JP2008242915A - Attack detection method and audit device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a means for quickly detecting a detour attack in a computer system equipped with a plurality of intrusion detection devices. <P>SOLUTION: In this attack detection method executed by an audit device 120 which detects a detour attack detouring intrusion detection devices (111 to 113) in a computer system equipped with a plurality of the intrusion detection devices (111 to 113) to be called according to the order of the execution of a process, the audit device 120 measures the number of times of use of the intrusion detection devices (111 to 113) in a prescribed processing unit executed by a computer system, and compares the measured number of times of use with the number of plans as the preset number of times of use of the intrusion detection devices (111 to 113) after the use of all the intrusion detection devices (111 to 113) in the prescribed processing unit, and when the measured number of times of use is not matched with the number of plans, a signal showing an abnormality is outputted. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a computer system that calls a plurality of intrusion detection devices in accordance with the execution order of a program, and more particularly to an attack detection method and an audit device that detect an attack that bypasses an intrusion detection device.

  In a computer system, there is a security technique that uses a plurality of intrusion detection devices (hereinafter abbreviated as detection devices) in order to detect unauthorized access from the outside to the inside. As an example of such a technique, Patent Document 1 describes a method of calling different types of detection devices from a network and a network relay device. Patent Document 2 describes a detection system in which detection devices of the same type are arranged at important points of a network.

  Examples of such detection devices include, for example, the memory protection device described in Patent Literature 3 and Patent Literature 7, the sandbox described in Patent Literature 4, the forced access control device described in Patent Literature 5, and the like. And an electronic signature device described in Patent Document 6.

  In a computer system including a plurality of intrusion detection devices as described above, an audit device that collects an alarm issued by each detection device may be installed. By installing an auditing device, the inspection results of a plurality of detecting devices are recorded, and by investigating this, it is possible to prevent omission of detection and identify the computer that has entered. On the other hand, in the prior art, the type and arrangement of the detection device must be readjusted according to the configuration of the computer system or network to be inspected.

  In a configuration in which the auditing device and the detection device are independent, the auditing device can recognize the state of each detection device based on the presence or absence of an alarm from each detection device. At this time, as a factor that an alarm of a certain detection device does not arrive, (a) the possibility of detection omission, (b) invalidation of the detection device, (c) failure of the device or repeater, etc. are conceivable. However, the prior art audit apparatus cannot distinguish between the factor (a) and the factor (b).

Attacks that invalidate the detection device for the factor (b) can be classified into yin and yang depending on how the failure appears, and the detection methods differ depending on the type of attack. An explicit attack, such as a DoS (denial of service) attack, can be detected by measuring the amount of computer system resources used. For this reason, it is easy to automate detection by a computer system.
On the other hand, an implicit attack, for example, an attack that bypasses the detection device, can be detected by manually referring to the audit history of the audit device. In this case, it is difficult to automate detection by the computer system.

The audit history is a record of internal processing of the detection device in time series. Therefore, ideally, all of the internal processing of the detection device is recorded as an audit history. However, the storage medium of the audit device is limited, and when the detection device does not detect an abnormality, it is generally not left as an audit history. In this case, if the detection device is bypassed, the audit history is not left. Even when all of the internal processing of the detection device is recorded, it is only possible to infer that detouring has been made from the context of the history. Therefore, the work of extracting the detour of the detection device from the audit history requires a lot of manual confirmation.
An implicit attack that bypasses the security function is hereinafter referred to as a bypass attack.
JP 2005-517349 Japanese Patent Laid-Open No. 2004-030286 JP 2001-216161 A JP 2005-157502 A Special table 2004-529408 gazette Japanese Patent Laid-Open No. 03-041535 JP 10-333902 A

  Therefore, the problem to be solved by the present invention is to provide means capable of quickly detecting a detour attack in a computer system including a plurality of intrusion detection devices.

