JP5893787B2 - Information processing apparatus, processing method, and program - Google Patents

Description

  The present invention relates to an apparatus, a processing method, and a program for preventing intrusion of malware (malicious software) performed via a network.

  Malware such as a computer virus invades and operates on a computer system, and causes various damages to the invaded computer system itself and other systems connected to the system. As measures to prevent the occurrence of damage caused by malware, malware that attempts to invade the computer system is detected to prevent intrusion, or malware that has already entered the computer system is detected and removed. As a technique for detecting malware, list matching is generally performed using a list (black list) in which information on known malware is collected (see, for example, Patent Document 1).

  In addition, unknown malware is detected and the source of the malware is specified. For example, a trap terminal (so-called honeypot or the like) through which malware can invade is provided on the network, and the operation of the invading malware is verified or the source of malware is identified (for example, patents) Reference 2).

JP 2009-181233 A WO2004 / 084063

  In recent years, malware intrusion methods have become more sophisticated and sophisticated, making it difficult to prevent intrusions into computers. For example, there is a case in which the malware is proactively acquired (downloaded) from the computer instead of sending the malware to the computer from the outside to be invaded. This includes a case in which a user such as a computer guides the user to operate the computer or the like to acquire (download) malware by a device provided on a web page or the like.

  The objective of this invention is providing the defense means with respect to the mechanism in which malware is mainly acquired from the above computers.

In order to achieve the above object, the present invention is realized as the following apparatus. The apparatus is an information processing apparatus connected to a network, a communication unit that communicates with an access destination on the network, an information holding unit that holds access destination information for specifying an access target on the network, The access control means for accessing the access target specified by the access destination information, and the transmission destination added to the specific software received from the access target accessed by the access control means, to which the access target has transmitted the specific software An access means for identifying the access request when the access is made to the network by the communication means, and the response to the access request from the access target. In response to this And a editing means for adding identification information extracted by the extraction means.
More preferably, the editing unit adds second identification information that is the same as or different from the first identification information extracted by the extraction unit to the response received from the access target specified by the access destination information. In this case, the second identification information is rewritten to the first identification information, and when the second identification information is not added to the response, the first identification information is not added to the response.

In addition, this editing means, instead of adding identification information to the response from the access target specified by the access destination information, when the access destination of the access request is the access target specified by the access destination information, The identification information extracted by the extracting means may be added to the access request.
In this case, more preferably, the editing unit adds the second identification information when the second identification information that is the same as or different from the first identification information extracted by the extraction unit is added to the access request. When the information is rewritten with the first identification information and the second identification information is not added to the access request, the first identification information is not added to the access request.

In addition, another aspect of the present invention that achieves the above object is also realized as the following apparatus. This apparatus is an information processing apparatus connected to a network, and communication means for communicating with an access destination on the network, and access for accepting an access request and transmitting specific software to a transmission source of the access request A first information holding unit for holding access destination information for specifying a target; and a second information for holding identification information used for identifying a transmission destination to which the access target specified by the access destination information has transmitted specific software. If the access destination of the access request when accessing the network by the information holding means and the communication means is the access target specified by the access destination information, and the response to the access request is received from this access target, this response Editing means for adding the identification information held in the second information holding means; Provided.
In addition, this editing means, instead of adding identification information to the response from the access target specified by the access destination information, when the access destination of the access request is the access target specified by the access destination information, The identification information extracted by the extracting means may be added to the access request.

  The present invention is also realized as the following method. This method is a processing method of network communication by an information processing apparatus connected to a network, and based on access destination information specifying an access destination, accessing an access target specified by the access destination information; and In order to access the access target specified by the access destination information, receive specific software from this access target, and identify the destination attached to this specific software to which this access target has transmitted this specific software Extracting the identification information used for the access, and the access destination of the access request when accessing the network is the access target specified by the access destination information, and when the response to the access request is received from this access target, this response Extracted in the previous step And including the steps of adding identification information.

