JP2011210058A - Information processor and computer program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the time required for collation irrespective of the version of definition information for the collation.SOLUTION: A computer program to be executed in the information processor that includes: an information acquisition part which acquires external information for specifying processed data collated based on collation definition information by a hash value and showing a processing result of the processed data, by network communication; a hash operation part which generates the hash value using a hash function applied to generation of the hash value of the external information from data stored in a storage medium; and an object screening part which excludes the data stored in the storage medium from objects to be collated when the hash value generated by the hash operation part matches the hash value of the external information.

Description

  The present application relates to an information processing apparatus capable of executing a collation process for scanning specific data in the apparatus, and a computer program executed by the information processing apparatus.

  Personal computers, which are a type of information processing apparatus, have become widespread. There are many companies and other organizations that have many personal computers for business use, and many households have a plurality of personal computers. Further, in a company, a plurality of personal computers are generally connected by a LAN (Local Area Network) or a WAN (Wide Area Network), and there are some homes where a LAN is constructed.

  Antivirus software is used to ensure the security of various computers including personal computers. The virus check executed by the anti-virus software is a matching process for scanning a file (target data) in a computer to find a portion that matches the virus pattern data. The virus inspection is performed based on definition information indicating virus pattern data.

  In addition to virus inspection, there is a verification process that scans target data. This is the detection of personal information by information leakage countermeasure software. In personal information detection, various dictionaries and lists such as a personal name dictionary, place name dictionary (address information), and mail address list, and detection rules are defined information.

  In recent years, security is regarded as important, and the operation of regularly performing virus inspection (so-called full scan) on all files in a computer is mainly used in companies and public institutions. Since data scanning is a relatively burdensome process for a computer, a full scan places a heavy load on the computer. For this reason, a computer having a specification with particularly low processing capability may be in a state where the user cannot use the computer as usual during a full scan. The same applies to personal information detection.

  Regarding the efficiency of virus inspection, there is a disclosure of a method for determining whether or not reexamination is necessary for data inspected based on information before update when definition information is updated (Patent Document 1). In this method, only when the estimated occurrence date and time of the virus indicated by the updated definition information is later than the date and time of the previous inspection, the inspection based on the updated definition information is performed on the data. Thereby, even if the definition information is updated, it is not necessary to re-examine all data each time.

JP 2007-65810 A

  Normally, data stored in a computer is increasing as user files are created or system files are updated. For this reason, the time required for the collation process for scanning data becomes longer as the computer is used every day. It can be said that the time required for the collation process is gradually increased not only when a full scan is performed on all files but also when a newly created file or an updated file is limited to a target.

  According to the method disclosed in the above-mentioned Patent Document 1, it is determined whether or not virus inspection is necessary for a file created before the definition information is updated. It is possible that the inspection is omitted. However, in the method of the above-mentioned document, virus inspection cannot be omitted for data created or updated after the definition information is updated.

  Therefore, an object of the present application is to provide a computer program that can shorten the time required for collation processing regardless of whether the definition information of the collation processing is new or old.

  The disclosed computer program is a computer program executed in an information processing apparatus, specifies processed data that has undergone collation processing based on collation definition information by a hash value, and indicates a processing result for the processed data An information acquisition unit for acquiring external information by network communication, and a hash calculation unit for generating a hash value from data stored in a storage medium using a hash function applied to generation of a hash value included in the external information A target selection unit that excludes the data stored in the storage medium from the target of the collation process when the hash value generated by the hash calculation unit and the hash value of the external information match. The information processing apparatus is operated as an apparatus having.

  The time required for the collation processing based on the definition information in the information processing apparatus can be shortened by excluding data already processed in other information processing apparatuses from the processing target.

It is a figure which shows the example of the network structure in connection with the assistance system of collation processing. It is a figure which shows the structure of a support system. It is a figure which shows the data structure of the result table which an information processing apparatus holds. It is a figure which shows the point of the hashing of a collation pattern. It is a figure which shows the data structure of the result management table which a server holds. It is a figure which shows the example of the condition which transmits an alert. It is a figure which shows the flow of collation process assistance operation | movement in information processing apparatus. It is a figure which shows the flow of the information collection process in a server. It is a figure which shows the information delivery process in a server. It is a figure which shows an example of the hardware constitutions regarding an information processing apparatus.

