JP2020086978A - Information processing system and information processing method - Google Patents

Abstract

To improve security by taking sufficient and appropriate measures against incidents such as virus infection, data leakage, and unauthorized access that may occur on an information processing terminal.SOLUTION: A management device 1 includes detection means 11 that detects a preset incident that has occurred in an information processing terminal 2, and log acquisition means 13 that acquires log information representing an operation status of the information processing terminal 2. The log acquisition means extracts information corresponding to the detected incident from the log information.SELECTED DRAWING: Figure 2

Description

The present invention relates to an information processing system and an information processing method that take computer security measures.

In an organization such as a company, many computers are used by each user who belongs to the computer. In such a situation, the organization needs to take security measures in each computer in order to ensure the security of the entire organization. Here, incidents that require security measures include virus infection, data leakage, and unauthorized access.

In security measures by an organization, it is mainly important to detect incidents and deal with the detected incidents. For example, when it detects that a computer is infected with a virus, it takes measures such as eliminating the virus and isolating the infected computer from other computers. Further, for example, when data leakage from a computer or unauthorized access to the computer is detected, the computer is locked or the network is shut down. As an example, Patent Document 1 describes that malware is detected and deleted.

JP, 2008-073423, A

Here, in the computer security measures by the organization, although the measures are taken when the incident is detected as described above, the influence and the cause of the occurrence of the incident are not pursued. Therefore, it is not possible to take appropriate measures because the damage caused by the occurrence of the incident cannot be grasped, and it is also impossible to take appropriate measures against the incident in advance. As a result, there arises a problem that the security of the organization cannot be improved.

Therefore, an object of the present invention is to solve the above-mentioned problem that it is not possible to improve security due to inability to take sufficient and appropriate response to an incident that may occur in an information processing terminal. is there.

An information processing system which is one form of the present invention,
Detection means for detecting a preset incident that has occurred in the information processing terminal,
Log acquisition means for acquiring log information indicating the operation status of the information processing terminal,
The log acquisition unit extracts information corresponding to the detected incident from the log information,
Take the configuration.

And in the above information processing system,
The log acquisition unit distinguishes between the occurrence of the incident and the occurrence thereof, and extracts information corresponding to the incident from the log information,
Take the configuration.

Further, in the above information processing system,
The log acquisition unit distinguishes between the occurrence of the incident and the occurrence of the incident, and outputs and outputs the extracted information.
Take the configuration.

Further, in the above information processing system,
When the incident occurs, the log acquisition unit acquires screen information of the information processing terminal before the occurrence or after the occurrence as the log information,
Take the configuration.

Further, in the above information processing system,
The detection means performs a coping process set according to the detected incident on the information processing terminal,
Take the configuration.

Further, an information processing system which is another mode of the present invention,
An information processing system including an information processing terminal and a management device that manages the information processing terminal,
The information processing terminal,
Incident detection means that detects a preset incident that has occurred in the information processing terminal, notifies the management device of the occurrence of the incident, and transmits log information that indicates the operating status of the information processing terminal. Equipped with
The management device, detection means for detecting the incident that occurred in the information processing terminal by the notification from the information processing terminal,
Log acquisition means for acquiring the log information from the information processing terminal,
The log acquisition unit extracts information corresponding to the detected incident from the log information,
Take the configuration.

Further, an information processing method which is another embodiment of the present invention is
Detects a preset incident that has occurred in the information processing terminal,
Obtaining log information indicating the operation status of the information processing terminal, and extracting information corresponding to the detected incident from the log information,
Take the configuration.

In addition, a program that is another embodiment of the present invention is
In the information processing device,
Detection means for detecting a preset incident that has occurred in the information processing terminal,
Log acquisition means for acquiring log information indicating the operation status of the information processing terminal, and extracting information corresponding to the detected incident from the log information,
To realize
Take the configuration.

With the above-described configuration, the present invention can take a sufficient and appropriate response to an incident that may occur in the information processing terminal, and can improve security.

It is a block diagram showing the composition of the whole information processing system in Embodiment 1 of the present invention. It is a figure which shows the structure of the management apparatus and user terminal which were disclosed by FIG. It is a figure which shows an example of the screen displayed on the management apparatus disclosed by FIG. It is a figure which shows an example of the screen displayed on the management apparatus disclosed by FIG. It is a figure which shows an example of the screen displayed on the management apparatus disclosed by FIG. It is a figure which shows an example of operation|movement for every incident in the management apparatus disclosed by FIG. 3 is a flowchart showing an operation in the management device disclosed in FIG. 1.

