JP6254401B2 - Information processing apparatus, information processing method, and information processing system - Google Patents

Description

  The present invention relates to security technology.

  In recent years, as a new form of cyber attack on a company, a method called a targeted attack that targets a computer owned by a specific employee in the company and steals information in the company by infecting the computer with malware is increasing. The most common attack method for targeted attacks is a spoofed email that addresses the real user's email address. Mail header spoofing or a real-time user computer called RAT (Remote Access Tool) The attack mail is sent to the attack target person by the technique such as manipulating in. In addition, the methods of impersonation have been diversified and sophisticated, such as “diversion of real mail”, “forgery of system mail”, and “forgery of product inquiry”, and users have trusted the contents of attack mail. The risk of inadvertent malware infection is increasing.

  By the way, hackers attacking malware use techniques such as social engineering to contact people and organizations that are close to the attack target, and to obtain real-world information that is easy to trust. However, it is difficult to obtain information if the security level of the company to which the attack target belongs is sufficiently high. Therefore, as one of the actions taken by hackers in recent years, malware is sent to "partner companies" and "related group companies" of companies to which the attack target belongs, and e-mail data etc. are exploited from malware infected computers, There is a tendency to obtain information on the attack target. In other words, there are an increasing number of cases where the strategy of attacking from the outer moat and dropping Honmaru is taken.

JP2003-115878

  Conventionally, as in Patent Document 1, when an attack by such a spoofed mail is received, unless the root, that is, the malware infection status of the mail transmission source company is improved, the root cannot be cut off, and the attack mail The number of people increased and the risk of being attacked for a longer period remained. As a specific measure against such a situation, it is necessary for the system administrator or the like to contact the sender user for confirmation each time, or to guess the specific attack technique and approach of the hacker in the first place. For example, it was necessary for the system administrator to analyze the information in order to take appropriate measures.

  The present invention has been made in view of such problems, and reduces the work burden on the system administrator for secondary countermeasures after a cyber attack by a hacker, and reduces the risk of malware infection due to the cyber attack. Provide technology for.

According to one aspect of the present invention, when malware is detected based on an email received from an external device, a specifying unit that specifies an email address of the external device;
Search means for searching for business card information from a storage device holding business card information including the mail address using the email address specified by the specifying means as a search key;
Notification means for notifying business card information as a search result by the search means ,
The searching means searches the storage device for business card information of a business card in which a mail address including a domain name included in the mail address specified by the specifying means is recorded .
Further, when malware is detected based on an email received from an external device, a specifying means for specifying the email address of the external device;
Search means for searching for business card information from a storage device holding business card information including the mail address using the email address specified by the specifying means as a search key;
Notification means for notifying business card information as a search result by the search means;
Control means for prohibiting access to a URL included in the business card information searched by the search means;
It is characterized by providing.
Further, when malware is detected based on an email received from an external device, a specifying means for specifying the email address of the external device;
Search means for searching for business card information from a storage device holding business card information including the mail address using the email address specified by the specifying means as a search key;
Notification means for notifying business card information as a search result by the search means;
With
The notification means includes
The search means identifies an owner included in the searched business card information, and notifies the owner of a message indicating that the owner may be infected with malware.

  According to the configuration of the present invention, it is possible to reduce the work burden on the system administrator for the secondary countermeasure after receiving a cyber attack by a hacker, and to reduce the risk of malware infection due to the cyber attack.

  Moreover, by collecting and reporting the infection status, it is possible to grasp the malware communication status in the network composed of the company and related companies, and use it as auxiliary data for developing an appropriate strategy for security incidents.

The block diagram which shows the structural example of an information processing system. The flowchart of the process which the terminal 1 performs. The figure which shows one structural example of a business card information group. The figure which shows the other structural example of a business card information group. The block diagram which shows the hardware structural example of a computer apparatus.

  Preferred embodiments of the present invention will be described below with reference to the accompanying drawings. The embodiment described below shows an example when the present invention is specifically implemented, and is one of the specific examples of the configurations described in the claims.

[First Embodiment]
First, a configuration example of the information processing system according to the present embodiment will be described with reference to the block diagram of FIG. As shown in FIG. 1, the information processing system according to the present embodiment includes a terminal 1, a terminal 2, and a business card information storage unit 3, and each device is connected to a network 4 such as a LAN or the Internet. Yes.

