外れ构造抽出技术を用いた 大规模セキュリティログ分析 - Fujitsu.PDF

Large-scale Security Log Analysis based on Outlier Extraction Technology ● 本多聡美　　　● 丸橋弘治　　　● 鳥居　悟　　　● 武仲正彦 あ ら ま し IDS Intrusion Detection System IDS Abstract In recent years, attacks on cyber space have not only increased in number but also become aggressive and sophisticated. To take countermeasures against such attacks, security analysts must detect and analyze unrecognized tactical attack events and their intentions before the start of the main attacks. It is not sufficient to apply conventional methods such as rule-based attack detection and simple outlier detection. The tactical attack events are hidden among numerous known attack events and it is difficult to extract and analyze them with only conventional methods. Therefore, to solve this problem Fujitsu Laboratories has developed Outlier Extraction Technology in order to single out an outlier-structure (a cluster of data shared with rare values) from a large-scale discrete event log such as a security event log. By applying this outlier extraction technology to a network monitoring log, security analysts can detect and analyze a sequence of tactical