  In order to solve the above problems, the present invention is a method executed by an auditing device that detects a detour attack that bypasses an intrusion detection device in a computer system including a plurality of intrusion detection devices that are called in accordance with the execution order of processes, The inspection device measures the number of times of use of the intrusion detection device in a predetermined processing unit executed in the computer system, and is set in advance as the measured number of use after use of all the intrusion detection devices in the predetermined processing unit. An attack detection method is provided that compares a planned number of used intrusion detection devices and outputs a signal indicating an abnormality when the measured number of uses does not match the planned number.

  Other aspects of the present invention will be described in detail in the embodiments described later.

  According to the present invention, it is possible to detect a bypass attack by detecting the occurrence of a bypass attack at the exit of a processing unit in the computer system, and it is possible to reduce the time required for detecting the bypass attack.

  Hereinafter, an audit apparatus for detecting a detour attack or a method for detecting the same will be described based on a preferred embodiment (hereinafter, an embodiment) to which the present invention is applied.

(First embodiment)
The feature of the first embodiment resides in that the auditing apparatus is installed at the exit of the system call in the computer system. With this configuration, (a) the use of the detection device can be confirmed for each system call, (b) the use of the planned detection device can be confirmed, (c) not only returning to the exit of the system call, but also the detection device An effect is obtained that it is understood that the auditing device itself has been bypassed.

  FIG. 1 is an example of a block diagram of a computer system in which an audit device is installed at the exit of a system call. The configuration of the computer system of this embodiment will be described with reference to FIG.

  As shown in FIG. 1, the computer system includes a process P101 of a program being executed, a kernel K102 for managing computer system resources in an OS (Operating System), a device D103 storing files, and three detection devices. S1 (111), S2 (112), and S3 (113) are comprised. An auditing device T120 is added to this computer system. The auditing device T120 includes a counter (301 or 501) for detecting a detour attack.

The computer system includes a storage device such as a CPU (Central Processing Unit), a RAM (Random Access Memory), and a hard disk as a hardware configuration. Further, the process P101 and the kernel K102 are realized by, for example, developing a program executed as the process P101 and the kernel K102 stored in the storage device on the RAM and executing the program by the CPU.
Further, the auditing device T120 and each of the detection devices S1 (111), S2 (112), and S3 (113) are embodied as a program stored in a storage device, a board type computer built in a computer system, or a computer system It can be embodied as dedicated hardware such as another computer system connected to the outside. The configuration and operation of the counter (301 or 501) will be described later.

  In the computer system shown in FIG. 1, three detection devices S1 (111), S2 (112), and S3 (113) are connected to S1 (111) → S2 (112) from the entrance of the system call e issued by the process P101. ) → Intrusion detection is performed in the order of S3 (113). Then, each of the detection devices S1 (111), S2 (112), and S3 (113) notifies the auditing device T120 that the device has been used together with the presence or absence of abnormality at the exit of the processing. The auditing device T120 stores this notification. Then, the kernel K102 performs inspection of all the detection devices S1 (111), S2 (112), and S3 (113), and executes the main body of the system call e process when no abnormality is found. For example, after accessing the file via the device D103, the process returns to the exit of the system call e. Then, at the exit, the auditing device T120 is called to check whether there is an abnormality.

  Here, taking as an example a case where a detour attack that bypasses the detection devices S2 (112) and S3 (113) occurs, out of the three detection devices S1 (111), S2 (112), and S3 (113) In the detection device S1 (111), the detection device S2 (112) and the detection device S3 (113), which are determined to be normal (actually omission of detection), are not used, and the file is directly accessed via the device D103. . As a result, there is a risk that a file that would otherwise be inaccessible may be altered or leaked. In addition, the control of the process P101 may be taken and further attacks and intrusions may be repeated.

  As shown in FIG. 1, by installing the auditing device T120 at the exit of the system call e, when the auditing device T120 is called at the exit of the system call e, each detection device S1 (111), S2 ( 112), the notification indicating that S3 (113) has been used cannot be detected by the auditing device T120, so that it is possible to detect that a detour attack has occurred. In this case, the detour attack can be detected earlier than the conventional method of referring to the history.

  Note that, depending on the OS process control method, the auditing apparatus T can be called not at the exit of the system call e but at the entrance where the device D103 is called. In that case, it can be expected to stop unauthorized access and privilege seizure accompanying the detour attack. That is, not only the computer system shown in FIG. 1 but also a detour attack can be detected by installing the auditing device T120 on the rear side of a plurality of detecting devices in the system call e.

