JP2010182019A - Abnormality detector and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an abnormality detector and a program that can improve accuracy in detecting abnormality caused by a computer virus such as Bot. <P>SOLUTION: A normal profile storage section 16 stores first identification information for identifying a file or a folder operated in a process generated in a normal terminal not infected with a computer virus. A log generating module 12 monitors the behavior of the process generated in a terminal to be monitored, and generates second identification information for identifying a file or a folder operated in the process. A log analysis module 17 compares the first identification information with the second identification information and determines that abnormality has occurred when both do not coincide with each other. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an abnormality detection apparatus that detects an abnormality caused by a computer virus such as a bot. The present invention also relates to a program for causing a computer to function as the abnormality detection device.

  In recent years, damage caused by viruses called bots that cause a computer infected with a virus to perform malicious operations has been increasing. The bot is composed of malicious code having a function of establishing a communication session with an external command server and downloading a new code, a function of receiving a command for an attack, and a function of attacking according to the command.

  However, an increasing number of bots cannot be detected by pattern-matching anti-virus software. Therefore, as a method to detect bots, a detection method focusing on the act of reading its own code (Read) when the bot infects multiple files on the PC and the act of deleting the code to destroy evidence (Delete) Has been proposed (see Non-Patent Document 1, for example).

Takahiro Sakai, Takumi Hase, Keisuke Takemori, Masakatsu Nishigaki, “A Study on the Potential of Bot Detection by Detecting Self-File READ / DELETE”, Malware Countermeasure Research Human Resource Development Workshop 2008 (MWS2008), Session M6-2, 2008 October

  Although the bot can be detected by the above method, there is a problem that some normal processes are erroneously detected.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to provide an abnormality detection device and a program that can improve the accuracy of abnormality detection by a computer virus such as a bot.

  The present invention has been made to solve the above-described problem, and a first identification for identifying a file or folder operated by a first process generated by a normal terminal not infected with a computer virus. The storage means for storing information and the behavior of the second process generated by the monitoring target terminal are monitored, and second identification information for identifying the file or folder operated by the second process is generated. An abnormality detection apparatus comprising: an information generation unit; and a determination unit that compares the first identification information with the second identification information and determines that an abnormality has occurred when the two do not match. It is.

  Further, the present invention provides a storage means for storing first identification information for identifying a file or folder operated by a process generated by a normal terminal not infected with a computer virus, and generated by a terminal to be monitored Second parent information that monitors the behavior of the parent process and the behavior of the child process started by the parent process, identifies the file or folder that the parent process has performed, and the child process operates. Generating means for generating third identification information for identifying the file or folder that has been subjected to the comparison, comparing the first identification information with the second identification information, and comparing the first identification information with the third identification information. If the first identification information and the second identification information do not match, the first identification information and the third identification information do not match, and Determining means for determining that an abnormality has occurred when the first identification information and the second identification information do not match and the first identification information and the third identification information do not match; Is an abnormality detection device characterized by

  The present invention also includes first identification information for identifying a file or folder operated by a first process generated by a normal terminal not infected with a computer virus, wherein the first process is a file. Alternatively, the storage means for storing the first procedure information indicating the procedure when the operation is performed on the folder and the behavior of the second process generated by the monitoring target terminal are monitored, and the second process performs the operation. First identification information generating means for generating information including time identification information and second identification information for identifying a file or folder performed, and the second identification information based on the information generated by the first information generation means. Second information generating means for generating second procedure information including information and indicating a procedure when the second process has performed an operation on the file or folder; the first procedure information; Comparing the second procedure information, an abnormality detection apparatus characterized by comprising determination means that an abnormality when they do not match occurs, the.

  The present invention also provides first identification information for identifying a file or folder operated by a first parent process generated by a normal terminal not infected with a computer virus, and the first parent process. Including a second identification information for identifying a file or folder on which the first child process to be activated operates, and the first parent process and the first child process performed an operation on the file or folder Storage means for storing first procedure information indicating a procedure at the time, the behavior of the second parent process generated by the terminal to be monitored, and the second child process started by the second parent process Information that includes third identification information and time information for monitoring the behavior and identifying the file or folder that the second parent process has operated, and the second child process. Based on the information generated by the first information generating means and the first information generating means for generating the fourth identification information for identifying the file or folder that has performed and the information including the time information. A second procedure information including the identification information and the fourth identification information, and generating second procedure information indicating a procedure when the second parent process and the second child process operate on the file or folder. An abnormality detection comprising: an information generating means; and a determination means that compares the first procedure information and the second procedure information and determines that an abnormality has occurred when the information does not match. Device.

