JP2008003862A - Audit log creating device, audit event recording program and image processing device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a method to surely storing required log information in a limited storage area. <P>SOLUTION: Every time an electronic device for executing a process according to a request from outside receives a request, the audit log creation device receives data such as a process content included by the request from the electronic device and creates a log by referring a table for corresponding description items and description formats of the log to the process content as an execution history of the process. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an apparatus for generating a history of processing executed by an electronic device.

  As an analysis method of the cause of failure of an electronic device, an analysis method is known that saves a history of processing executed by the electronic device as a log file in a storage unit such as a hard disk and reads it after the failure occurs to help analyze the cause of the failure . For a reliable analysis of the cause of a failure, the more information stored as a log, the better. However, since the storage capacity of the storage unit is finite, the history cannot be saved indefinitely.

In order to improve such problems, the following log file management methods have been proposed. In Patent Document 1, in the case of a fault event with a low occurrence frequency, fault event information (occurrence date, command, data source address, etc.) is recorded one by one in a log file, and in the case of a fault event with a high occurrence frequency, a log file is recorded. Discloses a method of storing more information with a limited storage capacity by recording only the number of occurrences. In Patent Document 2, the importance is determined for each history, and when an existing log file is deleted in order to secure a storage area necessary for recording a new history, a log file with a low importance is used. A technique for leaving a useful log file by erasing in order and leaving a log file having a high importance level without being erased is disclosed.
JP-A-8-69395 JP 2000-267902 A

  However, in Patent Document 1, only the number of occurrences is recorded for a failure event with a high occurrence frequency. For example, in a DoS attack, there is a problem in that important information (such as a source address) that is different for each event is not recorded. . The DoS attack refers to an act of applying a load by transmitting a large number of requests to a target network device in a short time and disabling service provision.

In the technique disclosed in Patent Document 2, if a low importance level is assigned to a history regarding a DoS attack, the log about the DoS attack is erased in the process of recording a log with a higher importance level. The fact of the attack cannot be recorded. Conversely, if it is recorded as a highly important log, the storage area will be used up.
An object of the present invention is to provide a method for reliably storing necessary log information and effectively utilizing a limited storage area.

  The first configuration of the audit log generation device according to the present invention is that at least a request source and a request content of the request each time an electronic device that executes any of a plurality of types of processing in response to an external request receives the request. Receiving means for receiving data representing the data from the electronic device, a table in which a description item and description format of a log, which is an execution history of the processing, is defined for each of the plurality of types of processing, the data received by the receiving means, It has a generating means for checking the contents of the table, selecting a description item and description format of a log of processing executed by the electronic device according to the request content, and generating the log.

  According to a second configuration of the audit log generation apparatus according to the present invention, in the first configuration, a write unit that writes the logs generated by the generation unit to a storage device in the generation order, and a predetermined number of logs by the write unit Is determined whether or not a log indicating that the electronic device has been illegally accessed is included in a predetermined number of logs stored in the storage device, triggered by being written to the storage device When the determination means determines that a log indicating that the unauthorized access has been received is included, the corresponding log is converted into a log having a predetermined format as a log indicating the unauthorized access. Conversion means.

  A third configuration of the audit log generation device according to the present invention is that, in the second configuration, the unauthorized access is a DoS attack, and the log indicating that the unauthorized access has been received is subjected to a DoS attack. The plurality of logs shown is a single log in which common data included in them is omitted.

  The audit event recording program according to the present invention has a configuration in which at least a request source and a request of an electronic device that executes any of a plurality of types of processing in response to a request from the outside are received by the computer device. A first step of receiving data representing the contents from the electronic device, a contents of a table in which a description item and a description format of a log, which is an execution history of the process, are defined in association with each of the plurality of types of processes; Checking data received by the receiving means, selecting a description item and description format of a log of processing executed by the electronic device according to the request content, and executing a second step of generating the log It is characterized by.