  The configuration shown in FIG. 1 is an example, and the number of terminals, the network configuration, and the like are not limited to those in FIG. For example, all of the functions of the terminal 1 and the business card information storage unit 3 may be performed by a management server / mail server (not shown) connected on the network 4, or some functions may be performed by the management server / mail server. It may be configured. The business card information storage unit 3 may be provided in a storage device separate from the terminal 1 connected on the network 4, or provided in an external storage device 506 (storage device) described later in the terminal 1. Also good.

  Each of the terminals 1 and 2 includes a general PC (personal computer), a server device, a network scanner, a handy terminal, a smartphone, and the like that has a mail transmission / reception function and can execute each process described below as performed by the terminal. Equipment.

  First, the terminal 1 will be described. The terminal 1 includes a business card information acquisition unit 11, a mail communication unit 12, and a malware detection unit 13.

  The business card information acquisition unit 11 acquires information written on the business card as business card information, and registers the acquired business card information in the business card information storage unit 3. There are various methods for acquiring business card information, and the method is not limited to a specific method. For example, a business card is scanned using a scanner device (OCR function), and a group of information (company name, department name, personal name, title, fax number, telephone number, e-mail address, URL, etc.) read by the scan is obtained as business card information You may get as Further, a business card is imaged using an imaging device (which may be provided in the terminal 1 or may be externally connected to the terminal 1), and the above-described information group is subjected to character recognition technology from the image obtained by the imaging. And the acquired information group may be acquired as business card information. In addition, an information group input using an operation unit 504 described later may be acquired as business card information, or an information group received from an external device connected on the network 4 may be acquired as business card information. Absent.

  In FIG. 1, the business card information acquisition unit 11 is provided in the terminal 1, but may be provided in a device (connected to the network 4) separate from the terminal 1. However, the business card information acquisition unit 11 registers the acquired business card information in the business card information storage unit 3.

  The mail communication unit 12 transmits / receives mail to / from an external device (terminal 2 in the case of FIG. 1) connected to the network 4 and stores the transmission / reception history in a memory accessible by the terminal 1 as a transmission / reception history. Record. In FIG. 1, the mail communication unit 12 is provided in the terminal 1, but may be provided in a device (connected to the network 4) separate from the terminal 1, or a mail (not shown) You may provide in a server.

  The malware detection unit 13 is for detecting malware based on an email received from an external device (terminal 2 in the case of FIG. 1). Specifically, the email received from the external device is attached with malware, the script that infects malware is written in the email (HTML format email), or the URL that infects malware when accessed Detect what is written in the email. As with the business card information acquisition unit 11, the malware detection unit 13 is provided in the terminal 1 in FIG. 1, but in a device (connected to the network 4) separate from the terminal 1. It may be provided. Specifically, the malware detection unit 13 may be provided in a network device such as a mail server, a spam filter server, a UTM, or a firewall connected to the network 4 that passes in the mail delivery process. In such a case, the malware detection unit 13 notifies the detection result to the mail transmission destination (for example, using an email, an instant message, etc.), so that the transmission destination terminal performs the detection after the malware detection unit 13 detects it. Each process to be described later is executed as a process.

  Next, the terminal 2 will be described. In the following, the terminal 2 transmits to the terminal 1 an email with malware attached, an email with a script that infects malware, or an email with a URL that infects malware when accessed. To do.

  Next, a process performed by the terminal 1 that has received from the terminal 2 an email with malware attached, an email with a script that infects malware, or an email with a URL that infects malware when accessed 2 will be described with reference to a flowchart of the process.

  In step S1, the mail communication unit 12 records the mail transmitted from the terminal 2 (the mail with the malware attached, the mail with the script that infects the malware, or the URL that is infected with the malware when accessed). A mail reception history (mail record) is created and additionally registered in the transmission / reception history registered in the memory accessible by the terminal 1.

  In step S2, the malware detection unit 13 indicates that the malware is attached to this email, that a script that infects malware is written in this email, or that a URL that infects malware when accessed is written in this email. Is detected, the information related to malware (malware file name, URL that infects malware if specified, email address of the sender, etc.) is extracted from this email and included in the extracted information The reception history including the mail address is extracted from the transmission / reception history.

  In step S3, the malware detection unit 13 extracts the mail address of the mail transmission source (in the case of FIG. 1, the mail address of the terminal 2) from the reception history extracted from the transmission / reception history in step S2.

