JP4681595B2 - Information tracing system, information tracing method, and information tracing program - Google Patents

Description

  The present invention relates to an information tracing system, an information tracing method, and an information tracing program for monitoring information output to the outside from a computer system, and in particular, the leakage of the leaked information when information is leaked to the outside from the computer system. The present invention relates to an information tracing system, method, and program that can trace a route.

  In recent years, due to the use of e-mail and external networks, there is an increased risk of leakage of confidential information stored in computers. As countermeasures against such information leakage, restrictions on computers connected to external networks and firewalls It is known that network access control by is effective, but it is not perfect for intentional crimes. In addition, when confidential information is leaked to the outside, it is necessary to quickly identify the damage because it is necessary to grasp the damage situation. For that purpose, the identification of the leaked confidential information (file name) and confidential information It is necessary to specify the person who acquired the information and the route through which the confidential information was leaked.

As a leakage prevention technique in the prior art, for example, as described in Patent Document 1 below, whether to allow attachment at the time of mail transmission is registered for each file, and the attachment permission is determined at the time of mail transmission. As disclosed in Non-Patent Document 1, application software for acquiring file operation records, print records, and e-mail records as output logs has been developed in each computer of an in-house computer system. Yes.
JP 2007-249618 A Articles on the Internet website of product information called AllWatcher (all watcher) of IRL Co., Ltd. [Search November 26, 2007], Internet <URL: http: // www .iri-ct.co.jp / allwatcher /〉

  Although the information leakage prevention technique described in Patent Document 1 described above can prevent leakage of confidential information by permitting attachment of an e-mail in advance, some confidential information requires a mail exchange with a specific outside. There is a problem that information that requires external mail exchange cannot be sent to the outside.

  Further, the technology described in Non-Patent Document 1 has the above-described log acquisition application software installed on a large number of computers, and when information leakage occurs, information leakage is performed by searching output logs of the large number of computers. Although the computer can be inferred, this output log acquisition is limited to log information such as the computer name (IP address), output destination name (IP address), date and time, and file name that output the information. When the file name is changed, it is difficult to search for the leak source based on the file name, and it is difficult to trace the outflow route from the time of information (file) creation to the time of leak. there were.

  An object of the present invention is to eliminate the above-described problems caused by the prior art, and to provide an information tracing system, an information tracing method, and an information tracing program capable of tracing a path of information leakage from a computer system. That is.

In order to achieve the above object, the present invention provides a plurality of computers for storing a file including a character string in a storage device and performing file operations, a server for executing an operation in accordance with a command from the computer, and the computer and the server. An information tracing system comprising: a log recording unit that stores log information of operation records and operation records; and an information tracing device that acquires log information of operation records and operation records for files with reference to the log recording unit. And
The log information includes a file name, a computer name, a server name, computer operation information including a file name change operation, server operation information including a file transmission operation, and date / time information on the operation or operation. Including
The information tracing device is
A file name of a file including an arbitrary character string is acquired from the storage device, a plurality of log information including operation information or operation information for the file with the acquired file name is acquired from the log recording unit, and the acquired file The first feature is that log information including a name, a computer name, a server name, and operation information or operation information is sorted based on date and time information.

  In the information tracing system according to the first feature, the server includes a printer server that controls printing of a file, and the log recording unit commands a file name printed by the printer server, printing date information, and printing. The second feature is that the computer name is recorded.

  In the information tracing system according to the first or second feature, the server includes a mail server that controls transmission / reception of an electronic mail, and the log recording unit attaches the electronic mail transmitted / received by the mail server. The third feature is that the name, the printing date and time information, and the name of the computer that commanded the transmission / reception of electronic mail are recorded.

Furthermore, the present invention relates to a plurality of computers that store a file including character strings in a storage device and perform file operations, a server that executes an operation in accordance with a command from the computer, an operation record and an operation record of the computer and server An information tracing method for an information tracing system comprising: a log recording unit that stores log information; and an information tracing device that acquires log information of operation records and operation records with respect to a file with reference to the log recording unit. ,
The log information includes a file name, a computer name, a server name, computer operation information including a file name change operation, server operation information including a file transmission operation, and date and time information when the operation or operation is performed. Include
The information tracing device is
A first step of acquiring a file name of a file including an arbitrary character string from the storage device;
A second step of acquiring, from the log recording unit, a plurality of log information including operation information or operation information for the file having the file name acquired in the first step;
A fourth feature is that a third step of sorting log information including the file name, computer name, server name, operation information or operation information acquired in the second step based on date and time information is performed.

