JP4705961B2 - Virus damage range prediction system - Google Patents

Description

The present invention relates to a virus damage range prediction system for predicting the damage range when a computer virus is infected to a computer terminal used in an organization such as a company. Furthermore, the present invention relates to a virus damage range prediction system that separates a computer terminal that is predicted to be infected from a network.

  An organization such as a company uses a large number of computer terminals to perform its business. However, for some reason, some computer terminals are referred to as computer viruses (referred to herein as “viruses.” Viruses are also defined as “unauthorized programs or program fragments that cause some damage to themselves or other computer terminals ( Other than computer viruses that can be transmitted via e-mail or web browsers, various programs such as worms, bots, and rootkits are included. In the present specification, they may be collectively referred to as “viruses”. In such a case, in order to prevent virus infection from an infected computer terminal to another computer terminal, the system administrator immediately shuts off the computer terminal that detected the virus infection from the network and specifies the infection route. There is a need to prevent new infections.

  The following Patent Document 1 describes an example of a system for specifying a virus infection route. Patent Document 2 describes an example of a system that notifies when there is a virus or unauthorized access.

JP 2002-287991 A JP 2007-206750 A

  When the invention of Patent Document 1 is used, it is advantageous in that it is possible to specify the route by which the computer is infected by the virus. Then, the system administrator performs an operation of identifying whether there is any other computer terminal that may be infected by following the identified infection route.

  In other words, in the case of a conventional system that specifies the infection route, even if the computer terminal can identify the virus-infected route, it predicts the other computer terminals that may be infected, that is, the damage range of the virus infection. Cannot be done. Therefore, as described above, the system administrator needs to specify whether there is another computer terminal that may be infected by following the specified infection route.

  However, in the case of a virus, when a file used by an infected computer terminal is used by another computer terminal, the other computer terminal is often infected and the damage spreads. Therefore, after identifying the path of virus infection, the system administrator followed the path to identify other infected computer terminals and blocked the network connection of the computer terminals. However, it takes time, and there is a risk of damage spreading to other computer terminals.

  In order to prevent damage from spreading, there is a system that notifies a predetermined telephone number or the like used by a system administrator by FAX when there is a virus infection or unauthorized access, as in Patent Document 2 described above. However, even if this system is used, it is impossible to predict the possible range of damage. Therefore, as in the past, the system administrator must eventually identify whether there are other computer terminals that may be infected.

  In addition, in order to prevent damage from spreading, it is possible to prevent damage spreading by blocking the network connection of all other computer terminals when a virus infection is detected. If the connection is interrupted, it will cause a significant hindrance to daily work.

  Therefore, when a virus infection is detected with one computer terminal, a system that can promptly and appropriately predict the infection range is desired. There is a demand for a system that prevents the spread of damage by blocking the network connection of computer terminals in the predicted range.

  In view of the above problems, the present inventors have invented the virus damage range prediction system of the present invention.

  A first invention is a virus damage range prediction system for predicting a damage range due to infection with a computer virus, the virus damage range prediction system including an operation log information storage unit that stores operation log information of a client terminal, a client Based on the operation log information, a virus detection information acquisition unit that acquires virus detection information indicating that a virus has been detected from the terminal and a client terminal that has accessed a file stored in the client terminal that has detected the virus are identified. Thus, a virus damage range prediction system having a damage range prediction processing unit for predicting the damage range of virus infection.

  The first possibility of virus infection is when another client terminal accesses a file stored in a virus-infected client terminal. Therefore, by configuring as in the present invention, it is possible to predict another client terminal that has accessed a file stored in the client terminal that has detected a virus as a damage range that may cause virus infection.

  In the above-described invention, the damage range prediction processing unit searches for operation log information stored in the operation log information storage unit based on client terminal identification information of the infected client terminal and operation contents indicating file access. And extracting the client terminal identification information from the operation log information specified by the search so as to identify the client terminal that has accessed the file stored in the infected client terminal. I can do it.

