JP2018124883A - Fraudulence detection program, fraudulence detection method and fraudulence detection device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect a fraudulent log-in using the same account.SOLUTION: When detecting log-in by the same account from a plurality of terminals, the fraudulence detection device 1 obtains position information of the plurality of terminals to locate the plurality of terminals, and based on the specified locations of the respective terminals, calculates the distances between the plurality of terminals. Then, when the calculated distances are equal to or greater than a predetermined value, the fraudulence detection device 1 determines that the log-in from the plurality of terminals is fraudulent.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a fraud detection program and the like.

  A server that manages software licenses provides licenses according to the number of users, and manages the provided licenses. That is, the server manages licenses of the provided software with user accounts corresponding to the number of users.

  A technique for authenticating a user's account when the user is in a remote place is disclosed. For example, if a user's account is authenticated by using information specific to its geodetic location, but that information is constantly changing, it is difficult to authenticate the user's account and trick the server A technique is disclosed (for example, see Patent Document 1).

Japanese National Patent Publication No. 11-512860 JP 2002-342284 A

  However, a service using a plurality of terminals may be performed using the same license. In such a case, the server that manages the license uses a plurality of terminals to log in a license using the same account, or a terminal in which a regular user and other users are different Cannot determine whether you are logged in using. For this reason, there is a problem that the server cannot detect an unauthorized login using the same account.

  The conventional technique is an authentication method in the case where the user's account is authenticated by using information specific to the geodetic position, and when the account is authenticated by the account, fraud using the same account is detected. It's not technology.

  In one aspect, the object is to detect unauthorized logins using the same account.

  In one aspect, the fraud detection program acquires position information of the plurality of terminals and identifies the positions of the plurality of terminals when the computer detects logins from the plurality of terminals with the same account. Based on the position of each of the plurality of terminals, the distance between each of the plurality of terminals is calculated, and when the calculated distance is equal to or greater than a predetermined value, login from the plurality of terminals is invalid. Determine and execute the process.

  According to one aspect, the fraud detection program can detect an unauthorized login using the same account.

FIG. 1 is a functional block diagram illustrating the configuration of the fraud detection apparatus according to the first embodiment. FIG. 2 is a diagram illustrating an example of login information according to the first embodiment. FIG. 3 is a diagram illustrating an example of a flowchart of fraud detection processing according to the first embodiment. FIG. 4 is a functional block diagram illustrating the configuration of the fraud detection device according to the second embodiment. FIG. 5 is a diagram illustrating an example of past history information according to the second embodiment. FIG. 6 is a diagram illustrating an example of threshold values corresponding to alert types. FIG. 7 is a diagram illustrating an example of an alert corresponding to an alert type. FIG. 8 is a diagram illustrating an example of a flowchart of fraud detection processing according to the second embodiment. FIG. 9 is a diagram illustrating an example of a flowchart of an unauthorized stage determination process using past history information. FIG. 10 is a diagram illustrating an example of a computer that executes a fraud detection program.

  Embodiments of a fraud detection program, a fraud detection method, and a fraud detection apparatus disclosed in the present application will be described below in detail with reference to the drawings. The present invention is not limited to the embodiments.

[Configuration of Fraud Detection Device According to Embodiment 1]
FIG. 1 is a functional block diagram illustrating the configuration of the fraud detection apparatus according to the first embodiment. The fraud detection apparatus 1 shown in FIG. 1 determines whether the login is from a legitimate user or includes an unauthorized user when detecting logins from the same account from a plurality of terminals. For example, an account is provided with a license for software used in a company according to the number of users or the number of PCs in the company. However, the account is not limited to this, and a license for software used by the individual may be provided to the individual.

  As shown in FIG. 1, the fraud detection device 1 includes a control unit 10 and a storage unit 20.

  The control unit 10 corresponds to an electronic circuit such as a CPU (Central Processing Unit). And the control part 10 has an internal memory for storing the program which prescribed | regulated various process procedures, and control data, and performs various processes by these. The control unit 10 includes a reception unit 11, an identification unit 12, a determination unit 13, and an output unit 14.

  The storage unit 20 is, for example, a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 20 has login information 21. The login information 21 indicates login information.

