JP2018081655A - Unauthorized operation monitoring device, unauthorized operation monitoring method, unauthorized operation monitoring program, and unauthorized operation monitoring system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the accuracy of detecting an unauthorized operation.SOLUTION: An unauthorized operation monitoring device 101 acquires operation history information that includes the type of operation that indicates the type of operation on an information processing system and an operated time of day. The unauthorized operation monitoring device 101 determines, on the basis of schedule information 120, whether or not the type of operation that corresponds to the operated time of day is included in an operation group that corresponds to the operated time of day of the acquired operation history information. The schedule information 120 indicates correspondence between an operation group that is a combination of one or more operation types that indicate the type of operation and a time. When the type of operation that corresponds to the operated time of day is not included in the operation group, the unauthorized operation monitoring device 101 determines whether or not an authorized operation has been performed, on the basis of a value that indicates the level of possibility of unauthorized operation that increases or decreases in accordance with the frequency of the type of operation in the operation history information included in the schedule information 120 at a specific time.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an unauthorized operation monitoring device, an unauthorized operation monitoring method, an unauthorized operation monitoring program, and an unauthorized operation monitoring system.

  In recent years, the damage caused by malware infection of business PCs (Personal Computers) in companies has increased. When infected with malware, an external malicious user may illegally remotely operate a business PC and steal important information in an in-house system or server.

  In addition, when a malware is infected, a back door is installed in the business PC and it is possible to easily operate the business PC from the outside. Therefore, unauthorized operation is prevented by user authentication using an ID (Identification) and password. Is difficult. Therefore, assuming such a situation, a technique for detecting an unauthorized operation in a commercial PC infected with malware is desired.

  As a related prior art, for example, there is a technique for obtaining a deviation of a weight value of an operation item from a corresponding average value and standard deviation and outputting alert information if the deviation of the weight value is out of an allowable range. Also, there is a technique for calculating the importance for each scenario candidate associated with each log received from the monitoring target device, and recalculating the importance of each scenario candidate for each user based on the user relevance level and the operation relevance level. . In addition, there is a technique for automatically generating a detection rule based on an access log notified from a passive host sensor that detects communication addressed to itself without notifying its own existence.

Japanese Patent Application Laid-Open No. 2011-210060 JP 2013-061794 A Japanese Patent Laid-Open No. 2005-31679

  However, the conventional technique has a problem that a normal operation is erroneously determined to be an unauthorized operation, and the detection accuracy of the unauthorized operation is reduced.

  In one aspect, an object of the present invention is to improve detection accuracy of an unauthorized operation.

  In one embodiment, operation history information including an operation type indicating an operation type for an information processing system and an operation time is acquired, and a schedule indicating a correspondence between an operation group and one or more combinations of the operation types. Referring to the storage unit that stores information, if the operation group corresponding to the operation time of the operation history information does not include the operation type corresponding to the operation time, it is included in the schedule information at a specific time There is provided an unauthorized operation monitoring device that determines whether or not an unauthorized operation has been performed based on a value indicating a possibility of an unauthorized operation that increases or decreases according to the frequency of the operation type.

  According to one aspect of the present invention, it is possible to improve the detection accuracy of an unauthorized operation.

FIG. 1 is an explanatory diagram of an example of the unauthorized operation monitoring method according to the embodiment. FIG. 2 is an explanatory diagram showing a system configuration example of the unauthorized operation monitoring system 200. FIG. 3 is a block diagram illustrating a hardware configuration example of the unauthorized operation monitoring apparatus 101. FIG. 4 is an explanatory diagram showing an example of the contents stored in the business profile table 220. FIG. 5 is an explanatory diagram showing an example of the contents stored in the operation profile table 230. FIG. 6 is an explanatory diagram showing an example of the contents stored in the undefined operation table 240. FIG. 7 is an explanatory diagram showing an example of the contents stored in the schedule profile table 250. FIG. 8 is an explanatory diagram showing an example of the contents stored in the application profile table 260. FIG. 9 is an explanatory diagram showing an example of the stored contents of the actual operation table 270. FIG. 10 is an explanatory diagram showing an example of the contents stored in the operation history table 280. FIG. 11 is an explanatory diagram showing an example of the contents stored in the score table 290. FIG. 12 is an explanatory diagram illustrating a screen example of the undefined operation confirmation screen 1200. FIG. 13 is a block diagram illustrating a functional configuration example of the unauthorized operation monitoring apparatus 101. FIG. 14 is an explanatory diagram (part 1) illustrating an example of determining an unauthorized operation. FIG. 15 is an explanatory diagram (part 2) of an example of determining an unauthorized operation. FIG. 16 is a flowchart (part 1) illustrating an example of the profile creation processing procedure of the unauthorized operation monitoring apparatus 101. FIG. 17 is a flowchart (part 2) illustrating an example of the profile creation processing procedure of the unauthorized operation monitoring apparatus 101. FIG. 18 is a flowchart (part 1) illustrating an example of the unauthorized operation monitoring processing procedure of the unauthorized operation monitoring apparatus 101. FIG. 19 is a flowchart (part 2) illustrating an example of the unauthorized operation monitoring processing procedure of the unauthorized operation monitoring apparatus 101. FIG. 20 is a flowchart illustrating an example of a specific processing procedure of the operation history update process.

  Exemplary embodiments of an unauthorized operation monitoring device, an unauthorized operation monitoring method, an unauthorized operation monitoring program, and an unauthorized operation monitoring system according to the present invention will be described below in detail with reference to the drawings.

(Embodiment)
FIG. 1 is an explanatory diagram of an example of the unauthorized operation monitoring method according to the embodiment. In FIG. 1, an unauthorized operation monitoring apparatus 101 is a computer that monitors unauthorized operations in the terminal apparatus 102. The unauthorized operation monitoring apparatus 101 is a server, for example. An unauthorized operation is an operation that uses an unauthorized computer.

  Examples of the unauthorized operation include an operation by a user who logs in with an illegally acquired ID and password, and an operation by a user who has entered through a back door installed in the terminal device 102. The operation refers to moving the terminal device 102 to cause some action. For example, the terminal device 102 is remotely operated to access an in-house system or server.

  Here, the damage caused by malware infection of business PCs in a company is increasing, and there is a risk that the business PC is illegally operated remotely, and important information in an in-house system or server is stolen. Malware is a general term for harmful software such as computer viruses and Trojan horses.

  When infected with malware, it is difficult to prevent intrusion from the outside by user authentication using an ID, a password, or the like. Therefore, as a countermeasure against malware infection, it is important how to detect an unauthorized operation in a business PC that has been infected with malware and can be illegally operated from the outside.

  For example, it is conceivable that an operation to be performed in each business is registered in advance, and if an unregistered operation is performed in a certain business, it is determined whether an unauthorized operation has been performed according to the frequency. However, the user does not always perform exactly the same operation every time in a business, and it may be possible to perform an operation related to another business while performing a certain business.

  For example, there is a case where a user who is performing a certain task notices a data input omission or an input mistake regarding a task performed immediately before and performs a data input operation. In addition, a user who is executing a certain task may access a server or the like in order to collect information in advance regarding a task scheduled to be performed thereafter. Therefore, if such a normal operation is handled as an operation that may be illegal, there is a risk of erroneous detection of the illegal operation.

  Therefore, in the present embodiment, an operation with a large number of crossing operations, that is, an operation performed in various operations, is an unauthorized operation when performed in another operation different from the operation assumed in advance. An unauthorized operation monitoring method that prevents erroneous detection of an unauthorized operation by reducing the accuracy of determination will be described. Hereinafter, a processing example of the unauthorized operation monitoring apparatus 101 will be described.

  (1) The unauthorized operation monitoring apparatus 101 acquires operation history information including an operation type indicating an operation type for the information processing system and an operation time. Here, the information processing system is an operation target 103 such as an in-house system or a server. The operation type is, for example, an operation name. For example, the operation history information may be acquired from the terminal device 102 or may be acquired from the operation target 103.

  In the example of FIG. 1, it is assumed that the operation history information 110 including the operation type indicating the type of the operation A performed in the business G and the operation time is acquired. The business G may be, for example, a business performed by the user of the terminal device 102 or a business that has been performed.

