JP2018128910A - Access monitoring system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an access monitoring system for monitoring accesses to shared resources in a network.SOLUTION: An abnormal access determination processing section 33 is provided to determine whether there is an abnormal access to a shared resource on the basis of detection history information indicating that the shared resource has been accessed. An operation log information processing unit 34 is provided to generate, when it is determined that there is the abnormal access, operation log information including information indicating the determined abnormal access. An operation log information determination processing unit 23 is provided to determine whether an abnormal access to the shared resource has been performed on the basis of the operation log information. A notification processing unit 24 is provided to perform a predetermined notification when the operation log information determination processing unit 23 determines that the abnormal access has been performed.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an access monitoring system that monitors access to a shared resource in a network.

  A plurality of computers are used in the business of various organizations such as companies, schools, and public offices (hereinafter referred to as “businesses”), and they are connected by a network. And since a wide variety of information is stored in the computer, if an abnormality such as a failure occurs on a computer in the network, the business will be hindered, and in the case of outflow of information, compliance will occur. Problems can also arise. For this reason, companies and the like monitor daily whether there is an abnormality in the network.

  In particular, in companies, etc., because it is necessary to perform common work among multiple persons in charge, files and folders used for common work, or servers such as file servers and database servers are set to be accessible from multiple computers. Has been. Here, a file (shared file) or folder (shared folder) accessible from a plurality of computers is called a shared resource, and a server storing the shared resource is called a shared server. An example of a system for sharing shared resources is shown in Patent Document 1 below.

  Shared resources are highly important because they are used by multiple people in charge. Therefore, as shown in Patent Document 2 below, the access authority is strictly managed.

JP 2013-235339 A JP 2007-94493 A

  In recent years, a method using ransomware is known as a cyber attack method. Ransomware is to return an infected computer to its original state after locking the computer or encrypting a file against the operator's will. A type of malicious program that unreasonably demands money in exchange. In many cases, when a malicious attachment included in an e-mail is opened, the malicious program is installed, or a legitimate website that has been tampered with is directed to a malicious website that attacks the vulnerability. Infect the computer with ransomware.

  When a computer is infected with ransomware, operations on the computer become impossible, and the infected computer and files shared on the network are encrypted and become unusable. In addition, economic damage will occur if money is requested.

  On the other hand, when a computer infected with ransomware is on the network, it is necessary to disconnect the infected computer from the network as soon as possible to prevent infection of other computers.

  In particular, if shared resources in the network become unavailable due to ransomware, there is a possibility that business operations will stop extensively, and the impact will be greater than if a single computer is infected. .

  Therefore, anti-virus software is used to prevent infection of ransomware, but anti-virus software performs only the entrance measure of detecting ransomware and cannot be detected by anti-virus software. However, there are few effective measures at present.

  This is because it is not easy to determine whether access to a shared resource is normal access or abnormal access.

  The present inventor has invented an access monitoring system in view of the above problems.

  A first invention is an access monitoring system for monitoring access to a shared resource in a network, and the access monitoring system is based on detection history information indicating that the shared resource has been accessed, An abnormal access determination processing unit that determines whether there is an abnormal access to the shared resource, and an operation log that generates operation log information including information indicating that there was an abnormal access when it is determined that there is an abnormal access Abnormal access has been performed in the information processing unit, the operation log information determination processing unit that determines whether an abnormal access to the shared resource has been performed based on the operation log information, and the operation log information determination processing unit The access monitoring system includes a notification processing unit that performs predetermined notification.

  In the present invention, it is possible to determine whether or not the access is normal by determining whether or not there is an abnormal access to the shared resource using the detection history information. As a result, even if the entrance countermeasures by the anti-virus software are broken, it is possible to quickly take effective measures against the ransomware.

  In the above-described invention, the access monitoring system detects the detection information including UNC by adding a shared resource access determination processing unit that determines that there is access to the shared resource, and adding date and time information to the detection information. It can be configured as an access monitoring system including a detection history information generation processing unit stored in the detection history information storage unit as history information.