  Here, an example of the login information 21 will be described with reference to FIG. FIG. 2 is a diagram illustrating an example of login information according to the first embodiment. As shown in FIG. 2, the login information 21 stores an account ID (Identifier) 21a and position information 21b in association with each other. The account ID 21a is a character string provided for each license, and is a character string that serves as an indicator for identifying the license. The location information 21b is location information of the logged-in terminal. The position information 21b may be information using longitude and latitude, may be address information, or may be rough area information. As an example, when the account ID 21a is “AAA”, “X1” is stored as the position information 21b. In addition, when the account ID 21a is “AAA”, “X2” is stored as the position information 21b. That is, when the account ID 21a is “AAA”, information on a plurality of logins using the same account is stored. Further, when the account ID 21a is “BBB”, “X3” is stored as the position information 21b. That is, when the account ID 21a is “BBB”, single login information is stored.

  The receiving unit 11 receives information including login information from the terminal. For example, the receiving unit 11 detects login from a terminal and receives login information including an account ID and position information.

  The identification unit 12 identifies information received by the reception unit 11. For example, the identification unit 12 identifies an account ID and location information included in the login information received by the reception unit 11. Then, the identification unit 12 stores the identified (identified) account ID and the identified (identified) position information in the login information 21 in association with each other.

  The determination unit 13 determines whether or not the login from the terminal is illegal based on the identification information identified by the identification unit 12. For example, the determination unit 13 refers to the login information 21 and acquires the position information 21 b of the same account ID as the account ID identified by the identification unit 12. And the determination part 13 calculates the distance between the terminal logged in and the terminal of the acquired positional information 21b based on the positional information identified by the identification part 12, and the acquired positional information 21b. And the determination part 13 determines with the login from the terminal of the logged-in terminal and the acquired positional information 21b being unauthorized, when the calculated distance is more than a predetermined value. The predetermined value is, for example, a distance value between a plurality of terminals that can be used by a single user at a plurality of terminals. That is, the determination unit 13 determines that logins from a plurality of terminals are not illegal when a plurality of terminals with the same account ID are located at a distance that can be used by one user. When a plurality of terminals with the same account ID are located at a distance that cannot be used by one user, the determination unit 13 determines that login from the plurality of terminals is illegal.

  When the determination unit 13 determines that the login from the terminal is illegal, the output unit 14 outputs an alert to the plurality of terminals determined to be illegal. For example, the output unit 14 outputs alerts such as cautions and warnings to a plurality of terminals determined to be unauthorized after login. As an example, the output unit 14 makes a part or all of the screens output to a plurality of terminals determined to be illegal after logging in an invisible or difficult to view state.

[Flowchart of Fraud Detection Processing According to Embodiment 1]
FIG. 3 is a diagram illustrating an example of a flowchart of fraud detection processing according to the first embodiment. As illustrated in FIG. 3, the reception unit 11 determines whether login has been detected (step S <b> 11). If it is determined that the login is not detected (step S11; No), the receiving unit 11 repeats the determination process until the login is detected.

  On the other hand, when it determines with having detected login (step S11; Yes), the identification part 12 specifies account ID and position information from the information of login (step S12). Then, the identification unit 12 stores the specified account ID and the specified position information in the login information 21 in association with each other.

  Then, the determination unit 13 refers to the login information 21 and determines whether the position information 21b of the same account ID 21a as the specified account ID exists (step S13). When it is determined that the position information 21b of the account ID 21a identical to the identified account ID does not exist (step S13; No), the determination unit 13 determines that the login from the terminal is not unauthorized, and performs the fraud detection process. finish.

  On the other hand, when it is determined that the position information 21b of the same account ID 21a as the specified account ID exists (step S13; Yes), the determination unit 13 performs the following process. That is, the determination unit 13 determines whether the distance between the specified position information and the position information 21b of the same account ID 21a as the specified account ID is less than a predetermined value (step S14).

  If it is determined that the distance is less than the predetermined value (step S14; Yes), the determination unit 13 determines that the login from the terminal is not unauthorized and ends the fraud detection process.

  On the other hand, if it is determined that the distance is greater than or equal to the predetermined value (step S14; No), the output unit 14 issues an alert to the terminal where the login is detected and the terminal of the location information 21b of the same account ID 21a. Output (step S15). The determination unit 13 determines that the login from the terminal in which the login is detected and the terminal having the location information 21b with the same account ID 21a is illegal, and the output unit 14 generates an alert such as a caution or a warning for these terminals. Is output. The determination unit 13 ends the fraud detection process.