  The configuration of the image processing apparatus according to the present invention includes an image processing means for executing image processing in response to an external request, and a receiving means for receiving at least the request source of the request and data representing the request contents each time the request is received. And the table in which the description items and description format of the log, which is the execution history of the processing, are associated with each of the requests, the data received by the receiving means, and the contents of the table, An audit log generation device having a generation unit that selects a description item and a description format of a log of processing executed by the image processing unit according to the content and generates the log is provided.

  According to the present invention, a more useful audit log can be generated by selecting contents to be recorded in an audit log of an electronic device for each operation.

(A: Configuration of the embodiment)
Hereinafter, the best mode for carrying out the present invention will be specifically described with reference to the drawings.
(A-1: System configuration)
FIG. 1 is a diagram illustrating a configuration of an information processing system 100 to which an image processing apparatus 200 having an audit log generation apparatus according to the present embodiment is connected. The information processing system 100 includes an image processing device 200 and a processing requesting device 300a, and the image processing device 200 and the processing requesting device 300a are connected via a communication network 500.

  The communication network 500 is, for example, Ethernet (registered trademark) laid in an office using the information processing system 100, and mediates data communication performed according to a predetermined communication protocol between devices such as a PC and an image forming apparatus. Is for. In this embodiment, IP is used as the communication protocol for the network layer, and TCP is used as the communication protocol for the transport layer. Here, the communication network 500 is connected to an external network 400 such as the Internet, and also has a function of mediating communication with the processing requesting device 300b connected to the external network 400. In the present embodiment, the case where the communication network 500 is Ethernet will be described, but it is needless to say that it may be a token ring. In short, any communication network may be used as long as it has a function of mediating communication performed according to the predetermined communication protocol. In this embodiment, the case where TCP is used as the transport layer communication protocol will be described, but it is of course possible to use UDP.

  Note that an IP address is assigned to each of the image processing device 200 and the processing requesting devices 300a and 300b, and each device is uniquely identified on the network. Specifically, “255.255.0.0” is allocated to the image processing apparatus 200, and “255.255.0.1” is allocated to the processing request apparatus 300a.

  Specifically, the image processing apparatus 200 is a so-called multi-function peripheral, and has an image reading function, an image forming function, and an image transfer function. Here, the image reading function is a function for optically reading an image formed on a recording material and executing an image reading process for generating image data corresponding to the read image. The image forming function forms an image corresponding to the image data received via the communication network 500 or the image data generated by the image reading function on a recording material such as a printing sheet or an OHP (Over Head Projector) sheet. This function executes image forming processing. In this embodiment, the image processing apparatus 200 forms a toner image corresponding to the image data on the recording material by electrophotography. The image transfer function is a function for executing an image transfer process for transferring image data corresponding to an image read by the image reading function to a predetermined destination via the communication network 500, for example.

  The image processing apparatus 200 receives a message transmitted according to a predetermined communication protocol via the communication network 500, and performs processing according to the content of the message (in this embodiment, image formation processing, image reading processing, and The image transfer process and the change / addition of a program for controlling the image transfer process are executed. In the following, requesting the image processing apparatus 200 to execute each of the above processes and a signal indicating the request will be referred to as a “request”. The request includes a command for specifying an execution job to be executed by the image processing apparatus 200, data to be processed and attributes of the data, an address for identifying the request source of the request (hereinafter referred to as a request source identifier), It includes the date and time of sending the request.

In the image processing apparatus 200, a communication port (hereinafter referred to as a data communication port) used for transmission / reception of a request for instructing execution of each process is determined in advance for each process. For example, a data communication port whose port number is “631” is assigned as a data communication port for image forming processing. When UDP is used as a transport layer communication protocol, a UDP communication port may be assigned to the data communication port.
The processing requesting device 300a is, for example, a PC, and has a function of generating a request for requesting the above processing from the image processing device 200 according to a user instruction and transmitting the request according to the predetermined communication protocol. Yes.