  Whether or not there has been an access to the shared resource can be determined by various methods, but by using the UNC as in the present invention, it can be determined simply and reliably.

  In the above-mentioned invention, the determination of abnormal access may be any one or more of the number of accesses to the shared resource, the amount of data of the accessed shared resource, the access time, the number of accessed shared resources, and the number of accessed shared servers. It can be configured like an access monitoring system that uses and determines.

  It is preferable to consider factors such as those of the present invention in determining whether there is an abnormal access.

  The first invention can be realized by reading the program of the present invention into a computer and executing it. That is, the abnormal access determination processing unit that determines whether there is an abnormal access to the shared resource based on the detection history information indicating that the computer has accessed the shared resource, and determines that there is the abnormal access An operation log information processing unit that generates operation log information including information indicating that there has been an abnormal access, and an operation log that determines whether an abnormal access to the shared resource has been performed based on the operation log information When the information determination processing unit and the operation log information determination processing unit determine that an abnormal access has been performed, it can be configured as an access monitoring program that functions as a notification processing unit that performs predetermined notification.

  The access monitoring system of the present invention can determine whether or not the access to the shared resource is an abnormal access. Therefore, it is possible to take quick measures against the spread of damage caused by ransomware executing illegal processing on shared resources.

It is an example of the image figure of the access monitoring system of this invention. It is a conceptual diagram which shows typically an example of a structure of the access monitoring system of this invention. It is a conceptual diagram which shows typically an example of a structure of the hardware of a computer. It is a flowchart which shows an example of the processing process of the access monitoring system of this invention. It is a figure which shows typically an example of the access count to a shared resource. It is a figure which shows typically an example in the case of performing abnormal access determination processing based on unit time and the number of accesses to a shared resource.

  An example of an image diagram of the access monitoring system 1 of the present invention is shown in FIG. 1, and a conceptual diagram showing an example of the configuration of the access monitoring system 1 is shown in FIG.

  The access monitoring system 1 is a computer system for monitoring a network of a company or the like and a computer in the network, and includes a master server 2, a client terminal 3, a management terminal 4, shared resources, and the like.

  The master server 2, the client terminal 3, and the management terminal 4 of the access monitoring system 1 are realized by various computers such as a server and a personal computer. FIG. 3 shows an example of the hardware configuration of the computer. The computer includes an arithmetic device 70 such as a CPU for executing arithmetic processing of a program, a storage device 71 such as a RAM and a hard disk for storing information, a display device 72 such as a display, a keyboard and a pointing device (such as a mouse and a numeric keypad). And a communication device 74 that transmits and receives processing results of the arithmetic device 70 and information stored in the storage device 71 via a network such as the Internet or a LAN.

  1 and 2 show the case where the master server 2 is realized by a single computer, the functions may be distributed and realized in a plurality of computers.

  Each means in the present invention is only logically distinguished in function, and may be physically or virtually the same area.

  In a company network, there are a master server 2, a management terminal 4, a client terminal 3, a shared server 5, and the like.

  The management terminal 4 is a computer operated by an administrator who manages the network, controls the master server 2 via the management terminal 4, and receives various notifications from the master server 2.

  The shared server 5 is a server that stores and manages shared resources such as various files, folders, and data accessed by a plurality of users. Examples of the shared server 5 include a file server and a database server.

  The client terminal 3 is a computer operated by a general user in a company or the like. The client terminal 3 accesses a shared resource in the shared server 5 as necessary, and performs operations such as browsing various files. Further, operation log information indicating an operation at the client terminal 3 is generated in the client terminal 3 and sent to the master server 2 regularly or irregularly.

  The client terminal 3 is provided with an agent program, and the agent program has functions of a detection history information processing unit 31, an abnormal access determination processing unit 33, and an operation log information processing unit 34. The client terminal 3 includes a detection history information storage unit 32 for the agent program to execute processing.

  The detection history information processing unit 31 includes a shared resource access determination processing unit 311 and a detection history information acquisition processing unit, and acquires information indicating that a shared resource has been accessed in the shared server 5 as detection history information. To do.

