JP2006040196A - Software monitoring system and monitoring method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a software monitoring system and method capable of taking adequate measures by effectively detecting a terminal device having a software vulnerable or infected with a malware. <P>SOLUTION: The system monitors a state of the software in the terminal device connected to a network by a monitoring device. The monitoring device includes a first database for housing feature information of the defined software including feature information of a file as a cause of vulnerability and a file generated when infected with the malware, and a second database for sequentially acquiring and holding the feature information of the file the terminal device has by its own. The monitoring device transmits an inspection request and the feature information housed in the first database to the terminal device through the network. The terminal device verifies an existence of the file relating to the feature information by retrieving the second database, and transmits the verification result to the monitoring device. The monitoring device determines the vulnerability and a malware infection state of the terminal device, conducts access control, and prevents expansion of damage. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a software monitoring system and a monitoring method, and more particularly, in a system for monitoring the state of a terminal device connected to a network with a monitoring device, a terminal device with a low security level based on software information of the terminal device The present invention relates to a software monitoring system and a monitoring method for detecting an error.

  In a network system configured by connecting a plurality of terminal devices to the network, by monitoring the software information that the terminal device has, verify the security of software such as the presence of vulnerabilities and the presence or absence of virus infection, It is known to detect a terminal device with a low security level. In accordance with the verification result, measures are taken for the terminal device, thereby improving the security level of the entire network.

  Known techniques for discovering a terminal device with a low security level include a vulnerability verification processing method and a virus and worm (hereinafter also simply referred to as malware) infection verification processing method.

  Regarding the former vulnerability verification processing, for example, in Japanese Patent Application Laid-Open No. 2003-271469 (Patent Document 1), an inspection console collects file information and registry information from a computer that is a client device connected to a network, Techniques for detecting the status and vulnerability of client devices are disclosed.

  Regarding the latter malware infection verification processing, for example, in Japanese Patent Laid-Open No. 2002-222094 (Patent Document 2), a server collects processing information related to detection and deletion of viruses from a plurality of clients, and performs anti-virus measures. A technique for performing execution instructions and management in an integrated manner is disclosed.

JP 2003-271469 A JP 2002-222094 A

  In order to discover a terminal device with a low security level by the conventional technology as described above, it is necessary to prepare two software, software that performs vulnerability verification processing and software that performs malware infection verification processing.

  Further, in the malware infection verification process, it takes a lot of time and consumes many resources to search and process all the files of the terminal device to be monitored. Furthermore, since the process for verifying the malware infection takes time, it promotes fraudulent activities such as secondary infection of malware, destruction activities, information leakage, and the like, increasing the risk of spreading damage.

An object of the present invention is to verify the safety of software and detect a terminal device with a low security level.
More specifically, the present invention provides a software monitoring system and method capable of efficiently detecting a terminal device having vulnerable software or a terminal device infected with malware and taking appropriate measures. It is to provide.

  The software monitoring system according to the present invention is a system that monitors the state of software of a terminal device connected to a network by a monitoring device, and the monitoring device stores feature information including characteristics of software used in the system. The first database and a processing device that executes at least a server program that performs processing for monitoring the software of the terminal device. The terminal device acquires and stores information about the files that the terminal device has. 2 database (second DB), processing for acquiring information about the file and storing it in the second DB, and processing for executing the agent program for performing verification processing based on a verification request from the monitoring device The monitoring device is a target terminal device by executing the server program After transmitting the verification request together with the feature information, the terminal device receives the verification request, searches the second DB by executing the agent program, verifies the existence of the file related to the feature information, and sends the verification result to the monitoring device. The monitoring apparatus performs a process of determining the software state of the terminal apparatus based on the received verification result by executing the server program.

The system further includes a network control device connected to the network, and the network control device executes an access management information DB for registering information related to access control and an access control program for performing access control on the network. When the access control instruction is transmitted to the network control device concerned via the network after the monitoring device has processed the judgment based on the verification result, the access control program receives the access control instruction and Communication access control to the terminal device to be performed.
In a preferred example, the first DB can identify feature information of a file generated at the time of malware infection, feature information of a file causing a vulnerability, or software whose use is restricted as feature information. Contains at least one piece of information.
For example, the feature information includes one or a combination of a file name, a file size, a time stamp, a location, a hash value of the file name, a data hash value, and registry information rewritten by software installation.
The server program of the monitoring device also has a function of executing processing for providing countermeasure support including measures for defective files to the terminal device after making a determination based on the verification result. When a countermeasure support instruction is issued from the device, information regarding the countermeasure support is displayed on the display device.
The present invention is also grasped as a novel invention with respect to a configuration as a monitoring device in the monitoring system, or a server program executed by the monitoring device in the system and an agent program executed by a terminal device.

