JP2002149435A - Network centralized monitor method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To simultaneously solve such problems on countermeasures to any computer virus, illegal access to information resources in a network, and illegal connection to the network. SOLUTION: On each of information equipment, an agent for collecting the constitution and use situation of resources in the information equipment and the use situation by a user and a virus detecting means for injecting vaccine to any computer virus are mounted, and a monitoring device for monitoring the connected situation and traffic of the information equipment in a network is arranged. This method is provided with a step for downloading new vaccine in prescribed time intervals to the virus detecting means and a step for acquiring the information of the constitution and use situation of the resources of the information equipment collected by the agent through the Internet, and for recognizing the constitution and use situation of the resources of the respective information equipment in the network, and for detecting the illegal use and illegal connection.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network centralized monitoring method and system for monitoring the configuration and use of resources of each information device in a network, and traffic by a centralized monitoring device arranged outside the network.

[0002]

2. Description of the Related Art When a computer network is constructed, a major problem is how to prevent damage from a computer virus from a recording medium such as a floppy (registered trademark) disk brought in by a user outside or inside the network such as the Internet. Become. To deal with such a problem, for example, JP-A-5-108487, JP-A-7-281980, and JP-A-11-134190
This can be dealt with by combining techniques disclosed in Japanese Patent Application Laid-Open No. 9-269930 and Japanese Patent Application Laid-Open No. 9-269930.

On the other hand, it is necessary to take care that information in a network is not illegally taken out from the outside or inside. This can be dealt with by setting an access right for each information device and restricting or prohibiting access to a user without the access right.

[0004]

However, even if the above technique is applied, a new information device is illegally connected in the network, and a database or the like in the network is used by using the illegally connected information device. There is a risk that this information will be taken out illegally. The present invention provides a network centralized monitoring method and system capable of simultaneously solving such computer virus countermeasures, countermeasures against unauthorized access to information resources such as files in a network, and countermeasures against unauthorized connection to a network. It is the purpose.

[0005]

In order to achieve the above object, a network centralized monitoring method according to the present invention collects, in each information device, the configuration and use status of resources in the information device and the use status by a user. An agent and a virus detecting means for detecting intrusion of a computer virus and injecting a vaccine against the computer virus are mounted, and a monitoring device for monitoring connection status and traffic of information devices in the network is further arranged.
A network centralized monitoring method for monitoring the configuration and use status of resources of each information device in a network and traffic by a centralized monitoring device arranged outside the network, wherein the virus detection means is transmitted from a predetermined Internet website for a predetermined time. A first step of downloading a new vaccine at intervals, acquiring information on the configuration and use of the resources of the information devices collected by the agent via the Internet, and configuring and using the resources of each information device in the network A second step of recognizing the situation and detecting unauthorized use and unauthorized connection.

Further, the method further comprises a step of periodically notifying a network administrator of the configuration and use of resources of each information device recognized in the second step. Further, the method further comprises the step of notifying the network administrator of the unauthorized use and the unauthorized connection detected in the second step.

[0007] The network centralized monitoring system of the present invention is characterized in that each information device in the network has an agent that collects the configuration and use status of resources in the information device and the usage status by the user, and a predetermined time from a predetermined Internet web site. When a new vaccine is downloaded at intervals and a computer virus is detected, virus detection means for injecting the vaccine is provided, and the connection status and traffic of information devices in the network are monitored in the network. A monitoring device, wherein the centralized monitoring device obtains, via the Internet, information on the configuration and usage of the resources of the information devices collected by the agent, and recognizes the configuration and usage of the resources of each information device in the network. As well as misuse and Characterized in that it comprises means for detecting a positive connection. Further, the centralized monitoring apparatus further includes means for periodically notifying the network administrator of the configuration and use status of the resources of each information device.
Further, the centralized monitoring apparatus further includes a unit for notifying the network administrator of the detected unauthorized use and unauthorized connection.

[0008]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a system configuration diagram showing an embodiment of a computer network system to which the present invention is applied.
N (local area networks) 11 and 12 are connected to the Internet 13 so that information can be exchanged through the Internet 13. The Internet 13 is connected to a network centralized monitoring device 14 according to the present invention, and also connected to an anti-virus vaccine distribution Web site 15 for downloading the latest vaccine against computer viruses.

