Generation device, generation method, and generation program
A generation device includes processing circuitry configured to extract log information in which a trace of intrusion remains from the log information construct graph structure data indicating an attack behavior order using time-series information included in the log information and generate a signature indicating a trace of an attack based on graph structure data constructed.
1 . A generation device comprising:
processing circuitry configured to:
extract event data in which a trace of intrusion remains from log information;
construct, using time-series information included in the event data, graph structure data indicating an attack behavior order that is an order of events of an attack included in the event data; and
generate a signature indicating a trace of the attack based on the constructed graph structure data indicating the attack behavior order.
2 . The generation device according to claim 1 , wherein the processing circuitry is further configured to:
search for a character string corresponding to the trace of the intrusion in the event data, and
extract the event data including the character string corresponding to the trace of the intrusion.
3 . The generation device according to claim 1 , wherein the processing circuitry is further configured to construct a nondeterministic finite automaton (NFA) as the graph structure data.
4 . The generation device according to claim 3 , wherein the processing circuitry is further configured to generate the signature by converting the constructed NFA by an algorithm for converting the NFA into a regular expression.
5 . A generation method executed by a generation device, the generation method comprising:
extracting event data in which a trace of intrusion remains from log information;
constructing, using time-series information included in the event data, graph structure data indicating an attack behavior order that is an order of events of an attack included in the event data; and
generating a signature indicating a trace of the attack based on the constructed graph structure data indicating the attack behavior order.
6 . A non-transitory computer-readable recording medium storing therein a generation program for causing a computer to execute:
extracting event data in which a trace of intrusion remains from log information;
constructing, using time-series information included in the event data, graph structure data indicating an attack behavior order that is an order of events of an attack included in the event data; and
generating a signature indicating a trace of the attack based on the constructed graph structure data indicating the attack behavior order.
7 . The generation device according to claim 1 , wherein the processing circuitry is configured to add a vertex corresponding to the trace of intrusion to the graph structure data.
8 . The generation device according to claim 7 , wherein the processing circuitry is configured to add the vertex corresponding to the trace of intrusion to the graph structure data if there is no vertex corresponding to the trace in the graph structure data.
9 . The generation device according to claim 1 , wherein the processing circuitry is configured to add an epsilon transition to a vertex corresponding to the trace of intrusion.
10 . The generation device according to claim 9 , wherein the processing circuitry is configured to add the epsilon transition to the vertex corresponding to the trace if the vertex corresponding to the trace of intrusion already exists in the graph structure data.
11 . The generation device according to claim 1 , wherein the processing circuitry is configured to generate the signature by replacing a label of the constructed graph structure data with a terminal symbol.
12 . The generation device according to claim 11 , wherein the processing circuitry is configured to add a predetermined arrow symbol before the terminal symbol of the signature.
13 . The generation device according to claim 1 , wherein the signature is described in an Event Log Language (ELL).
14 . The generation device according to claim 1 , wherein the processing circuitry is configured to collate the log information and an Indicator of Compromise (IoC).
15 . The generation device according to claim 4 , wherein the processing circuitry is configured to apply a state elimination method to convert the NFA into the regular expression.
16 . The generation device according to claim 1 , wherein the event data extracted from the log information includes a process name and a file name.
17 . The generation device according to claim 1 , wherein the constructed graph structure data represents an appearance positional relationship of the trace of intrusion.