  In the abnormality detection device of the present invention, the second process is a process generated when a user is not operating the terminal to be monitored.

  In the abnormality detection apparatus of the present invention, the parent process and the child process are processes generated when a user is not operating the terminal to be monitored.

  In the abnormality detection device of the present invention, the second parent process and the second child process are processes generated when a user does not operate the terminal to be monitored. .

  Moreover, this invention is a program for functioning a computer as said abnormality detection apparatus.

  According to the present invention, it is determined that an abnormality has occurred when an operation different from the operation of a file or folder by a process generated by a normal terminal not infected with a computer virus is detected. The possibility of erroneous detection of processing can be reduced and the accuracy of abnormality detection can be improved.

It is a block diagram which shows the structure of the abnormality detection apparatus by one Embodiment of this invention. It is a reference figure which shows the information contained in the log in one Embodiment of this invention. It is a reference figure which shows the information contained in the log in one Embodiment of this invention. It is a reference diagram showing an image of processing in one embodiment of the present invention. It is a reference diagram showing an image of processing in one embodiment of the present invention. It is a reference figure which shows the procedure of the file operation in one Embodiment of this invention. It is a reference figure which shows the procedure of the file operation in one Embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows the configuration of the abnormality detection apparatus according to the present embodiment. This abnormality detection apparatus easily extracts details of an operation that may be abnormal by associating an operation that changes the state of a file or folder with a process that executes the operation. In order to achieve this, there is provided a mechanism for hooking system call processing, generating a log relating to file operation (file change / deletion), and analyzing the log.

  A log generation module 12 is provided in the kernel portion of the OS 11 that operates on the terminal to be monitored. The log generation module 12 is a system call issued to the OS 11 when the processes 10a, 10b, and 10c as various application processes access the hardware 13 such as the storage device 13a, the input device 13b, and the output device 13c. Generate a log by hooking the process.

  Linux (registered trademark) is implemented with Linux (registered trademark) Security Module (LSM), which is a framework for extending security functions in the kernel. In LSM, when a file or process is operated, a monitoring point is provided to call a security verification mechanism defined by the user to verify authority and generate a log. The hook for system call processing of this log analysis system is implemented as a security verification mechanism at the monitoring point of LSM.

  The log generated by the log generation module 12 is stored and stored in the log storage unit 14. The operation detection module 15 detects that the user has operated the input device 13b such as a mouse or a keyboard, and generates a log including the operation time (hereinafter referred to as an operation log). The operation log generated by the operation detection module 15 is stored and stored in the log storage unit 14.

  The normal profile storage unit 16 stores a normal profile including information on a normal operation for a file or folder, acquired by a normal terminal that is guaranteed not to be infected with a computer virus. The normal profile is generated based on the result of monitoring the behavior of a normal terminal process. The method for monitoring the behavior of the process is the same as the method for the log generation module 12 monitoring the behavior of the process. The log analysis module 17 analyzes the log stored in the log storage unit 14 and determines whether there is an abnormality.

  Next, details of the log generated by the log generation module 12 will be described. The LSM has monitoring points for about 160 processes such as file processing, program execution processing, and communication processing. In the present embodiment, the log generation module 12 generates a log using monitoring points related to file operations. In the present embodiment, “file_permission”, which is a monitoring point for monitoring reading and writing of files, and “inode_delete”, which is a monitoring point for monitoring file deletion, generate logs.

  2 and 3 show information included in the log generated by the log generation module 12. Information contained in this log is roughly divided into header information and monitoring point specific information. The header information is information recorded in common in the log corresponding to each monitoring point. FIG. 2 shows the contents of the header information. Specifically, the time 200 when the log was recorded, the name 202 of the monitoring point, the ID 204 (pid) of the process that performed the processing, the user ID 206 (uid), the group ID 208 (gid), the ID 210 (parent) of the parent process, The name 212 (parent cmd) of the parent process and the name 214 (cmd) of the process that performed the processing are recorded.