  The shared resource access determination processing unit 311 refers to information on the file system (this is referred to as detection information) output by the OS (Operating System) of the client terminal 3 and uses UNC (Universal Naming Convention: “\\”, “ It is determined whether there is detection information including a file path that starts with “/”, and detection information including UNC is determined to have access to the shared resource, and the detection information is acquired. The detection information is information indicating the history of operations in the client terminal 3, and is information that can be used to determine whether the driver has been started or a folder has been accessed by the started driver. Information such as application name is included.

  The detection history information generation processing unit 312 adds date / time information to the detection information acquired by the shared resource access determination processing unit 311 to generate detection history information, and stores it in the detection history information storage unit 32 described later. The detection history information is information in which date / time information is added to the detection information.

  The detection history information storage unit 32 stores the detection history information generated by the detection history information generation processing unit 312 in the detection history information processing unit 31. The detection history information storage unit 32 preferably stores the detection history information in time series based on the date / time information.

  The abnormal access determination processing unit 33 determines whether there is an abnormal access to the shared resource based on the detection history information stored in the detection history information storage unit 32. As a method for determining whether there is an abnormal access, for example, it can be determined based on whether or not a predetermined condition is satisfied based on detection history information within a certain period.

  As a predetermined condition, whether the operation content is file open, and the number of detection history information whose access destination is a shared resource within a certain period is equal to or greater than a predetermined threshold (file open number), or the operation content is file save (Or write) and the access destination is a shared resource The number of detection history information within a certain period is equal to or greater than a predetermined threshold (number of saved files), the operation is a file open, and the access destination If the total amount of data of a shared resource that is a shared resource within a certain period is equal to or greater than a predetermined threshold (the total amount of data of opened files), the operation content is file save (or write), Whether the total amount of data in the shared resource for which the access destination is a shared resource within a certain period is equal to or greater than a predetermined threshold (the total amount of data in the saved file ), The operation content is the file deletion, the access destination, and the like or the number of a certain period of detection history information is a shared resource is equal to or greater than a predetermined threshold (erase cycles of the shared resource).

  Furthermore, as another condition, when the amount of change in the total number of shared resource accesses (opens) and the number of bytes of shared resources accessed increases rapidly, it may be determined as abnormal. For example, assume that the unit time is 10 minutes, the resolution is 1 minute, and the upper limit of the number of accesses is 200, and the number of accesses to the shared resource is as shown in FIG. FIG. 5A is a table of the number of accesses for each resolution, and FIG. 5B is a graph of the number of accesses for each resolution.

  Then, the abnormal access determination processing unit 33 sums up the number of accesses per unit time for each resolution, and determines whether the access is abnormal depending on whether the relationship between the number of accesses and the threshold satisfies a predetermined condition. That is, first, the number of accesses is summed with 0 to 9 minutes as a unit time, and the number of accesses is summed as 1 to 10 minutes as the next unit time. This is repeated until the final resolution is reached. Then, the number of accesses is compared with the threshold every unit time, and it is determined whether a predetermined condition is satisfied, for example, the number of accesses exceeds the threshold or the number of accesses falls below the threshold. This determination process is shown in FIG. FIG. 6A is a table showing the number of accesses per unit time, and FIG. 6B is a graph showing the number of accesses per unit time. Note that, as shown in FIG. 6, the determination may be made by distinguishing the occurrence of abnormal access and the end of abnormal access.

  When the abnormal access determination processing unit 33 determines that there is an abnormal access, the operation log information processing unit 34 generates information indicating an operation history such as operation log information indicating that there is an abnormal access. Send to server 2. In the following description, a case where operation log information is used as information indicating the operation history will be described, but the present invention is not limited to operation log information.

  The operation log information processing unit 34 stores the operation log information based on the detection history information not only when the operation log information is determined to be abnormal access by the abnormal access determination processing unit 33 but also when a normal operation is performed. The operation log information is sent to the master server 2 regularly or irregularly. When the operation log information is generated indicating that there is an abnormal access, it is preferable to immediately send the operation log information to the master server 2 separately from the timing of sending the normal operation log information. , But not limited to it. The operation log information is information including “information indicating abnormal access” as the operation content in addition to the operation content in the detection history information. That is, the detection history information and the operation log information differ depending on whether or not information indicating abnormal access is included. As the operation log information, detection history information other than when abnormal access is determined as described above may be used as it is.