  In the information tracing method according to the fourth feature, the server includes a printer server that controls printing of a file, and the log recording unit instructs a file name printed by the printer server, printing date and time information, and printing. A fifth feature is that it includes a step of recording the computer name.

  In the information tracing method according to the fifth feature, the server includes a mail server that controls transmission / reception of electronic mail, and the log recording unit includes a file name attached to the electronic mail transmitted / received by the mail server; A sixth feature includes a step of recording the printing date and time information and the name of the computer that commanded transmission / reception of electronic mail.

Furthermore, the present invention relates to a plurality of computers that perform operations of storing a file including a character string in a storage device and copying and moving the file, a server that executes an operation in accordance with a command from the computer, and the computer and the server. Information of an information tracing system comprising: a log recording unit for storing operation record and operation record log information; and an information tracing apparatus for acquiring operation record and operation record log information for the file with reference to the log recording unit A tracing program,
The log information includes a file name, a computer name, a server name, computer operation information including a file name change operation, server operation information including a file transmission operation, and date / time information on the operation or operation. Including
In the information tracing apparatus,
A first procedure for obtaining a file name of a file including an arbitrary character string from the storage device;
A second procedure for obtaining a plurality of log information including operation information or operation information for the file having the file name obtained by the first procedure from the log recording unit;
A seventh feature is that a third procedure for sorting log information including the file name, computer name, server name, operation information or operation information acquired by the second procedure based on the date / time information is executed.

  In the information tracing program according to the seventh feature, the server includes a printer server that controls printing of a file, and the log recording unit instructs the printer server to print a file name, printing date information, and printing. The eighth feature is that a procedure for recording the computer name is executed.

  In the information tracing program of the seventh or eighth feature, the server includes a mail server that controls transmission / reception of electronic mail, and the file attached to the electronic mail transmitted / received by the mail server in the log recording unit A ninth feature is that a procedure for recording the name, the printing date and time information, and the computer name that commanded the transmission / reception of electronic mail is executed.

  The information tracing system, method, and program according to the present invention are obtained from a file in which an information tracing device stores a file name including a character string included in leaked information in a storage device (hard disk) of a computer constituting the system. Acquire the log information including the acquired file name from the log recording unit, and sort the acquired log information in order of date and time to identify the movement path from the creation of the leaked file in the computer system And based on this, it is possible to examine a route through which information is leaked.

  Hereinafter, an embodiment of an information tracing system in a computer system employing an information tracing method according to the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram for explaining the overall configuration of a computer system to which an information tracing system according to an embodiment of the present invention is applied, and FIG. 2 is a diagram for explaining the configuration of an information tracing device according to the present embodiment. FIG. 3 is a diagram for explaining a tracing operation by the information tracing apparatus, FIG. 4 is a diagram for explaining an example of an information leakage path targeted by the embodiment, and FIG. 5 is an operation log according to the embodiment. FIG. 6 is a diagram illustrating a recording format of the mail transmission / reception log recording unit 10 according to the present embodiment, FIG. 7 is a diagram illustrating an example of a file search result of a PC or the like according to the present embodiment, and FIG. These are figures which show the recording format of the information tracing table recording part 14. FIG.

[Constitution]
First, the computer system constituting the information tracing system according to the present embodiment corresponds to a client as shown in FIG. 1, and a plurality of exchangeable external media 2a to 2c such as portable memory / flexible disk are connected. Computers 1a to 1c, a printer server 4 for controlling printing output using the printer 3 by operating the computers 1a to 1c, and an external network 5 such as the Internet, and sending and receiving e-mail between the computer 1 and the outside Is connected to the information tracing device 11 that is a feature of the present embodiment via the LAN 7. Although the computer and the server are not shown with peripheral devices such as a display and a keyboard, they are also provided.

  In particular, the computer system according to the present embodiment includes operation log information (user name, operation content, date and time, operation file) when various operations such as file copy, file movement, print output, and mail transmission / reception are performed on the computers 1a to 1c. Operation log recording units 8a to 8c for recording the name etc. and hard disks 13a to 13c for storing the contents of the operated file are connected, and the printer server 4 performs a print output operation when the print operation is performed. A printer output log recording unit 9 for recording log information (computer name, printing date and time, operation file name, etc.) is connected, and mail output operation log information (computer name, mail when the mail transmission / reception operation is performed to the mail server 6 is performed. A mail transmission / reception log recording unit 10 that records transmission / reception date / time, mail title, attached file name, etc.) It is continued.

