JP2005100124A - Unauthorized access monitoring system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To minimize damage by monitoring cyber-attacks to memories and files of a terminal connected with a network. <P>SOLUTION: In a system being resident in a computer connected with the network or a monitor computer to a computer group connected with the network and having an unauthorized access monitoring module usually monitoring the memories and files of a computer and a user authentication means, when a program executing processing for a registered value or more is detected by the unauthorized access monitoring module, the user authentication is carried out by the user authentication means. Operation of the program is stopped under conditions that the user authentication is not approved. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to network security, and more particularly to an unauthorized access monitoring system of a host monitoring type.

  In recent years, unauthorized intrusion of computer viruses has attracted great interest in network systems. Registering the characteristics of a known virus (program) as a countermeasure against unauthorized computer viruses, checking each file in the computer and finding a program with the registered characteristics. Things are prevalent.

Also, if a hacker attacking the system breaks the antivirus system, it will not function effectively, so there is a system status collection module in the cyber computer that checks whether there was an intrusion by the hacker, and general operation A host-based intrusion detection system has been proposed in which non-persistent monitoring is performed in a format that does not differ from that of the system, and even experienced hackers are not aware of the presence of the system state collection module, increasing the difficulty of system hacking by hackers. Patent Document 1)
JP 2002-73553 A

However, in the method of registering already known characteristics of a virus and checking for a computer virus that has entered, the computer virus that has not been registered is defenseless, and once it has entered, a great damage will occur.
Further, even the method of Patent Document 1 cannot prevent the expansion of hacking damage once it has entered.

An object of the present invention is to solve the above-described problems, and it is an object of the present invention to monitor a cyber attack on a memory or a file of a terminal connected to a network and to minimize damage.
To this end, the present invention is a system comprising an unauthorized access monitoring module that always resides in a computer connected to a network or a group of computers connected to the network and constantly monitors the memory and files of the computer, and a user authentication means. When a program that executes processing exceeding the registered value is detected by the unauthorized access monitoring module, user authentication is performed by the user authentication means, and the operation of the program is stopped on the condition that user authentication is not established. It is characterized by.
In addition, the present invention is characterized in that, when processing exceeding the registered value is performed, it is further determined whether or not the program is based on the permission program, and the operation of the program is stopped when the processing is not based on the permission program.
Further, in the present invention, the registration value is a registration value of the number of renames, deletions, changes, or creations of new files, or the number of simultaneous mail transmissions to a registered mail address performed per unit time. It is characterized by being.
According to the present invention, the authentication means includes an IC card that is connectable to a computer in which the unauthorized access monitoring module resides and stores a personal authentication key. The input personal identification information and the authentication stored in the IC card. User authentication is performed based on the key.
Further, the present invention is characterized in that the authentication is performed in an IC card.

  The present invention can monitor a cyber attack on a memory or a file of a terminal connected to a network, and can minimize damage even if there is an unauthorized intrusion.

Embodiments of the present invention will be described below.
The fraud monitoring system of this embodiment is intended to minimize damage when a firewall or network-type unauthorized access monitoring program is broken by a hacker or when an unauthorized operation is performed by an inside intruder. is there. In other words, the computer's memory and files are constantly monitored, and when a predetermined amount or more of existing files are renamed, deleted, modified, or new files are created at a predetermined time, or a mass mail is sent to a predetermined number of registered email addresses When processing different from the normal program is performed, such as when transmission is performed, it is determined that the program is based on a hacking program, and a PIN (personal identification number) is used to confirm whether the command is issued by a previously authorized user. If the correct PIN is input, it is concluded that it is not an unauthorized access and the operation is continued. If an incorrect PIN is input, the change of all files is prohibited (stopped).

FIG. 1 is a conceptual diagram illustrating a fraud monitoring system according to this embodiment.
The computer 1 is connected to a network 3 such as the Internet, and has a resident unauthorized access monitoring program described later. An IC card 2 can be connected to the computer 1, and an authentication key of a user who uses the computer 1 is stored in the IC card. Although the case where the unauthorized access monitoring program is resident in each network-connected computer will be described here, the unauthorized access monitoring program may be resident in a monitoring computer for a network-connected computer group.

  First, the user is authenticated using the IC card 2 when the network computer 1 is activated. This authentication is performed by connecting the IC card 2 to the computer 1, starting an authentication program, and inputting a PIN. The authentication process is desirably performed in the IC card so that the authentication key does not leak outside. This is because a computer virus that performs unauthorized access cannot know the PIN in the IC card.

  Next, a registration value corresponding to the variable item of the unauthorized access monitoring program stored in the IC card is set in the program according to the user level. For example, settings such as changing, deleting, renaming, and creating a new file for 20 or more files per second are illegal, and sending 30 or more simultaneous mails are illegal. Of course, this set value is variable, and can be registered for each computer or IC card. By doing so, access control can be performed for each computer or for each user (IC card). Then, once a program that performs processing exceeding the set value is detected, the operation is temporarily stopped.