The software monitoring method according to the present invention is a method of monitoring the software status of a terminal device connected to a network by a monitoring device, wherein the monitoring device stores feature information including software features in the first DB; In the terminal device, the step of acquiring information related to the file owned by the terminal device and storing it in the second DB, the step of transmitting a software verification request with feature information from the monitoring device to the terminal device, and the terminal device in the verification request , The second DB is searched to verify the existence of a file related to the feature information, the verification result is transmitted from the terminal device to the monitoring device, and the monitoring device is based on the received verification result. And determining the software state of the terminal device.
In a preferred example, after the monitoring device makes a determination based on the verification result, the step of transmitting countermeasure support information including measures for a defective file to the terminal device, and the terminal device receives the countermeasure support information and takes countermeasures. Displaying the contents on the display device.
Further, as an example, the countermeasure support information includes at least one of an action for a terminal device, display data, transmission / reception information, a file path, or a combination thereof.

  According to the present invention, it is possible to relatively easily detect a terminal device with a low security level by checking the software configuration information acquired by the terminal device in response to a request from the monitoring device, and to detect those terminals. Appropriate measures can be taken for the device. In addition, since the verification process can be performed at a higher speed than the conventional verification method, secondary infection can be minimized.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a network configuration diagram of a software monitoring system according to an embodiment.
In this software monitoring system, a monitoring device 10, a plurality of terminal devices 20, and network control devices 30 and 40 are connected to each other via a local network 50, and the network control device 30 is further connected to the Internet or the like. It is configured to be connected to the world area network 60.

As shown in FIG. 2, the hardware configuring each of the devices 10 to 40 is configured to include substantially similar units.
That is, the monitoring device 10 includes a CPU 11, a memory 12, a communication device 13, a display device 14, an input device 15, and a storage device 16 connected to the bus 17. The terminal device 20 is a client such as a personal computer (PC), and is connected to a bus 27, respectively, a CPU 21, a memory 22, a communication device 23, a display device 24, an input device 25, and a storage device 26. And is configured. The network control device 30 includes a CPU 31, a memory 32, a communication device 33, a display device 34, an input device 35, a storage device 36, and a communication device 38 connected to the bus 37. Composed. The network control device 40 includes a CPU 41, a memory 42, a communication device 43, a display device 44, an input device 45, and a storage device 46 connected to a bus 47.

  Next, with reference to FIG. 3, the function of each apparatus 10-40 and the software information relevant to them are demonstrated.

  The monitoring device 10 includes a software control information database (DB) 110 for storing software control information and the like, a monitoring information DB 120 for storing state information including verification results and the like of the terminal device 20, a software search request, and a verification result A data transmission / reception unit 102 for transmitting / receiving information such as countermeasure support information, and a server program 101 for controlling them. The DBs 110 and 120 are formed in the storage device 16.

  The software control information DB 110 includes malware feature information 111 for storing feature information of files generated at the time of malware infection, vulnerability feature information 112 for storing feature information of files causing vulnerability, and reasons such as license restrictions The use restriction information 113 for storing the feature information of the file that can uniquely identify the software whose use is restricted by the above is stored. In addition, the monitoring information DB 120 stores information related to the verification result collected from the terminal device 20. That is, the characteristic information of the file having the vulnerability or the malware infection acquired from the terminal device 20 as a response to the verification request is stored in association with, for example, the IP address or the host name of the terminal device 20.

  Here, the feature information is information for specifying the type and version of software, and the file represented by the file name and file size, time stamp, location, file name hash value, and data hash value. Information that combines multiple pieces of information for identification. For example, when a virus is infected, a specific file is generated and a hash value remains at that time. In addition, the vulnerable software contains a file with a problem that causes it, and the hash value of the file remains at the time of installation. Accordingly, by searching for the information held by each terminal device 20 using these feature information as keys, a vulnerable file or the like can be found.