  (2) Based on the schedule information 120, the unauthorized operation monitoring apparatus 101 determines whether or not the operation group corresponding to the operation time of the acquired operation history information includes an operation type corresponding to the operation time. The schedule information 120 is information indicating a correspondence between an operation group, which is one or more combinations of operation types indicating operation types, and time.

  The operation group corresponds to a task scheduled to be performed at a time corresponding to the operation group. Therefore, by determining whether or not the operation group corresponding to the operation time in the operation history information includes the operation type corresponding to the operation time, the operation of the operation type corresponds to the job corresponding to the operation group. It can be determined whether or not the operation is to be performed.

  In the example of FIG. 1, it is assumed that the operation type corresponding to the operation time of the operation history information 110 does not include the operation type indicated by the operation history information 110. That is, assume that the operation A is not an operation corresponding to the business G.

  (3) If the operation group does not include an operation type corresponding to the operation time, the unauthorized operation monitoring apparatus 101 indicates the possibility of an unauthorized operation when an operation of the operation type in the operation history information is performed as an undefined operation. Based on the value indicating the height, it is determined whether or not an unauthorized operation has been performed. Here, an undefined operation is an operation that is different from an operation that is assumed to be performed in a certain job.

  The value indicating the high possibility of illegal operation indicates the high possibility of illegal operation when the operation is performed as an undefined operation. The value indicating the possibility of unauthorized operation increases or decreases according to the frequency of the operation type of the operation history information included in the schedule information 120 for a specific time. The specific time is, for example, a time corresponding to all tasks performed by the user of the terminal device 102 in one day.

  More specifically, the value indicating the high possibility of unauthorized operation is set such that the frequency of the operation type of the operation history information included in the schedule information 120 at a specific time is smaller as the frequency is lower, and is larger as the frequency is lower. Is set. That is, the value indicating the high possibility of unauthorized operation becomes smaller as the operation has a greater number of crossings.

  In the example of FIG. 1, an unauthorized operation is performed based on a value indicating the level of possibility of unauthorized operation that increases or decreases according to the frequency of the operation type of the operation history information 110 included in the schedule information 120 of a specific time. It is determined whether or not. In other words, it is possible to increase the possibility of unauthorized operation that increases or decreases according to the frequency with which the operation A is performed in another business different from the business G among a plurality of business operations performed by the user of the terminal device 102 in one day. Based on the indicated value, it is determined whether or not an unauthorized operation has been performed in the business G.

  As a result, if the operation A is an operation with a large number of cross-business operations performed in various business operations, even if the operation A is performed as an undefined operation, it is highly likely that the operation is a normal operation. The accuracy of the determination can be lowered. In other words, it is possible to prevent the normal operation from being treated as an operation that may be illegal, and to improve the detection accuracy of the illegal operation.

  In the following description, an operation group corresponding to a certain time may be treated as a “business” scheduled to be performed at that time.

(System configuration example of the unauthorized operation monitoring system 200)
Next, a system configuration example of the unauthorized operation monitoring system 200 according to the embodiment will be described.

  FIG. 2 is an explanatory diagram showing a system configuration example of the unauthorized operation monitoring system 200. In FIG. 2, the unauthorized operation monitoring system 200 includes an unauthorized operation monitoring device 101, terminal devices T1 to Tn (n: a natural number of 2 or more), and servers SV1 to SVm (m: a natural number of 2 or more). In the unauthorized operation monitoring system 200, the unauthorized operation monitoring device 101, the terminal devices T1 to Tn, and the servers SV1 to SVm are connected via a wired or wireless network 210. The network 210 is, for example, a local area network (LAN), a wide area network (WAN), or the Internet.

  In the following description, an arbitrary terminal device among the terminal devices T1 to Tn may be referred to as “terminal device Ti” (i = 1, 2,..., N). In addition, an arbitrary server among the servers SV1 to SVm may be expressed as “server SVj” (j = 1, 2,..., M).

  Here, the unauthorized operation monitoring apparatus 101 determines whether an unauthorized operation is performed on the server SVj in the terminal apparatus Ti. The unauthorized operation monitoring apparatus 101 includes a business profile table 220, an operation profile table 230, an undefined operation table 240, and a schedule profile table 250. These various tables 220, 230, 240, 250 are created before the unauthorized operation monitoring process by the unauthorized operation monitoring apparatus 101, for example. The schedule information 120 illustrated in FIG. 1 corresponds to, for example, the operation profile table 230 and the schedule profile table 250.

  In addition, the unauthorized operation monitoring apparatus 101 includes an application profile table 260, an actual operation table 270, an operation history table 280, and a score table 290. These various tables 260, 270, 280, and 290 are created and updated during execution of the unauthorized operation monitoring process by the unauthorized operation monitoring apparatus 101, for example. The contents stored in the various tables will be described later with reference to FIGS.

  The terminal device Ti is a computer that a user uses in business. For example, the terminal device Ti is a PC, a tablet PC, a smartphone, or the like. The user is, for example, a company employee or a local government employee. The terminal device 102 illustrated in FIG. 1 corresponds to the terminal device Ti, for example.

  The server SVj is a computer that provides a service for a user to perform business. For example, the server SVj is a business server such as a file server, a mail server, or an application server included in a business system of a company. The operation target 103 illustrated in FIG. 1 corresponds to the server SVj, for example.

(Hardware configuration example of unauthorized operation monitoring apparatus 101)
Next, a hardware configuration example of the unauthorized operation monitoring apparatus 101 will be described.

  FIG. 3 is a block diagram illustrating a hardware configuration example of the unauthorized operation monitoring apparatus 101. 3, the unauthorized operation monitoring apparatus 101 includes a CPU (Central Processing Unit) 301, a memory 302, an I / F (Interface) 303, a disk drive 304, and a disk 305. Each component is connected by a bus 300.

  Here, the CPU 301 governs overall control of the unauthorized operation monitoring apparatus 101. The memory 302 includes, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), and a flash ROM. Specifically, for example, a flash ROM or ROM stores various programs, and a RAM is used as a work area for the CPU 301. The program stored in the memory 302 is loaded into the CPU 301 to cause the CPU 301 to execute the coded process.

  The I / F 303 is connected to the network 210 through a communication line, and is connected to an external computer (for example, the terminal devices T1 to Tn and the servers SV1 to SVm shown in FIG. 2) via the network 210. The I / F 303 controls an interface between the network 210 and the inside of the apparatus, and controls data input / output from an external computer. For example, a modem or a LAN adapter may be employed as the I / F 303.

  The disk drive 304 controls reading / writing of data with respect to the disk 305 according to the control of the CPU 301. The disk 305 stores data written under the control of the disk drive 304. Examples of the disk 305 include a magnetic disk and an optical disk.

  The unauthorized operation monitoring device 101 may include, for example, an SSD (Solid State Drive), an input device, a display, and the like in addition to the above-described components. Further, the terminal device Ti and the server SVj can also be realized by the same hardware configuration as that of the unauthorized operation monitoring device 101. However, the terminal device Ti includes, for example, an input device, a display, and the like in addition to the components described above.

(Contents stored in various tables)
Next, the contents stored in various tables of the unauthorized operation monitoring apparatus 101 shown in FIG. 2 will be described. The various tables are created for each user who uses the terminal device Ti, for example. The various tables are realized by a storage device such as the memory 302 and the disk 305 shown in FIG.

  FIG. 4 is an explanatory diagram showing an example of the contents stored in the business profile table 220. In FIG. 4, the business profile table 220 has fields for business name and block threshold, and records business profile information (for example, business profile information 400-1 to 400-6) by setting information in each field. Remember as.

  Here, the business name indicates the name of the business performed by the user. The business name corresponds to information for identifying the operation group described with reference to FIG. The block threshold value indicates a threshold value used when determining whether or not an illegal operation has been performed in the business task with the business name. For example, the block threshold is set to a value at which an operation in normal business is not determined to be illegal. As a business name, a group of a plurality of businesses may be set.