Here, each of the LANs 11 and 12 includes a plurality of client computers (or information devices) 111 and 112 such as personal computers, a mail server 113, a file server 114, and a proxy server 11.
5. A firewall server 116 is provided, and a monitoring device according to the present invention is further connected. Here, the firewall server 11 for preventing unauthorized access from the outside
6 may be incorporated in the proxy server 115 and the firewall server 116 may be omitted. Further, in the plurality of client computers 111 and 112, a recording medium such as a floppy disk 118 or a CD-ROM can be inserted from the outside to input / output data.

FIG. 2 shows the client computer 11.
1, 112 shows a configuration of a program mounted on an operating system (OS) 1
111, an application program 1112 for performing various tasks, a virus check program 1113, and an agent program 111 according to the present invention.
4 are provided. Virus check program 11
13, a commercially available virus check program can be used. For example, the product names "VirusScan" and "NetShield" of Japan Network Associates
d "," GruopShield "," WebShie
ld ”can be used. "VirusScan"
Specializes in overall memory protection on client computers. "NetShield" specializes in overall memory protection in file servers. "Gruo
"pShield" specializes in checking incoming and outgoing mail in a groupware environment and virus infection control.
"WebShield" specializes in checking incoming and outgoing mail in an SMTP environment and virus infection countermeasures.
For the mail server 113 in FIG.
ld ”, but“ NetS
field ", and" W
ebShield ”is implemented. Also,
“VirusScan” is implemented for each of the client computers 111 and 112. In any case, when a computer virus is detected, a function of automatically sending a notification mail to the administrator is provided, and the vaccine is distributed at a preset time interval to the vaccine distribution Web.
A function for automatically downloading from the site 15 is provided.

The agent program 1114 automatically collects the configuration and use status of the resources in each of the client computers 111 and 112 and the usage status by the user. As shown in FIG.
141, task management unit 11142, user management unit 111
43, network alarm management unit 11144, application management unit 11145, printer management unit 1114
6 is provided. This agent program 1114
Is, for example, “Mototex's LanScope
e), “SuperManager” and the like.

The configuration management unit 11141 monitors whether anti-virus measures are correctly implemented, and monitors illegal copying of information resources such as files. In addition, it acquires the configuration information of the client computer in which it is installed, and manages it as management information database (DB) as asset management information.
Record at 115. The asset management information includes hardware asset management information and software asset management information. The software trial management information includes the version of the application and the name of the installed program.

The task management unit 11142 checks the number of licenses and the number of running software acquired in the LAN, restricts applications that have attempted to run illegally, and suppresses unauthorized use. The unauthorized use suppression (or prohibition) control of the application is performed by the application name and the maximum number of licenses. User management unit 11143
Is to monitor the operation history of the user based on the operation record of the application running on each client computer, the operation record of mail transmission / reception, the operation record of the browser, and the like.

Network alarm management unit 11144
Is for monitoring registration other than software registered in advance and adding hardware, and when an operation of registering new software or adding hardware is performed, the administrator is notified by e-mail. . The application management unit 11145 manages the version of the application running on each client computer, and checks overall consistency within the LAN.
Also, the operation status of each client computer is monitored. The monitoring targets include file distribution, version management, operation management including license and application operation time, and the like. The printer management unit 11146 monitors a print log (print count for each user, print count for each printer, print count for each login) in a printer (not shown).

FIGS. 4 and 5 show the structure of client-specific management information collected by each unit of the agent program 1114.
1. The configuration includes task management information 402, user management information 403, network alarm monitoring information 404, application management information 405, user management information 406, and printer management information 407. Since each information is as described above, the description thereof will be omitted.

FIG. 6 shows the configuration of the monitoring device 117. The network operation status monitoring unit 11171, the expert analysis unit 11172, the alarm transmission unit 11173,
A traffic generation unit 11174 and a protocol translation unit 11175 are provided. This monitoring device 117
For example, “Sniffer <DSS / RMONPro>” of Japan Network Associates can be used for each unit.

The network operation state monitoring unit 11171 monitors the operation state of the LAN, an illegally connected device, or a newly connected device. Whether a device is a newly connected device is determined by, for example, P
ing command is sent, and the I
It is checked whether or not the P address includes a different IP address from the previously collected IP address. If the P address includes the P address, the device having the IP address is recognized as a newly connected device. When a newly connected device is detected,
The information is transmitted to the centralized monitoring device 14 and, after obtaining the confirmation of the administrator, is registered in the monitoring information database 11176 as an authorized connection device. If there is no confirmation from the administrator,
Recognizes as an unauthorized connection device, notifies the administrator,
It is recorded in the monitoring information database 11176.