  The monitoring point specific information is information recorded for each monitoring point according to the argument information passed to the hook process. FIG. 3 shows the contents of the monitoring point specific information recorded by “file_permission” for monitoring the reading and writing of the file. Information 300 (inode_num) is a unique identifier assigned to the file. Information 302 (fowner) is a unique identifier indicating the owner of the file. Information 304 (fgrp) is a unique identifier indicating the group to which the file belongs. Information 306 (mode) identifies reading / writing of a file. The value of the information 306 is a value specific to the OS. By reading this value, it is possible to grasp the operation content (read / write). Information 308 (path) is information including the name of the file to be operated and the name of the folder in which the file exists. In the example shown in FIG. 3, “/ home / example /” is the name of the folder, and “path.txt” is the name of the file.

  Hereinafter, information including one header information regarding file operations that can be independently identified and one piece of monitoring point specific information is referred to as a unit log. The log stored in the log storage unit 14 is a collection of unit logs.

  Next, a log analysis method by the log analysis module 17 will be described. In the following description, an operation on a file is described as an abnormality detection target, but the same applies to an operation on a folder as an abnormality detection target.

  There is a possibility that a file operation caused by a user operating a mouse or a keyboard is erroneously detected. Therefore, in this embodiment, the operation of the file during the period when the user does not operate the mouse, the keyboard, or the like is set as an abnormality detection target. However, it is not essential that the file operation during this period be an abnormality detection target, and file operations other than this period may be the object of abnormality detection.

  The log analysis module 17 reads the log generated by the log generation module 12 from the log storage unit 14 and reads the operation log generated by the operation detection module 15 from the log storage unit 14. The operation log records the time when the user operated the mouse, the keyboard, etc., and the log analysis module 17 recognizes the predetermined period based on the time when the user performed the operation as the operation period. The log analysis module 17 extracts a log whose time (time 200 in FIG. 2) is not included in the operation period from the logs generated by the log generation module 12. The log extracted in this way is used in the subsequent processing. Hereinafter, the log extracted as described above is set as a processing target log.

  As processing after the above, four processing examples will be described below.

(First processing example)
First, a first processing example will be described. In the first processing example, when a process accesses a file other than the file that the process originally accesses, it is determined that an abnormality due to a computer virus (particularly a bot) has occurred. FIG. 4 shows an image of processing according to the first processing example.

  In the normal profile stored in the normal profile storage unit 16, information (file name in this embodiment) for identifying a file accessed by a normal terminal process is recorded. Of the processes 400, 410, 420, and 430 operating on the monitored terminal, the processes 400, 410, and 420 access the same file as the file accessed by the normal terminal process. It is determined that there is no computer virus (the possibility of a computer virus is low). However, since the process 430 accesses a file different from the file accessed by the normal terminal process, the process 430 is determined to be abnormal (high possibility of a computer virus). Note that the determination may be performed for each individual file, or for each file type such as a DLL file, a definition file, and an execution file.

  In the first processing example, the log analysis module 17 operates as follows. First, the log analysis module 17 reads a normal profile from the normal profile storage unit 16. Subsequently, the log analysis module 17 compares the file name (information 308 in FIG. 3) recorded in the unit log included in the processing target log with the file name included in the normal profile.

  A plurality of file names are recorded in the normal profile. When the file name recorded in the unit log matches one of the file names recorded in the normal profile, the log analysis module 17 determines that no abnormality has occurred. If the file name recorded in the unit log does not match any file name recorded in the normal profile, the log analysis module 17 determines that an abnormality has occurred. When a plurality of unit logs exist in the processing target log, the log analysis module 17 repeats the above processing.

  With the above processing, the possibility of erroneously detecting normal processing is reduced, and abnormality can be detected. Note that if the combination of the file name and process name recorded in the unit log does not match any combination of the file name and process name recorded in the normal profile, it is determined that an abnormality has occurred. May be.

(Second processing example)
Next, a second processing example will be described. In a terminal infected with a bot, a parent process may activate a child process, and the parent process and the child process may jointly perform desired processing. In the second processing example, it is determined whether there is an abnormality due to the parent-child process. FIG. 5 shows an image of processing according to the second processing example.

  Similar to the first processing example, the normal profile stored in the normal profile storage unit 16 records information (file name) identifying a file accessed by a normal terminal process. In the monitoring target terminal, a parent process 500 and child processes 510 and 520 started by the parent process 500 are operating.