[Effect of Example 1]
In this way, in the first embodiment, the fraud detection device 1 acquires the position information of the plurality of terminals and identifies the position of each of the plurality of terminals when the login by the same account is detected from the plurality of terminals. . The fraud detection device 1 calculates the distance between each of the plurality of terminals based on the identified positions of the plurality of terminals. The fraud detection device 1 determines that logins from a plurality of terminals are fraudulent when the calculated distance is equal to or greater than a predetermined value. According to such a configuration, the fraud detection device 1 can detect an unauthorized login using the same account.

  Further, in the first embodiment, when the fraud detection device 1 determines that logins from a plurality of terminals are illegal, a part or all of the screens output to the plurality of terminals after login cannot be viewed or viewed. Execute the process to make it difficult to do. According to such a configuration, the fraud detection device 1 can make a plurality of terminals that are determined to be fraudulent to be aware of the unauthorized use of the license.

  By the way, the fraud detection apparatus 1 according to the first embodiment, when detecting logins from the same account from a plurality of terminals, when the distance calculated from the position of each of the plurality of terminals is a predetermined value or more, the plurality of terminals It explained that it was determined that the login from was invalid. However, the fraud detection apparatus 1 is not limited to this, and when it is determined that logins from a plurality of terminals are illegal, the fraud detection apparatus 1 refers to the history information of past logins and outputs to the plurality of terminals step by step. A part or all of the screen may be invisible or difficult to view.

  Accordingly, the fraud detection apparatus 1 according to the second embodiment refers to a screen that outputs to a plurality of terminals step by step with reference to past log history information when it is determined that logins from a plurality of terminals are fraudulent. A case will be described in which a part or all of the screen is made invisible or difficult to view.

[Configuration of fraud detection apparatus according to Embodiment 2]
FIG. 4 is a functional block diagram illustrating the configuration of the fraud detection device according to the second embodiment. In addition, about the structure same as the fraud detection apparatus 1 shown in FIG. 1, the same code | symbol is attached | subjected and the description of the overlapping structure and operation | movement is abbreviate | omitted. The difference between the first embodiment and the second embodiment is that the reception unit 11 is changed to the reception unit 11A, the identification unit 12 is changed to the identification unit 12A, the determination unit 13 is changed to the determination unit 13A, and the output unit 14 is changed. The output unit 14A is changed. Further, the difference between the first embodiment and the second embodiment is that past history information 31 is added. The past history information 31 is history information of a terminal that has logged in in the past.

  Here, an example of the past history information 31 will be described with reference to FIG. FIG. 5 is a diagram illustrating an example of past history information according to the second embodiment. As shown in FIG. 5, past history information 31 is associated with account ID 31a and login start time 31b, MAC address 31c in HW information, IP address 31d in HW information, login status 31e, usage time 31f. Remember. Furthermore, the past history information 31 stores location information 31g, a usage URL 31h, and a browser 31i in association with the account ID 31a and the login start time 31b. The account ID 31a is a character string assigned to each license, and is a character string that serves as an indicator for identifying the license. The account ID 31a corresponds to the account ID 21a of the login information 21. The login start time 31b indicates the login start time. The MAC address 31c in the HW information indicates the MAC address of the logged-in terminal. The IP address 31d in the HW information indicates the IP address of the logged-in terminal. The login status 31e indicates the login status of the logged-in terminal. The usage time 31f indicates the duration of continuous use after logging in. The location information 31g is location information of the logged-in terminal. The position information 31g may be information using longitude and latitude, may be address information, or may be rough area information. Here, the position information 31g is assumed to be rough area information. The use URL 31h indicates a URL used by the logged-in terminal. The browser 31i indicates a browser that is used by the logged-in terminal.

  As an example, when the account ID 31a is “AAA”, the login start time 31b is “2017/01/10 13:30”, the MAC address 31c in the HW information is “MAC address a”, and the IP address 31d is “ IP address a ”is stored. “Logged in” is stored as the login status 31e, “3h” as the usage time 31f, “Tokyo” as the location information 31g, “URLa” as the usage URL 31h, and “IE” as the browser 31i. When another account ID 31a is “AAA”, the login start time 31b is “2017/01/10 14:30”, the MAC address 31c in the HW information is “MAC address b”, and the IP address 31d is “IP address b” is stored. “Logged in” is stored as the login status 31e, “1h” as the usage time 31f, “Osaka” as the location information 31g, “URLb” as the usage URL 31h, and “IE” as the browser 31i.