  In the present embodiment, by executing the server program 101 of the monitoring device 10, the feature information collected in the terminal device 20 is searched and a vulnerable file is detected and collected, and the file is received from the monitoring device 10. Provide countermeasure instructions. That is, the monitoring device 10 has a problem such as vulnerability with respect to the terminal device 20 in order to check whether or not an inappropriate terminal device having a problem such as vulnerability is connected to the local area network 50. Send a verification request to confirm the software status. Furthermore, the monitoring device 10 collects and manages the verification results from the terminal device 20 as a response to the verification request.

  Further, the monitoring device 10 transmits an access control request to the network control devices 30 and 40 based on the verification result acquired from the terminal device 20 or transmits countermeasure support information to the terminal device 20. Here, the countermeasure support information is data describing programs and control information for eliminating vulnerabilities and malware, data describing methods for eliminating vulnerabilities and malware, and display data for alerting. Further, the network control devices 30 and 40 perform control such as prohibiting access to the specific terminal device 20 having the vulnerability in accordance with the received access control request.

  FIG. 5 shows an example of countermeasure support information. The countermeasure support information includes information as illustrated, such as an action for the terminal device 20, display data, transmission / reception information, a file path, and the like. The received countermeasure support information is displayed on the display device 24 of the terminal device 20, and prompted to take action according to the display.

  The terminal device 20 normally executes a program stored in the storage device 26 by the CPU 21 to realize a desired function. In the present embodiment, the terminal device 20 sends information such as a software search request, a verification result, and countermeasure support information between the monitoring device 10 and a software configuration information DB 203 that stores software feature information in the terminal device 20. It has a data transmission / reception unit 201 for transmission / reception and an agent program 202 for controlling them. The software configuration information DB 203 is formed in the storage device 26.

  As shown in FIG. 4, software feature information stored in the software configuration information DB 203 includes file name, file size, time stamp, location, file name hash value, data hash value, and registry information rewritten by software installation. Etc. are included. By searching the DB 203 with information obtained by combining one or more of these information, a corresponding file or the like is searched.

  The agent program 202 has a function of collecting, in real time, characteristic information about files and software generated by executing normal programs in the terminal device 20 and registering them in the software configuration information DB 203. Further, the agent program 202 is executed in accordance with the verification request from the server program 101 of the monitoring apparatus 10, and the software configuration information DB 203 is searched to search for files having a vulnerability or a file generated at the time of malware infection. It has a function of transmitting the result to the monitoring device 10. Furthermore, the agent program 202 implements countermeasures based on countermeasure support information transmitted from the monitoring apparatus 10. For example, in accordance with countermeasure support information displayed on the display device 24, a file causing a vulnerability or a file generated upon malware infection may be recognized, and these files may be deleted from the storage device 26 or quarantined. it can.

  As described above, when the normal program is executed, the feature information about the file and the software is collected in real time by the execution of the agent program 202 and collected in the software configuration information DB 203, so that the verification request from the monitoring apparatus 10 is met. The DB 203 can be searched and a file with a vulnerability can be immediately obtained and responded. Thereby, vulnerability verification processing and malware infection verification processing can be performed in a short time.

The network control device 30 implements access control, blocking of network communication of the terminal device, and the like in order to prevent damage spread by an inappropriate terminal device connected to the local area network 50.
As shown in FIG. 3, the network control device 30 includes an access management information DB 304, a data transmission / reception unit 302, a data transmission / reception unit 301, and an access control program 303 for controlling them.

  The access management information DB 304 stores information related to access control of the terminal device 20. The data transmission / reception unit 302 transmits / receives access control instruction information and access management information transmitted from the monitoring device 10, communication data from the local area network 50 to the wide area network 60, and communication data from the local area network 50 to the wide area network. Transmission / reception of communication data and the like directed to 60 is performed. The data transmission / reception unit 301 transmits / receives communication data from the local area network 50 to the wide area network 60, communication data from the local area network 50 to the wide area network 60, and the like.

The network control device 40 performs access control and the like in order to prevent damage spread by an inappropriate terminal device connected to the local area network 50.
As shown in FIG. 3, the network control device 40 includes an access management information DB 403 in which information related to access control of the terminal device is stored, access control instruction information, access management information, and local area network 50 from the monitoring device 10. It has a data transmission / reception unit 401 that transmits / receives communication data transmitted by the connected terminal device, and an access control program 402 that controls them.