Furthermore, in the above method, when the access destination of the access request is the access target specified by the access destination information instead of adding the identification information to the response from the access target specified by the access destination information. The identification information extracted in the previous step may be added to the access request.
In addition, the identification information used for identifying the transmission destination to which the access target identified by the access destination information has transmitted the specific software is held in the storage means, and instead of the identification information extracted in the previous step, The identification information held in the storage unit may be added to the response or the access request.

  Furthermore, the present invention is also realized as a program that controls a computer to realize each function of the above-described device, or a program that causes a computer to execute processing corresponding to each step in the above processing method. This program can be provided by being stored and distributed in a magnetic disk, an optical disk, a semiconductor memory, or other recording media, or distributed via a network.

  ADVANTAGE OF THE INVENTION According to this invention, the defense with respect to the mechanism which acquires malware actively from a computer is implement | achieved, and a computer can be protected.

It is a figure showing the example of whole composition of the computer system to which this embodiment is applied. It is a figure which shows the mechanism in which the website on the internet transmits malware according to the access from a client terminal. It is a figure which shows the function structural example of the proxy server by the 1st structural example of this embodiment. It is a flowchart which shows operation | movement of the proxy server by the 1st structural example of this embodiment. It is a figure which shows the function structural example of the proxy server by the 2nd structural example of this embodiment. It is a flowchart which shows the process regarding the cookie by the proxy server of a 2nd structural example, and is a figure which shows the operation | movement at the time of acquisition of a cookie. It is a flowchart which shows the process regarding the cookie by the proxy server of a 2nd structural example, and is a figure which shows the operation | movement at the time of rewriting of a cookie. It is a figure which shows an example of the hardware constitutions of the computer suitable for implement | achieving the proxy server of this embodiment.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.
<System configuration example>
First, a network system to which this embodiment is applied will be described.
FIG. 1 is a diagram showing an example of the overall configuration of such a network system.
As shown in the figure, this network system is configured by connecting a client terminal 10 and a proxy server 20 to a LAN (Local Area Network) 100. Each device connected to the LAN 100 is connected to the Internet 200 via the proxy server 20. That is, communication from the device in the LAN 100 to the external network is always performed via the proxy server 20.

  The client terminal 10 is a computer used by a user. For example, it is realized by a personal computer, a workstation, or other computer devices. As described above, the client terminal 10 is connected to the LAN 100 and accesses a server (not shown) on the Internet 200 via the proxy server 20. Although four client terminals 10 are illustrated in FIG. 1, the number of client terminals 10 connected to the LAN 100 is not limited to the four illustrated.

  A server on the Internet 200 constructs a website that provides services on the Internet 200 using web pages and the like. In the following description, as an access destination by the client terminal 10 and the proxy server 20 or an operation (such as data transmission) on the Internet 200, a website is appropriately used instead of a server. Note that this server and website do not necessarily correspond one-on-one. There are cases where a single server provides a plurality of websites, and there is also a case where one website is constituted by web pages stored in a plurality of servers.

  The proxy server 20 is a server computer that relays communication between the client terminal 10 in the LAN 100 and a server on the Internet 200. As described above, the client terminal 10 always accesses the Internet 200 via the proxy server 20. The proxy server 20 may include general functions provided in an existing proxy server, such as a firewall function and a communication data cache function, in addition to a basic relay function.

  In addition to the function as the normal proxy server 20 described above, the proxy server 20 of the present embodiment has a function of making a cyclic access to a website on the Internet 200 based on a predetermined access destination list. Details of the function and operation of the proxy server 20 and the access destination list in this embodiment will be described later.

  The LAN 100 is a network in which terminal devices such as a client terminal 10 and a network printer (not shown) are connected through various lines so that data can be transmitted and received between them. The Internet 200 is a huge network that connects networks all over the world using TCP / IP.

