JP2004118699A - Unauthorized access detection device, its method, computer program, and recording medium with computer program recorded thereon - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To detect an unauthorized access to a computer system which performs authentication twice or more. <P>SOLUTION: A communication record collection part 11 in an unauthorized intruder detection system 1 acquires a communication record obtained by collecting logs each of which includes the address of a connecting source, user identification information and connection time or disconnection time on the basis of user authentication to a server and a communication record obtained by collecting logs connected on the basis of user authentication to a server connected in the connection to the server concerned. An unauthorized access determination part 13 retrieves a log between the connection time of a log including connection time included in the communication record of the server connected ahead and the disconnection time of a log including the address of the log and the user identification information included in the communication record and disconnection time nearest to the connection time of the log from the communication record of the server connected later and compares the user identification information of the log of the server connected ahead with that of the log of the server connected later. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an unauthorized access detection device, an unauthorized access detection method, a computer program for executing the method, and a recording medium on which the computer program is recorded, which can detect unauthorized access to a computer system in which authentication is performed a plurality of times.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, a computer system that handles personal important information and confidential information has been required to have high security. Therefore, the same user may be subjected to, for example, a plurality of authentication processes for each purpose.
[0003]
FIG. 10 is a diagram illustrating an operation of a computer system in which authentication is performed a plurality of times for each purpose. The computer system performs a first authentication (dial-up authentication) for specifying an accessing user, and if this is successful, performs a second authentication for restricting a function to be used, and if this is successful, specifies personal data. The third authentication is performed, and if this is successful, the personal information of the user and the confidential information of the user are used.
[0004]
Specifically, the system is set to use the user A as a user, dialed up from a line used by the user A, and recognized by the system as the calling number 1111111, and changed to the user ID “AAA” of the user A. When the password “aaa” is input, the first authentication is successful. After that, the second authentication is successful by inputting the user A's user ID and the like. Thereafter, the third authentication is made successful by inputting the user ID of the user A or the like.
[0005]
In the system, the same settings are made for the other user B and the like, and the system operates such that the user who has succeeded in the three-step authentication uses the personal information of the user.
[0006]
Also, a technique is known in which an authentication device (for example, a firewall) for externally accessing a network notifies a user who has been subjected to the authentication at the time of authentication that access has been made. For example, when A tries to enter the network using B's user ID and password, B uses registered means (e-mail, telephone, etc.) to register a registered notification destination address (e-mail address, telephone Number, etc.) that the network has been accessed. This allows B to detect that A has impersonated himself (see Patent Document 1).
[0007]
[Patent Document 1]
JP-A-2002-91917
[0008]
[Problems to be solved by the invention]
However, in a conventional computer system in which authentication is performed a plurality of times, since the correlation between individual authentications is not checked, spoofing (theft of another user's user ID or password, pretending to be that person, and impersonating the network) Activity) cannot be detected.
[0009]
That is, as shown in FIG. 10, since the system is set to use the user B as a user, the system is dialed up from the line recognized as the calling number 2222222 of the user B, and the user ID of the user B “BBB” And the password “bbb” are input, the first authentication is successful. After that, the second authentication is successfully performed by inputting the user ID of the user B, but the third authentication succeeds even if the user ID of the user A is input. A's personal information can be used.
[0010]
The present invention has been made in view of the above-described conventional problems, and has as its object to provide an unauthorized access detection device and an unauthorized access detection method capable of detecting unauthorized access to a computer system in which authentication is performed a plurality of times. And a computer program for executing the method, and a recording medium on which the computer program is recorded.