  Since the parent process 500 and the child process 520 are accessing the same file as the file accessed by the process of the normal terminal, it is determined that there is no abnormality, but the child process 510 is the file accessed by the normal process. Since a file different from that is accessed, it is determined to be abnormal. As a result, it is determined that the group including the parent process 500 and the child processes 510 and 520 is abnormal.

  In the second processing example, the log analysis module 17 operates as follows. In the unit log, in addition to the ID (ID 204 in FIG. 2) and name (name 214 in FIG. 2) of the process that performed the file operation, the ID (ID 210 in FIG. 2) and name (ID 2 name 212) is recorded. The log analysis module 17 grasps the parent-child relationship of processes recorded in any two unit logs based on these pieces of information.

  Specifically, the log analysis module 17 associates both unit logs when the ID or name of the process included in one unit log matches the ID or name of the parent process included in the other unit log. . However, although the process ID is information unique to each process that is currently operating at a point in time, it does not guarantee that the process ID is unique to each process at a different point in time. It is more desirable to use the process name for.

  The log analysis module 17 generates information (hereinafter referred to as parent-child relationship information) indicating the parent-child relationship between the two unit logs associated as described above. For example, parent-child relationship information that associates the ID or name of the parent process with the ID or name of the child process is generated. Subsequently, the log analysis module 17 reads the normal profile from the normal profile storage unit 16 and compares the file name recorded in the unit log included in the processing target log with the file name included in the normal profile.

  A plurality of file names are recorded in the normal profile. When the file name recorded in the unit log matches one of the file names recorded in the normal profile, the log analysis module 17 determines that no abnormality has occurred. If the file name recorded in the unit log does not match any file name recorded in the normal profile, the log analysis module 17 determines that an abnormality has occurred. When a plurality of unit logs exist in the processing target log, the log analysis module 17 repeats the above processing.

  The log analysis module 17 extracts the ID or name of the process that performed the file operation from the unit log that was used when it was determined that an abnormality occurred, and based on the parent-child relationship information that includes the ID or name, It is determined that the group including the process is abnormal. The log analysis module 17 associates and stores the unit log information related to the group determined to be abnormal in the log storage unit 14. In the above processing, when the parent process is determined to be normal and the child process is determined to be abnormal, the parent process is determined to be abnormal and the child process is determined to be normal, the parent process is determined to be abnormal and the child process is determined to be abnormal. In either case, it is determined that the group including the parent-child process is abnormal.

  With the above processing, the possibility of erroneously detecting normal processing is reduced, and abnormality can be detected. In particular, when a parent and child process performs a desired process jointly using a bot, it is possible to know the behavior of the parent and child process from the log information related to the group determined to be abnormal. In unit log processing, an error occurs when the combination of the file name and process name recorded in the unit log does not match any combination of file name and process name recorded in the normal profile. You may make it determine with having carried out.

(Third processing example)
Next, a third processing example will be described. In the third processing example, it is determined that an abnormality due to a computer virus (particularly a bot) has occurred when a process accesses a file in a procedure different from the procedure for accessing the file. FIG. 6 shows an example of a procedure when a process originally accesses a file.

  FIG. 6 shows how the process 600 accesses the files 610, 620, 630, and 640. Arrows indicate access to each file by the process 600, and characters written in the vicinity of the arrows indicate the type and order of access. Access types include “r” (read), “w” (write), and “d” (delete). Also, the order is represented by numbers, and the smaller the number, the faster the order. For example, “r1” indicates that the file is read and that the order is first.

The process 600 shown in FIG. 6 accesses each file in the following steps 1 to 4.
Step 1: The file 610 is read.
Step 2: Write to file 620.
Step 3: Write to the file 630.
Step 4: Delete the file 640.

  The normal profile stored in the normal profile storage unit 16 stores information indicating a procedure when a normal terminal process accesses a file. If the file operation procedure detected on the monitored terminal is the same as the procedure recorded in the normal profile, the process that performed the file operation detected on the monitored terminal is determined to be normal. . Also, if the file operation procedure detected on the monitored terminal is not the same as the procedure recorded in the normal profile, the process that performed the file operation detected on the monitored terminal is determined to be abnormal. Is done.

