JP2015055960A - Monitoring device, information processing system, monitoring method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize structure which can effectively detect malware.SOLUTION: A targeted threat detection device 117 is configured to: detect user activity in a terminal device 103 that cannot be detected by programs of the terminal device 103; detect the terminal device 103 which has been operated by the user or could have been operated by the user, being in such a non-operated state that user will not operate the terminal device 103; and detect malware by monitoring a data transmission state of the terminal device 103 in the non-operated state.

Description

  The present invention relates to a technique for detecting an unauthorized operation on a terminal device, for example, a technique for detecting an unauthorized operation by malware.

Conventional malware detection technology prepares a dedicated malware execution environment, observes the behavior observed when actually executing a suspicious file, and matches the predefined behavior definition of malware When the behavior was observed, it was determined that the executed file was malware (for example, Patent Document 1).
Similarly, as a method of observing behavior and determining whether it is malware, there is also a method of performing multiple analyzes by using a sandbox that can be set by address scanning information detection, vulnerability attack code detection, and malware analysis means, respectively. It has been proposed (for example, Patent Document 2).

JP 2007-334536 A JP 2009-37545 A

Malware operations are detected in an environment where malware analysis is being performed. Therefore, in such an environment, malware does not operate and an environment where malware activity can be performed (an environment in which malware operations are difficult to detect). ) Malware works after it is detected.
For example, malware often detects that the user is actually performing a terminal operation and operates by the user's terminal operation.
In the malware detection technology (for example, Patent Document 1 and Patent Document 2) that determines whether the file is malware or not based on the behavior observed when a conventional suspicious file is actually executed, the suspicious file performs activities as malware. When the conditions to be performed are not satisfied, the behavior as malware is not observed, and as a result, there is a problem that conventional malware detection technology can be avoided.

  The main object of the present invention is to solve such a problem, and it is a main object of the present invention to realize a configuration capable of effectively detecting malware.

The monitoring device according to the present invention is:
Detecting user behavior of the terminal device that cannot be detected by a program included in the terminal device, the terminal device operated by the user or in a state that can be operated by the user is operated by the user. A state detection unit that detects a non-operation state that cannot be performed,
A data transmission status monitoring unit that monitors a data transmission status from the terminal device when the status detection unit detects that the terminal device is in a non-operational state.

In the present invention, a user action that cannot be detected by the program included in the terminal device is detected, and it is detected that the terminal device that has been operated by the user or that can be operated by the user has entered a non-operating state. In this case, the data transmission status from the terminal device is monitored.
For this reason, when the terminal device is infected with malware, it is possible to monitor the data transmission status in a non-operation state that cannot be detected by the malware, and to effectively detect the malware without being detected by the malware. .

FIG. 3 is a diagram illustrating an example of a system configuration according to the first embodiment. FIG. 3 is a flowchart showing an operation example in the system according to the first embodiment. FIG. 6 shows an example of a mouse pad according to the second embodiment. FIG. 10 is a diagram showing a system configuration example according to the third embodiment. FIG. 10 is a flowchart showing an operation example in the system according to the third embodiment. FIG. 10 is a diagram showing a system configuration example according to the third embodiment. FIG. 10 is a diagram showing a system configuration example according to the third embodiment. FIG. 10 is a diagram showing a system configuration example according to the third embodiment. The figure which shows the example of the functional module of the target type attack detection apparatus which concerns on Embodiment 1-3. The figure which shows the hardware structural example of the target type attack detection apparatus which concerns on Embodiment 1-3, and a terminal device.

Embodiment 1 FIG.
In this embodiment, by detecting a contradiction such that the user's terminal behaves suspiciously such as communication in a situation where the user cannot operate by using the state of entering / leaving rooms etc. where malware cannot be detected, A configuration for detecting that a terminal is infected with malware will be described.

  FIG. 1 shows a system configuration example according to the present embodiment.