[0011]
[Means for Solving the Problems]
In order to solve the above-mentioned conventional problem, the present invention according to claim 1 includes a connection source address, user identification information, and connection time or disconnection time recorded by connection and disconnection with user authentication to a server. A communication record that collects logs and a communication that collects logs including a connection source address, user identification information, and connection time recorded by a connection with user authentication to a server connected during connection to the server. Communication record acquisition means for acquiring the record via a communication line, and the connection time of the log including the connection time in the communication record of the server connected earlier, which is acquired by the communication record acquisition means, The connection time and the address between the log address and the user identification information in the communication record and the log disconnection time including the disconnection time closest to the log connection time are included. Log search means for searching a log from a communication record of a server connected later, which is obtained by the communication record obtaining means, and a log including a connection time in a communication record of the server connected earlier. The unauthorized access detection device includes an unauthorized access detection device that compares the user identification information of the log with the user identification information of the log retrieved from the communication record of the server connected later.
[0012]
According to the first aspect of the present invention, a communication record that collects logs including a connection source address, user identification information, and connection time or disconnection time recorded by connection and disconnection with user authentication to a server; Via a communication line, a communication record that collects logs including a connection source address, a user identification information, and a connection time recorded by a connection with user authentication to a server connected during connection to the server is connected. The connection time of the log obtained by the communication record obtaining means and including the connection time in the communication record of the server connected earlier, the address and user identification information of the log in the communication record, and the connection of the log The log search unit searches a log including the connection time between the log including the disconnection time closest to the time and the relevant connection time and the address from the communication record of the server connected later. Then, the user identification information of the log including the connection time in the communication record of the server connected earlier and the user identification information of the log searched from the communication record of the server connected later are illegally changed. Since the access detection means makes a comparison, an unauthorized access can be detected based on whether or not these pieces of user identification information are different from each other.
[0013]
Further, according to a second aspect of the present invention, when the user identification information to be compared is different from each other, the unauthorized access detecting means performs a process set in advance as a case where there is an unauthorized access. The unauthorized access detection device according to claim 1 is a solution.
[0014]
According to the present invention of claim 2, when the user identification information to be compared is different from each other, the unauthorized access detection means stores these logs in the storage device as a process preset as a case of unauthorized access. Processing such as storage, display on a display device, and printing on a printing device can be performed.
[0015]
Further, the present invention according to claim 3 is a communication record that collects a log including a connection source address, user identification information, connection time or disconnection time recorded by connection and disconnection with user authentication to the server, Via a communication line, a communication record that collects logs including a connection source address, a user identification information, and a connection time recorded by a connection with user authentication to a server connected during connection to the server is connected. The communication record obtaining step to obtain, the connection time of the log including the connection time in the communication record of the server connected earlier, which is obtained in the communication record obtaining step, and the connection time of the log in the communication record. The log including the connection time and the address between the log and the disconnection time of the log including the address and the user identification information and the disconnection time closest to the connection time of the log is obtained in the communication record obtaining step. A log search step of searching the acquired communication record of the server to be connected later, and the user identification information of the log including the connection time in the communication record of the server connected earlier, The unauthorized access detection method includes an unauthorized access detection step of comparing the log with the user identification information of the searched log from the communication record of the server.
[0016]
According to the third aspect of the present invention, a communication record that collects logs including a connection source address, user identification information, and connection time or disconnection time recorded by connection and disconnection with user authentication to the server; Via a communication line, a communication record that collects logs including a connection source address, a user identification information, and a connection time recorded by a connection with user authentication to a server connected during connection to the server is connected. The connection time of the log acquired in the communication record acquisition stage and including the connection time in the communication record of the server connected earlier, the address and user identification information of the log in the communication record, and the connection of the log In the log search stage, a log including the connection time between the log including the disconnection time closest to the time and the relevant address and the relevant address is found in the communication record of the server connected later. Then, the user identification information of the log including the connection time in the communication record of the server connected earlier and the user identification information of the log searched from the communication record of the server connected later are illegally changed. Since the comparison is performed at the access detection stage, unauthorized access can be detected based on whether or not these pieces of user identification information are different from each other.
[0017]
According to a fourth aspect of the present invention, when the user identification information to be compared in the unauthorized access detecting step is different from each other, a process set in advance as a case of unauthorized access is performed. The unauthorized access detection method described in item 1 is a solution.