  The receiving unit 11A receives information including login information from the terminal. In addition, the receiving unit 11A receives information on the usage status using the license from the logged-in terminal. The login information is, for example, information including an account ID, position information, and HW information. The usage status information is, for example, information including a login status, a usage URL, and a browser.

  The identification unit 12A identifies the information received by the reception unit 11A. For example, the identification unit 12A identifies an account ID, location information, and HW information included in the login information received by the reception unit 11A. Then, the identification unit 12A associates the identified (identified) account ID and the identified (identified) position information and stores them in the login information 21. The identification unit 12A stores the identified (identified) account ID, location information, and HW information in the past history information 31. The identifying unit 12A identifies the login status, usage URL, and browser included in the usage status information received by the receiving unit 11A. Then, the identification unit 12A updates the identified (identified) login status, usage URL, and browser in the record of the past history information 31 corresponding to the account ID and the HW information. In addition, when the usage status is received by the receiving unit 11A, the identification unit 12A indicates the usage time continuously used after logging in the record of the past history information 31 corresponding to the account ID and the HW information. Update.

  The determination unit 13A determines that the login from the terminal is illegal based on the identification information identified by the identification unit 12A. For example, the determination unit 13A refers to the login information 21 and acquires the position information 21b of the same account ID 21a as the account ID identified by the identification unit 12A. Then, the determination unit 13A calculates the distance between the logged-in terminal and the terminal of the acquired position information 21b based on the position information identified by the identification unit 12A and the acquired position information 21b. When the calculated distance is equal to or greater than a predetermined value, the determination unit 13A determines that the login from the terminal that has logged in and the terminal of the acquired position information 21b is illegal. That is, the determination unit 13A determines that logins from a plurality of terminals logged in with the same account ID are illegal.

  If the determination unit 13A determines that logins from a plurality of terminals logged in with the same account ID are illegal, the determination unit 13A determines whether the login is further illegal using the past history information 31. For example, with reference to the past history information 31, the determination unit 13A determines that logins from a plurality of terminals are illegal at the caution stage when the first threshold value is met. That is, in such a case, the determination unit 13A determines that logins from a plurality of terminals are mild injustices. Then, the determination unit 13A outputs the alert type to the output unit 14A with the alert type as “caution”. Further, the determination unit 13A refers to the past history information 31 and determines that login from a plurality of terminals is illegal at the warning stage when the second threshold value is satisfied. That is, in such a case, the determination unit 13A determines that logins from a plurality of terminals are medium-level fraud. Then, the determination unit 13A sets the alert type as “warning” and outputs the alert type to the output unit 14A. Further, the determination unit 13A refers to the past history information 31 and determines that login from a plurality of terminals is illegal at the restriction stage when the third threshold value is satisfied. In other words, in such a case, the determination unit 13A determines that logins from a plurality of terminals are serious injustices. Then, the determination unit 13A sets the alert type as “restricted” and outputs the alert type to the output unit 14A. Note that the relationship between the first threshold value, the second threshold value, and the third threshold value is set such that the contents of the threshold value are heavy in the order of the first threshold value, the second threshold value, and the third threshold value.

  Here, an example of the first threshold value, the second threshold value, and the third threshold value when one account is provided to an individual as a software license will be described with reference to FIG. FIG. 6 is a diagram illustrating an example of threshold values corresponding to alert types. The table shown in FIG. 6 shows thresholds of determination items used when determining whether or not the information is invalid in association with the alert type. The determination items are, for example, the number of logins from the same account ID, the number of logins in a predetermined period, the usage time in the predetermined period, and the distance between a plurality of terminals. The determination items shown here are examples, and other determination items may be applied.

  When the number of logins from the same account ID is used as a determination item, the first threshold is “2-4”, the second threshold is “5-9”, and the third threshold is “10”. For example, the determination unit 13A refers to the past history information 31 and counts the number of logins during login of the same account ID as the account ID identified by the identification unit 12A. Then, when the count number matches “2-4” indicating the first threshold, the determination unit 13A determines the alert type as “caution”. It is judged as a minor stage of fraud. Then, the determination unit 13A determines the alert type as “warning” when the count number matches “5 to 9” indicating the second threshold. It is determined that the medium level of fraud. Then, when the count number matches “10” indicating the third threshold, the determination unit 13A determines the alert type as “restricted”. It is judged as a serious stage of fraud. That is, when the number of logins from the same account ID being logged in is “2 to 4”, the determination unit 13A determines that there is a mild stage of fraud that there is a possibility of unauthorized use. When the number of logins from the same account ID being logged in is “5-9”, the determination unit 13A determines that the medium level of fraud is likely to be fraudulent use. When the number of logins from the same account ID being logged in is “10”, the determination unit 13A determines that it is a serious stage of fraud where the possibility of unauthorized use is very high.