  The above-described invention can also be configured as the following invention. That is, a virus damage range prediction system that predicts a damage range due to a computer virus infection, the virus damage range prediction system storing an operation log information storage unit that stores operation log information of a client terminal and a client terminal. A file information storage unit that stores at least file identification information of a file being detected, a virus detection information acquisition unit that acquires virus detection information indicating that a virus has been detected from a client terminal, and acquiring the virus detection information, A file specifying unit that specifies a file stored in the client terminal based on the file information storage unit, and a client terminal that accesses the file specified by the file specifying unit in the operation log information storage unit Based on the operation log information stored By constant, a terminal identifying unit that performs the damage range prediction of viral infection can also be configured as viral damage range prediction system with.

  In the above-described invention, when the file specifying unit acquires the virus detection information, based on the client terminal identification information of the virus detection information, the file identification unit stores the file identification information of the file stored in the client terminal. The terminal specifying unit searches the operation log information stored in the operation log information storage unit based on the file identification information specified by the file specifying unit and the operation content indicating file access, By extracting the client terminal identification information of the operation log information specified by the search, it can be configured as a virus damage range prediction system that identifies the client terminal that has accessed the file stored in the infected client terminal.

  Furthermore, in the above-mentioned invention, the damage range of the virus infection is predicted by specifying another client terminal that has accessed the file stored in the client terminal infected by the virus. It is also possible to predict the damage range of virus infection. That is, a virus damage range prediction system that predicts a damage range due to computer virus infection, the virus damage range prediction system including an operation log information storage unit that stores operation log information of each client terminal, A virus detection information acquisition unit for acquiring virus detection information indicating that the virus has been detected, and a file accessed by the client terminal that has detected the virus, by identifying the client terminal that has accessed the virus based on the operation log information. You may comprise like the virus damage range prediction system which has a damage range prediction process part which performs the damage range prediction of infection.

  When another client terminal accesses a file accessed by a virus-infected client terminal, the other client terminal may be infected with a virus. Therefore, by configuring as in the present invention, it is possible to predict other client terminals that have accessed a file accessed by a client terminal that has detected a virus as a damage range that may cause virus infection.

  The above-described invention can also be configured as the following invention. That is, a virus damage range prediction system for predicting a damage range due to computer virus infection, wherein the virus damage range prediction system includes an operation log information storage unit for storing operation log information of a client terminal, and a virus from the client terminal. Based on the operation log information stored in the operation log information storage unit, the virus detection information acquisition unit that acquires virus detection information indicating detection, and when the virus detection information is acquired, the file accessed by the client terminal By identifying the file identification unit to be identified and the client terminal that has accessed the file identified by the file identification unit based on the operation log information stored in the operation log information storage unit, it is possible to predict the damage range of virus infection And a virus identification having a terminal identification unit It can also be configured as a range prediction system.

  In the above-described invention, when the file specifying unit acquires the virus detection information, a file of the file accessed by the client terminal based on the client terminal identification information of the virus detection information and the operation content indicating file access. The identification information and the storage location information are specified based on the operation log information stored in the operation log information storage unit, and the terminal specification unit is configured to identify the file identification information specified by the file specification unit and the storage location thereof. Based on the information and the operation content indicating the file access, the operation log information stored in the operation log information storage unit is searched, and the client terminal identification information of the operation log information specified by the search is extracted, thereby being infected. Specify the client terminal that accessed the file stored in the client terminal. It can also be configured as pulse damage range prediction system.

  For a client terminal predicted to be infected with a virus, it is preferable to block the network connection in order to prevent the damage from spreading. Therefore, the network connection can be blocked by configuring as in the following invention. That is, the virus damage range prediction system further includes a network connection cut-off processing unit that executes a network connection cut-off process for a client terminal identified as being predicted to be damaged by the virus infection. You may comprise as follows.

  The above-described system can be configured by causing a computer terminal to read and execute the program of the present invention. That is, a computer terminal that stores operation log information of a client terminal in a storage device is stored in a virus detection information acquisition unit that acquires virus detection information indicating that a virus has been detected from the client terminal, and is stored in the client terminal that has detected the virus. A virus damage range prediction program that functions as a damage range prediction processing unit that predicts a damage range of a virus infection by identifying a client terminal that has accessed a file based on operation log information stored in the storage device You may comprise.

  Furthermore, the above-described system can be configured by causing a computer terminal to read and execute the program of the present invention. That is, a computer terminal that stores operation log information of a client terminal in a storage device is accessed by a virus detection information acquisition unit that acquires virus detection information indicating that a virus has been detected from the client terminal, or a client terminal that has detected the virus Like a virus damage range prediction program that functions as a damage range prediction processing unit that predicts the damage range of a virus infection by specifying the client terminal that accessed the file based on the operation log information stored in the storage device It may be configured.