  In step S4, the malware detection unit 13 searches for one or more business card information from the business card information group registered (held) in the business card information storage unit 3 using the mail address extracted from the reception history in step S3 as a search key. . In this search, the business card information of the business card in which the mail address extracted from the reception history in step S3 may be searched. The domain name included in the mail address extracted from the reception history in step S3. You may make it search the business card information of the business card in which the mail address containing is described. That is, the search condition is not limited to a specific search condition.

  In general, in order to obtain a wide range of business card information at once, the search conditions are “domain name match”, “group related company”, “date and time when the business card information including the email address extracted from the reception history in step S3 is registered, Arbitrary conditions may be selected from a plurality of search conditions prepared in advance such as “business card information registered at the same time”. For the selection of the search condition, for example, a search condition selection screen may be displayed on a display screen (not shown), and the search condition selected by the user using a mouse or a keyboard may be adopted.

  In step S5, the malware detection unit 13 acquires the business card information as the search result in step S4 from the business card information storage unit 3, and notifies the acquired business card information. Various notification processes in this step can be considered.

  For example, the searched business card information may be notified, and / or alternatively, the business card information including information similar to the searched business card information may be notified. Here, the “business card information including information similar to the searched business card information” means, for example, that the searched business card information includes the same company name and department name included in the searched business card information. It is business card information partially including the same information as the information. Note that, for example, a group of information designated and associated by the user, such as wanting to associate them as the same group but with different department names, may be “business card information including information similar to the retrieved business card information”.

  In the business card information notification method, for example, each information included in the business card information is displayed as a list on a display screen (not shown) of the terminal 1 or other device as text, or additionally extracted as information related to malware. Information may be displayed. The business card information may be recorded as text data in a file, or the file may be recorded in a memory or transmitted to an external device.

  Here, a configuration example of the business card information group registered in the business card information storage unit 3 will be described with reference to FIG. In FIG. 3, the name, company name, affiliation, telephone number, and mail address corresponding to each business card are registered.

  Based on the business card information obtained in this manner, the user of the terminal 1 or the system administrator appropriately uses the information described in the business card information to determine the user of the terminal 2 or the terminal 2 that has sent the malware mail. You can notify the administrator of your network of this fact, and you can request or give instructions for checking the status of malware infection in the terminal and the network that contains the terminal, as well as requesting or instructing it. It can be prevented. Furthermore, it is possible to raise the crisis awareness of the terminal user and the network manager in this case and contribute to the improvement of the mutual security level.

  Another configuration example of the business card information group registered in the business card information storage unit 3 will be described with reference to FIG. In FIG. 4, in addition to the name, company name, affiliation, telephone number, and e-mail address corresponding to each business card, information of the user who scanned (acquired) the business card (the owner who received the business card) is registered. . This makes it possible to identify multiple individuals who have the same business card information and raise awareness of the danger by notifying individuals of the status of malware mail reception and the possibility of infection. Can prevent the damage from spreading.

  In the case of Web mail, there is a high possibility that the domain name of the mail address of the terminal 2 that sent the malware is the same as the domain name of the other terminal. Therefore, in the case of a specific domain name, it is possible to notify the owner who owns the same business card as the name of the terminal 2 that sent the malware, and to improve the convenience for the user.

  In addition, there is a possibility that other terminals in the company having the terminal 2 that has transmitted the malware are also infected with the malware. Therefore, it is possible to notify the owner of the business card including the corresponding company name or the domain name of the mail address that the malware mail is received or that there is a possibility of being infected.

  In addition, the e-mail address included in the searched business card information, the e-mail address including the domain name included in the e-mail address included in the searched business card information, and information similar to the searched business card information are included. If a mail is received from an external device having one of the mail addresses included in the business card information, a message indicating that there is a possibility of being infected with malware may be notified. I do not care.

  Further, as in the mail address shown in FIG. 3, the domain name of the mail address of the terminal 2 that sent the malware is determined, and the mail server is prohibited from sending and receiving mail from the mail address including the domain name. By setting to, malware intrusion can be prevented. There are various forms of such prohibition processing.

  For example, the e-mail address included in the business card information searched in step S4, the e-mail address including the domain name included in the e-mail address included in the searched business card information, and information similar to the searched business card information are included. E-mail transmission and / or reception with an external device having one of the e-mail addresses included in the registered business card information is prohibited.