The network operation state monitoring unit 1
Reference numeral 1171 denotes each client computer 111, 11
2 to collect information on internal components or devices,
It is determined whether or not the device is an anti-virus device in which the agent program 1114 is mounted. If the agent program 1114 is not installed, it is recognized as a new or unauthorized device for which no antivirus has been implemented. Expert analysis unit 11172
Is for recognizing transmission / reception partners inside and outside the LAN and sequentially recording them in the monitoring information database 11176.

The alarm transmitting unit 11173 transmits, for example, when an illegally connected device is found, to the centralized monitoring device. The traffic generation unit 11174 intentionally places a load on the LAN,
It is used when testing the performance of N. The protocol translating unit 11175 translates a protocol of information transmitted and received inside and outside the LAN.

FIG. 7 shows the configuration of the network centralized monitoring device 14, and the input / output device 14 including a display device.
1. An agent transmitting / receiving unit 142, a monitoring device transmitting / receiving unit 143, an input / output unit 144, and a monitoring information database 145 that records various types of collected monitoring information. When an intrusion is detected, the network manager 146 is notified.

FIGS. 8 and 9 show the client computers 111 and 112 and the monitoring device 11 in the above configuration.
7 shows an overview of information transmitted and received between the vaccine distribution Web site 15 and the network centralized monitoring device 14. In this case, the vaccine is on the website 15
Is automatically distributed at the time of the distribution time. Alternatively, each client computer or the server itself may determine the vaccine download time, issue a download request, and distribute the vaccine. Although the management information collected by the agent program 1114 and the like is described as being directly transmitted to the network centralized monitoring device 14, a dedicated server for storing the management information is provided, and the management information is stored in the dedicated server. It is also possible to adopt a configuration in which management information is acquired from the network centralized monitoring device 14.

First, the client computer 111,
112 automatically collects the asset management information 401 and the task management information 402 as shown in FIG. 4 by the agent program 1114 (step 801). Also, the user management, network alarm management, application management, and printer management are activated to start their respective processes (step 802). Similarly, the monitoring device 1
17 also starts processing of each unit inside, and starts monitoring the network operation state (step 803).

On the other hand, the vaccine distribution Web site 15
When a predetermined time has elapsed from the previous vaccine distribution time and the latest vaccine distribution time has come, the latest vaccine is distributed to client computers and servers in the LAN (step 804). Each client computer 1
11, 112 registers the distributed vaccine in the virus check program 1113 (step 805).
If the monitoring device 117 detects an illegally connected device during the monitoring operation in the LAN, it immediately notifies the network centralized monitoring device 14 of this (step 806).

On the other hand, the client computers 111,
When the virus check program 1113 detects the intrusion of the computer virus, the 112 immediately notifies the network centralized monitoring device 14 of the detection including the transmission / reception address (step 807). Also,
If an unauthorized access to the resource without the access right is detected, it is immediately notified to the network centralized monitoring device 14 including the user name and the login password (step 808). Further, when a failure of the application is detected, it is immediately notified to the network centralized monitoring device 14 including its name and version information (step 8).
09).

On the other hand, the network centralized monitoring device 14 transmits the management information collected by the agent program 1114 of each client computer and the server and the monitoring information collected by the monitoring device 117 at the collection time. An instruction is issued, and management information and monitoring information are collected (step 810). Then, the management information and the monitoring information are arranged, and the presence / absence of inconsistency between those having a correspondence relationship is checked. If there is any inconsistency or abnormality is recognized, the network manager 146 is notified (step 811). , 812).

Here, the management information and the monitoring information collected by the network centralized monitoring device 14 include an unauthorized connection device,
It contains information such as unauthorized access users and unauthorized use of unlicensed applications, so it is not only possible to detect unauthorized use and the intrusion of computer viruses, but also that resources such as hardware and software in the LAN It is possible to grasp the usage status.

Therefore, in addition to measures against computer viruses and unauthorized use, it is possible to obtain materials for effective use of computer resources at the same time. Based on this, it is possible to propose an improvement plan for improving the performance of the LAN to the network administrator, and to contribute to obtain the price.

Here, as shown in the system configuration diagram of another embodiment of FIG. 10, by providing an authentication server 120 for performing user authentication upstream of the firewall server 116, for example, a portable client computer 112 can be installed. Even when an authorized user who carries the device goes abroad and goes out, it is possible to normally access resources in the LAN from the destination via the Internet 13 without being judged as a newly connected device. .