  When the number of logins in a predetermined period is used as a determination item, the first threshold is “within reference value ± 50%”, the second threshold is “reference value ± 51 to 100%”, and the third threshold is “reference value”. Values ± 101 to 100% ”. Here, it is assumed that the reference value is “3”, for example. Then, for example, the first threshold is set to “1.5 to 4.5”, the second threshold is set to “greater than 4.5 and less than 6”, and the third threshold is set to “greater than 6”, for example. It ’s fine. The reference value may be calculated from the number of logins in the past predetermined time, or may be set in advance by the user.

  For example, the determination unit 13A refers to the past history information 31 and counts the number of logins of the same account ID as the account ID identified by the identification unit 12A within a predetermined period. Then, the determination unit 13A sets the alert type to “caution” when the counted number of logins matches “within reference value ± 50%” indicating the first threshold. It is judged as a minor stage of fraud. Then, the determination unit 13A sets the alert type to “warning” when the counted number of logins matches “reference value ± 51 to 100%” indicating the second threshold. It is determined that the medium level of fraud. Then, the determination unit 13A sets the alert type to “restricted” when the counted number of logins matches “reference value ± 101 to 100%” indicating the third threshold. It is judged as a serious stage of fraud.

  When the usage time in the predetermined period is used as a determination item, the first threshold is “within 10 h / day”, the second threshold is “10 h to 15 h / day”, and the third threshold is “15 h or more / day”. It is. For example, the determination unit 13A refers to the past history information 31 and acquires the usage time of the account ID identified by the identification unit 12A and the usage time of the account ID that is the same as the account ID. Then, the determination unit 13A determines the alert type as “caution” when both the usage times match “within 10 hours / day” indicating the first threshold. It is judged as a minor stage of fraud. Then, the determination unit 13A determines the alert type as “warning” when both the usage times match “10h to 15h / day” indicating the second threshold. It is determined that the medium level of fraud. Then, the determination unit 13A determines that the alert type is “restricted” when both usage times match “15h or more / day” indicating the third threshold. It is judged as a serious stage of fraud. That is, when the usage time in a predetermined period matches a predetermined threshold, the determination unit 13A determines that the same user is illegally used because it is difficult for the same user to use a plurality of terminals for a long period of time. .

  When using a distance between a plurality of terminals as a determination item, the first threshold is “distance corresponding to the company”, the second threshold is “distance corresponding to the country”, and the third threshold is “outside the country”. “Applicable distance”. For example, the determination unit 13A refers to the past history information 31 and acquires the position information of the account ID identified by the identification unit 12A and the position information of the same account ID as the account ID. Then, the determination unit 13A calculates distances between the plurality of terminals from the acquired position information. When the distance between the plurality of terminals matches the “distance corresponding to the company” indicating the first threshold, the determination unit 13A determines the alert type as “caution”. It is judged as a minor stage of fraud. Then, the determination unit 13A determines the alert type as “warning” when the distance between the plurality of terminals matches the “distance corresponding to the country” indicating the second threshold. It is determined that the medium level of fraud. Then, the determination unit 13A determines that the alert type is “restricted” when the distance between the plurality of terminals matches the “distance corresponding to outside the country” indicating the third threshold. It is judged as a serious stage of fraud. That is, when the distance between a plurality of terminals matches a predetermined threshold, the determination unit 13A determines that the same user is unauthorized use because it is difficult for the same user to use a plurality of terminals.

  In this way, when the login with the same account ID is performed from a plurality of terminals, the determination unit 13A adds not only the location information but also the determination condition to determine that the login is illegal. It can be accurately determined whether or not there is.

  It has been described that the determination unit 13A determines the alert type for each determination item using the first threshold value, the second threshold value, and the third threshold value. However, the determination unit 13A is not limited to this, and the alert type may be determined using the first threshold value, the second threshold value, and the third threshold value for each combination of the determination items. For example, for each determination item included in the combination, the determination unit 13A determines that the alert type is “attention” when each value related to each determination item matches each first threshold value. For each determination item included in the combination, the determination unit 13A determines the alert type as “warning” when each value related to each determination item matches the second threshold value. For each determination item included in the combination, the determination unit 13A determines that the alert type is “restricted” when each value related to each determination item matches the third threshold value.