<Embodiment 1>
A first embodiment of the present invention will be described with reference to FIGS. 1 to 5 are diagrams for explaining the configuration of the information processing system. 6 to 7 are diagrams for explaining the operation of the information processing system.

[Constitution]
FIG. 1 shows the overall configuration of an information processing system according to the present invention. As shown in this figure, the information processing system includes a management device 1 and a plurality of user terminals 2 connected via a network N. For example, in the present embodiment, the management device 1 and the user terminal 2 are installed in an organization such as a company G, and are connected via a wired or wireless network such as an intranet. To do.

Here, the user terminal 2 is an information processing terminal operated by an employee of the company G, in which various software such as an operating system is installed and various data is stored. The management device 1 is an information processing device operated by an administrator of the company G, and manages the configuration and state of the user terminal 2 installed in the company G. Hereinafter, each configuration will be described in detail.

The user terminal 2 is an information processing terminal including a computing device and a storage device. As shown in FIG. 2, the user terminal 2 includes an incident detection unit 21 constructed by executing a program on a computing device. The user terminal 2 also includes a log data storage unit 25 formed in the storage device.

The incident detection unit 21 (incident detection means, detection means) of the user terminal 2 is composed of, for example, security countermeasure software, and has a function of detecting that an incident for which a security countermeasure should be taken has occurred in the user terminal 2. For example, the incidents detected in this embodiment are “virus infection” that infects malware such as malicious software or code, “data leakage” that illegally leaks data to the outside, and “internal fraudulent access from outside”. , There is. The incident detection unit 21 detects, for example, virus infection by pattern matching the data to be incorporated, and detects data leakage and internal fraud from log data such as operation logs and login logs.

However, the incident detection method by the incident detection unit 21 is arbitrary, and the incidents to be detected are not limited to those described above. It should be noted that the incident in the present invention includes not only the state in which the virus infection described above has occurred, but also the state in which it can occur. For example, a state of receiving a computer virus, a state of accessing a fraudulent website, a state of being fraudulently attacked from the outside, and the like are included in the incident.

In addition, in order to detect the incident as described above and to analyze the occurrence of the incident as described later, the incident detection unit 21 collects various log data (log information) indicating the operation status of the user terminal 2. It is acquired and stored in the log data storage unit 25. For example, as the log data, an access right log indicating the status of granting the access right to the user to the terminal, a login log indicating the history of the user who has logged in to the terminal, an operation log indicating the operation history of the terminal, and a history of mail transmission/reception. Representing email sending log and email receiving log, installed software log showing installed software history, application usage log showing application usage history, virus detection log showing virus infection detection, screen log showing terminal screen display history ,and so on. The log data stored in the log data storage unit 25 may be acquired by the operating system itself of the user terminal 2 or other software installed in the operating system. Further, the log data stored in the log data storage unit 25 is not limited to the above.

When the incident detection unit 21 detects that an incident has occurred as described above, the incident detection unit 21 notifies the management device 1 of the content of the incident that has occurred (virus infection, data leakage, internal fraud, etc.). At this time, the notification unit 22 also notifies the terminal information of the user terminal 2 itself and the information on the date and time when the incident occurred.

Further, the incident detection unit 21 performs preset provisional security countermeasure processing according to the content of the incident. For example, the incident detection unit 21 performs countermeasure processing according to the content of the incident, such as virus removal, network disconnection, file encryption, and device lock. The security coping process by the incident detection unit 21 may be executed under the control of the management device 1 by notifying the content of the incident, as described later.

Furthermore, the incident detection unit 21 has a function of transmitting the log data stored in the log data storage unit 25 to the management device 1. At this time, the incident detection unit 21 may transmit only log data of a type corresponding to the content of the incident that has occurred to the management device 1. Furthermore, the incident detection unit 21 may select the log data at the time of the incident, the log data before the incident, and the log data after that, according to the content of the incident, and send it to the management device 1. At this time, the incident detection unit 21 may itself transmit the log data to the management device 1 when detecting the incident, or may transmit the log data in response to a request from the management device 1 as described later. ..

