JP5334739B2 - Log monitoring program, log monitoring system - Google Patents

Description

  The present invention relates to a technique for monitoring a log of operations performed on a computer by a user.

  2. Description of the Related Art Conventionally, a technique has been developed that monitors a log of an operation performed by a user on a computer and detects or prevents an illegal information leakage action. In such a technique, a log of operations performed by a user on a computer is collected, and the contents of the log are analyzed to identify an illegal act.

  However, even if logs are collected, it is not efficient in terms of personnel costs and time costs for system administrators to perform daily log analysis in real time. Moreover, in an environment where a server that specializes in log analysis is not prepared and individual logs are checked by a system administrator or the like, log management tends to be neglected. If log management is neglected, there is a concern that the traceability of fraud is interrupted and preventive measures for preventing recurrence cannot be fully implemented.

  On the other hand, the log management server may not be able to collect logs due to trouble with the log management server or an unauthorized person intentionally disconnecting communication with the log management server. In this case, since the fraudster can conceal the log, it may be difficult to trace the fraud.

  In the following Patent Document 1, as described above, even in an environment where communication with the log management server is interrupted, log collection is continued on the client side, and when the communication is recovered, the log management server collects logs collectively. Techniques to do this are disclosed.

JP 2008-147717 A

  In the technique described in Patent Document 1, when a log cannot be transmitted to the server side, a print job is once accepted, and the log is transmitted to the server side again when communication is resumed later. In the technique described in Patent Document 1, logs are collected while communication with the server is interrupted, but log analysis is performed after communication is recovered. Therefore, there is a time lag between the user action and the log check, and there is a concern that the security monitoring level is lowered during that time.

  The present invention has been made to solve the above-described problems, and suppresses fraud while allowing the user to continue operation even when communication with the log management server is interrupted. An object of the present invention is to provide a log monitoring technique that can be used.

  The log monitoring program according to the present invention transmits the collected logs to a predetermined folder and deletes the transmitted logs. When the log size exceeds a predetermined threshold, a user operation for which a log is to be acquired is prohibited.

  According to the log monitoring program of the present invention, the user can continue the operation while the log can be transmitted to the predetermined folder and deleted. Further, even when the predetermined folder cannot be accessed because communication is temporarily interrupted, the user can continue the operation until the log size reaches a predetermined threshold. If the user intentionally prevents log transmission for a long time and the log size exceeds a predetermined threshold, the user will not be able to perform an operation, so it will deter the intentional log concealment act. can do.

1 is a configuration diagram of a log monitoring system 1000 according to Embodiment 1. FIG. It is a figure which shows the structure of audit log 122, and an example of data. 5 is an operation flow for explaining the operation of the log monitoring system 1000. It is a figure which shows an example of the email which the log monitoring program 121 transmits to a system administrator by step S302 of FIG. 6 is a configuration diagram of a log monitoring system 1000 according to Embodiment 2. FIG. It is a figure which shows the structural example of the shaping log. 10 is an operation flow for explaining the operation of the log monitoring system 1000 according to the third embodiment. 10 is an operation flow for explaining the operation of the log monitoring system 1000 according to the fifth embodiment.

<Embodiment 1>
FIG. 1 is a configuration diagram of a log monitoring system 1000 according to Embodiment 1 of the present invention. The log monitoring system 1000 includes a client terminal 100 and a log storage server 200. The client terminal 100 and the log storage server 200 are connected via a network 300.

  The client terminal 100 is a computer for a user to perform work, and includes a calculation unit 110 and a storage unit 120.

  The calculation unit 110 is a calculation device such as a CPU (Central Processing Unit). In addition to controlling the operation of the client terminal 100, the arithmetic device 110 acquires a log of operations to be monitored among operations performed by the user on the client terminal 100 as the audit log 122 and stores it in the storage unit 120. In addition, the log monitoring program 121 is executed to monitor the log. In the following description, for convenience of description, the log monitoring program 121 may be described as an operating entity related to log monitoring, but it is added that the actual operating entity is the arithmetic unit 110.

