JPH11282673A - Method for detecting computer virus infection route and recording medium for recording trace virus to be used for the method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To exterminate the infection of a computer virus by detecting a virus infection route at an early stage and previously preventing the infection of the virus. SOLUTION: A trace virus having a self-duplication function similar to that of a computer virus, capable of recording infection history supposed to trace an infection route similar to that of the computer virus and independent of the computer virus is spread in a specific inspection area (S2). When a certain computer virus is detected (S3: YES), the infection history of the trace virus in the specific inspection area is successively inspected from the trace virus existing in a detected document or the like (S4), the infection route of the trace virus is searched and specified based on the infection history (S5), a computer virus infection route is estimated based on the infection route of the specified trace virus and an intrusion place of the computer virus into the specific inspection area is detected.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for detecting a computer virus infection route in the field of information processing and a recording medium for recording a trace virus used in the method.

[0002]

2. Description of the Related Art In recent years, damage to computer systems, such as data destruction due to computer virus infection and business suspension, has increased and has become a social problem.

[0003] A computer virus is a program designed to intentionally cause some damage to files such as programs and data of third parties, and has the following features (1) to (3). It has one or more. (1) Self-infection (infection) It spreads itself by copying itself to other programs. (2) Latency The conditions such as the specific time, the fixed time, and the processing time for the onset of the disease are stored, and no symptoms are displayed until the onset of the disease. (3) Attack Destruction of files such as programs and data,
Behaves unintended by the designer. The above (1) to (3)
Is from the Information Processing Promotion Agency (IPA).

Types of Computer Virus (1) Machine Language Virus a) System Infection Type (Boot Sector Type) The computer virus infects the IPL (boot sector, partition table) in the HDD and is already infected after booting. b) File infection type (application infection type) When the infected program / data is executed, it is infected with other programs / data, and when the program becomes sick if the conditions such as date and number of executions are satisfied at the time of execution. There is. (2) Macro virus A type that infects document files (eg, Word, Excel) and is a multi-platform type that exceeds the model and OS of the same macro system. Infects other macros of the same file format when opening a document file.

[0005] The following cases are conceivable as computer virus infection routes. 1) Infected by distribution of FD or CD-ROM 2) Infected by programs and data downloaded from personal computer communication, WWW server, file server, etc. 3) Infected by attached files such as e-mail and groupware

In particular, recently, due to the spread of the network environment, damages caused by the above cases (2) and (3) have been highlighted. On the other hand, virus check software and vaccine software have made remarkable progress, and if appropriate preparations have been made, early detection of virus infection and prevention of the spread of damage can be performed to a considerable extent.

[0007]

However, according to the current technology, after a virus infection is detected by virus check software, or unfortunately, after infection is detected due to the onset of the disease, measures can be taken to prevent further spread of the damage. However, since it is difficult to identify the route by which the virus has transmitted, there is a problem that it is not possible to pursue the source of the infection and to prevent or eliminate re-infection.

Accordingly, an object of the present invention is to solve such a problem of the prior art, that is, when a computer virus is found, a computer virus which clarifies the path through which the virus has been transmitted is disclosed. It is an object of the present invention to provide an infection route detection method and a recording medium for recording a trace virus used in the method.

[0009]

According to the first aspect of the present invention, there is provided a computer virus infection route which intrudes into a specific information processing area from the outside, copies itself to a document such as a machine, a program, a data file, etc. and infects it. A method for detecting an infection route of a computer virus to be tracked and detected, the computer virus having a self-replication function similar to the computer virus and recording infection history information assumed to take an infection route similar to the computer virus. Unrelated trace viruses are spread in a specific investigation area, and when a computer virus is found, trace virus infection history information in the specific investigation area is sequentially transmitted starting from the trace virus present in the found document, etc. Check,
Based on the infection history information, trace virus infection routes are searched and specified, and computer virus infection routes are estimated based on the specified trace virus infection routes to detect intrusions into specific investigation areas. It was made. According to this means, the infection history of the trace virus is sequentially examined, the infection route of the computer virus is estimated based on the infection route of the trace virus, and the entry point of the computer virus into a specific investigation area is detected. As a result, even if a computer virus can be found and removed, the conventional problem that the infection route cannot be traced can be solved, and the infection can be eradicated by preventing the infection by preventing the infection.

According to a second aspect of the present invention, in the method for detecting an infection route of a computer virus according to the first aspect, the relationship between a parent trace virus as a source of infection of a document and the like and a child trace virus as a destination of infection of a document and the like, Document information specifying the document containing the parent trace virus is stored in the infection history information of the child trace virus, and when a computer virus is found, the parent trace virus is used based on the trace virus history information of the document present in the found computer virus. Are sequentially identified, the route of trace virus infection is searched for and identified, and a computer virus intrusion is detected. According to this means, the computer virus sequentially present in the parent document is sequentially confirmed based on the document information of the parent trace virus, and an intrusion point which is a source of the computer virus is detected. it can.

According to a third aspect of the present invention, there is provided the computer virus infection route detecting method according to the first aspect, wherein a relationship between the parent trace virus that is the source of infection of the document and the like and the child trace virus that is the destination of infection of the document and the like is provided. The parent trace virus infection history information stores child document information identifying the document containing the parent trace virus, and when a computer virus intrusion is detected, the trace virus infection history information of the document present in the detected computer virus Child document information in which a child trace virus exists is sequentially searched and specified, and whether a computer virus is present in the specified document or the like is detected, and the intrusion status of the computer virus is detected by tracking the child document. . According to this means, the child documents are sequentially traced based on the document information of the child trace virus, and the infection of the computer virus is checked, so that the entire intrusion state can be checked without fail.

