JP7328635B2 - Security Incident Detection Device, Security Incident Detection System, Security Incident Detection Method and Program - Google Patents

Description

TECHNICAL FIELD The present invention relates to technology for preventing damage from security incidents at endpoints, and more particularly to a security incident detection device, a security incident detection system, and a security incident detection method that support post-incident measures after a security incident has occurred at an endpoint.

Conventionally, the detection of malware that causes security incidents at endpoints is based on signatures (e.g., characteristic data fragments included in computer viruses, etc., and received data patterns characteristic of attackers' access) based on malware specimens. etc.) has been developed around the ability to create and defend against Here, malware is a general term for software that behaves maliciously and harms users and computers, and security incidents are incidents and accidents that affect business operations and threaten information security. Say.

However, with regard to recent malware, the effectiveness of malware samples themselves is waning due to the existence of targeted attacks and tools that can easily create a wide variety of subspecies.

Therefore, in the information security industry, it is common knowledge that it is impossible to completely protect against security damage such as malware. The idea that “reacting after the fact” is very important is accelerating rapidly.

In this regard, endpoint security products that have recently been attracting attention are endpoint detection abd response (EDR), which supports investigation, recovery, and countermeasures after infection by malware, and prevention of loss and leakage of confidential information. It is a product that supports post-event handling of security incidents such as "DLP" (Data Loss Prevention).

For example, Non-Patent Document 1 discloses a product related to EDR, and Non-Patent Document 2 discloses a product related to DLP.

Cybereason Japan Co., Ltd., “Cybereason EDR”, [online], [searched on January 15, 2019], Internet <URL: https://www.cybereason.co.jp/products/edr/> McAfee, Inc., “McAfee DLP Endpoint”, [online], [searched on January 15, 2019], Internet <URL: https://www.mcafee.com/enterprise/ja-jp/products/dlp-endpoint .html>

However, conventional products related to EDR and DLP are expensive products and have been introduced mainly by large companies. In addition, conventional EDR and DLP products are required to process security incidents in real time and to secure data storage areas for collecting and storing data at all times. There was a problem of increasing the load. In addition, there is a problem that it is necessary to allocate highly specialized human resources for the operation after the introduction of the product.

As a result, it has been difficult for medium-sized companies and small and medium-sized enterprises to introduce products such as EDR and DLP that support post-incident handling of security incidents.

The present invention has been made in view of the above circumstances, and can be used by medium-sized companies and small and medium-sized enterprises without incurring high costs, without imposing a load on endpoints, and without requiring specialized human resources. It is an object of the present invention to provide a security incident detection device, a security incident detection system, and a security incident detection method for endpoints that can be easily introduced even if the

In order to achieve the above object, a security incident detection device according to the present invention, as one aspect thereof, is capable of mutual communication with a user terminal provided in a company via a communication network. a security incident detection device for detecting a security incident that has occurred, comprising: a log information collecting unit for periodically collecting log information related to the security incident from the user terminal; and the log information collected by the log information collecting unit. for each analysis pattern provided for each type of security incident to be detected, a log information analysis unit that analyzes the log information associated with the analysis pattern and detects the possibility of a security incident occurring; An analysis report creation unit that aggregates analysis results of the log information by the log information analysis unit for each company and creates an analysis report, and an analysis report output unit that outputs the created analysis report to the user terminal.

Further, a security incident detection system according to the present invention comprises, as one aspect thereof, a user terminal provided in a company, and a server device capable of mutually communicating with the user terminal via a communication network, A security incident detection system for detecting a security incident that has occurred in a user terminal, wherein the user terminal includes a log information transmission unit that periodically collects and transmits log information related to the security incident, and the server The apparatus includes a log information receiving unit that receives the log information transmitted from the log information transmitting unit, an analysis pattern storage unit that stores an analysis pattern for each type of security incident to be detected, and storage in the analysis pattern storage unit. a log information analysis unit that analyzes the log information associated with the analysis pattern for each analysis pattern and detects the possibility of occurrence of a security incident; and analysis of the log information by the log information analysis unit. an analysis report creation unit that aggregates results for each company and creates an analysis report; and an analysis report output unit that outputs the created analysis report to the user terminal, wherein the user terminal outputs the analysis report. an analysis report display unit for displaying the analysis report output by the unit;

Further, a security incident detection method according to the present invention, as one aspect thereof, is a security incident detection method for detecting a security incident that has occurred in a user terminal provided in a company, wherein a security incident is periodically detected from the user terminal. a log information collection step for collecting log information related to an incident; and for each analysis pattern provided for each type of security incident to be detected, for the log information collected by the log information collection step. A log information analysis step of analyzing the associated log information and detecting the possibility of occurrence of a security incident, and aggregating the analysis results of the log information by the log information analysis step for each company and creating an analysis report. It comprises an analysis report creation step and an analysis report output step of outputting the created analysis report to the user terminal.

