JP5508042B2 - IP access log analysis apparatus and method - Google Patents

Description

  The present invention relates to an IP access log analysis apparatus and method. In particular, the verification result for extracting the IP address and area information stored in the IP address database using the IP access log information of the Internet protocol of the user terminal received by the website as search key information, and specifying the access area of the user terminal The present invention relates to an IP access log analysis apparatus using a computer that generates a file and a method thereof.

  A conventional IP access log analyzing apparatus uses a company information database in which company-specific information such as a company name, address, telephone number, and URL is registered in association with the company IP address or domain name. A user who is an operator of the website, using the IP access log information of the Internet protocol received from the computer terminal accessing via the network, analyzing the access log to the website under various conditions There is known an IP access log analysis device that can be provided to the user and can accurately determine the prospective customer (Patent Document 1).

JP 2008-97259 A

  However, since the conventional IP access log analyzer uses a company information database registered in association with the company IP address or domain name, an individual user accesses a website from the user terminal via the Internet. However, it is difficult to match the IP address of the user terminal with the IP address stored in the company information database, and even if the IP access log is collected at a website provided by the company, the information value is remarkably high. descend.

  When a website provided by a company executes electronic commerce, ID information and password information issued to the user are received from the user terminal via the Internet network, and the ID and password information are received on the website side. Electronic commerce is permitted on condition that the authentication information matches. In other words, a malicious third party uses another person's credit card number or bank account number to perform fraud in order to execute e-commerce even though it is unknown from which region the user terminal is accessing. However, it is difficult to immediately stop electronic commerce, and provision of new security technology has been desired. Therefore, it is a technical problem of the present invention to provide a new security technique by analyzing IP access log information.

  The present invention has been made in response to the above-described problem, and extracts the area information of the IP address of the user terminal from the IP access log information, and the same registration number (for example, credit card number or bank account) within a predetermined period. Number) is used from a plurality of IP addresses or from a single IP address, an IP access log using a computer that outputs a list indicating the usage status of registered numbers and stores it in a storage device An object is to provide an analysis apparatus.

  Then, the area information of the IP address of the user terminal is extracted from the IP access log information, and a list showing the usage status of the registration number is output whether a plurality of registration numbers are used from the same IP address within a predetermined period. It is an object of the present invention to provide an IP access log analysis apparatus using a computer that stores data in a storage device.

  Here, the IP access log information includes the total count (COUNT) accessing the specific website, the access time (TIME) of the user terminal, and the IP address (ADDR = [203.141.xxx.xxx]) of the user terminal. ), Host name of user terminal (HOST = [ppp123.xkcom.ne.jp], browser of user terminal (AGENT = [Mozilla / 3.01 [en] (Win95; I)]), link source information (REFER = [http http://www.xxxxxx.co.jp/link/]), and this user terminal information is recorded in a storage device on the website side.

  The IP address is an identification number assigned to a computer or communication device connected to an IP network such as the Internet or an intranet. This identification number is unique and corresponds to a telephone number that can identify computers and communication devices from the Internet network around the world. In the Internet network, the network information centers NICs in each country execute IP address assignment management work so that the numerical values of the identification numbers do not overlap. The website administrator may recognize the location of the user terminal, the connection environment of the Internet network, and the connection method by the website operator by analyzing the IP address of the user terminal accessing the website. it can.

In order to achieve the above object, an IP access log analysis apparatus using a computer of the present invention stores, for example, an IP address and address information of prefectures and municipalities corresponding to the IP address as shown in FIG. The storage device 16 and the user terminal via the Internet 12 access condition designation information and inquiry IP address information related to whether the same registration number information is used from a plurality of IP addresses and addresses within a predetermined period. and access date information, registration number information of the applicant, the query address information, and receiving said query IP address information of the user terminal, the address information from said storage device the IP address of the query IP address information as a search key Locate the query IP address information of the address information determining IP address determination means 18 (seen in CPU22 A software program) that, based on the match or mismatch between the determination result and the inquiry address information of address information by the IP address determination means, identification address information and / or the inquiry address information of said query IP address information In addition to broadcast information for reporting whether or not the applicant who uses the registration number information is reliable, the inquiry address information , the access date information, the registration number information, the inquiry IP address information , and marketing or impersonation access prevention Determination data transmission for generating list information including at least one piece of information related to security of the information, and transmitting the list information to the user terminal via the Internet network in association with the condition designation information Means (software program executed by the CPU 22).

