JPH09171460A - Diagnostic system for computer - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain a mechanism by which the fault such as installation mistake, etc., of a virus program is detected by comparing a stored operation and the actual state inside a computer. SOLUTION: A knowledge base 1c stores the operation specification when a program is normal, the operation of the program when a program is infected with a virus program, etc., and the operation of the program when an installation mistake exists. A diagnostic module 1b compares the operations stored in the knowledge base 1c and the work history 2c that an operating system outputs, inspects the infection with the virus program and the installation mistake of the program and outputs the diagnostic results and a countermeasure 1d. Namely, the diagnostic module 1b compares the operation specification when the program is normal which is stored in the knowledge base 1c, and the work history 2c. When the both of them do not match with each other, it is judged that the program is infected with the virus or the installation mistake of the program exists and the diagnostic result is outputted.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer fault detection system, and in particular, by analyzing information relating to a program operation which has not been conventionally used, that is, a related program calling operation or file input / output operation of each program, It relates to a mechanism for detecting failures such as virus programs and program installation errors.

[0002]

2. Description of the Related Art Conventionally, infection of virus programs is
There was a virus inspection program that mainly compares the program patterns of virus programs with the contents of files inside the computer to determine the presence or absence of infection. Also,
Humans mainly diagnosed the program installation error from the operation of the computer.

As a similar technique, a technique for analyzing the behavior of a computer in order to detect an intruder from the outside (for example, "Detecting Intruders in Computer Systems", Tere
sa F. Lunt, 1993 Conference on Auditing and Compute
NI DES system described in r Technology).

[0004]

In the above-mentioned conventional techniques, it is difficult to inspect a virus program using a technique of encrypting a program pattern so that the inspection program cannot judge it. In addition, the judgment of the installation error requires the assistance of a skilled expert. Also, C in NIDES
Since the load information of the PU is processed statistically, it was not sufficient as a defense method against viruses that cause rapid damage.

In order to solve this problem, an object of the present invention is to detect a failure such as a virus program or a program installation error by analyzing information about a program operation which has not been used conventionally. To provide.

[0006]

[Means for Solving the Problems] The above-mentioned object is a database that stores the operating specifications of a program when it is normal, the operation of the program when it is infected with a virus or program, and the operation of the program when there is an installation error. ,
This is achieved by preparing a mechanism for observing the internal state of the computer and comparing the stored operation with the actual internal state of the computer.

[0007]

The present invention is realized as an appropriate database and program on a computer.

An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram of a computer system using the present invention. Reference numeral 1 is a diagnostic system for inspecting a virus program for infection or a program installation error, which may be an appropriate program on a computer that exchanges information with a computer user using the display / input device 3. Reference numeral 1a is an interface program of the diagnostic system 1, which may be an appropriate program on a computer.
Reference numeral 2 denotes an operating system of the computer, which may be an operating system having a mechanism for outputting, as a work history 2c, information on the program starting a related program and information on input / output operations performed by the program.

Here, the operating system 2 having a mechanism for outputting information as to the work history 2c of the program starting the related program and the information about the input / output operation performed by the program is a process which is a sub-program inside the operating system. This can be easily realized by providing the management system 2a and the file management system 2b with necessary functions. For example, if the UNIX operating system used in many computers in recent years is ex
It can be easily implemented by adding the necessary functions to the subroutine that implements system calls such as ec, fork, link, open, and close.

The knowledge base 1c is a database on a computer that stores the operating specifications of the program at normal times, the operation of the program when infected with a virus program, etc., and the operation of the program when there is an installation error. It is a part of the diagnostic system 1. The diagnostic module 1b compares the operation stored in the knowledge base 1c with the work history 2c output by the operating system, inspects for infection of virus programs and program installation errors, and outputs the diagnosis result and coping method 1d. The above program is a part of the diagnostic system 1.

Here, the diagnostic module 1b is the knowledge base 1c.
Specification and work history of the program stored in the normal state 2c
If the two do not match, it is determined that the computer is infected with a virus or there is a program installation error, and the diagnostic result 1d is output. In addition, the operation of the program when infected with a virus program etc. stored in the knowledge base 1c and the work history 2c are compared, and if they match, it is determined that the virus is infected and the diagnosis result 1d is obtained. Output. Further, the operation of the program when there is an installation error stored in the knowledge base 1c and the work history 2c are compared, and when the two match, it is determined that there is an installation error of the program and the diagnostic result 1d is output. .