  For example, in order to determine whether or not an unauthorized operation has been performed on the entire day of work, “all work” representing all the work performed on the day may be set as the work name. At this time, the block threshold value may be a value obtained by summing up the block threshold values of all the tasks, or a value smaller than the sum of the block threshold values of all the tasks (for example, about 70 to 80%). Value) may be used.

  FIG. 5 is an explanatory diagram showing an example of the contents stored in the operation profile table 230. In FIG. 5, the operation profile table 230 includes fields for business name, operation name, threshold value, and weight. By setting information in each field, operation profile information (for example, operation profile information 500-1 to 500- 4) is stored as a record.

  Here, the business name indicates the name of the business performed by the user. The operation name indicates the name of the operation performed in the business with the business name. The operation name corresponds to the operation type described in FIG. That is, a combination of operations with the same business name corresponds to the operation group described with reference to FIG. The threshold value indicates a threshold value used when determining whether or not the operation of the operation name is performed in a normal range in the business of the business name. For example, the threshold value is set to a value or range in which an operation in normal business is not determined to be illegal.

  The weight is a value added to a score indicating a high possibility that an illegal operation has been performed in the business with the business name when it is determined that the operation with the operation name is not performed within a normal range. For example, the weight is set to a larger value as the degree of influence when the operation name operation is fraudulent is increased. In addition, the weight is set to a larger value as the validity that can be said to be invalid when the operation of the operation name is not performed in a normal range in the business of the business name is high.

  For example, the operation profile information 500-1 indicates a threshold “5 to 20 minutes” and a weight “1” of the operation name “system A operation time” performed in the business with the business name “estimation”.

  FIG. 6 is an explanatory diagram showing an example of the contents stored in the undefined operation table 240. In FIG. 6, the undefined operation table 240 has fields of undefined operation name, appearance frequency, weighted average, and undefined score. By setting information in each field, undefined operation information (for example, undefined operation information). Operation information 600-1 to 600-4, 600-x) is stored as a record.

  Here, the undefined operation name indicates the name of the operation performed by the user in any of the tasks. As the undefined operation name, for example, among the operation names set in the operation profile table 230, the remaining character string excluding “number of times” from the operation name described as “number of times” is used. The appearance frequency indicates a frequency at which an operation with an undefined operation name appears in all the operations performed by the user. For example, the appearance frequency is the number of times (number of records) that an operation including an undefined operation name in the operation name appears in the operation profile table 230 (for example, see FIG. 5).

  The weight average is an average value of operation weights of undefined operation names in the operation profile table 230. The non-definition score indicates the high possibility of an unauthorized operation when an operation with an undefined operation name is performed as an undefined operation. An undefined operation is an operation that is different from an operation that is assumed to be performed in a business.

  FIG. 7 is an explanatory diagram showing an example of the contents stored in the schedule profile table 250. In FIG. 7, the schedule profile table 250 stores a business name, a start time, and an end time in association with each other. In the schedule profile table 250, for example, a business name, a start time, and an end time for each business scheduled to be performed by the user during a day are stored.

  Here, the business name indicates the name of the business scheduled to be performed by the user. The business may include break times such as lunch breaks. The start time indicates the time at which the business with the business name starts. The end time indicates the time at which the business with the business name ends. The schedule profile table 250 is created for each business day, for example.

  FIG. 8 is an explanatory diagram showing an example of the contents stored in the application profile table 260. In FIG. 8, the application profile table 260 has a field of application. Here, the applied business indicates the name of the business performed by the user when an operation is performed on the terminal device Ti.

  FIG. 9 is an explanatory diagram showing an example of the stored contents of the actual operation table 270. In FIG. 9, the actual operation table 270 has fields of business name, operation name, and total number. By setting information in each field, actual operation information (for example, actual operation information 900-1 to 900-3). Is stored as a record.

  The business name indicates the name of the business performed by the user. The operation name indicates the name of the operation performed by the user in the business with the business name. The total indicates the total number of times or the total time that the user has operated the operation name in the business with the business name, and is sequentially updated according to the operation performed by the user during the business. The total number of times is the number of times the user has performed an operation. The accumulated time is the accumulated operation time from the start of the operation to the end of the operation by the user.

  Here, when “operation time” is included in the operation name, the cumulative total indicates the cumulative time. When the operation name includes “access count”, the cumulative total indicates the cumulative count. The actual operation table 270 is reset, for example, when starting or ending a day's work.

  FIG. 10 is an explanatory diagram showing an example of the contents stored in the operation history table 280. In FIG. 10, an operation history table 280 has business name, operation name, and average fields, and records operation history information (operation history information 1000-1 to 1000-3) by setting information in each field. Remember as.

  The business name indicates the name of the business performed by the user. The operation name indicates the name of the operation performed by the user in the business with the business name. The average indicates an average operation of operation names performed by the user in the business with the business name in the past certain period T. The fixed period T can be set arbitrarily, and is set to a period of one week or one month, for example.

  For example, when “operation time” is included in the operation name, the average indicates the average of the accumulated time for one day of the operation performed by the user in the past certain period T. Further, when “number of accesses” is included in the operation name, the average indicates the average of the accumulated number of operations performed by the user in the past certain period T.

  Although illustration is omitted, the operation history table 280 stores operation information (operation log) indicating, for example, operations performed by the user of the terminal device Ti during a past fixed period.

  FIG. 11 is an explanatory diagram showing an example of the contents stored in the score table 290. In FIG. 11, the score table 290 has fields of business name and score, and by setting information in each field, score information (for example, 1100-1 to 1100-6) is stored as a record.

  Here, the business name indicates the name of the business performed by the user. As the business name, for example, the business name set in the business profile table 220 shown in FIG. 4 is set. The score is a value indicating a high possibility that an unauthorized operation has been performed in the business with the business name, and is sequentially updated according to the operation content performed by the user during the business.

(Screen example of undefined operation confirmation screen 1200)
Next, a screen example of the undefined operation confirmation screen 1200 displayed on the display (not shown) of the terminal device Ti will be described.

  FIG. 12 is an explanatory diagram illustrating a screen example of the undefined operation confirmation screen 1200. In FIG. 12, an undefined operation confirmation screen 1200 is an operation screen for confirming an undefined operation registered in the undefined operation table 240. The undefined operation confirmation screen 1200 displays the operation name, operation definition work, yesterday's score, today's score, and change / setting of the operation registered as an undefined operation.

  Here, the operation definition task indicates a task for which an operation with an operation name is performed. In addition, it is specified from the operation profile table 230 shown in FIG. 5, for example, in which work each operation is performed. The yesterday's score is a yesterday's undefined score for the operation of the operation name. Today's score is today's undefined score for the operation of the operation name. As today's score, for example, a value based on the appearance frequency of each operation and the weighted average is set.

  According to the undefined operation confirmation screen 1200, for example, the user can determine the validity of today's score by referring to yesterday's score for each operation. In addition, when changing the score for today for a certain operation, the user inputs the score after the change in the item for changing / setting the operation. As a result, for the operation, today's score is updated to the changed score. For operations in which the change / setting item is not input, today's score is set as an undefined score.

  Further, according to the undefined operation confirmation screen 1200, the user can set today's score of “other operation”. “Other operation” is an operation that is not registered in the operation profile table 230. Thereby, it is possible to arbitrarily set an undefined score indicating a high possibility of an unauthorized operation when “other operation” is performed.

  In addition, when the OK button 1201 is selected by the user's operation input using the input device (not shown) of the terminal device Ti on the undefined operation confirmation screen 1200, confirmation of the undefined operation registered in the undefined operation table 240 is confirmed. Can be terminated. Further, when the cancel button 1202 is selected by a user operation input on the undefined operation confirmation screen 1200, items for changing / setting each operation can be initialized.

(Functional configuration example of the unauthorized operation monitoring apparatus 101)
Next, a functional configuration example of the unauthorized operation monitoring apparatus 101 will be described.