  In addition, when the operation log information processing unit 34 generates operation log information, the abnormal access determination processing unit 33 determines that abnormal access has occurred and abnormal access has ended as shown in FIG. In such a case, operation log information in which abnormal access is distinguished from “execution of abnormal access” and “end of abnormal access” as an operation content may be generated and sent to the master server 2.

  Note that information indicating an operation history such as operation log information generated by the operation log information processing unit 34 may be stored in a predetermined storage device 71 of the client terminal 3.

  The master server 2 manages and monitors the entire network, and includes an operation log information acquisition processing unit 21, an operation log information storage unit 22, an operation log information determination processing unit 23, and a notification processing unit 24.

  The operation log information acquisition processing unit 21 acquires information indicating an operation history such as operation log information transmitted from the client terminal 3 and stores the information in an operation log information storage unit 22 described later.

  The operation log information storage unit 22 stores information indicating an operation history such as the operation log information acquired by the operation log information acquisition processing unit 21.

  The operation log information determination processing unit 23 determines whether there is operation history information including “information indicating abnormal access” among the information indicating the operation history such as the operation log information acquired by the operation log information acquisition processing unit 21. Determine. For example, when information indicating “execution of abnormal access” is included as the operation content in the operation log information, it is determined as operation log information including “information indicating abnormal access”.

  If the operation log information determination processing unit 23 determines that the operation history information indicating abnormal access execution is included, the notification processing unit 24 sends the management terminal 4 operated by the administrator or a predetermined notification destination of the administrator. An alert notification indicating that there was an abnormal access is sent. In this case, for example, a notification may be sent directly to the management terminal 4 as in the case of a messaging service, or it may be configured to send by e-mail or the like based on a pre-registered administrator's e-mail address. Good.

  Furthermore, as shown in FIG. 6, when operation log information that distinguishes “abnormal access execution”, “abnormal access end” and abnormal access is acquired as the operation content from the client terminal 3, an abnormal access occurs. The notification that distinguishes the end of abnormal access may be sent to the management terminal 4 operated by the administrator or a predetermined notification destination of the administrator at each timing.

  Next, an example of the processing process of the access monitoring system 1 of the present invention will be described with reference to the flowchart of FIG.

  When any operation or process is executed on the client terminal 3, the OS of the client terminal 3 outputs detection information. Then, the shared resource access determination processing unit 311 refers to detection information output from the OS of the client terminal 3 and determines whether there is detection information including UNC. If it is determined that there is detection information including UNC, it is determined that there is access to the shared resource, and the detection information is acquired.

  Then, the detection history information generation processing unit 312 generates detection history information by adding date / time information to the detection information determined by the shared resource access determination processing unit 311 to have access to the shared resource, and stores the detection history information. The data is stored in the unit 32 (S100).

  Based on the detection history information stored in the detection history information storage unit 32, the abnormal access determination processing unit 33 determines whether there is an abnormal access (S110).

  When the abnormal access determination processing unit 33 determines that there is an abnormal access, the operation log information processing unit 34 displays operation log information indicating that there is an abnormal access, for example, “abnormal access execution”, “abnormal access end” In addition to this, operation log information including date / time information, information based on detection history information such as an access destination, identification information of the client terminal 3, and the like is generated (S120). Then, the operation log information processing unit 34 sends the generated operation log information to the master server 2 (S130).

  The operation log information sent from the operation log information processing unit 34 of the client terminal 3 is acquired by the operation log information acquisition processing unit 21 of the master server 2 (S140) and stored in the operation log information storage unit 22.

  Then, the operation log information determination processing unit 23 of the master server 2 determines whether the operation log information acquired by the operation log information acquisition processing unit 21 includes information indicating abnormal access (S150). For example, it is determined whether or not information such as “execution of abnormal access” and “abnormal access end” is included as operation contents of the operation log information.