(A-2: Configuration of image processing apparatus)
FIG. 2 is a diagram illustrating an example of a hardware configuration of the image processing apparatus 200.
The image processing apparatus 200 includes a control unit 210, a communication interface (hereinafter referred to as “IF”) unit 220, an information processing unit 230, a storage unit 240, a UI (User interface) unit 250, and an audit log generation. The apparatus 600 has a system bus 260 that mediates data communication between these components.

The control unit 210 is a CPU (Central Processing Unit), for example, and has a function of executing various programs stored in a storage unit 240 described later and controlling the operation of other components.
The communication IF unit 220 is, for example, a NIC (Network Interface Card), and is connected to the communication network 500. The communication IF unit 220 is for receiving data transmitted via the communication network 500 and delivering the data to the control unit 210 and sending the data delivered from the control unit 210 to the communication network 500.

  The information processing unit 230 includes a scanner unit, a printing unit, and an information processing control unit. The scanner unit optically reads an image formed on a recording material placed on a platen glass (not shown), generates image data corresponding to the image, and delivers the image data to the information processing control unit. The printing unit takes out the recording material stored in a paper tray (not shown), and forms a toner image on the recording material by electrophotography in accordance with the image data delivered from the information processing control unit. The information processing control unit controls the operation of the scanner unit and the printing unit under the control of the control unit 210.

  The UI unit 250 includes an operation panel and buttons provided in the image processing apparatus 200. When the user presses a button while referring to the display on the operation panel, a command for specifying an execution job requested by the user from the UI unit 250 via the system bus 260, a request source identifier (in this case, the image processing apparatus 200). Data such as the assigned IP address) and the date and time when the user makes a request is transmitted to the control unit 210, and the image processing apparatus 200 can execute specific processing. Hereinafter, the signal transmitted from the UI unit 250 to the control unit 210 is referred to as a “request” together with the signal transmitted from the processing requesting apparatus 300 to the image processing apparatus 200 described above. The request transmitted from the UI unit 250 to the control unit 210 does not include image data to be processed, and is supplied from the information processing unit 230 of the image processing apparatus 200.

  The storage unit 240 includes an HDD 240a (Hard Disk Drive), a RAM (Random Access Memory) 240b, and a ROM (Read Only Memory) 240c. The RAM 240b is used as a work area by the control unit 210 operating according to various programs. The ROM 240c stores data and programs for causing the control unit 210 to realize functions characteristic of the image processing apparatus 200 according to the present invention. The HDD 240a stores the generated audit log.

  Here, the program stored in the ROM 240c will be described. A control program is stored in the ROM 240c. The control unit 210 operating according to this control program receives the request sent from the processing requesting device 300a, and among the data included in the request, the above command, data and data attributes, request source identifier, The transmission date and time is transmitted to the audit log generation device 600. On the other hand, when the user transmits the image processing apparatus 200 via the UI unit 250, the control unit 210 displays the command, that is, the UI operation performed by the user, the image data generated in the information processing unit 230, and the image processing apparatus 200. The request source identifier assigned to and the transmission date and time are transmitted to the audit log generation device 600.

(A-3: Configuration of the audit log generation device)
Next, the configuration of the audit log generation device 600 will be described with reference to FIG.
The audit log generation apparatus 600 includes a CPU 610, a RAM 630, an input / output unit 640, a ROM 620, and a bus 650 that mediates data communication between these components.
The RAM 630 is used as a work area by the CPU 610 operating according to various programs. Further, the RAM 630 has a role as a buffer memory that stores only one data related to the request received by the image processing apparatus 200.
The input / output unit 640 is connected to the system bus 260, passes data transmitted via the system bus 260 to the CPU 610, sends data transferred from the CPU 610 to the system bus 260, and controls the control unit 210. The function of instructing the system of the image processing apparatus 200 to stop.