<Mechanism for intruding malware>
Here, a mechanism for invading malware targeted by the present embodiment will be described.
FIG. 2 is a diagram illustrating a mechanism in which a website on the Internet transmits malware in response to access from a client terminal.
In FIG. 2, a website 210 provided on the Internet 200 is a website for distributing malware (malware distribution site). In the mechanism shown in FIG. 2, first, an access request is made from the client terminal 10 to the website 210. When an access request from the client terminal 10 to the website 210 is made, the website 210 transmits malware to the client terminal 10 that has made the access request.

  On the Internet 200, various devices for making an access request from the client terminal 10 to the website 210 are made. For example, a script for accessing the website 210 is described in a web page of another website (not shown), and when the client terminal 10 downloads the web page, the website 210 is automatically accessed. There is a mechanism. In addition, a link for accessing the website 210 is provided on a web page of another website (not shown), and the user viewing the web page is directed to access the website 210 by himself / herself. There is also.

  2. Description of the Related Art Conventionally, as a security measure for such a technique, a malware distribution site has been discovered by using a client terminal 10 (a cocoon terminal) that becomes a cocoon. Specifically, access from the client terminal 10 to a website 210 that may have received malware from the client terminal 10 and downloaded malware, and confirm whether the website 210 transmits malware Was done.

  On the other hand, in order to avoid the discovery by such investigation, the website 210 that is a malware distribution site transmits malware to the client terminal 10 that has requested access only when a predetermined condition is satisfied. was there. Specifically, the client terminal 10 that has downloaded the malware is stored, and when there is an access request from the same client terminal 10 within a certain period of time, for example, the malware is transmitted to the client terminal 10 There was no website 210.

  Various methods are conceivable as a method for identifying the client terminal 10 by the server that provides the website 210 that is a malware distribution site. Typical methods include a method using an IP address and a method using a cookie. Is mentioned. In the former method, the server of the website 210 identifies the client terminal 10 that made the access request based on the IP address of the access request source. In the latter method, when the server of the website 210 receives an access request, it creates a cookie and transmits it to the client terminal 10 that is the access request source. When the access request is received from the client terminal 10 next time, the server of the website 210 identifies the client terminal 10 that has made the access request based on the cookie attached to the access request.

<Circuit access and impersonation by proxy server>
In the present embodiment, as described above, for the website 210 that does not transmit malware in response to the second and subsequent access requests to the client terminal 10 that has made multiple access requests within a certain period, Cyclic access by the proxy server 20 is performed. Then, the proxy server 20 downloads malware from the website 210. In addition, the proxy server 20 impersonates an access request from the client terminal 10 in the LAN 100 in which the proxy server 20 is provided to the website 210 as if it were the second and subsequent access requests. In the LAN 100 provided with such a proxy server 20, the proxy server 20 accesses the website 210 in advance and downloads the malware. Therefore, even if the client terminal 10 accesses the website 210 thereafter, the malware may be downloaded. Absent.

  As described above, as a typical technique for the server providing the website 210 to identify the client terminal 10, a technique using an IP address and a technique using a cookie are conceivable. Thus, hereinafter, the functional configuration and operation of the proxy server 20 in the present embodiment will be described separately for each case.

<First configuration example>
First, in the case where the server of the website 210 identifies an access source client terminal 10 using an IP address, a system configuration and its operation for preventing malware intrusion will be described. In this configuration example, the system is realized by the function of the proxy server 20.

<Functional configuration of proxy server>
FIG. 3 is a diagram illustrating a functional configuration example of the proxy server 20 according to the present embodiment.
The proxy server 20 illustrated in FIG. 3 includes an access relay unit 21, a list holding unit 22, an access control unit 23, a software analysis unit 24, and a software processing unit 25. In FIG. 3, only the unique functions in the present embodiment are described except for the access relay unit 21. Actually, in addition to the functions shown in FIG. 3, various functions of an existing proxy server such as a firewall function and a cache function can be provided.

