JP6851212B2 - Access monitoring system - Google Patents

Description

The present invention relates to an access monitoring system that monitors access to shared resources in a network.

Multiple computers are used in the business of companies, schools, government offices, and other organizations (hereinafter referred to as "corporations, etc."), and they are connected by a network. And since a wide variety of information is stored in the computer, if an abnormality such as a failure occurs in the computer in the network, the business will be hindered, and in the case of information leakage to the outside, compliance will be taken. Problems can also occur. Therefore, companies and others monitor daily for any abnormalities in the network.

Especially in companies, etc., because it is necessary for multiple persons in charge to perform common tasks, files and folders used for common tasks, or servers such as file servers and database servers are set to be accessible from multiple computers. Has been done. Here, files (shared files) and folders (shared folders) that can be accessed from multiple computers are called shared resources, and a server that stores shared resources is called a shared server. An example of a system for sharing shared resources is shown in Patent Document 1 below.

Shared resources are very important because they are used by multiple persons in charge. Therefore, as shown in Patent Document 2 below, the access authority is strictly controlled.

Japanese Unexamined Patent Publication No. 2013-235339 Japanese Unexamined Patent Publication No. 2007-94493

In recent years, a method using ransomware has been known as a method of cyber attack. Ransomware is to make an infected computer unusable by locking the computer or encrypting files against the intention of the operator, and then returning it to its original state. It is a type of malicious program that unreasonably demands money in exchange. In many cases, when a malicious attachment contained in an email is opened, the malicious program is installed or the malicious website that has been tampered with is directed to the malicious website that attacks the vulnerability. Infect your computer with ransomware.

When a computer is infected with ransomware, it becomes impossible to operate the computer, and the infected computer and files shared on the network are encrypted and become unusable. In addition, financial damage will occur if the request for money is met.

On the other hand, if a computer infected with ransomware is on the network, it is necessary to disconnect the infected computer from the network as soon as possible to prevent infection to other computers.

In particular, if shared resources in the network become unusable due to ransomware, the business of companies etc. may be stopped extensively, and the impact will be incomparably greater than when one computer is infected. ..

Therefore, antivirus software is used to prevent infection with ransomware, but antivirus software only implements entrance measures to detect ransomware and cannot be detected by antivirus software. In the case of (the entrance measures have been breached), there are almost no effective measures at present.

This is because it was not easy to determine whether the access to the shared resource was a normal access or an abnormal access.

The present inventor has invented an access monitoring system in view of the above problems.

The first invention is an access monitoring system that monitors access to a shared resource in a network, and the access monitoring system is based on detection history information indicating that the shared resource has been accessed. An abnormal access determination processing unit that determines whether there is an abnormal access to the shared resource, and an operation log that generates operation log information including information indicating that there was an abnormal access when it is determined that there is an abnormal access. Abnormal access was performed in the information processing unit, the operation log information determination processing unit that determines whether or not the shared resource was abnormally accessed based on the operation log information, and the operation log information determination processing unit. It is an access monitoring system including a notification processing unit that gives a predetermined notification when the determination is made.

In the present invention, it is possible to determine whether or not the access is normal by determining whether or not there has been an abnormal access to the shared resource using the detection history information. As a result, even if the entrance countermeasures by antivirus software are breached, it is possible to quickly take effective measures against ransomware and the like.

In the above-described invention, the access monitoring system detects the detection information including the UNC by adding the date and time information to the shared resource access determination processing unit that determines that the shared resource is accessed. It can be configured like an access monitoring system including a detection history information generation processing unit that stores the detection history information storage unit as history information.

Whether or not the shared resource has been accessed can be determined by various methods, but by determining using the UNC as in the present invention, it is possible to make a simple and reliable determination.

In the above-described invention, the determination of the abnormal access is performed by determining any one or more of the number of accesses to the shared resource, the amount of data of the shared resource accessed, the access time, the number of shared resources accessed, and the number of shared servers accessed. It can be configured like an access monitoring system that uses and judges.

It is preferable to consider factors such as those of the present invention in determining whether or not the access is abnormal.