Further, for example, when there are two processes and one of the processes calls the device D103 and an interrupt is made to transfer control to the other process, the auditing device T120 may be called when the interrupt occurs. .
In the computer system shown in FIG. 1, it is assumed that the detection device S1 (111) is a memory protection device, the detection device S2 (112) is a sandbox, and the detection device S3 (113) is a forced access control device. The present invention is not limited to these, and can be applied regardless of the type of detection device.

  Furthermore, in this embodiment, the auditing device T120 receives a notification indicating that the detection device S has been used at the exit of the detection device S without depending on the internal processing of the detection device S such as history and alarm output. The number of detectors S used can be measured. By this method, (a) a hook can be used for measuring the number of used inspection apparatuses S, and the influence on the kernel K and the detection apparatus S is small. (B) Even if the auditing apparatus T is called at any place, it is used. There is an effect that the measurement error of the number is eliminated, (c) the performance degradation due to the measurement is reduced as compared with the case of inquiring from the inspection apparatus T or the history analysis.

  Next, a procedure for measuring the number of detection devices used in the computer system will be described. Here, FIG. 2 is an example of a sequence diagram illustrating a procedure for measuring the number of detection devices used.

  The computer system in the sequence diagram shown in FIG. 2 has the same configuration as that of the computer system shown in FIG. 1, and includes a process P101, a kernel K102, a device D103, and three detection devices S1 (111) and S2 (112 ), S3 (113). Furthermore, the computer system shown in FIG. 2 detects a detection device S4 that is an electronic signature device that detects falsification of the process P101 as a detection device that does not depend on the system call e, and a library call during the operation of the process P101. It is assumed that a detection device S5 that is a memory protection device different from the detection device S1 that detects tampering of the library is provided.

  In FIG. 2, check points CPi (i = 1,..., 5) indicate the exits of the detection devices Si (i = 1,..., 5). A hook is provided that assumes that the detection device Si is used when passing through the check point CPi. This hook includes processing for calling a counter (301 or 501) described later. This hook is software that is preferably easy to incorporate in any location inside the kernel K.

Referring to FIG. 2, when a program including process P101 is executed in the computer system, kernel K102 calls detection device S4, detects falsification of process P101, and at the exit (CP4) of detection device S4, The audit device T120 is notified of the use of the detection device S4 by the hook together with the detection result.
Then, the program calls the process P101 library. At that time, the detection device S5 is called, the alteration of the called library is detected, and at the exit (CP5) of the detection device S5, the use of the detection device S4 is notified to the auditing device T120 by the hook together with the detection result. To do.

Thereafter, a service routine is started by the system call e, and the detection devices are called in the order of the detection device S1 (111) → the detection device S2 (112) → the detection device S3 (113), and the exits (CP1, CP2) of each detection device. , CP3), the audit device T120 is notified of the use of each detection device by the hook together with the detection result.
Then, at the exit of the service routine by the system call e, the auditing device T120 is called to check whether there is an abnormality (not shown).

  In the example of the detour attack that bypasses the detection devices S2 (112) and S3 (113), since the place where the detection device S1 → the detection device S2 → the detection device S3 is repeated is bypassed, for example, check as follows. Suppose that the point CPi is passed.

CP1->CP2->CP3->CP1->CP2->CP3->CP1->CP1->CP2-> CP3
(Detecting device: S1->S2->S3->S1->S2->S3->S1->S1->S2-> S3)

  In this example, the system call e is repeated four times, and it is understood that CP2 → CP3 cannot be measured in the third to fourth repetitions. In this case, at least one detection device is bypassed. I understand.

Next, the counter built in the inspection apparatus T120 will be described in detail by showing two embodiments.
(First embodiment)
Here, FIG. 3 is a diagram showing a configuration of the counter 301 of the first embodiment built in the inspection apparatus T120. The configuration of the counter 301 will be described in detail with reference to FIG.