  A network 100 illustrated in FIG. 1 is a corporate LAN to which a plurality of information processing apparatuses 1, 1 b, 1 c and a server 3 are connected. Each information processing device 1, 1 b, 1 c is communicably connected to a server 3 that is another information processing device via a network 100 including an access point 5. The information processing apparatuses 1, 1b, and 1c are stationary or portable personal computers, and include a non-illustrated nonvolatile recording medium that stores various programs including an operating system and user files.

  In each of the information processing apparatuses 1, 1b, and 1c, a collation process is regularly executed by anti-virus software or personal information detection software. The execution cycle is, for example, common among the plurality of information processing apparatuses 1, 1b, 1c, and the execution time is individually determined for each information processing apparatus 1, 1b, 1c. In the present embodiment, software for executing the collation process is installed in each information processing apparatus 1, 1b, 1c. However, the software on the server 3 may be activated by the information processing apparatuses 1, 1b, and 1c without installing the dedicated software in the information processing apparatuses 1, 1b, and 1c.

  A support system for reducing the time required for verification processing has been introduced into the network 100. This support system collects the results of the collation processing executed in the information processing apparatuses 1, 1 b, 1 c in the server 3. The result information 7 accumulated in the result management table T2 of the server 3 is distributed to the information processing apparatuses 1, 1b, 1c in a timely manner and is held by the information processing apparatuses 1, 1b, 1c under the management of the support system. The support system refers to the result information 7 held when each information processing device 1, 1 b, 1 c executes collation processing, and uses the processed data (file) indicated by the result information 7 as a target of collation processing Exclude from That is, when the collation process has already been performed for a file in any of the plurality of information processing apparatuses 1, 1b, and 1c, the collation process based on the same definition information for the file is omitted. This means that the collation processing is shared for a plurality of files that are commonly held by the plurality of information processing apparatuses 1, 1b, and 1c.

  Hereinafter, the configuration of the support system will be described. Since the functional configuration related to the support system in the plurality of information processing apparatuses 1, 1b, and 1c is the same, only the information processing apparatus 1 is shown as a representative in the following drawings.

  As illustrated in FIG. 2, the support system 10 includes a plurality of elements provided in the information processing apparatus 1 and a plurality of elements provided in the server 3. The information processing apparatus 1 includes an information acquisition unit 12, a hash calculation unit 14, a target selection unit 16, an information transmission unit 18, and a notification response unit 20 as software elements related to the support system 10. The server 3 includes a reception unit 22, a transmission unit 24, and a notification unit 26 as software elements related to the support system 10. These elements of the support system 10 are functional elements realized by computer programs installed in the information processing apparatus 1 and the server 3, respectively.

  In the information processing apparatus 1, the information acquisition unit 12 acquires external information 72 indicating the processing result of the matching process based on the matching definition information from the server 3 through network communication. The external information 72 includes a hash value that identifies processed data that has undergone the collation process. This external information 72 is information for one delivery of the result information 7 described above. The information acquisition unit 12 records the acquired external information 72 in a result table T1 described later.

  The hash calculator 14 generates a hash value 15 from the data stored in the storage medium 40 using a predetermined hash function. The hash function used by the hash calculation unit 14 is the same as the hash function applied to the generation of the hash value that the external information 72 has. The data converted into the hash value 15 is a file designated as a processing target by the user of the information processing apparatus 1 for the software 30 (in the figure, anti-virus software) responsible for the matching process. If the target designation format is a format for designating a storage area, the hash calculator 14 generates a hash value 15 for each file in the designated storage area. The storage medium 40 is a generic name for storage that is built in or connected to the information processing apparatus 1 that stores a file for which the hash value 15 is to be generated. Usually, a storage such as a hard disk drive (HDD) or an SSD (Solid State Drive) in which an operating system and application programs are installed corresponds to the storage medium 40. A removable storage medium may be included in the storage medium 40.

  The target selection unit 16 refers to the result table T1 and checks whether or not a hash value that matches the hash value 15 generated by the hash calculation unit 14 exists in the result table T1. When a hash value that matches the hash value 15 exists in the result table T1, the information processing apparatus 1 has a result of a collation process performed in the past for a file designated as a collation target It is. In this case, the target selection unit 16 instructs the software 30 that performs the matching process to exclude the file corresponding to the hash value 15 from the target of the matching process. In response to this, the software 30 omits scanning of the file by the analysis engine (collation unit) 32 included therein.

