JP2014063349A - Malware detection device and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect malware intruding a control system without damaging the existing operation of the control system.SOLUTION: A router part 11B transfers a packet to virtual PC 13 received from a system network 20 to the virtual PC 13 through an internal network 12, and transfers a response packet received from the virtual PC 13 through the internal network 12 to the system network 20, a storage part 16 stores an assumption list 16A in which a transmission source address and/or execution command of various legal packets assumed to be exchanged through the internal network 12, and an illegality detection part 14 acquires a packet exchanged through the internal network 12, collates the transmission source address and/or execution command of the packet with the assumption list 16A, and detects illegal access by the packet.

Description

  The present invention relates to a network security technique, and more particularly to a malware detection technique for detecting malware that has entered a control system.

  In information systems, unauthorized intrusion of malware from a network to a PC has become a major social problem. Malware is a generic term for malicious programs and malicious programs such as computer viruses and worms. Such malware often incurs serious damage because it expands the range of activities by illegally intruding into a PC and then intruding into another PC using the PC as a stepping stone.

  Conventionally, as a countermeasure technique against such unauthorized intrusion, communication by the decoy server is monitored, and the construction information for constructing a new decoy server according to the reconnaissance behavior and the communication by the decoy server are newly taken. The device setting information to be guided to the server is generated, and a decoy server that allows an intruder to intrude is dynamically constructed based on the construction information, and communication by the decoy server is performed on the network based on the device setting information. Techniques for controlling so as not to be exposed to the outside have been proposed (see, for example, Patent Document 1).

JP 2005-004617 A

Similar to such information systems, control systems that control, monitor, and manage plants and building facilities are systematized by computers. It is necessary to improve.
However, the control system has various problems that are not found in a general information system, and there is a problem that it is impossible to take the same measures as the information system.

  For example, the PC that configures each node of the control system repeatedly executes a process of outputting new instruction data based on the measurement data obtained by each device. Therefore, in order to obtain sufficient responsiveness, It is necessary to shorten the time required for data acquisition, that is, the scan time. Accordingly, when anti-virus software is operated in parallel as in the information system, processing delay may occur and the scan time may increase, and sufficient responsiveness cannot be ensured.

  In principle, the PCs constituting each node of the control system operate continuously for 24 hours to control equipment. Therefore, when anti-virus software similar to the information system is used on the PC of the control system, the PC must be stopped or rebooted when installing anti-virus software or updating for dealing with new malware. I can't.

  The present invention is intended to solve such problems, and an object of the present invention is to provide a malware detection technique that can detect malware that has entered a control system without impairing the existing operation of the control system.

  In order to achieve such an object, a malware detection apparatus according to the present invention is constructed from a plurality of nodes connected via a system network, and operates as a control system that operates continuously for 24 hours to control equipment. On the other hand, it is a malware detection device that detects malware entering from the outside, and is connected to an internal network provided in the device, and the virtual PC that is the access target of the malware and the virtual network received from the system network A packet addressed to the PC is transferred to the virtual PC via the internal network, and a router unit that transfers a response packet received from the virtual PC via the internal network to the system network; Exchange between the router unit and the virtual PC For various legitimate packets that are assumed to be, a storage unit that stores an assumption list in which the source address and / or execution command of the packet is registered, and between the router unit and the virtual PC via the internal network An illegality that captures a packet exchanged in the network, collates the source address and / or execution command of the packet with an assumed list in the storage unit, and detects the presence or absence of unauthorized access by the packet based on the collation result And a detection unit.

  In addition, in the configuration example of the malware detection device, the fraud detection unit may receive the virtual packet as a response to a packet addressed to the virtual PC when the destination of the packet captured from the internal network is the virtual PC. In the case of a packet transmitted from a PC, if the access content of the packet does not match the assumption list, it is determined that the packet is from malware that has entered the node connected to the system network. It is what you do.

  In addition, in the configuration example of the malware detection device, the fraud detection unit may not send the packet taken from the internal network to the virtual PC, and the virtual packet may be used as a response to the packet addressed to the virtual PC. When the packet is not transmitted from the PC and the access content of the packet does not match the assumption list, it is determined that the packet is from malware that has entered the virtual PC. is there.