  Then, the IP access log analysis device 14 transmits the list information with address information corresponding to the access date information, the registration number information, and the inquiry IP address information to the user terminal. The user of the user terminal 10 can use the list information with address information as marketing information or security information for preventing impersonation access, and list information including warning information (a tag that highlights the address of the inquiry address or IP address). The reliability of the electronic commerce applicant can be confirmed with reference.

Further, the IP access log analysis device 14 using a computer has an IP address, a storage device 16 for storing address information of prefectures and municipalities corresponding to the IP address, and the applicant terminals 30a and 30b via the Internet network. registration number and information on applicant, inquiry address information, and receives an inquiry IP address information of the applicant terminal, searches the address information from said storage device the query IP address information as a retrieval key, the inquiry IP address information In an IP access log analysis device comprising: IP address determination means 18 for determining the address information of the address; address information corresponding to the inquiry address information or the registration number information of the applicant; and the inquired inquiry IP address information The address information of the prefectures and municipalities of And address information corresponding to the serial registration number information, to determine the identity and address information of said query IP address information, and the determination result of address information by the IP address determining means, to the inquiry address information or the registration number information Based on the identity with the corresponding address information , the reliability of the applicant who uses the registered number information is identified and displayed on the display screens 32a and 32b of the display, and the registered number information and the inquiry address information are used illegally. It is immediately determined that it has not been done .

  As a result, the user of the IP access log analyzer 14 can confirm the identity between the determination result of the IP address determination determination means 18 displayed on the display screens 32a and 32b and the reference address information. It is possible to immediately determine whether or not the received registration number information and inquiry address information are illegally used based on the determination result expressing the reliability of the applicant who uses.

  According to the IP access log analysis apparatus using the computer of the present invention, access date information and registration number information corresponding to the address information of the inquiry IP address can be provided as list information. IP address and address, or multiple registration numbers are used from the same inquiry IP address and address, or the same registration number is used from multiple inquiry IP addresses and addresses within a predetermined period. Because one list information is specified by the condition specification information, refer to the warning information that identifies and displays a mismatch with the address information of the user terminal, the access date and the reference address information, and immediately check the status of regular or unauthorized access I can grasp it.

The block diagram of the IP access log analysis apparatus of this invention. The figure which shows the operation | movement sequence of the IP access log analysis apparatus of this invention. The block diagram which utilizes the IP access log analysis apparatus of this invention for a financial system.

  An embodiment of the present invention will be described with reference to FIG. The IP access log analysis device 14 of the present embodiment schematically includes an IP address determination unit 18 and a determination data transmission unit 20 provided in a computer 24, and is connected to a storage device 16 that stores address information corresponding to the IP address. The CPU 22 provided in the computer 24 controls the storage device 16, the IP address determination unit 18 and the determination data transmission unit 20. The IP access log analysis device 14 and the user terminal 10 analyze the IP access log included in the request information received from the user terminal 10 by transmitting information to each other via the Internet network 12, and use the analysis result as a user. A reply can be made to the terminal 10.

  The IP access log analysis device 14 of this embodiment shown in FIG. 1 is connected to a storage device 16 (for example, a hard disk) that stores an IP address database DB that stores address information corresponding to an IP address. The illustrated memory, I / O, and storage unit for storing the computer software program are provided, and the CPU 22 executes the computer software program to cause the IP address determination unit and the determination data transmission unit to function.

  The storage device 16 includes, as address (position) information corresponding to the IP address, information specifying the country, region, prefecture, municipality, area code, latitude and longitude, and connection environment information corresponding to the IP address as a domain, Information specifying the line type and proxy usage is stored as an IP address database DB.

  For example, the address information corresponding to the IP address “202.234.1.10” of the Internet service provider (hereinafter abbreviated as “ISP”) can specify Hokkaido, and the connection environment information can specify the ISDN line. Similarly, the address information corresponding to the IP address “202.234.2.100” of the ISP can specify Tokyo, and the connection environment information can specify the FTTH line, and corresponds to the IP address “202.234.3.200”. The address information to be specified can specify Osaka, and the connection environment information can specify the ADSL line.

