JP2018136610A - File monitoring device and file monitoring program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable acquisition of a content of a file at a time when operation was carried out.SOLUTION: A file monitoring device 200 receives a packet relayed through a switch 130 connected to a first network 101 having a file server 110 from the switch 130. The file monitoring device 200 determines whether the received packet is a file sharing packet communicated according to a file sharing protocol. Then, the file monitoring device 200 restores a management file managed by the file server 110 using one or more file sharing packets.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a technique for monitoring a file managed by a file server.

File servers are often placed on a network, and files are exchanged between file servers and clients.
Conventionally, information such as names of exchanged files and operations on exchanged files has been acquired from packets flowing through the network.

  Patent Document 1 discloses a technique for analyzing a packet transmitted from a client device to an external server device.

Japanese Patent No. 6023738

Files stored in the file server can be easily referenced from the client. When necessary authority is set for the file, only a person having necessary authority can refer to the file.
Conventionally, it has been possible to acquire information such as a file name and an operation, but it has not been possible to acquire the contents of a file when the operation is performed.
For this reason, it was impossible to know what kind of file the operation was performed on. In other words, if the contents of the file stored in the file server are changed, it is impossible to know the contents of the file when the operation is performed. Therefore, the contents of the file when the operation was performed could not be inspected.

  An object of the present invention is to make it possible to acquire the contents of a file when an operation is performed.

The file monitoring apparatus of the present invention
A communication unit that receives a packet relayed by the switch from a switch that is a device connected to a network having a file server;
An analysis unit that determines whether the received packet is a file sharing packet communicated according to a file sharing protocol;
A restoration unit that restores the management file managed by the file server using one or more file sharing packets.

The file monitoring device
An inspection unit is provided that extracts text from the restored management file and extracts monitoring information from the extracted text.

  The inspection unit determines whether the extracted monitoring information satisfies the alert condition, and notifies the alert when the extracted monitoring information satisfies the alert condition.

  The file monitoring apparatus includes a storage unit that stores the restored management file in association with the file name, the access time, and the extracted monitoring information.

The file monitoring device
A reception unit for receiving a specified file name and a specified period;
A search unit for finding a management file associated with the same file name as the designated file name and associated with an access time corresponding to the designated period from the storage unit;
And an output unit for outputting a list of found management files.

The file monitoring apparatus includes a storage unit that stores the restored management file.
The analysis unit obtains a user name from one of the file sharing packets.
The storage unit stores the restored management file in association with a file name and the user name.

The file monitoring device
A reception unit that accepts a specified file name;
A search unit for finding a user name associated with the same file name as the specified file name from the storage unit;
And an output unit for outputting the found user name.

The file monitoring device
A reception unit that accepts a specified user name;
A search unit for finding a file name associated with the same user name as the designated user name from the storage unit;
An output unit for outputting the found file name.

The file monitoring program of the present invention
A communication unit that receives a packet relayed by the switch from a switch that is a device connected to a network having a file server;
An analysis unit that determines whether the received packet is a file sharing packet communicated according to a file sharing protocol;
The computer is caused to function as a restoration unit that restores the management file managed by the file server using one or more file sharing packets.

The file monitoring apparatus of the present invention
An analysis unit that determines whether the packet stored in the storage device is a file sharing packet communicated according to a file sharing protocol;
A restoration unit that restores the management file managed by the file server using one or more file sharing packets.

The file monitoring program of the present invention
An analysis unit that determines whether the packet stored in the storage device is a file sharing packet communicated according to a file sharing protocol;
The computer is caused to function as a restoration unit that restores the management file managed by the file server using one or more file sharing packets.

  According to the present invention, since the file is restored using one or more relayed packets, it is possible to acquire the contents of the file when the operation is performed.

1 is a configuration diagram of a file monitoring system 100 according to Embodiment 1. FIG. 1 is a configuration diagram of a file monitoring apparatus 200 according to Embodiment 1. FIG. 5 is a flowchart of a file monitoring method according to the first embodiment. 6 is a flowchart of alert processing (S160) in the first embodiment. 5 is a flowchart of management information search (S170) in the first embodiment.

  In the embodiments and the drawings, the same reference numerals are assigned to the same elements and corresponding elements. Description of elements having the same reference numerals will be omitted or simplified as appropriate. The arrows in the figure mainly indicate the flow of data or the flow of processing.