By using the virus damage range prediction system of the present invention, it is not simply specified the infection route as in the past, but it is specified whether there are other computer terminals that are likely to be infected with the virus. It is possible to predict the range and block the network connection of computer terminals within the range. As a result, it is possible to prevent the damage from spreading and to maintain the network connection of the computer terminal not infected with the virus as it is. Therefore, there will be no significant hindrance to daily work.

  An overall conceptual diagram of the virus damage range prediction system 1 of the present invention is shown in FIG. A conceptual diagram of an example of the system configuration of the virus damage range prediction system 1 is shown in FIG.

  The virus damage range prediction system 1 of the present invention is configured by processing a predetermined program or module in a computer terminal or server (hereinafter referred to as “management server 2”) used by an administrator who monitors each client terminal 4. Realized. The management server 2 preferably records and monitors what files and programs are executed in the plurality of client terminals 4. Therefore, each client terminal 4 is provided with information such as the program name and file name executed in the client terminal 4 periodically, or when a new program or file is executed or terminated. It is preferable to have a function of transmitting information on the program name and file name from the client terminal 4 to the management server 2 at the timing. The function of transmitting program name and file name information can be obtained by extracting the program name and file name being executed by the arithmetic unit 20 of the client terminal 4 or extracting and transmitting the program name and file name in the memory. Good. That is, so-called operation log information may be transmitted from the client terminal 4 to the management server 2.

  In addition, the client terminal 4 includes a storage device such as a USB memory at regular or predetermined timing (for example, when receiving e-mail or browsing a website with a web browser, or when receiving some data via a network) And a virus detection function that scans for viruses in the client terminal 4). Various known products can be applied to this virus detection function.

  In the present specification, the term “client terminal 4” includes “file server” in addition to a computer terminal operated by a user.

  The administrator terminal 3 is a computer terminal used by a system administrator who uses the management server 2, receives a predetermined notification from the management server 2, and transmits some control instruction to the management server 2. May be possible. The administrator terminal 3 may be provided integrally with the management server 2, or may be provided as a separate computer terminal.

  The management server 2, the client terminal 4, and the administrator terminal 3 include a calculation device 20 such as a CPU that executes program calculation processing, a storage device 21 such as a RAM or a hard disk that stores information, and processing results of the calculation device 20. And a communication device 24 that transmits and receives information stored in the storage device 21 via a network such as the Internet or a LAN. Further, the client terminal 4 and the administrator terminal 3 further have a display device 22 such as a display. Each function (each unit) realized on the computer is executed when a unit (program, module, etc.) for executing the process is read into the arithmetic unit 20. When using the information stored in the storage device 21 in the processing, each function reads the corresponding information from the storage device 21 and uses the read information for processing in the arithmetic device 20 as appropriate. The computer may include an input device 23 such as a keyboard, a mouse, or a numeric keypad. FIG. 3 schematically shows an example of the hardware configuration of the management server 2. Further, the management server 2 may have its functions distributed in a plurality of computer terminals or servers.

  Each means in the present invention is only logically distinguished in function, and may be physically or practically the same area.

  The virus damage range prediction system 1 includes an operation log information acquisition unit 5, an operation log information storage unit 6, a file information acquisition unit 7, a file information storage unit 8, a virus detection information acquisition unit 9, a damage range prediction processing unit 10, and a network connection. And a blocking processing unit 11.

  The operation log information acquisition unit 5 acquires operation log information in the client terminal 4 from each client terminal 4 regularly or irregularly. The acquired operation log information is stored in an operation log information storage unit 6 (to be described later) together with the date and time and information for identifying which client terminal 4 is the operation log information. The operation log information may be information indicating the operation content in each client terminal 4 and the processing content in the client terminal 4, for example, the client such as “file copy”, “file selection”, “file access”, etc. This corresponds to information indicating the operation of the operator of the terminal 4. Further, when the management server 2 acquires operation log information from each client terminal 4, it may be acquired via a network, or the operation log information is recorded on a recording medium such as a DVD in the client terminal 4, and the recording is performed. The medium may be read by the management server 2 and read by reading operation log information therefrom.

