JP2002258972A - Illegal operation monitor device and its program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an illegal operation monitor device capable of monitoring any illegal input and operation in real time by always monitoring the operation history log of a computer system to be monitored. SOLUTION: This illegal operation monitor device 3 is provided with an operation history log information acquiring means 11 for acquiring operation history log information from a computer system 2 to be monitored, an operation history log memory 12 for storing the operation history log information, an illegality discovery information registering means 13 for registering illegal discovery information for discovering any illegal operation, an input information memory 14 for storing input information such as a key input interval or an input alarm value being the illegality discovery information, an operation pattern information memory 15 for storing operation pattern information being the illegality discovery information, and an illegal operation monitoring means 16 for monitoring the illegal operation by comparing the illegality discovery information with operation history log information.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an unauthorized operation monitoring device for monitoring an unauthorized operation on a computer system.
In particular, the present invention relates to an unauthorized operation monitoring device that can constantly detect an unauthorized operation by real-time monitoring of an operation history log of a monitored computer system.

[0002]

2. Description of the Related Art Conventionally, various methods have been employed to detect and prevent unauthorized inputs and operations in computer systems. As one of the methods, there has been a method in which a history of input / operation is stored as an operation history log, which is later used for fraud analysis. According to this method, when an illegal input or an illegal operation is detected, the contents of the operation history log are analyzed to identify who has entered and operated and to identify an unauthorized person.

[0003]

However, in the above-described method, the operation history log is used only to identify an unauthorized person after the detection of an unauthorized operation, and the operation history log is used when an unauthorized input or operation is performed. The logs were not being used.

[0004] Therefore, there has been a problem in that, when the illegal input / operation is performed, the illegality cannot be detected by the conventional method.

[0005] Further, in the conventional method, if the operator's ID and password are stolen, unauthorized input / operation is normally processed, and there is also a problem that the illegality cannot be found. Was.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and has as its object to constantly monitor an operation history log of a computer system to be monitored, thereby enabling unauthorized input / operation to be monitored in real time. A monitoring device is provided.

[0007]

In order to achieve the above object, an unauthorized operation monitoring device according to the first aspect of the present invention comprises:
Operation history log information acquisition means for acquiring operation history log information relating to a history of operation of the monitored computer system, and fraud detection for registering fraud detection information which is information for detecting an illegal operation on the monitored computer system Information registering means, and unauthorized operation monitoring means for comparing the unauthorized discovery information registered by the unauthorized discovery information registering means with the operation history log information to detect an unauthorized operation on the monitored computer system. It is characterized by the following.

According to the first aspect of the present invention, the operation history log information is acquired from the monitored computer system and is constantly monitored, so that an unauthorized input by an unauthorized operator can be detected in real time.

[0009] The unauthorized detection information of the unauthorized operation monitoring device according to the second aspect is a key input interval set by a time interval between a longest time and a shortest time when inputting an input item. And

According to the second aspect of the present invention, the unauthorized operation is monitored based on the key input interval, so that the unauthorized operation can be detected even if the operator ID or the password is stolen.

According to a third aspect of the present invention, the illegal operation detection information of the unauthorized operation monitoring device is an input warning value set based on the maximum value and the minimum value of the numerical value of the input content.

According to the third aspect of the present invention, the unauthorized operation is monitored based on the input warning value, so that the unauthorized operation can be found even if the operator ID or the password is stolen.

According to a fourth aspect of the present invention, the fraudulent information of the fraudulent operation monitoring device is an input pattern set according to an input order of input items.

According to the fourth aspect of the present invention, since the unauthorized operation is monitored based on the operation pattern information, the unauthorized operation can be detected even if the operator ID or the password is stolen.

According to a fifth aspect of the present invention, there is provided an unauthorized operation monitoring program, comprising: an operation history log information acquisition process for acquiring operation history log information relating to a history of operation of a monitored computer system; Fraud detection information registration processing for registering fraud detection information that is information for detecting fraudulent operation; comparing the fraud detection information registered in the fraud detection information registration processing with the operation history log information; An unauthorized operation monitoring process for detecting an unauthorized operation on the monitored computer system.

According to the fifth aspect of the present invention, since the operation history log information is acquired from the monitored computer system and is constantly monitored, an unauthorized input by an unauthorized operator can be found in real time.

[0017]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The configuration of an unauthorized operation monitoring system according to the present embodiment will be described below with reference to FIG.