  The access relay unit 21 relays communication between the client terminal 10 connected to the LAN 100 and the website 210 (server) on the Internet 200. That is, the data transmitted from the client terminal 10 is received and transmitted to the transmission destination website 210, and the data transmitted from the website 210 is received and transmitted to the transmission destination client terminal 10.

  The list holding unit 22 is information holding means for holding a list of access destinations to be accessed by the proxy server 20. The access destination of the proxy server 20 in the present embodiment is the website 210 that is transmitting malware to the client terminal 10 that is the access source, or the website 210 that is suspected of the website. In particular, the website 210 that does not transmit malware corresponding to the second and subsequent access requests to the client terminal 10 that has made a plurality of access requests within a certain period is targeted. This access destination list can be obtained from, for example, an information security service provider, or can use information on a published malware distribution site.

  The website 210 registered in the access destination list includes the website 210 that actually transmits malware, the website 210 that is recognized as possibly transmitting malware, and such website 210. It is assumed to include a website 210 that automatically transitions to.

  The access control unit 23 is an access control unit that accesses the website 210 based on the access destination list held in the list holding unit 22. Access to the website 210 is performed at a predetermined timing. For example, it may be performed periodically (once a day, a predetermined time, etc.), or may be performed when the system is in a specific state. As a specific example, in a system in which all the client terminals 10 connected to the LAN 100 are stopped depending on the time zone, the proxy is activated when any one of the client terminals 10 is started after all the client terminals 10 are stopped. It is conceivable that the server 20 accesses the website 210. Further, for each website 210 registered in the access destination list, the proxy server 20 when a certain time has elapsed since any client terminal 10 connected to the LAN 100 last accessed the website 210. May also access the website 210.

  The software analysis unit 24 analyzes the software downloaded by accessing the website 210 under the control of the access control unit 23, and determines whether it is malware. For this determination, for example, an existing method such as list matching using a black list may be used. In this case, software defined in advance as malware to be processed is registered in the black list.

  The software processing unit 25 processes the software determined to be malware by the software analysis unit 24 and puts the software into a state where it is not executed. Specifically, the target software is deleted or stored in a special folder (isolated) so that it cannot be executed.

<Operation of Proxy Server in First Configuration Example>
FIG. 4 is a flowchart showing the operation of the proxy server 20 according to the present embodiment.
In the system configured as described above, the proxy server 20 controls the access control unit 23 according to the access destination list held in the list holding unit 22 at a predetermined timing (when the time requirement is satisfied). The website 210 is accessed (steps 401 and 402). When the software is acquired (downloaded) from the website 210, the software analysis unit 24 analyzes the acquired software (steps 403 and 404). If it is determined as a result of analysis by the software analysis unit 24 that the acquired software is malware, the software processing unit 25 next processes (deletes, isolates, etc.) the software (steps 405 and 406).

  As described above, according to the present embodiment, the proxy server 20 sends the malware 210 to the website 210 (or the website 210 with the possibility) at a predetermined timing based on the access destination list. to access. Due to the characteristics of the LAN 100 provided with the proxy server 20, when an access request is made from a terminal device (including the client terminal 10) connected to the LAN 100, the IP address of the access source is relayed by the proxy server 20 Is the IP address of the proxy server 20. For this reason, after accessing by the proxy server 20 in the website 210, all accesses from the client terminal 10 in the LAN 100 are determined to be accesses from the same IP address (the same terminal device).

  Here, it is assumed that the website 210 does not transmit malware corresponding to the second and subsequent access requests to the client terminal 10 that has made a plurality of access requests within a certain period. Then, even if there is an access request from the client terminal 10 in the LAN 100, the website 210 does not transmit malware to the access request transmission source for a certain period after the proxy server 20 accesses.