The first invention can be realized by loading and executing the program of the present invention in a computer. That is, the abnormal access determination processing unit that determines whether or not there is an abnormal access to the shared resource, determines that the computer has the abnormal access, based on the detection history information indicating that the shared resource has been accessed. If so, the operation log information processing unit that generates operation log information including information indicating that there was an abnormal access, and the operation log that determines whether the shared resource has been abnormally accessed based on the operation log information. When the information determination processing unit and the operation log information determination processing unit determine that an abnormal access has been performed, it can be configured like an access monitoring program that functions as a notification processing unit that gives a predetermined notification.

The access monitoring system of the present invention can determine whether or not the access to the shared resource is an abnormal access. Therefore, it is possible to quickly take countermeasures against the spread of damage caused by ransomware performing illegal processing on shared resources.

This is an example of an image diagram of the access monitoring system of the present invention. It is a conceptual diagram which shows typically an example of the structure of the access monitoring system of this invention. It is a conceptual diagram which shows an example of the hardware structure of a computer schematically. It is a flowchart which shows an example of the processing process of the access monitoring system of this invention. It is a figure which shows an example of the access number to a shared resource schematically. It is a figure which shows typically an example of the case where the abnormal access determination processing is performed based on a unit time and the number of accesses to a shared resource.

FIG. 1 shows an example of an image diagram of the access monitoring system 1 of the present invention, and FIG. 2 shows a conceptual diagram showing an example of the configuration of the access monitoring system 1.

The access monitoring system 1 is a computer system for monitoring a network of a company or the like and computers in the network, and is composed of a master server 2, a client terminal 3, a management terminal 4, shared resources, and the like.

The master server 2, client terminal 3, and management terminal 4 of the access monitoring system 1 are realized by various computers such as a server and a personal computer. FIG. 3 shows an example of the hardware configuration of the computer. The computer includes an arithmetic unit 70 such as a CPU that executes arithmetic processing of a program, a storage device 71 such as a RAM or a hard disk for storing information, a display device 72 such as a display, and a keyboard or pointing device (mouse, ten-key, etc.). It has an input device 73 such as, and a communication device 74 that transmits and receives the processing result of the arithmetic unit 70 and the information stored in the storage device 71 via a network such as the Internet or LAN.

Although FIGS. 1 and 2 show a case where the master server 2 is realized by one computer, the functions may be distributed and realized by a plurality of computers.

Each means in the present invention has only a logical distinction in its function, and may form the same area physically or substantially.

A master server 2, a management terminal 4, a client terminal 3, a shared server 5, and the like exist in a network of a company or the like.

The management terminal 4 is a computer operated by an administrator who manages the network, controls the master server 2 via the management terminal 4, and receives various notifications from the master server 2.

The shared server 5 is a server that stores and manages shared resources such as various files, folders, and data accessed by a plurality of users. Examples of the shared server 5 include a file server and a database server.

The client terminal 3 is a computer operated by a general user in a company or the like, and accesses shared resources in the shared server 5 as needed to perform operations such as viewing various files. Further, the client terminal 3 generates operation log information indicating the operation in the client terminal 3 and sends the operation log information to the master server 2 periodically or irregularly.

The client terminal 3 is provided with an agent program, which has functions of a detection history information processing unit 31, an abnormality access determination processing unit 33, and an operation log information processing unit 34. Further, the client terminal 3 is provided with a detection history information storage unit 32 for the agent program to execute processing.

The detection history information processing unit 31 includes a shared resource access determination processing unit 311 and a detection history information acquisition processing unit, and acquires information indicating that the shared resource in the shared server 5 has been accessed as detection history information. To do.

The shared resource access determination processing unit 311 refers to the information on the file system (this is called detection information) output by the OS (Operating System) of the client terminal 3, and UNC (Universal Naming Convention: "\\", ". It is determined whether there is detection information including a file path starting with "//"), and it is determined that the detection information including UNC has access to the shared resource, and the detection information is acquired. The detection information is information indicating the history of operations on the client terminal 3, and is information that can determine that the driver has been started or that the folder has been accessed by the started driver, and is the operation content on the client terminal 3 and the access destination. ， Contains information such as application name.