  In addition, the malware detection method according to the present invention is a malware that is constructed from a plurality of nodes connected via a system network and intrudes from the outside to a control system that operates continuously for 24 hours to control equipment. A malware detection method used in a malware detection device for detecting a packet, wherein a router unit receives an internal network provided in the device for a packet addressed to a virtual PC to be accessed by the malware, received from the system network. A router step for transferring a packet received from the virtual PC via the internal network to the system network, and a storage unit for transferring the packet to the virtual PC via the internal network and the router unit via the internal network. Positive that is expected to be exchanged with a virtual PC A storage step for storing an assumption list in which a source address and / or an execution command of the packet is registered, and a fraud detection unit between the router unit and the virtual PC via the internal network. An illegality that captures a packet exchanged in the network, collates the source address and / or execution command of the packet with an assumed list in the storage unit, and detects the presence or absence of unauthorized access by the packet based on the collation result A detection step.

  ADVANTAGE OF THE INVENTION According to this invention, the malware which invaded the control system can be detected in PC which comprises each node of a control system, without running anti-virus software in parallel. For this reason, it is possible to avoid the occurrence of processing delay that may occur when anti-virus software is operated in parallel, and to suppress the increase in time required to acquire measurement data, that is, scan time, and ensure sufficient responsiveness in equipment control. It becomes possible. In addition, it is not necessary to install anti-virus software or update to cope with new malware, so there is no need to stop or reboot the PC, and the equipment can be operated continuously for 24 hours. it can. Therefore, it is possible to detect malware that has entered the control system without impairing the existing operation of the control system for a control system with various restrictions that is not found in a general information system.

It is a block diagram which shows the structure of a malware detection apparatus. It is a block diagram which shows the structure of a malware detection apparatus. It is a structural example of transfer setting information. It is an example of a structure of an assumption list. It is a flowchart which shows the packet transfer process of a proxy network I / F part and a packet transfer control part. It is a flowchart which shows the unauthorized access detection process of an unauthorized detection part and a virtual PC recording part.

[Principle of the Invention]
First, the principle of the present invention will be described.
A control system that operates continuously for 24 hours to control equipment has the following restrictions.
First, the PCs constituting each node of the control system repeatedly execute a process of outputting new instruction data based on the measurement data obtained by each device. Therefore, in order to obtain sufficient responsiveness, It is necessary to shorten the time required for data acquisition, that is, the scan time. Therefore, when anti-virus software is operated in parallel on such a PC, processing delay may occur and scan time may increase, and sufficient responsiveness cannot be ensured.

  In principle, the PCs constituting each node of the control system operate continuously for 24 hours to control equipment. Therefore, when anti-virus software similar to the information system is used on the PC of the control system, the PC must be stopped or rebooted when installing anti-virus software or updating for dealing with new malware. I can't.

In addition, when anti-virus software is used, it is necessary to modify the anti-virus software program sequentially in order to cope with new malware. However, from the viewpoint of guaranteeing the operation of the PC, such correction should be applied. Should be avoided.
There is also a method to detect malware by scanning various files stored on the hard disk of the PC, but the processing load increases because the processing load on the PC increases and the access speed of the hard disk is delayed. There is a risk that the scan time will increase, and sufficient responsiveness cannot be secured.

On the other hand, the control system has a characteristic network configuration different from a general information system.
That is, each node connected to the system network has a fixed IP address and does not change dynamically. In addition, connection to the Internet is not essential, and connection to an external network can be blocked. In addition, there is a limited monitoring need from an external network, and it is also possible to permit a limited connection through a firewall.

  The present invention pays attention to such network configuration features in addition to the restrictions specific to the control system described above, and unauthorized access by malware on the system network without installing anti-virus software on the PC constituting the node. In this case, unauthorized access by malware is detected by collating with an assumed list in which legitimate accesses are listed.

[Embodiment]
Next, an embodiment of the present invention will be described with reference to the drawings.
First, with reference to FIG. 1, the malware detection apparatus 10 concerning this Embodiment is demonstrated. FIG. 1 is a block diagram showing the configuration of the malware detection apparatus. FIG. 2 is a block diagram showing a configuration of the malware detection apparatus.

  The malware detection device 10 is composed of an information communication device such as a server device or a PC as a whole, and is connected to the system network 20 of the control system 1 that controls, monitors, and manages the plant and building facilities, and enters the control system 1. It has a function to detect unauthorized intrusion malware.