<Modification of the first configuration>
As described above, in the LAN 100 provided with the proxy server 20, the IP address of the access source in the access request from each terminal device connected to the LAN 100 is the IP address of the proxy server 20. Therefore, the function of the access control unit 23 of the proxy server 20 in the above configuration example may be provided in a specific client terminal 10 connected to the LAN 100 instead of the proxy server 20.

  In this case, the specific client terminal 10 holds an access destination list similar to that held in the list holding unit 22. Based on this access destination list, the website 210 is accessed at a predetermined timing.

<Second configuration example>
Next, a system configuration and its operation for preventing malware intrusion when the server of the website 210 identifies the access source client terminal 10 using a cookie will be described. In this configuration example, the system is realized by the function of the proxy server 20.

  In the second configuration example, the website 210 adds a cookie to the transmission data when responding to the client terminal 10 that has made the access request. The client terminal 10 that has received the cookie adds the received cookie to the access request or transmission data when accessing the same website 210 next time, and transmits it. When a cookie issued by itself is added to the received access request or transmission data, the website 210 identifies the client terminal 10 that has transmitted the access request and its state based on the cookie.

  Accordingly, when the website 210 transmits malware to the client terminal 10 and adds a unique cookie at the time of transmission of the malware, the website 210 subsequently transmits the malware based on the cookie added to the access request received from the same client terminal 10. It can be recognized that malware has already been transmitted to the client terminal 10. Therefore, in the second configuration example, in the data exchange between the client terminal 10 and the website 210, the cookie added to the response from the website 210 or the access request from the client terminal 10 is transmitted at the time of malware transmission. Replace with cookies. This disguises the website 210 to recognize that the malware has already been transmitted to the client terminal 10 that is the source of the access request.

<Functional configuration of proxy server>
FIG. 5 is a diagram illustrating a functional configuration example of the proxy server 20 according to the present embodiment.
The proxy server 20 illustrated in FIG. 5 includes an access relay unit 21, a list holding unit 22, an access control unit 23, a software analysis unit 24, a software processing unit 25, and an information editing unit 26. Here, the access relay unit 21, the list holding unit 22, the access control unit 23, the software analysis unit 24, and the software processing unit 25 are the same as the configuration of the proxy server 20 in the first configuration example illustrated in FIG. Accordingly, the same reference numerals are given and description thereof is omitted. In FIG. 5, only the unique functions in the present embodiment are described except for the access relay unit 21. Actually, in addition to the functions shown in FIG. 5, various functions of an existing proxy server such as a firewall function and a cache function can be provided.

  In the proxy server 20 of this configuration example shown in FIG. 5, the information editing unit 26 extracts and rewrites a cookie added to data transmitted from the website 210 to the client terminal 10 in the LAN 100. That is, the information editing unit 26 is an extracting unit that extracts a cookie from the received data from the website 210, and an editing unit that rewrites the cookie added to the received data. The contents of the cookie rewriting process by the information editing unit 26 will be described in detail below.

  As a premise, the proxy server 20 according to the second configuration example shown in FIG. 5 is held in the list holding unit 22 similarly to the proxy server 20 according to the first configuration example described with reference to FIGS. 3 and 4. Based on the access destination list, the website 210 is accessed at a predetermined timing. Then, the software downloaded from the website 210 is analyzed by the software analysis unit 24, and when the software is malware, the software processing unit 25 processes (deletes, isolates, etc.).

  Here, when it is determined that the software downloaded from the website 210 is malware, in the proxy server 20 of this configuration, the information editing unit 26 extracts the data of the cookie added to the software. The extracted cookie data is stored in a predetermined storage unit in association with information specifying the transmission source website 210.

  Then, when an access request to the website 210 is made from the client terminal 10 in the LAN 100 and there is a response from the website 210, the information editing unit 26 uses the cookie added to the response from the website 210. , And rewrite it as a cookie (ie, a cookie added when sending malware).