Embodiment 1 FIG.
A mode of monitoring a file managed by a file server will be described with reference to FIGS.

*** Explanation of configuration ***
The configuration of the file monitoring system 100 will be described with reference to FIG.
The file monitoring system 100 includes a file server 110, a plurality of client terminals 120, a switch 130, and a file monitoring device 200.

The file server 110 is a server that manages files. The server is a computer. A file managed by the file server 110 is called a management file.
The management file is a generic name for a shared file and a personal file.
A shared file is a file shared by a plurality of users.
The personal file is a file that can be operated only by a specific individual.

The file server 110 is connected to the first network 101.
The first network 101 is a network having a file server 110.
Specifically, the first network 101 is the Internet or an intranet. In other words, the first network 101 is a WAN (Wide Area Network) or a LAN (Local Area Network).

The plurality of client terminals 120 are computers operated by a plurality of users.
The user accesses the management file by operating the client terminal 120. Specifically, the user uploads the management file, references the management file, updates the management file, or downloads the management file.

Each client terminal 120 is connected to the second network 102.
The second network 102 is a network having a plurality of client terminals 120.
Specifically, the second network 102 is the Internet or an intranet. In other words, the second network 102 is a WAN or a LAN.

A management file is communicated between the file server 110 and the client terminal 120 according to a file sharing protocol.
A specific file sharing protocol is SMB (Server Message Block) or CIFS (Common Internet System).

The switch 130 is a network device that relays packets between networks.
Specifically, the switch 130 relays a packet communicated between the first network 101 and the second network 102.
For example, the switch 130 relays a file sharing packet communicated between the client terminal 120 and the file server 110.
A file sharing packet is a packet communicated according to a file sharing protocol.

The switch 130 has a mirror port 131 and performs port mirroring.
That is, the switch 130 outputs the relayed packet from the mirror port 131.

  The file monitoring apparatus 200 is connected to the mirror port 131, captures a packet relayed through the switch 130, and monitors a management file.

The configuration of the file monitoring apparatus 200 will be described based on FIG.
The file monitoring apparatus 200 is a computer including hardware such as a processor 901, a memory 902, an auxiliary storage device 903, a communication device 904, and an input / output interface 905. These hardwares are connected to each other via signal lines.

The processor 901 is an IC (Integrated Circuit) that performs arithmetic processing, and controls other hardware. For example, the processor 901 is a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or a GPU (Graphics Processing Unit).
The memory 902 is a volatile storage device. The memory 902 is also called main memory or main memory. For example, the memory 902 is a RAM (Random Access Memory). Data stored in the memory 902 is stored in the auxiliary storage device 903 as necessary.
The auxiliary storage device 903 is a nonvolatile storage device. For example, the auxiliary storage device 903 is a ROM (Read Only Memory), a HDD (Hard Disk Drive), or a flash memory. Data stored in the auxiliary storage device 903 is loaded into the memory 902 as necessary.

The communication device 904 is a device that performs communication, that is, a receiver and a transmitter. For example, the communication device 904 may be a communication chip or a NIC (Network Interface).
Card).
The input / output interface 905 is a port to which an input device and an output device are connected. For example, the input / output interface 905 is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display. USB is an abbreviation for Universal Serial Bus.

  The file monitoring apparatus 200 includes software elements such as an analysis unit 210, a restoration unit 220, an inspection unit 230, and a search unit 240. A software element is an element realized by software.

The auxiliary storage device 903 stores a file monitoring program for causing the computer to function as the analysis unit 210, the restoration unit 220, the inspection unit 230, and the search unit 240. The file monitoring program is loaded into the memory 902 and executed by the processor 901.
Further, the auxiliary storage device 903 stores an OS (Operating System). At least a part of the OS is loaded into the memory 902 and executed by the processor 901.
That is, the processor 901 executes the file monitoring program while executing the OS.
Data obtained by executing the file monitoring program is stored in a storage device such as the memory 902, the auxiliary storage device 903, a register in the processor 901, or a cache memory in the processor 901.