The present invention does not incur high costs, does not burden endpoints, and does not require specialized personnel. As a result, even medium-sized enterprises and small and medium-sized enterprises can easily introduce the system.

1 is a schematic configuration diagram of a security incident detection system according to an embodiment of the present invention; FIG. FIG. 2 is a schematic diagram explaining log analysis in the security incident detection system according to the embodiment of the present invention; 1 is a schematic configuration diagram of a security incident detection server according to an embodiment of the present invention; FIG. It is a figure which shows an example of the analysis report based on embodiment of this invention. 1 is a schematic configuration diagram of a user terminal according to an embodiment of the present invention; FIG. 4 is a flow chart showing the flow of log collection processing according to the embodiment of the present invention; 4 is a flow chart showing the flow of log analysis processing according to the embodiment of the present invention;

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings.

<Security incident detection system configuration>
FIG. 1 is a schematic configuration diagram of a security incident detection system 1 according to an embodiment of the present invention. The security incident detection system 1 is a computer system that provides a service for detecting security incidents that have occurred at endpoints 20 of a company (hereinafter referred to as Endpoint Incident Scanning Service; hereinafter referred to as EISS). The endpoint 20 means a server connected to a communication network, a personal computer (hereinafter abbreviated as PC), and a mobile information terminal such as a smartphone. A PC installed in a company will be described. Also, the endpoint 20 is described as a user terminal 20 .

The security incident detection system 1 enables the security incident detection server 10, one or more user terminals 20 of a company, and the security incident detection server 10 and the user terminals 20 to communicate with each other. A communication network 2 including a public network, a private network such as a LAN (Local Area Network), and the like. Under such a configuration, the security incident detection server 10 analyzes the log information 211 periodically transmitted from the user terminal 20 of the company, creates an analysis report 115P for each company, and creates the analysis report 115P. is sent to companies. By viewing this analysis report 115P, a company using EISS can grasp whether or not a security incident has occurred in the user terminal 20 of the company.

As described above, in the security incident detection system 1 according to the present embodiment, instead of performing a series of real-time processing such as data collection, analysis, and result output on the user terminal 20 side provided in the company, the user terminal 20 side However, the security incident detection server 10 only periodically collects and transmits target log information, and analyzes the log information and outputs the results. Therefore, there is an effect that there is no cost or processing load on the company side, and there is no need to allocate highly specialized personnel. In other words, EISS is a service that can be easily introduced even by small and medium-sized enterprises as a service that supports post-incident measures after a security incident occurs at an endpoint.

FIG. 2 is a diagram explaining an overview of log analysis performed in the security incident detection system 1. As shown in FIG.

Before explaining the log analysis of the security incident detection system 1 according to this embodiment, first, log information according to this embodiment will be explained.

The log information 211 according to this embodiment is roughly divided into program execution history 211A, user operation history 211B, and system information 211C. The program execution history 211A is information related to the history of programs executed on the user terminal 20 . For example, a process list (list information of programs executed behind the system (backend)) is applicable. The user operation history 211B is information about the history of operations on the user terminal 20 by the user. For example, there is a USB connection device list (list information of USB devices connected to the user terminal 20) and a network connection history list (list information of which network the user terminal 20 is connected to). The system information 211C is information about the current system status of the user terminal 20 . For example, it is a program hash list (a list of hash information of programs existing in a specific directory).

In this embodiment, such log information 211 is periodically uploaded from the user terminal 20 to the security incident detection server 10 .

The security incident detection server 10 performs log analysis on each piece of log information 211 by referring to the analysis pattern 112 and the master data 113 provided in the security incident detection server 10 . As a result of log analysis, when it is determined that there is a possibility of occurrence of a security incident, it is recorded as post-analysis data 114, which will be described later.