<Operation of Proxy Server in Second Configuration Example>
6 and 7 are flowcharts showing processing related to cookies by the proxy server 20 of this embodiment. FIG. 6 shows the operation at the time of obtaining the cookie, and FIG. 7 shows the operation at the time of rewriting the cookie.
In the operation shown in FIG. 6, the operation until the proxy server 20 accesses the website 210 based on the access destination list and analyzes the downloaded software (steps 601 to 604) is the first configuration shown in FIG. 4. The operation is the same as that in steps 401 to 404 according to the example.

  The proxy server 20 in this configuration example processes (deletes, isolates, etc.) the acquired software if it is determined that the acquired software is malware as a result of analysis by the software analyzing unit 24, and is added to the software. Cookies are acquired (steps 605 and 606). That is, the cookie acquired at this time is a cookie added when the website 210 transmits malware.

  Reference is now made to FIG. First, the access relay unit 21 of the proxy server 20 receives a response from the website 210 to the access request from the client terminal 10 in the LAN 100 (step 701). Then, the information editing unit 26 checks whether or not the cookie acquired by accessing the website 210 in advance (the cookie acquired in step 606 in FIG. 6) is held (step 702). If the cookie acquired from the website 210 is held, the information editing unit 26 rewrites the cookie added to the response received in step 701 with the cookie detected in step 702 (step 703). Then, the access relay unit 21 transmits a response in which the cookie is rewritten by the information editing unit 26 to the client terminal 10 that is the transmission source of the access request (step 704).

  Thereafter, when accessing the website 210 again, the client terminal 10 adds the cookie added by the proxy server 20 in Step 703 to the access request. For this reason, the website 210 that has received this access request determines, based on the cookie, that the received access request is an access request from the client terminal 10 that has already transmitted malware.

  Here, it is assumed that the website 210 does not retransmit the malware for a certain period to the client terminal 10 that has already transmitted the malware. Then, the website 210 does not transmit malware to the client terminal 10 that is the transmission source of the access request to which the cookie is added.

  In the above operation example, the information editing unit 26 rewrites the cookie when the proxy server 20 receives a response from the website 210. On the other hand, when the client terminal 10 in the LAN 100 makes an access request with the website 210 registered in the access destination list as an access destination, the information editing unit 26 holds the cookie added to the access request. It is good also as a procedure to rewrite the cookie.

  In the above operation example, the cookie added to the response from the website 210 or the access request from the client terminal 10 is rewritten (that is, the cookie added at the time of malware transmission is deleted by deleting the already added cookie). It was decided to. On the other hand, when the cookie is not added to the response from the website 210 or the access request from the client terminal 10, the information editing unit 26 may simply add the cookie.

<Modification of Second Configuration>
In the above configuration example, the proxy server 20 accesses the website 210 prior to the client terminal 10 in the LAN 100, and acquires a cookie that is added when malware is transmitted. On the other hand, it is good also as a structure which acquires the cookie added when the website 210 registered in the access destination list transmits malware with another means beforehand, and hold | maintains it in the proxy server 20. FIG. In this case, it is conceivable that the information security service provider provides the cookie together with the access destination list, for example. A technique and procedure for rewriting or adding a cookie added to a response from the website 210 or an access request from the client terminal 10 are the same as in the above configuration example.

<Example of hardware configuration>
Finally, a hardware configuration of a computer suitable for realizing the proxy server 20 of this embodiment will be described.
FIG. 8 is a diagram illustrating an example of the hardware configuration of such a computer.
The computer shown in FIG. 8 includes a CPU (Central Processing Unit) 300a that is a calculation means and a memory 300c that is a main storage means. As external devices, a hard disk drive (HDD) 300g, a network interface 300f, a display mechanism 300d, an audio mechanism 300h, an input device 300i such as a keyboard and a mouse, and the like are provided.