The detection history information generation processing unit 312 attaches date and time information to the detection information acquired by the shared resource access determination processing unit 311, generates it as detection history information, and stores it in the detection history information storage unit 32 described later. The detection history information is information in which date and time information is added to the detection information.

The detection history information storage unit 32 stores the detection history information generated by the detection history information generation processing unit 312 in the detection history information processing unit 31. The detection history information storage unit 32 preferably stores the detection history information in chronological order based on the date and time information.

The abnormal access determination processing unit 33 determines whether or not there is an abnormal access to the shared resource based on the detection history information stored in the detection history information storage unit 32. As a method of determining whether or not there is an abnormal access, for example, it can be determined whether or not a predetermined condition is satisfied based on the detection history information within a certain period of time.

As a predetermined condition, the operation content is file open, and the number of detection history information whose access destination is a shared resource within a certain period is equal to or more than a predetermined threshold (number of file open), or the operation content is saved in a file. (Or write), the number of detection history information whose access destination is a shared resource within a certain period is equal to or greater than a predetermined threshold (number of saved files), or the operation content is file open and the access destination Is a shared resource The total value of the data amount of the shared resource within a certain period is equal to or more than a predetermined threshold (total amount of data of the opened file), or the operation content is file save (or write). The access destination is a shared resource Whether the total value of the data amount of the shared resource within a certain period is equal to or more than a predetermined threshold (total amount of data of the saved file), the operation content is file deletion, and the access destination is Whether the number of detection history information that is a shared resource within a certain period is equal to or greater than a predetermined threshold (number of times the shared resource is deleted) and the like.

Furthermore, as another condition, if the amount of change in the total value of the number of accesses (open number) of the shared resource and the number of bytes of the accessed shared resource suddenly increases, it may be determined as abnormal. For example, suppose that the unit time is set to 10 minutes, the resolution is set to 1 minute, and the upper limit of the number of accesses is set to 200, and the number of accesses to the shared resource is shown in FIG. FIG. 5A is a table of the number of accesses for each resolution, and FIG. 5B is a graph of the number of accesses for each resolution.

Then, the abnormal access determination processing unit 33 totals the number of accesses per unit time for each resolution, and determines whether or not the abnormal access is due to whether the relationship between the number of accesses and the threshold value satisfies a predetermined condition. That is, first, the number of accesses during that period is totaled with 0 to 9 minutes as a unit time, and the number of accesses during that period is totaled with 1 to 10 minutes as the next unit time. This is repeated until the final resolution is reached. Then, the number of accesses and the threshold value are compared for each unit time, and it is determined whether or not a predetermined condition is satisfied, for example, the number of accesses exceeds the threshold value or the number of accesses falls below the threshold value. This determination process is shown in FIG. FIG. 6A is a table showing the number of accesses per unit time, and FIG. 6B is a graph showing the number of accesses per unit time. As shown in FIG. 6, it may be determined that an abnormal access has occurred and that the abnormal access has ended.

When the operation log information processing unit 34 determines that there is an abnormal access in the abnormal access determination processing unit 33, the operation log information processing unit 34 generates information indicating the operation history such as operation log information indicating that there is an abnormal access, and masters it. Send to server 2. The following description describes the case where the operation log information is used as the information indicating the operation history, but the information is not limited to the operation log information.

The operation log information processing unit 34 provides not only the operation log information determined by the abnormal access determination processing unit 33 that there is an abnormal access, but also the operation log information based on the detection history information even when a normal operation is performed. It is generated and sends operation log information to the master server 2 periodically or irregularly. When the operation log information is generated to indicate that there is an abnormal access, it is preferable to immediately send the operation log information to the master server 2 separately from the timing of sending the normal operation log information. ， Not limited to that. The operation log information is information that includes "information indicating abnormal access" as the operation content in addition to the operation content in the detection history information. That is, the detection history information and the operation log information differ depending on whether or not they include information indicating abnormal access. As the operation log information, the detection history information other than the case where the abnormal access is determined as described above may be used as it is.