  The information tracing apparatus 11 includes a log information table recording unit 12 that collects and records various log information recorded in the operation log recording unit 8, the printer output log recording unit 9, and the mail transmission / reception log recording unit 10. An information tracing table recording unit 14 storing trace information for specifying by what means the information (file) is output to the outside by an operation described later is connected. Although not shown in FIG. 1, the log information table recording unit 12 includes a PC log information table recording unit 12a for storing operation logs collected from a plurality of computers 1a to 1c, and a mail transmission / reception log recording unit. Mail transmission / reception log information table recording unit 12b for storing the mail transmission / reception log information collected from 10 and the file masterpiece results collected from the hard disks 13a to 13c connected to the PCs 1a to 1c using the keyword designated by the administrator as a key An information table 12c is provided.

  As shown in FIG. 2, the information tracing device 11 records the operation log information recorded in the operation log recording unit 8, the printer output log information recorded in the printer output log recording unit 9, and the mail transmission / reception log recording unit 10. Specified by the administrator, a log information collection unit 21 that collects the received mail transmission / reception log information via the LAN 7, a database creation unit 22 that creates a log information database from various log information collected by the log information collection unit 21, and Based on the log information table created by the database creation unit 22 using the keywords and the like, the file search unit 23 for searching the file contents recorded on the hard disk 13 of each computer 1, and the search result by the file search unit 23 Information for identifying the computer 1 involved in the information leakage described later and identifying the information outflow route It consists of tracing the search unit 24.

  In the above-described embodiment, the information tracing apparatus 11 acquires the log information from the operation log recording unit 8 or the like and records it in the log information table recording unit 12. However, the present embodiment is not limited to this. However, the operation log recording unit 8 or the like may be configured to transmit log information to the log information table recording unit 12. Further, in the case of a system that connects to an external web server via a proxy server, a log information recording unit may be provided in the proxy server, and in the above example, the mail server 6 also records log information of received mail. However, it may be configured to record only transmission log information, and configured to record access log information including an upload operation when an external website is accessed via the external network 5. Also good.

  Next, the contents recorded by each log recording unit will be described. As shown in FIG. 4, the user 1 of the computer name PC1 creates a file with the file name “file1” at time “08:00:00”. It registers in its own hard disk 13a (step a), and the user 1 attaches the file “file1” to the computer name PC2 and sends it at time “09: 0” (step b). The file “file1” is copied as the file “file1-1” at “10:50” (step c), stored in the flexible disk (FD) at the time “11:00” (step d), and the user 2 is the user 3 The user 3 who has received the FD uses the computer with the computer name PC3 to store the file “file” stored in the FD. -1 "is stored in its own hard disk (step f), and this" file 1-1 "is sent to the outside via the mail server 6 (step g), so that information is leaked to the outside. Will be described.

  First, as shown in FIG. 5, the log information collected from each operation log recording unit 8 and stored in the PC log information table recording unit 12a at the time “11:00” as shown in FIG. Log information of item No. 1 that outputs (records) “file1-1” to the FD and log information of No. 2 that PC1 outputs (records) the file “file2” to the CD-R at time “12:00” And the log information of item number 3 in which the file “file1-1” is input from the FD at time “12:00”. The log information of item number 2 is not related to information leakage.

  The mail transmission / reception log information recorded in the mail transmission / reception log information table recording unit 12b is stored in the file “file1-1” at time “9:00” via the mail server “ML1” by the operation of the PC 1, as shown in FIG. ”With the mail content“ xxx .... xxx ”sent, and mail with the file“ file1 ”attached to the time“ 9:00 ”via the mail server“ ML1 ”by the operation of the PC 2 The log information that received the mail with the contents “xxx... Xxx” and the mail contents “yyy ..” with the file “file3” attached to the time “12:00” via the mail server “ML2” by the operation of the PC 4. .yyy "and the file" file1-1 "at time" 15:00 "via the mail server" ML1 "by the operation of the PC 3 Is stored as an attachment to e-mail content "zzz ... zzz" send log information mail of the. The mail content is also stored as a sent mail on the sender's hard disk.

  Further, the information log saved by each PC collected by the log information table storage unit 12 in the file search result information table 12c shows the correspondence between the file storage time corresponding to the computer name and the file name, as shown in FIG. For example, the fact that the PC 1 has recorded the file “file1” on the hard disk at time “8:00” is stored.

  The information tracing apparatus 11 according to the present embodiment includes the operation log information of each PC recorded in the plurality of operation log recording units 8a to 8c, the log information of the print output recorded in the printer output log recording unit 9, and the mail. The mail recording log information recorded in the transmission / reception log recording unit 10 is collected and stored in each table storage unit 12a to 12c of the log information table recording unit 12.