As shown in FIG. 1, an unauthorized operation monitoring system 1 includes a monitored computer system 2 for monitoring whether or not an unauthorized operation has been performed, and an operation related to an operation history from the monitored computer system 2. An unauthorized operation monitoring device 3 that acquires history log information and monitors unauthorized operations, an input device 4 for an operator to input to the unauthorized operation monitoring device 3, and an output from the unauthorized operation monitoring device 3. And a monitor 5 for displaying a processed result and a warning.

Here, the unauthorized operation monitoring device 3 is an operation history log information acquisition means 11 for acquiring operation history log information which is a history of operations of the monitored computer system 2.
An operation history log memory 12 for storing the operation history log information; an unauthorized discovery information registering unit 13 for registering unauthorized discovery information as information for discovering an unauthorized operation on the monitored computer system 2; An input information memory 14 for storing input information for detecting an irregularity such as an interval and an input warning value, an operation pattern information memory 15 for storing an operation pattern which is an input order of input items to the monitored computer system 2, and a key. And unauthorized operation monitoring means 16 for comparing unauthorized detection information such as input intervals, input item values, and operation patterns with operation history log information to monitor unauthorized operations on the monitored computer system 2. The unauthorized operation monitoring device 3 is configured by a normal computer system including a CPU for performing various processes and a storage unit for storing instructions for the processes.

Next, a process of registering fraud detection information by the fraudulent operation monitoring system 1 according to the present embodiment will be described with reference to the flowchart of FIG. Here, a case will be described in which a key input interval, an input warning value, and operation pattern information are registered as fraud detection information.

First, the unauthorized operation monitoring device 3 acquires operation history log information relating to the operation contents and input contents of the operator operating the monitored computer system 2 (S20).
1). The operation history log information includes information such as an operator ID, an operation date and time, an operation screen, input items, input contents, and key input time, as shown in FIG.

Then, upon acquiring the operation history log information, the unauthorized operation monitoring device 3 writes it in the operation history log memory 12 (S202).

Next, the fraudulent operation monitoring device 3 registers fraud detection information which is information for detecting fraud. Here, the operator operating the fraudulent operation monitoring device 3 automatically registers the fraud detection information. Or direct registration (S
203).

When the operator selects the automatic registration, the unauthorized operation monitoring device 3 sets the operation history log memory 1
2 to retrieve the operation history log information (S
204) First, the maximum value and the minimum value of the key input time are obtained for each input content, the time interval between the maximum value and the minimum value is set as the key input interval, and written in the input information memory 14 (S205).

Further, as for the input contents, the maximum value and the minimum value are calculated for the payout amount and the reception amount, and the range between the maximum value and the minimum value is set as an input warning value and written in the input information memory 14 (S206) ). FIG. 4 shows an example of the information written in the input information memory 14.

Next, the unauthorized operation monitoring device 3 obtains an operation order when input items and the like are input from the operation history log information, sets the operation order as operation pattern information, and writes it in the operation pattern information memory 15 (S207). ). FIG. 5 shows an example of this operation pattern information. As shown in FIG. 5, the content of the operation performed for each operator ID is recorded in the operation pattern information in the order of operation.

When the key input interval, the input warning value, and the operation pattern information are set in this way, the registration processing of the fraud detection information by the automatic registration ends.

If automatic registration is not selected in step S203, direct registration is performed by an operator operating the unauthorized operation monitoring device 3.

In this direct registration, the operator first inputs an arbitrarily set key input interval (S208), and similarly inputs an input warning value by the operator (S20).
9) The data is written to the input information memory 14.

Further, the operator also arbitrarily sets and inputs the operation pattern information (S210), and writes it into the operation pattern information memory 15.

When the key input interval, the input warning value, and the operation pattern information are input by the operator, the registration process of the fraud detection information by the direct registration is completed.

Next, based on the flowchart of FIG.
A description will be given of the monitoring process of the unauthorized operation based on the key input interval.

First, the unauthorized operation monitoring device 3 takes in the key input interval from the input information memory 14 (S601), and further takes in the key input time from the operation history log memory 12 (S602).

Then, it is determined whether or not the fetched key input time is within the range of the key input interval (S603).
When the key input time is not within the range of the key input interval, it is determined that the input is made by an unauthorized operator, and a warning message is output to the monitor 5 (S604), and a warning of the illegal operation is issued to the operator and the key is issued. The monitoring process of the unauthorized operation based on the input interval ends.

In step S603, when the key input time is within the range of the key input interval, it is determined that the input is performed by a legitimate operator, and the monitoring process for the illegal operation based on the key input interval is terminated.

Similarly, a monitoring process for an illegal operation based on an input warning value will be described with reference to the flowchart of FIG.