The node ND includes an information communication device such as a server device or a PC as a whole, and is connected to the system network 20 and has a function of performing various processes in the control system 1.
The gateway 30 is composed of a general gateway device as a whole, and has a function of relay-connecting the system network 20 and the external network NW.

  The malware detection apparatus 10 is provided with a router unit 11, an internal network 12, a virtual PC 13, a fraud detection unit 14, a virtual PC recording unit 15, and a storage unit 16 as main functional units.

The router unit 11 includes a dedicated communication processing circuit, and performs a firewall function for restricting and transferring packets exchanged between the system network 20 and the internal network 12 and an operation of the communication I / F in the virtual PC 13. And a proxy function.
The router unit 11 includes a proxy network I / F unit 11A and a packet transfer control unit 11B.

  The proxy network I / F unit 11A is connected to the system network 20 and the packet transfer control unit 11B, receives a packet indicating a request addressed to the virtual PC 13 from the system network 20 side, and transfers the packet to the packet transfer control unit 11B. And a function of transferring a packet transmitted from the virtual PC 13 in response to the request and received by the packet transfer control unit 11B from the system network 20 to the request source.

The proxy network I / F unit 11A has a communication port 11X for connecting to the system network 20, and the IP address and MAC address of the system network 20 are assigned to the communication port 11X. In the example of FIG. 2, the system network 20 is assigned as “LAN2”, and “172.18.21.234” is assigned as the IP address. In addition, as the gateway GW serving as a packet transmission destination to the external network NW, the IP address “172.18.1.21.2” of the communication port 30P of the gateway 30 is assigned.
Further, the communication port 11X is opened in a state where the same port number as that used in the virtual PC 13 can be used. In the example of FIG. 2, “137”, “139”, “445”,..., “135” are opened as available port numbers.

  The packet transfer control unit 11B is connected to the proxy network I / F unit 11A and the internal network 12, and transmits a packet indicating a request addressed to the virtual PC 13 transferred from the proxy network I / F unit 11A to the communication port of the virtual PC 13 Among the 13Ps, the proxy network I / F unit 11A transmits the packet to the same port number as the port number received via the internal network 12, and is transmitted from the virtual PC 13 in response to the request. It has a function of receiving a packet from the internal network 12 and transferring it to the proxy network I / F unit 11A.

  The packet transfer control unit 11B has a communication port 16P for connecting to the internal network 12, and the IP address and MAC address of the internal network 12 are assigned to the communication port 16P. In the example of FIG. 2, the internal network 12 is assigned as “LAN1”, and “192.168.1.1” is assigned as the IP address.

The packet transfer control unit 11B has a general function as a router, for example, a function of transferring / discarding a packet according to filter information at the time of packet transfer, or a network address conversion between the system network 20 and the internal network 12 It has a function.
FIG. 3 is a configuration example of transfer setting information. Here, in addition to the IP address relating to the gateway GW that is a packet transmission destination to the external network NW, the communication port 11X of the proxy network I / F unit 11A, the communication port 11Y of the packet transfer control unit 11B, the virtual PC 13 from the system network 20 Filter information indicating whether or not a packet to be transferred can be transferred, and NAT (Network Address Translation) information for network address conversion between the system network 20 and the internal network 12 are set.

  The internal network 12 is provided inside the malware detection apparatus 10 and has a function of connecting the router unit 11, the virtual PC 13, and the fraud detection unit 14 to each other via the internal network 12 so that packet communication is possible. .

  The virtual PC 13 is virtually constructed on a memory by a computer (not shown) of the malware detection device 10 and is composed of a PC (personal computer) to be accessed by the malware, and is connected to the internal network 12 to receive packets. A function for executing a process according to a request execution command included in a packet received from the transfer control unit 11B via the internal network 12 and a packet indicating a response including the content obtained by this process via the internal network 12 And a function of transmitting to the packet transfer control unit 11B.

The packet transfer control unit 11B has a communication port 13P for connecting to the internal network 12, and the IP address and MAC address of the internal network 12 are assigned to the communication port 13P. The communication port 13P is set so that the port number used by the virtual PC 13 can be used. In the example of FIG. 2, “192.168.1.180” is assigned as the IP address. Further, the IP address “192.168.1.1” of the communication port 11Y of the packet transfer control unit 11B is assigned as the gateway GW serving as a packet transmission destination to the external network NW.
Further, in the communication port 13P, some port numbers are opened in a usable state. In the example of FIG. 2, “137”, “139”, “445”,..., “135” are opened as available port numbers.