  If Windows (registered trademark) is used as the OS (operating system) of the client terminal 100, the audit log 122 can be acquired as an OS standard function. When using another OS, a similar function may be validated or a log acquisition program having a similar function may be installed in the client terminal 100 so that a log equivalent to the audit log 122 can be acquired. .

  The storage unit 120 includes a writable storage device such as an HDD (Hard Disk Drive), and stores a log monitoring program 121 and an audit log 122.

  The log monitoring program 121 is a software program that defines the operation of the arithmetic unit 110 related to log monitoring processing. The log monitoring program 121 collects the audit log 122 and uploads (transmits) it to the shared folder 221 of the log storage server 200. At that time, it is checked whether there is a log of fraud in accordance with a predetermined rule, and if it exists, the fact is notified to the system administrator. This will be described again with reference to FIGS.

  The audit log 122 has a configuration described in FIG. The calculation unit 110 does not necessarily need to record all user operations in the audit log 122, and may record the log only for access to important files.

The log storage server 200 is a server for uploading logs collected by the log monitoring program 121, and includes a calculation unit 210 and a storage unit 220.
The calculation unit 210 is a calculation device such as a CPU, and controls the operation of the log storage server 200.

  The storage unit 220 includes a writable storage device such as an HDD, and includes a shared folder 221. The shared folder 221 is a file folder for uploading logs collected by the log monitoring program 121. The path of the shared folder 221 is not disclosed to the user of the client terminal 100. Furthermore, a “hidden folder” attribute may be added.

  FIG. 2 is a diagram illustrating a configuration of the audit log 122 and data examples. The computing unit 110 of the client terminal 100 monitors a predetermined operation performed by the user and records the monitoring result in the audit log 122.

  In the example of FIG. 2, the audit log 122 records access to a predetermined shared secret folder and a control medium (such as a CD-ROM drive). In addition, the date and time of access, the name of the accessed user, the name of the accessed computer, the address of the accessed computer, etc. are also recorded. The content to be recorded in the audit log 122 is not limited to these, and any item may be used as long as the user's operation can be monitored.

  The configuration of the log monitoring system 1000 has been described above. Next, an operation in which the log monitoring system 1000 monitors user operations will be described.

  FIG. 3 is an operation flow for explaining the operation of the log monitoring system 1000. Hereinafter, each step of FIG. 3 will be described.

(FIG. 3: Step S301)
The user of the client terminal 100 performs operations such as file creation on the client terminal 100. If the operation is to be recorded in the audit log 122, the computing unit 110 records the content of the operation in the audit log 122. At this time, the arithmetic unit 110 appropriately sets the access authority for the audit log 122 so that the user of the client terminal 100 cannot modify the audit log 122.

(FIG. 3: Step S302)
The log monitoring program 121 collects the audit log 122 at a predetermined time interval or when the user of the client terminal 100 instructs, and uploads it to the shared folder 221. As the communication protocol at this time, for example, FTP (File Transfer Protocol), NetBEUI, or the like can be used. The path (address on the network) of the shared folder 221 is embedded in the log monitoring program 121 or set by a system administrator or the like when the log monitoring program 121 is installed in the client terminal 100 and stored in the storage unit 120. Keep it.

(FIG. 3: Step S302: Supplement 1)
In this step, when uploading the collected audit log 122 to the shared folder 221, the log monitoring program 121 extracts a log of an operation that may correspond to an illegal act based on a predetermined rule. For example, a method of extracting a record of the audit log 122 including a keyword (access target: external HDD, file operation: storage, etc.) related to an action that may cause information leakage may be considered. This rule is set by, for example, a system administrator when the log monitoring program 121 is installed in the client terminal 100, and a file describing the rule is stored in the storage unit 120.

(FIG. 3: Step S302: Supplement 2)
When the collected audit log 122 includes a log of an act corresponding to an illegal act, the log monitoring program 121 sends an e-mail as described later with reference to FIG. This is notified, for example, by sending to the destination. Other notification methods include, for example, displaying a dialog screen on the management terminal and outputting a log.