  However, the present invention is not limited to the IP address database DB stored in the storage device 16. For example, the IP access log analysis device 14 is connected to the IP address database DB of a web server (not shown) via the Internet 12. Address information and connection environment information can also be received and used in real time.

  The operation of the IP access log analyzer 14 will be described with reference to FIGS. 1 and 2.

  The IP access log analyzer 14 receives request information from the user terminal 10 via the Internet network 12 and inputs the request information to the memory area of the IP access log analyzer 14. This request information is exemplified in the XML specification. In step S1, XML version, authentication information “ID = xxx, PASS = xxx”, inquiry IP address “163.135.172.4”, prefecture information “Kanagawa”, municipal information “Kawasaki city” ”, The connection environment information“ FTTH ”, the prefecture code“ 90 ”, the municipality code“ 95 ”, the request information describing the connection environment code“ 85 ”is received by the IP access log analyzer 14 via the Internet 12 and stored in the memory area. input. Next, the CPU 22 executes the IP log information input process on condition that the authentication information matches the account information stored in the storage device 16. The illustrated request information indicates a part of the inquiry IP address and receives a plurality of subsequent inquiry IP addresses from the user terminal.

  The IP access log analysis device 14 can receive request information of the CSV specification in addition to the XML specification from the user terminal 10 via the Internet network 12 and input it to the memory area. In this case, the authentication process is completed between the IP access log analyzer 14 and the user terminal 10 via the Internet network 12. The IP access log analyzer 14 receives condition designation information, IP access log collection date information, branch name information (optional), registration number information, inquiry IP address information, customer registration prefecture name information, customer registration from the user terminal 10 City name information is received via the Internet 12.

  In step S2, the IP access log analyzer 14 causes the IP address determination unit 18 to function and picks up the inquiry IP address “163.135.172.4” in the request information and uses it as a search key. Address information corresponding to the IP address that matches the search key is read from the storage device 16.

  Even if the IP address that completely matches the inquiry IP address “163.135.172.4” does not hit (match) in the storage device 16, the IP address determination unit 18 does not start the first address “163”, the second address When “135” matches the third address “172”, information on the prefecture and the municipality can be acquired as the address information.

  The Ip address determination means 18 shifts the processing to step S3, and determines whether or not the inquiry analysis has been completed for all the inquiry IP addresses of the request information received from the user terminal 10 in the IP address database in the storage device 16. .

  The condition for completing the IP log analysis may be that the reading of the “End Of File” in the request information is detected and it is determined that the IP log analysis of all the inquiry IP addresses is completed. When the maximum value is reached, it may be determined that the IP log analysis is complete. The IP address determination means 18 branches to step S2 (determination result = N) until the determination result “Y” of completion of the IP log analysis in step S3 is output (determination result = N), and repeats the address information extraction processing until the CPU 22 times out.

  In the condition designation information described above, the verification rule ID can be selected from the types “R00” to “R07”. For example, the verification rule ID “R00” executes access verification from an IP address address different from the user registration address.

  The verification rule ID “R01” executes access verification in which the same registration number (credit card number or bank account number) is used from a plurality of IP addresses on the same day.

  The verification rule ID “R02” executes access verification from a plurality of prefectures (identified from the reference IP address) using the same registration number (credit card number or bank account number).

  The verification rule ID “R03” executes access verification in which a plurality of registration numbers (credit card numbers or bank account numbers) are used from the same inquiry IP address (a domain name may be used).

  The verification rule ID “R04” executes access verification with purchase payment using the same registration number (credit card number or bank account number) from a plurality of locations (found from the reference IP address).

  The verification rule ID “R05” executes access verification from a site (domain name or IP address) registered in the black IP list managed by the company that manages the user terminal 10.

  As the verification rule ID “R06”, any one of access verifications from other than Japan can be selected. However, the present invention is not limited to the seven types of verification rules, and other customized verification rule IDs using a reference IP address search key can also be added.

  When the IP address determination means 18 detects the determination result “Y” of the completion of the IP log analysis, it executes the IP log analysis result display process in step S4. In this case, the IP address determination unit 18 can display the IP log analysis result on the user terminal 10 via the Internet network 12 on a display (not shown). On the display, warning information for identifying and displaying a mismatch between the determination result of the IP address determination determination means 18 and the inquiry address information is displayed.