  The fraud detection unit 14 is connected to the internal network 12, takes in a packet exchanged between the packet transfer control unit 11 </ b> B and the virtual PC 13, and checks the source address and execution command of the packet to check the packet. The packet is illegally accessed based on whether the access address of the obtained access content and / or the execution command is registered in the assumed list 16A of the storage unit 16 to be described later And a function for determining whether or not.

  Further, if the packet is a packet addressed to the virtual PC 13 or a response to the packet addressed to the virtual PC 13, the fraud detection unit 14 determines that the unauthorized access is due to malware that has entered the node ND on the system network 20. If the packet is not a packet addressed to the virtual PC 13 or a response to the packet addressed to the virtual PC 13, the function determines that the unauthorized access may be due to malware that has entered the virtual PC 13, and supports these unauthorized accesses. A fraud detection result 16B including a packet to be received and a determination result is recorded in the storage unit 16.

  When the fraud detection unit 14 determines that there is a possibility of malware intrusion into the virtual PC 13, the virtual PC recording unit 15 records the fraud image data 16 </ b> C indicating the operation state of the virtual PC 13 in the storage unit 16. It has a function.

The storage unit 16 includes a hard disk and a semiconductor memory, and has a function of storing various processing information and programs used for processing operations in each functional unit.
The processing information stored in the storage unit 16 includes an assumption list 16A, a fraud detection result 16B, and fraud image data 16C.
FIG. 4 is a configuration example of an assumption list. The assumption list 16A is a list indicating access contents of normal packets that are assumed to be exchanged in the internal network 12. Here, a set of attribute information such as a source address and an execution command indicating the characteristics of the packet is registered as an entry.

The fraud detection result 16B is information indicating the contents of fraudulent access detected by the fraud detection unit 14. For example, for unauthorized access from malware that has entered the node ND on the system network 20, the packet data of the packet in which the unauthorized access is detected and its determination result are recorded as the unauthorized detection result 16B.
The unauthorized image data 16 </ b> C is a memory image indicating the operation state of the virtual PC 13 in which malware may have entered, and when malware has entered the virtual PC 13, includes a sample of the malware.

  Among the functional units in the malware detection device 10, the virtual PC 13, the fraud detection unit 14, and the virtual PC recording unit 15 are obtained by a CPU (not shown) reading a program (not shown) from the storage unit 16 and executing it. This is realized by an arithmetic processing unit. This program is stored in advance in an external device or a recording medium (both not shown), and is transferred to and stored in the storage unit 16 of the malware detection device 10.

[Operation of the embodiment]
Next, the operation of the malware detection apparatus 10 according to the present embodiment will be described with reference to FIGS. FIG. 5 is a flowchart showing packet transfer processing of the proxy network I / F unit and the packet transfer control unit. FIG. 6 is a flowchart showing unauthorized access detection processing of the unauthorized detection unit and the virtual PC recording unit.

When the proxy network I / F unit 11A receives the packet a from the system network 20 at the communication port 11X, the packet transfer process shown in FIG. 5 is started.
First, the proxy network I / F unit 11A determines whether or not the received packet a is an ARP (Address Resolution Protocol) packet (step 100). ARP is a protocol for obtaining a MAC address from an IP address.

Here, when the packet a is an ARP packet (step 100: YES), the proxy network I / F unit 11A responds the packet a as a proxy in accordance with the ARP processing (step 101), and a series of packet transfer processing Exit.
On the other hand, when the packet a is not an ARP packet (step 100: NO), the proxy network I / F unit 11A passes the packet a to the packet transfer control unit 11B (step 102).

The packet transfer control unit 11B receives the packet a received from the proxy network I / F unit 11A from the communication port 13P of the virtual PC 13 at the communication port 11X of the proxy network I / F unit 11A. To the same port number m via the internal network 12 (step 110).
The packet transfer control unit 11B stores the port number m of the packet a (Step 111).

Thereafter, the packet transfer control unit 11B receives the packet b transmitted from the virtual PC 13 at the communication port 11Y (step 112), and the packet b is transmitted from the port number m among the communication ports 13P of the virtual PC 13. It is confirmed whether the packet is a response packet to the packet a (step 113).
Here, when the packet b is a response packet from the port number m (step 113: YES), the packet transfer control unit 11B passes the packet b to the proxy network I / F unit 11A (step 114).