  FIG. 13 is a block diagram illustrating a functional configuration example of the unauthorized operation monitoring apparatus 101. In FIG. 13, the unauthorized operation monitoring apparatus 101 includes an acquisition unit 1301, a determination unit 1302, a calculation unit 1303, a setting unit 1304, a determination unit 1305, and a control processing unit 1306. The acquisition unit 1301 to the control processing unit 1306 are functions as control units. Specifically, for example, by causing the CPU 301 to execute a program stored in a storage device such as the memory 302 and the disk 305 illustrated in FIG. Alternatively, the function is realized by the I / F 303. The processing result of each functional unit is stored in a storage device such as the memory 302 and the disk 305, for example.

  The acquisition unit 1301 acquires operation information indicating an operation performed on the terminal device Ti. Here, the operation information includes, for example, an operation time, an operation target, and an operation content. The operation time is the time when the operation was performed. The operation target indicates an operation target. For example, the operation target is one of the servers SVj among the servers SV1 to SVm illustrated in FIG. The operation content indicates the content of the operation. The operation information corresponds to the operation history information described with reference to FIG.

  Specifically, for example, the acquisition unit 1301 receives operation information indicating the operation from the server SVj (or the terminal device Ti) in response to an operation performed on the server SVj in the terminal device Ti. Thus, operation information indicating the operation is acquired. The acquired operation information is stored as an operation log, for example, in the operation history table 280 shown in FIG.

  The determination unit 1302 determines whether or not the operation indicated by the acquired operation information is an operation corresponding to the application job, based on information in which each job is associated with an operation performed in each job for a plurality of jobs. Here, the application work is a work performed by the user of the terminal device Ti when the operation indicated by the operation information is performed.

  Specifically, for example, the determination unit 1302 refers to the schedule profile table 250 illustrated in FIG. 7, and the operation time included in the acquired operation information is included in the time period from the start time to the end time. The business name is specified as the business name of the applied business. As a result, it is possible to identify the work for which the operation indicated by the operation information has been performed.

  However, the operation information may include information that can identify the work performed by the user. In this case, the determination unit 1302 can identify the work on which the operation indicated by the operation information has been performed with reference to the acquired operation information.

  The business name of the specified application business is stored, for example, in the application profile table 260 shown in FIG. For example, each time the operation information is acquired, the determination unit 1302 updates the application profile table 260, so that the task currently being performed by the user of the terminal device Ti can be managed.

  Then, the determination unit 1302 refers to the operation profile table 230 illustrated in FIG. 5 and determines whether the operation name of the operation indicated by the operation information is set in association with the business name of the application. Here, when the operation name is set, the determination unit 1302 determines that the operation indicated by the operation information is an operation corresponding to the application. On the other hand, when the operation name is not set, the determination unit 1302 determines that the operation indicated by the operation information is not an operation corresponding to the application.

  Note that the operation name of the operation indicated by the operation information is identified from, for example, the operation target and the operation content included in the operation information. For example, when the operation target server SVj is “system A” and the operation content is “file read / write”, the operation name is “system A access count”. When the server SVj to be operated is “system A” and the operation content is “login / logout”, the operation name is “system A operation time”.

  The calculation unit 1303 calculates the frequency at which operations are performed in business based on the acquired operation information. Specifically, for example, when the operation indicated by the operation information is an operation corresponding to the application, the calculation unit 1303 calculates the frequency of the operation performed in the application. The frequency is, for example, the total number of times and the total time that operations have been performed in the application.

  For example, when the acquired operation information indicates access to the server SVj that is the operation target (for example, file read / write), the calculation unit 1303 increments the number of accesses to the server SVj in the application.

  When the acquired operation information indicates the start (for example, login) of the operation to the server SVj that is the operation target, the calculation unit 1303 starts the operation (for example, the login time) to the server SVj in the application. ). Then, when the operation information indicating the end of the operation on the server SVj (for example, logout) is acquired, the calculation unit 1303 calculates the operation time for the server SVj in the application and accumulates the operation time. The operation time is, for example, the time from the start time to the end time (for example, logout time) of the operation on the server SVj in the application.

  The calculated frequency is stored as “cumulative” in the actual operation table 270 illustrated in FIG. 9 in association with, for example, the business name of the applied business and the operation name of the corresponding operation. The corresponding operation is an operation indicated by the operation information. If the actual operation table 270 already has a record corresponding to the combination of the application name of the application and the operation name of the corresponding operation, the “total” of the record is updated.

  Also, the calculation unit 1303 updates the operation history of the user of the terminal device Ti based on the acquired operation information. Specifically, for example, the calculation unit 1303 acquires operation information for a certain past period T from the operation history table 280. The operation information for the past fixed period T is, for example, operation information in which the operation time is included in a period from the time point that is a predetermined period T backward from the current time to the current time.

  Then, the calculation unit 1303 calculates an average of operations performed by the user in the business for each combination of the business and the operation based on the acquired operation information for a predetermined period T. For example, when the operation name is included in the operation name of the operation, the average of the operations indicates an average of the accumulated time for each day of the corresponding operation performed by the user in the corresponding business. In addition, the average of operations indicates an average of the cumulative number of operations per day for the corresponding operation performed by the user in the corresponding job when the operation name of the operation includes the access count.

  The calculated average of operations is stored in the operation history table 280 shown in FIG. 10 in association with, for example, a business name and an operation name. If there is already a record in the operation history table 280 corresponding to the combination of the business name and operation name for which the average operation has been calculated, the “average” of the record is updated.

  Note that the operation history update process of the user of the terminal device Ti may be executed every time operation information is acquired, or may be executed periodically such as every day or every week.

  The setting unit 1304 sets an undefined score for operations performed in the terminal device Ti. Here, the operation for which the non-definition score is set is, for example, an operation with the operation name set in the operation profile table 230. The non-definition score is a value indicating a high possibility of fraud when an operation is performed as an undefined operation. An undefined operation is an operation that is different from an operation that is assumed to be performed in a business.

  The score outside the definition of the operation is increased or decreased according to the frequency of the operation in a plurality of operations performed by the user of the terminal device Ti. In other words, the undefined score of an operation performed as an undefined operation in a certain business increases or decreases according to the frequency with which the operation is performed in another business. Accordingly, the undefined score of frequently performed operations is low in the entire plurality of tasks performed by the user.

  The frequency of each operation in the entire plurality of tasks performed by the user corresponds to, for example, the appearance frequency of each operation in the operation profile table 230. That is, the appearance frequency of an operation with a certain operation name is the number of times the operation with the operation name appears in the operation profile table 230.

  In addition, the score outside the definition of the operation may be further increased or decreased according to the weight set according to the combination of the operation for which the operation is performed and the operation. For example, the weight is set to a higher value as the degree of influence when a fraud is performed on a corresponding operation in the business is larger. For example, the score outside the definition of the operation further increases or decreases according to the weight set in the operation profile table 230 according to the combination of the business name and the operation name.

More specifically, for example, the setting unit 1304 may calculate an undefined score for each operation using the following formula (1). However, N _a indicates the appearance frequency of the operation a in the operation profile table 230. W _ka indicates the weight of the operation a in the operation k in the operation profile table 230.

The calculated undefined score of each operation is stored in, for example, the undefined operation table 240 shown in FIG. 6 in association with the operation name (undefined operation name), appearance frequency N _a, and weight average of each operation. The The weight average is equivalent to the average value of the weights in the above formula (1). Thereby, the undefined score of each operation performed in the terminal device Ti can be set.

  The determination unit 1305 determines whether an unauthorized operation has been performed in the business. Specifically, for example, if the operation indicated by the operation information is not an operation corresponding to the application, the determination unit 1305 applies the application based on a value indicating the first possibility of the unauthorized operation of the operation. It is determined whether or not an illegal operation has been performed.

  Here, the value indicating the high possibility of the first unauthorized operation means that the operation indicated by the operation information is performed in another business different from the applied business among the plurality of operations performed by the user of the terminal device Ti. It is a value that increases or decreases according to the frequency. Further, the value indicating the high possibility of the first unauthorized operation may be further increased or decreased according to the weight set according to the combination of the operation for which the operation indicated by the operation information is performed and the operation. .