The ROM 620 stores data for assigning functions characteristic of the present invention to the audit log generation apparatus 600 and the audit event recording program 10.
An example of such data is a recording method selection table shown in FIG. The recording method selection table lists various requests received by the image processing apparatus 200 and items to be recorded in an audit log that records the requests when each request is received. Here, the audit log recording method will be described with reference to the recording method selection table shown in FIG. There are two types of audit log recording methods: a simple log and an advanced log. The first concise log contains data about the type of requested execution job, image data attributes, requester identifier, date and time the request was sent, and processing results (if any errors occurred, the content of the important error) Is described. On the other hand, in the advanced log, the type of requested execution job, processed image, image data attribute, request source identifier, request transmission date and time, and processing result (if an error occurs, the content of the error) Data is described. The processed image refers to image data generated or received by the image processing apparatus 200. In order to reduce the log capacity, the image data may be compressed and stored in the HDD 240a.
Examples of audit events that generate a simple log include image reading by the image processing apparatus 200, image formation, and image transfer. Examples of the audit event that generates an advanced log include registration, change, and deletion of system data of the image processing apparatus 200 and addition of a new application.

The CPU 610 operating according to the audit event recording program 10 is provided with a function for generating a history (audit log) of processing performed by the image processing apparatus 200 as described below.
FIG. 4 is a block diagram showing a functional configuration of the audit log generation device 600. Specifically, the CPU 610 operating in accordance with the audit event recording program 10 above has a means surrounded by a double line in FIG. 4, that is, an audit event detecting means 700, a recording method selecting means 710, and a log generating means 720. Audit log writing means 730, free space detection means 740, DoS attack detection means 750, log compression means 760, log deletion means 770, and counter 780.

  The audit event detection unit 700 audits the occurrence of the audit event described above based on the data stored in the RAM 630. The audit method is described below. The audit event detection unit 700 determines whether or not the request stored in the RAM 630 matches one of the requests described in the recording method selection table (hereinafter referred to as an audit event). If they match, the audit event detection unit 700 transmits data indicating the type of the audit event to the recording method selection unit 710.

The recording method selection means 710 selects either a simple log or an advanced log based on the data received from the audit event detection means 700, and the log generation means 720 indicates the selected recording method. Send.
The log generation unit 720 generates log data based on the audit log recording method selected by the recording method selection unit 710. FIG. 8 shows the contents of the log generated by the audit log generation device 600. The log shown in the log 1 indicates a history of a request for requesting image printing from the processing requesting device 300a to the image processing device 200. In this case, “execution job” describes PRINT meaning image formation and DO meaning execution. In the “data attribute”, an extension (for example, “jpeg”) indicating the type of printed image data is described. The “request source identifier” describes the IP address assigned to the process requesting device 300a. In “transmission date and time”, day, month, year, hour, minute, and second are described in order. In the “processing result”, whether or not the requested processing has been completed without any problem, and if an error occurs, a number indicating the content of the error is described. Here, the described number “200” means that the processing has been completed without any trouble. Further, the log shown in the log 2 indicates that the user has read an image by an operation on the UI unit 250 of the image processing apparatus 200. In this case, the request source identifier describes the IP address assigned to the image processing apparatus 200 itself.

The log generation unit 720 transmits the generated log data to the audit log writing unit 730.
The audit log writing unit 730 receives the log data generated by the log generation unit 720 and writes it to the log file.
Here, the free space detection unit 740 has a function of detecting a free space in the HDD 240 a and notifying the audit log writing unit 730. The audit log writing means 730 detects the capacity of the generated log data, and writes a log when the file capacity is smaller than the detected free area. On the other hand, when the file capacity is larger than the detected free space, the audit log writing unit 730 stops log writing and transmits a signal to the control unit 210 so that the image processing apparatus 200 stops the system. Instead of stopping the system, the audit log writing unit 730 may instruct the input / output unit 640 to issue an alert.
The audit log writing means 730 increments the counter 780 when writing the log. Note that the initial value of the counter 780 is zero. As a result of repeating the writing and incrementing, when the counter 780 reaches a predetermined value N (N is a natural number equal to or larger than 2 and is 50 in this case), the CPU 610 resets the counter 780 to the initial value 0, At the same time, a signal indicating that the counter 780 has reached a specified value N is transmitted to the DoS attack detection means 750.