In FIG. 1, a living room 100 is a place where a user usually performs business using the terminal device 103.
The living room 100 can be entered and exited only through the security gate 102 controlled by the security gate control device 101.
In addition, the users who can enter and leave the room are also restricted.
The terminal device 103 is installed in the living room 100 and is installed for a user to perform information processing operations, and includes a signal input / output unit 104, a calculation unit 105, and a memory 106.
In addition, a keyboard 108, a mouse 109, and a monitor 107 are connected to the terminal device 103 as a basic device configuration for a user to input and output to the terminal device 103.

The terminal device 103 is connected to the network 110, and can communicate with other devices connected to the network 110 through the network 110.
Examples of other devices connected to the network 110 include a file server 111, an authentication server 112, a mail server 113, a proxy 114, and a firewall 115.
Communication with a server on the Internet 116 includes mail transmission / reception via the mail server 113, Web communication via the proxy 114, FTP (File Transfer Protocol), and the like.

The target-type attack detection device 117 is assumed to be connected to the network 110 inside the organization, like the file server 111 and the authentication server 112.
The target-type attack detection device 117 includes a security gate in addition to a log of the terminal device 103 connected to the network 110, devices related to information processing such as the file server 111, the authentication server 112, the mail server 113, the proxy 114, and the firewall 115. It is assumed that logs related to physical facility management such as the user entering and leaving the room 100 such as the control device 101 are also collected and stored in the database.
The target-type attack detection device 117 performs a statistical analysis such as a search based on a keyword, a log aggregation, or a predetermined rule matching with respect to a log accumulated in a database.
The target-type attack detection device 117 generates an alert when notifying an administrator and detecting an event that needs to be dealt with, such as a security breach or failure, and notifies the administrator of the alert.
The target-type attack detection device 117 is an example of a monitoring device.

  FIG. 9 shows functional modules of the target-type attack detection device 117 according to the present embodiment.

In FIG. 9, the communication unit 11 receives logs from each device connected to the network 110.
The communication unit 11 receives, for example, a log of the security gate control apparatus 101, a log of the mail server 113, a log of the proxy 114, and the like.
The log received by the communication unit 11 is stored in the log storage unit 15 that is a database.

The state detection unit 12 analyzes the log of the security gate control apparatus 101 stored in the log storage unit 15 and detects that the user has left the room 100.
That is, the state detection unit 12 detects an action of leaving the room 100 that is a user action that cannot be detected by a program (malware) included in the terminal device, and has been operated by the user or operated by the user. It is detected that the terminal device 103 that has been in the obtaining state has entered a non-operating state that cannot be operated by the user.

The data transmission status monitoring unit 13 monitors the data transmission status from the terminal device 103 when the status detection unit 12 detects that the user has left the room 100 and the terminal device 103 is in a non-operation state. .
Then, when it is detected that data is transmitted from the terminal device 103 while the terminal device 103 is in a non-operation state, the data transmission status monitoring unit 13 determines that the terminal device 103 has been illegally operated by malware. To do.
Further, when the data transmission status monitoring unit 13 detects that data has been transmitted from the terminal device 103, the data transmission status monitoring unit 13 permits the transmission destination (permitted permission) in which the data transmission destination from the terminal device 103 is described in the white list. It may be determined whether or not the terminal device 103 has been illegally operated by malware when the data transmission destination does not match the white list transmission destination.
Note that the white list is stored in the white list storage unit 16.

  The alert generation unit 14 generates an alert for notifying that the terminal device 103 is illegally operated by malware when the data transmission state monitoring unit 13 determines that the terminal device 103 has been illegally operated by malware. And output an alert.

Next, the operation of the target-type attack detection apparatus 117 will be described with reference to FIG.
There are two operations of the target-type attack detection device 117: an operation of collecting various logs and storing them in the log storage unit 15 and an operation of analyzing the collected logs. Since the operation stored in the unit 15 can be realized by a general log collection technique, the description will be given here with an emphasis on the operation of the log analysis technique.