Here, the analysis pattern 112 is logic data regarding conditions for detecting security incidents. For example, when log-analyzing a process list, an analysis pattern 112 related to an unauthorized process prepared in advance is referenced to detect whether or not the process in the process list is unauthorized. Although the analysis pattern 112 of this embodiment is held as data, it may be incorporated into a program as logic.

The master data 113 is data related to security rules for each company and data related to publicly available malicious programs and files. For example, the data regarding the security rules for each company include data regarding whether or not USB can be used and whether or not Wifi can be used. For example, in log analysis of the USB connection device list and the network connection history list described above, the master data 113 for each company is also referred to.

In FIG. 2, for example, the log information A1 in the program execution history 211A is analyzed using analysis pattern 1, and the log information B1 in the user operation history 211B is analyzed using analysis pattern 3 and master data 1. do. In this way, the relationship between the log information 211, the analysis pattern 112, and the master data 113 is not a one-to-one correspondence, but an N-to-N correspondence. In practice, log analysis is performed on the associated log information 211 according to each analysis pattern 112 . At that time, when the master data 113 is required, the master data 113 is also referred to for log analysis.

FIG. 3 is a functional configuration diagram of the security incident detection server 10. As shown in FIG. The security incident detection server 10 is a core server device of the security incident detection system 1 .

As shown in FIG. 3, the security incident detection server 10 is composed of, for example, a hard disk, etc., and is composed of a storage unit 11 for storing data managed by the security incident detection server 10, and, for example, a CPU and memory. A control unit that executes various processes (log collection process, log analysis process) described later in this embodiment by controlling the unit 11, transferring various data, performing various calculations, temporarily storing data, etc. 12 and a communication unit 13 that transmits and receives data to and from the user terminal 20 via the communication network 2 .

More specifically, the storage unit 11 stores log collection control data 111 , analysis patterns 112 , master data 113 , post-analysis data 114 , and report data 115 .

The log collection control data 111 is master data for controlling log collection, and is set for each company. For example, data relating to the timing of log collection, files to be collected as logs (also referred to as configuration files), and the like are set.

The analysis pattern 112 and the master data 113 are data referred to in log analysis, and are as described with reference to FIG.

The post-analysis data 114 is data determined to be suspected of a security incident by log analysis of the security incident detection server 10 . The post-analysis data 114 is created in units of log analysis.

The report data 115 is the data of the analysis report 115P sent to the company. In this embodiment, the user (administrator) of the company can view the analysis report 115P by email or on the management screen site on the Web. It is possible.

FIG. 4 shows an example of the analysis report 115P. FIG. 4(a) is a diagram showing an overview of analysis results for the entire company, and shows an analysis target period, contract details, analysis terminal information, and an overview of analysis results. In the analysis report shown in FIG. 7(a), 115P reports that one of the 13 user terminals 20 is likely to steal information. FIG. 4(b) is a diagram showing the details of the analysis result, showing detection contents for each user terminal 20. As shown in FIG. As shown in FIG. 4(b), when there is no risk of a security incident on the user terminal 20, the content of the detection is "No evidence of information exploitation was found." If there is a risk, a message such as "There is a risk of information exploitation" is output.

The user (administrator) of the company takes countermeasures based on the results of this analysis report 115P. For example, the user terminal 20 that may cause a security incident is exterminated using anti-virus software, or the service provider that provides EISS is contacted to request a specific solution thereafter. This is because the security incident detection system 1 of the present embodiment specializes in detecting security incidents, and is not a system that deals with the resolution of security incidents.

The control unit 12 is classified into a log collection control unit 121 , a log analysis unit 122 , and an analyzed receipt creation unit 123 when subdivided into main functions.

The log collection control unit 121 executes processing on the security incident detection server 10 side in log collection processing, which will be described later. For example, when there is an inquiry about log collection from the user terminal 20, the user refers to the log collection control data 111 and informs whether or not it is time to collect the log, and also selects the file to be collected as the log. When there is an acquisition request for the setting file shown, the log collection setting data 111 is referred to and the setting file is transmitted.

The log analysis unit 122 executes log analysis processing, which will be described later, analyzes the log information transmitted from the user terminal 20 , and registers post-analysis data 114 in the storage unit 11 .

Note that the post-analysis data 114 is data determined to be suspected of causing a security incident, and includes misdetected data, so such data is removed from the post-analysis data 114 . For example, for the program hash list (a list of hash information of programs existing in a specific directory), which is given as an example of the system information 211C, log Analyze, but exclude files not related to security incidents, as not all EXE files in the temp folder are suspect malware.