  The counter 301 built in the auditing device T120 includes a subtracter C311, a comparator A312, a register m314, and a register n313. Note that the auditing device T120 may include a storage medium for recording the detection results and execution history of the detection device Si (i = 1, 2, 3).

The register n303 stores the actual number n of detectors Si used from the start (entrance) to the end (exit) of the audit of the system call as a variable that changes at every checkpoint CPi.
In the register m304, the planned number M, which is a preset number of times of use of the detection device Si from the start of the audit of the system call to the end of the audit, is stored as a constant via the audit device T512.

  The subtractor C311 operates when measuring the detection device Si, and resets the value of the register n303 to the value of the register m304 as an initial operation for starting the audit of the system call. Further, when the passage of the check point CPi (i = 1, 2, 3) is confirmed from the start of the audit to the end of the audit, 1 is subtracted from the value of the register n303.

  The comparator A 312 operates when calling the auditing device T120, and compares the value of the register n313 with 0. In this comparison, if the register n313 is 0, 0 (normal) is output, and if it is not 0, 1 (abnormal) is output.

In the configuration of the counter 301 shown in FIG. 3, there are two input paths. That is, a planned system (register m314) and a measured system (subtractor C311 and register n313). The planned system completes the writing at the entrance of the system call, and after that, it specializes in reading. On the other hand, the system to be measured is initialized at the entrance of the system call, and thereafter only the subtraction is executed. By adopting such a configuration, falsification of the planned number M and the used number n is prevented. However, by acquiring the planned number M via the subtracter C311, the input system can be made one system.
In the configuration of the counter 301 shown in FIG. 3, the output path is one system. Therefore, it is possible to prevent the entire auditing apparatus T120 from being affected.
Further, the planned number M, which is a preset use count of the detection device Si in the system call, is stored in, for example, a storage area inside the auditing device T120. The planned number M can be set according to the type of system call.

  In the computer system of this embodiment, the audit period to be audited by the auditing apparatus T120 is the unit of system call e. However, the process P101 for executing a plurality of system calls is set as the audit period, and the auditing apparatus is set at the exit of the process P101. You may call T120. In this case, the auditing device T120 detects a detour attack using the planned number M of the detecting devices S1 (111), S2 (112), and S3 (113) through the process P101. In this case, the planned number M of the detection device Si for each process can be stored in an internal table of the process or stored in a storage area inside the auditing device T120.

Next, the operation of the counter 301 of this embodiment having the above-described configuration will be described.
Here, FIG. 4 is a flowchart for explaining the operation of the counter 301.

  In this example, the plan number M is 3, and <S1, S2, S3> <S1, S2, S3> <S1, S2, S3> <S1, S2, S3> are called in this order. I will explain. In the following, <> represents the entrance and exit of the system call e.

  First, the auditing device T120 sets the register m314 to the planned number M at the entrance of the system call. The subtractor C311 is reset by setting the register m314 in the register n313. As a result, the planned number M is set in the register (number of uses) n313 (step 401).

  Next, the subtractor C311 determines whether or not the detection device Si (i = 1, 2, 3) has been called (step 402), and if it is called (Y in step 402), the subtracter C311 1 is subtracted from the register (number of uses) n313 (step 403).

  Then, the comparator A 312 determines whether or not the audit device T120 is called at the exit of the system call (step 404). If the audit device T120 is not called (N in step 404), the process returns to step 402. Then, it is determined whether or not the detection device Si has been called again.

  On the other hand, when the auditing device T120 is called (Y in Step 404), the comparator A 312 determines whether or not the register n313 is 0 (Step 405). If the register n313 is 0 (Y in step 405), the comparator A312 determines that there is no detour attack (step 406), and outputs 0 (normal) as the return value of the auditing device T120 for processing. Exit. Thereafter, returning to the exit of the system call, the processing of the process P is continued, and the same processing is repeated in the second and subsequent system calls.

