Method, system and apparatus for predicting abnormality

• US 9,811,278 B2
• Filed: 10/27/2015
• Issued: 11/07/2017
• Est. Priority Date: 07/06/2015
• Status: Active Grant

• Current Assignee: Wistron Corporation
• Original Assignee: Wistron Corporation
• Inventors: Chen, Chih-Ming, Tin, Hsiao-Wen
• Primary Examiner(s): NGUYEN, HIEP T
• Application Number:
  US14/923,446
• Publication Number:
  US 20170010829A1
• Time in Patent Office: 742 Days
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0673 Single storage device

Abstract

A method, a system and an apparatus for predicting abnormalities are provided. A controller analyzes a plurality of command logs to obtain a predictive rule for accessing a storage device. The controller performs an anomaly detection for the command logs based on the predictive rule so as to obtain at least one command cluster. The controller establishes policy data corresponding to the predictive rule based on the command logs included in each command cluster, and sends the policy data to a data transmission interface coupled to the storage device. The data transmission interface obtains a processing action for a received data access command according to the policy data.

Claims

1. An abnormality predicting method, comprising:

analyzing a plurality of command logs via a controller so as to obtain at least one predictive rule for accessing a storage device;

performing an anomaly detection to the command logs via the controller according to the at least one predictive rule so as to obtain at least one command cluster;

establishing at least one policy data corresponding to the at least one predictive rule via the controller according to one or more command logs in each of the at least one command cluster;

sending the at least one policy data via the controller to a data transmission interface coupled to the storage device; and

obtaining a processing action for a received data access command via the data transmission interface according to the at least one policy data.

2. The abnormality predicting method according to claim 1, wherein each of the at least one policy data comprises a security rule and the corresponding processing action;

wherein the step of obtaining the processing action for the received data access command via the data transmission interface according to the at least one policy data comprises;

retrieving the processing action corresponding to the security rule matched with the data access command.

3. The abnormality predicting method according to claim 2, wherein after the step of sending the at least one policy data via the controller to the data transmission interface coupled to the storage device further comprises:

transforming the at least one policy data via the data transmission interface into a format compliant with a store table of the data transmission interface so as to write the at least one policy data to the store table, wherein the step of writing each of the at least one policy data into the store table comprises;

writing the security rule into a rule field; and

writing the processing action into an action field, wherein the store table further comprises a status field, the status field recording a number of times that the data transmission interface receives the data access command.

4. The abnormality predicting method according to claim 3, further comprising:

after the data transmission interface receives the data access command, accumulating the number of times into the corresponding status field via the data transmission interface, and forwarding the number of times to the controller such that the controller updates the at least one policy data.

5. The abnormality predicting method according to claim 2, wherein the step of obtaining the processing action for the received data access command via the data transmission interface according to the at least one policy data comprises:

determining whether the received data access command matches the security rule via the data transmission interface;

if the received data access command does not match any security rule, executing a block action to the data access command; and

if the received data access command matches the security rule, obtaining the processing action corresponding to the security rule via the data transmission interface.

6. The abnormality predicting method according to claim 1, wherein after the step of obtaining the processing action for the received data access command via the data transmission interface according to the at least one policy data, further comprising:

if the processing action is an active action, executing an access action corresponding to the data access command to the storage device via the data transmission interface;

if the processing action is a filter action, executing an access action corresponding to an adjusted data access command to the storage device, after adjusting the content of the data access command via the data transmission interface; and

if the processing action is a block action, isolating the data access command via the data transmission interface such that the data transmission interface blocks execution of the data access command.

7. The abnormality predicting method according to claim 6, wherein if the processing action is the block action, further comprising:

forwarding the data access command to the controller or another one data transmission interface via the data transmission interface.

8. The abnormality predicting method according to claim 1, wherein the storage device comprises a plurality of storage spaces, and each of the storage spaces has at least one corresponding policy data.

9. The abnormality predicting method according to claim 1, wherein the step of analyzing the command logs via the controller so as to obtain the at least one predictive rule for accessing the storage device comprises:

executing the anomaly detection to the command logs so as to obtain a plurality of similar clusters;

obtaining a predictive threshold from each of the similar clusters; and

comparing the predictive thresholds to obtain the at least one predictive rule.