The analyzed receipt creation unit 123 creates report data 115 for each company based on the post-analysis data 114 created by the log analysis unit 122 . Also, an analysis report 115P based on the created report data 115 is sent to the company administrator.

The security incident detection server 10 has functions as an application server, database server, and Web (World Wide Web) server as described above, and exchanges information with the user terminal 20 using applications and the Web. It is possible. Furthermore, the security incident detection server 10 may consist of a single physical device, or may consist of a system in which a plurality of devices are connected to a network. may be installed in one location, or may be installed in a plurality of locations.

FIG. 5 is a functional configuration diagram of the user terminal 20. As shown in FIG. As shown in FIG. 5, the user terminal 20 includes, for example, a hard disk, a storage unit 21 that stores programs and various data, and an input unit 22 that includes, for example, a keyboard and a mouse. An output unit 23 composed of a display, a speaker, etc., and, for example, a CPU, a memory, etc., which controls the storage unit 21, transfers various data, performs various calculations, temporarily stores data, etc. , a control unit 24 that executes log collection processing described later in this embodiment, and a communication unit 25 that transmits and receives data to and from the security incident detection server 10 via the communication network 2 .

The storage unit 21 stores log information 211 to be collected, a log collection program 212, and the like. The log collection program 212 is an application program installed in each user terminal 20 of a company that uses EISS. The user terminal 20 accesses the security incident detection server 10 based on the log collection program 212 to obtain information related to log collection, such as log collection timing and log collection target files.

As a function of the security incident detection system 1 , the control unit 24 has a log collection unit 241 that periodically collects log information of the user terminal 20 . Note that the control unit 24 of the user terminal 20 of the administrator has, in addition to the log collection unit 241 , a report browsing unit 242 (not shown) for browsing analysis reports created by the security incident detection server 10 . The function of this report browsing unit 242 enables the administrator of the company to browse the analysis report 115P on the user terminal 20. FIG.

A program for executing various processes (log collection process, log analysis process) of the security incident detection system 1 according to the present embodiment is stored in a main storage device such as the above-described memory or an auxiliary storage device such as a hard disk. There is. This program can be recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disc), and a BD (Blu-ray Disc (registered trademark)). Delivery via a communication network is also possible.

<Operation of security incident detection system>
Next, the operation of the security incident detection system 1 according to this embodiment will be described with reference to FIGS. 6 and 7. FIG.

First, log collection processing of the security incident detection system 1 according to the present embodiment will be described with reference to FIG. FIG. 6 is a flowchart showing the flow of log collection processing.

Note that, among the log collection processing shown in FIG. 6, the processing on the user terminal 20 side in steps S20 to S60 is performed by the function of the log collection unit 241 based on the log collection program 212. FIG. On the other hand, among the log collection processing shown in FIG.

When the corporate user activates the user terminal 20 (step S10), the user terminal 20 transmits a log collection inquiry to the security incident detection server 10 (step S20).

Upon receiving the log collection inquiry, the security incident detection server 10 refers to the log collection control data 111 of the inquiring company and transmits to the user terminal 20 a response as to whether or not it is time to collect the log.

When the user terminal 20 receives the response regarding the log collection timing, it determines whether or not it is the log collection timing based on the received response (step S30).

When the user terminal 20 determines that it is time to collect logs (step S30: YES), the user terminal 20 transmits a configuration file acquisition request to the security incident detection server 10 . When the security incident detection server 10 receives the setting file acquisition request, the security incident detection server 10 transmits the setting file of the inquired company to the user terminal 20 . As a result, the user terminal 20 acquires the setting file from the security incident detection server 10 (step S40). The configuration file describes the files that are the targets of log collection.

Next, based on the acquired setting file, the user terminal 20 collects the log information 211 in the user terminal 20 (step S50), compresses the collected log information 211, and transmits the data to the security incident detection server 10. (step S60).

As a result, the security incident detection server 10 collects data-compressed log information 211 from the user terminal 20 .

On the other hand, when the user terminal 20 determines that it is not the log collection timing (step S30: NO), the log collection process ends.

Although the log collection processing shown in FIG. 6 has been described for one user terminal 20 of a company, the security incident detection server 10 collects log information 211 from all target user terminals 20 of the company. .

Next, log analysis processing of the security incident detection system 1 according to the present embodiment will be described using FIG. FIG. 7 is a flowchart showing the flow of log analysis processing. The log analysis process is executed when the log collection process is executed and the log information is received from the user terminal 20 .

