Network packet analyzer and computer program product
A network packet analyzer according an embodiment includes a memory and one or more hardware processors. The memory stores a plurality of sets of training data in which semantics of one protocol field and one or more patterns indicating characteristics of variations of the parameters of the one protocol field are associated with each other. The hardware processors: captures a network packets and extracts a variable field whose parameter varies in time series; generates, based on the parameter varying in the time series in the variable field, one or more patterns indicating a characteristic of a variation of the parameter; and compares each of the one or more patterns with each of the one or more patterns of the training data and estimate the semantics of the variable field.
1. A network packet analyzer comprising:
a storage configured to store a plurality of sets of training data in which semantics of one protocol field and one or more first patterns for the one protocol field are associated with each other, the one protocol field being included in each of network packets to be received in time series, the one or more first patterns indicating different characteristics of variations of the parameters in parameter of the one protocol field among the network packets to be received in time series; and
one or more hardware processors configured to:
capture network packets in time series and extract variable fields whose parameters vary in time series among the captured network packets;
generate one or more second patterns indicating different characteristics of variations in parameter of the variable fields among the captured network packets; and
compare each of the one or more second patterns with each of the one or more first patterns of the training data and estimate semantics of the variable field.
2. The apparatus according to claim 1 , wherein
the one or more second patterns two or more patterns, and
the one or more first patterns in the training data are two or more patterns.
3. The apparatus according to claim 1 , the one or more hardware processors are configured to:
divide an analysis target of the captured network packets into subfields; and
filter, among one or more parameter sequences in which a plurality of the parameters stored in the same subfield are arranged in time series order, a parameter sequence in which the parameters constituting the parameter sequence have varied in time series, as the variable field.
4. The apparatus according to claim 1 , wherein the one or more first patterns and the one or more second patterns each indicate at least one of characteristics including: a regularity of the parameter in time series; an irregularity of the parameter in time series; a type of the parameter; a period of the parameter; frequency of the parameter; an upper limit value of the parameter; a lower limit value of the parameter; a correlation between the parameter and a data length; a range of change in increase or decrease of the parameter; an increase or decrease value of the parameter; a rate of change of the parameter; and a correlation between the parameter and the parameter stored in the pattern of the other variable field or stored in a known field.
5. The apparatus according to claim 1 , wherein the one or more hardware processors are configured to:
calculate a similarity measure for each of patterns of a same type among the one or more second patterns of the variable field and the one or more first patterns of each of sets of the plurality of sets of training data;
calculate a degree of total similarity for each of the sets based on the similarity measure; and
estimate, as the semantics of the variable field, semantics of the protocol field of the set having the highest degree of total similarity.
6. The apparatus according to claim 1 , wherein the one or more hardware processors are configured to:
acquire a plurality of pieces of network packets; and
filter, as the network packets among the plurality of pieces of network packets, two or more pieces of the network packets that satisfy a first filtering condition to have a same characteristic.
7. The apparatus according to claim 6 , wherein the first filtering condition is a condition for one or more of a data length, a MAC address, an IP address, an Ethernet (registered trademark) frame type number, an IP protocol number, a port number, a communication frequency, and a time stamp.
8. The apparatus according to claim 5 , wherein the one or more hardware processors are configured to:
evaluate whether the estimation for the variable field is successful or unsuccessful based on the degree of total similarity; and,
in response to evaluating that the estimation of at least one of the variable fields is successful, add, to the storage, information in which semantics of the variable field judged to be successful in estimation as the training data is associated with the second pattern of the variable field.
9. The apparatus according to claim 5 , wherein the one or more hardware processors are configured to:
acquire a plurality of pieces of network packets and extract, as the network packets among the plurality of pieces of network packets, two or more pieces of the network packets satisfying a first filtering condition to have a same characteristic;
evaluate whether the estimation for the variable field is successful or unsuccessful based on the degree of total similarity; and,
when a number of the variable fields judged to be successful in the estimation is less than a set number, extract the network packets under a second filtering condition being different from the first filtering condition.
10. The apparatus according to claim 1 , wherein the one or more hardware processors are configured to specify the variable field as a tampering target.
11. The apparatus according to claim 1 , wherein, when the semantics estimated as the semantics of the variable field is the same as predetermined semantics, the one or more hardware processors are configured to specify the variable field associated with the predetermined semantics as a tampering target.
12. A computer program product comprising a non-transitory computer-readable recording medium on which an executable program to be executed by a computer is recorded, the computer including a memory to store a plurality of sets of training data in which semantics of one protocol field and one or more first patterns for the one protocol field are associated with each other, the one protocol field being included in each of network packets to be received in time series, the one or more first patterns indicating different characteristics of variations in parameter of the one protocol field among the network packets to be received in time series, the executable program instructing the computer to:
capture network packets in time series and extract variable fields whose parameters vary in time series among the captured network packets;
generate one or more second patterns indicating different characteristics of variations in parameter of the variable fields among the captured network packets; and
compare each of the one or more second patterns with each of the one or more first patterns of the training data and estimate semantics of the variable field.