First, the communication unit 11 receives a log indicating that the user of the terminal device 103 has left the room 100 from the security gate control device 101 (S201).
Thereafter, while waiting for the user of the terminal device 103 to enter the room (S202), the data transmission status monitoring unit 13 monitors whether communication is generated from the user's terminal device 103 (S203).
Whether or not communication has been performed is determined from various logs collected in the log storage unit 15.
For example, the communication to the Internet 116 is recorded in the mail transmission log of the mail server 113 and the log of the proxy 114.
Further, the log of the file server 111 records which user accessed which file from which terminal.
In addition, the log of the authentication server records when and by which user the authentication was performed.
The data transmission status monitoring unit 13 analyzes a log transmitted in real time from each device after the user leaves the room 100 to monitor the data transmission status from the terminal device 103.

When the user enters the room 100 (YES in S202), the data transmission status monitoring unit 13 exits the monitoring loop and ends the process.
If communication has occurred from the user terminal device 103 (YES in S203), the data transmission status monitoring unit 13 checks whether the communication destination is listed in the white list (S204).
If the destination is listed in the white list (YES in S204), the data transmission status monitoring unit 13 returns to the monitoring loop.
When the destination is not in the white list (NO in S204), the communication is performed from the terminal device 103 in a situation where the user cannot operate the terminal device 103 (for example, a situation where the user leaves the room), and the data transmission status The monitoring unit 13 determines that unauthorized communication has been performed (S205), and the alert generation unit 14 generates an alert (S206) and notifies the administrator.

Instead of the security gate control apparatus 101, the user's absence and presence may be determined from the video of the monitoring camera.
In this case, even if the user has entered the living room 100, the user can leave the seat and can detect a situation in which the terminal device 103 cannot be operated. Therefore, the presence or absence of the terminal operation can be determined with higher accuracy.

  In addition, instead of the security gate control device 101, it is linked with a conference room reservation WF (Work Flow) in the living room 100, and if it is included in the attending members of the conference, there is a high possibility of leaving It can also be judged.

As described above, based on the entrance / exit log obtained from the log of the security gate control apparatus 101, a situation where the user cannot operate the terminal apparatus 103 is detected, and whether unauthorized communication is performed during that time is monitored. By detecting a physical contradiction, it is determined that the communication performed from the terminal device 103 is due to malware activity, and the terminal device 103 is highly likely to be infected with malware. Can do.
Thereby, even if the terminal device 103 is infected with malware by the targeted attack, it can be detected.
Furthermore, even if it is not malware, even if another user operates the terminal device 103 illegally and communicates with the file server 111 or the Internet 116 while the user leaves the room, the terminal device 103 operates illegally. Can be detected.

As described above, in the present embodiment, the system including the following means has been described.
Means to control entry / exit of rooms (security gate)
Means for controlling security gates Means for performing information processing operations (terminals)
Means to record the presence or absence of communication (access log of proxy or each server)
Means to detect malware activity and unauthorized operation of terminals by detecting physical inconsistencies from security gate logs and terminal communication logs

In the present embodiment, a system including the following means has been described.
Means to determine absence and presence from video of surveillance camera Means to perform information processing (terminal)
Means to record the presence or absence of communication (access log of proxy or each server)
Means to detect malware activity and unauthorized operation of terminal by detecting physical contradiction from surveillance camera log and terminal communication log

In the present embodiment, a system including the following means has been described.
Means to determine absence and presence from conference room reservation WF Means to perform information processing (terminal)
Means to record the presence or absence of communication (access log of proxy or each server)
Means of detecting malware activity and unauthorized operation of terminal by detecting physical contradiction from conference room reservation WF and terminal communication log

Embodiment 2. FIG.
In the first embodiment described above, in the situation where the user cannot operate the terminal device, when communication occurs from the terminal device, infection with malware or unauthorized operation by other users is detected.
Next, an embodiment will be described in which malware observes a user's terminal operation, and detects when the user is engaged in business communication only when the user is using the terminal device.

  FIG. 3 shows an example of the mouse pad 301 used in this embodiment.