  In the third processing example, the log analysis module 17 operates as follows. First, the log analysis module 17 generates information indicating a file operation procedure detected by the monitoring target terminal based on the processing target log. Specifically, the log analysis module 17 extracts a unit log in which the ID (ID 204 in FIG. 2) and the name (name 214 in FIG. 2) of the same process are recorded, and the time (time 200 in FIG. 2). Arrange unit logs in the order of. As a result, the unit logs are arranged in the order of file operations, and the information of each unit log becomes information of each step constituting a series of procedures.

  Subsequently, the log analysis module 17 reads the normal profile from the normal profile storage unit 16 and compares the information indicating the file operation procedure detected by the monitoring target terminal with the information included in the normal profile. In the normal profile, information on a procedure including one or a plurality of steps is recorded. The log analysis module 17 compares information for each step. First, the log analysis module 17 compares the information on the first step of the file operation detected by the monitoring target terminal with the information on the first step of the file operation recorded in the normal profile.

  The information of each step includes at least the name of the process that performed the file operation, the name of the file, and the type of file operation (read / write / delete). If all of these pieces of information match, the information in the next step is compared. In addition, if even one of these pieces of information does not match, the log analysis module 17 indicates that the procedure of the file operation detected by the monitored terminal is not the same as the procedure recorded in the normal profile. Is determined to have occurred. The above processing is performed for each step. For all steps, if the file operation information detected at the monitored terminal matches the file operation information recorded in the normal profile, the log analysis module 17 determines that no abnormality has occurred. To do. In the normal profile, information indicating the procedure of each file operation is recorded for a plurality of file operations, and the log analysis module 17 repeats the above processing for each file operation.

  With the above processing, the possibility of erroneously detecting normal processing is reduced, and abnormality can be detected.

(Fourth processing example)
Next, a fourth processing example will be described. In the fourth processing example, it is determined whether there is an abnormality due to the parent-child process. FIG. 7 shows an example of a procedure when a process originally accesses a file.

FIG. 7 shows how the parent process 700 and the child process 710 access the files 720, 730, and 740. The meaning of the arrow and the meaning of the characters written in the vicinity of the arrow are the same as in FIG. The parent process 700 and the child process 710 shown in FIG. 7 access each file in the following steps 1 to 5.
Step 1: The parent process 700 reads the file 720.
Step 2: The parent process 700 writes to the file 730.
Step 3: The parent process 700 writes to the file 740.
Step 4: The child process 710 reads the file 730.
Step 5: The child process 710 deletes the file 720.

  In the normal profile stored in the normal profile storage unit 16, information indicating a series of procedures by the parent process and the child process when the process of the normal terminal accesses the file is recorded. If the sequence of file operations detected by the parent and child processes detected on the monitored terminal is the same as the procedure recorded in the normal profile, the detected file operation was performed on the monitored terminal It is determined that the process is not abnormal. Also, if the file operation procedure detected on the monitored terminal is not the same as the procedure recorded in the normal profile, the process that performed the file operation detected on the monitored terminal is determined to be abnormal. Is done.

  In the fourth processing example, the log analysis module 17 operates as follows. First, the log analysis module 17 grasps the relationship between the parent and child processes by the same processing as in the second processing example, and generates parent-child relationship information in which the parent process ID or name is associated with the child process ID or name. To do.

  Subsequently, the log analysis module 17 generates information indicating the procedure of the file operation detected by the monitoring target terminal based on the processing target log. Specifically, the log analysis module 17 extracts a unit log in which the ID (ID 204 in FIG. 2) and the name (name 214 in FIG. 2) of the same process are recorded. The log analysis module 17 also extracts a unit log including the same ID or name as the ID or name of the parent process or child process of this process based on the parent-child relationship information. Thereby, a unit log of a process having a parent-child relationship is extracted.

  Subsequently, the log analysis module 17 arranges the extracted unit logs in order of time (time 200 in FIG. 2). As a result, the unit logs are arranged in the order of file operations, and the information of each unit log becomes information of each step constituting a series of procedures.

  Subsequently, the log analysis module 17 reads the normal profile from the normal profile storage unit 16 and compares the information indicating the file operation procedure detected by the monitoring target terminal with the information included in the normal profile. In the normal profile, information on a procedure including one or a plurality of steps is recorded. The log analysis module 17 compares information for each step. First, the log analysis module 17 compares the information on the first step of the file operation detected by the monitoring target terminal with the information on the first step of the file operation recorded in the normal profile.