[0018]
According to the fourth aspect of the present invention, when the user identification information to be compared in the unauthorized access detection stage is different, these logs are stored in the storage device as a process which is set in advance as a case where there is an unauthorized access. For example, it is possible to perform a process of causing the display device to display the image, displaying the image on a display device, or printing the image on a printing device.
[0019]
According to a fifth aspect of the present invention, there is provided a computer program that executes the unauthorized access detection method according to the third or fourth aspect.
[0020]
According to the fifth aspect of the present invention, since the computer program can detect unauthorized access to a computer system in which authentication is performed a plurality of times, the program can be distributed.
[0021]
According to a sixth aspect of the present invention, there is provided a recording medium storing a computer program for executing the unauthorized access detecting method according to the third or fourth aspect.
[0022]
According to the sixth aspect of the present invention, since the recording medium stores a computer program capable of detecting unauthorized access to a computer system in which authentication is performed a plurality of times, the medium can be distributed by delivery.
[0023]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0024]
FIG. 1 is a diagram showing a configuration and a use form of an unauthorized intruder detection system 1 in which an unauthorized intruder detection device of the present invention is applied to an embodiment. The unauthorized intruder detection system 1 is a computer system configured in the WWW server 10 of the account information providing center 100. The specification information providing center 100 includes a radius server 2 and a firewall server (hereinafter, referred to as a firewall) 3. The WWW server 10 is provided with a detailed information providing system 4. The specification information providing center 100 is configured to be able to communicate with each user terminal 200 used by a user of the WWW server 10 via a public line network.
[0025]
The RADIUS server 2 includes an authentication unit 21 and a communication recording unit 22. The authentication unit 21 performs dial-up authentication on the user terminal 200, and information related thereto is communicated by the communication recording unit 22 to the communication record 23 (also referred to as a router communication record 23). ). That is, the communication recording unit 22 records the router connection log 23A in the router communication record 23 when the authentication unit 21 performs dial-up authentication in response to the connection request from the user terminal 200, and when the communication link is disconnected, the router records the router connection log 23A. A router disconnection log 23B is recorded in the communication record 23. Therefore, the router communication record 23 is in a state where the router connection log 23A and the router disconnection log 23B are arranged in the order of the connection time or the disconnection time.
[0026]
The router connection log 23A includes a time at which authentication was successful (hereinafter, referred to as a connection time, and the term is also applied to authentication at the firewall 3 and the detailed information providing system 4), an IP address of a connection source, and user identification information (hereinafter, referred to as “connection time”). , User ID), state, and calling number. The router disconnection log 23B includes a communication link disconnection time, a connection source IP address, a user ID, a state, and a calling number.
[0027]
In the router connection log 23A, the state is recorded as connection OK when the authentication is successful, recorded as connection NG when the authentication is not successful, and recorded as undeterminable when the determination is impossible. The status in the router disconnection log 23B is recorded as “OK” when the communication link is normally disconnected, and is recorded as “Undetermined” when the determination is impossible. Note that such status recording is similarly performed for logs in the firewall 3 and the detailed information providing system 4, which will be described later, and the recorded contents are also the same.
[0028]
Note that the router connection log 23A and the router disconnection log 23B are collectively referred to as a router log.
[0029]
The firewall 3 includes an authentication unit 31 and a communication recording unit 32. When the authentication by the authentication unit 21 of the RADIUS server 2 is successful, the authentication unit 31 authenticates the user terminal 200, and information related thereto is stored in the communication recording unit. 32 is recorded in a communication record 33 (hereinafter, also referred to as FW communication record 33). That is, the communication recording unit 32 records the FW connection log 33A in the FW communication record 33 when the authentication unit 31 authenticates the use request of the protocol from the user terminal 200. Communication is performed according to a preset protocol. When the communication link is disconnected, the FW disconnection log 33B is recorded in the FW communication record 33. Therefore, the FW communication record 33 is in a state where the FW connection log 33A and the FW disconnection log 33B are arranged in the order of the connection time or the disconnection time.