The mouse pad 301 includes a liquid crystal portion 302.
It is assumed that the mouse is an optical mouse that senses movement with an optical sensor.
Before leaving the room 100, the user places the mouse connected to the terminal device 103 on the mouse pad 301 and then leaves the room.
The mouse pad senses that the mouse is placed on the liquid crystal part 302 of the mouse pad 301 by the user, or the image drawn on the liquid crystal part 302 is displayed when the user explicitly operates the mouse pad. Operate randomly.
Then, the mouse placed on the liquid crystal portion 302 mistakenly recognizes that the mouse is moving, and sends a mouse operation signal to the terminal device 103.
The terminal device 103 recognizes the mouse operation signal input from the mouse and operates the mouse pointer on the monitor.
Since the operation signal of the mouse is sent from the mouse, the malware misunderstands that the user is operating the terminal device 103 and acts.
At this time, the method for determining whether or not the terminal device 103 is infected with malware based on the occurrence of communication from the terminal device 103 is the same as that described in the first embodiment.

As described above, when the optical mouse that has been used by the user or can be used by the user becomes unusable by the user, the image displayed on the mouse pad 301 is changed. An optical system in which a state in which the optical mouse is moving on the mouse pad 301 is simulated, and a pseudo mouse signal reflecting a pseudo movement locus on the mouse pad 301 of the optical mouse is stationary on the mouse pad 301. Output from the mouse.
Then, the terminal device 103 performs the same processing as that for a normal mouse signal on the pseudo mouse signal from the mouse.
Thereby, the malware in the terminal device 103 misidentifies that the terminal device 103 is used by the user.

Note that although a method for operating an optical mouse using the mouse pad 301 including the liquid crystal portion 302 has been described in Embodiment 2, a tablet terminal is used instead of the mouse pad 301 including the liquid crystal portion 302. You may do it.
In other words, an application for operating the design of the liquid crystal screen may be mounted on the tablet terminal, and when the user leaves the room, the application may be activated to change the design of the liquid crystal screen.
Further, the mouse may be mounted so as to self-run in a predetermined range without using the mouse pad 301 provided with the liquid crystal portion 302.
In the case of the self-propelled type, it is not always necessary to be an optical mouse.
In the case of the self-propelled type, when the user leaves the room, the mouse is self-propelled and a pseudo mouse signal that reflects the movement trajectory of the mouse by self-propelled is output.
Then, the terminal device 103 performs the same processing as that for a normal mouse signal on the pseudo mouse signal from the mouse.
Thereby, the malware in the terminal device 103 misidentifies that the terminal device 103 is used by the user.

As described above, by sending a mouse operation signal to the terminal device when the user is away from the desk, the malware misidentifies that the user is operating the terminal device, thereby promoting the activity of the malware and the user leaving the room. Malware activity is detected from the inconsistency of the terminal operating status.
As a result, it is possible to detect malware that determines whether the user is operating the terminal based on the operation signal of the mouse.

As described above, in the present embodiment, the system including the following means has been described.
Means for detecting malware activity and unauthorized operation of the terminal Means for generating an operation signal from an optical mouse (mouse pad with liquid crystal part)

In the present embodiment, a system including the following means has been described.
Means to detect malware activity and unauthorized operation of the terminal Means to cause the mouse to self-run and generate an operation signal (self-propelled mouse)

Embodiment 3 FIG.
In Embodiment 2 described above, by sending a mouse operation signal to the terminal device, causing the malware to misunderstand that the user is operating the terminal device, prompting the activity of the malware, and the user leaving the room Malware activity is detected from the inconsistency of the terminal operating status.
Next, an embodiment in which malware observes input to the keyboard as a user's terminal operation, and detects when the user performs an activity covered by business communication only when the user is using the terminal device Indicates.

FIG. 4 shows a system configuration example according to the third embodiment.
The difference from FIG. 1 is only the keyboard input simulation device 401 that simulates the keyboard input while the user is absent, and thus description of other devices and functions is omitted.
The keyboard input simulation device 401 is installed at a position where a keyboard input signal is relayed to the terminal device.

  Next, the operation of the keyboard input simulation device 401 will be described with reference to FIG.

  When the user leaves the room (S501), the security gate control apparatus 101 sends a room leaving signal notifying the user of the room leaving (S503) via the network and the terminal device (S502). .