  The information transmission unit 18 transmits the processing result information 71 to the server 3. The processing result information 71 indicates the result of the collation processing performed by the analysis engine 32 for the file stored in the storage medium 40. In addition, the processing result information 71 includes a hash value that identifies a file that is a target of the collation processing. This hash value is generated by the hash calculation unit 14 and is acquired by the information transmission unit 18 through the target selection unit 16. The information transmission unit 18 generates processing result information 71 in which the hash value is associated with the result information received from the analysis engine 32.

  The notification response unit 20 receives an alert described later from the server 3 and executes a predetermined response. For example, when the alert indicates that a virus is detected in a file having the same content as the file held by the information transmission unit 18, the notification response unit 20 instructs the software 30 or other software to remove or quarantine the file. You may make it perform the display which shows the content of an alert.

  On the other hand, in the server 3, the reception unit 22 receives the processing result information 71 transmitted from the information processing apparatus 1 by the information transmission unit 18. The receiving unit 22 records the received processing result information 71 in the result management table T2. Result information 7 is accumulated as described above by sequentially recording the processing result information 71 from the information processing apparatus 1 and the other information processing apparatuses 1b and 1c.

  The transmission unit 24 transmits the undelivered processing result information 71 recorded in the result management table T2 as the external information 72 to the information processing apparatus 1 and the other information processing apparatuses 1b and 1c. The transmission unit 24 transmits the external information 72 in response to a request from the information processing apparatus 1 or other information processing apparatuses 1b and 1c as well as the distribution led by the server 3.

  The notification unit 26 transmits an alert (warning notification). The alert is transmitted when the processing result information 71 received by the receiving unit 22 indicates a match by collation, for example, when a virus is found by virus inspection. The transmission destination of the alert has a file that has been subjected to a collation process based on collation definition information that is different from the collation definition information corresponding to the processing result information 71 and that is a file that indicates matching in the processing result information 71. Information processing apparatuses 1, 1b, and 1c. The notification unit 26 determines whether or not it is necessary to transmit an alert each time the processing result information 71 is received or at a predetermined timing.

  In FIG. 3, the data structure of the result table T1 held by the information processing apparatus 1 is shown. The result table T1 includes, as data items, “matching pattern hash value”, “update date”, “target file hash value”, “location of processing result”, and “processing result information”.

  The “collation pattern” of the “collation pattern hash value” is information indicating data to be collated with a file (target for collation processing) stored in the storage medium 40. For example, a collation pattern in virus inspection is definition information indicating a characteristic bit string pattern of a virus and a countermeasure for the virus. The definition information is managed by software 30 that is responsible for collation processing. Definition information is not always constant so that virus inspection definition information is updated each time a new virus occurs. The dictionary is updated or added even when personal information is detected.

  If the matching patterns are different, the result of the matching process is not always the same even if the target files are the same. If the version number of the definition information is different or the manufacturer of the software 30 to be used is different, the verification pattern is necessarily different. Therefore, in order to omit the collation process in the information processing apparatus 1 for the same file that has been subjected to the collation process in the other information processing apparatuses 1b and 1c in the past, the past collation process and the collation process to be executed in the future Therefore, the matching pattern needs to be the same. In order to facilitate checking whether or not the collation patterns are the same, a hash value is calculated for the collation pattern and recorded in the result table T1 as “the hash value of the collation pattern”.

  In “Hash value of collation pattern” and “Hash value of target file” in FIG. 3, examples of hash values are expressed in alphabetical characters for convenience, such as “AAAA”, “CCCC”, and “ZZZ..ZZ”. However, the actual hash value is a bit string having a predetermined number of digits.

  The hash calculation unit 14 calculates a hash value for the verification pattern. At this time, as shown in FIG. 4A, in the case of virus detection, a hash value may be generated from definition information indicating a virus pattern. In the case of personal information detection, as shown in FIG. 4 (B), a hash value is generated from data obtained by concatenating a group of files related to processing such as a personal name dictionary, a place name dictionary, and a detection rule into one definition information. do it.

  Returning to FIG. 3, the item “update date” indicates a date range in which the processing result information is recorded in the result table T <b> 1. By having this item, it is possible to delete a record that has passed a certain number of days or an old record, thereby making the search of the result table T1 more efficient.