  “Warning information” may highlight (bold or underline) the character string of the reference address, and specify a background color that is different from the background color of the upper or lower line for the line displaying the registration number that does not match the address. By displaying, the user can easily identify.

  Further, the “warning information” may display a character string of the address of the IP address based on the determination result instead of the character string of the reference address. In short, it is possible to arbitrarily set a means for warning the user of an event where the reference address and the IP address do not match.

  Further, when the IP address determining means 18 is installed in the user company, it can be displayed in the form described above on the display (not shown) of the IP address determining means 18. The list information of the IP log analysis result is illustrated in the following table.

  Table 1 shows the IP log analysis result of the verification rule ID “R01”. In the title column at the top, the verification rule ID “detection ID” from the left, the date “date and time” when the reference IP address accessed the website, the “branch name” of the financial institution, the “account number” of the financial institution, “IP address” of reference IP address, “domain name” of reference IP address, “prefecture” of address information, “line type” used by reference IP address are displayed, and information corresponding to each title is displayed as list information It is displayed. In Table 1, the same account number verifies access from multiple reference IP addresses and addresses on the same day. The list information of the lines whose addresses do not match is displayed with “warning information”.

  Table 2 shows the IP log analysis result of the verification rule ID “R02”. In the title column at the top, the verification rule ID “detection ID” from the left, the date “date and time” when the reference IP address accessed the website, the “branch name” of the financial institution, the “account number” of the financial institution, “IP address” of reference IP address, “domain name” of reference IP address, “prefecture” of address information, “line type” used by reference IP address are displayed, and information corresponding to each title is displayed as list information It is displayed. In Table 2, the same account number verifies access from multiple reference IP addresses and addresses on the same day. In addition, the list information of the lines whose addresses do not match is displayed with “warning information”.

  Table 3 shows the IP log analysis result of the verification rule ID “R03”. In the title column at the top, the verification rule ID “detection ID” from the left, the date “date and time” when the reference IP address accessed the website, the “branch name” of the financial institution, the “account number” of the financial institution, “IP address” of reference IP address, “domain name” of reference IP address, “prefecture” of address information, “line type” used by reference IP address are displayed, and information corresponding to each title is displayed as list information It is displayed. Table 3 verifies access in which multiple account numbers are used from the same reference IP address (domain name). In addition, the list information of the lines whose addresses do not match is displayed with “warning information”.

  Table 4 shows the IP log analysis result of the verification rule ID “R04”. In the title column at the top, the verification rule ID “detection ID” from the left, the date “date and time” when the reference IP address accessed the website, the “branch name” of the financial institution, the “account number” of the financial institution, “IP address” of reference IP address, “domain name” of reference IP address, “prefecture” of address information, “line type” used by reference IP address are displayed, and information corresponding to each title is displayed as list information It is displayed. Table 4 verifies an access with a purchase payment by using the same account number from a plurality of reference IP address locations (addresses). In addition, the list information of the lines whose addresses do not match is displayed with “warning information”.

  In step S4, the IP access log analyzer 14 transmits the verification display information specified in any one of Tables 1 to 4 specified from the user terminal 10 to the user terminal 10 via the Internet network 12, and then performs the processing. The process proceeds to step S5, and verification result file transmission processing is executed.

  The IP telephone number investigation device 10 generates an XML specification or CSV specification verification result file in correspondence with the verification display information designated from the user terminal 10 and stores it in the storage device 16, and stores this verification result file on the Internet network. 12 to the user terminal 10 to complete the IP access log analysis process.

  According to the IP access log analysis device 14 of the present embodiment, it is possible to detect a mischievous application at a lie address from the IP log analysis result, and to open a large number of registration numbers (bank accounts) from the same reference IP address. It can detect and detect registrations from suspicious reference IP addresses that conceal areas and identities that have a high probability of fraud, and can detect applications from overseas and deny access to websites from overseas. Fraud can be detected by credit screening at the account opening stage of commerce.

  Further, according to the IP access log analysis device 14, a transaction from a high-risk reference IP address is similarly detected at the stage of electronic commerce, the use of an unauthorized account number is detected, and a reference IP address other than home or work is detected. Can prevent spoofing transactions and detect man-in-the-middle attacks and session hijacking by determining the address of the reference IP address.