  FIG. 6 shows an example of the first threshold value, the second threshold value, and the third threshold value when one account is provided to an individual as a software license. However, if one account is provided for a company as a software license, even if the first threshold, the second threshold, and the third threshold are set according to the number of users in the company good. Assume that the number of users is 1000. In such a case, when the number of logins from the same account ID is used as the determination item, the first threshold is “1001 to 1004”, the second threshold is “1005 to 1009”, and the third threshold is For example, “1010” may be set. Further, when the number of logins in a predetermined period is used as a determination item, the specified value is assumed to be “3000”, for example. Then, for example, the first threshold may be set to “1500 to 4500”, the second threshold may be set to “greater than 4500 and less than or equal to 6000”, and the third threshold may be set to “greater than 6000”, for example.

  The output unit 14A outputs an alert to a plurality of terminals determined to be unauthorized according to the alert type output by the determination unit 13A. For example, the output unit 14A makes a part or all of the screens output to a plurality of terminals determined to be illegal in a state where it is not visible or difficult to view depending on the alert type output by the determination unit 13A. . As an example, when the alert type is “attention”, the output unit 14A makes it difficult for a plurality of terminals determined to be illegal to visually recognize a portion that is not related to the screen job being used. To do. That is, the output unit 14A interferes with a part that has a small influence on the business. When the alert type is “warning”, the output unit 14A makes it difficult to visually recognize a plurality of terminals determined to be illegal, including portions related to the screen job being used. . That is, the output unit 14A interferes with a part that has an effect on business. When the alert type is “restricted”, the output unit 14A makes all the screens in use invisible or difficult to view for a plurality of terminals determined to be illegal. That is, the output unit 14A interferes with the usage screen entirely.

  Here, an example of the alert corresponding to the alert type will be described with reference to FIG. FIG. 7 is a diagram illustrating an example of an alert corresponding to an alert type. As shown in FIG. 7, an alert is output according to the alert type determined using the past history information 31.

  When the alert type is “Caution”, the output unit 14A makes it difficult for a plurality of terminals determined to be illegal to visually recognize portions that are not related to the screen job being used. Here, a portion unrelated to the screen job being used shown in a broken line is interfered.

  When the alert type is “warning”, the output unit 14A makes it difficult to visually recognize a plurality of terminals determined to be illegal, including portions related to the screen job being used. . Here, a portion related to the screen job being used shown in a broken line is interfered.

  When the alert type is “restricted”, the output unit 14A makes all the screens in use invisible or difficult to view for a plurality of terminals determined to be illegal. Here, the entire screen being used is interfered with in an invisible state.

  Accordingly, the output unit 14A can raise awareness of unauthorized use of the license by interfering in a stepwise manner with respect to the screens of a plurality of terminals determined to be unauthorized according to the threshold value.

[Flowchart of Fraud Detection Processing According to Second Embodiment]
FIG. 8 is a diagram illustrating an example of a flowchart of fraud detection processing according to the second embodiment. As illustrated in FIG. 8, the reception unit 11A determines whether login has been detected (step S21). If it is determined that login has not been detected (step S21; No), the receiving unit 11A repeats the determination process until login is detected.

  On the other hand, when it determines with having detected login (step S21; Yes), the identification part 12A specifies account ID and position information from the information of login (step S22). Then, the identification unit 12A stores the specified account ID and the specified position information in the login information 21 in association with each other.

  Then, the determination unit 13A refers to the login information 21 and determines whether the position information 21b of the same account ID 21a as the specified account ID exists (step S23). When it is determined that the position information 21b of the account ID 21a identical to the identified account ID does not exist (step S23; No), the determination unit 13A determines that the login from the terminal is not unauthorized, and performs the fraud detection process. finish.

  On the other hand, when it is determined that the position information 21b of the account ID 21a identical to the specified account ID exists (step S23; Yes), the determination unit 13A performs the following process. That is, the determination unit 13A determines whether or not the distance between the specified position information and the position information 21b of the same account ID 21a as the specified account ID is less than a predetermined value (step S24).

  If it is determined that the distance is less than the predetermined value (step S24; Yes), the determination unit 13A determines that the login from the terminal is not illegal and ends the fraud detection process.