  Here, for example, assume that the detection devices are called in the order of <S1, S2, S3> <S1, S2, S3> <S1, S2> <S1, S2, S3>. In this case, S3 is not called by the third system call. Therefore, unlike the first and second times, the third system call does not match the constant 0 (N in step 405) because the register n313 is 2 in the determination in step 405. Therefore, the comparator A 312 determines that there is a detour attack (step 407), outputs 1 (abnormal) as the return value of the auditing device T120, and ends the process. Thereafter, returning to the exit of the system call, the processing of the process P is continued, and the same processing is repeated in the second and subsequent system calls.

  In the above-described embodiment, the case where the planned number M and the used number n common to the computer system in the system call are compared has been described. As a modification of the present embodiment, for example, even when different system calls are executed or when different processes are executed, it is possible to cope with them. In that case, the planned number M of each system call or process is set in the register m314.

  In the embodiment, the example using the subtractor C311 has been described. However, the same determination can be realized by using an adder instead of the subtracter C311 and comparing the integrated value of the number n used with the planned number M. Is possible.

  As described above, according to the auditing device T120 including the counter 301 according to the present embodiment example, since the auditing is performed at the exit of the system call, it is possible to detect the detour attack regardless of the arrangement of the detection device Si. Therefore, the maintainability of the audit device is improved.

(Second Embodiment)
The counter of the first embodiment is intended for a case where the auditing device T120 is called for each system call. On the other hand, the counter of the second embodiment is intended for a case where a process unit, that is, a plurality of system calls are bundled to perform an audit. In this case, it is desirable to use an adder because it is necessary to hold the total number of system calls or usages.

  Here, FIG. 5 is a drawing showing the configuration of the counter of the second embodiment incorporated in the auditing apparatus T120. The configuration of the counter 501 will be described in detail with reference to FIG.

  The counter 501 built in the inspection apparatus T120 includes an adder C1 (511), an adder C2 (513), a multiplier (including a comparator 514) A512, a register m522, a register n521, and a register t523. With. In this embodiment, in order to show the difference from the apparatus configuration of the first embodiment, the comparator 514 is provided in the multiplier A512. However, the comparator 514 and the multiplier A512 are different. It may be a configuration. Further, the auditing device T120 may include a storage medium for recording the detection result and execution history of the detection device Si.

The register n521 stores the actual number n of detectors Si used from the start of audit (entrance) to the end of audit (exit) as a variable that changes every time the check point CPi is passed.
In the register m522, the planned number M, which is a preset number of times of use of the detection device Si for each system call, is stored as a constant via the auditing device T120. In the present embodiment, the planned number M is a value common to the computer system regardless of the type of system call.
Further, the register t523 stores the number of executions of the system call from the start of the audit to the end of the audit as a variable that changes at every entry of the system call.

The multiplier A512 operates when calling the auditing device T120, and multiplies the values of the register m522 and the register t523 at that time.
The comparator 514 compares the register n521 and the multiplication result of the multiplier A512. Further, 0 (normal) is output when the register n521 matches the multiplication result, and 1 (abnormal) is output when they do not match.

  The adder C1 (511) operates when measuring the detection device Si. As an initial operation, the value of the register n521 is reset to 0 at the start of the audit, and the passage of the check point CPi is confirmed at the exit of the detection device Si. Later, 1 is added to the value of the register n521.

  The adder C2 (513) operates when the system call is called. As an initial operation, the value of the register t523 is reset to 0 at the start of the audit, and whenever the system call entrance is confirmed, the adder C2 (513) Add 1 to the value.

Next, the operation of the counter 501 of the present embodiment having the above configuration will be described.
Here, FIG. 6 is a flowchart for explaining the operation of the counter 301.

  Here, in common with computer systems, the planned number M, which is the number of times the detector Si (i = 1, 2, 3) is used, is 3, and <S1, S2, S3> <S1, S2, S3> < A description will be given using an example in which the detection device Si is called in the order of S1, S2, S3> <S1, S2, S3>. In the following, <> represents the entry and exit of a system call.

  First, the auditing device T120 sets the register m522 to the planned number M (= 3) at the entrance of the system call (step 601). The adder C1 (511) sets the register (use number) n521 to 0 (step S602), and the adder C2 (513) sets the register (system call number) t523 to 0 (step 603). .