When the DoS attack detection unit 750 receives a signal indicating that the counter 780 has reached the specified value N, the DoS attack detection unit 750 determines whether or not there is a suspected DoS attack log for the 50 most recent logs recorded in the log file. audit. Details thereof will be described below.
In FIG. 8, the case where the log 550 is recorded and the counter 780 is reset will be described as an example. The DoS attack detection unit 750 receives the signal from the counter 780 and audits the presence or absence of an audit log suspected of a DoS attack for the latest 50 logs, that is, the logs 501 to 550. As described above, since the DoS attack is to send a large number of requests to a specific data communication port in a short time, the following (a) or (b) is described in at least a part of the 50 logs. When such a tendency is observed, it is determined that the logs are suspected DoS attacks.
(A) When the number of requests per unit time exceeds the specified value (b) When a failure due to high load is recorded in the processing result exceeding the specified number

  Here, in the logs “523” to “550” in FIG. 8, the jpg format is used in a short period of 20 seconds from 00:28:00 to 00:28:20 on September 1, 2006. It is recorded that a total of 28 processing request messages for instructing to print images have been received from different request sources. In addition, a processing result indicating that a failure due to a high load has occurred is recorded. Here, in light of the criteria (a) or (b), the DoS attack detection means 750 determines that the logs 523 to 550 are logs suspected of DoS attacks. The DoS attack detection unit 750 transmits a signal including a log number determined to be a log suspected of DoS attack to the log compression unit 760. Note that the criteria for determining a DoS attack are not limited to the above (a) and (b), and other criteria can be set in light of the nature of the DoS attack. In addition, although N is described here as 50, a natural number other than 50 may be used. In short, it may be a value sufficient to audit a plurality of logs and determine whether or not they are logs suspected of DoS attacks.

  The log compression unit 760 that has received the signal from the DoS attack detection unit 750 reads the log from the log file and generates a “difference log” based on the data. A specific example of the generation method will be described below. A log number of a newly generated log is assigned a number in which the start number and end number of the log to be compressed are arranged, such as “523-550”. In the description content of the difference log, the data described for each item different in each log is left, while the items common to each log are combined into one. In this example, since the request source identifier is different for each log, the request source identifier is described as the request source identifier described in each log, while the other items have common contents in each log. The common content is described as a representative. As for the transmission date / time, the date / time when the log with the smallest number was described, that is, the date / time when the DoS attack was started is representatively described. In “cumulative occurrence count”, the number of logs collected as a difference log is described. As described above, the differential log is generated after the log for which a DoS attack is suspected.

The log deleting unit 770 deletes logs from the log file after the log compressing unit 760 reads logs suspected of being DoS attacks from the log file.
In addition, when the DoS attack detection unit 750 detects a DoS attack, the DoS attack detection unit 750 sends a signal instructing the control unit 210 to block the data communication port in which the DoS attack is performed. When the control unit 210 receives the signal, the control unit 210 blocks the data communication port that has received the DoS attack. Here, the image processing apparatus 200 has a timer (not shown). When the control unit 210 shuts off the data communication port, the timer starts counting the time elapsed from that point. When the predetermined time T1 has elapsed, the control unit 210 opens the data communication port and waits to receive the request again.

  The above is the configuration of the audit log generation apparatus 600. As described above, the configuration of the audit log generation apparatus 600 according to the present embodiment is the same as the configuration of a general computer apparatus, and the characteristic functions of the audit log generation apparatus according to the present invention are based on software modules. It has been realized.

(B: Operation of the embodiment)
Next, among the operations performed by the audit log generation apparatus 600 according to the present invention, operations that significantly show the features will be described with reference to the drawings. In the following, log recording for normal operation of the image processing apparatus 200 will be described first, and then log recording for a DoS attack received by the image processing apparatus 200 will be described.

(B-1: Log recording for normal operation)
Hereinafter, as an example of implementation of the present embodiment, when a request for image formation is transmitted from the processing requesting device 300a connected to the communication network 500 to the image processing device 200, the audit log generating device 600 The log recording process to be executed will be described. It is assumed that no log data is stored in the HDD 240a at the start of this operation.