  The information tracing table recording unit 14 is created by acquiring log information designated by an instruction from the information tracing device 11 described later from the log information table recording unit 12, and as shown in FIG. The log information of the operations and operations of each PC and server shown in FIG. 4 is sorted in order of date and time, and details will be described later.

[Operation]
In the information tracing system according to the present embodiment, when the PCs 1a to 1c of the computer system store a user-created document file in the hard disk 13a and move or copy the file to the external medium 2a, the information is recorded in the operation log recording unit 8a. Operation log information of the file operation is stored, and when the printer output log recording unit 9 performs print output by the printer 3 using the printer server 4, print log information such as the print base PC and file name is stored. The mail transmission / reception log recording unit 10 operates to store mail log information when mail is transmitted / received via the mail server 6.

  Further, in the information tracing apparatus 11 according to the present embodiment, the log information collection unit 21 shown in FIG. 2 is periodically operated by the operation log recording units 8a to 8c, the printer output log recording unit 9, and the mail transmission / reception log recording unit, for example. 10, the log information database creation unit 22 stores the collected log information in the information tables 12b and 12c shown in FIGS. 6 to 7, and the collected log information is time-sequentially stored. It operates to sort and record in the information tracing table recording unit 14.

  In such a state, for example, when it is found that technical information related to the specifications of the business management software of company A has been leaked, the information tracing device 11 of this system allows the administrator to execute the leaked file name and technical information. Step S101 for receiving an input of a keyword set based on a term (character string) included in the keyword and a search condition (search expression based on a combination of AND condition / OR condition / knot condition) using the keyword, and the input keyword As a key, the file names and the file contents stored in the hard disks 13a to 13c, which are all recording devices connected to the system according to the search conditions (including character strings in the mail text such as character strings and numerical information) And a computer name (PC name) / file name / file as a result of the search The log information table is recorded by a search expression using the acquired PC name and file name as a keyword and the date search condition of the update date and time (the leak discovery date is the maximum date, etc.) using the acquired PC name and file name as keywords. Step 104 for searching various log information recorded in the section 12, step S105 for sorting the log information hit in step S104 in the order of date and displaying it on the display, and obviously the log information included in step S105. Step S106 in which the administrator selects and deletes log information that is not involved in information leakage is executed, and step S107 in which the screened log information is sorted and displayed.

  The log information subjected to the screening is stored in the information tracing table recording unit 14, and as shown in FIG. 8, the log information on the history of the file operation and server operation described with reference to FIG. 4 is displayed as a list. Specifically, the PC 1 records the file “file1” on the hard disk at time “8:00” (item number 1), and the file is sent via the mail server 8 called ML1 at time “9:00”. Send the mail (No. 2), and the PC 2 receives the mail via the same mail server 8 (No. 3) at the time “9:00” and records this file on the hard disk (No. 4). The file name is changed to “file1-1” (item number 5) and recorded on the hard disk (item number 6), and the file “file1-1” is output to the flexible disk (item number 7). The PC 3 records the file “file1-1” on the hard disk at time “12:00” (item number 8), and then sends a mail via the mail server 8 at time “15:00” (item number 9). ) Is shown as a list.

  As described above, the information tracing system according to the present embodiment is provided with a plurality of log recording units for recording operations and operations of a client-side computer, a printer server, a mail server, and the like that operate according to instructions from the computer. 11 searches for a file stored in a hard disk connected to each computer using a keyword for specifying leaked information, and uses the searched file name and the computer name storing the file as a key. By acquiring the log information stored in the log recording unit and sorting the acquired log information in time series, it is possible to display a list of paths related to the leaked file.

  Therefore, the administrator can check the leaked path and the cause of the leak by referring to the path list regarding the leaked file. In particular, in the present embodiment, in the technique described in the above-mentioned non-patent document, for example, when the file name is changed, the file that is the leaked information source cannot be specified, and the cause of the information leak is clarified. However, in this embodiment, a file that may be leaked from the character string of the contents of a file such as a document saved by each computer is identified, and the log of the computer that handled the file and the file is identified. By acquiring information, a leaked path can be traced even when the file name is changed.

The figure for demonstrating the whole structure of the computer system to which the information tracing system by one Embodiment of this invention is applied. The figure for demonstrating the structure of the information tracing apparatus by this embodiment. The flowchart for demonstrating the outline | summary operation | movement of this information tracing apparatus. The figure for demonstrating an example of the information leakage path | route used as the object of this embodiment. The figure which shows the recording format of the operation log recording part by this embodiment. The figure which shows the recording format of the mail transmission / reception log recording part by this embodiment. The figure which shows the example of file search results, such as PC by this embodiment. The figure which shows the recording format of an information tracing table recording part.