Next, the configuration of the management device 1 will be described. As shown in FIG. 2, the management device 1 includes a detection unit 11, a coping unit 12, a log acquisition unit 13, and an output unit 14, which are constructed by executing a program on an arithmetic device. The management device 1 also includes a management data storage unit 15 and a log data storage unit 16 formed in the storage device.

First, the management device 1 has, as a basic function, a function of managing the configuration and state of the user terminal 2 installed in the company G. For example, the management device 1 is associated with a unique IP address of the user terminal 2, terminal information such as a group to which the user terminal 2 belongs, a user name, and a login password, hardware information that configures the user terminal 2, and installed information. Manage management data including software information, etc. Then, the management device 1 stores the management data regarding the user terminal 2 in the management data storage unit 15 and manages it.

The detection unit 11 (detection unit) of the management device 1 detects that an incident has occurred in the user terminal 2 by notifying the content of the incident from the user terminal 2. In particular, the detection unit 11 identifies the user terminal 2 in which the incident has occurred based on the notification from the user terminal 2 and determines the content of the incident, that is, which of the virus infection, the data leakage, and the internal fraud incident has occurred. , And the date and time when the incident occurred. Then, the detection unit 11 notifies the coping unit 12 and the log acquisition unit 13 of the detected information.

Note that the detection unit 11 of the management device 1 may acquire log data indicating the operating status of the user terminal 2 that is being managed, and detect from the log data that an incident has occurred in the user terminal 2. .. For example, the detection unit 11 constantly monitors the operation status of the user terminal 2 to acquire log data such as an operation log, a mail log, and an application usage log, and an incident has occurred in the user terminal 2 based on the log data. May be detected. At this time, the detection unit 11 may store and accumulate the log data of the user terminal 2 that is constantly acquired in the log data storage unit 16 of the management device 1.

The coping unit 12 (detection unit) of the management device 1 performs a provisional security coping process set in advance on the user terminal 2 according to the detected incident content of the user terminal 2. For example, the virus-infected user terminal 2 is cleaned and the network is disconnected, and the data-leaked user terminal 2 is encrypted with a file or device-locked. Disconnects from the network. Note that the security coping process by the coping unit 12 may be processed only by the management device 1 or may be processed by instructing another device such as the user terminal 2 or a communication device. In some cases, the user terminal itself handles the processing.

The log acquisition unit 13 (log acquisition unit) of the management device 1 acquires the log data of the user terminal 2 that has detected the incident, and stores and stores the log data in the log data storage unit 16. For example, the log acquisition unit 13 may acquire the log data transmitted by the user terminal 2 itself, or may request the user terminal 2 to acquire the log data from the user terminal 2. Alternatively, the log acquisition unit 13 may acquire the log data of the user terminal 2 accumulated in the log data storage unit 16 of the management device 1.

Then, the log acquisition unit 13 extracts, from the acquired log data of the user terminal 2, log data of a type corresponding to the content of the incident that has occurred. For example, in the case of virus infection, the virus detection log, mail transmission log, installed software log, and screen log are extracted. In the case of data leakage, the operation log, installed software log, application usage log, login log, screen log are extracted. In the case of internal fraud, the access right log, login log, and screen log are extracted. The type of log data extracted according to the content of the incident is related to the content of the incident, and is set in advance and stored in the management data storage unit 15, for example.

Further, the log acquisition unit 13 distinguishes between the occurrence of the incident and the occurrence thereof, and extracts the log data. That is, the log data extracted according to the content of the incident as described above is further distinguished into the log data after the incident occurrence date and the log data before the incident occurrence date and time. At this time, the log acquisition unit 13 extracts only the necessary data after and before the occurrence of the incident according to the content of the incident. For example, in the case of virus infection, the mail transmission log is necessary only after the occurrence, so it is extracted as the post-occurrence, and the installed software log is necessary only before the occurrence, so it is extracted as the pre-occurrence log. Note that which log data before or after the occurrence of the incident is extracted according to the content of the incident is set in advance and stored in the management data storage unit 15, for example.

In the above description, the log acquisition unit 13 extracts log data from the log data acquired from the user terminal 2 by limiting the type according to the content of the incident and by distinguishing before and after the occurrence. Alternatively, the type of the log data to be extracted and the distinction before and after the occurrence may be designated and requested to the user terminal 2 to obtain. For example, when the generated incident is a virus infection, the log data may be specified by requesting the log data such as the mail transmission log after the incident occurs and the log data may be acquired.