Next, an outline of the operation of the software monitoring system will be described with reference to FIG.
First, each terminal device 20 records the information of its own file in the software configuration information DB 203 in real time by executing the agent program 202 (ST01). In parallel or sequentially, the monitoring device 10 uses software control information to identify software feature information (malware feature information and vulnerability information) for identifying software and information (usage restriction information) that defines processing at the time of software detection. It records in DB110 (ST02).

  Next, under the execution of the server program 101, the monitoring device 10 transmits a software verification request to the terminal device 20 (ST1). The inspection based on this verification request is executed at regular intervals, for example, every day at 0:10 am. Upon receiving the software verification request, the terminal device 20 searches the software configuration information DB 203 to verify whether the software information specified by the feature information is stored, and transmits the verification result to the monitoring device 10 (ST2 ).

  The monitoring device 10 receives the verification result transmitted from each terminal device 20, and transmits countermeasure support information to the corresponding terminal device 20 as necessary (ST3). Furthermore, based on the verification result, the monitoring device 10 transmits an access control instruction to the corresponding network control devices 30 and 40 as necessary (ST4). The network control devices 30 and 40 that have received the access control instruction perform access control of the network communication of the terminal device 20. Based on the access control instruction, for example, the network communication is cut off. The monitoring device 10 may transmit the access control instruction to the terminal device 20 and perform the same processing.

Next, the processing operation of each device in the software monitoring system will be described with reference to FIG.
First, the monitoring device 10 activates the server program 101 in order to monitor the terminal device 20 connected to the network (S001). Then, the monitoring device 10 defines software feature information (S002).
Here, the file 1 that matches the data hash value = “2B9327351AC421E2B67E13A18A31F0BF72EA2323” is assumed to be generated at the time of malware infection, and the file 2 that matches the file name = “system.dll” and the data hash value = “481EA981C7E8F546AE12143EE7D08011BF9F3728” Assume an old system file.

  Next, the monitoring apparatus 10 defines the operation when the software is detected as policy information (S003). For example, the policy information is defined so that the terminal device in which the file 1 defined in S002 is detected disconnects from the network, and the terminal device in which the file 2 is detected displays a message prompting to update the file. To do.

  The server program 101 displays a list of status information of the terminal devices 20 to be monitored connected to the local area network 50 (S004). In the display device 14, for example, together with the IP address and host name of the terminal device 20 to be monitored, the verification result regarding the vulnerability holding state and the malware infection state regarding the terminal device 20 stored and accumulated in the monitoring information DB 120 is displayed. Information is displayed. The system maintenance person selects a terminal device to be monitored based on the display contents and designates it from the input device 15.

  Next, the server program 101 creates a software verification request and transmits it to the monitoring target terminal device 20 via the data transmission / reception unit 102 (S005). This software verification request is used to verify the possession status of software that is inappropriate for ensuring security, such as files generated at the time of malware infection, software with vulnerabilities, and software whose use is restricted due to security issues. Is to be sent. This verification request is transmitted with software feature information such as malware feature information 111, vulnerability feature information 112, and use restriction information 113 acquired from the software control information DB 110. In this example, information for searching the file 1 and the file 2 is added to the software verification request and transmitted.

  On the other hand, in the terminal device 20, when the terminal device 20 is activated, the agent program 202 is activated immediately after that (S006). Then, the agent program 202 acquires the latest feature information of the file held by the terminal device and stores it in the software configuration information DB 203 (S007). As for the software configuration information stored in the DB 203, for example, a certain terminal device 20 infected with malware also includes a file (file name = “malicious.exe”, “data hash value =“ 2B9327351AC421E2B67E13A18A31F0BF72EA2323 ”) generated at the time of malware infection. The information is stored in the DB 203. Further, the agent program 202 of a certain terminal device 20 using old vulnerable software is a file (file name = “system.dll”, data hash value = “481EA981C7E8F546AE12143EE7D08011BF9F3728”). ) Is also stored in the DB 203 (S007).

  When the terminal device 20 receives the software verification request including the characteristic information regarding the file 1 and the file 2 transmitted from the monitoring device 10 (S008), the terminal device 20 takes over the processing to the agent program 202. The agent program 202 searches the software configuration information DB 203 based on the software verification request, and determines whether or not a file that matches the file 1 and the file 2 exists in the DB 203 (S009).