  More specifically, for example, the determination unit 1305 acquires an undefined score corresponding to the operation indicated by the operation information from the undefined operation table 240. The undefined score corresponding to the operation indicated by the operation information is a definition in which the operation name of the operation indicated by the operation information (for example, the remaining character string obtained by removing “number of times” from the operation name) is set as the undefined operation name. This is a score outside the definition of external operation information. It should be noted that operations with operation names that do not have the “number of times” notation may be excluded from acquisition targets of undefined scores.

  However, the operation name of the operation indicated by the operation information (for example, the remaining character string obtained by removing “number of times” from the operation name) may not include the undefined operation information set in the undefined operation name. In this case, the determination unit 1305 acquires, from the undefined operation table 240, an undefined score of undefined operation information (for example, undefined operation information 600-x) in which “other operation” is set as the undefined operation name. .

  Next, the determination unit 1305 adds the acquired undefined score to the score of the score information corresponding to the application in the score table 290 illustrated in FIG. Here, the score information corresponding to the applied business is score information in which the business name of the applied business is set to the business name. The score information in which the business name of the applied business is set includes the business name of the applied business as part of the business name of the business in which a plurality of business operations are combined. Further, the score information corresponding to the application business includes score information in which “business overall” is set as the business name.

  Then, the determination unit 1305 determines whether the score of the score information corresponding to the application business in the score table 290 exceeds the corresponding block threshold value in the business profile table 220. The block threshold value is a threshold value that is set according to the job in order to determine whether or not an unauthorized operation has been performed. The corresponding block threshold value in the business profile table 220 is a block threshold value of business profile information whose score information and business name match.

  Here, when the score of the score information corresponding to the application job exceeds the block threshold, the determination unit 1305 determines that an unauthorized operation has been performed in the job having the job name of the score information. On the other hand, when the score of the score information corresponding to the application job is equal to or less than the block threshold, the determination unit 1305 determines that an unauthorized operation is not performed in the job with the job name of the score information.

  In addition, when the operation indicated by the operation information is an operation corresponding to the application, the determination unit 1305 determines the frequency of the corresponding operation performed in the application calculated by the calculation unit 1303 as a combination of the application and the corresponding operation. It compares with the threshold value set according to.

  More specifically, the determining unit 1305 refers to the actual operation table 270, for example, and identifies the total corresponding to the business name of the application and the operation name of the corresponding operation. Next, the determination unit 1305 refers to the operation profile table 230 and specifies a threshold value corresponding to the business name of the application and the operation name of the corresponding operation.

  Then, the determination unit 1305 determines whether the specified cumulative total exceeds the specified threshold value. The cumulative total exceeding the threshold corresponds to, for example, the cumulative total being larger than the value indicated by the threshold or out of the range indicated by the threshold. Here, when the cumulative total does not exceed the threshold value, the determination unit 1305 may determine that an unauthorized operation is not performed in the application.

  On the other hand, when the cumulative total exceeds the threshold value, the determination unit 1305 determines whether the application operation is based on the value indicating the second high possibility of unauthorized operation set according to the combination of the application operation and the corresponding operation. It may be determined whether an unauthorized operation has been performed.

  Here, the second value indicating the high possibility of the unauthorized operation is a value indicating the high possibility that the unauthorized operation has been performed in the application. The value indicating the second high possibility of unauthorized operation is, for example, the degree of influence when an unauthorized operation is performed on the corresponding operation, or when the corresponding operation is not performed in a normal range in the application. It is set according to the level of validity that can be said to be fraudulent.

  Specifically, for example, the value indicating the second possibility of unauthorized operation is a weight corresponding to the combination of the application and the corresponding operation in the operation profile table 230. Therefore, for example, the determination unit 1305 acquires the weight corresponding to the combination of the business name of the application and the operation name of the corresponding operation from the operation profile table 230.

  Next, the determination unit 1305 adds the acquired weight to the score of the score information corresponding to the application in the score table 290. That is, the score of the score information corresponding to the application in the score table 290 includes the above-described value indicating the high possibility of the first unauthorized operation (non-definition score) and the second high possibility of the unauthorized operation. Is a cumulative value obtained by accumulating values (weights) indicating.

  Then, the determination unit 1305 determines whether the score of the score information corresponding to the application business in the score table 290 exceeds the corresponding block threshold value in the business profile table 220. Here, when the score of the score information corresponding to the application job exceeds the block threshold, the determination unit 1305 determines that an unauthorized operation has been performed in the job having the job name of the score information. On the other hand, when the score of the score information corresponding to the application job is equal to or less than the block threshold, the determination unit 1305 determines that an unauthorized operation is not performed in the job with the job name of the score information.

  The control processing unit 1306 executes control processing when it is determined that an unauthorized operation has been performed in the business. The processing content of the control processing can be arbitrarily set. Specifically, for example, when it is determined that an unauthorized operation has been performed in the application, the control processing unit 1306 may perform control so as to limit the operation on the terminal device Ti. Restricting the operation in the terminal device Ti may be, for example, blocking an operation on part or all of the servers SV1 to SVm from the terminal device Ti.

  The control processing unit 1306 may output an alert when it is determined that an unauthorized operation has been performed in the application. The alert is a warning indicating that there is a high possibility that an unauthorized operation has been performed in the terminal device Ti. The alert includes information for identifying the terminal device Ti, a business name of an applied business, and the like. The output destination of the alert may be, for example, a computer of an administrator of the unauthorized operation monitoring system 200, or may be a storage device such as the memory 302 and the disk 305.

(Illegal operation judgment example)
Next, an example of determining an unauthorized operation performed in the terminal device Ti will be described.

  FIG. 14 and FIG. 15 are explanatory diagrams illustrating an example of determining an unauthorized operation. In FIG. 14, the operation log LG includes operation information 1401 to 1403. The operation information 1401 to 1403 is information indicating operations sequentially performed in the business with the business name “estimate” in the terminal device Ti.

  First, when the operation information 1401 is acquired, the actual operation information 1411 is stored in the actual operation table 270 as a new record. However, since only the login time is recorded at this time, the cumulative total of the actual operation information 1411 is “−”. The operation indicated by the operation information 1401 has an operation name “System A operation time” and corresponds to an application (operation name: estimate).

  In this case, the determination unit 1305 refers to the operation profile table 230, and the cumulative “−” of the actual operation information 1411 indicates that the threshold value “corresponding to the combination of the business name“ estimate ”and the operation name“ system A operation time ”is“ It is determined whether or not “5 to 20 minutes” is exceeded. Here, it is determined that the threshold value “5 to 20 minutes” is not exceeded. Accordingly, the score of the score information 1421 corresponding to the application in the score table 290 remains “0”.

  Next, when the operation information 1402 is acquired, the actual operation information 1412 is stored in the actual operation table 270 as a new record. At this time, the total of the actual operation information 1412 is “once”. The operation indicated by the operation information 1402 is an operation corresponding to the application (operation name: estimate) whose operation name is “system A access count”.

  In this case, the determination unit 1305 refers to the operation profile table 230, and the cumulative “one time” of the actual operation information 1412 is a threshold corresponding to the combination of the business name “estimate” and the operation name “system A access count”. It is determined whether or not “3 to 10 times” is exceeded. Here, it is determined that the threshold value “3 to 10 times” is not exceeded. Accordingly, the score of the score information 1421 corresponding to the application in the score table 290 remains “0”.

  Next, when the operation information 1403 is acquired, the cumulative total of the actual operation information 1412 in the actual operation table 270 is incremented. At this time, the total of the actual operation information 1412 is “twice”. The operation indicated by the operation information 1402 is an operation corresponding to the application (operation name: estimate) whose operation name is “system A access count”.

  In this case, the determination unit 1305 refers to the operation profile table 230, and the cumulative “twice” of the actual operation information 1412 is a threshold corresponding to the combination of the business name “estimate” and the operation name “system A access count”. It is determined whether or not “3 to 10 times” is exceeded. Here, it is determined that the threshold value “3 to 10 times” is not exceeded. Accordingly, the score of the score information 1421 corresponding to the application in the score table 290 remains “0”.