[0029]

As described above, according to the present invention,
At the same time, it can solve computer virus countermeasures, countermeasures against unauthorized access to information resources such as files in the network, and countermeasures against unauthorized connection to the network.
It is possible to grasp the usage status of resources such as hardware and software in the network. In addition to providing computer virus countermeasures and unauthorized use countermeasures, it is also possible to obtain materials for effective use of computer resources at the same time. It is possible to propose an improvement plan for improving the performance of the network to the network administrator and to contribute to obtain the price.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram showing an embodiment of a computer network to which the present invention has been applied.

FIG. 2 is a program configuration diagram of a client computer.

FIG. 3 is a functional configuration diagram of an agent program implemented in a client computer.

FIG. 4 is a diagram (part 1) illustrating a configuration example of management information collected by an agent program;

FIG. 5 is a diagram (part 2) illustrating a configuration example of management information collected by an agent program;

FIG. 6 is a functional configuration diagram illustrating a configuration of a monitoring device.

FIG. 7 is a functional configuration diagram illustrating a configuration of a network centralized monitoring device.

FIG. 8 is a sequence diagram (part 1) illustrating an outline of information transmitted and received between the client computer and the monitoring apparatus network centralized monitoring apparatus;

FIG. 9 is a sequence diagram (part 2) illustrating an outline of information transmitted and received between the client computer and the monitoring device network centralized monitoring device.

FIG. 10 is a system configuration diagram showing another embodiment of the present invention.

[Description of Signs] 11, 12 LAN 13 Internet 14 Network centralized monitoring device 15 Antivirus vaccine distribution Web site 111 112 Client computer 1113 Virus check program 1114 Agent program 11171 Network operation state monitoring unit

 ──────────────────────────────────────────────────続 き Continuing from the front page (72) Inventor Atsuhiko Mochizuki 18th floor of Queens Tower C Bldg. 2-3-5 Minatomirai, Nishi-ku, Yokohama-shi, Kanagawa Prefecture Inside Soft Science Corporation (72) Takashi Yoshida Nishi-ku, Yokohama-shi, Kanagawa Prefecture Minato Mirai 2-3-5 Queens Tower C Bldg. 18th Floor Soft Science Co., Ltd. F-term (reference) 5B076 FB05 FD08

Claims (6)

[Claims] 1. An agent for collecting the configuration and use status of resources in the information device and the use status of the user in each information device, and a virus detection means for detecting intrusion of a computer virus and injecting a vaccine against the computer virus. And a monitoring device for monitoring the connection status and traffic of information devices in the network, and a centralized monitoring device for arranging the resource configuration and usage status of each information device in the network and the traffic outside the network A first step of downloading a new vaccine from a predetermined Internet website at a predetermined time interval to the virus detection means, and monitoring the resources of information devices collected by the agent. Configuration and usage information And a second step of recognizing the configuration and use of resources of each information device in the network, and detecting unauthorized use and unauthorized connection. . 2. The centralized network according to claim 1, further comprising a step of periodically notifying a network administrator of the configuration and use of resources of each information device recognized in said second step. Monitoring method. 3. The centralized network monitoring method according to claim 1, further comprising a step of notifying a network administrator of the unauthorized use and the unauthorized connection detected in the second step. 4. A network centralized monitoring system for monitoring the configuration and use status of resources of each information device in a network and a traffic by a centralized monitoring device arranged outside the network, wherein each information device is a resource in the information device. An agent that collects the configuration and usage status of a user and the usage status of a user, and a virus that injects the vaccine when a new vaccine is downloaded from a predetermined Internet website at a predetermined time interval and intrusion of a computer virus is detected. A monitoring device for monitoring the connection status and traffic of the information devices in the network, wherein the centralized monitoring device is configured and used for the resources of the information devices collected by the agent. Internet Information Through acquired, the network centralized monitoring system characterized in that it comprises together, the means for detecting the illegal use and unauthorized access to recognize the structure and usage of resources of the information devices in the network. 5. The network centralized monitoring system according to claim 4, wherein said centralized monitoring device further comprises means for periodically notifying a network administrator of the configuration and use status of resources of each information device. . 6. The network centralized monitoring system according to claim 4, wherein said centralized monitoring device further comprises means for notifying a network administrator of the detected unauthorized use and unauthorized connection.