When receiving the exit signal from the security gate control device 101, the keyboard input simulation device 401 issues a command to the terminal device 103 to activate a program (for example, a text editor) that accepts keyboard input (S504), and the terminal A random keyboard input signal (pseudo keyboard signal) is transmitted to the device 103 (S505).
The terminal device 103 that has received the keyboard input signal inputs the keyboard input signal from the keyboard input simulation device 401 on the program that accepts the activated keyboard input.
In the terminal device 103, the same processing as the processing for the keyboard input signal from the keyboard 108 at the time of user operation is performed on the keyboard input signal from the keyboard input simulation device 401.

When the user enters the room, as in the case of leaving the room, an entry signal notifying the user's entry is sent from the security gate control device 101 via the terminal device 103 to the keyboard input simulation device 401 (S506 to S509).
The keyboard input simulation device 401 that has received the entry signal ends the program started on the terminal device 103 (S510).

Since the input signal from the keyboard is sent, the malware misunderstands that the user is operating the terminal device and acts.
At this time, the method for determining whether or not the terminal device is infected with malware based on the occurrence of communication from the terminal device is the same as that described in the first embodiment.

The keyboard input simulation device 401 may be implemented together with functions other than keyboard input simulation, such as a USB (Universal Serial Bus) hub, an IC card reader, and a writer.
Further, as shown in FIG. 6, a mouse can be connected and the mouse / keyboard input simulation device 601 may be implemented.
In this case, since it is possible to simulate a mouse click signal, which was not possible in the second embodiment, there is an advantage that it is more likely to be misidentified by malware.
The functions of the mouse / keyboard input simulation device 601 may be implemented as individual functions of the keyboard and mouse.
In this case, an external device such as a mouse / keyboard input simulation device 601 is not required, and the configuration can be simplified.
Further, as shown in FIG. 7, the mouse / keyboard input simulation device 701 may be configured independently of the connection of the keyboard and the mouse.
In this case, the terminal device 103 recognizes that two keyboards and two mice are connected.
Further, instead of the mouse / keyboard input simulation devices 601 and 701, a keyboard input simulation device 401 and a mouse input simulation device that outputs a pseudo mouse signal may be connected to the terminal device 103.

Further, as shown in FIG. 8, a keyboard and mouse may be connected to the wireless reception device 801, and a simulated keyboard and mouse signal transmitted from the wireless transmission device 802 may be transmitted wirelessly.
In this case, since it is not necessary to prepare as many mouse / keyboard input simulation devices 803 as the number of terminal devices 103, the introduction cost can be reduced.

Further, in the above embodiment, random input is performed by simulating mouse and keyboard input, but meaningful fixed phrases, keyboard input actually input by the user, and mouse movement are stored for a certain period of time. In addition, when a simulated signal is output, a signal may be sent based on the simulated signal so that it cannot be distinguished from the user input.
Thereby, it becomes easy to misunderstand that the user is operating the terminal device with respect to malware.

As described above, the operation status of the terminal when the user is leaving the room by simulating the keyboard and mouse input, thereby causing the malware to misunderstand that the user is operating the terminal. Malware activity is detected from the contradiction.
This makes it possible to detect malware that determines whether or not the user is operating the terminal device based on the operation signals of the keyboard and mouse.

As described above, in the present embodiment, the system including the following means has been described.
Means to detect malware activity and unauthorized operation of terminal Means to simulate keyboard input signal and communicate to terminal via wired connection

In the present embodiment, a system including the following means has been described.
Means for detecting malware activity and unauthorized terminal operation Means for simulating keyboard and mouse input signals and transmitting them to the terminal via wire

In the present embodiment, a system including the following means has been described.
Means to detect malware activity and unauthorized operation of the terminal Means to memorize fixed phrases and signals input by the user for a certain period of time as input signals of the keyboard and mouse, and to convey them to the terminal via wired simulation .