Further, when the operation log information processing unit 34 generates the operation log information, the abnormal access determination processing unit 33 determines that an abnormal access has occurred and that the abnormal access has ended, as shown in FIG. If this is the case, operation log information that distinguishes between "abnormal access execution" and "abnormal access termination" and abnormal access may be generated and sent to the master server 2.

Information indicating the operation history, such as the operation log information generated by the operation log information processing unit 34, may be stored in a predetermined storage device 71 of the client terminal 3.

The master server 2 manages and monitors the entire network, and includes an operation log information acquisition processing unit 21, an operation log information storage unit 22, an operation log information determination processing unit 23, and a notification processing unit 24.

The operation log information acquisition processing unit 21 acquires information indicating an operation history such as operation log information transmitted from the client terminal 3, and stores the information in the operation log information storage unit 22, which will be described later.

The operation log information storage unit 22 stores information indicating the operation history, such as the operation log information acquired by the operation log information acquisition processing unit 21.

Does the operation log information determination processing unit 23 include operation history information including "information indicating abnormal access" among the information indicating the operation history such as the operation log information acquired by the operation log information acquisition processing unit 21? To judge. For example, if the operation content in the operation log information includes information indicating "abnormal access execution", it is determined as operation log information including "information indicating abnormal access".

When the notification processing unit 24 determines in the operation log information determination processing unit 23 that the operation history information indicating abnormal access execution is included, the notification processing unit 24 sends the management terminal 4 operated by the administrator or a predetermined notification destination of the administrator. In response, an alert notification is sent indicating that there was an abnormal access. In this case, for example, like a messaging service, the notification may be sent directly to the management terminal 4, or may be configured to be sent by e-mail or the like based on the e-mail address of the administrator registered in advance. Good.

Further, as shown in FIG. 6, when the operation log information that distinguishes between "abnormal access execution" and "abnormal access termination" and abnormal access is acquired from the client terminal 3, abnormal access occurs. , A notification that distinguishes the end of abnormal access may be sent to the management terminal 4 operated by the administrator or a predetermined notification destination of the administrator at each timing.

Next, an example of the processing process of the access monitoring system 1 of the present invention will be described with reference to the flowchart of FIG.

When some operation or processing is executed on the client terminal 3, the OS of the client terminal 3 outputs the detection information. Then, the shared resource access determination processing unit 311 refers to the detection information output from the OS of the client terminal 3 and determines whether or not there is detection information including UNC. Then, when it is determined that there is detection information including UNC, it is determined that there is access to the shared resource, and the detection information is acquired.

Then, the detection history information generation processing unit 312 generates the detection information determined by the shared resource access determination processing unit 311 that there is access to the shared resource as detection history information with date and time information, and stores the detection history information. It is stored in the unit 32 (S100).

Then, based on the detection history information stored in the detection history information storage unit 32, the abnormal access determination processing unit 33 determines whether or not there is an abnormal access (S110).

When the abnormal access determination processing unit 33 determines that there is an abnormal access, the operation log information processing unit 34 performs operation log information indicating that there is an abnormal access, for example, "abnormal access execution" or "abnormal access end" as the operation contents. , Etc., and also generate operation log information including date and time information, information based on detection history information such as access destinations, and identification information of the client terminal 3 (S120). Then, the operation log information processing unit 34 sends the generated operation log information to the master server 2 (S130).

The operation log information sent from the operation log information processing unit 34 of the client terminal 3 is acquired by the operation log information acquisition processing unit 21 of the master server 2 (S140) and stored in the operation log information storage unit 22.

Then, the operation log information determination processing unit 23 of the master server 2 determines whether the operation log information acquired by the operation log information acquisition processing unit 21 includes information indicating an abnormal access (S150). For example, it is determined whether the operation contents of the operation log information include information such as "abnormal access execution" and "abnormal access termination".