[0030]
The FW connection log 33A includes a connection time, a connection source IP address, a user ID, and a state. The FW disconnection log 33B includes a disconnection time, a connection source IP address, a user ID, and a status. Note that such status recording is performed in the same manner as the above-described recording in the log in the RADIUS server 2, and the recorded content is also the same.
[0031]
The FW connection log 33A and the FW disconnection log 33B are collectively referred to as FW logs.
[0032]
The specification information providing system 4 includes an authentication unit 41 and a communication recording unit 42. When the authentication by the authentication unit 31 of the firewall 3 is successful, the authentication unit 41 authenticates the user terminal 200 and transmits information related thereto. The recording unit 42 records in a communication record 43 (hereinafter, also referred to as a WWW communication record 43). The communication recording unit 42 records the WWW connection log 43A in the WWW communication record 43 when the authentication unit 41 authenticates a file use request from the user terminal 200. Therefore, the WWW communication record 43 is in a state where the WWW connection logs 43A are arranged in the order of the connection time. The WWW connection log 43A includes a connection time, a connection source IP address, a user ID, and a state. Note that such state recording is performed in the same manner as the recording in the log of the above-described radius server 2 and the like, and the recorded contents are also the same.
[0033]
Note that the router log, the FW log, and the WWW connection log are collectively referred to as “log”.
[0034]
Further, the detailed information providing system 4 includes a detailed information providing unit 44 and detailed information 45 for service users, and after the authentication by the authentication unit 41, the detailed information providing unit 44 provides the detailed information 45 for service users to the user terminal 200. It is supposed to.
[0035]
In FIG. 1, the authentication path from the user terminal 200 to the use of the service user statement information 45 is indicated by a broken line.
[0036]
The unauthorized intruder detection system 1 is a computer system including a communication record collecting unit 11, a communication record organizing unit 12, an unauthorized access determining unit 13, and a result editing unit 14. These units are realized by a computer program being read from a storage device such as a fixed magnetic disk device storing the program into the unauthorized intruder detection system 1 and executed by an arithmetic processing unit of the system.
[0037]
The communication record collection unit 11 is a processing unit that collects communication records, that is, acquires the router communication record 23 from the RADIUS server 2, the FW communication record 33 from the firewall 3, and the WWW communication record 43 from the detailed information providing system 4. . That is, the communication record collecting unit 11 includes, as a communication record acquisition unit, the address of the connection source, the user identification information, and the connection time or disconnection time recorded by the connection and disconnection with the user authentication to the server at the communication record acquisition stage. A communication record that collects logs and a communication that collects logs including a connection source address, user identification information, and connection time recorded by a connection with user authentication to a server connected during connection to the server. The record is obtained via a communication line.
[0038]
The communication record organizing unit 12 is a processing unit for organizing the communication records 23, 33, and 43 collected by the communication record collecting unit 11.
[0039]
The unauthorized access determining unit 13 is a processing unit that selects, from each communication record after being organized by the communication record organizing unit 12, a log recorded at the time of unauthorized access to the detailed information providing system 4 and a log related thereto. is there.
[0040]
More specifically, the unauthorized access determination unit 13 determines the connection time in the communication record of the server connected earlier, which was acquired in the communication record acquisition stage by the communication record collection unit 11 in the log search stage as the log search means. And the connection time between the connection time of the log including the log, the address and the user identification information of the log in the communication record, and the disconnection time of the log including the disconnection time closest to the connection time of the log. A log including the address is retrieved from the communication record of a server connected later, which is acquired from the communication record collection unit 11 in the communication record acquisition stage. In the unauthorized access detection step, the unauthorized access determination unit 13 performs, in the unauthorized access detection step, the user identification information of the log including the connection time in the communication record of the server connected first, and the server connected later. Is compared with the user identification information of the retrieved log from the communication record of the log. Further, when the user identification information to be compared is different from each other, the unauthorized access determination unit 13 records a log in which the user identification information is different from each other in a file as a record indicating that there has been an unauthorized access.