In the present embodiment, a system including the following means has been described.
Means for wirelessly transmitting simulated input signals for keyboards and mice Means for receiving simulated input signals and transmitting them to the terminal

Finally, a hardware configuration example of the target-type attack detection device 117 and the terminal device 103 shown in the first to third embodiments will be described with reference to FIG.
The target-type attack detection device 117 and the terminal device 103 are computers, and each element of the target-type attack detection device 117 and the terminal device 103 can be realized by a program.
As a hardware configuration of the target-type attack detection device 117 and the terminal device 103, an arithmetic device 901, an external storage device 902, a main storage device 903, a communication device 904, and an input / output device 905 are connected to the bus.

The arithmetic device 901 is a CPU (Central Processing Unit) that executes a program.
The external storage device 902 is, for example, a ROM (Read Only Memory), a flash memory, or a hard disk device.
The main storage device 903 is a RAM (Random Access Memory).
The communication device 904 is, for example, a NIC (Network Interface Card).
The input / output device 905 is, for example, a mouse, a keyboard, a display device, or the like.

The program is normally stored in the external storage device 902, and is loaded into the main storage device 903 and sequentially read into the arithmetic device 901 and executed.
The program is a program that realizes the function described as “˜unit” (excluding “˜storage unit”, the same applies hereinafter) shown in FIG.
Further, an operating system (OS) is also stored in the external storage device 902. At least a part of the OS is loaded into the main storage device 903. ”Is executed.
In the description of the first to third embodiments, “determination of”, “determination of”, “detection of”, “detection of”, “analysis of”, “monitoring of”, “ Information, data, signal values, and variable values indicating the results of the processing described as "setting of", "selection of", "generation of", "input of", "output of", etc. It is stored as a file in the device 903.
Further, the encryption key / decryption key, random number value, and parameter may be stored in the main storage device 903 as a file.

  The configuration in FIG. 10 is merely an example of the hardware configuration of the target-type attack detection device 117 and the terminal device 103, and the hardware configuration of the target-type attack detection device 117 and the terminal device 103 is described in FIG. It is not limited to this configuration, and other configurations may be used.

  Moreover, the monitoring method according to the present invention can be realized by the procedure shown in the first to third embodiments.

  DESCRIPTION OF SYMBOLS 11 Communication part, 12 State detection part, 13 Data transmission condition monitoring part, 14 Alert generation part, 15 Log storage part, 16 White list storage part, 100 Living room, 101 Security gate control apparatus, 102 Security gate, 103 Terminal apparatus, 104 Signal input / output unit, 105 arithmetic unit, 106 memory, 107 monitor, 108 keyboard, 109 mouse, 110 network, 111 file server, 112 authentication server, 113 mail server, 114 proxy, 115 firewall, 116 internet, 117 targeted attack detection Device 301 mouse pad 302 liquid crystal part 401 keyboard input simulation device 601 mouse / keyboard input simulation device 701 mouse / keyboard input simulation device 801 wireless reception device 802 radio transmission apparatus, 803 mouse keyboard input simulator.

Claims (18)