[Operation of IP access log analyzer]
As described above, the IP access log analysis device 14 can determine address information using the IP address information requested from the user terminal 10 as a search key. Then, the operation according to another embodiment of the present invention can be provided by incorporating the IP access log analysis device 14 into a computer system of a financial operator.

  With reference to FIG. 3, the operation of the IP access log analysis apparatus using a computer according to another embodiment will be described. The illustrated IP access log analyzer 14 is installed in a facility of a financial operator 28 (for example, a credit company).

  The IP access log analysis device 14 is registered via the Internet network 12 from the storage device 16 (FIG. 1) for storing the IP address and the address information of the prefectures and municipalities corresponding to the IP address, and the applicant terminals 30a and 30b. IP address determination means for receiving number information, inquiry address information, and inquiry IP address information, searching address information from the storage device 16 (FIG. 1) using the inquiry IP address information as a search key, and determining the address of the inquiry IP address 18 (FIG. 1) and a determination result expressing whether or not the applicant who uses the registration number information is reliable based on the identity of the determination result of the IP address determination determination means 18 (FIG. 1) and the reference address information Is displayed on the display screens 32a and 32b of the display.

  The financial trader 28 provides a website (not shown), and acquires the IP address of the applicant terminal 30a or the applicant terminal 30b that accesses the website via the Internet network 12. This IP address is information for specifying an access source applicant terminal used for returning contents from the website to the applicant terminals 30a and 30b according to the TCP / IP standard.

  The IP access log analyzer 14 searches the corresponding address information from the storage device 16 (FIG. 1) using the IP address of the applicant terminal 30a or the applicant terminal 30b as a search key, and the IP address of the accessing applicant terminal Determine your address.

  The website of the financial company 28 includes, for example, registration number information (for example, a card loan number), registration address information of the applicant, and birth date information from the applicant terminal 30a or the applicant terminal 30b as conditions for executing the loan. The application information and the IP address information of the application terminal are received, and the application information and the IP address information of the application terminal are transferred to the IP access log analyzer 14 connected to or incorporated in the website.

  Then, the IP access log analysis device 14 matches the registered address information in the application information with the IP address information of the application terminal, and determines whether or not they match. For example, when the applicant A accesses the website of the financial company 28 from the applicant terminal 30a via the Internet network 12, the IP address determination means 18 (FIG. 1) converts the application information of the applicant A in real time. It is determined whether or not an address corresponding to the registered address or registration number described (for example, an address registered in the computer of the financial operator 28) matches the address of the IP address.

  The IP access log analysis device 14 displays the determination result of the IP address determination means 18 (FIG. 1) on the display screen 32 a of the display connected to the IP access log analysis device 14. For example, when the determination result of the IP address determination means 18 (FIG. 1) matches, “OK” permission notification is displayed, and when the determination result does not match, “NO” denial notification is displayed. When the applicant B applies for a loan using the applicant terminal 30b, the determination result of the IP address determination means 18 (FIG. 1) is displayed on the display screen 32b of the display connected to the IP access log analyzer 14. .

  As a result, even if a plurality of applicants access the website of the financial operator 28 from each applicant terminal, an address corresponding to this IP address information is obtained based on the IP address information of the applicant terminal of the access source in real time. Unauthorized financing by identifying the level of the prefecture or municipality and matching the address corresponding to the registration number or the address in the received application information to determine the legitimacy of the address that is the execution condition of the loan Application and legitimate application can be judged quickly.

  In another embodiment, the financial operator 28 has been described as an example. However, the present invention is not limited to this, and can be applied to an electronic commerce business, a banking business, and an insurance business via the Internet network 12.

  Although the present embodiment has been described with respect to the Internet network, the present invention is not limited to the above-described embodiment, and it goes without saying that the configuration requirements can be appropriately changed according to the development of the communication line network.

DESCRIPTION OF SYMBOLS 10 ... User terminal, 12 ... Internet network, 14 ... IP access log analysis apparatus, 16 ... Memory | storage device, 18 ... IP address determination means, 20 ... Determination data transmission means, 22 ... Central controller CPU, 24 ... Computer, 30a ... Applicant terminal, 30b ... Applicant terminal, 32a ... Determination result screen, 32b ... Determination result screen.