[0041]
The result editing unit 14 is a processing unit for organizing the determination result of the unauthorized access and the like. In addition, as files for recording the determination result and the like, an unauthorized access user list file 15a, a router disconnection user list file 15b, an FW disconnection user list file 15c, an error file 15d, and a break file 15e are used.
[0042]
Next, the operation of the unauthorized intruder detection system 1 will be described. For convenience of explanation, the router communication record 23, the FW communication record 33, and the WWW communication record 43 are stored on the corresponding date as shown in FIG. It is assumed that the content of the processing is reflected. Further, a user with a user ID “XXX” (X is one letter of the alphabet) is referred to as “X user”. For example, the user with the user ID “AAA” is described as “user A”.
[0043]
First, when the communication record collection unit 11 is started at a fixed time or manually, communication records are collected. That is, the router communication record 23 is obtained from the radius server 2, the FW communication record 33 is obtained from the firewall 3, and the WWW communication record 43 is obtained from the detailed information providing system 4.
[0044]
The router communication record 23 and the FW communication record 33 are acquired as files using the ftp function. On the other hand, the WWW communication record 43 is converted into a file after acquisition using a read command.
[0045]
As shown in FIG. 3, since each connection log and disconnection log of the router communication record 23, the FW communication record 33, and the WWW communication record 43 have the date recorded, the past date is designated when the computer is started up. In this case, it is possible to extract only the date on which the date is specified.
[0046]
At the end of each day, the RADIUS server 2 and the firewall 3 file only the date of the current date, store the date in the file name, and save them as the router communication record 23 and the FW communication record 33, respectively. The communication record collection unit 11 obtains a file including the specified date in the file name from the radius server 2 and the firewall 3 using the ftp function.
[0047]
On the other hand, as for the WWW communication record 43, only the data on the specified date is extracted from the file obtained after acquisition using the read command.
[0048]
FIG. 4 is a diagram exemplifying the communication records 23, 33, 43 after the execution of the above-described processing by the communication record collection unit 11. As described above, it is assumed that the communication records 23, 33, and 43 have been designated as of February 2, 2002, and reflect only the processing contents of FIG.
[0049]
Next, the communication record organizing unit 12 transfers abnormal logs (for example, logs that do not follow the log format) in the communication records 23, 33, and 43 to the error file 15d. If the date is not specified, a log in which a predetermined number of days have elapsed is output to the error file 15d.
[0050]
Next, the communication record organizing unit 12 sorts the communication records 23, 33, and 43 using the first sort key as an IP address and the second sort key as a connection time or a disconnection time.
[0051]
FIG. 5 is a diagram showing the communication records 23, 33, and 43 after the above-described processing has been performed by the communication record organizing unit 12. As shown in this figure, in the router communication record 23 at this time, the log at 18:00, which was recorded in the router communication record 23 of FIG. 4 and whose status was determined to be undeterminable, has already been moved to the error file 15d. Have been.
[0052]
Next, the unauthorized access determination unit 13 performs a check / matching process on the communication records 23, 33, and 43 shown in FIG.
[0053]
First, a log whose status is not OK is extracted from the router communication record 23 and output to the router disconnected user list file 15b. Further, a log whose status is other than OK is extracted from the FW communication record 33 and output to the FW disconnected user list file 15c. If the connection log and the disconnection log are not aligned in the router communication record 23 and the FW communication record 33, the surplus log is output to the break file 15e.
[0054]
Therefore, the router connection log 23A at 17:00 in which the status is set to connection NG in the router communication record 23 of FIG. 5 is output to the FW disconnected user list file 15c.