Explanation of symbols

  13a to 13c: hard disk, 1a to 1c: computer, 2a to -2c: external medium, 8a to 8c: operation log recording unit, 3: printer, 4: printer server, 5: external network, 6: mail server, 9: Printer output log recording unit, 10: mail transmission / reception log recording unit, 11: information tracing device, 12: log information table recording unit, 12a: log information table, 12b: mail transmission / reception log information table, 12c: file search result information table , 14: Information tracing table recording unit, 21: Log information collection unit, 22: Log information database creation unit, 23: File search unit, 24: Information tracing search unit.

Claims (9)

A plurality of computers that store files including character strings in a storage device and perform file operations, a server that executes operations according to commands from the computers, and operation records of the computers and servers and log information of operation records are stored. An information tracing system comprising: a log recording unit; and an information tracing device that acquires log information of operation records and operation records for files with reference to the log recording unit,
The log information includes a file name, a computer name, a server name, computer operation information including a file name change operation, server operation information including a file transmission operation, and date / time information on the operation or operation. Including
The information tracing device is
A file name of a file including an arbitrary character string is acquired from the storage device, a plurality of log information including operation information or operation information for the file with the acquired file name is acquired from the log recording unit, and the acquired file Information tracing system that sorts log information including name, computer name, server name, operation information or operation information based on date and time information.   The information according to claim 1, wherein the server includes a printer server that controls printing of a file, and the log recording unit records a file name printed by the printer server, printing date and time information, and a computer name that instructs printing. Tracing system.   The server includes a mail server that controls transmission / reception of electronic mail, and the log recording unit includes a file name attached to an electronic mail transmitted / received by the mail server, print date / time information, and a computer name that instructs electronic mail transmission / reception. The information tracing system according to claim 1 or 2, wherein the information is recorded. A plurality of computers that store files including character strings in a storage device and perform file operations, a server that executes operations according to commands from the computers, and operation records of the computers and servers and log information of operation records are stored. An information tracing method of an information tracing system comprising: a log recording unit; and an information tracing device that acquires log information of operation records and operation records with respect to a file with reference to the log recording unit,
The log information includes a file name, a computer name, a server name, computer operation information including a file name change operation, server operation information including a file transmission operation, and date and time information when the operation or operation is performed. Include
The information tracing device is
A first step of acquiring a file name of a file including an arbitrary character string from the storage device;
A second step of acquiring, from the log recording unit, a plurality of log information including operation information or operation information for the file having the file name acquired in the first step;
An information tracing method for performing a third step of sorting log information including a file name, a computer name, a server name, operation information or operation information acquired in the second step based on date and time information.   The server includes a printer server that controls printing of a file, and the log recording unit includes a step of recording a file name printed by the printer server, printing date information, and a computer name that commanded printing. 4. Information tracing method according to 4.   The server includes a mail server that controls transmission / reception of electronic mail, and the log recording unit sends a file name attached to the electronic mail transmitted / received by the mail server, print date / time information, and a computer name that instructs electronic mail transmission / reception. The information tracing method according to claim 4, further comprising a step of recording. A plurality of computers for storing a file including a character string in a storage device and copying and moving the file, a server for executing an operation in accordance with a command from the computer, an operation record and an operation record of the computer and the server An information tracing program for an information tracing system, comprising: a log recording unit that stores log information of an image; and an information tracing device that acquires log information of operation records and operation records for files with reference to the log recording unit. And
The log information includes a file name, a computer name, a server name, computer operation information including a file name change operation, server operation information including a file transmission operation, and date / time information on the operation or operation. Including
In the information tracing apparatus,
A first procedure for obtaining a file name of a file including an arbitrary character string from the storage device;
A second procedure for obtaining a plurality of log information including operation information or operation information for the file having the file name obtained by the first procedure from the log recording unit;
An information tracing program for executing a third procedure for sorting log information including a file name, a computer name, a server name, operation information or operation information acquired by the second procedure based on date information.   The server includes a printer server that controls printing of a file, and the log recording unit causes the printer server to execute a procedure of recording a printed file name, printing date information, and a computer name that instructs printing. Item 7. The information tracing program according to Item 7.   The server includes a mail server that controls transmission / reception of electronic mail, and the log recording unit includes a file name attached to the electronic mail transmitted / received by the mail server, printing date / time information, and a computer name that instructs electronic mail transmission / reception, The information tracing program according to claim 7 or 8, wherein a procedure for recording the information is executed.

Images