FIG. 2 shows an example of internal processing of the computer for explaining the present invention. The operating system 2 outputs the information of FIG. 2 as a work history 2c. In FIG. 2, the computer user uses the application programs 4a, 4b, 4c, 4d, 4e through the interface program 1a, and uses the application programs 5a, 5b, 5c, 5d through the interface program 1a '. The application programs 6a, 6b, 6c, 6d, 6e, 6f are used through the interface program 1a ".

FIG. 3 is an example of a normal operation of a program for explaining the present invention, which is an example of information stored in the knowledge base 1c. Figure 3 shows that when the source code of c program is created by application program 6a (emacs), the created program is
The program 6b (make) is started by the application program 6e (cc) that is started by the application program 6f (ld)
Being converted into the program 5c (prog.exe), and in the course of work, the application program 6e (cc) converts the input file 7a (/usr/include/stdio.h etc.)
Program 6f (ld) is input file 7b (/usr/lib/libc.a
Etc.) is used as an input, and the output file 7c (/ tmp / work_file) is used as a work file.

FIG. 4 shows an example of the operation when a program is infected with a virus for explaining the present invention, and an example when one copy of the contents of the work history 2c is extracted. The difference from FIG. 3 is the operation of the application program 6f (ld). Application program infected by virus
6f (ld) is trying to write to / os_image 8, but Fig. 3
Comparing with the normal operation example of, it can be diagnosed that the writing to / os_image 8 is not due to the original specifications of the application program 6f (ld) but due to virus infection. Also, by giving the operating system 2 a function to stop the operation of the program concerned (application program 6f in this case) when such an abnormal operation occurs, it is possible to prevent a serious failure due to a virus or the like. it can. This function of the operating system 2 is easily realized by notifying the operating system 2 of the fact that the diagnostic system 1 determines that the operation is abnormal and stopping the program causing the abnormality. it can.

FIG. 5 is an operation example of the program when there is an installation error for explaining the present invention.
This is an example when one copy of the contents of the work history 2c is extracted. FIG.
Compared to the normal operation example of, /usr/lib/libc.a by this originally successful application program 6f (ld)
Input work of equal input file 7b failed (9a), and as a result,
It can be seen that execution of the executable program 5c (prog.exe) has failed (9b). Conventionally, in such a case, a non-specialist can see only the execution failure (9b) of the executable program 5c (prog.exe), and / usr / lib / libc by the original application program 6f (ld). Although I did not understand until the input failure (9a) of the a etc. input file 7b, by comparing the operation examples, such an installation error (in this case, forgetting to install the necessary file) can be diagnosed.

In the above embodiment, for the sake of simplicity, the knowledge base 1c has been described as storing the normal or abnormal operation of the program. However, the coping method at the time of virus infection or installation error is also stored at the same time. By doing so, it is possible to output the coping method for those abnormalities,
It is another embodiment of the present invention.

FIG. 6 is a block diagram of an embodiment in which a computer operation is stored in the knowledge base 1c using the present invention.
Is the knowledge base creation module. In this embodiment, the knowledge base creation module has 1. a state in which it is not infected with a virus and software is normally installed, and 2. a state in which a virus is infected to create the knowledge base 1c, and 3. In the knowledge base 1c, the typical operation of the computer in the state of causing the installation inconvenience to create the knowledge base 1c is stored.

Here, the operation of the computer stored in the knowledge base 1c may be an appropriate part of the work history 2c output from the operating system 2. Here, the work history 2c has the form of graphs illustrated in FIGS. 3, 4, and 5 as structural information regarding the input / output relationship of files between programs.
If you extract the pattern that appears repeatedly in this graph,
1. The state that it is not infected by a virus and the software is normally installed, and 2. The state that a virus is infected to create knowledge base 1c, and 3. The knowledge base
A knowledge base can be created for the typical operation of each computer in the state that caused inconvenience in installation for creating 1c.

Any method may be used to extract the pattern that appears repeatedly in the graph, but the document "Conceptual learning from inference processes (1) Extraction of typological inference processes, Yoshida and Motoda, Journal of Japan Society for Artificial Intelligence" , Vol. 7, No. 4, pp. 119-129 (199
2) ”, it is possible to analyze the statistics including the structural information such as the input / output relationship of files between programs, and create the knowledge base 1c based on the analysis result.