  The operation log information storage unit 6 stores the operation log information acquired from each client terminal 4 by the operation log information acquisition unit 5. The operation log information includes information for identifying the client terminal 4, information indicating the operation content, the name of the file or application that is the operation target of the operation content, information indicating the location of the file or application, date and time, and numerical values. Information is included. FIG. 6 shows an example of operation log information. The operation log information is preferably stored for each client terminal 4 or for each user (login name or the like). In addition, when associating the information indicating the operation content with the date and time, it may be performed at the client terminal 4, may be performed when the operation log information is acquired by the management server 2, or an operation log information storage unit This may be done when storing in step 6. FIG. 7 schematically shows an example of a conceptual diagram of the operation log information storage unit 6.

  The file information acquisition unit 7 acquires the file information stored in each client terminal 4 or the like from the client terminal 4 or the like and stores it in the file information storage unit 8 described later.

  This may be done by periodically inquiring each client terminal 4 about information such as file identification information (file name, etc.) and storage location of the file stored in them, and obtaining the result. In addition, if the operation log information in the operation log information acquisition unit 5 or the operation log information storage unit 6 is monitored and the operation content is operation log information including “file creation”, the file name and storage location Is stored in the file information storage unit 8 to be described later. Furthermore, when the operation content is “change file name” or the like, the file name may be changed based on the file name (the file name before and after the change) and the storage location information, or “delete file”. In this case, the file name may be deleted based on the file name and the storage location information. Furthermore, in the case of “paste file”, the operation log information whose operation content is “file copy” (operation log information corresponding to “paste file”) is identified, the file name and “paste file” The file information may be stored in the file information storage unit 8 based on the storage location information.

  That is, the file information acquisition unit 7 stores the file information stored in each client terminal 4 and the like, at least the file information stored in the client terminal 4 infected with the virus, in the file information storage unit 8 by various methods. Just do it.

  The file information storage unit 8 stores file information stored in each client terminal 4. As this file information, at least file identification information is preferably stored for each client terminal 4 storing the file. In addition to the file identification information, the date and time when the file was created may be stored. FIG. 8 schematically shows an example of a conceptual diagram of the file information storage unit 8.

  The file information acquisition unit 7 and the file information storage unit 8 are not provided in the virus damage range prediction system 1, but are stored in the client terminal 4 after the virus detection information acquisition unit 9 described later acquires virus detection information. The file information that has been stored may be acquired.

  The virus detection information acquisition unit 9 acquires virus detection information when a virus is detected by the client terminal 4. The virus detection information includes a notification that a virus has been detected and client terminal identification information that identifies which client terminal 4 has detected the virus. In some cases, information on detection date and time, file identification information of a file in which virus infection is detected, and the like may be included.

  When the virus detection information acquisition unit 9 acquires the virus detection information, the damage range prediction processing unit 10 predicts a client terminal 4 that may be infected by another client terminal 4 other than the virus-infected client terminal 4. In other words, the damage range of virus infection is predicted. The damage range prediction processing unit 10 includes a file specifying unit 101 and a terminal specifying unit 102.

  The file specifying unit 101 specifies a file stored in the virus infected client terminal 4 or a file accessed by the virus infected client terminal 4.

  First, in the former case (first method), since identification information of the client terminal 4 infected with the virus is acquired based on the virus detection information acquired by the virus detection information acquisition unit 9, the client terminal identification information is used. Thus, the file identification information of the file stored in the client terminal 4 infected with the virus is specified from the file information storage unit 8. That is, the file information storage unit 8 is searched based on the client terminal identification information of the client terminal 4 infected with the virus, and the file identification information stored in the client terminal 4 is specified.

  In the latter case (second method), since the identification information of the client terminal 4 infected with the virus is acquired based on the virus detection information acquired by the virus detection information acquisition unit 9, the client terminal identification information is used. Then, the file identification information of the file accessed by the client terminal 4 infected with the virus is specified from the operation log information storage unit 6. That is, the operation log information storage unit 6 is searched based on the client terminal identification information of the client terminal 4 infected with the virus, and the operation log information including the client terminal identification information and the operation content indicating “file access” is specified. By extracting the file identification information from the identified operation log information, the file identification information accessed by the client terminal 4 and the storage location of the file are identified. In this case, it is preferable to search operation log information from the operation to a certain period before. Although the fixed period can be set arbitrarily, for example, the virus scanning timing interval by the virus detection function in the client terminal 4 (if virus scanning is performed every three days, the fixed period is three days, or the previous virus scan. May be set later, or may be set as appropriate, such as 24 hours, 48 hours, 72 hours, or the like.