The processing requesting device 300a stores data A (image in jpeg format) in the HDD 240a. The user can cause the image processing apparatus 200 to transmit a request for forming an image represented by the data A by appropriately operating the processing requesting apparatus 300a. At this time, the processing requesting device 300a generates a request including a command for instructing image formation, data A and data related to the attribute of the data A (in this case, jpeg), the IP address of the processing requesting device 300a, and the request transmission date and time. The request is transmitted to the data communication port 631 of the image processing apparatus 200. The request transmitted in this way is received by the control unit 210 of the image processing apparatus 200 via the communication network 500.
The control unit 210 that has received the request audits the command, the attribute of the data A, the IP address of the process requesting device 300a, and the data related to the transmission date and time of the request received from the process requesting device 300a via the system bus 260. The data is transferred to the CPU 610 of the log generation device 600 and the data is temporarily stored in the RAM 630.

FIG. 6 is a flowchart showing the flow of log recording processing executed when the CPU 610 operating in accordance with the audit event recording program 10 receives data related to the request.
When data related to a new request is added to the RAM 630 (step SA10: Yes), the audit event detection unit 700 reads data related to a command from the data. Since this command corresponds to an audit event, the audit event detection unit 700 notifies the recording method selection unit 710 of data related to the command.

The recording method selection means 710 compares the data related to the received command with the stored contents of the recording method selection table, selects the recording method of the log generated for the audit event corresponding to the command (step SA20), and the selection result Is transmitted to the log generation means 720. In this embodiment, the recording method selection table (see FIG. 5) stipulates that image formation processing is recorded as a simple log. Accordingly, the recording method selection means 710 selects a simple log in step SA20.
The log generation unit 720 reads items described in a simple log from data stored in the RAM 630, that is, data related to the type of command (execution job), data attributes, request source identifier, and transmission date and time, and from these items. Log data is generated (step SA30) and transmitted to the audit log writing means 730.

  Also, the free space detection unit 740 detects a free space in the HDD 240a and notifies the audit log writing unit 730 of the free space. The audit log writing unit 730 compares the capacity of the log data notified from the log generation unit 720 with the free area of the HDD 240a, and determines whether or not the HDD 240a has a free area large enough to write the log data. (Step SA40).

  If the determination result in step SA40 is “Yes”, that is, if there is a sufficiently large free space, the audit log writing unit 730 generates a log file in the HDD 240a and the log received by the log generation unit 720. Data is written to the log file (step SA50). On the contrary, if the determination result in step SA40 is “No”, that is, if there is not a sufficiently large free area, the audit log writing unit 730 transmits an instruction to stop the system to the control unit 210. Then, the system of the image processing apparatus 200 is stopped (step SA120).

As described above, in this operation example, since no log data is stored in the HDD 240a at the start time, the determination result in step SA40 is “Yes”, and the processing in step SA50 described above is performed. Executed. In step SA60 executed subsequent to step SA50, the audit log writing unit 730 increments the counter 780 (step SA60).
When the count of the counter 780 reaches the specified value N (in this case, 50) due to the increment (step SA70: Yes), the CPU 610 resets the counter 780 to the initial value “0” (step SA80), and the difference log generation process Is executed (step SA90). The difference log generation process will be described later in detail. On the other hand, when the value of the counter 780 incremented in step SA60 has not reached the prescribed value N (step SA70: No), the CPU 610 does not perform the processes of steps SA80 and SA90, but will be described later in step SA100. Execute the process.

For the first time at this stage, the control unit 210 of the image processing apparatus 200 performs processing (image formation in this operation example) according to the request received from the processing requesting device 300a (step SA100), and the processing result has been written. Is added to the log (step SA110). For example, when printing is completed without any trouble as a result of the image formation, the control unit 210 adds a number “200” indicating that the processing has been completed without trouble to the written log. Conversely, when an error occurs in the course of processing, the control unit 210 analyzes the error by means provided separately, and additionally writes the content of the error clarified as a result of the analysis.
Thereafter, whenever a request is transmitted from the process requesting device 300a, the log recording process shown in FIG. 6 is executed. As a result, for example, a log file as shown in FIG. 8 is recorded in the HDD 240a. .

