Information processing device and monitoring method

Patent metadata

Field	Value
Publication number	US-10860406-B2
Application number	US-201515122602-A
Country	US
Kind code	B2
Filing date	Mar 18, 2015
Priority date	Mar 20, 2014
Publication date	Dec 8, 2020
Grant date	Dec 8, 2020

Abstract

The present invention provides an information processing device that outputs information including the data transmission relationship between elements constituting an information processing system, the information indicating the state of the information processing system. The information processing device includes a graphing means for generating a relationship graph based on an event log indicating the behavior of each of a plurality of processes operating in the system, the relationship graph having the processes as the vertices thereof and having the data transmission relationship between the vertices as the sides thereof; and a graph output means for outputting the generated relationship graph.

First claim

The invention claimed is:

1. An information processing device comprising:
a storage embodying a program; and
a processor configured to read the program and execute the program to:
acquire an event log from a host computer in a system, the event log indicating a behavior of each of a plurality of processes operating in the system and a behavior of each of a plurality of predetermined devices in the system;
generate a first relationship graph based on the event log, the first relationship graph including the plurality of processes and predetermined devices as vertices thereof and including data transmission relationships between the vertices as sides thereof, wherein the data transmission relationships include a plurality of data transmissions in a same direction that are set as a single side of the sides, and wherein the generation of the first relationship graph includes a side aggregating the event log indicating a similar behavior, and wherein a criterion for determining whether a new event is normal or abnormal when the new event occurs is calculated based on the first relationship graph;
generate a second relationship graph that includes vertices reflecting an arbitrary file and a device accessed by the plurality of processes, and sides reflecting accesses;
delete a specific side of the sides when an event corresponding to the specific side has not occurred for a predetermined period; and
output the first and the second relationship graphs.

2. The information processing device according to claim 1 , wherein
the system includes a plurality of hosts which are connected to each other via a network and in which each arbitrary process of the processes operates, and
the processor is further configured to at least obtain the event log from a monitoring agent located in each of the hosts.

3. The information processing device according to claim 1 , wherein the processor is further configured to generate a relationship graph that includes vertices reflecting an arbitrary file and a device accessed by the plurality of processes, and sides reflecting accesses.

4. The information processing device according to claim 1 , wherein the processor is further configured to generate the first relationship graph including generation of a new process by the process as a side thereof.

5. The information processing device according to claim 1 , wherein the processor is further configured to set information of the similar behavior on the side as an attribute for the side.

6. The information processing device according to claim 1 , wherein the processor is further configured to generate the first relationship graph including information concerning a volume of transferred data on the side as an attribute for the side.

7. The information processing device according to claim 1 , wherein the processor is further configured to generate the first relationship graph including information concerning the number of accesses on the side as an attribute for the side.

8. The information processing device according to claim 1 , wherein the processor is further configured to generate the first relationship graph including types of the data transmission relationships individually as the sides.

9. The information processing device according to claim 1 , wherein the processor is further configured to generate the first relationship graph including a combination of the data transmission relationships as a side.

10. The information processing device according to claim 1 , wherein the processor is further configured to generate the first relationship graph based on the event log selected based on an arbitrary criterion.

11. The information processing device according to claim 1 , wherein the side includes a property associated with a relationship between the vertices.

12. The information processing device according to claim 1 , wherein the processor is further configured to:
store the first relationship graph as a history relationship graph,
wherein the processor is configured to output the first relationship graph to be generated by updating the history relationship graph based on the history relationship graph and the event log.

13. The information processing device according to claim 12 , wherein the processor is further configured to delete the history relationship graph based on elapse of time.

14. The information processing device according to claim 13 , wherein the processor is further configured to stochastically delete the history relationship graph when the history relationship graph is deleted.

15. The information processing device according to claim 13 , wherein when the history relationship graph is deleted, the processor is configured to aggregate information included in the history relationship graph to be deleted with the history relationship graph that is not to be deleted.

16. The information processing device according to claim 1 , the processor further configured to:
receive a query including one or more retrieval conditions and send information concerning the first relationship graph that matches one or more of the one or more retrieval conditions.

17. The information processing device according to claim 16 , wherein the processor is configured to highlight
a portion of the first relationship graph which matches with the one or more retrieval conditions.

18. The information processing device according to claim 1 , the processor further configured to:
analyze the first relationship graph based on a mining request and output a result of the analysis.

19. The information processing device according to claim 18 , wherein the processor is further configured to output the result of the analysis, and highlight a portion of the first relationship graph corresponding to the mining request.

20. The information processing device according to claim 18 , wherein the processor is configured to analyze a current relationship graph and output a result of the analysis of the current relationship graph, and
the processor is further
configured to analyze a past relationship graph and output a result of the analysis of the past relationship graph; and
compare the result of the analysis of the current relationship graph and the result of the analysis of the past relationship graph with each other, based on one mining request of the mining request, and output a difference based on a result of the comparison.

21. The information processing device according to claim 20 , wherein the processor is further configured to
highlight a portion of the relationship graph corresponding to the difference.

22. The information processing device according to claim 17 , wherein the processor is further configured to highlight the portion by using at least one of display in a different color, blinking, a different line thickness, a different line pattern, and animation.

23. The information processing device according to claim 1 , wherein the processor is configured to generate and output the first relationship graph represented in a diagram.

24. An information processing system comprising:
a processor configured
according to claim 1 ; and
wherein the processor is further configured to monitor an event of at least one of process generation, file access, and interprocess communication.

25. A monitoring method comprising:
acquiring an event log from a host computer in a system, the event log indicating a behavior of each of a plurality of processes opera

Assignees

• Nec Corp

Inventors

• Nomura Takashi
• Kida Koji
• Kamimura Junpei
• Sakae Yoshiaki
• Katsuda Etsuko
• Isoyama Kazuhiko
• Yamasaki Kentaro
• Kobayashi Yuji

Classifications

• G06F11/3476 Primary

  Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title

• G06F11/323

  Visualisation of programs or trace data · CPC title

• G06F2201/875

  Monitoring of systems including the internet · CPC title

• G06F11/3006

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title

• G06F11/3072

  where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting · CPC title