  The terminal specifying unit 102 specifies the identification information of another client terminal 4 that has accessed the file identification information file specified by the file specifying unit 101 within a predetermined time based on the operation log information storage unit 6.

  For example, when the file identification unit 101 uses the first method, the identification information of the client terminal 4 infected with the virus is “ABC12345678”, and the file identification information of the file stored therein is “AAAAAAA”. It is assumed that “BBBBBBBB”, “CCCCCCC”, and “DDDDDDD”. In this case, if the operation log information stored in the operation log information storage unit 6 is FIG. 7 and the operation log information up to a predetermined period (for example, 72 hours before) is to be processed, the file identification information “AAAAAAA”, “BBBBBBBB” ”,“ CCCCCCCC ”, and“ DDDDDDDD ”, the client terminal 4 other than the client terminal identification information“ ABC12345678 ”is identified based on the operation log information. This is, for example, the operation content indicating “file access” in the operation log information up to 72 hours ago, and is one of the file identification information “AAAAAAA”, “BBBBBBB”, “CCCCCCCC”, “DDDDDDD”. The operation log information whose identification information “ABC12345678” is the identification information “ABC12345678” of the virus-infected client terminal 4 is stored, and the client terminal identification information of the specified operation log information is extracted. This process is shown in FIG.

  Therefore, in the case of FIG. 9, it is predicted that the client terminal 4 whose client terminal identification information is “DEF33334444”, “GHI45698733”, “SDF123332111”, “YUI4565444” is the damage range of virus infection.

  It is not specified by the file identification information, but by searching operation log information up to a predetermined period based on the client terminal identification information of the client terminal 4 infected with the virus and the operation content indicating “file access”, You may comprise so that the other client terminal 4 which accessed them may be specified.

  In addition, when the second method is used in the file specifying unit 101, the identification information of the client terminal 4 infected with the virus is “ABC12345678”, and the file identification information of the file accessed by the client terminal 4 within a certain period of time. Are “AAAAAAA” (storage location “client terminal ABC12345678”), “BBBBBBBB” (storage location “File server3”), “CCCCCCCC” (storage location “File server4”), “DDDDDDDD” (storage location “File server2”) Suppose there was. In this case, if the operation log information stored in the operation log information storage unit 6 is FIG. 10 and the operation log information up to a predetermined period (for example, 72 hours before) is to be processed, “AAAAAAA” (storage location “client terminal” ABC12345678 ”),“ BBBBBBBB ”(storage location“ File server3 ”),“ CCCCCCCC ”(storage location“ File server4 ”),“ DDDDDD ”(storage location“ File server2 ”) other than client terminal identification information“ ABC123345678 ” The client terminal 4 is specified based on the operation log information. This is the operation content indicating “file access” in the operation log information up to 72 hours ago, for example, file identification information “AAAAAAA” (storage location “client terminal ABC12345678”), “BBBBBBBB” (storage location “File” server3 ”),“ CCCCCCCC ”(storage location“ File server4 ”), or“ DDDDDDD ”(storage location“ File server2 ”), and the file storage location accessed by the virus-infected client terminal 4 The operation log information, which is the storage location, is specified, and the client terminal identification information of the specified operation log information is extracted. This process is shown in FIG.

  Therefore, in the case of FIG. 11, it is predicted that each client terminal 4 whose client terminal identification information is “DEF333334444”, “GHI45698733”, “SDF12333211”, and “YUI4565444” is the damage range of virus infection.

  In the damage range prediction processing unit 10, either the first method or the second method may be used, or both may be used.