  Next, auditing measurement is started, and the adder C2 (513) determines whether or not a system call has been issued (step 604). If a system call is detected (Y in step 604), the register (number of system calls) t523 is incremented by 1 (step 605), and the process returns to the determination in step 604.

  On the other hand, when the system call is not detected (N in Step 604), the adder C1 (511) determines whether or not the detection device Si (i = 1, 2, 3) is called (Step 606). If called (Y in Step 606), the adder C1 (511) adds 1 to the register (number of uses) n (Step 607) and returns to the determination in Step 604.

  On the other hand, when the detection device Si is not called (N in step 606), the multiplier A512 determines whether or not the auditing device T120 is called at the exit of the system call (step 608). If not called (N in step 608), the process returns to step 604 to repeat the issuance of the system call and the detection of the calling of the detection device Si.

On the other hand, when the auditing device T120 is called (Y in Step 608), the measurement for auditing is terminated, and the multiplier A512 refers to the register (plan number) m522 and the register (system call number) t523. (Step 609), the cumulative number (m × t) obtained by multiplying the value of the register m522 and the value of the register t523 is calculated (step 610).
Then, the comparator 514 refers to the register (use number) n521 (step 611) and determines whether or not the value of the register (use number) n521 matches the cumulative number (m × t) ( Step 612).

  In this example, since the value of the register t523 is 4, the value of the register m522 is 3, and the value of the register n521 is 12, the value of the register n521 matches the cumulative number (m × t) ( In step 612, Y), the comparator 514 determines that there is no detour attack (step 613), outputs 0 (normal) as the return value of the auditing device T120, and ends the process. Then, return to the exit of the system call and continue processing the next process.

  Here, using the example in which the detection devices are called in the order of <S1, S2, S3> <S1, S2, S3> <S1, S2> <S1, S2, S3>, a detour attack in the flowchart shown in FIG. The case of detecting the will be described. In this example, the detection device S3 is not called by the third system call.

  In this case, since the value of the register t523 is 4, the value of the register m522 is 3, and the value of the register n521 is 11, the value of the register n521 does not match the cumulative number (m × t) ( In step 612, N), the comparator 514 determines that there is a detour attack (step 614), outputs 1 (abnormal) as the return value of the auditing device T120, and ends the process. Then, return to the exit of the system call and continue processing the next process.

  In the above description, the detection devices S1, S2, and S3 are accumulated together using the register n. Therefore, strictly speaking, there is a risk of detection failure. For example, for normal <S1, S2, S3> <S1, S2, S3> <S1, S2, S3>, abnormal <S1, S2, S3> <S1, S3> <S1, S1, S2, S3> Cannot be detected. However, in place of the register n, each of the detection devices Si (i = 1, 2, 3) includes the registers n1, n2, and n3, so that verification can be performed separately. In this example, the normal value is n1 = n2 = n3 = 3, but n1 = 4, n2 = 2, and n3 = 3. Therefore, an abnormality can be detected by comparing each register. .

  According to the auditing apparatus T120 including the counter according to the present embodiment described above, a bypass attack can be detected by collecting a plurality of system calls. Further, the present invention can be applied regardless of the type of system call, and the auditing device T120 can be flexibly operated.

It is a block diagram of the computer system which installs an audit device in the exit of a system call. It is a sequence diagram explaining the procedure which measures the usage-amount of a detection apparatus. It is drawing which shows the structure of the counter which concerns on the example of 1st Embodiment. It is a flowchart explaining operation | movement of the counter which concerns on the example of 1st Embodiment. It is drawing which shows the structure of the counter which concerns on the example of 2nd Embodiment. It is a flowchart explaining operation | movement of the counter which concerns on the example of 2nd Embodiment.