  In FIG. 15, operation information 1404 to 1406 is added to the operation log LG. The operation information 1404 to 1406 is information indicating operations sequentially performed in the business with the business name “estimate” in the terminal device Ti.

  First, when the operation information 1404 is acquired, the actual operation information 1413 is stored in the actual operation table 270 as a new record. At this time, the total of the actual operation information 1413 is “once”. The operation indicated by the operation information 1404 has an operation name “server C access count” and is not an operation corresponding to an application (operation name: estimate).

  In this case, the determination unit 1305 excludes from the undefined operation table 240 an undefined corresponding to the remaining character string “server C access” obtained by removing “number of times” from the operation name “server C access count” of the operation indicated by the operation information. Score “3” is acquired. Then, the determination unit 1305 adds the acquired undefined score to the score of the score information 1421 corresponding to the application name “estimation” in the score table 290.

  Next, the determination unit 1305 determines whether or not the score of the score information 1421 exceeds the block threshold “8” corresponding to the business name “estimation” in the business profile table 220. At this time, the score of the score information 1421 is “3”. Therefore, the determination unit 1305 determines that the score “3” of the score information 1421 does not exceed the block threshold “8”.

  Next, when the operation information 1405 is acquired, the total of the actual operation information 1413 in the actual operation table 270 is incremented. At this time, the total of the actual operation information 1413 is “twice”. The operation indicated by the operation information 1405 has an operation name “server C access count” and is not an operation corresponding to the application (operation name: estimate).

  In this case, the determination unit 1305 excludes from the undefined operation table 240 an undefined corresponding to the remaining character string “server C access” obtained by removing “number of times” from the operation name “server C access count” of the operation indicated by the operation information. Score “3” is acquired. Then, the determination unit 1305 adds the acquired undefined score to the score of the score information 1421 corresponding to the application name “estimation” in the score table 290.

  Next, the determination unit 1305 determines whether or not the score of the score information 1421 exceeds the block threshold “8” corresponding to the business name “estimation” in the business profile table 220. At this time, the score of the score information 1421 is “6”. Therefore, the determination unit 1305 determines that the score “3” of the score information 1421 does not exceed the block threshold “8”.

  Next, when the operation information 1406 is acquired, the total of the actual operation information 1413 in the actual operation table 270 is incremented. At this time, the total of the actual operation information 1413 is “3 times”. The operation indicated by the operation information 1406 has an operation name “server C access count” and is not an operation corresponding to an application (operation name: estimate).

  In this case, the determination unit 1305 excludes from the undefined operation table 240 an undefined corresponding to the remaining character string “server C access” obtained by removing “number of times” from the operation name “server C access count” of the operation indicated by the operation information. Score “3” is acquired. Then, the determination unit 1305 adds the acquired undefined score to the score of the score information 1421 corresponding to the application name “estimation” in the score table 290.

  Next, the determination unit 1305 determines whether or not the score of the score information 1421 exceeds the block threshold “8” corresponding to the business name “estimation” in the business profile table 220. At this time, the score of the score information 1421 is “9”. Since the score of the score information 1421 is “9”, the determination unit 1305 determines that the block threshold “8” is exceeded. Then, the determination unit 1305 determines that an unauthorized operation has been performed in the business with the business name “estimate”.

  Thus, whenever new operation information is acquired, the possibility of an unauthorized operation can be determined and the score information score can be updated, and an unauthorized operation in the terminal device Ti can be detected in real time. It becomes possible.

(Various processing procedures of the unauthorized operation monitoring apparatus 101)
Next, various processing procedures of the unauthorized operation monitoring apparatus 101 will be described. First, the profile creation processing procedure of the unauthorized operation monitoring apparatus 101 will be described. The profile creation process is executed, for example, before the start of a day of work for the user of the terminal device Ti.

  16 and 17 are flowcharts illustrating an example of a profile creation processing procedure of the unauthorized operation monitoring apparatus 101. In the flowchart of FIG. 16, first, the unauthorized operation monitoring apparatus 101 determines whether or not input of business profile information has been received from the terminal apparatus Ti (step S1601). The business profile information includes a business name and a block threshold value of a business handled by the user of the terminal device Ti.

  Here, the unauthorized operation monitoring apparatus 101 waits for input of business profile information (step S1601: No). If the unauthorized operation monitoring apparatus 101 receives input of business profile information (step S1601: Yes), the input business profile information is registered in the business profile table 220 (step S1602).

  Next, the unauthorized operation monitoring apparatus 101 refers to the operation history table 280 and displays the operation history of the user of the terminal device Ti on the display (not shown) of the terminal device Ti (step S1603). Then, the unauthorized operation monitoring apparatus 101 determines whether or not input of operation profile information has been received from the terminal apparatus Ti (step S1604). The operation profile information includes the business name of the business handled by the user of the terminal device Ti, the name of the operation performed in the business, the threshold value, and the weight.

  Here, the unauthorized operation monitoring apparatus 101 waits for input of operation profile information (step S1604: No). When the unauthorized operation monitoring apparatus 101 receives input of operation profile information (step S1604: Yes), it registers the input operation profile information in the operation profile table 230 (step S1605).

  Next, the unauthorized operation monitoring apparatus 101 refers to the operation profile table 230 and calculates the appearance frequency and the weighted average of each operation set in the operation profile table 230 (step S1606). The unauthorized operation monitoring apparatus 101 calculates an undefined score for each operation using the above equation (1) based on the calculated appearance frequency and weighted average of each operation (step S1607).

  Next, the unauthorized operation monitoring apparatus 101 registers the calculated undefined score of each operation in the undefined operation table 240 in association with the operation name (undefined operation name), appearance frequency, and weight average of each operation. (Step S1608), the process proceeds to step S1701 shown in FIG.

  In the flowchart of FIG. 17, the unauthorized operation monitoring apparatus 101 first displays the undefined operation confirmation screen 1200 on the display (not shown) of the terminal device Ti with reference to the undefined operation table 240 (step S1701). Then, the unauthorized operation monitoring apparatus 101 determines whether or not the content of the undefined operation has been changed on the undefined operation confirmation screen 1200 (step S1702).

  If the contents of the undefined operation have not been changed (step S1702: No), the unauthorized operation monitoring apparatus 101 proceeds to step S1704. On the other hand, when the contents of the undefined operation are changed (step S1702: Yes), the unauthorized operation monitoring apparatus 101 updates the undefined operation table 240 based on the changed contents of the undefined operation (step S1703). .

  Next, the unauthorized operation monitoring apparatus 101 determines whether or not the user's schedule input of the terminal apparatus Ti has been accepted (step S1704). The schedule includes a work name, a start time, and an end time of each work performed by the user of the terminal device Ti. Here, the unauthorized operation monitoring apparatus 101 waits for an input of a schedule (step S1704: No).

  When the unauthorized operation monitoring apparatus 101 receives an input of a schedule (step S1704: YES), the unauthorized operation monitoring apparatus 101 registers the input schedule in the schedule profile table 250 (step S1705), and ends a series of processes according to this flowchart. . Thereby, various profiles of the user of the terminal device Ti can be created.

(Unauthorized operation monitoring processing procedure of the unauthorized operation monitoring apparatus 101)
Next, an unauthorized operation monitoring process procedure of the unauthorized operation monitoring apparatus 101 will be described.

  18 and 19 are flowcharts illustrating an example of the unauthorized operation monitoring processing procedure of the unauthorized operation monitoring apparatus 101. In the flowchart of FIG. 18, first, the unauthorized operation monitoring apparatus 101 determines whether operation information indicating an operation performed on the terminal apparatus Ti has been acquired (step S1801).

  Here, the unauthorized operation monitoring apparatus 101 waits for acquisition of operation information (step S1801: No). Then, when the operation information is acquired (step S1801: Yes), the unauthorized operation monitoring apparatus 101 determines whether the schedule is registered in the schedule profile table 250 (step S1802).

  Here, when the schedule is not registered (step S1802: No), the unauthorized operation monitoring apparatus 101 notifies the user of the terminal apparatus Ti of a profile creation request (step S1803), and ends the series of processes according to this flowchart. .