Claims (8)

An IP address, a storage device for storing address information of prefectures and municipalities corresponding to the IP address;
Condition specification information related to whether the same registration number information is used from a plurality of IP addresses and addresses within a predetermined period from the user terminal via the Internet network, access date information when the inquiry IP address information is accessed , application Receiving the registration number information, inquiry address information, and inquiry IP address information of the user terminal ,
Wherein the query IP address to search the address information from said storage device an IP address as a search key information IP address determining means for determining address information of said query IP address information,
The address information of the inquiry IP address information and / or the inquiry address information is identified and displayed based on the match or mismatch between the address information determination result by the IP address determination means and the reference address information, and the registration number information is used. In addition to the notification information to notify the applicant's reliability ,
Generating list information including at least one of the inquiry address information , the access date information, the registration number information, the inquiry IP address information , and information related to security of marketing or impersonation access prevention ;
Determination data transmission means for transmitting the list information to the user terminal via the Internet network in correspondence with the condition designation information;
An IP access log analysis apparatus using a computer comprising: 2. The IP access log analysis apparatus according to claim 1, wherein the registration number information is a credit card number or a bank account number. An IP address, a storage device for storing address information of prefectures and municipalities corresponding to the IP address;
Receiving the registration number information of the applicant , the inquiry address information, and the inquiry IP address information of the applicant terminal via the Internet network from the applicant terminal;
Searches the address information from said storage device the query IP address information as a search key, in the IP access log analysis apparatus and a determined IP address determining unit address information of said query IP address information,
The address information corresponding to the inquiry address information or the registration number information of the applicant is matched with the address information of prefectures and municipalities of the inquiry IP address information inquired, and the inquiry address information or the registration number is matched in real time. Determining the identity of the address information corresponding to the information and the address information of the inquiry IP address information;
The determination result of address information by the IP address determining means, based on the identity of the address information corresponding to the inquiry address information or the registration number information, the applicants used the registration number information reliability of the display An identification display is made on the display screen, and it is immediately determined that the registration number information and the inquiry address information are not used illegally .
An IP access log analysis apparatus using a computer characterized by the above . 4. The IP access log analysis apparatus according to claim 3, wherein the registration number information is a credit card number or a bank account number. A storage step of storing an IP address, address information of prefectures and municipalities corresponding to the IP address;
Condition specification information related to whether the same registration number information is used from a plurality of IP addresses and addresses within a predetermined period from the user terminal via the Internet network, access date information when the inquiry IP address information is accessed , application Receiving the registration number information, inquiry address information, and inquiry IP address information of the user terminal,
Wherein the searching the address information from the storage step determining address information of said query IP address information as the query IP address information IP address search key,
Based on the match or mismatch between the determination result and the inquiry address information of address information by determining the address information of the inquiry IP address information, identifying and displaying the address information and / or the inquiry address information of said query IP address information In addition to broadcast information for reporting whether or not the applicant who uses the registration number information is reliable ,
Generating list information including at least one of the inquiry address information , the access date information, the registration number information, the inquiry IP address information , and information related to security of marketing or impersonation access prevention ;
Transmitting the list information to the user terminal via the Internet network in correspondence with the condition designation information;
An IP access log analysis method using a computer comprising: 6. The IP access log analysis method according to claim 5, wherein the registration number information is a credit card number or a bank account number. A storage step of storing an IP address, address information of prefectures and municipalities corresponding to the IP address;
Receiving the registration number information of the applicant , the inquiry address information, and the inquiry IP address information of the applicant terminal via the Internet network from the applicant terminal;
Searches the address information from said storing step to the query IP address information as a search key, and determining the address information of the inquiry IP address information, the IP access log analysis method with a,
The address information corresponding to the inquiry address information or the registration number information of the applicant is matched with the address information of prefectures and municipalities of the inquiry IP address information inquired, and the inquiry address information or the registration number is matched in real time. Determining the identity of the address information corresponding to the information and the address information of the inquiry IP address information;
Determination result of the query IP address address information by the address information of the determining information, based on the identity of the address information corresponding to the inquiry address information or the registration number information, application that uses the registration number information The reliability of the person is identified and displayed on the display screen of the display , and it is immediately determined that the registration number information and the inquiry address information are not used illegally.
IP access log analysis method using a computer, characterized in that. 8. The IP access log analysis method according to claim 7, wherein the registration number information is a credit card number or a bank account number.

Images