(FIG. 3: Step S303)
The log monitoring program 121 deletes from the storage unit 120 the audit log 122 that has been uploaded to the shared folder 221 in step S302.

(FIG. 3: Step S303: Supplement)
In step S302, when the network connection between the client terminal 100 and the log storage server 200 is interrupted or when the log storage server 200 is down, the log monitoring program 121 transfers the audit log 122 to the shared folder 221. I can't upload. In this case, the log monitoring program 121 stops uploading the audit log 122. Further, since the upload could not be performed, the deletion of the amount from the storage unit 120 is also stopped.

(FIG. 3: Step S304)
The log monitoring program 121 checks whether the size of the audit log 122 has reached a predetermined threshold value. If the threshold value has not been reached, the process returns to step S301 and the same procedure is repeated. If the threshold is reached, the process proceeds to the next step S305. This threshold is set by a system administrator or the like when the log monitoring program 121 is installed in the client terminal 100, for example, and a file describing the rule is stored in the storage unit 120.

(FIG. 3: Step S305)
The log monitoring program 121 prohibits user operations that are targets for recording the audit log 122. Specifically, a means for revoking access authority to the corresponding file, folder, control medium, etc. from the user is used. As a result, the user is prompted to upload the audit log 122 to the shared folder 221 regularly, and therefore, an effect of psychologically suppressing fraud can be exhibited.

  FIG. 4 is a diagram showing an example of an e-mail that the log monitoring program 121 transmits to the system administrator in step S302 of FIG. This e-mail describes the contents of the user operation extracted in step S302 and a message that prompts the user to confirm whether or not the system administrator really permits the operation.

  The operation of the log monitoring system 1000 has been described above. Next, a procedure in which the system administrator audits fraud using the audit log 122 uploaded to the shared folder 221 will be described in the following (Step 1) to (Step 3).

(Procedure for audit of fraud: Step 1)
The system administrator receives the e-mail described with reference to FIG. 4 and confirms the described message. From the message, the system administrator knows the action performed by the user, the user name, the access target, the date and time, and the like.

(Procedure for audit of fraud: Step 2)
The system administrator confirms whether or not the user has access authority for the access target grasped in step 1. If the operation is based on a legitimate access authority, this audit procedure is terminated. If it is determined that the operation is not based on a legitimate access authority, or is an operation that is not normally performed, the process proceeds to the next step 3.

(Injustice audit procedure: Step 3)
The system administrator uses the e-mail described in FIG. 4 and, if necessary, the audit log 122 stored in the shared folder 221 to identify a user who may have performed a fraudulent action, and conduct an interview survey. To do.

  The procedure for the system administrator to audit fraud using the audit log 122 uploaded to the shared folder 221 has been described above. In addition, it is possible to audit fraud by comparing the audit log 122 stored in the client terminal 100 with the audit log 122 uploaded to the shared folder 221. The procedure will be described in the following (Step 1) to (Step 3).

(Audit Procedure II: Step 1)
The system administrator requests the user who uses the client terminal 100 to submit the audit log 122, for example, when it is determined that an illegal act has occurred. This is because there is a possibility that a person who has performed an illegal act has deleted the corresponding record in the audit log 122.

(Injustice audit procedure # 2: Step 2)
The system administrator compares the audit log 122 submitted by the user with the audit log 122 stored in the shared folder 221. The comparison operation itself may be performed using appropriate file comparison software.

(Injustice audit procedure 2: Step 3)
When the audit log 122 submitted by the user is different from the audit log 122 stored in the shared folder 221, the system administrator inquires of the user who has performed the operation of the different part. As a result, it is possible to prevent and detect that an unauthorized person deletes the audit log 122 illegally.

  As described above, according to the first embodiment, the log monitoring program 121 uploads the audit log 122 to the shared folder 221 and deletes the uploaded audit log 122. As a result, the system administrator can compare the audit log uploaded to the shared folder 221 and the audit log 122 on the client terminal 100 to find signs of fraud and improve security. it can.