Here, with reference to FIG. 6, an example of the content of the incident and the log data extracted corresponding to before and after the occurrence of the incident will be described. Here, the log data displayed in the column of "S3: Impact investigation" indicates the log data extracted after the occurrence of the incident, and the log data displayed in the column of "S4: Cause tracking" is , Shows the log data extracted before the occurrence of the incident. For example, in the case of virus infection, a virus detection log, an operation log, and a mail transmission log are extracted after an incident has occurred, and an operation log, an installed software log, and a screen log have been extracted before an incident has occurred. In the case of data outflow, the operation log, screen log, and application usage log are extracted after the incident has occurred, and the operation log, the installed software log, and the login log are extracted before the incident has occurred. In the case of internal fraud, the login log and the screen log are extracted after the incident has occurred, and the login log and the access right log are extracted before the incident has occurred.

The output unit 14 (log acquisition unit) of the management device 1 displays the status of incidents occurring in the user terminal 2 and the log data acquired and extracted as described above on the display device of the management device 1 or another display device. Display output to. For example, as shown in FIG. 3, the output unit 14 displays the indications C1, C2, and C3 of the types of incidents that have occurred in any of the user terminals 2 managed by the management device 1 together with the date. Then, when the display C1, C2, C3 of the type of incident that has occurred is selected, the output unit 14 displays the details of the selected incident, as shown in FIG. 4 or 5.

As shown in the upper part of FIG. 4, the output unit 14 displays the outline of the incident in the display field indicated by reference numeral 30 as the detailed display of the incident. Here, first, as indicated by reference numeral 31, the type of incident that has occurred and the current time are displayed. Further, as indicated by reference numeral 32, the name of the user who is logged in to the user terminal 2 in which the incident has occurred and the client name representing the user terminal itself are displayed, and at the same time, the handling unit 12 described above performs the operation on the user terminal 2. Display the contents of the provisional security response processing. Further, as indicated by reference numeral 33, the screen log of the user terminal 2 when the incident occurs is displayed. The screen log may be before or after the occurrence of the incident.

The output unit 14 also displays a list 40 of the log data extracted as described above, as shown in the lower part of FIG. At this time, the output unit 14 distinguishes and displays the log data before and after the occurrence of the incident. For example, in this example, when an “impact investigation” tab 41 and a “cause tracking” tab 42 are displayed on the display screen and the “impact investigation” tab 41 is selected as shown in FIG. 4, an incident occurs. The subsequent log data list 40 is displayed in time series. On the other hand, when the "cause tracking" tab 42 is selected as shown in FIG. 5, a list 40 of log data before the occurrence of the incident is displayed in time series.

[motion]
Next, the operation of the above-described information processing system, in particular, the management device 1 will be described with reference to FIGS. 6 and 7. FIG. 6 is a diagram for explaining the operation of the entire information processing system, and FIG. 7 is a flowchart showing the operation of the management device 1.

First, the user terminal 2 monitors its own operating status and checks whether or not an incident has occurred. For example, as shown in FIG. 6, the user terminal 2 refers to a virus detection log, an operation log, a login log, and the like to check whether an incident such as virus infection, data leakage, or internal fraud has occurred. When the user terminal 2 detects the occurrence of the incident, the user terminal 2 notifies the management device 1 of the content of the incident (virus infection, data leakage, internal fraud). At this time, the notification unit 22 also notifies the terminal information of the user terminal 2 itself and the information on the date and time when the incident occurred.

By receiving the above-mentioned notification, the management device 1 detects that an incident has occurred in the user terminal 2 (step S1 in FIG. 6, step S11 in FIG. 7). Then, the management device 1 performs a preset provisional security countermeasure process on the user terminal 2 according to the detected incident content of the user terminal 2 (step S2 in FIG. 6, step S12 in FIG. 7). ). The provisional security countermeasure process may be executed by the user terminal 2 itself.

Subsequently, the management device 1 acquires the log data of the user terminal 2 that has detected the incident (step S13 in FIG. 7). Then, the management device 1 extracts, from the log data, log data of a type corresponding to the content of the incident that has occurred, and also extracts log data before or after the occurrence of the incident, depending on the content of the incident. (Step S14 of FIG. 7). For example, as indicated by reference signs S3 and S4 in FIG. 6, log data of each set type is extracted for each incident and before and after the occurrence of the incident.