  If it is determined that information indicating abnormal access is included, the notification processing unit 24 confirms that there is an abnormal access to the management terminal 4 operated by the administrator or a predetermined notification destination of the administrator. An alert notification is sent (S160). At this time, the date and time when the abnormal access occurred based on the date and time information, the information indicating the access destination, the identification information of the client terminal 3 of the operation log information including information indicating that there is an abnormal access. It is also preferable to notify the information of the access destination, the client terminal 3 that has made an abnormal access, and the like.

  By executing the processing as described above, it is possible to determine whether or not the access to the shared resource is an abnormal access, and if there is an abnormal access, the administrator can be notified immediately. It becomes.

  In addition to notifying the administrator, a control instruction for blocking the network communication may be sent to the client terminal 3 by UDP communication. In this case, when the client terminal 3 receives the control instruction from the master server 2, it returns a response indicating that the control instruction for blocking the network communication has been received, and blocks communication other than the network communication with the master server 2. Execute control to

  Whether or not the access is abnormal is preferably executed in the agent program of the client terminal 3. This is because if the detection history information is transmitted to the master server 2 at any time, the communication fee is increased, and if the master server 2 performs the process of determining whether there is an abnormal access, the load on the master server 2 increases. On the other hand, it is possible to adopt a configuration in which detection history information is sent to the master server 2 and the master server 2 determines whether the access is abnormal.

  As a method for determining abnormal access in the abnormal access determination processing unit 33, in addition to the above, continuous access to a shared resource for a long time may be determined based on date and time information included in detection history information. In this case, for example, the time and the number of times are determined based on the detection history information of the date / time information when a certain file is opened and the detection history information of the date / time information when the same file is closed. It is determined whether or not there is an abnormal access depending on whether the threshold is exceeded.

  As another method, the shared resource name may be extracted from the file path included in the detection history information, and the variety of types of the accessed shared resource may be determined. In this case, the shared resource name is extracted from the file path included in the detection history information, and it is determined whether or not there is an abnormal access depending on whether the number of shared resources accessed exceeds a predetermined threshold in a predetermined unit time. .

  As another method, the server name (shared server 5 names) may be extracted from the file path included in the detection history information, and the diversity of the shared servers 5 storing the accessed shared resources may be determined. In this case, the name of the shared server 5 is extracted from the file path included in the detection history information, and whether or not there is an abnormal access depending on whether the number of the shared servers 5 being accessed exceeds a predetermined threshold in a predetermined unit time. judge.

  In addition, although the number of shared resources that have been opened (file read) as the operation content included in the detection history information exceeds the first threshold for a predetermined unit time, the file is stored as the operation content included in the detection history information When the number of shared resources (file writing) does not exceed the second threshold, it is determined that there is an abnormality. Note that the first threshold value> the second threshold value. In this case, since it is assumed that data is collected by accessing many shared resources and the data is written in the folder for illegal take-out, it can be determined that the access is abnormal.

  Since the detection history information includes the name of the application accessing the shared resource, the abnormal access determination processing unit 33 may include the name of the application in the operation log information. Then, by sending operation log information including the application name, the operation log information determination processing unit 23 of the master server 2 can identify the application that is executing the abnormal access, and when the notification processing unit 24 performs notification, The name of the application executing the access may be notified.

  The abnormal access determination processing unit 33 extracts the shared resource name from the file path included in the detection history information, and determines the number of shared resources accessed in a predetermined unit time. Also, the name of the application accessing the shared history information included in the detection history information is extracted, and the number of applications is determined. And, if the ratio of the number of shared resources accessed and the number of applications that executed access in a unit time satisfies the predetermined condition, for example, the number of shared resources is large but the number of applications is small. In such a case, it is determined that there is a high possibility that an unauthorized application is illegally accessing the shared resource, and it is determined that the access is abnormal.

  As another determination method, the number of accesses is counted for each application instructing access to the shared resource. If a specific application protrudes and the number of accesses is large, it can be determined that the application is an unauthorized application. Is determined as an abnormal access.