  Further, according to the first embodiment, the log monitoring program 121 is the user who is the target of acquiring the audit log 122 when the size of the audit log 122 stored in the storage unit 120 exceeds a predetermined threshold. Prohibit operation. Accordingly, the user is regularly prompted to submit the audit log 122 to the system administrator, and this has the effect of psychologically suppressing the act of illegally deleting or modifying the audit log 122.

  Further, according to the first embodiment, when uploading the audit log 122 to the shared folder 221, the log monitoring program 121 extracts a user operation record that matches a predetermined rule, and sends an e-mail to the system administrator. Notify at. The system administrator does not need to check all the audit logs 122 and only needs to check the log records described in the e-mail. As a result, the burden on the system administrator can be reduced.

  Further, according to the first embodiment, the log storage server 200 does not need a special function, and it is sufficient to simply provide the shared folder 221 to which an appropriate access authority is given. Thereby, the log storage server 200 can be configured easily and inexpensively, which is advantageous from the viewpoint of the construction period and cost of the log monitoring system 1000.

<Embodiment 2>
In the second embodiment of the present invention, an operation example of shaping the audit log 122 when uploading the audit log 122 to the shared folder 221 will be described. Since the other configuration is the same as that of the first embodiment, the following description will focus on the differences.

  FIG. 5 is a configuration diagram of the log monitoring system 1000 according to the second embodiment. In the second embodiment, the log monitoring program 121 does not upload the collected audit log 122 to the shared folder 221 as it is, but formats it as a formatted log 123. The log monitoring program 121 uploads the shaping log 123 to the shared folder 221.

  FIG. 6 is a diagram illustrating a configuration example of the shaping log 123. For comparison, configurations related to before and after shaping are also shown. 6A shows the configuration of the audit log 122 before shaping, and FIGS. 6B to 6D show the configuration of the shaping log 123 obtained by shaping the audit log 122. FIG. Here, an example in which the MAC address having high uniqueness is used as a key is shown.

  FIGS. 6B to 6D show examples in which audit logs 122 having common properties are cut out and configured as a user table, a date / time table, and an operation table, respectively.

  As shown in FIG. 6, when the audit log 122 is formatted using a predetermined log item as a key, an item that overlaps between the tables may occur, and thus the data size generally increases. However, since the search target items can be narrowed down, the log analysis processing can be speeded up. For example, if it is desired to extract the audit log 122 relating to a specific user name, only the user table shown in FIG.

  As described above, according to the second embodiment, the log monitoring program 121 performs the shaping process when uploading the audit log 122 to the shared folder 221. Thereby, since the audit log uploaded to the shared folder 221 is the one after shaping, the log analysis process can be performed at high speed, and the burden on the system administrator when auditing can be reduced.

<Embodiment 3>
In the first embodiment, the operation for prohibiting the user operation that is the acquisition target of the audit log 122 when the size of the audit log 122 exceeds a predetermined threshold has been described. However, if the operation is suddenly prohibited, the user may be confused. Therefore, in the third embodiment, an operation example for notifying a warning message before prohibiting a user operation will be described. Other configurations and operations are the same as those in the first and second embodiments.

  FIG. 7 is an operation flow for explaining the operation of the log monitoring system 1000 according to the third embodiment. Hereinafter, each step of FIG. 7 will be described.

(FIG. 7: Step S301)
This step is the same as the step in FIG.

(FIG. 7: Step S701)
The log monitoring program 121 checks whether the size of the audit log 122 has reached a predetermined warning threshold value. The warning threshold value is set to a value smaller than the threshold value used in step S304 (for example, a numerical value of about 80% of the threshold value). If the size of the audit log 122 has not reached the warning threshold, the process skips to step S302, and if the size has reached the warning threshold, the process proceeds to step S702.

(FIG. 7: Step S702)
The log monitoring program 121 notifies the client terminal 100 by displaying a warning message indicating that the size of the audit log 122 is approaching the threshold value in step S304. As a result, the user is prompted to upload the audit log 122 to the shared folder 221.