  Further, the damage range prediction processing unit 10 may not use both the file specifying unit 101 and the terminal specifying unit 102. In other words, the damage range prediction processing unit 10 specifies the file stored in the virus-infected client terminal 4 by the first method in the file specifying unit 101 described above, or the virus-infected client by the second method. The file accessed by the terminal is specified. At this time, the file is specified by the operation log information. The operation log information also stores information on the storage location of the file. Therefore, it is possible to identify the client terminal 4 that may be infected with the virus based on the information on the storage location of the file. In this case, since the processing of the file specifying unit 101 and the terminal specifying unit 102 is substantially performed in one process, the processing can be simplified.

  The network connection cut-off processing unit 11 cuts off the network connection of the client terminal 4 predicted by the damage range prediction processing unit 10 as a virus infection damage range. For example, a control instruction for blocking the network connection is transmitted to the client terminal 4 having the predicted client terminal identification information. As a method for blocking the network connection, the client terminal 4 cannot be recognized in the network by impersonating an ARP (address resolution protocol) response packet that stops the operation of the network driver of the client terminal 4. There are methods such as forcibly giving up the address and stopping the assignment of the IP address. In addition, from the predicted client terminal 4 to the client terminal 4 predicted to be free of virus infection (the client terminal 4 other than the client terminal 4 of the client terminal identification information predicted by the damage range prediction processing unit 10). The client terminal 4 predicted by the damage range prediction processing unit 10 is forcibly logged off from the currently participating domain to the DNS server that transmits a control instruction for rejecting all network connection requests. It can also be performed by transmitting a control instruction for disabling.

  When the network connection is cut off, the network connection cut-off processing unit 11 may notify the administrator terminal 3 that the cut-off client terminal 4 has been cut off.

  For each client terminal 4 that has been disconnected from the network, the network connection can be restored by a predetermined control instruction from the administrator terminal 3 of the system administrator after completion of virus infection confirmation, virus removal processing, and the like. It is preferable to make it.

  Next, an example of the processing process of the virus damage range prediction system 1 of the present invention will be described with reference to the flowcharts of FIGS. 4 and 5 and the conceptual diagram of FIG.

  The operation log information of the client terminal 4 is transmitted from each client terminal 4 to the management server 2 periodically or at a predetermined timing. The operation log information is acquired by the operation log information acquisition unit 5.

  The operation log information acquired by the operation log information acquisition unit 5 is stored in the operation log information storage unit 6. In general, the operation log information includes information for identifying the client terminal 4 and date and time information. If the operation log information is not included, the operation log information is acquired together. And store them in the operation log information storage unit 6 in association with each other.

  Each client terminal 4 executes a virus scan process using a virus detection function periodically or at a predetermined timing. In this virus scanning process, when any virus is detected (S100), the client terminal 4 sends information indicating that a virus has been detected and identification information of the client terminal 4 to the management server 2. The included virus detection information is transmitted (S110).

  This virus detection information is acquired by the virus detection information acquisition unit 9 of the management server 2. Then, the file specifying unit 101 of the damage range prediction processing unit 10 specifies the file identification information of the file stored in the client terminal 4 infected with the virus by the above-described first method, or the above-described second method. By the method, the file identification information of the file accessed by the client terminal 4 infected with the virus is specified (S120).

  The terminal identification unit 102 of the damage range prediction processing unit 10 stores the identification information of the client terminal 4 other than the client terminal 4 infected with the virus that has accessed the file of the file identification information identified by the file identification unit 101, and stores the operation log information. It specifies based on the operation log information memorize | stored in the part 6 (S130).

  Since the client terminal 4 of the client terminal identification information specified in this way is a client terminal 4 that is predicted to be damaged by virus infection, the network connection cutoff processing unit 11 uses the client terminal identification information specified by the terminal specification unit 102. The client terminal 4 is controlled to block the network connection (S140). For example, a control instruction for cutting off the network connection is transmitted to the specified client terminal 4, a control instruction for forced logoff from the domain of the client terminal 4 is transmitted to the DNS server, or the specified client terminal For example, a control instruction for rejecting the network connection from the identified client terminal 4 is transmitted to the client terminals 4 other than 4.

  By executing the processing as described above, not only the client terminal 4 that has detected the virus infection but also the other client terminals 4 that are predicted to be damaged can be quickly disconnected from the network. On the other hand, as for the client terminal 4 whose damage is not predicted, since the network connection is maintained as it is, the daily work is not hindered.

  In the above-described embodiment, the case where part or all of the processing is executed in the management server 2 has been described. However, these functions are appropriately distributed in the client terminal 4, the management server 2, and the administrator terminal 3. Also good.