First, the unauthorized operation monitoring device 3 fetches an input warning value from the input information memory 14 (S701), and further fetches input contents for an input item from the operation history log memory 12 (S702).

Then, it is determined whether or not a numerical value such as the payout amount of the input content is within the range of the input warning value (S703). If the numerical value of the input content is not within the range of the input warning value, the data is invalid. It is determined that the input is performed by an appropriate operator, and a warning message is output to the monitor 5 (S70).
4) A warning of an illegal operation is issued to the operator, and the monitoring processing of the illegal operation based on the input warning value ends.

If it is determined in step S703 that the numerical value of the input content is within the range of the input warning value, it is determined that the input is made by a valid operator, and the process of monitoring for an illegal operation based on the input warning value ends.

Next, based on the flowchart of FIG.
A description will be given of a process of monitoring an unauthorized operation based on operation pattern information.

First, the unauthorized operation monitoring device 3 fetches operation pattern information from the operation pattern information memory 15 (S
801), the input items and the input contents are fetched from the operation history log memory 12 (S802).

Then, it is determined whether or not the operation order of the input contents fetched from the operation history log memory 12 is different from the operation pattern order (S803). And a warning message is output to the monitor 5 (S
804) A warning of an illegal operation is issued to the operator, and the illegal operation monitoring processing based on the operation pattern ends. However,
At this time, a setting may be made so that a warning is issued if at least one operation order is different, or a setting is made such that no warning is issued even if the operation order is different up to an arbitrarily set number.

In step S803, when the order of operation of the input contents matches the order of the operation patterns, it is determined that the input is made by a valid operator, and the process of monitoring unauthorized operation based on the operation pattern information ends.

As described above, the unauthorized operation monitoring device 3 according to the present embodiment acquires the operation history log information of the monitored computer system 2 and constantly monitors the information, so that an unauthorized input or operation by an unauthorized operator can be performed in real time. Can be found.

Further, unauthorized operation is monitored based on key input intervals, input warning values, and operation patterns.
Even if the password is stolen, unauthorized operations can be found.

[0046]

As described above, according to the unauthorized operation monitoring apparatus of the present invention, an unauthorized input or an unauthorized operation to the monitored computer system can be monitored in real time.

[Brief description of the drawings]

FIG. 1 is a block diagram showing the configuration of an embodiment of an unauthorized operation monitoring system according to the present invention.

FIG. 2 is a flowchart for explaining a process of registering fraud detection information in the fraudulent operation monitoring system shown in FIG. 1;

FIG. 3 is a diagram illustrating an example of operation history log information.

FIG. 4 is a diagram illustrating an example of input information.

FIG. 5 is a diagram showing an example of operation pattern information.

FIG. 6 is a flowchart illustrating a monitoring process of an unauthorized operation based on a key input interval.

FIG. 7 is a flowchart illustrating a process of monitoring an unauthorized operation based on an input warning value.

FIG. 8 is a flowchart illustrating a process of monitoring an unauthorized operation based on operation pattern information.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Unauthorized operation monitoring system 2 Monitored computer system 3 Unauthorized operation monitoring device 4 Input device 5 Monitor 11 Operation history log information acquisition means 12 Operation history log memory 13 Unauthorized discovery information registration means 14 Input information memory 15 Operation pattern information memory 16 Unauthorized operation Monitoring means

Claims (5)

[Claims] An operation history log information acquisition unit for acquiring operation history log information relating to a history of operation of a monitored computer system, and fraud detection information as information for detecting an unauthorized operation on the monitored computer system. Fraud detection information registering means for registering the fraudulent information registered in the fraud detection information registering means and the operation history log information to detect fraudulent operations on the monitored computer system An unauthorized operation monitoring device comprising: a monitoring unit. 2. The unauthorized operation monitoring according to claim 1, wherein the unauthorized detection information is a key input interval set by a time interval between a longest time and a shortest time when an input item is input. apparatus. 3. The unauthorized operation monitoring device according to claim 1, wherein the unauthorized detection information is an input warning value set based on a maximum value and a minimum value of numerical values of input contents. . 4. The unauthorized operation monitoring device according to claim 1, wherein the unauthorized detection information is an input pattern set in an order in which input items are input. 5. An operation history log information acquisition process for acquiring operation history log information relating to a history of operation of a monitored computer system, and fraud detection information as information for detecting an unauthorized operation on the monitored computer system. Fraud detection information registration processing for registering a fraudulent operation, and illegal operation for detecting fraudulent operation on the monitored computer system by comparing the fraud detection information registered in the fraud detection information registration processing with the operation history log information. An unauthorized operation monitoring program characterized by including a monitoring process.