(FIG. 7: Steps S302 to S305)
These steps are the same as those in FIG.

  As described above, according to the third embodiment, when the size of the audit log 122 stored in the storage unit 120 exceeds the predetermined warning threshold, the log monitoring program 121 displays a warning message to that effect to the user. Notice. Accordingly, the user's operation is not suddenly prohibited in step S304 in FIG. 7, and the possibility of inconvenience to the user can be reduced.

<Embodiment 4>
In the above first to third embodiments, it has been described that the path of the shared folder 221 is not disclosed so that the user cannot browse the shared folder 221. In the fourth embodiment of the present invention, three examples for fully configuring the security of the shared folder 221 will be described. Other configurations are the same as in any of the first to third embodiments.

<Embodiment 4: Security configuration example 1 of shared folder 221>
The calculation unit 210 sets the access authority for the shared folder 221 as follows based on an instruction from the system administrator.

(Access authority 1 of shared folder 221)
The system administrator of the log storage server 200 has full access authority (permits reading / writing / deleting) to the log file stored in the shared folder 221.

(Access right of shared folder 221 2)
Users who access the shared folder 221 via the network 300 are prohibited from acquiring the file list stored in the shared folder 221. As a result, the external user of the log storage server 200 cannot substantially access the file stored in the shared folder 221.
In step S302 of FIG. 3, the log monitoring program 121 executes the following additional operation.

(FIG. 3: Step S302: Supplement 3)
The log monitoring program 121 uploads the audit log 122 so that the user has only write authority for the audit log 122 uploaded to the shared folder 221. When uploading the audit log 122, the log monitoring program 121 may specify the access authority, or the calculation unit 210 of the log storage server 200 forcibly sets the access authority for the file in the shared folder 221. You may do it. In addition, for example, the access authority of the shared folder 221 may be set on the OS of the log storage server 200, or the log storage server 200 and the log monitoring program 121 communicate with each other via an appropriate communication program to share the shared folder 221. You may make it set the access authority of.

<Embodiment 4: Security configuration example 2 of shared folder 221>
In step S302 of FIG. 3, the log monitoring program 121 executes the following additional operation.

(FIG. 3: Step S302: Supplement No. 4)
The log monitoring program 121 uses a random character string or a character string encrypted based on a predetermined rule as the file name of the audit log 122 uploaded to the shared folder 221. The term “encryption” as used herein refers to generating a file name such that the user of the client terminal 100 cannot easily know the file name in the shared folder 221. Any known technique can be used for the encryption method.

  In this configuration example, since the user of the client terminal 100 cannot know the file name of the audit log 122 on the shared folder 221, unauthorized access to the shared folder 221 can be prevented.

<Embodiment 4: Example 3 of Security Configuration of Shared Folder 221>
The system administrator assigns a special user authority different from the general user to the log monitoring program 121 on the OS of the client terminal 100. When uploading the audit log 122 to the shared folder 221, the log monitoring program 121 specifies that the file can be read / written / deleted only with the user authority. As a result, the general user of the client terminal 100 cannot access the audit log 122 uploaded to the shared folder 221.

  As described above, in the fourth embodiment, the three examples for fully configuring the security of the shared folder 221 have been described. Three examples can be arbitrarily combined.

<Embodiment 5>
In the first to fourth embodiments described above, it is described that when the size of the audit log 122 stored in the storage unit 120 exceeds a predetermined threshold, a user operation that is a target for recording the audit log 122 is prohibited. did. However, the user does not necessarily deliberately upload the audit log 122 for a long period of time, and there may be an unavoidable situation (for example, a long-term failure of the network 300).

Therefore, in the fifth embodiment of the present invention, an operation example is described in which the user can continue the operation even when the size of the audit log 122 exceeds the threshold only when the system administrator permits it. Other configurations and operations are the same as those in the first to fourth embodiments.
FIG. 8 is an operation flow for explaining the operation of the log monitoring system 1000 according to the fifth embodiment. Hereinafter, each step of FIG. 8 will be described.