10. The abnormality predicting method according to claim 1, wherein the step of sending the at least one policy data to the data transmission interface via the controller further comprises:

constructing a firewall layer structure corresponding to the data transmission interface according to the at least one policy data, wherein the firewall layer structure comprises a network layer, a schematic layer and a semantic layer;

wherein the abnormality predicting method further comprises;

executing a syntactic analysis to the command logs via the controller so as to obtain a parse tree of each of the command logs, and executing a semantic analysis to the parse tree of each of the command logs so as to obtain a role labeling, and establishing the at least one policy data according to the role labeling.

11. An abnormality predicting system, comprising:

a data transmission interface coupled to a storage device; and

an abnormality predicting apparatus coupled to the data transmission interface, the abnormality predicting apparatus comprises;

a database storing a plurality of command logs; and

a controller coupled to the database, wherein the controller analyses the command logs so as to obtain at least one predictive rule for accessing the storage device;

the controller performs an anomaly detection to the command logs according to the at least one predictive rule so to obtain at least one command cluster;

the controller establishes at least one policy data corresponding to the at least one predictive rule according to one or more command logs in each of the at least one command cluster;

wherein the controller sends the at least one policy data to the data transmission interface such that the data transmission interface obtains a processing action for a received data access command according to the at least one policy data.

12. The abnormality predicting system according to claim 11, wherein each of the at least one policy data comprises a security rule and the corresponding processing action;

after receiving the policy data, the data transmission interface transforms the at least one policy data into a format compliant with a store table of the data transmission interface so as to write the policy data into the store table, the store table comprising;

a rule field recording the security rule;

an action field recording the processing action; and

a status field recording a number of times that the data transmission interface receives the data access command.

13. The abnormality predicting system according to claim 12, wherein, after receiving the data access command, the data transmission interface determines whether the received data access command matches the security rule recorded in the rule field;

if the received data access command does not match any security rule, a block action is executed to the data access command;

if the received data access command matches the security rule, the data transmission interface reads the corresponding action field so as to obtain the processing action.

14. The abnormality predicting system according to claim 12, wherein, after receiving the data access command, the data transmission interface accumulates the number of times into corresponding the status field and forwards the number of times to the controller such that the controller updates the policy data.

15. The abnormality predicting system according to claim 11, wherein

if the processing action is an active action, the data transmission interface executes an access action corresponding to the data access command to the storage device;

if the processing action is a filter action, after the data transmission interface adjusts the content of the data access command, the data transmission interface executes an access action corresponding to the adjusted data access command to the storage device; and

if the processing action is a block action, the data transmission interface isolates the data access command such that the data transmission interface blocks execution of the data access command.

16. The abnormality predicting system according to claim 15, wherein if the processing action is the block action, the data transmission interface forwards the data access command to the controller or another one data transmission interface.

17. The abnormality predicting system according to claim 11, wherein the storage device comprises a plurality of storage spaces, and each of the storage spaces has at least one corresponding policy data.

18. The abnormality predicting system according to claim 11, wherein the controller executes the anomaly detection to the command logs to obtain a plurality of similar clusters;

obtains a predictive threshold from each of the similar clusters; and

compares the predictive thresholds so as to obtain the at least one predictive rule.

19. The abnormality predicting system according to claim 11, wherein the data transmission interface comprises a firewall layer structure, the firewall layer structure comprises a network layer, a schematic layer and a semantic layer;

wherein the controller executes a syntactic analysis to the command logs so as to obtain a parse tree of each of the command logs, and executes a semantic analysis to the parse tree of each of the command logs to obtain a role labeling, and establishes the policy data according to the role labeling.

20. An abnormality predicting apparatus, comprising:

a storage unit comprising a plurality of modules and a database, wherein the database stores a plurality of received command logs;

a controller coupled to the storage unit and executing the modules to implement an abnormality predicting method,

wherein the modules comprise;

a behavior predicting module analyzing the command logs so as to obtain at least one predictive rule for accessing a storage device;

a policy generating module performing an anomaly detection to the command logs according to the at least one predictive rule so as to obtain at least one command cluster, and establishing at least one policy data corresponding to the at least one predictive rule according to one or more command logs in each of the at least one command cluster; and

a transmission module sending the at least one policy data to a data transmission interface such that the data transmission interface obtains a processing action for a received data access command according to the at least one policy data, wherein the data transmission interface is coupled to the storage device.