  In the client terminal 3, the screen displayed on the display device 72 when generating the detection history information may be acquired as image information and may be associated with the detection history information. In this case, when the abnormal access determination processing unit 33 determines that there is an abnormal access, the image information of the screen corresponding to the detection history information is sent to the operation log information generated based on the detection history information. The notification processing unit 24 of the master server 2 that has received the message can notify the administrator or the management terminal 4 of the screen when the abnormal access is determined as image information.

  As a modification of the first to fourth embodiments, when it is determined that there is an abnormal access because the operation log information of the client terminal 3 includes an operation content indicating abnormal access execution, the operation log information determination processing unit 23 However, when it is determined that there is an abnormal access in the plurality of client terminals 3, the weight of the alert notification notified by the notification processing unit 24 may be changed.

  Further, the operation log information determination processing unit 23 may be configured to change the weight of the alert notification notified by the notification processing unit 24 according to the number and frequency of operation log information that is determined to have been abnormally accessed. .

  Changing the weight of the alert notification increases the importance of the alert notification as the number of client terminals 3 that have determined that there has been an abnormal access in the operation log information determination processing unit 23 increases. This is because the risk level increases as the number of client terminals 3 having an abnormal access increases.

  The process of changing the weight includes increasing the number and frequency of alert notifications according to the importance, displaying the size of characters to be notified, and the importance in the notification itself. There is also a method of changing the notification method according to the importance, for example, only mail, only message, both mail and message, all mail, message and telephone. Furthermore, the notification range may be changed according to the importance. For example, the notification destination may be increased as the importance increases, such as only the person, the person and the administrator, the information security officer, the supervisor, and a member in the department.

  With the access monitoring system 1 of the present invention, it can be determined whether or not the access to the shared resource is an abnormal access. Therefore, it is possible to take quick measures against the spread of damage caused by ransomware executing illegal processing on shared resources.

1: Access monitoring system 2: Master server 3: Client terminal 4: Management terminal 5: Shared server 21: Operation log information acquisition processing unit 22: Operation log information storage unit 23: Operation log information determination processing unit 24: Notification processing unit 31 : Detection history information processing unit 32: detection history information storage unit 33: abnormal access determination processing unit 34: operation log information processing unit 311: shared resource access determination processing unit 312: detection history information generation processing unit 70: computing device 71: storage Device 72: Display device 73: Input device 74: Communication device

Claims (4)

An access monitoring system for monitoring access to shared resources in a network,
The access monitoring system includes:
An abnormal access determination processing unit that determines whether there is an abnormal access to the shared resource based on detection history information indicating that the shared resource has been accessed;
An operation log information processing unit that generates operation log information including information indicating that there was an abnormal access when it is determined that there is an abnormal access;
An operation log information determination processing unit that determines whether an abnormal access to the shared resource has been performed based on the operation log information;
A notification processing unit for performing a predetermined notification when it is determined in the operation log information determination processing unit that an abnormal access has been performed;
An access monitoring system comprising: The access monitoring system includes:
A shared resource access determination processing unit that determines that the detection information including the UNC is accessed to the shared resource;
A detection history information generation processing unit that attaches date and time information to the detection information and stores the detection history information in the detection history information storage unit;
The access monitoring system according to claim 1, further comprising: The determination of abnormal access is as follows:
Using one or more of the number of accesses to the shared resource, the amount of data of the accessed shared resource, the access time, the number of accessed shared resources, and the number of accessed shared servers,
The access monitoring system according to claim 1 or claim 2, wherein Computer
An abnormal access determination processing unit for determining whether there is an abnormal access to the shared resource based on detection history information indicating that the shared resource has been accessed;
An operation log information processing unit that generates operation log information including information indicating that there was an abnormal access when it is determined that there is an abnormal access;
An operation log information determination processing unit that determines whether an abnormal access to the shared resource has been performed based on the operation log information;
A notification processing unit for performing a predetermined notification when it is determined in the operation log information determination processing unit that an abnormal access has been performed;
An access monitoring program characterized by functioning as

Images