  Note that there are various patterns of variations in the distributed arrangement, and any arrangement form may be used. In these cases, when each function of the management server 2 is used at the time of processing in each client terminal 4 or the administrator terminal 3, the inquiry is sent from the client terminal 4 or the administrator terminal 3 to the management server 2. The result is used for processing in the client terminal 4 and the administrator terminal 3. The processing result is executed by the client terminal 4 or the administrator terminal 3.

  Each function described above may be provided in the client terminal 4. That is, the operation log information acquisition unit 5, the operation log information storage unit 6, the file information acquisition unit 7, the file information storage unit 8, the virus detection information acquisition unit 9, the damage range prediction processing unit 10, and the network connection cutoff processing unit 11 are connected to the client terminal. 4 may be provided.

  In this case, when the other client terminal 4 is infected with a virus, the client terminal 4 acquires the information by the virus detection information acquisition unit 9. Then, the damage range prediction processing unit 10 executes the processing of each of the above-described embodiments, so that the client terminal 4 accesses the client terminal 4 infected with the virus (the client terminal 4 that transmitted the virus detection information). Determine. If the client terminal 4 is accessing the virus-infected client terminal 4, the client terminal 4 may also be infected with the virus. A control process for blocking the network connection is executed, or a control instruction for blocking the network connection is transmitted to another client terminal 4 or a predetermined server. The other client terminal 4 or the predetermined server that has received this control instruction executes processing such as blocking the network connection with the client terminal 4 that is predicted to be infected with the virus or rejecting the network connection request in accordance with the control instruction. To do.

  Further, when the client terminal 4 is provided with the above functions, the terminal itself may be infected with a virus (when a virus is detected by the terminal itself). In this case, the damage range prediction processing unit 10 determines the other client terminals 4 that have accessed the client terminal 4 by executing the processes of the above-described embodiments. Then, a control for transmitting a notification that a virus infection is predicted to the client terminal 4 or a predetermined server where a virus infection is predicted, or for executing a network connection blocking process by the network connection blocking processing unit 11. Send instructions.

  As a result, even when the client terminal 4 is infected with a virus, it is possible to determine that another client terminal 4 that has accessed the terminal is predicted to be infected with the virus, and take action.

By using each of the above-mentioned inventions, the infection route is not simply identified as in the past, but it is identified whether there are other computer terminals that are likely to be infected with the virus, that is, the damage range is predicted. The network connection of the computer terminal within the range can be cut off. As a result, the expansion of damage can be prevented for the time being, and the network connection of the computer terminal not infected with the virus can be maintained as it is. Therefore, there will be no significant hindrance to daily work.

It is a conceptual diagram which shows the whole concept of this invention. It is a conceptual diagram which shows an example of the system configuration | structure of this invention. It is a conceptual diagram which shows an example of a hardware configuration. It is a flowchart which shows an example of the whole processing process of this invention. It is a flowchart which shows an example of the processing process which estimates the damage range of virus infection. It is a figure which shows an example of operation log information typically. It is a figure which shows an example of an operation log information storage part typically. It is a figure which shows an example of a file information storage part typically. It is a figure which shows typically the 1st method in a file specific | specification part. It is a figure which shows typically another example of the operation log information storage part. It is a figure which shows the 2nd method in a file specific part typically.

Explanation of symbols

1: Virus damage range prediction system 2: Management server 3: Administrator terminal 4: Client terminal 5: Operation log information acquisition unit 6: Operation log information storage unit 7: File information acquisition unit 8: File information storage unit 9: Virus detection Information acquisition unit 10: Damage range prediction processing unit 101: File identification unit 102: Terminal identification unit 11: Network connection cutoff processing unit 20: Computing device 21: Storage device 22: Display device 23: Input device 24: Communication device

Claims (10)