A computer in which the embodiments illustrated in FIGS. 1 and 6 are combined so that the infection of a virus program or the like and the installation error can be checked and the knowledge base 1c can be created on the same machine is also the present invention. It is another embodiment. In this case, by extracting and storing the program pattern unique to the newly discovered virus together in the created knowledge base 1c, the virus pattern as a character string stored in the memory of the program, which is the conventional method, is stored. It is also possible to improve the security of the system of the mechanism for checking. That is, it is assumed that the computer is infected with a new type of virus while working on the computer system using the present invention. According to the present invention, even if a virus tries to affect the operating system 2, the virus can be safely stopped,
A knowledge base 1c about the virus can be created. Knowledge for a system of a mechanism to check the virus pattern as a character string stored in the memory of the program, which is a conventional method, by extracting and storing the program pattern unique to the virus newly discovered at this time together. You can also create a base. In this case, it is possible to check whether or not the program is infected with a virus by comparing it with the extracted program pattern before starting the new program.

[0022]

As is apparent from the above embodiments, according to the present invention, the operation stored in the database is compared with the internal state of the computer, and according to the comparison result, infection or installation of a virus program, etc. You can check for mistakes. Further, when the computer starts an abnormal operation, the operation can be invalidated, so that it is possible to avoid a failure such as a file corruption due to an infection of a virus program or an installation mistake.

Further, since the diagnosis is performed by the operation instead of the pattern as the character string stored in the memory of the program,
It is also possible to inspect a virus program using a technique of encrypting a program pattern so that the inspection program cannot judge it. Furthermore, since it is built into the operating system that is normally used, it is not necessary to prepare for inspecting a virus on another device, and it is possible to deal with a virus that is infected unexpectedly. The embodiment in which the virus is inspected in comparison with the normal operation pattern can deal with an unknown virus whose operation is unknown.

Furthermore, a knowledge base for diagnosis can be automatically created, and when an unknown virus is infected, a knowledge base for an unknown virus can also be automatically created. Therefore, by storing the program pattern of the virus, the conventional method can be used. It is also possible to improve the security of the system of the mechanism for checking the virus pattern as a character string stored in the memory of a certain program.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a computer system using the present invention.

FIG. 2 is an example of processing inside a computer for explaining the present invention.

FIG. 3 is an example of a normal operation of a program for explaining the present invention.

FIG. 4 is an operation example when a program is infected with a virus for explaining the present invention.

FIG. 5 is an operation example of a program when there is an installation error for explaining the present invention.

FIG. 6 is a configuration diagram of another embodiment of a computer system using the present invention.

[Explanation of symbols]

 1 Diagnostic system 1a Interface program 1a 'Interface program 1a "Interface program 1b Diagnostic module 1c Knowledge base 1d Diagnostic result / action 1e Knowledge base creation module 2 Operating system 2a Process management system 2b File management system 2c Work history 3 Display Input device 4a Application program 4b Application program 4c Application program 4d Application program 4e Application program 5a Application program 5b Application program 5c Application program 5d Application program 6a Application program 6b Application program 6c Application program Program 6d application Program 6e application program 6f application program 7a input file 7b input file 7c Output File 8 output file 9a error 9b error.

Claims (7)

[Claims] 1. A database that stores the operating specifications of a program under normal conditions and a mechanism for observing the internal state of the computer, and by comparing the operating specifications during normal operation with the internal state of the computer, virus programs, etc. A computer diagnostic system characterized by a mechanism for detecting failures. 2. A program having a program storing normal operation specifications of the program and a mechanism for observing the internal state of the computer, and comparing the normal operation specification with the internal state of the computer to install or miss the program. A computer diagnosis system characterized by having a mechanism for diagnosing etc. 3. A database storing the operation of the program when infected with a virus program, etc., and a mechanism for observing the internal state of the computer, and the operation of the program and the internal state of the computer when infected with a virus program, etc. A computer diagnostic system characterized by having a mechanism for detecting a failure such as a virus program by comparing with. 4. A database that stores the operation of the program when there is an installation error and a mechanism for observing the internal state of the computer are provided, and the operation of the program when there is an installation error and the internal state of the computer are compared. By doing so, a computer diagnostic system characterized by having a mechanism for diagnosing program installation errors, etc. 5. A computer having the computer diagnostic system according to any one of claims 1 to 4, and having a mechanism for invalidating the operation of the computer when the computer starts an abnormal operation. system. 6. A computer system having a mechanism for observing the internal state of a computer and having a function of creating a knowledge base that stores the behavior of a program when it is normal or abnormal. 7. A statistical amount including structural information such as input / output relations of files between programs in order to observe the internal state of the computer and create a knowledge base that stores normal and abnormal operations of the programs. 7. The computer system according to claim 6, wherein the knowledge base is created on the basis of the result of the analysis.