  The “hash value of the target file” is a hash value generated for a file that has undergone collation processing in the information processing apparatus 1 or other information processing apparatuses 1b and 1c in the past. In this item, the number of information processing devices held is preferentially recorded in common with a plurality of information processing devices 1, 1 b, 1 c, or when there is a restriction on the table capacity, for example. It is possible to perform recording selection such as not recording a small number of files.

  “Location of processing result” indicates a position (address) in the memory space in which processing result information for the target file specified by the hash value is stored. In the illustrated example, the seek position of the hard disk is recorded. When there is a matching hash value by searching for the “hash value of the target file” by this item, the processing result information of the file corresponding to the hash value is read with reference to “location of the processing result” Access is possible.

  In “processing result information”, the processing result is recorded. For example, in the case of virus inspection, the presence / absence of virus detection and the type of virus are recorded. In the drawing, an example of the contents of the “processing result information” is shown as a character string for convenience, but the processing result is actually recorded in a data format conforming to the specification of the software 30 responsible for the collation processing.

  FIG. 5 shows the data structure of the result management table T2 held by the server 3. The result management table T2 includes, as data items, “matching pattern hash value”, “client ID”, “hash value of target file”, and “processing result information”. Of these, items other than “client ID” are the same as the items in the result table T1 described above. “Client ID” is identification data that uniquely represents each of the plurality of information processing apparatuses 1, 1b, and 1c.

  FIG. 6 shows an example of a situation where the server 3 sends an alert. Assume that processing result information indicating that a virus is detected in a file having a hash value “XXXXXXXXX” is obtained as shown in the second column from the bottom of the result management table T2 in FIG. This information is a result of collation processing (in this case, virus inspection) based on the definition information whose hash value is “CCCC”, and is information obtained in the information processing apparatus whose “client ID” is “001”. For the file corresponding to this information (has a hash value “XXXXXXXXX”), another processing result information is recorded in the result management table T2. The information is information that there is no problem (no virus was detected) in the collation process based on the definition information whose hash value is “BBBB”. A virus detected in “CCCC” but “no problem” in “BBBB” means that a test based on “BBBB” has a virus detection failure. Therefore, the server 3 transmits an alert for prompting to deal with the file “XXXXXXXXX” to the information processing apparatus (client ID is “002”) that has transmitted a result indicating no problem.

  The operation of the support system 10 described above is shown in the flowcharts of FIGS.

  In FIG. 7, the hash calculator 14 calculates the hash value of the target file for the collation process (# 11). The target file here is a file designated for the software 30 responsible for the collation processing. When full scan is designated, all files in the information processing apparatus 1 become target files. The hash calculator 14 calculates a hash value for each file.

  The target selection unit 16 pays attention to one of the calculated hash values, and checks whether or not the hash value is recorded in the result table T1. At this time, the check is performed from the matching hash value of the matching pattern. That is, in the virus inspection, the same definition information table as the currently checked definition information is read out and collated. If there is no matching pattern hash value, it is determined that it does not exist in the result table (# 12). Since there is a time lag in the distribution of the result information from the server 3, when the load on the network 100 is small, the target selection unit 16 may request the information acquisition unit 12 to acquire the latest result information from the server 3. it can.

  When the focused hash value exists in the result table T1 (YES in # 12), the target selection unit 16 excludes the file corresponding to the hash value from the target of the collation process, and uses the processing result information indicated in the result table T1. (# 13). That is, the target selection unit 16 causes the analysis engine 32 to omit scan analysis (collation processing) for the file, and gives the processing result information read from the result table T1 to the analysis engine 32.

  On the other hand, if the focused hash value does not exist in the result table T1 (NO in # 12), the target selection unit 16 requests the analysis engine 32 to perform scan analysis on the file (# 14).

  Steps # 11 to # 15 are repeated until the process of determining whether or not the scan analysis is necessary for all the files specified for the software 30 is completed (YES in # 15). When the process for determining whether or not the scan analysis is necessary is finished and the scan analysis by the analysis engine 32 is finished, the processing result information 71 in which the information transmission unit 18 associates the analysis result acquired from the analysis engine 32 with the hash value for specifying the target file. Is transmitted to the server 3 (# 16).

  In FIG. 8, the receiving unit 22 of the server 3 receives the processing result information 71 from the information processing apparatus 1 (# 21), and records the received information together with the ID of the information processing apparatus 1 in the result management table T2 (# 22). ). The notification unit 26 determines whether it is necessary to send an alert (# 23), and if the call is necessary (YES in # 23), the alert is sent to the information processing apparatus having the problematic file as described above ( # 24).

