Extraction device, extraction method, recording medium, and detection device

Patent metadata

Field	Value
Publication number	US-11526605-B2
Application number	US-201817042622-A
Country	US
Kind code	B2
Filing date	Apr 27, 2018
Priority date	Apr 27, 2018
Publication date	Dec 13, 2022
Grant date	Dec 13, 2022

Abstract

An extraction device includes: at least one memory configured to store instructions; and at least one processor configured to execute the instructions to: sort each set of frames that have the same identifier associated with a node, into frames maintaining a cycle and frames out of the cycle; and extract, as an event rule, a feature of a bit change in a data field related to an event occurrence, from the frames that have the same identifier and are out of the cycle.

First claim

What is claimed is:

1. A monitoring apparatus comprising:
an extraction device comprising:
at least one first memory configured to store instructions; and
at least one first processor configured to execute the instructions to:
sort each set of frames that have the same identifier associated with a node, into frames maintaining a cycle and frames out of the cycle;
extract, as an event rule, a feature of a bit change in a data field related to an event occurrence, from the frames that have the same identifier and are out of the cycle; and
exclude the frames that have the same identifier and maintain the cycle from the set of frames having the same identifier, and select the frames that are out of the cycle, and
a detection device that is communicably connected to the extraction device comprising:
at least one second memory configured to store instructions; and
at least one second processor configured to execute the instructions to:
determine a detection target frame out of the cycle to be an illegal frame when the data field of the detection target frame does not match the feature extracted by the extraction device and determine the detection target frame out of the cycle to be a normal frame when the data field of the detection target frame matches the feature extracted by the extraction device; and
update, after a frame out of the cycle is determined to be a normal frame, a base point of the cycle to a frame that is output at a time of an event occurrence,
wherein the feature of the bit change in the data field is that a bit at a specific position in the data field takes the same value before and after the event occurrence.

2. The extraction device according to claim 1 , wherein the feature of the bit change in the data field is inversion of a bit at a specific position in the data field.

3. The extraction device according to claim 1 , wherein the feature of the bit change in the data field is a combination of bits designated as 0 and 1 in the data field.

4. An extraction method comprising:
sorting frames that have the same identifier associated with a node, into frames maintaining a cycle and frames out of the cycle;
extracting, as an event rule, a feature of a bit change in a data field related to an event occurrence, from the frames that have the same identifier and are out of the cycle;
excluding the frames that have the same identifier and maintain the cycle from the set of frames having the same identifier, and select the frames that are out of the cycle;
determining a detection target frame out of the cycle to be an illegal frame when the data field of the detection target frame does not match the extracted feature and determine the detection target frame out of the cycle to be a normal frame when the data field of the detection target frame matches the extracted feature; and
updating, after a frame out of the cycle is determined to be a normal frame, a base point of the cycle to a frame that is output at a time of an event occurrence,
wherein the feature of the bit change in the data field is that a bit at a specific position in the data field takes the same value before and after the event occurrence.

5. A non-transitory computer-readable recording medium storing a program for causing a computer to:
sort each set of frames that have the same identifier associated with a node, into frames maintaining a cycle and frames out of the cycle;
extract, as an event rule, a feature of a bit change in a data field related to an event occurrence, from the frames that have the same identifier and are out of the cycle;
exclude the frames that have the same identifier and maintain the cycle from the set of frames having the same identifier, and select the frames that are out of the cycle;
determine a detection target frame out of the cycle to be an illegal frame when the data field of the detection target frame does not match the extracted feature and determine the detection target frame out of the cycle to be a normal frame when the data field of the detection target frame matches the extracted feature; and
update, after a frame out of the cycle is determined to be a normal frame, a base point of the cycle to a frame that is output at a time of an event occurrence,
wherein the feature of the bit change in the data field is that a bit at a specific position in the data field takes the same value before and after the event occurrence.

6. The extraction device according to claim 2 , wherein the feature of the bit change in the data field is inversion of a bit at a specific position in the data field.

7. The extraction device according to claim 2 , wherein the feature of the bit change in the data field is a combination of bits designated as 0 and 1 in the data field.

8. The extraction device according to claim 2 , wherein the feature of the bit change in the data field is that a bit at a specific position in the data field takes the same value before and after the event occurrence.

Assignees

• Nec Corp

Inventors

• Konashi Takashi
• Yamano Satoru

Classifications

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• H04L9/36

  with means for detecting characters not meant for transmission · CPC title