or the black list.
6 . An anomaly detection method performed by an anomaly detection apparatus that includes a memory and a processor to detect an anomaly of a communication system that performs communication among a plurality of nodes by a broker-less type publishing/subscribing model, the anomaly detection method comprising:
in a case where a network configuration of the communication system changes, detecting an anomaly of the communication system based on configuration information indicating the network configuration and at least one of a predefined white list or black list,
wherein the configuration information comprises multi-level relationship information between nodes extracted from communication traffic in the broker-less type publishing/subscribing model, and
the anomaly detection method further comprises performing, by the communication system including a configuration management unit, network configuration control in response to detection of the anomaly,
wherein the configuration information is information in which, using first relationship information indicating a relationship among the nodes regarding transmission and reception of the communication, second relationship information indicating a relationship among the nodes regarding a belonging domain and whether the nodes are on a publisher side or on a subscriber side, and third relationship information indicating a relationship among the nodes regarding a topic to be published and subscribed, the first relationship information and the second relationship information are associated with each other by IP addresses and port numbers, and the second relationship information and the third relationship information are associated with each other by identifiers used in the broker-less type publishing/subscribing model.
7 . A non-transitory computer-readable recording medium having computer-readable instructions stored thereon, which, when executed, cause a computer including a memory and processor to function as the anomaly detection apparatus according to claim 3 .