The proxy network I / F unit 11A transmits the packet b received from the packet transfer control unit 11B to the system network 20 from the port number m of the communication port 11X (step 103), and ends a series of packet transfer processes.
On the other hand, when the packet b is not a response packet from the port number m (step 113: NO), the packet transfer control unit 11B discards the packet b (step 115) and ends a series of packet transfer processes.

When the packet c is exchanged between the packet transfer control unit 11B and the virtual PC 13 via the internal network 12, the unauthorized access detection process of FIG. 6 is started.
First, the fraud detector 14 checks the destination of the packet c fetched from the internal network 12 (step 120).

  Here, when the destination of the packet c is the virtual PC 13 (step 120: YES), the fraud detector 14 analyzes the access content of the packet by checking the source address and execution command of the packet c (step 120). 121) It is confirmed whether or not the transmission source address and / or execution command of the obtained access content are registered in the preset assumption list 16A (step 122).

At this time, if the access content of the packet c is registered in the assumption list 16A (step 122: NO), the fraud detection unit 14 ends the series of fraudulent access detection processing.
On the other hand, when the access content of the packet c is not registered in the assumption list 16A (step 122: YES), the fraud detection unit 14 refers to the access by the packet c from the node ND on the system network 20. (Step 123), the fraud detection result 16B including the packet c and the determination result is recorded in the storage unit 16 (step 124), and the series of unauthorized access detection processing is terminated.

  The fraud detection result 16B may be displayed on a screen display unit (not shown) of the malware detection device 10 in addition to being recorded in the storage unit 16, and may be displayed on a monitoring device (not shown) connected to the system network 20. ) To notify the operator of the control system 1.

In step 120, if the destination of the packet c is not the virtual PC 13 (step 120: NO), the fraud detector 14 transmits the packet c from the virtual PC 13 to the packet transfer controller 11B as a response to the packet addressed to the virtual PC 13. It is confirmed whether or not the received packet is received (step 125).
If the packet c is a response packet (step 125: YES), the process proceeds to step 121 described above.

  On the other hand, when the packet c is not the response packet (step 125: NO), the fraud detector 14 analyzes the access content of the packet by checking the source address and execution command of the packet c (step 126). Then, it is confirmed whether or not the source address and / or execution command of the obtained access contents are registered in the preset assumption list 16A (step 127).

At this time, if the access content of the packet c is registered in the assumption list 16A (step 127: NO), the fraud detection unit 14 ends the series of fraudulent access detection processing.
On the other hand, when the access content of the packet c is not registered in the assumption list 16A (step 127: YES), the fraud detection unit 14 determines that there is a possibility of malware intrusion into the virtual PC by accessing the packet c. (Step 128), the fraud detection result 16B including the packet c and the determination result is recorded in the storage unit 16 (Step 129), and the series of unauthorized access detection processing ends.

  Further, the virtual PC recording unit 15 acquires a memory image indicating the operation state of the virtual PC 13 in response to the determination by the fraud detection unit 14 that there is a possibility of malware intrusion into the virtual PC 13 (step 130). Data 16C is recorded in the storage unit 16 (step 131), and a series of unauthorized access detection processing is completed.

[Effect of the embodiment]
As described above, in the present embodiment, the router unit 11B transfers the packet addressed to the virtual PC 13 received from the system network 20 to the virtual PC 13 via the internal network 12, and also transmits the packet via the internal network 12 to the virtual PC 13 The packet received from the virtual PC 13 is transferred to the system network 20, and the storage unit 16 transmits the relevant packet for various legitimate packets expected to be exchanged between the router unit 11 and the virtual PC 13 via the internal network 12. The assumption list 16A in which the original address and / or the execution command is registered is stored, and the fraud detection unit 14 captures a packet exchanged between the router unit 11 and the virtual PC 13 via the internal network 12, and the packet Source address and / or execution command Collates the assumption list 16A, is obtained to detect the presence of unauthorized access by the packet based on the comparison result.