  In the configuration example shown in FIG. 8, the memory 300c and the display mechanism 300d are connected to the CPU 300a via the system controller 300b. The network interface 300f, the magnetic disk device 300g, the audio mechanism 300h, and the input device 300i are connected to the system controller 300b via the I / O controller 300e. Each component is connected by various buses such as a system bus and an input / output bus.

  FIG. 8 merely exemplifies a hardware configuration of a computer suitable for applying the present embodiment. The present embodiment can be widely applied to an information processing system that analyzes a data file obtained from network traffic or the like, and the present embodiment is not realized only in the configuration shown in the figure.

  In FIG. 8, the OS and application software programs are stored in the magnetic disk device 300 g. These programs are read into the memory 300c and executed by the CPU 300a, so that the access relay unit 21, the access control unit 23, the software analysis unit 24, the software processing unit 25, and the information editing unit shown in FIGS. Various functions including the unit 26 are realized. Further, the storage means such as the magnetic disk device 300g and the memory 300c realizes the holding means for the cookies extracted by the list holding unit 22 and the information editing unit 26.

  In each configuration example of the present embodiment, the proxy server 20 makes a cyclic access to the website 210 based on the access destination list except for the modified example of the first configuration. However, in an actual system, such a configuration is used. It is not limited. That is, the website 210 can be accessed by various gateway devices provided on the communication path between the LAN 100 and the Internet 200. Further, a dedicated information processing apparatus that cyclically accesses the website 210 based on the access destination list is provided in the LAN 100 and configured to access the website 210 on the Internet 200 via a gateway such as the proxy server 20. Also good.

DESCRIPTION OF SYMBOLS 10 ... Client terminal, 20 ... Proxy server, 21 ... Access relay part, 22 ... List holding part, 23 ... Access control part, 24 ... Software analysis part, 25 ... Software processing part, 26 ... Information editing part, 100 ... LAN ( Local Area Network), 200 ... Internet

Claims (13)