The auxiliary storage device 903 functions as a storage unit 291 that stores data. However, another storage device may function as the storage unit 291 instead of the auxiliary storage device 903 or together with the auxiliary storage device 903.
The communication device 904 functions as a communication unit 292 that communicates data.
The input / output interface 905 functions as a reception unit 293 that receives input, and also functions as an output unit 294 that outputs data.

  The file monitoring apparatus 200 may include a plurality of processors that replace the processor 901. The plurality of processors share the role of the processor 901.

  The file monitoring program can be stored in a computer-readable manner on a nonvolatile storage medium such as a magnetic disk, an optical disk, or a flash memory. A non-volatile storage medium is a tangible medium that is not temporary.

*** Explanation of operation ***
The operation of the file monitoring apparatus 200 corresponds to a file monitoring method. The procedure of the file monitoring method corresponds to the procedure of the file monitoring program.

The file monitoring method will be described with reference to FIG.
In step S <b> 110, when a packet is output from the mirror port 131 of the switch 130, the communication unit 292 receives the packet output from the mirror port 131 of the switch 130.

In step S120, the analysis unit 210 determines whether the received packet is a file sharing packet.
Specifically, the analysis unit 210 refers to a specific part in the received packet. Then, the analysis unit 210 determines whether the identifier of the file sharing packet is set at the specific location. When the identifier of the file sharing packet is set at a specific location, the received packet is a file sharing packet.

When the file sharing protocol is SMB, the analysis unit 210 performs determination as follows.
First, the analysis unit 210 extracts a transport layer payload from the received packet. The payload of the transport layer includes a data length field and SMB data.
Next, the analysis unit 210 extracts the first 4 bytes of the SMB data from the extracted payload.
Then, the analysis unit 210 determines whether an identifier “SMB” is set in the extracted 4 bytes.
When the identifier “SMB” is set in the extracted 4 bytes, the received packet is a file sharing packet.

If the received packet is a file sharing packet, the analysis unit 210 stores the received file in the storage unit 291 and the process proceeds to step S130.
If the received packet is not a file sharing packet, the analysis unit 210 discards the received packet, and the process proceeds to step S110.

  In the description from step S130 to step S160, the file sharing packet means a received packet.

In step S130, the analysis unit 210 acquires management information and file data from the file sharing packet. Specific management information includes session information, file name, file size, access time (operation time), access type (operation type), and user name. File data is part of the management file.
Then, the analysis unit 210 stores management information and file data in the storage unit 291 in association with each other for each session information.

When the file sharing protocol is SMB, the analysis unit 210 acquires session information as follows.
The analysis unit 210 extracts an Ethernet header from the file sharing packet, and acquires a transmission source MAC address and a destination MAC address from the Ethernet header. Ethernet is a registered trademark. MAC is an abbreviation for Media Access Control.
The analysis unit 210 extracts an IP header from the file sharing packet, and acquires a transmission source IP address and a destination IP address from the IP header. IP is an abbreviation for Internet Protocol.
The analysis unit 210 extracts a TCP header from the file sharing packet, and acquires a transmission source port number and a destination port number from the TCP header. TCP is an abbreviation for Transmission Control Protocol.
A set of a source MAC address, a destination MAC address, a source IP address, a destination IP address, a source port number, and a destination port number is session information.

When the file sharing protocol is SMB, the analysis unit 210 acquires the file name as follows.
First, the analysis unit 210 extracts SMB data from the file sharing packet.
Next, the analysis unit 210 determines whether the SMB data is file operation data. The file operation data is SMB data related to the file operation. Specifically, the file operation data is SMB data having a command field in which a file operation command number is set. For example, the file operation is read or write.
When the SMB data is file operation data, the analysis unit 210 acquires a file name from the data field in the SMB data.

When the file sharing protocol is SMB, the analysis unit 210 acquires the file size as follows.
First, the analysis unit 210 extracts SMB data from the file sharing packet.
Next, the analysis unit 210 determines whether the SMB data is the first file operation data.
When the SMB data is the first file operation data, the analysis unit 210 acquires the file size from the count field in the SMB data.

When the file sharing protocol is SMB, the analysis unit 210 acquires the access time (operation time) as follows. The access time means the date and time when the management file was accessed (operated).
First, the analysis unit 210 extracts SMB data from the file sharing packet.
Next, the analysis unit 210 determines whether the SMB data is the first file operation data.
When the SMB data is the first file operation data, the analysis unit 210 acquires the time when the file sharing packet is received. The acquired time is the access time.