Detecting user behavior of the terminal device that cannot be detected by a program included in the terminal device, the terminal device operated by the user or in a state that can be operated by the user is operated by the user. A state detection unit that detects a non-operation state that cannot be performed,
A monitoring apparatus comprising: a data transmission status monitoring unit that monitors a data transmission status from the terminal device when the status detection unit detects that the terminal device is in a non-operational state. The data transmission status monitoring unit
The terminal device according to claim 1, wherein when the terminal device detects that data is transmitted from the terminal device while the terminal device is in a non-operation state, the terminal device determines that the terminal device has been illegally operated. Monitoring device. The state detection unit
The monitoring apparatus according to claim 1, wherein the monitoring apparatus detects that the user has left the terminal apparatus and detects that the terminal apparatus has become non-operational. The state detection unit
The terminal device is detected from a room where access to the room is restricted, detecting that the user has left the room, and detecting that the terminal device is in a non-operating state. The monitoring apparatus according to 1. The monitoring device further includes:
A white list storage unit that stores a white list indicating a permitted data transmission destination that is a data transmission destination permitted to the terminal device;
The data transmission status monitoring unit
When it is detected that data is transmitted from the terminal device, the transmission destination of the data transmitted from the terminal device is compared with the permitted data transmission destination indicated in the white list and transmitted from the terminal device. The monitoring apparatus according to claim 2, wherein when the data transmission destination does not match the permission data transmission destination, it is determined that the terminal device has been illegally operated. A terminal device;
The terminal device that is detected by the user of the terminal device that cannot be detected by the program included in the terminal device and that has been operated by the user or can be operated by the user is transmitted to the user. An information processing system comprising: a monitoring device that detects a non-operation state that cannot be operated and monitors a data transmission state from the terminal device that has become a non-operation state. The monitoring device
7. The terminal device according to claim 6, wherein when the terminal device detects that data is transmitted from the terminal device while the terminal device is in a non-operation state, the terminal device determines that the terminal device has been illegally operated. Information processing system. The monitoring device
The information processing system according to claim 6, wherein the information processing system detects that the user has left the terminal device and detects that the terminal device is in a non-operation state. The terminal device
Connected to the mouse,
When the mouse that has been used by the user or is in a state where it can be used by the user becomes unusable by the user, when the mouse is being used by the user, from the mouse Input a pseudo mouse signal that simulates the output mouse signal,
The information processing system according to claim 6, wherein the same process as the process for the mouse signal is performed on the input pseudo mouse signal. The terminal device
Connected to the optical mouse used on the mouse pad to display the image,
The image displayed on the mouse pad changes when the optical mouse that has been used by the user or can be used by the user becomes unusable by the user. The state that the optical mouse is moving on the mouse pad is simulated, and the pseudo mouse signal reflecting the pseudo movement locus of the optical mouse on the mouse pad is stationary on the mouse pad. The information processing system according to claim 9, wherein the information is input from the optical mouse. The terminal device
Connected to a self-propelled mouse,
When the mouse that has been used by the user or is in a state that can be used by the user becomes unusable by the user, the mouse self-runs, and the movement trajectory of the mouse by self-running The information processing system according to claim 9, wherein a pseudo mouse signal reflecting the above is input from the mouse. The terminal device
It is connected to a mouse input simulator that generates a pseudo mouse signal,
When the mouse that has been used by the user or can be used by the user becomes unusable by the user, a pseudo mouse signal generated by the mouse input simulator is used as the mouse. The information processing system according to claim 9, wherein the information is input from an input simulation device. The terminal device
Connected to the keyboard,
From the keyboard when the keyboard is being used by the user when the keyboard that has been used by the user or is in a state where it can be used by the user becomes unusable by the user Input a pseudo keyboard signal that simulates the output keyboard signal,
The information processing system according to claim 6, wherein the same process as the process for the keyboard signal is performed on the input pseudo keyboard signal. The terminal device
Connected to a keyboard input simulator that generates a pseudo keyboard signal,
When the keyboard that has been used by the user or can be used by the user becomes unusable by the user, a pseudo keyboard signal generated by the keyboard input simulator is used as the keyboard. The information processing system according to claim 13, wherein the information is input from an input simulation device. The monitoring device
The terminal device is detected from a room where access to the room is restricted, detecting that the user has left the room, and detecting that the terminal device is in a non-operating state. 6. The information processing system according to 6. The monitoring device
At least one of the user's passing situation of the security gate installed in the living room, the user's video taken by the surveillance camera arranged in the living room, and the user's meeting room reservation situation in the meeting room reservation system. 16. The information processing system according to claim 15, wherein analysis is performed to detect that the user has left the room. The computer detects the behavior of the user of the terminal device that cannot be detected by a program included in the terminal device, and the terminal device that has been operated by the user or can be operated by the user is A state detection step for detecting a non-operation state that cannot be operated by the user;
The computer has a data transmission status monitoring step of monitoring a data transmission status from the terminal device when it is determined by the status detection step that the terminal device is in a non-operational state. Monitoring method.   A program that causes a computer to function as the monitoring device according to claim 1.

Images