  Further, phishing can be prevented by determining the URL to which the terminal 2 that sent the malware belongs from the business card information and setting the access to the URL to be prohibited (control means). In addition, the reception status from the mail address extracted in step S3 in the past and the transmission status to the mail address are totaled, and the result of the totalization is displayed together with the business card information searched using the mail address as a search key. It doesn't matter.

  Also, search for an arbitrary mailbox based on the email address information of the malware information, search for incoming email records from the corresponding email address, and write the business card information obtained from the business card information storage unit based on the corresponding email address. It may be displayed. Also, the corresponding mail record may be quarantined / deleted.

  In addition, the e-mail address included in the searched business card information, the e-mail address including the domain name included in the e-mail address included in the searched business card information, and information similar to the searched business card information are included. When the transmission and / or reception of an email with an external device having one of the email addresses included in the business card information is detected, a warning is given to the user, and the transmission and / or Alternatively, a screen for allowing the user to select whether or not to continue reception may be displayed. When the user inputs an instruction to continue, the transmission and / or reception is continued. When an instruction to not continue is input, the transmission and / or reception is interrupted.

  In addition, the e-mail address included in the searched business card information, the e-mail address including the domain name included in the e-mail address included in the searched business card information, and information similar to the searched business card information are included. When detecting the transmission and / or reception of an email with an external device having any of the email addresses included in the business card information, the business card information including the email address of the external device is notified. It doesn't matter.

  In addition, the combination of the information displayed and alert | reported is not restricted to said example, You may combine suitably.

  When the transmission / reception history is recorded, the transmission / reception history and business card information may be recorded in association with each other using the mail address as a key. In this case, when the malware detection unit 13 detects malware based on the received mail, the reception history including the relevant business card information is searched using the reception history as a search key.

[Second Embodiment]
The business card information acquisition unit 11, the mail communication unit 12, and the malware detection unit 13 may all be configured by hardware or may be configured by software (computer program). When each part is configured by software, a computer device having the hardware configuration shown in FIG. 5 can be applied to the terminal 1.

  The CPU 501 executes processes using computer programs and data stored in the RAM 502 and the ROM 503, thereby controlling the operation of the entire apparatus and executing the processes described above as being performed by the terminal 1.

  The RAM 502 temporarily stores an area for temporarily storing the computer program and data loaded from the external storage device 506 and data received from the outside (terminal 2 in FIG. 1) via the I / F (interface) 507. Has an area to store automatically. Further, the RAM 502 has a work area used when the CPU 501 executes various processes. That is, the RAM 502 can provide various areas as appropriate. The ROM 503 stores setting data of this apparatus, a boot program, and the like.

  The operation unit 504 is configured by a user interface such as a mouse or a keyboard, and various instructions can be input to the CPU 501 by the user of the apparatus.

  The display unit 505 is configured by a CRT, a liquid crystal screen, or the like, and can display a processing result by the CPU 501 with an image, text, or the like. For example, various information described above can be displayed as what is displayed on the display screen of the terminal 1.

  The external storage device 506 is a large-capacity information storage device represented by a hard disk drive device. The external storage device 506 stores computer programs and data for causing the CPU 501 to realize the functions of the OS (operating system), the business card information acquisition unit 11, the mail communication unit 12, and the malware detection unit 13. . This data includes information described as known information in the above description (even if there is no particular description, information necessary for realizing the above processing is also included).

  Computer programs and data stored in the external storage device 506 are appropriately loaded into the RAM 502 under the control of the CPU 501 and are processed by the CPU 501.

  The I / F 507 is used to connect the apparatus to the network 4 described above, and the apparatus can perform data communication with devices on the network 4 via the I / F 507.

  Each of the above parts is connected to the bus 508. Note that the hardware configuration illustrated in FIG. 5 may be applied to the terminal 2. Further, the hardware configuration shown in FIG. 5 is an example, and for example, a scanner or an imaging device may be added to this configuration.