  On the other hand, when it is determined that the distance is equal to or greater than the predetermined value (step S24; No), the determination unit 13A determines that logins from a plurality of terminals logged in using the specified account ID are illegal. Then, the determination unit 13A further performs an unauthorized stage determination process using the past history information 31 for the specified account ID (step S25). A flowchart of the unauthorized stage determination process using the past history information 31 will be described later.

  Then, the determination unit 13A ends the fraud detection process after executing the fraud stage determination process using the past history information 31.

[Flow chart of fraud stage determination processing using past history information]
FIG. 9 is a diagram illustrating an example of a flowchart of an unauthorized stage determination process using past history information. In FIG. 9, it is assumed that the determination unit 13 </ b> A receives a corresponding account ID that is determined to be unauthorized.

  As illustrated in FIG. 9, the determination unit 13A refers to the past history information 31 and determines whether or not the past history of the corresponding account ID matches the first threshold (step S31). When it is determined that the past history of the corresponding account ID matches the first threshold value (step S31; Yes), the determination unit 13A is illegal to log in from a plurality of terminals logged in with the corresponding account ID. It is determined that Then, the output unit 14A outputs a “caution” alert (step S32). For example, the output unit 14A makes it difficult for a plurality of terminals determined to be illegal to visually recognize a portion unrelated to the screen job being used. Then, the determination unit 13A ends the unauthorized stage determination process using the past history information 31.

  On the other hand, if it is determined that the past history of the corresponding account ID does not match the first threshold (step S31; No), the determination unit 13A matches the past history of the corresponding account ID to the second threshold. Is determined (step S33). When it is determined that the past history of the corresponding account ID matches the second threshold value (step S33; Yes), the determination unit 13A is illegal in logging in from a plurality of terminals logged in with the corresponding account ID. It is determined that The output unit 14A then outputs a “warning” alert (step S34). For example, the output unit 14A makes it difficult to visually recognize a plurality of terminals determined to be illegal, including portions related to the screen job being used. Then, the determination unit 13A ends the unauthorized stage determination process using the past history information 31.

  On the other hand, when it is determined that the past history of the corresponding account ID does not match the second threshold (step S33; No), the determination unit 13A restricts login from a plurality of terminals logged in with the corresponding account ID. It is determined that the stage is invalid. Then, the output unit 14A outputs a “limit” alert (step S35). For example, the output unit 14A makes all of the screens in use unrecognizable or difficult to view for a plurality of terminals determined to be unauthorized. Then, the determination unit 13A ends the unauthorized stage determination process using the past history information 31.

  It has been described that the determination unit 13 </ b> A determines whether it is further unauthorized using the past history information 31 when it is determined that logins from a plurality of terminals logged in with the same account ID are unauthorized. For example, the determination unit 13A refers to the past history information 31 to set at least one of the duration of unauthorized login (usage time), the number of unauthorized logins, and the distance between a plurality of terminals that performed unauthorized logins. In response, it is further determined whether or not it is illegal. However, the determination unit 13 </ b> A is not limited to this, and may refer to the past history information 31 to determine whether or not the information is further illegal in accordance with information on a plurality of terminals that performed unauthorized login. For example, the determination unit 13A refers to the past history information 31 to acquire a plurality of MAC addresses that have performed unauthorized login, and when the acquired MAC address has not been used in the past, the terminal of the MAC address May be determined to be fraudulent. In addition, the determination unit 13A refers to the past history information 31 and performs information on a plurality of terminals that have performed unauthorized login, the duration of unauthorized login (usage time), the number of unauthorized logins, and unauthorized login. Further, it may be determined whether or not it is further illegal according to at least one of the distances between the plurality of terminals.

[Effect of Example 2]
As described above, in the second embodiment, when the fraud detection device 1 determines that logins from a plurality of terminals are illegal, the fraud detection apparatus 1 further includes terminal information, unauthorized login duration, and unauthorized logins. A region to be invisible or difficult to view is determined according to at least one of the number of times and the distance between terminals that have performed unauthorized login. According to such a configuration, the fraud detection device 1 can further raise awareness of unauthorized use of licenses to a plurality of terminals determined to be fraudulent using the past history information 31. .

  Further, in the second embodiment, when the fraud detection device 1 determines that logins from a plurality of terminals are illegal, the fraud detection apparatus 1 further includes terminal information, the duration of illegal login, the number of illegal logins, and fraud. The difficulty of visual recognition is determined according to at least one of the distances between the terminals that have logged in. According to this configuration, the fraud detection device 1 can further raise awareness of unauthorized use of the license by determining the difficulty of visual recognition using the past history information 31.