[0055]
Next, the presence / absence check of the same IP between three points is performed. Specifically, the processing 51 following the first log (simply referred to as a router log, FW log, and WWW connection log) in each of the communication records 23, 33, and 43 is performed, and the processing 52 is subsequently performed.
[0056]
(Equation 1)
Process 51:
When router log IP address <FW log IP address
→ Since there is no FW log corresponding to the router log, the router log is output to the break file 15e.
When router log IP address> FW log IP address
→ Since there is no router log corresponding to the FW log, the FW log is output to the break file 15e.
When router log IP address = FW log IP address
→ Both the router log and the FW log are recorded in the communication records 23 and 33.
Process 52:
When router log IP address = FW log IP address = WWW connection log IP address
→ The router log, the FW log, and the WWW log are left in each of the communication records 23, 33, and 43.
When router log IP address = FW log IP address <WWW connection log IP address
→ Since there is no WWW log corresponding to the router log and the FW log, the router log and the FW log are output to the break file 15e.
When router log IP address = FW log IP address> WWW connection log IP address
→ Since there is no router log and FW log for the WWW log, the WWW log is output to the break file 15e.
[0057]
FIG. 6 is a diagram showing the communication records 23, 33, and 43 after the execution of the above-described processing by the unauthorized access determination unit 13. As shown in this figure, in the router communication record 23 at this time, the log at 17:00, which was present in the router communication record 23 of FIG. 5 and whose status was recorded as connection NG, has already been moved to the break file 15e. Have been. Similarly, the router logs at 16:00 and 16:03 that existed in the router communication record 23 of FIG. 5 have been moved to the break file 15e. The FW logs of 16:02 and 16:03 that existed in the FW communication record 33 of FIG. 5 have been moved to the break file 15e.
[0058]
Next, the unauthorized access determination unit 13 performs a range time check on each of the communication records 23, 33, and 43 shown in FIG.
[0059]
That is, the following check is performed for logs having the same IP address.
[0060]
Connection time of router connection log 23A ≦ connection time of FW connection log 33A, and disconnection time of router disconnection log 23B ≧ disconnection time of FW disconnection log 33B, and connection time of FW connection log 33A ≦ connection of WWW connection log 43A. When the time and the disconnection time of the FW disconnection log 33B ≧ the connection time of the WWW connection log 43A, the range time check is OK, and the logs are left in the communication records 23, 33, and 43. 15e.
[0061]
FIG. 7 is a diagram illustrating the communication records 23, 33, and 43 after the execution of the range time check by the unauthorized access determination unit 13. As shown in this figure, in the router communication record 23 at this time, the router logs at 19:00 and 20:00 that existed in the router communication record 23 in FIG. 6 have already been moved to the break file 15e. Similarly, the FW logs of 19:02 and 20:00 that existed in the FW communication record 33 of FIG. 6 have already been moved to the break file 15e. Also, the WWW connection log 43A of 18:55, which existed in the WWW communication record 43 of FIG. 6, has already been moved to the break file 15e.
[0062]
Next, the unauthorized access determination unit 13 performs unauthorized determination on each of the communication records 23, 33, and 43 shown in FIG.
[0063]
That is, logs with different user IDs are extracted from the logs of the same IP address and output to the unauthorized access user list file 15a. It should be noted that the same IP address does not always correspond in a 1: 1: 1 manner, so processing is performed by a user ID matching method.
[0064]
FIG. 8 is a diagram illustrating a user ID matching method. Here, for convenience of explanation, the connection time of the FW connection log indicated by (1), the disconnection time of the FW disconnection log indicated by (1), the connection time of the FW connection log indicated by (2), and the FW indicated by (2) The disconnection time of the disconnection log is within the range between the connection time of the router connection log indicated by (1) and the disconnection time of the router disconnection log indicated by (1).