Claims (14)

When detecting malware based on an email received from an external device, a specifying means for specifying an email address of the external device;
Search means for searching for business card information from a storage device holding business card information including the mail address using the email address specified by the specifying means as a search key;
Notification means for notifying business card information as a search result by the search means ,
The information processing apparatus, wherein the search unit searches the storage device for business card information of a business card in which a mail address including a domain name included in the mail address specified by the specifying unit is recorded . The notification means includes
The identification means aggregates the reception status from the email address identified in the past and the transmission status to the email address, and the result of the aggregation is used together with the business card information retrieved by the retrieval means using the email address as a search key. The information processing apparatus according to claim 1, wherein the information processing apparatus displays the information processing apparatus. The specifying means is:
When malware is detected based on the mail received from the external device, the mail reception history is specified from the transmission / reception history recorded every time the mail is transmitted / received to / from the external device, and the specified reception history from the information processing apparatus according to claim 1 or 2, wherein the identifying mail address of the external device. The identification means is that the email received from the external device is attached with malware, the script that infects malware is written in the email, or the URL that infects malware when accessed is written in the email. Being, when detecting the information processing apparatus according to any one of claims 1 to 3, wherein the identifying mail address of the external device. The business card information processing apparatus according to any one of claims 1 to 4, characterized in that the information obtained by reading the business card mail address is written. When detecting malware based on an email received from an external device, a specifying means for specifying an email address of the external device;
Search means for searching for business card information from a storage device holding business card information including the mail address using the email address specified by the specifying means as a search key;
Notification means for notifying business card information as a search result by the search means;
The information processing apparatus characterized by a control means for inhibiting access to the URL that the searching means is included in the retrieved business card information. When detecting malware based on an email received from an external device, a specifying means for specifying an email address of the external device;
Search means for searching for business card information from a storage device holding business card information including the mail address using the email address specified by the specifying means as a search key;
Notification means for notifying business card information as a search result by the search means;
With
The notification means includes
An information processing apparatus characterized by identifying an owner included in business card information searched by the search means and notifying a message indicating that the owner may be infected with malware. When detecting malware based on an email received from an external device, a specifying means for specifying an email address of the external device;
Search means for searching for business card information from a storage device holding business card information including the mail address using the email address specified by the specifying means as a search key;
Notification means for notifying business card information as a search result by the search means ,
The information processing system , wherein the search means searches the storage device for business card information of a business card in which a mail address including a domain name included in the mail address specified by the specifying means is recorded . When detecting malware based on an email received from an external device, a specifying means for specifying an email address of the external device;
Search means for searching for business card information from a storage device holding business card information including the mail address using the email address specified by the specifying means as a search key;
Notification means for notifying business card information as a search result by the search means;
Control means for prohibiting access to a URL included in the business card information searched by the search means;
An information processing system comprising: When detecting malware based on an email received from an external device, a specifying means for specifying an email address of the external device;
Search means for searching for business card information from a storage device holding business card information including the mail address using the email address specified by the specifying means as a search key;
Notification means for notifying business card information as a search result by the search means;
With
The notification means includes
An information processing system characterized by identifying an owner included in business card information searched by the search means and notifying the owner of a message indicating that the owner may be infected with malware. An information processing method performed by an information processing apparatus,
When the identification unit of the information processing apparatus detects malware based on an email received from an external device, the identification step of identifying the email address of the external device;
A search step in which the search means of the information processing device searches the business card information from a storage device that holds the business card information including the mail address using the mail address specified in the specifying step as a search key;
A notification step of notifying a business card information as a search result by the search step, wherein the notification means of the information processing apparatus ,
In the search step, the business card information of a business card in which a mail address including a domain name included in the mail address specified in the specifying step is searched from the storage device . An information processing method performed by an information processing apparatus,
When the identification unit of the information processing apparatus detects malware based on an email received from an external device, the identification step of identifying the email address of the external device;
A search step in which the search means of the information processing device searches the business card information from a storage device that holds the business card information including the mail address using the mail address specified in the specifying step as a search key;
A notification step in which the notification means of the information processing apparatus notifies the business card information as a search result by the search step;
A control step in which the control means of the information processing apparatus prohibits access to a URL included in the business card information searched in the search step;
An information processing method comprising: An information processing method performed by an information processing apparatus,
When the identification unit of the information processing apparatus detects malware based on an email received from an external device, the identification step of identifying the email address of the external device;
A search step in which the search means of the information processing device searches the business card information from a storage device that holds the business card information including the mail address using the mail address specified in the specifying step as a search key;
A notifying step in which the notifying means of the information processing device notifies the business card information as a search result by the searching step;
With
In the notification step,
An information processing method comprising identifying an owner included in the business card information searched in the search step and notifying the owner of a message indicating that the owner may be infected with malware. The computer program for functioning a computer as each means of the information processing apparatus of any one of Claims 1 thru | or 7 .

Images