Explanation of symbols

101 Process P
102 Kernel K
111 Detector S1
112 Detector S2
113 Detection device S3
120 Audit equipment T
312 Comparator A
311 Subtractor C
313,521 Register n
314, 522 register m
512 Multiplier A
514 Comparator 523 Register t

Claims (10)

In a computer system comprising a plurality of intrusion detection devices that are called according to the execution order of processes, an attack detection method executed by an auditing device that detects a detour attack that bypasses the intrusion detection device,
The audit device is
Measuring the number of times the intrusion detection device is used in a predetermined processing unit executed in the computer system;
In the predetermined processing unit, after using all of the intrusion detection devices, compare the measured number of times of use with a planned number of preset use of the intrusion detection device,
An attack detection method comprising: outputting a signal indicating abnormality when the measured number of uses and the planned number do not match. The attack detection method according to claim 1, wherein the number of uses is measured by receiving a signal indicating that each intrusion detection device has been used. In a computer system comprising a plurality of intrusion detection devices that are called according to the execution order of processes, an attack detection method executed by an auditing device that detects a detour attack that bypasses the intrusion detection device,
The audit device includes a first register, a second register, a subtractor, and a comparator,
In a predetermined processing unit executed in the computer system, a planned number that is a preset number of use of the intrusion detection device is stored in the first register,
The subtractor sets the value of the first register to the initial value of the second register at the entrance of the predetermined processing unit;
When the subtractor obtains a signal indicating that the intrusion detection device has been used, it subtracts 1 from the second register,
The attack detection method, wherein the comparator determines that the value of the second register is not 0 at the exit of the predetermined processing unit unless the value of the second register is 0. 4. The system according to claim 1, wherein the predetermined processing unit is a system call issued by the process, and the planned number is a value set for each system call. 5. The attack detection method described in 1. The attack detection method according to any one of claims 1 to 3, wherein the predetermined processing unit is the process, and the planned number is a value set for each of the processes. . In a computer system comprising a plurality of intrusion detection devices that are called according to the execution order of processes, an attack detection method executed by an auditing device that detects a detour attack that bypasses the intrusion detection device,
The audit device includes a first register, a second register, a third register, a first adder, a second adder, a multiplier, and a comparator,
In the system call issued by the process, a planned number that is a preset number of use of the intrusion detection device is stored in the first register,
At the entrance of the process, the first adder sets the second register to 0, the second adder sets the third register to 0,
The second adder adds 1 to the value of the third register each time the system call is issued,
Each time the first adder obtains a signal indicating that the intrusion detection device has been used in the process, it adds 1 to the second register,
The multiplier multiplies and outputs the values of the second and third registers at the exit of the process;
The attack detection method, wherein the comparator outputs a signal indicating an abnormality when the output of the multiplier does not match the value of the first register. In a computer system comprising a plurality of intrusion detection devices that are called in accordance with the execution order of processes, an audit device that detects a detour attack that bypasses the intrusion detection device,
A first register that stores a planned number that is a preset number of use of the intrusion detection device in a predetermined processing unit executed in the computer system;
A second register that is subtracted each time the intrusion detection device is used;
The value of the first register is stored in the second register at the entrance of the predetermined processing unit, and the signal indicating that the intrusion detection device is used in the predetermined processing unit is obtained each time A subtractor for subtracting 1 from the second register;
A comparator that determines whether or not the second register is 0 at an exit of the predetermined processing unit, and outputs a signal indicating an abnormality when the second register is not 0;
An auditing apparatus comprising: The audit apparatus according to claim 7, wherein the predetermined processing unit is a system call issued by the process, and the planned number is a value set for each system call. The audit apparatus according to claim 8, wherein the predetermined processing unit is the process, and the planned number is a value set for each process. In a computer system comprising a plurality of intrusion detection devices that are called in accordance with the execution order of processes, an audit device that detects a detour attack that bypasses the intrusion detection device,
In a system call issued by the process, a first register that stores a plan number that is a preset use number of the intrusion detection device;
A second register in which the actual number of intrusion detection devices used is stored;
A third register for storing the number of issued system calls;
A first adder that sets the second register to 0 at the entrance of the process and adds 1 to the second register each time a signal indicating that the intrusion detection device is used in the process is acquired. When,
A second adder that sets the third register to 0 at the entrance of the process and adds 1 to the value of the third register each time the system call is issued;
A multiplier for multiplying and outputting values of the second register and the third register at an exit of the process;
A comparator that outputs a signal indicating an abnormality when the output of the multiplier does not match the value of the first register;
An auditing apparatus comprising:

Images