[0065]
The connection time of the WWW log indicated by (1), (2), (3) and (4) is the connection time of the FW connection log indicated by (1) and the disconnection time of the FW cut log indicated by (1). And within the range. The connection time of the WWW log indicated by (5), (6) and (7) is a range between the connection time of the FW connection log indicated by (2) and the disconnection time of the FW cut log indicated by (2). It is assumed that
[0066]
(Equation 2)
(1) Check the user ID of the router log (1) and the user ID of the FW log (1).
→ If there is a mismatch, the fact that there is a mismatch is stored in the FW.
(2) Check the user ID of the FW log (1) and the user ID of the WWW log (1).
→ If they do not match, the fact that they do not match is stored in WWW.
(3) Check the user ID of the FW log (1) and the user ID of the WWW log (2).
→ If they do not match, the fact that they do not match is stored in WWW.
(4) The same processing is performed from WWW log (3) to WWW log (4).
(5) Check the user ID of the router connection log (1) and the user ID of the FW log (2).
→ If there is a mismatch, the fact that there is a mismatch is stored in the FW.
(6) Check the user ID of the FW log (2) and the user ID of the WWW log (5).
→ If they do not match, the fact that they do not match is stored in WWW.
(7) The same processing is performed for the WWW logs (6) and (7).
(8) Based on the stored mismatch information, the router connection log (1), the FW connection log (1), and the WWW log (1) in which a mismatch has occurred are described in the unauthorized access user list file 15a.
[0067]
Next, the result editing unit 14 attaches a header (title) to the data of the unauthorized access user list file 15a, the router disconnection user list file 15b, and the FW disconnection user list file 15c, and edits the line feed and the like so that the data can be easily viewed. To
[0068]
FIG. 9 is a diagram showing the states of the unauthorized access user list file 15a, the router disconnected user list file 15b, and the FW disconnected user list file 15c after processing by the result editing unit 14.
[0069]
The unauthorized access user list file 15a includes a result including a user ID of an unauthorized access log obtained by changing the user ID to an unauthorized user ID, and a user ID of a regular access log accessed with a regular user ID. Since the results are associated with each other, it is possible to list unauthorized users.
[0070]
Specifically, as shown in FIG. 9, the unauthorized access user list file 15a includes an unauthorized access made by changing the user ID from “BBB” to “GGG” and a user ID changed from “CCC” to “FFF”. A log of unauthorized access made after the change is recorded. A program for displaying the log stored in the unauthorized access user list file 15a on the display device or printing the log on the printing device is set in the unauthorized intruder detection system 1, and the program is activated to execute the processing. May be actually performed.
[0071]
The router disconnection user list file 15b records information when the router authentication is not successful (NG) due to a password error or the like. In the FW disconnected user list file 15c, information when FW authentication is not successful (NG) due to a password error or the like is recorded.
[0072]
Note that the computer program that causes the unauthorized intruder detection system 1 to execute the above-described processing is recorded on a computer-readable recording medium such as a semiconductor memory, a magnetic disk, an optical disk, a magneto-optical disk, and a magnetic tape, and then recorded on the recording medium. Can be widely distributed by transporting or storing it in a server such as the Internet and then transmitting it via a communication network. Further, in the present invention, the address may be not only the IP address as described above but also another type of address.
[0073]
【The invention's effect】
As described above, according to the present invention, a communication record in which a log including a connection source address, user identification information, and connection time or disconnection time recorded by connection and disconnection with user authentication to a server is collected. And a communication record that collects logs including the connection source address, user identification information, and connection time recorded by the connection with user authentication to the server connected during the connection to the server. Via the server, the connection time of the log including the connection time in the communication record of the server connected earlier, and the address and user identification information of the log in the communication record and the connection time of the log. A log including the connection time between the disconnection time of the log including the close disconnection time and the relevant address is searched from the communication record of the server connected later, and the server connected earlier is searched. Since the user identification information of the log including the connection time in the communication record of the server is compared with the user identification information of the log retrieved from the communication record of the server to be connected later, a plurality of authentications are performed. Unauthorized access to the computer system in which is performed can be detected.