(FIG. 8: Steps S301 to S304)
These steps are the same as those in FIG. However, step S801 is newly inserted after step S304.

(FIG. 8: Step S801)
The log management program 121 determines whether or not the user has input a predetermined password to the log management program 121. If entered, the process returns to step S301 and the same procedure is repeated. If not, the process proceeds to step S305. The predetermined password in this step is a password for canceling the prohibition process in step S305, which is notified by the system administrator in response to a contact from the user. When this password is input, the log management program 121 exceptionally does not execute step S305 or changes the threshold value in step S304 to a larger value and continues the user operation.

(FIG. 8: Step S305)
This step is the same as the step in FIG.
As described above, according to the fifth embodiment, if the audit log 122 cannot be uploaded to the shared folder 221 regardless of the user's intention due to unavoidable circumstances such as a network failure, the permission of the system administrator The user's operation can be continued.

  In the fifth embodiment, an expiration date may be set for the password notified to the user by the system administrator. The log monitoring program 121 executes step S305 if the size of the audit log 122 still exceeds the threshold after the user inputs a predetermined password in step S801 and the expiration date is exceeded, or step S305 is executed. The threshold value in S304 is returned to the original value, and the user's operation is prohibited. As a result, the user is prompted to recover from the failure as soon as possible, which is preferable from the viewpoint of security.

  In the fifth embodiment, the password notified to the user by the system administrator may be a one-time password that is valid only once. As a result, it is possible to prevent the user from continuing to reuse the password.

  100: client terminal, 110: calculation unit, 120: storage unit, 121: log monitoring program, 122: audit log, 123: shaping log, 200: log storage server, 210: calculation unit, 220: storage unit, 221: sharing Folder, 300: Network, 1000: Log monitoring system.

Claims (11)

A program for causing a computer to execute processing for monitoring a log of operations performed by a user,
In the computer,
A log collection step for collecting the logs;
A log transmission step of transmitting the log collected in the log collection step to a predetermined folder and deleting the log of the transmission source;
A prohibiting step of prohibiting a user operation corresponding to a target for acquiring the log when the size of the log collected in the log collecting step exceeds a predetermined threshold;
Was executed,
In the prohibition step, the computer is
Log monitoring characterized in that the user's operation corresponding to the access authority is prohibited by depriving the user of the access authority on the computer corresponding to the user's operation corresponding to the log acquisition target. program. In the log transmission step, the computer
2. The log monitoring program according to claim 1, wherein it is checked whether or not there is a record of a user operation that matches a predetermined rule, and if there is a match, a message to that effect is sent. In the log collecting step, the computer
The log monitoring program according to claim 1 or 2, wherein the log is shaped using a predetermined item as a key in the collected logs. 4. The computer according to claim 1, wherein when the size of the log on the computer exceeds a predetermined warning threshold value smaller than the threshold value, the computer is caused to execute a step of notifying the user of the warning. The log monitoring program according to any one of the preceding items. In the log transmission step, the computer
The log is transmitted so that the user's access authority to the log on the folder is in a state of permitting only writing to the log. Log monitoring program. In the log transmission step, the computer
The random character string or a character string encrypted based on a predetermined rule is used as a file name of the log to be transmitted to the folder. Log monitoring program. 7. The method according to claim 1, further comprising: allowing the computer to execute the step of exceptionally permitting the act prohibited in the prohibition step only for a predetermined period when the predetermined password is received. The log monitoring program described. The password has an expiration date,
8. The computer according to claim 7, wherein if the size of the log exceeds the predetermined threshold even after the expiration date, the computer is caused to execute a step of prohibiting again the act prohibited in the prohibiting step. Log monitoring program. A computer that executes the log monitoring program according to any one of claims 1 to 8,
A server having the folder;
A log monitoring system comprising: The server
The user's access rights to the folder,
The log monitoring system according to claim 9, wherein the user is not allowed to acquire a list of files stored in the folder. The log monitoring system according to claim 9 or 10, wherein the server gives a hidden folder attribute to the folder.

Images