(B-2: Log recording for DoS attack)
Next, the operation of the audit log generation device 600 will be described as a case where the image processing device 200 is subjected to a DoS attack as a suitable example of the implementation of the present embodiment.
FIG. 7 is a flowchart showing in detail the flow of “difference log generation processing executed in step SA90 of FIG. 6.” When the DoS attack detection unit 750 receives the signal transmitted from the reset counter 780, FIG. The latest 50 logs stored in the log file (FIG. 8: logs 501 to 550) are determined whether or not they contain logs suspected of DoS attacks (step SA910).

When the determination result in step SA910 is “Yes” (that is, when it is determined that a log that is suspected of Dos attack is included), the CPU 610 executes the processes from step SA920 to SA980 in FIG. Then, the difference log generation process is terminated. Conversely, when the determination result in step SA910 is “No”, the CPU 610 ends the difference log generation process without executing the processes from step SA920 to SA980.
In this operation example, among the 50 logs from the log 501 to the log 550 shown in FIG. 8, when the logs 523 to 550 correspond to the above-mentioned criteria (a) or (b) (that is, these 28 logs) Will be described). As described above, since the 50 logs include logs in which a Dos attack is suspected, in this operation example, the determination result in step SA910 is “Yes”, and steps SA920 to SA980 are performed. Processing is executed.

  In step SA920, which is subsequently executed when the determination result in step SA910 is “Yes”, the DoS attack detection unit 750 receives the data communication in which the requests related to the logs 523 to 550 are received from the control unit 210. An instruction is given to temporarily block the service port (631 in this case).

Next, the CPU 610 starts timing by a timer (step SA930), and sends data relating to the log number suspected of being a DoS attack (in this case, from 523 to 550) to the log compression means 760.
The log compressing means 760 that has received the data relating to the log number suspected of DoS attack compresses the corresponding log (step SA940). Specifically, the log compression unit reads the log from the log file, generates differential log data from the data according to the above-described procedure, and transmits it to the audit log writing unit 730. The difference log is written to the log file by the audit log writing unit 730 (step SA950), and the logs before compression (that is, the logs 523 to 550 in FIG. 8) are deleted from the log file by the log deletion unit (step SA960). ). In this operation example, the case where the log before the compression is deleted after the difference log is written has been described. However, the difference log may be written after the log before the compression is deleted. .

Thereafter, the data communication port 631 blocked by the control unit 210 in step SA920, when the time counted by the timer reaches a predetermined time T1 (step SA970: Yes), It is opened (step SA980).
As a result of the operations described above, logs that are suspected of being a Dos attack are aggregated into a differential log. Therefore, a limited storage area is maintained while retaining important information such as the attack source communication address of the Dos attack. It can be used effectively.

(C: Modification)
Although one embodiment of the present invention has been described above, it is needless to say that the embodiment may be modified as described below.

(1) In the above embodiment, the audit log generation apparatus is provided for the image processing apparatus. However, the installation target is not limited to the image processing apparatus, and can be installed for various electronic devices. .
(2) In the above embodiment, the case has been described where the functions characteristic of the image processing apparatus according to the present invention are realized by software modules. However, the present invention is based on a combination of hardware modules having the above functions. Of course, the audit log generation device may be configured.

(3) In the above embodiment, the recording method selection unit 710 selects the audit log recording method by the command included in the request received from the processing requesting device 300a or the UI unit 250 of the image processing device 200. However, some events that should be recorded as audit logs are not associated with commands. The DoS attack described above is an example. Therefore, in addition to the events shown in the embodiment, a log may be created in the following cases. When the user performs authentication errors continuously, when the user performs a large amount of image reading / image formation / image transfer, when a detection program such as a virus installed in the image processing apparatus 200 detects a virus, This is the case when there is a suspicious net access such as a port scan or an authentication challenge to the processing device 200. The above is summarized in the table shown in FIG. 9 by combining with the recording method selection table shown in FIG.