The security incident detection server 10 first decomposes the received log information 211 (step S110). Specifically, this means that the data-compressed log information 211 is decompressed.

Next, the security incident detection server 10 analyzes the log information 211 (step S120). This log analysis is performed with reference to the analysis pattern 112 and the master data 113 as described above. That is, the target log information 211 is analyzed using the master data 113 for each analysis pattern 112 to determine whether or not a security incident has occurred (see FIG. 2).

Next, the security incident detection server 10 creates post-analysis data 114 from the log information 211 suspected of having caused a security incident as a result of the log analysis, and stores the created post-analysis data 114 in the storage unit 11 (step S130). ). Note that the security incident detection server 10 removes erroneously detected data from the post-analysis data 114 stored in the storage unit 11 .

Next, the security incident detection server 10 aggregates the post-analysis data 114 for each company and creates an analysis report (step S140). That is, the report data 115 is generated by aggregating the processing of steps S110 to S130 executed for each user terminal 20 for each company.

Next, the security incident detection server 10 stores the created report data 115 in the storage unit 11 and transmits an analysis report 115P based on the report data 115 to the company administrator (step S150). Specifically, the analysis report 115P is attached as a file to an e-mail sent to the company administrator. Of course, in addition to this, the administrator can view the analysis report 115P from the management screen site.

As described above, the security incident detection system 1 of the present embodiment periodically collects log information 211 related to security incidents from user terminals 20 provided in companies, and is provided for each type of security incident to be detected. For each analysis pattern 112, the log information 211 associated with the analysis pattern 112 is analyzed to detect the possibility of occurrence of a security incident, and an analysis report 115P is created by aggregating the analysis of the log information 211 for each company. , to the user terminal 20.

By adopting such a configuration, the security incident detection system 1 of the present embodiment does not incur high costs, does not impose a load on endpoints, and does not require specialized personnel. Has a pronounced effect. As a result, even medium-sized enterprises and small and medium-sized enterprises can easily introduce the system.

More specifically, the security incident detection server 10 periodically collects log information and analyzes the logs, so the necessary security countermeasure processing can be reduced and high costs are not required. In other words, a company using EISS can perform post-incident response processing at low cost after a security incident occurs.

In addition, for example, based on the user operation history 211B, etc., it is possible to monitor by focusing on actions such as the movement of data leading to data leakage or destruction, or the movement of the operation itself, so that human-induced internal crimes can be detected at an early stage. can do.

Furthermore, the security incident detection server 10 can periodically collect and hold volatile data such as a program list (an example of the program execution history 211A). As a result, the evidence of the data record of the user terminal 20 can be clarified.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and various modifications can be made to the embodiments of the present invention without departing from the gist of the present invention. Modifications and modifications can be applied, and those involving such modifications and modifications are also included in the technical scope of the present invention. In addition, the actions and effects described in the embodiments of the invention are merely enumerations of the most suitable actions and effects resulting from the present invention, and the actions and effects of the present invention are described in the embodiments of the invention. are not limited to those listed.

1 security incident detection system 2 communication network 10 security incident detection servers 11 and 21 storage units 12 and 24 control units 13 and 25 communication unit 20 user terminal (end point)
22 input unit 23 output unit 111 log collection control data 112 analysis pattern 113 master data 114 post-analysis data 115 report data 115P analysis report 121 log collection control unit 122 log analysis unit 123 analysis report creation unit 211 log information 212 log collection program 241 log collection unit

Claims (8)