  When the agent program 202 detects the presence of the file 1 or the file 2 as a result of searching the software configuration information DB 203, the agent program 202 displays the verification result, that is, the software configuration information including the information of the file 1 or the file 2, the status information ( That is, the information including the IP address and the host name is transmitted to the monitoring apparatus 10 via the data transmitting / receiving unit 201 (S010).

  When the monitoring device 10 receives the verification result information transmitted from the terminal device 20 to be monitored (S011), the server program 101 makes a determination based on the policy from the acquired verification result (S012). For example, the verification result, the status of the terminal device that acquired the verification result, and the policy established in advance are displayed on the display device 14, and measures such as access control, vulnerability removal, malware countermeasures, software usage restrictions, etc. are performed by the system administrator. Is determined, and a countermeasure instruction is input from the input device 15. As a countermeasure, for example, the terminal device 20 having the file 1 is instructed to disconnect the network connection. Further, a display of a message for requesting software update is instructed to a certain terminal device 20 that has the file 2. Then, the server program 101 transmits an access control instruction to the network control devices 30 and 40 via the data transmitting / receiving unit 102 (S013). The instruction in this case is an instruction for disconnecting the network connection of the terminal device 20, for example.

  The network control device 30 receives the access control instruction transmitted from the monitoring device 10 via the data transmission / reception unit 302 (S014). Similarly, the network control apparatus 40 may receive this access control instruction via the data transmission / reception unit 401. The access control program 303 of the network control device 30 reflects the received access control instruction in the access management information DB 304, and performs processing for disconnecting the network connection of the terminal device 20 (S015).

  Further, the server program 101 transmits countermeasure support information to the specific terminal device 20 via the data transmission / reception unit 102 (S016). This countermeasure support information includes information on vulnerability removal, malware countermeasures, forced execution of software usage restrictions, and alerts and countermeasure methods.

  The specific terminal device 20 receives the transmitted countermeasure support information (S017), and the agent program 202 displays the contents regarding the countermeasure support information on the display device 24. The display content is, for example, a message prompting to update an outdated software version. According to the display, the user of the terminal device 20 takes measures (S018). That is, the specified old software version is updated to the latest version.

  When the countermeasure is completed, the agent program 202 transmits a countermeasure result, that is, a message browsing completion notification to the monitoring apparatus 10 (S019). When the server program 101 of the monitoring apparatus 10 receives the countermeasure result from the terminal device 20 that is the target of the countermeasure (S020), the countermeasure result is stored in the monitoring information DB 120 and the state information of the terminal apparatus is updated (S021). . A list including the updated status information of the terminal device 20 is displayed on the display device 14. Viewing this display, the system administrator can grasp the status of the terminal devices infected with the vulnerability and malware, and the status of countermeasures for those terminal devices.

  As described above, according to the present embodiment, the monitoring device can verify the vulnerability inherent in the terminal device, the usage of software that does not conform to the usage rules, and the malware infection status. In addition, since the terminal device sequentially acquires the information of the file held by itself and stores it in the software configuration information DB, it is designated by immediately searching the software configuration information DB in response to the verification request from the monitoring device. The existence of a file that matches the feature information can be verified at high speed. With respect to vulnerability countermeasures and malware countermeasures, it is possible to reduce the risk of secondary infection by malware by linking with access control to the network control device.

The figure which shows the network structure of the software monitoring system in one Embodiment. The figure which shows the structural example of the hardware of each apparatus which comprises the software monitoring system of FIG. The figure which shows the structural example of the software of each apparatus which comprises the software monitoring system of FIG. The figure which shows the structure of the software characteristic information in the software monitoring system by one Embodiment. The figure which shows the structure of the countermeasure assistance information in the software monitoring system by one Embodiment. The figure for demonstrating the outline of the whole operation | movement of the software monitoring system by one Embodiment. The flowchart for demonstrating operation | movement of each apparatus in the software monitoring system by one Embodiment.

Explanation of symbols

10: monitoring device, 11, 21, 31, 41: CPU,
12, 22, 32, 42: memory, 13, 23, 33, 38, 43: communication device,
14, 24, 34, 44: display device, 15, 5, 35, 45: input device,
16, 26, 36, 46: storage device, 17, 27, 37, 47: bus,
20: Terminal device, 30: Network control device,
40: network control device, 50: local area network,
60: World area network 101: Server program
102: Data transmission / reception unit, 110: Software control information DB,
111: Malware feature information, 112: Vulnerability feature information,
113: Usage restriction information, 120: Monitoring information DB,
201: Data transmission / reception unit, 202: Agent program,
203: Software configuration information DB, 301, 302: Data transmission / reception unit,
303: Access control program, 304: Access management information DB,
401: Data transmission / reception unit, 402: Access control program,
403: Access management information DB.