  The information of each step includes at least the name of the process that performed the file operation, the name of the file, and the type of file operation (read / write / delete). If all of these pieces of information match, the information in the next step is compared. In addition, if even one of these pieces of information does not match, the log analysis module 17 indicates that the procedure of the file operation detected by the monitored terminal is not the same as the procedure recorded in the normal profile. Is determined to have occurred. The above processing is performed for each step. For all steps, if the file operation information detected at the monitored terminal matches the file operation information recorded in the normal profile, the log analysis module 17 determines that no abnormality has occurred. To do. In the normal profile, information indicating the procedure of each file operation is recorded for a plurality of file operations, and the log analysis module 17 repeats the above processing for each file operation.

  With the above processing, the possibility of erroneously detecting normal processing is reduced, and abnormality can be detected.

  In the first to fourth processing examples described above, the processing result may be displayed on the display device. For example, in the first processing example, information on a file operated by a process determined to be abnormal may be displayed. In the second processing example, information on a file operated by a process determined to be abnormal or information on a parent-child process group including a process determined to be abnormal may be displayed. In the third processing example, a procedure determined to be abnormal may be displayed. In the fourth processing example, the procedure determined to be abnormal and the information of the process group of the parent and child who performed the operation according to the procedure may be displayed.

  Information obtained by a host-type intrusion detection system or an unauthorized process detection system may be used. The host-type intrusion detection system is a system that detects falsification of a system file by storing a normal state of a file or directory of a monitored terminal and periodically checking consistency. The unauthorized process detection system focuses on the feature that a terminal infected with malware sends an unintended packet automatically or by external control regardless of the user's keyboard or mouse operation. It is a system that detects the unauthorized process by profiling the characteristics of the communication in the state, determining that the communication not corresponding to this is abnormal.

  In the host-type intrusion detection system, the name of the file that has detected tampering can be obtained. In the first to fourth processing examples, when it is determined that an abnormality has occurred, the log analysis module 17 compares the name of the file relating to the abnormality with the name of the file acquired by the host-type intrusion detection system. . If the two match, it is possible to know that there is a higher possibility that an abnormality due to a computer virus has occurred.

  In the unauthorized process detection system, the name of the unauthorized process is obtained. In the first to fourth processing examples, when it is determined that an abnormality has occurred, the log analysis module 17 compares the name of the process related to the abnormality and the name of the process acquired by the unauthorized process detection system. If the two match, it is possible to know that there is a higher possibility that an abnormality due to a computer virus has occurred.

  In the third to fourth processing examples, the threshold θ is provided to configure the file operation procedure detected by the monitoring target terminal and the file operation procedure recorded in the normal profile. It may be determined that an abnormality has occurred when the number of steps differs by θ or more.

  Moreover, you may detect the abnormality by a bot as follows. A bot has the feature that its process duplicates (self-replicates) its own file (executable file). In particular, when self-replicating, there is a feature that the file is replicated to a system folder in which files related to the OS are stored.

  In bot self-replication, the bot file (and the folder in which the file was stored) that was the source of the process that performed the file operation (replication), and the file (and its file) that the process performed the file operation (replication) The folder in which the file is stored). Therefore, the file that is the source of the legitimate process that performed the file operation, or the folder in which the file was stored (hereinafter referred to as the file or folder of the operation source process), the file that the process performed the file operation, Alternatively, a relative profile (more specifically, a relative path) with a folder in which the file is stored (hereinafter, referred to as an operation target file or folder) is set as a regular profile.

  If the relative path of the operation target file or folder detected on the monitored terminal is different from the relative path in the regular profile (actually detected on the monitored terminal) If the operation source process file or folder is the same as the operation target file or folder), it is determined that an error has occurred. The relative path may be obtained by calculating the absolute path of the file or folder of the operation source process and the absolute path of the operation target file or folder.

  In addition, since the bot self-replicating files are copied to the system folder, the relative path detected by the above on the monitored terminal does not match the relative path of the regular profile, and the operation target folder is the system folder. If it is a folder, it may be determined that an abnormality has occurred.