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration and a use form of an unauthorized intruder detection system 1 to which the present invention is applied.
FIG. 2 is a diagram showing an initial router communication record 23, FW communication record 33, and WWW communication record 43.
FIG. 3 is a diagram showing that the initial router communication record 23, FW communication record 33, and WWW communication record 43 are dated.
FIG. 4 is a diagram exemplifying communication records 23, 33, and 43 after execution of processing by a communication record collection unit 11;
FIG. 5 is a diagram showing communication records 23, 33, and 43 after execution of processing by the communication record organizing unit 12.
FIG. 6 is a diagram showing communication records 23, 33, and 43 after execution of processes 51 and 52 by the unauthorized access determination unit 13;
FIG. 7 is a diagram showing communication records 23, 33, and 43 after execution of a range time check by the unauthorized access determination unit 13;
FIG. 8 is a diagram showing a user ID matching method.
FIG. 9 is a diagram showing states of an unauthorized access user list file 15a, a router disconnected user list file 15b, and a FW disconnected user list file 15c after processing by the result editing unit 14.
FIG. 10 is a diagram illustrating an operation of a computer system in which authentication is performed a plurality of times for each purpose.
[Explanation of symbols]
1 Intruder detection system
2 Radius server
3 Firewall server
4 Detail information providing system
10 WWW server
11 Communication record collection unit
12 Communication Record Arrangement Department
13 Unauthorized access judgment unit
21, 31, 41 Authentication Department
22, 32, 42 Communication recording unit
23, 33, 43 Communication record
100 statement information providing center
200 user terminal

Claims (6)

A communication record that collects logs including a connection source address, user identification information, and connection time or disconnection time recorded by connection and disconnection with user authentication to the server, and is connected during connection to the server. Communication record acquisition means for acquiring, via a communication line, a communication record in which a log including a connection source address, user identification information, and connection time recorded by a connection with user authentication to a server is obtained,
The connection time of the log including the connection time in the communication record of the server connected earlier, which is acquired by the communication record acquisition means, the address and user identification information of the log in the communication record, and the log The log including the connection time and the address between the disconnection time of the log including the disconnection time closest to the connection time of the log obtained by the communication record obtaining unit, and the communication record of the server to be connected later Log search means for searching from inside,
Unauthorized comparison between the user identification information of the log including the connection time in the communication record of the server connected earlier and the user identification information of the log searched from the communication record of the server connected later. An unauthorized access detection device comprising access detection means. 2. The unauthorized access detection device according to claim 1, wherein when the user identification information to be compared is different, the unauthorized access detection unit performs a process set in advance as a case where there is an unauthorized access. A communication record that collects logs including a connection source address, user identification information, and connection time or disconnection time recorded by connection and disconnection with user authentication to the server, and is connected during connection to the server. A communication record acquisition step of acquiring, via a communication line, a communication record that has collected logs including a connection source address, user identification information, and connection time recorded by a connection with user authentication to the server,
The connection time of the log including the connection time in the communication record of the previously connected server, the address and the user identification information of the log in the communication record, and the log acquired in the communication record acquisition stage. The disconnection time of the log including the disconnection time closest to the connection time, the log including the connection time between the connection time and the address, the log obtained in the communication record obtaining step, the communication record of the server to be connected later A log search stage to search from inside,
Unauthorized comparison between the user identification information of the log including the connection time in the communication record of the server connected earlier and the user identification information of the log searched from the communication record of the server connected later. An unauthorized access detection method comprising an access detection step. 2. The unauthorized access detection method according to claim 1, wherein when the user identification information to be compared in the unauthorized access detection step is different from each other, a process set in advance as an unauthorized access is performed. A computer program for executing the unauthorized access detection method according to claim 3. A recording medium storing a computer program for executing the unauthorized access detection method according to claim 3.

Images