A security incident detection device capable of mutual communication with a user terminal provided in a company via a communication network and detecting a security incident occurring in the user terminal,
A log collection control data storage unit that stores log collection control data related to log collection timing and files to be collected for log information related to security incidents for each company;
When a log collection inquiry for the log information is received from the user terminal, the log collection control data is referred to, and a response as to whether or not it is the log collection timing is transmitted to the user terminal. and referring to the log collection control data and referring to the setting file in response to transmitting a setting file acquisition request indicating the file in response to the fact that it is determined that it is time to collect the log based on the answer. to the user terminal to collect the log information of the file from the user terminal;
For each analysis pattern provided for each type of security incident to be detected, the log information associated with the analysis pattern is analyzed with respect to the log information collected by the log information collection unit, and the security incident is detected. a log information analysis unit that detects the possibility of
an analysis report creation unit that aggregates the analysis results of the log information by the log information analysis unit for each company and creates an analysis report;
an analysis report output unit that outputs the created analysis report to the user terminal;
security incident detection device. 2. The security incident detection device according to claim 1, wherein the log information includes log information regarding program execution history, log information regarding user operation history, and system information. The log information collecting unit collects the log information by the user terminal collecting and transmitting the log information of the file indicated in the setting file received from the security incident detection device. The security incident detection device according to claim 1 or 2. further comprising a master data storage unit that stores data on security rules for each company and master data on publicly available malicious programs and malicious files;
The security incident detection device according to any one of claims 1 to 3, wherein the log information analysis unit analyzes the log information with reference to master data stored in the master data storage unit. The analysis report includes information on the number of user terminals that have undergone analysis of the log information, the number of user terminals that may have security incidents, and the user terminals that may have security incidents. A security incident detection device according to any one of the preceding claims 1-4. A security incident detection system comprising a user terminal provided in a company and a server device capable of communicating with the user terminal via a communication network, and detecting a security incident occurring in the user terminal. hand,
The user terminal is
a log information transmission unit that periodically inquires of the server device for log collection of log information related to security incidents, collects and transmits the log information,
The server device
a log collection control data storage unit that stores log collection control data related to the log collection timing of the log information and files to be collected for each company;
When a log collection inquiry for the log information is received from the log information transmission unit of the user terminal, the log collection control data is referred to and a response as to whether or not it is the log collection timing is transmitted to the user terminal. , in response to the fact that the log information transmission unit of the user terminal has transmitted a request to acquire a configuration file indicating the file in response to judging that it is the log collection timing based on the response, A log information receiving unit that receives the log information of the file transmitted from the log information transmitting unit of the user terminal by referring to the log collection control data and transmitting the setting file to the user terminal. and,
an analysis pattern storage unit that stores an analysis pattern for each type of security incident to be detected;
a log information analysis unit that analyzes the log information associated with each analysis pattern stored in the analysis pattern storage unit and detects the possibility of a security incident occurring;
an analysis report creation unit that aggregates the analysis results of the log information by the log information analysis unit for each company and creates an analysis report;
an analysis report output unit that outputs the created analysis report to the user terminal;
with
The user terminal is
A security incident detection system comprising an analysis report display unit that displays the analysis report output by the analysis report output unit. A security incident detection method for detecting a security incident occurring in a user terminal provided in a company,
Upon receipt of a log collection inquiry for log information related to a security incident from the user terminal, the log is collected by referring to the log collection timing of the log information stored for each company and the log collection control data related to the files to be collected. A reply indicating whether or not it is time to collect the logs is transmitted to the user terminal, and the user terminal acquires a setting file indicating the file when the user terminal determines that it is time to collect the logs based on the reply. log information for collecting the log information of the file from the user terminal by referring to the log collection control data and transmitting the setting file to the user terminal in response to the transmission of the request; a collecting step;
For each analysis pattern provided for each type of security incident to be detected, the log information associated with the analysis pattern is analyzed with respect to the log information collected by the log information collection step, and the security incident is detected. a log information analysis step for detecting the possibility;
an analysis report creation step of aggregating the analysis results of the log information by the log information analysis step for each company and creating an analysis report;
an analysis report output step of outputting the created analysis report to the user terminal;
A security incident detection method comprising: When executed by a computer that detects a security incident that has occurred on a user terminal installed in a company, the computer:
Upon receipt of a log collection inquiry for log information related to a security incident from the user terminal, the log is collected by referring to the log collection timing of the log information stored for each company and the log collection control data related to the files to be collected. A reply indicating whether or not it is time to collect the logs is transmitted to the user terminal, and the user terminal acquires a setting file indicating the file when the user terminal determines that it is time to collect the logs based on the reply. log information for collecting the log information of the file from the user terminal by referring to the log collection control data and transmitting the setting file to the user terminal in response to the transmission of the request; a collection procedure;
For each analysis pattern provided for each type of security incident to be detected, the log information associated with the analysis pattern is analyzed with respect to the log information collected by the log information collection procedure, and the security incident occurrence is detected. a log information analysis procedure for detecting the possibility of
an analysis report creation procedure for aggregating the analysis results of the log information by the log information analysis procedure for each company and creating an analysis report;
an analysis report output procedure for outputting the created analysis report to the user terminal;
The program that causes the to run.

Images