  Note that the computer and the IC card do not have to have a one-to-one correspondence. For example, one or more security administrators on the network may request authentication when a malicious program is detected on the computer. Furthermore, authentication of the number of security managers set in order to prevent fraud of the security managers may be requested.

  In the above description, user authentication is performed using an IC card. However, user authentication without using an IC card is also possible. For example, authentication by a program that requires password input may be performed, or input of a character string, a numerical value, a color, or the like displayed by a program that requires authentication may be requested from the user.

FIG. 2 is a conceptual diagram schematically showing a method for detecting a process of a set value or more.
The program 10 is a program that performs processing in the computer and, for example, performs processing such as file creation, file deletion, file renaming, or mail transmission. When performing these processes, the directory 13 managed by the OS 13 is accessed to obtain a program for performing the corresponding process, and then the memory / file 15 conceptually showing the memory and file is accessed to create a file and file. Deletion, file renaming, mail transmission, etc. are performed. Reference numeral 10 denotes an API (application interface). Therefore, in the present embodiment, when the program 10 accesses the directory 12 for file creation or the like, the information collection module 11 once intercepts this and monitors how many times the directory is accessed in one second, and is predetermined. If it is more than the number of times, it is determined that the access is unauthorized.

  In this way, when processing exceeding the set value is performed, it is determined whether the authentication user is responsible. This determination is made by prompting the user to enter a PIN, and checking whether the PIN entered using the authentication key stored in the IC card is correct. If it is determined that the correct PIN has been input as a result of authentication, the operation is resumed. If it is determined that the access is unauthorized, all changes to the computer are prohibited and a beep sound, screen display, Give a warning by notification (email or screen). Note that user authentication is desirably performed in the IC card, and biometric information may be used in combination.

  Monitoring of unauthorized access by the unauthorized monitoring program continues until the computer is logged off. Also, if the IC card is a non-contact type and the user leaves the IC card, the registration value (20 per second, 30 simultaneous email transmissions, etc.) is reset to the most difficult default value. It may be allowed to return, or file creation, file deletion, file renaming, mail transmission, etc. are not permitted at all.

  When determining whether or not unauthorized access is made, a check may be made as to whether or not the processing above the set value is due to a permission program or application that performs a similar operation. The permission program and application can be registered in the system in advance, and can be easily determined by checking whether or not the registered program corresponds to the registered program. By registering a program that performs an operation similar to the monitoring operation in this way in advance, it is possible to prevent a burden on the system (monitoring target limitation) and the user (PIN input).

FIG. 3 is a diagram for explaining an example of the fraud monitoring process flow. Note that this processing flow shows an example in which a determination as to whether or not the program is a permitted program is added when the operation of the program is stopped.
When unauthorized access is monitored and unauthorized operation is detected (steps S1 and S2), the program operation is stopped (step S3). Next, it is checked whether the unauthorized program is caused by the permitted program (step S4). The permission program can be easily checked by registering the system. If the permitted program is not the cause, a PIN input is obtained (step S5), and it is determined whether or not it is a legitimate PIN input (step S6). If it is not a legitimate PIN, an unauthorized access is warned (step S7). If the permission program is the cause in step S4, and if it is a valid PIN in step S6, the operation is restarted (step S8), and the process returns to step S1 to monitor unauthorized access.

  As described above, according to the present invention, it is possible to monitor a cyber attack on a memory or file of a terminal connected to a network, and to minimize damage even if there is an unauthorized intrusion. Is big.

It is a conceptual diagram explaining the fraud monitoring system of this embodiment. It is a conceptual diagram explaining the method to detect the process more than a setting value. It is a figure explaining the example of a fraud monitoring process flow.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Computer, 2 ... IC card, 3 ... Network, 10 ... Program, 11 ... Information collection module, 12 ... Directory, 13 ... OS, 14 ... API, 15 ... Memory / file.

Claims (5)

An unauthorized access monitoring module that resides in a computer connected to a network or a group of computers connected to a network and constantly monitors the memory and files of the computer;
A system comprising user authentication means,
When a program that executes processing exceeding the registered value is detected by the unauthorized access monitoring module, user authentication is performed by the user authentication means, and the operation of the program is stopped on condition that user authentication is not established. Unauthorized access monitoring system. 2. The unauthorized access monitoring system according to claim 1, wherein when the processing exceeding the registered value is performed, it is further determined whether or not the program is based on the permitted program, and the operation of the program is stopped when the processing is not based on the permitted program. The registered value is a registered value of the number of renames, deletions, changes, or creations of new files, or the number of simultaneous mail transmissions to a registered mail address performed per unit time. The unauthorized access monitoring system according to claim 1 or 2. The authentication means can be connected to a computer in which the unauthorized access monitoring module resides, includes an IC card storing a personal authentication key, and performs user authentication based on the input personal identification information and the authentication key stored in the IC card The unauthorized access monitoring system according to claim 1, wherein: 5. The unauthorized access monitoring system according to claim 4, wherein the authentication is performed in an IC card.

Images