When it is determined that the information indicating the abnormal access is included, the notification processing unit 24 determines that the management terminal 4 operated by the administrator or the predetermined notification destination of the administrator has been abnormally accessed. An alert notification indicating is sent (S160). At this time, the date and time when the abnormal access was made based on the date and time information, the information indicating the access destination, the identification information of the client terminal 3, etc. of the operation log information including the information indicating that there was an abnormal access. , Access destination, client terminal 3 where abnormal access was made, etc. are also preferably notified.

By executing the above processing, it is possible to determine whether the access to the shared resource is an abnormal access, and if there is an abnormal access, promptly notify the administrator. It becomes.

In addition to notifying the administrator, a control instruction for blocking the network communication may be sent to the client terminal 3 by UDP communication. In this case, when the client terminal 3 receives the control instruction from the master server 2, it returns a response that the control instruction for blocking the network communication is received and blocks communication other than the network communication with the master server 2. Perform control.

It is preferable that the agent program of the client terminal 3 executes whether or not the access is abnormal. This is because if the detection history information is transmitted to the master server 2 at any time, the communication charge will increase, and if the master server 2 performs the determination process for abnormal access, the load on the master server 2 will increase. On the other hand, it is possible to configure the system so that the detection history information is sent to the master server 2 and the master server 2 determines whether or not the access is abnormal.

As a method of determining abnormal access in the abnormal access determination processing unit 33, in addition to the above, continuous access to the shared resource for a long time may be determined based on the date and time information included in the detection history information. In this case, for example, the time and the number of times are determined based on the detection history information of the date and time information when a certain file is opened and the detection history information of the date and time information when the same file is closed, and that is a predetermined value. Whether or not the access is abnormal is determined based on whether the access exceeds the threshold value.

Alternatively, the shared resource name may be extracted from the file path included in the detection history information to determine the diversity of the types of shared resources accessed. In this case, the shared resource name is extracted from the file path included in the detection history information, and it is determined whether or not the access is abnormal based on whether the number of shared resources being accessed exceeds a predetermined threshold value in a predetermined unit time. ..

As another method, the server names (five shared servers) may be extracted from the file path included in the detection history information, and the diversity of the shared servers 5 in which the accessed shared resources are stored may be determined. In this case, 5 shared servers are extracted from the file path included in the detection history information, and whether or not the access is abnormal is determined by whether the number of shared servers 5 being accessed exceeds a predetermined threshold value in a predetermined unit time. judge.

In addition, although the number of shared resources for which the file was opened (file read) as the operation content included in the detection history information exceeds the first threshold value in a predetermined unit time, the file is saved as the operation content included in the detection history information. If the number of shared resources (written to a file) does not exceed the second threshold value, it is determined that there is an error. The first threshold value> the second threshold value. In this case, it is presumed that many shared resources are accessed, data is collected, and the data is written to the folder intended for unauthorized removal, so it can be determined that the access is abnormal.

Since the detection history information includes the name of the application accessing the shared resource, the abnormal access determination processing unit 33 may include the name of the application in the operation log information. Then, by sending the operation log information including the application name, the operation log information determination processing unit 23 of the master server 2 can identify the application executing the abnormal access, and when the notification processing unit 24 gives a notification, an abnormality occurs. You may notify the name of the application that is accessing.

The abnormal access determination processing unit 33 extracts the shared resource name from the file path included in the detection history information, and determines the number of shared resources being accessed in a predetermined unit time. In addition, the name of the application that is accessing the shared history information included in the detection history information is extracted, and the number of applications is determined. Then, when the ratio of the number of shared resources accessed and the number of applications that executed access in a unit time satisfies a predetermined condition, for example, the number of shared resources is large but the number of applications is small. In such cases, it is determined that there is a high possibility that an unauthorized application is accessing the shared resource illegally, and it is determined that the access is abnormal.

As another judgment method, the number of accesses is totaled for each application instructing access to the shared resource, and if a specific application is prominent and the number of accesses is large, it can be determined that the application is an unauthorized application. Access by is judged as abnormal access.