  On the other hand, when the schedule has been registered (step S1802: Yes), the unauthorized operation monitoring apparatus 101 refers to the schedule profile table 250, and the operation time included in the acquired operation information is the time from the start time to the end time. The business name of the applied business included in the band is specified (step S1804).

  Then, the unauthorized operation monitoring apparatus 101 sets the business name of the identified application business in the application profile table 260 (step S1805). Next, the unauthorized operation monitoring apparatus 101 executes an operation history update process (step S1806), and proceeds to step S1901 shown in FIG. Note that a specific processing procedure of the operation history update process will be described later with reference to FIG.

  In the flowchart of FIG. 19, first, the unauthorized operation monitoring apparatus 101 refers to the operation profile table 230 to determine whether or not the operation indicated by the acquired operation information is an operation corresponding to an application (step S1901). .

  If the operation corresponds to the application (step S1901: Yes), the unauthorized operation monitoring apparatus 101 calculates the frequency (total) of operations indicated by the operation information in the application and calculates the actual operation table 270. Is updated (step S1902). Then, the unauthorized operation monitoring apparatus 101 refers to the actual operation table 270, and the total corresponding to the application name of the application and the operation name of the operation indicated by the operation information exceeds the corresponding threshold value in the operation profile table 230. It is determined whether or not (step S1903).

  Here, when the cumulative total does not exceed the threshold value (step S1903: No), the unauthorized operation monitoring apparatus 101 ends the series of processes according to this flowchart. On the other hand, when the cumulative total exceeds the threshold value (step S1903: Yes), the unauthorized operation monitoring apparatus 101 sets the weight corresponding to the combination of the business name of the applied business and the operation name indicated by the operation information from the operation profile table 230. Obtain (step S1904).

  The unauthorized operation monitoring apparatus 101 adds the acquired weight to the score of the score information corresponding to the application in the score table 290 (step S1905), and proceeds to step S1908.

  In step S1901, if the operation does not correspond to the application (step S1901: No), the unauthorized operation monitoring apparatus 101 acquires an undefined score corresponding to the operation indicated by the operation information from the undefined operation table 240. (Step S1906). Then, the unauthorized operation monitoring apparatus 101 adds the acquired non-definition score to the score of the score information corresponding to the application in the score table 290 (step S1907).

  Then, the unauthorized operation monitoring apparatus 101 determines whether the score of the score information corresponding to the application business in the score table 290 exceeds the corresponding block threshold in the business profile table 220 (step S1908).

  Here, when the score does not exceed the block threshold (step S1908: No), the unauthorized operation monitoring apparatus 101 ends the series of processes according to this flowchart. On the other hand, when the score exceeds the block threshold (step S1908: Yes), the unauthorized operation monitoring apparatus 101 executes a control process for restricting the operation in the terminal apparatus Ti (step S1909), and a series of processes according to this flowchart. Exit.

  Thereby, the operation performed in the terminal device Ti can be monitored in real time, and when it can be determined that the unauthorized operation is performed in the terminal device Ti, the operation in the terminal device Ti can be restricted at that time.

  Next, a specific processing procedure of the operation history update process in step S1806 shown in FIG. 18 will be described.

  FIG. 20 is a flowchart illustrating an example of a specific processing procedure of the operation history update process. In the flowchart of FIG. 20, first, the unauthorized operation monitoring apparatus 101 stores the acquired operation information in the operation history table 280 in association with the application name of the application (step S2001).

  Next, the unauthorized operation monitoring apparatus 101 identifies a combination of the application name of the application and the operation name of the operation indicated by the acquired operation information (step S2002). Then, the unauthorized operation monitoring apparatus 101 acquires operation information for a predetermined period T corresponding to the combination of the specified business name and operation name from the operation history table 280 (step S2003).

  Next, based on the acquired operation information, the unauthorized operation monitoring apparatus 101 calculates the accumulated time or the average number of operations for each day indicated by the operation information in the application (step S2004). The unauthorized operation monitoring apparatus 101 registers the calculated average in the operation history table 280 in association with the combination of the application name of the application and the operation name indicated by the operation information (step S2005). A series of processes according to the flowchart ends.

  Thereby, whenever the operation information performed in the terminal device Ti is acquired, the storage content of the operation history table 280 can be updated.

  As described above, according to the unauthorized operation monitoring apparatus 101 according to the embodiment, operation information indicating an operation performed on the terminal device Ti can be acquired. Further, according to the unauthorized operation monitoring apparatus 101, it is possible to identify the application for which the operation indicated by the operation information has been performed from the operation time included in the acquired operation information with reference to the schedule profile table 250. Thereby, when the operation indicated by the operation information is performed in the terminal device Ti, it is possible to specify the task (applied task) performed by the user of the terminal device Ti.

  Further, the unauthorized operation monitoring apparatus 101 can determine whether or not the operation indicated by the acquired operation information is an operation corresponding to the application, with reference to the operation profile table 230. Thereby, it is possible to determine whether or not the operation performed in the terminal device Ti is an undefined operation different from the operation assumed to be performed in the application.

  Further, according to the unauthorized operation monitoring apparatus 101, if the operation does not correspond to the application, the unauthorized operation is illegal in the application based on the undefined score corresponding to the operation indicated by the operation information with reference to the undefined operation table 240. It can be determined whether or not an operation has been performed. The non-definition score indicates the level of possibility of unauthorized operation that increases or decreases depending on the frequency of operations indicated by the operation information in other tasks different from the applied tasks among the plurality of tasks performed by the user of the terminal device Ti. Value.

  As a result, if the operation indicated by the operation information is an operation with a large number of cross-business operations performed in various business operations, it is likely that the operation is a normal operation even if it is performed as an undefined operation in the applied business. It is possible to reduce the accuracy with which it is determined that.

  Further, according to the unauthorized operation monitoring apparatus 101, a weight (a value indicating the second possibility of unauthorized operation) set in accordance with a combination of another business different from the applied business and the operation indicated by the operation information Based on the undefined score that further increases / decreases in response to this, it is possible to determine whether an unauthorized operation has been performed in the application. As a result, for example, when an operation having a large influence when fraud is performed in another business is performed as an undefined operation, it is possible to increase the accuracy with which the fraudulent operation is determined.

  Further, according to the unauthorized operation monitoring apparatus 101, in the case of an operation corresponding to an application, the frequency at which the operation indicated by the operation information is performed in the application can be calculated. Further, the unauthorized operation monitoring apparatus 101 refers to the operation profile table 230 to determine whether the calculated frequency exceeds a threshold set according to the combination of the application and the operation indicated by the operation information. can do. Then, according to the unauthorized operation monitoring apparatus 101, when the calculated frequency exceeds the threshold value, the weight set according to the combination of the application and the operation indicated by the operation information (second high possibility of unauthorized operation). It is possible to determine whether or not an unauthorized operation has been performed in the application.

  As a result, when the operation indicated by the operation information in the application is not performed within the normal range, and when the degree of influence when the operation is illegal is large, it is determined that the operation is an unauthorized operation. Accuracy can be increased.

  Also, according to the unauthorized operation monitoring apparatus 101, when the cumulative value of the undefined score and the weight for the application is greater than the block threshold set according to the application, the unauthorized operation is performed in the application. It can be judged that it was broken. Accordingly, it is possible to increase the possibility of an unauthorized operation by detecting an operation that has not been performed within a previously assumed range while preventing a normal operation from being treated as an unauthorized operation.

  Further, according to the unauthorized operation monitoring device 101, when it is determined that an unauthorized operation has been performed in the application, it is possible to limit operations in the terminal device Ti where the operation indicated by the operation information has been performed. As a result, it is possible to block damage to information leakage and the like by blocking the operation from the terminal device Ti, which has been infected with malware and easily operated from the outside, to the in-house system or the like.

  Further, the unauthorized operation monitoring apparatus 101 can output an alert when it is determined that an unauthorized operation has been performed in the application. Thereby, it is possible to notify the administrator of the unauthorized operation monitoring system 200 that there is a high possibility that the unauthorized operation has been performed in the terminal device Ti, and it is possible to quickly cope with the malware-infected terminal device Ti. Can be.