  Delivery of the external information 72 to the information processing devices 1, 1b, 1c by the transmission unit 24 of the server 3 is timely and asynchronous with the collection of the processing result information 71 from the information processing devices 1, 1b, 1c by the reception unit 22. (# 31 in FIG. 9).

  As described above, the information processing apparatuses 1, 1 b, and 1 c that reduce the target of the collation processing by using the processing result in another apparatus are, for example, in a personal computer having a general hardware configuration illustrated in FIG. 10. Can be realized. The personal computer has a central processing unit (CPU) 61 that executes various programs, a read only memory (ROM) 62 that stores control programs, and a random access memory (RAM) 63 that serves as a work area. For storage of data, a hard disk drive 64 as a storage is used. A removable media drive 65 for accessing a CD-ROM (Compact Disc Read Only Memory) and a DVD (Digital Versatile Disk) and a communication interface 66 for network connection are also components of the personal computer. A computer program that realizes the function of the support system 10 on the information processing apparatus 1 side can be installed in the storage 64 from a removable storage medium 651 storing the program or an external device connected via the communication interface 66. The personal computer also includes a display 67, a keyboard 68, and a mouse 69 as human interface devices.

  In the above embodiment, the plurality of information processing apparatuses 1, 1b, 1c share the result information 7 by transmission / reception via the server 3, but the plurality of information processing apparatuses 1, 1b, 1c exchange information to obtain result information. 7 can be shared. In that case, each information processing device 1, 1b, 1c has the function of the server 3, grasps which information processing device has performed the matching processing based on which definition information, and sends an alert as necessary.

  In the above-described embodiment, the number of the information processing apparatuses 1, 1b, and 1c that execute the matching process is not limited to 3 as illustrated, and may be plural.

1, 1b, 1c Information processing device (first information processing device)
72 External information 12 Information acquisition unit 40 Storage medium 15 Hash value 14 Hash calculation unit 16 Target selection unit 18 Information transmission unit 3 Server (second information processing apparatus)
22 receiving unit 24 transmitting unit 26 notifying unit

Claims (6)

A computer program executed in an information processing apparatus,
An information acquisition unit that specifies the processed data that has undergone the collation processing based on the collation definition information by a hash value and obtains external information indicating the processing result of the processed data by network communication;
A hash calculation unit that generates a hash value from data stored in a storage medium using a hash function applied to generation of a hash value included in the external information;
A target selection unit that excludes the data stored in the storage medium from the target of the collation process when the hash value generated by the hash calculation unit and the hash value of the external information match. A computer program for operating the information processing apparatus as an apparatus having the apparatus. Processing result information indicating the result of the collation processing performed on the data stored in the storage medium and specifying the target data with a hash value is connected to the information processing apparatus via a network. The computer program according to claim 1, wherein the information processing apparatus is operated as an apparatus having an information transmission unit for transmitting to another apparatus. An information processing apparatus capable of accessing data stored in a storage medium,
An information acquisition unit that specifies the processed data that has undergone the collation processing based on the collation definition information by a hash value and obtains external information indicating the processing result of the processed data by network communication;
A hash calculation unit that generates a hash value from data stored in a storage medium using a hash function applied to generation of a hash value included in the external information;
A target selection unit that excludes the data stored in the storage medium from the target of the collation process when the hash value generated by the hash calculation unit and the hash value of the external information match. An information processing apparatus comprising: A computer program that is executed in a second information processing apparatus capable of communicating with the first information processing apparatus that executes the computer program according to claim 2,
A receiving unit for receiving the processing result information transmitted from the first information processing apparatus;
Operating the second information processing apparatus as a device having a transmission unit that transmits the processing result information received by the reception unit as the external information to another device connected via a network. A featured computer program. When the processing result information received by the receiving unit indicates a match between the data, a matching process based on matching definition information that is data corresponding to the processing result information and different from the matching definition information is received. The computer program according to claim 4, wherein the second information processing apparatus is operated as an apparatus that further includes a notification unit that notifies other apparatuses that hold data about the data. A second information processing apparatus capable of communicating with a first information processing apparatus that executes the computer program according to claim 2,
A receiving unit for receiving the processing result information transmitted from the first information processing apparatus;
An information processing apparatus comprising: a transmission unit that transmits the processing result information received by the reception unit as the external information to another device connected via a network.

Images