The client terminal 3 may acquire the screen displayed by the display device 72 when generating the detection history information as image information and associate it with the detection history information. In this case, when the abnormal access determination processing unit 33 determines that there is an abnormal access, the image information of the screen corresponding to the detection history information is sent to the operation log information generated based on the detection history information. The notification processing unit 24 of the master server 2 that has received the above can notify the administrator or the management terminal 4 of the screen when the execution of abnormal access is determined as image information.

As a modification of Examples 1 to 4, when it is determined that an abnormal access has occurred because the operation log information of the client terminal 3 contains an operation content indicating an abnormal access execution, the operation log information determination processing unit 23 However, if it is determined that an abnormal access has been made by the plurality of client terminals 3, the weighting of the alert notification notified by the notification processing unit 24 may be changed.

Further, the operation log information determination processing unit 23 may be configured to change the weighting of the alert notification notified by the notification processing unit 24 according to the number and frequency of the operation log information determining that there has been an abnormal access. ..

Changing the weighting of alert notifications increases the importance of alert notifications as the number of client terminals 3 that have determined that an abnormal access has occurred in the operation log information determination processing unit 23 increases. This is because the risk increases as the number of client terminals 3 that have undergone abnormal access increases.

The processing for changing the weighting includes increasing the number and frequency of alert notifications according to the importance, displaying the size of the characters to be notified, and displaying the importance in the notification itself. There is also a way to change the notification method according to the importance, for example, mail only, message only, both mail and message, mail and message and all of telephone. Furthermore, the notification range may be changed according to the importance. For example, the number of notification destinations may be increased as the importance increases, such as only the person, the person and the administrator, the person in charge of information security, the boss, and the members in the department.

The access monitoring system 1 of the present invention can determine whether or not the access to the shared resource is an abnormal access. Therefore, it is possible to quickly take countermeasures against the spread of damage caused by ransomware performing illegal processing on shared resources.

1: Access monitoring system 2: Master server 3: Client terminal 4: Management terminal 5: Shared server 21: Operation log information acquisition processing unit 22: Operation log information storage unit 23: Operation log information judgment processing unit 24: Notification processing unit 31 : Detection history information processing unit 32: Detection history information storage unit 33: Abnormal access judgment processing unit 34: Operation log information processing unit 311: Shared resource access judgment processing unit 312: Detection history information generation processing unit 70: Arithmetic device 71: Storage Device 72: Display 73: Input device 74: Communication device

Claims (4)

An access monitoring system that monitors access to shared resources in the network.
The access monitoring system is
An abnormal access determination processing unit that determines whether or not there is an abnormal access to the shared resource based on the detection history information indicating that the shared resource has been accessed.
When it is determined that there is an abnormal access, the operation log information processing unit that generates operation log information including information indicating that there was an abnormal access, and the operation log information processing unit
Based on the operation log information, the operation log information determination processing unit that determines whether an abnormal access to the shared resource has been performed, and the operation log information determination processing unit.
When the operation log information determination processing unit determines that an abnormal access has been performed, the notification processing unit that gives a predetermined notification and the notification processing unit
An access monitoring system characterized by being equipped with. The access monitoring system further
A shared resource access determination processing unit that determines that there is access to the shared resource based on the detection information that includes UNC, and
A detection history information storage unit that stores detection history information,
A detection history information generation processing unit that attaches date and time information to the detection information and stores it in the detection history information storage unit as detection history information.
The access monitoring system according to claim 1, further comprising. The determination of abnormal access is
Judgment is made using any one or more of the number of accesses to the shared resource, the amount of data of the shared resource accessed, the access time, the number of shared resources accessed, and the number of shared servers accessed.
The access monitoring system according to claim 1 or 2. Computer,
An abnormal access determination processing unit that determines whether or not there is an abnormal access to the shared resource based on the detection history information indicating that the shared resource has been accessed.
Operation log information processing unit that generates operation log information including information indicating that there was an abnormal access when it is determined that there is an abnormal access.
Operation log information determination processing unit that determines whether an abnormal access to the shared resource has been performed based on the operation log information.
When the operation log information determination processing unit determines that an abnormal access has been performed, the notification processing unit that gives a predetermined notification,
An access monitoring program characterized by functioning as.

Images