  As described above, according to the present embodiment, it is determined that an abnormality has occurred when an operation different from a file or folder operation by a process generated by a normal terminal not infected with a computer virus is detected. Therefore, the possibility of erroneously detecting normal processing can be reduced and the accuracy of abnormality detection can be improved.

  As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the above-described embodiments, and includes design changes and the like without departing from the gist of the present invention. . For example, a program for realizing the operation and function of the abnormality detection device may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read by the computer and executed.

  Here, the “computer” includes a homepage providing environment (or display environment) if the WWW system is used. The “computer-readable recording medium” refers to a storage device such as a portable medium such as a flexible disk, a magneto-optical disk, a ROM, and a CD-ROM, and a hard disk built in the computer. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program described above may be transmitted from a computer storing the program in a storage device or the like to another computer via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the above-described program may be for realizing a part of the above-described function. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer, what is called a difference file (difference program) may be sufficient.

  DESCRIPTION OF SYMBOLS 11 ... OS, 12 ... Log generation module (information generation means, 1st information generation means), 13 ... Hardware, 13a ... Storage device, 13b ... Input device, 13c ... Output device, 14 ... log storage unit, 15 ... operation detection module, 16 ... normal profile storage unit (storage unit), 17 ... log analysis module (second information generation unit, determination unit) )

Claims (8)

Storage means for storing first identification information for identifying a file or folder operated by a first process generated by a normal terminal not infected with a computer virus;
Information generating means for monitoring the behavior of the second process generated by the terminal to be monitored and generating second identification information for identifying the file or folder operated by the second process;
A determination unit that compares the first identification information with the second identification information and determines that an abnormality has occurred when the two do not match;
An abnormality detection device characterized by comprising: Storage means for storing first identification information for identifying a file or folder operated by a process generated by a normal terminal not infected with a computer virus;
Second identification information for monitoring a behavior of a parent process generated by a monitoring target terminal and a behavior of a child process started by the parent process, and identifying a file or folder operated by the parent process; Information generating means for generating third identification information for identifying a file or folder operated by the child process;
The first identification information and the second identification information are compared, the first identification information and the third identification information are compared, and the first identification information and the second identification information do not match. If the first identification information and the third identification information do not match, or if the first identification information and the second identification information do not match, the first identification information and the third identification Determining means for determining that an abnormality has occurred when the information does not match;
An abnormality detection device characterized by comprising: A first process generated by a normal terminal not infected with a computer virus includes first identification information for identifying a file or folder operated by the first process, and the first process operates on the file or folder. Storage means for storing first procedure information indicating a procedure at the time of
The first process for monitoring the behavior of the second process generated by the terminal to be monitored and generating the information including the second identification information for identifying the file or folder operated by the second process and the time information. Information generation means,
Based on the information generated by the first information generating means, second procedure information including the second identification information and indicating a procedure when the second process has performed an operation on a file or folder is generated. Second information generating means for
A determination unit that compares the first procedure information with the second procedure information and determines that an abnormality has occurred when the two do not match;
An abnormality detection device characterized by comprising: First identification information for identifying a file or folder operated by a first parent process generated by a normal terminal that is not infected with a computer virus, and a first process started by the first parent process Second identification information for identifying a file or folder in which a child process has operated, and a procedure when the first parent process and the first child process have performed an operation on the file or folder. Storage means for storing one procedure information;
The behavior of the second parent process generated by the monitoring target terminal and the behavior of the second child process started by the second parent process are monitored, and the second parent process performs an operation. Information including third identification information for identifying a file or folder and time information, and information including fourth identification information for identifying a file or folder operated by the second child process and time information are generated. First information generating means for
Based on the information generated by the first information generating means, the second parent process and the second child process operate on the file or folder including the third identification information and the fourth identification information. Second information generating means for generating second procedure information indicating a procedure when
A determination unit that compares the first procedure information with the second procedure information and determines that an abnormality has occurred when the two do not match;
An abnormality detection device characterized by comprising:   The abnormality detection apparatus according to claim 1, wherein the second process is a process generated when a user is not operating the terminal to be monitored.   The abnormality detection apparatus according to claim 2, wherein the parent process and the child process are processes generated when a user does not operate the terminal to be monitored.   The abnormality detection apparatus according to claim 4, wherein the second parent process and the second child process are processes generated when a user does not operate the monitoring target terminal.   The program for functioning a computer as an abnormality detection apparatus in any one of Claims 1-7.

Images