(4) In the above embodiment, a case has been described in which a request is transmitted from the processing requesting device 300a connected to a LAN (Local Area Network) to the image processing device 200 via the communication network 500. Requests and accesses from the processing request apparatus 300b connected on the external network 400 such as the Internet can be handled in the same manner as requests and accesses from the processing request apparatus 300a.

It is the figure which showed the structure of the information processing system to which the image processing apparatus which has an audit log production | generation apparatus which concerns on this embodiment was connected. It is the figure which showed the hardware constitutions of the image processing apparatus which has an audit log production | generation apparatus concerning this embodiment. It is the figure which showed the structure of the audit log production | generation apparatus. It is the block diagram which showed the function structure of the audit log production | generation apparatus. It is a recording method selection table showing an audit log recording method according to an audit event. It is the flowchart which showed the log recording processing process of the audit event by the audit log generation device. It is the flowchart which showed the production | generation process of the difference log of the DoS attack by the audit log production | generation apparatus. This is the content of the audit log generated by the audit log generation device. It is a table that summarizes the audit log recording method according to the audit event.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Audit event recording program, 100 ... Information processing system, 200 ... Image processing apparatus, 210 ... Control part, 220 ... Communication IF part, 230 ... Information processing part, 240 ... Memory | storage part, 250 ... UI part, 260 ... System bus , 300a, 300b ... processing request device, 400 ... external network, 500 ... communication network, 600 ... audit log generation device, 610 ... CPU, 620 ... ROM, 630 ... RAM, 640 ... input / output unit, 650 ... bus, 700 ... Audit event detection means, 710 ... Recording method selection means, 720 ... Log generation means, 730 ... Audit log writing means, 740 ... Free space detection means, 750 ... DoS attack detection means, 760 ... Log compression means, 770 ... Log deletion means 780 ... Counter

Claims (5)

A receiving means for receiving from the electronic device at least the request source and request content of the request every time the electronic device that executes any of a plurality of types of processing in response to an external request receives the request;
A table in which a description item and a description format of a log that is an execution history of the processing are defined for each of the plurality of types of processing;
Generating means for comparing the data received by the receiving means with the contents of the table, selecting a description item and description format of a log of processing executed by the electronic device according to the request content, and generating the log; An audit log generation device characterized by comprising: Writing means for writing the log generated by the generating means to the storage device in the order of generation;
When a predetermined number of logs are written to the storage device by the writing means, a log indicating a predetermined number of logs stored in the storage device indicating that the electronic device has received unauthorized access Determining means for determining whether or not included in,
Conversion means for converting a corresponding log into a log in a predetermined format as a log indicating unauthorized access when the determination means determines that a log indicating that unauthorized access has been received is included. The audit log generation device according to claim 1. The unauthorized access is a DoS attack, and the log indicating that the unauthorized access has been received is a single log obtained by omitting a plurality of logs indicating that the DoS attack has been received and common data included therein. The audit log generation device according to claim 2. Computer equipment,
A first step of receiving, from the electronic device, at least data indicating the request source and request contents of the request every time the electronic device that executes any of a plurality of types of processing in response to an external request receives the request;
The contents of the table in which the description items and description format of the log, which is the execution history of the processes in association with each of the plurality of types of processes, are compared with the data received by the receiving means, and according to the request contents And a second step of selecting a description item and a description format of a log of processing executed by the electronic device and generating the log. Image processing means for executing image processing in response to an external request;
Each time a request is received, receiving means for receiving at least the request source and data indicating the request contents, and a description item and description format of a log that is an execution history of the processing are defined in association with each request. Compare the table, the data received by the receiving means, and the contents of the table, select the description item and description format of the processing log executed by the image processing means according to the requested content, and generate the log An image processing apparatus comprising: an audit log generation device having a generation means for performing

Images