Claims (15)

In a system for monitoring the software status of a terminal device connected to a network by a monitoring device,
The monitoring device includes a first database (first DB) that stores feature information including features of software used in the system, and a process that executes a server program that performs processing for monitoring software of at least the terminal device An apparatus,
The terminal device acquires a second database (second DB) that acquires and stores information about a file that the terminal device has, a process for acquiring information about the file and storing the information in the second DB, and from the monitoring device A processing device for executing the agent program for performing processing for verification based on the verification request;
The monitoring device transmits a verification request together with the feature information to the target terminal device by executing the server program,
After receiving the verification request, the terminal device searches the second DB by executing the agent program, verifies the existence of a file related to the feature information, and transmits a verification result to the monitoring device.
The monitoring apparatus performs a process of determining a software state of the terminal apparatus based on the received verification result by executing the server program. And a network control device connected to the network, the network control device comprising an access management information DB for registering information related to access control, and a processing device for executing an access control program for controlling access to the network,
When the monitoring apparatus transmits an access control instruction to a related network control apparatus via the network after processing of the determination based on the verification result, the access control program receives the access control instruction and 2. The software monitoring system according to claim 1, wherein access control of communication with the terminal device is performed. The first DB has a small amount of feature information that can identify feature information of a file generated at the time of malware infection, feature information of a file that causes a vulnerability, or software whose use is restricted as the feature information. The software monitoring system according to claim 1 or 2, comprising one. The server program of the monitoring device further has a function of executing processing for providing countermeasure support including measures for a defective file to the terminal device after making a determination based on the verification result,
4. The software monitoring system according to claim 1, wherein the terminal device displays information on the countermeasure support on a display device when the countermeasure apparatus instructs the countermeasure support. 5. In a method for monitoring the software status of a terminal device connected to a network by a monitoring device,
In the monitoring apparatus, storing feature information including software features in the first DB;
In the terminal device, the step of acquiring information about the file that the terminal device has and storing it in the second DB;
Transmitting a software verification request with the feature information from the monitoring device to the terminal device;
In the terminal device, after receiving the verification request, searching the second DB and verifying the existence of a file related to the feature information;
Transmitting a verification result from the terminal device to the monitoring device;
In the monitoring device, based on the received verification result, determining a software state of the terminal device;
A software monitoring method characterized by comprising: The monitoring device, after making a determination based on the verification result, transmitting countermeasure support information including a treatment of a defective file to the terminal device;
In the terminal device, receiving the countermeasure support information and displaying the contents of the countermeasure on a display device;
The software monitoring method according to claim 5, further comprising: The first DB may identify, as the feature information, feature information of a file generated at the time of malware infection, feature information of a file causing a vulnerability, or software whose use is restricted. 6. The software monitoring method according to claim 5, comprising at least one of the following. 8. The feature information includes one or a combination of a file name, a file size, a time stamp, a location, a hash value of a file name, a data hash value, and registry information rewritten by software. Software monitoring method. 7. The software monitoring method according to claim 6, wherein the countermeasure support information includes at least one of an action for a terminal device, display data, transmission / reception information, a file path, or a combination thereof. The monitoring device, after making a determination based on the verification result, transmitting an access control instruction to a related network control device via a network;
The network control device receives the access control instruction and performs communication access control for the related terminal device;
The software monitoring method according to claim 5, further comprising: The terminal device has an agent program in a storage device, and based on processing for obtaining information on the file to be stored in the second DB by executing the agent program, and a verification request from the monitoring device 11. The software monitoring method according to claim 5, wherein a process of searching the second DB and verifying a related file is performed. The monitoring device has a server program in a storage device, and executes the server program to acquire the feature information including software features, and issues a verification request to the terminal device to verify the terminal device. 12. The software monitoring method according to claim 5, wherein a series of processes for performing is performed. The monitoring apparatus in the system in any one of Claims 1 thru | or 4. A server program executed by the monitoring device in the system according to claim 1. An agent program executed by a terminal device in the system according to claim 1.

Images