A virus damage range prediction system for predicting the damage range due to computer virus infection,
The virus damage range prediction system is:
An operation log information storage unit for storing operation log information of the client terminal;
A virus detection information acquisition unit for acquiring virus detection information indicating that a virus has been detected from a client terminal;
A damage range prediction processing unit for predicting a damage range of a virus infection by identifying a client terminal that has accessed a file stored in the client terminal that has detected the virus based on the operation log information;
A virus damage range prediction system characterized by comprising: The damage range prediction processing unit
Based on the client terminal identification information of the infected client terminal and the operation content indicating file access, search the operation log information stored in the operation log information storage unit,
By identifying the client terminal identification information of the operation log information specified by the search, the client terminal that has accessed the file stored in the infected client terminal is specified.
The virus damage range prediction system according to claim 1. A virus damage range prediction system for predicting the damage range due to computer virus infection,
The virus damage range prediction system is:
An operation log information storage unit for storing operation log information of the client terminal;
A file information storage unit storing at least file identification information of a file stored in the client terminal;
A virus detection information acquisition unit for acquiring virus detection information indicating that a virus has been detected from a client terminal;
Upon obtaining the virus detection information, a file specifying unit for specifying a file stored in the client terminal based on the file information storage unit,
A terminal identifying unit that predicts a damage range of a virus infection by identifying a client terminal that has accessed the file identified by the file identifying unit based on operation log information stored in the operation log information storage unit;
A virus damage range prediction system characterized by comprising: The file specifying unit
When the virus detection information is acquired, based on the client terminal identification information of the virus detection information, the file identification information of the file stored in the client terminal is specified from the file information storage unit,
The terminal specifying unit
Based on the file identification information specified by the file specifying unit and the operation content indicating file access, search operation log information stored in the operation log information storage unit,
By identifying the client terminal identification information of the operation log information specified by the search, the client terminal that has accessed the file stored in the infected client terminal is specified.
The virus damage range prediction system according to claim 3. A virus damage range prediction system for predicting the damage range due to computer virus infection,
The virus damage range prediction system is:
An operation log information storage unit for storing operation log information of each client terminal;
A virus detection information acquisition unit for acquiring virus detection information indicating that a virus has been detected from a client terminal;
A damage range prediction processing unit for predicting a damage range of virus infection by identifying the accessed client terminal based on the operation log information in a file accessed by the client terminal that has detected the virus;
A virus damage range prediction system characterized by comprising: A virus damage range prediction system for predicting the damage range due to computer virus infection,
The virus damage range prediction system is:
An operation log information storage unit for storing operation log information of the client terminal;
A virus detection information acquisition unit for acquiring virus detection information indicating that a virus has been detected from a client terminal;
When acquiring the virus detection information, a file specifying unit for specifying a file accessed by the client terminal based on operation log information stored in the operation log information storage unit;
A terminal identifying unit that predicts a damage range of a virus infection by identifying a client terminal that has accessed the file identified by the file identifying unit based on operation log information stored in the operation log information storage unit;
A virus damage range prediction system characterized by comprising: The file specifying unit
When acquiring the virus detection information, based on the client terminal identification information of the virus detection information and the operation content indicating the file access, the file identification information of the file accessed by the client terminal and the storage location information are Based on the operation log information stored in the operation log information storage unit,
The terminal specifying unit
Based on the file identification information specified in the file specifying unit, the information on the storage location and the operation content indicating the file access, search the operation log information stored in the operation log information storage unit,
By identifying the client terminal identification information of the operation log information specified by the search, the client terminal that has accessed the file stored in the infected client terminal is specified.
The virus damage range prediction system according to claim 6. The virus damage range prediction system further includes:
A network connection blocking processing unit for performing a network connection blocking process on the client terminal identified as being predicted to be damaged by the virus infection;
The virus damage range prediction system according to any one of claims 1 to 7, characterized by comprising: A computer terminal for storing operation log information of a client terminal in a storage device,
A virus detection information acquisition unit for acquiring virus detection information indicating that a virus has been detected from the client terminal;
A damage range prediction processing unit that performs damage range prediction of virus infection by specifying a client terminal that has accessed a file stored in the client terminal that has detected the virus based on operation log information stored in the storage device,
Virus damage range prediction program characterized by functioning as A computer terminal for storing operation log information of a client terminal in a storage device,
A virus detection information acquisition unit for acquiring virus detection information indicating that a virus has been detected from the client terminal;
A damage range prediction processing unit for predicting a damage range of a virus infection by specifying the accessed client terminal based on operation log information stored in the storage device in a file accessed by the client terminal that has detected the virus,
Virus damage range prediction program characterized by functioning as

Images