An information processing apparatus connected to a network,
A communication means for communicating with an access destination on the network;
Information holding means for holding access destination information for specifying an access target on the network;
Access control means for accessing the access target specified by the access destination information;
Extraction means for extracting identification information added to the specific software received from the access target accessed by the access control means and used to identify the transmission destination to which the access target has transmitted the specific software;
The access destination of the access request when accessing the network by the communication means is the access target specified by the access destination information, and when a response to the access request is received from the access target, Editing means for adding the identification information extracted by the extraction means;
An information processing apparatus comprising:   The editing unit adds second identification information that is the same as or different from the first identification information extracted by the extraction unit to the response received from the access target specified by the access destination information. If the second identification information is rewritten to the first identification information and the second identification information is not added to the response, the first identification information is not added. Item 4. The information processing apparatus according to Item 1. An information processing apparatus connected to a network,
A communication means for communicating with an access destination on the network;
Information holding means for holding access destination information for specifying an access target on the network;
Access control means for accessing the access target specified by the access destination information;
Extraction means for extracting identification information added to the specific software received from the access target accessed by the access control means and used to identify the transmission destination to which the access target has transmitted the specific software;
When the access destination of the access request when accessing the network by the communication means is the access target specified by the access destination information, the identification information extracted by the extraction means is added to the access request Editing means,
An information processing apparatus comprising:   The editing means adds the second identification information to the access request when the second identification information that is the same as or different from the first identification information extracted by the extraction means is added to the access request. 4. The information processing apparatus according to claim 3, wherein the first identification information is not added when the first identification information is rewritten and the second identification information is not added to the access request. 5. An information processing apparatus connected to a network,
A communication means for communicating with an access destination on the network;
First information holding means for holding access destination information for specifying an access target for receiving an access request and transmitting specific software to a transmission source of the access request;
Second information holding means for holding identification information used for identifying a transmission destination to which the access target specified by the access destination information has transmitted the specific software;
The access destination of the access request when accessing the network by the communication means is the access target specified by the access destination information, and when a response to the access request is received from the access target, Editing means for adding the identification information held in the second information holding means;
An information processing apparatus comprising: An information processing apparatus connected to a network,
A communication means for communicating with an access destination on the network;
First information holding means for holding access destination information for specifying an access target for receiving an access request and transmitting specific software to a transmission source of the access request;
Second information holding means for holding identification information used for identifying a transmission destination to which the access target specified by the access destination information has transmitted the specific software;
When the access destination of the access request when accessing the network by the communication means is the access target specified by the access destination information, the identification held in the second information holding means in the access request Editing means for adding information;
An information processing apparatus comprising: A method of processing network communication by an information processing apparatus connected to a network,
Accessing the access target specified by the access destination information based on the access destination information specifying the access destination;
Access the access target specified by the access destination information, receive specific software from the access target, and identify the transmission destination added to the specific software to which the access target has transmitted the specific software Extracting identification information to be used for
When the access destination of the access request when accessing the network is the access target specified by the access destination information, and when a response to the access request is received from the access target, the identification extracted in the response Adding information, and
Including a processing method. A method of processing network communication by an information processing apparatus connected to a network,
Accessing the access target specified by the access destination information based on the access destination information specifying the access destination;
Access the access target specified by the access destination information, receive specific software from the access target, and identify the transmission destination added to the specific software to which the access target has transmitted the specific software Extracting identification information to be used for
When the access destination of the access request when accessing the network is the access target specified by the access destination information, adding the extracted identification information to the access request;
Including a processing method. A method of processing network communication by an information processing apparatus connected to a network,
Sending an access request to an access point on the network;
Receiving a response to the access request from the access destination of the access request;
When the access destination of the access request is the special access target specified by the access destination information specifying the special access target that receives the access request and transmits the specific software to the transmission source of the access request, Adding identification information used to identify a destination to which the special access target has transmitted the specific software to the received response;
Including a processing method. In a program for controlling a computer connected to a network,
A communication means for communicating with an access destination on the network;
Access control means for accessing the access target specified by the access destination information for specifying the access destination;
Extraction means for extracting identification information added to the specific software received from the access target accessed by the access control means and used to identify the transmission destination to which the access target has transmitted the specific software;
The access destination of the access request when accessing the network by the communication means is the access target specified by the access destination information, and when a response to the access request is received from the access target, As editing means for adding the identification information extracted by the extracting means,
A program for causing the computer to function. In a program for controlling a computer connected to a network,
A communication means for communicating with an access destination on the network;
Access control means for accessing the access target specified by the access destination information for specifying the access destination;
Extraction means for extracting identification information added to the specific software received from the access target accessed by the access control means and used to identify the transmission destination to which the access target has transmitted the specific software;
When the access destination of the access request when accessing the network by the communication means is the access target specified by the access destination information, the identification information extracted by the extraction means is added to the access request As an editing tool,
A program for causing the computer to function. In a program for controlling a computer connected to a network,
A communication means for communicating with an access destination on the network;
First information holding means for holding access destination information for specifying an access target for receiving an access request and transmitting specific software to a transmission source of the access request;
Second information holding means for holding identification information used for identifying a transmission destination to which the access target specified by the access destination information has transmitted the specific software;
The access destination of the access request when accessing the network by the communication means is the access target specified by the access destination information, and when a response to the access request is received from the access target, As an editing means for adding the identification information held in the second information holding means,
A program for causing the computer to function. In a program for controlling a computer connected to a network,
A communication means for communicating with an access destination on the network;
First information holding means for holding access destination information for specifying an access target for receiving an access request and transmitting specific software to a transmission source of the access request;
Second information holding means for holding identification information used for identifying a transmission destination to which the access target specified by the access destination information has transmitted the specific software;
When the access destination of the access request when accessing the network by the communication means is the access target specified by the access destination information, the identification held in the second information holding means in the access request As an editing means to add information,
A program for causing the computer to function.

Images