[Others]
Note that the components of the illustrated apparatus do not necessarily have to be physically configured as illustrated. In other words, the specific mode of device distribution / integration is not limited to that shown in the figure, and all or part of the device is functionally or physically distributed / integrated in an arbitrary unit according to various loads or usage conditions. Can be configured. For example, the determination unit 13A uses the first determination unit for determining whether or not the login from a plurality of terminals logged in with the same account ID is unauthorized, and whether or not it is further unauthorized using the past history information 31. You may isolate | separate into the 2nd determination part to determine. Further, the receiving unit 11A and the identification 12A may be integrated. Further, the storage unit 20 may be connected as an external device of the fraud detection device 1 via a network.

  The various processes described in the above embodiments can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. Therefore, in the following, an example of a computer that executes a fraud detection program that realizes the same function as the fraud detection device 1 illustrated in FIG. 1 will be described. FIG. 10 is a diagram illustrating an example of a computer that executes a fraud detection program.

  As illustrated in FIG. 10, the computer 200 includes a CPU 203 that executes various arithmetic processes, an input device 215 that receives input of data from the user, and a display control unit 207 that controls the display device 209. The computer 200 also includes a drive device 213 that reads a program and the like from a storage medium, and a communication control unit 217 that exchanges data with other computers via a network. The computer 200 includes a memory 201 that temporarily stores various types of information and an HDD 205. The memory 201, CPU 203, HDD (Hard Disk Drive) 205, display control unit 207, drive device 213, input device 215, and communication control unit 217 are connected by a bus 219.

  The drive device 213 is a device for the removable disk 211, for example.

  The CPU 203 reads the fraud detection program 205a, expands it in the memory 201, and executes it as a process. Such a process corresponds to each functional unit of the fraud detection device 1. The fraud detection processing related information 205 b corresponds to the reception unit 11, the identification unit 12, the determination unit 13, and the output unit 14 in the fraud detection device 1. For example, the removable disk 211 stores each piece of information such as the fraud detection program 205a.

  The fraud detection program 205a does not necessarily have to be stored in the HDD 205 from the beginning. For example, the program is stored in a “portable physical medium” such as a flexible disk (FD), a CD-ROM, a DVD disk, a magneto-optical disk, or an IC card inserted into the computer 200. Then, the computer 200 may read and execute the fraud detection program 205a from these.

DESCRIPTION OF SYMBOLS 1 Fraud detection apparatus 10 Control part 11, 11A Reception part 12, 12A Identification part 13, 13A Determination part 14, 14A Output part 20 Storage part 21 Login information 31 Past history information

Claims (6)

On the computer,
When login from the same account is detected from a plurality of terminals, the position information of the plurality of terminals is acquired to identify the positions of the plurality of terminals,
Calculate the distance between each of the plurality of terminals based on the identified position of each of the plurality of terminals,
A fraud detection program that executes a process of determining that logins from the plurality of terminals are fraudulent when the calculated distance is equal to or greater than a predetermined value. When it is determined that logins from the plurality of terminals are unauthorized, executing a process of making a part or all of the screens output to the plurality of terminals after the login unrecognizable or difficult to view. The fraud detection program according to claim 1. Further, an area that is invisible or difficult to view according to at least one of the terminal information, the duration of unauthorized login, the number of unauthorized logins, and the distance between terminals that performed unauthorized login The fraud detection program according to claim 2, wherein the fraud detection program is executed. Furthermore, the process for determining the difficulty of visual recognition is executed according to at least one of the terminal information, the duration of unauthorized login, the number of unauthorized logins, and the distance between terminals performing unauthorized login. The fraud detection program according to claim 2, wherein: Computer
When login from the same account is detected from a plurality of terminals, the position information of the plurality of terminals is acquired to identify the positions of the plurality of terminals,
Calculate the distance between each of the plurality of terminals based on the identified position of each of the plurality of terminals,
When the calculated distance is equal to or greater than a predetermined value, it is determined that logins from the plurality of terminals are illegal.
A fraud detection method characterized by executing processing. When detecting login by the same account from a plurality of terminals, a specifying unit that acquires position information of the plurality of terminals and specifies the position of each of the plurality of terminals;
A calculation unit for calculating a distance between each of the plurality of terminals based on the identified positions of the plurality of terminals;
A determination unit that determines that logins from the plurality of terminals are illegal when the calculated distance is equal to or greater than a predetermined value;
A fraud detection device characterized by comprising:

Images