The log data acquisition process (step S13 in FIG. 7) and the extraction process (step S14 in FIG. 7) described above are performed before or after the security countermeasure process (step S12 in FIG. 7), or in parallel. You may break.

After that, the management device 1 displays and outputs the details of the incident generated in the user terminal 2 on the display device, as shown in FIG. 4 or FIG. 5 (step S15 in FIG. 7). At this time, the management device 1 uses the log data after the incident has occurred (impact investigation tab 41 in FIG. 4: step S3 in FIG. 6) and the log data before the incident has occurred (cause investigation tab 42 in FIG. 5: FIG. 6). And step S4) are displayed separately. Further, as shown in FIG. 6, the type of log data displayed at this time is the type of log data 40 according to the content of the incident that has occurred. Further, as indicated by reference numeral 33, a screen log when the incident occurs is also displayed.

After that, the management device 1 or the administrator performs a permanent coping process according to the extracted log data that is distinguished before and after the occurrence of the incident according to the content of the incident (step of FIG. 6). S5, step S16 of FIG. 7). Further, the management device 1 or the manager performs a report process such as creating a report (step S6 in FIG. 6, step S17 in FIG. 7).

As described above, according to the present invention, when an incident occurs in the user terminal 2, the log data according to the content of the incident can be easily examined, and the log data can be distinguished before and after the occurrence of the incident. You can examine the data. Therefore, it is possible to easily and swiftly pursue the influence and cause of the incident that has occurred, and to take sufficient and appropriate measures. As a result, the security of the entire organization such as the company G can be improved.

In the above description, the management device 1 and the user terminal 2 cooperate with each other to perform processing such as incident detection and handling, log data extraction, and display, but all the functions described above are performed only by the management device 1. Alternatively, only the user terminal 2 may be equipped and any processing may be performed by any of the devices.

Here, the above-mentioned program is stored in a storage device or recorded in a computer-readable recording medium. For example, the recording medium is a portable medium such as a flexible disk, an optical disk, a magneto-optical disk, and a semiconductor memory.

Although the invention of the present application has been described with reference to the exemplary embodiments and the like, the invention of the present application is not limited to the above-described exemplary embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

DESCRIPTION OF SYMBOLS 1 management device 11 detection unit 12 handling unit 13 log acquisition unit 14 output unit 15 management data storage unit 16 log data storage unit 2 user terminal 21 incident detection unit 25 log data storage unit

Claims (7)

Detection means for detecting a preset incident that has occurred in the information processing terminal,
Log acquisition means for acquiring log information indicating the operation status of the information processing terminal,
The log acquisition unit extracts information corresponding to the detected incident from the log information,
Information processing system. The information processing system according to claim 1, wherein
The log acquisition unit distinguishes between the occurrence of the incident and the occurrence thereof, and extracts information corresponding to the incident from the log information,
Information processing system. The information processing system according to claim 2, wherein
The log acquisition unit distinguishes between the occurrence of the incident and the occurrence of the incident, and outputs and outputs the extracted information.
Information processing system. The information processing system according to any one of claims 1 to 3,
When the incident occurs, the log acquisition unit acquires screen information of the information processing terminal before the occurrence or after the occurrence as the log information,
Information processing system. The information processing system according to any one of claims 1 to 4,
The detection means performs a coping process set according to the detected incident on the information processing terminal,
Information processing system. An information processing system including an information processing terminal and a management device that manages the information processing terminal,
The information processing terminal,
Incident detection means that detects a preset incident that has occurred in the information processing terminal, notifies the management device of the occurrence of the incident, and transmits log information that indicates the operating status of the information processing terminal. Equipped with
The management device, detection means for detecting the incident that occurred in the information processing terminal by the notification from the information processing terminal,
Log acquisition means for acquiring the log information from the information processing terminal,
The log acquisition unit extracts information corresponding to the detected incident from the log information,
Information processing system. Detects a preset incident that has occurred in the information processing terminal,
Obtaining log information indicating the operation status of the information processing terminal, and extracting information corresponding to the detected incident from the log information,
Information processing method.

Images