As a result, it is possible to detect malware that has entered the control system without running anti-virus software in parallel on the PCs constituting each node of the control system. For this reason, it is possible to avoid the occurrence of processing delay that may occur when anti-virus software is operated in parallel, and to suppress the increase in time required to acquire measurement data, that is, scan time, and ensure sufficient responsiveness in equipment control. It becomes possible. In addition, it is not necessary to install anti-virus software or update to cope with new malware, so there is no need to stop or reboot the PC, and the equipment can be operated continuously for 24 hours. it can.
Therefore, according to the present invention, it is possible to detect malware that has entered the control system without impairing the existing operation of the control system for a control system with various restrictions that is not found in a general information system. .

Further, in the present embodiment, the fraud detector 14 is a packet transmitted from the virtual PC 13 as a response to a packet addressed to the virtual PC 13 when the destination of the packet fetched from the internal network 12 is the virtual PC 13. In some cases, if the access content of the packet does not match the assumption list 16A, it is determined that the packet is from malware that has entered the node ND connected to the system network 20. .
Thereby, when the malware invades the node ND, the intruding portion can be specified.

Further, in the present embodiment, the fraud detection unit 14 does not use the virtual PC 13 as the destination of the packet fetched from the internal network 12 and the packet is transmitted from the virtual PC 13 as a response to the packet addressed to the virtual PC 13. If there is not, the access content of the packet does not match the assumption list 16 </ b> A, and it is determined that the packet is from malware that has entered the virtual PC 13.
Thereby, when malware invades virtual PC 13, the sample of malware can be secured by saving illegal image data 16C indicating the operating state of virtual PC 13.

[Extended embodiment]
The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

  DESCRIPTION OF SYMBOLS 1 ... Control system, 10 ... Malware detection apparatus, 11 ... Router part, 11A ... Proxy network I / F part, 11B ... Packet transfer control part, 11X, 11Y ... Communication port, 12 ... Internal network, 13 ... Virtual PC, 13P ... Communication port, 14 ... Fraud detection unit, 15 ... Virtual PC recording unit, 16 ... Storage unit, 16A ... Assumption list, 16B ... Fraud detection result, 16C ... Fraud image data, 20 ... System network, 30 ... Gateway, 30P ... Communication port, ND ... node, NW ... external network.

Claims (4)

A malware detection apparatus that detects malware entering from the outside with respect to a control system that is constructed from a plurality of nodes connected via a system network and operates continuously for 24 hours to control equipment,
A virtual PC connected to an internal network provided in the device and to be accessed by the malware;
A router for forwarding a packet addressed to the virtual PC received from the system network to the virtual PC via the internal network and forwarding a response packet received from the virtual PC via the internal network to the system network And
A storage unit that stores an assumed list in which a source address and / or an execution command of the packet is registered for various valid packets assumed to be exchanged between the router unit and the virtual PC via the internal network When,
Taking in a packet exchanged between the router unit and the virtual PC via the internal network, collating the source address and / or execution command of the packet with an assumed list in the storage unit, A malware detection device comprising: a fraud detection unit that detects the presence or absence of unauthorized access by the packet based on a collation result. The malware detection device according to claim 1,
The fraud detector, when the destination of the packet taken from the internal network is the virtual PC, or when the packet is a packet transmitted from the virtual PC as a response to the packet addressed to the virtual PC, A malware detection device, wherein if the access content of a packet does not match the assumption list, it is determined that the packet is from malware that has entered the node connected to the system network. In the malware detection apparatus according to claim 1 or 2,
The fraud detection unit, when the destination of the packet taken from the internal network is not the virtual PC and the packet is not a packet transmitted from the virtual PC as a response to the packet addressed to the virtual PC, A malware detection device characterized in that, when the access content of a packet does not match the assumption list, it is determined that the packet is from malware that has entered the virtual PC. Malware detection used in a malware detection device that detects malware entering from outside a control system that is constructed from a plurality of nodes connected via a system network and operates continuously for 24 hours to control equipment. A method,
The router unit forwards the packet received from the system network and addressed to the virtual PC to be accessed by the malware to the virtual PC via the internal network provided in the device, and via the internal network. A router step of transferring a response packet received from the virtual PC to the system network;
The storage unit has an assumed list in which the source address of the packet and / or the execution command is registered for various valid packets assumed to be exchanged between the router unit and the virtual PC via the internal network. A storage step for storing;
The fraud detection unit captures a packet exchanged between the router unit and the virtual PC via the internal network, and sends a source address and / or an execution command of the packet to an assumed list of the storage unit And a fraud detection step for detecting the presence or absence of unauthorized access by the packet based on the collation result.

Images