When the file sharing protocol is SMB, the analysis unit 210 acquires the access type (operation type) as follows. The access type indicates the type of access (operation) to the management file.
First, the analysis unit 210 extracts SMB data from the file sharing packet.
Next, the analysis unit 210 determines whether the SMB data is the first file operation data.
When the SMB data is the first file operation data, the analysis unit 210 acquires a command number from the command field in the SMB data. The acquired command number is the access type.

When the file sharing protocol is SMB, the analysis unit 210 acquires the user name as follows.
First, the analysis unit 210 extracts SMB data from the file sharing packet.
Next, the analysis unit 210 determines whether the SMB data is login data. The login data is SMB data related to user login. Specifically, the login data is SMB data having a command field in which a session setup command number is set.
When the SMB data is login data, the analysis unit 210 acquires the user name from the data field in the SMB data.

When the file sharing protocol is SMB, the analysis unit 210 acquires file data as follows.
First, the analysis unit 210 extracts SMB data from the file sharing packet.
Next, the analysis unit 210 determines whether the SMB data is file operation data.
When the SMB data is file operation data, the analysis unit 210 acquires file data from the data field in the SMB data.

  By executing step S130 each time a file sharing packet is received, management information and one or more file data are stored in the storage unit 291 in association with each other for each session information.

In step S140, the restoration unit 220 determines whether the management file can be restored.
Specifically, the restoration unit 220 performs determination as follows.
First, the restoration unit 220 acquires the file size and one or more file data associated with the session information that matches the file sharing packet from the storage unit 291.
Next, the restoration unit 220 calculates the total size of one or more file data.
Then, the restoration unit 220 compares the calculated total size with the file size.
When the calculated total size matches the file size, the management file can be restored.
If the management file can be restored, the process proceeds to step S150.
If the management file cannot be restored, the process proceeds to step S110.

In step S150, the restoration unit 220 restores the management file, and stores the restored management file in the storage unit 291 in association with the corresponding management information. The corresponding management information is management information associated with session information that matches the management file.
Specifically, the restoration unit 220 acquires one or more file data associated with the session information matching the file sharing packet from the storage unit 291 and combines the acquired one or more file data. As a result, the management file is restored.

In step S160, the inspection unit 230 notifies an alert when the management file satisfies the alert condition.
After step S160, the process proceeds to step S110.

The alert process (S160) will be described with reference to FIG.
In step S161, the inspection unit 230 extracts text from the management file.
For example, when the management file is a PDF file, the inspection unit 230 extracts text included in the PDF file. The same applies even if the type of management file is an office file or another type of file.

In step S162, the inspection unit 230 extracts monitoring information from the text.
Specifically, the inspection unit 230 extracts a portion that matches the monitoring information pattern from the text. The extracted part is the monitoring information.
The monitoring information pattern is a pattern indicating the format of monitoring information. The monitoring information pattern is determined in advance.
The portion matching the monitoring information pattern is a portion described in the same format as the monitoring information pattern.
Specific monitoring information can be set arbitrarily. The main monitoring information is name, address, telephone number, credit card number, my number (personal number) and e-mail address. The monitoring information pattern can be arbitrarily defined.
The inspection unit 230 stores the extraction result in the storage unit 291 regardless of the presence or absence of the extracted monitoring information.

In step S163, the inspection unit 230 determines whether the extracted monitoring information satisfies the alert condition.
Specifically, the alert condition is defined by the type of monitoring information and the number of monitoring information. For example, alert conditions such as “10 or more monitoring information”, “5 or more names” or “3 or more names and 3 or more credit numbers or my numbers” are defined in advance. Alert conditions can be arbitrarily defined.
If the extracted monitoring information satisfies the alert condition, the process proceeds to step S164.
If the extracted monitoring information does not satisfy the alert condition, the alert process (S160) ends.

In step S164, the inspection unit 230 notifies an alert.
Specifically, the inspection unit 230 transmits an alert mail to the notification destination via the communication unit 292. The alert mail is an email in which an alert message is described. The alert message is a message notifying that an access (operation) has been made to a management file including text that satisfies the alert condition. The alert message can include a file name, access time, access type, user name, and the like.
The inspection unit 230 may notify the alert by a method different from the e-mail, such as display on a display or writing to a system log.