  For these reasons, according to the unauthorized operation monitoring device, the unauthorized operation monitoring method, the unauthorized operation monitoring program, and the unauthorized operation monitoring system according to the embodiment, a normal operation is treated as a potentially unauthorized operation. Therefore, the detection accuracy of unauthorized operations can be improved.

  The unauthorized operation monitoring method described in this embodiment can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. The unauthorized operation monitoring program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, an MO (Magneto-Optical disk), a DVD (Digital Versatile Disk), or a USB (Universal Serial Bus) memory. This is executed by being read from the recording medium by the computer. The unauthorized operation monitoring program may be distributed via a network such as the Internet.

  The following additional notes are disclosed with respect to the embodiment described above.

(Supplementary Note 1) An acquisition unit that acquires operation history information including an operation type indicating an operation type for the information processing system and an operation time;
A storage unit that stores schedule information indicating a correspondence between an operation group that is one or more combinations of the operation types and time;
If the operation group corresponding to the operation time of the operation history information does not include the operation type corresponding to the operation time, the fraud increases or decreases depending on the frequency of the operation type included in the schedule information at a specific time A control unit that determines whether an unauthorized operation has been performed based on a value indicating a high degree of operation possibility;
An unauthorized operation monitoring device comprising:

(Supplementary note 2) The value indicating the high possibility of unauthorized operation is a weight set according to a combination of another operation group different from the operation group corresponding to the operation time and the operation type of the operation history information The unauthorized operation monitoring device according to appendix 1, wherein the number is further increased or decreased in accordance with.

(Appendix 3) The control unit
When the operation group corresponding to the operation time includes the operation type corresponding to the operation time, the frequency of the operation of the operation type performed in the time corresponding to the operation group is calculated,
If the calculated frequency exceeds a threshold value, whether an unauthorized operation has been performed based on a value indicating the second highest possibility of unauthorized operation set according to the combination of the operation group and the operation type Determine whether or not
The unauthorized operation monitoring device according to appendix 1 or 2, characterized by:

(Appendix 4) The control unit
When a cumulative value obtained by accumulating the value indicating the high possibility of unauthorized operation and the value indicating the second high possibility of unauthorized operation exceeds a threshold set according to the operation group, Determine that an unauthorized operation has been performed,
The unauthorized operation monitoring device according to Supplementary Note 3, wherein

(Supplementary Note 5) The control unit
The unauthorized operation monitoring device according to any one of appendices 1 to 4, wherein when it is determined that an unauthorized operation has been performed, operations on the terminal device on which the operation history information has been operated are restricted.

(Appendix 6) The unauthorized operation monitoring device according to any one of appendices 1 to 5, wherein an alert is output when it is determined that an unauthorized operation has been performed.

(Supplementary Note 7) Acquire operation history information including an operation type indicating an operation type for the information processing system and an operation time,
Referring to a storage unit that stores schedule information indicating a correspondence between an operation group that is one or more combinations of the operation types and time, the operation group corresponding to the operation time of the operation history information corresponds to the operation time When the operation type to be performed is not included, the unauthorized operation is performed based on a value indicating the level of possibility of the unauthorized operation that increases or decreases according to the frequency of the operation type included in the schedule information at a specific time. To determine whether or not
An unauthorized operation monitoring method, wherein a computer executes a process.

(Supplementary Note 8) Acquire operation history information including an operation type indicating an operation type for the information processing system and an operation time,
Referring to a storage unit that stores schedule information indicating a correspondence between an operation group that is one or more combinations of the operation types and time, the operation group corresponding to the operation time of the operation history information corresponds to the operation time When the operation type to be performed is not included, the unauthorized operation is performed based on a value indicating the level of possibility of the unauthorized operation that increases or decreases according to the frequency of the operation type included in the schedule information at a specific time. To determine whether or not
An unauthorized operation monitoring program for causing a computer to execute processing.

(Supplementary note 9) a terminal device;
Operation history information including an operation type indicating an operation type on the terminal device for the information processing system and an operation time is acquired, and schedule information indicating a correspondence between an operation group and one or more combinations of the operation types Is included in the schedule information at a specific time when the operation group corresponding to the operation time of the operation history information does not include the operation type corresponding to the operation time. An unauthorized operation monitoring device that determines whether or not an unauthorized operation has been performed based on a value indicating a high possibility of an unauthorized operation that increases or decreases according to the frequency of the operation type;
An unauthorized operation monitoring system comprising:

101 Unauthorized Operation Monitoring Device 102 T1 to Tn, Ti Terminal Device 110 Operation Information 120 Corresponding Information 200 Unauthorized Operation Monitoring System 220 Business Profile Table 230 Operation Profile Table 240 Undefined Operation Table 250 Schedule Profile Table 260 Applied Profile Table 270 Actual Operation Table 280 Operation history table 290 Score table 1200 Undefined operation confirmation screen 1301 Acquisition unit 1302 Determination unit 1303 Calculation unit 1304 Setting unit 1305 Determination unit 1306 Control processing unit

Claims (7)

An acquisition unit that acquires operation history information including an operation type indicating an operation type for the information processing system and an operation time;
A storage unit that stores schedule information indicating a correspondence between an operation group that is one or more combinations of the operation types and time;
If the operation group corresponding to the operation time of the operation history information does not include the operation type corresponding to the operation time, the fraud increases or decreases depending on the frequency of the operation type included in the schedule information at a specific time A control unit that determines whether an unauthorized operation has been performed based on a value indicating a high degree of operation possibility;
An unauthorized operation monitoring device comprising:   The value indicating the high possibility of unauthorized operation is further set according to a weight set according to a combination of another operation group different from the operation group corresponding to the operation time and the operation type of the operation history information. The unauthorized operation monitoring apparatus according to claim 1, wherein the unauthorized operation monitoring apparatus increases or decreases. The controller is
When the operation group corresponding to the operation time includes the operation type corresponding to the operation time, the frequency of the operation of the operation type performed in the time corresponding to the operation group is calculated,
If the calculated frequency exceeds a threshold value, whether an unauthorized operation has been performed based on a value indicating the second highest possibility of unauthorized operation set according to the combination of the operation group and the operation type Determine whether or not
The unauthorized operation monitoring apparatus according to claim 1 or 2, wherein The controller is
When a cumulative value obtained by accumulating the value indicating the high possibility of unauthorized operation and the value indicating the second high possibility of unauthorized operation exceeds a threshold set according to the operation group, Determine that an unauthorized operation has been performed,
The unauthorized operation monitoring device according to claim 3. Acquire operation history information including an operation type indicating an operation type for the information processing system and an operation time,
Referring to a storage unit that stores schedule information indicating a correspondence between an operation group that is one or more combinations of the operation types and time, the operation group corresponding to the operation time of the operation history information corresponds to the operation time When the operation type to be performed is not included, the unauthorized operation is performed based on a value indicating the level of possibility of the unauthorized operation that increases or decreases according to the frequency of the operation type included in the schedule information at a specific time. To determine whether or not
An unauthorized operation monitoring method, wherein a computer executes a process. Acquire operation history information including an operation type indicating an operation type for the information processing system and an operation time,
Referring to a storage unit that stores schedule information indicating a correspondence between an operation group that is one or more combinations of the operation types and time, the operation group corresponding to the operation time of the operation history information corresponds to the operation time When the operation type to be performed is not included, the unauthorized operation is performed based on a value indicating the level of possibility of the unauthorized operation that increases or decreases according to the frequency of the operation type included in the schedule information at a specific time. To determine whether or not
An unauthorized operation monitoring program for causing a computer to execute processing. A terminal device;
Operation history information including an operation type indicating an operation type on the terminal device for the information processing system and an operation time is acquired, and schedule information indicating a correspondence between an operation group and one or more combinations of the operation types Is included in the schedule information at a specific time when the operation group corresponding to the operation time of the operation history information does not include the operation type corresponding to the operation time. An unauthorized operation monitoring device that determines whether or not an unauthorized operation has been performed based on a value indicating a high possibility of an unauthorized operation that increases or decreases according to the frequency of the operation type;
An unauthorized operation monitoring system comprising:

Images