Based on FIG. 5, the management information search (S170) will be described. The management information search (S170) is a part of the file monitoring method.
In step S171, the reception unit 293 receives a search request for requesting a search.
Specifically, the requested search is a file content search, an access user search, an access file search, or an access period search.
The search request includes a search type identifier indicating the type of search.

In step S172, the search unit 240 determines the type of search requested based on the search request.
Specifically, the search unit 240 refers to the search type identifier included in the search request and determines the type of search identified by the search type identifier.
If the requested search is a file content search, the process proceeds to step S173.
If the requested search is an access user search, the process proceeds to step S174.
If the requested search is an access file search, the process proceeds to step S175.
If the requested search is an access period search, the process proceeds to step S176.

A search request for requesting a file content search includes a file name, a file content, and a period.
A file name included in the search request is referred to as a specified file name, and a period included in the search request is referred to as a specified period. The file contents included in the search request are called designated contents.

  In step S173, the search unit 240 searches the storage unit 291 according to the search request, and the output unit 294 outputs a list of specified files in the specified period. The management file identified by the specified file name is the specified file. When a designated file in the list is selected, the output unit 294 outputs the designated file.

Specifically, the search unit 240 operates as follows.
First, the search unit 240 extracts the specified file name, the specified content, and the specified period from the search request.
Then, the search unit 240 searches the storage unit 291 using the specified file name, the specified period, and the specified period as search keys.
As a result, a management file associated with the same file name as the designated file name (or associated with the same content as the designated content) and associated with the access time included in the designated period is found. The found management file is the specified file for the specified period.

  Specifically, the output unit 294 displays the designated file at the designated time on the display. However, the output unit 294 may display the designated file on the display of the client terminal 120 by transmitting the designated file to the client terminal 120 via the communication unit 292.

A search request for requesting an access user search includes a file name.
The file name included in the search request is called a specified file name.

In step S174, the search unit 240 searches the storage unit 291 according to the search request, and the output unit 294 outputs a list of users who have accessed the specified file. The management file identified by the specified file name is the specified file.
A list of users who have accessed the specified file is called an access user list.

Specifically, the search unit 240 operates as follows.
First, the search unit 240 extracts a specified file name from the search request.
Then, the search unit 240 searches the storage unit 291 using the specified file name as a search key.
Thereby, one or more user names associated with the same file name as the designated file name are found. One or more user names found are access user lists.

  Specifically, the output unit 294 displays the access user list on the display. However, the output unit 294 may display the access user list on the display of the client terminal 120 by transmitting the access user list to the client terminal 120 via the communication unit 292.

The search request for requesting access file search includes the user name.
The user name included in the search request is called a specified user name.

In step S175, the search unit 240 searches the storage unit 291 according to the search request, and the output unit 294 outputs a list of files accessed by the designated user. The user identified by the designated user name is the designated user.
A list of files accessed by the specified user is called an access file list.

Specifically, the search unit 240 operates as follows.
First, the search unit 240 extracts the designated user name from the search request.
Then, the search unit 240 searches the storage unit 291 using the designated user name as a search key.
As a result, one or more file names associated with the same user name as the designated user name are found. One or more found file names are the access file list.

  Specifically, the output unit 294 displays the access file list on the display. However, the output unit 294 may display the access file list on the display of the client terminal 120 by transmitting the access file list to the client terminal 120 via the communication unit 292.

A search request for requesting an access period search includes a period.
The period included in the search request is called a specified period.

In step S176, the search unit 240 searches the storage unit 291 according to the search request, and the output unit 294 outputs a list of management files accessed during the specified period.
A list of management files accessed during a specified period is called an access file list.

Specifically, the search unit 240 operates as follows.
First, the search unit 240 extracts a specified period from the search request.
Then, the search unit 240 searches the storage unit 291 using the specified period as a search key.
As a result, one or more management files associated with the access time included in the specified period are found. One or more management files found are an access file list.

  Specifically, the output unit 294 displays the access file list on the display. However, the output unit 294 may display the access file list on the display of the client terminal 120 by transmitting the access file list to the client terminal 120 via the communication unit 292.

*** Effects of Embodiment 1 ***
It is possible to acquire the contents of the management file operated on the file server, notify an operation that matches an arbitrary condition, and check the contents of the management file retroactively when an accident occurs.
The management file managed by the file server 110 can be restored using one or more file sharing packets captured from the network. Therefore, it is possible to know the contents of the management file when the operation is performed.
By the alert process (S160), it is possible to know in real time that a management file including important information such as personal information or confidential information has been operated. Therefore, it becomes possible to respond promptly to information leakage due to intention or accident.
By the management information search (S170), the contents of the management file in the specified period can be confirmed.

*** Another configuration ***
The file monitoring system 100 may include a storage device connected to the mirror port 131 instead of the file monitoring device 200.
The storage device receives the packet instead of the file monitoring device 200 and stores the received packet.
The file monitoring device 200 communicates with the storage device, and performs file monitoring and management information search using a packet stored in the storage device.

*** Supplement to the embodiment ***
The embodiments are exemplifications of preferred forms and are not intended to limit the technical scope of the present invention. The embodiment may be implemented partially or in combination with other embodiments. The procedure described using the flowchart and the like may be changed as appropriate.

  100 file monitoring system, 101 first network, 102 second network, 110 file server, 120 client terminal, 130 switch, 131 mirror port, 200 file monitoring device, 210 analysis unit, 220 restoration unit, 230 inspection unit, 240 search unit , 291 storage unit, 292 communication unit, 293 reception unit, 294 output unit, 901 processor, 902 memory, 903 auxiliary storage device, 904 communication device, 905 input / output interface.

Claims (12)

A communication unit that receives a packet relayed by the switch from a switch that is a device connected to a network having a file server;
An analysis unit that determines whether the received packet is a file sharing packet communicated according to a file sharing protocol;
A file monitoring apparatus comprising: a restoration unit that restores a management file managed by the file server using one or more file sharing packets. The file monitoring apparatus according to claim 1, further comprising: an inspection unit that extracts text from the restored management file and extracts monitoring information from the extracted text. The file monitoring apparatus according to claim 2, wherein the inspection unit determines whether the extracted monitoring information satisfies an alert condition, and notifies the alert when the extracted monitoring information satisfies the alert condition. The file monitoring apparatus according to claim 1, further comprising a storage unit that stores the restored management file in association with a file name and an access time. A reception unit for receiving a specified file name and a specified period;
A search unit for finding a management file associated with the same file name as the specified file name and associated with an access time included in the specified period from the storage unit;
The file monitoring apparatus according to claim 4, further comprising an output unit that outputs the found management file. A reception unit that accepts a specified period;
A search unit for finding a management file associated with an access time included in the specified period from the storage unit;
The file monitoring apparatus according to claim 4, further comprising an output unit that outputs the found management file. The file monitoring device includes a storage unit for storing the restored management file,
The analysis unit obtains a user name from one of the file sharing packets,
The file monitoring apparatus according to claim 1, wherein the storage unit stores the restored management file in association with a file name and the user name. A reception unit that accepts a specified file name;
A search unit for finding a user name associated with the same file name as the specified file name from the storage unit;
The file monitoring apparatus according to claim 7, further comprising: an output unit that outputs a found user name. A reception unit that accepts a specified user name;
A search unit for finding a file name associated with the same user name as the designated user name from the storage unit;
The file monitoring apparatus according to claim 7, further comprising: an output unit that outputs a found file name. A communication unit that receives a packet relayed by the switch from a switch that is a device connected to a network having a file server;
An analysis unit that determines whether the received packet is a file sharing packet communicated according to a file sharing protocol;
A file monitoring program for causing a computer to function as a restoration unit that restores a management file managed by the file server using one or more file sharing packets. An analysis unit that determines whether the packet stored in the storage device is a file sharing packet communicated according to a file sharing protocol;
A file monitoring apparatus comprising: a restoration unit that restores a management file managed by a file server using one or more file sharing packets. An analysis unit that determines whether the packet stored in the storage device is a file sharing packet communicated according to a file sharing protocol;
A file monitoring program for causing a computer to function as a restoration unit that restores a management file managed by a file server using one or more file sharing packets.

Images