According to a fourth aspect of the present invention, in the method for detecting an infection route of a computer virus according to the first aspect, an infection history of each trace virus is reported to a management server in a specific investigation area, or an inquiry from the management server is made. The management server estimates the route of infection of the computer virus from the infection history of each trace virus and detects it. According to this means, the trace virus reports history information to the management server, and the management server identifies a trace virus infection route,
Since the entry point of the computer virus is specified, the route search can be efficiently performed in a short time without requiring human intervention.

[0013] The invention of claim 5 is the invention of claims 1 to 3.
In any of the computer virus infection route detection methods described above, the trace virus is the virus itself that is transmitted by self-replication of documents such as machines, programs, and data files, and the self-replication environment information, date, parent and child information, etc. And a data area for writing various types of information as history information by the recording function part. According to this means, since it has history information such as the date and time of the infection of the trace virus and the source of the infection, it is possible to search for the route of the infection of the trace virus.

According to a sixth aspect of the present invention, there is provided the computer virus infection route detecting method according to the fifth aspect, wherein the parent trace virus which is the source of the trace virus such as a document and the child trace virus which is the destination of the document etc. are infected. In relation to this, the history information of the trace virus has information such as a document of an infected destination such as a document as child document information, or has parent document information of an infection source such as a document as family document information. According to this means, since the trace virus has the child document information of the infection destination or the family document information, the route search for the infection of the trace virus can be efficiently performed.

According to a seventh aspect of the present invention, in the method for detecting an infection route of a computer virus according to the fifth or sixth aspect, the trace virus has an information transmission function of transmitting history information to a management server which manages the trace virus, or , A function of responding to the management server in addition to the information transmission function. According to this means, since the history information is sent to the management server, the trouble of manually checking the history information of the trace virus such as a document is eliminated and the efficiency can be improved.

The invention according to claim 8 is the invention according to claims 5 to 7.
In the method for detecting a computer virus infection route described above, the trace virus has a function of self-invalidating, self-erasing, or erasing the entire parent document when contact with the management server that manages the trace virus is lost. According to this means, since the trace virus or the like is erased before inadvertently flowing out of the management area, the trace virus can be thoroughly managed.

According to a ninth aspect of the present invention, a machine, a program,
The virus itself that is infected by self-replication of documents such as data files, a function part that records history information such as self-replication environment information, date, parent and child information, and writes various information as history information by this recording function part A recording medium for recording a trace virus having an information area.

[0018]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a flowchart of a computer virus infection route detection method according to the first embodiment of the present invention.

First, a special computer virus (hereinafter referred to as a "trace virus" to distinguish it from a real computer virus) is prepared (S1).

FIG. 2 is a configuration diagram of the trace virus.

In the figure, 100 is a trace virus, 101
Is a trace virus body having a self-replication function, 102
Is a function part for recording environmental information, date and time, parent and child information at the time of self-replication / infection, and 103 is an information area written in the function part as history information.

FIG. 3 is a configuration diagram of the information area 103 of the trace virus 100.
202 is a machine ID part, 203 is a document ID part, and 204 is a parent document ID part.

Next, the trace virus 100 is spread in the company (in the organization) (S2). In principle, computer documents (data files, program files, etc.) created in-house should be intentionally infected with this trace virus at the time of creation. Infect immediately (because the virus is spreading). Also, when a new computer document comes into the organization from outside, it is immediately infected. Therefore, in principle, a state in which there is no uninfected computer document of the trace virus 100 in the company (within the organization) is maintained.

Here, the operation of the information recording function (102) of the trace virus 100 when the trace virus 100 infects a new document will be described.

As shown in FIG. 4, when the parent trace virus 100 produces a child trace virus by the self-replication function of the trace virus body (101), the information recording section (102) of the parent trace virus 100 Information is recorded in the information area (103) of the trace virus 100A as follows.

That is, the date and time when the child was born is recorded in the date and time portion of (1) 201 in the information area 103 shown in FIG. (2) In the machine ID part 202, the ID (for example, IP address or the like) of the machine at the time when the child was born is recorded. (3) In the document ID portion of 203, the document name of the host (the parasite is infected (infected) by the trace virus of the child) and the directory path where the document of the host existed when the trace infection occurred. Record. (4) At the time of infection, the document ID of 203 is taken over from the parent trace virus and recorded in the parent document ID of 204.

That is, in the process where the trace virus 100 sequentially infects from the parent to the child, as shown in FIG. 5, for example, it is assumed that the trace virus 100A on the left side is infected and the trace virus 100B on the center is infected. . In this case, the information area 103 of the trace virus 100A on the left is recorded in the information area 103 of the trace virus 100B at the center by the trace virus 100B.
B unique 201 (date and time) H, 10, 4, 26, 202
(Machine ID) ID, A006, 203 (Document ID) I
D and B006 are recorded.

Further, 20 of the trace virus 100B
4 (Parent and child book) is trace virus 100, the source of infection
A 203 (document ID) ID and B004 are slid and recorded (hatched arrow in the figure). Similarly, the trace virus 100B infects another document and causes the trace virus 10
When 0C occurs, 201 to 203 in the information area 103 of the trace virus 100C record the individual values of the trace virus 100C, and 204 (parent document) contains the 203 of the trace virus 100B corresponding to the parent.
(Document ID) ID and B006 are recorded by sliding. This enables tracking from the downstream (child side) to the upstream (parent side).

Next, when a genuine computer virus is found, the record of the trace virus 100 is checked (S3).

In this case, as shown in FIG. 6, the infection route of the parent document is tracked. First, information on the trace virus that is simultaneously infected with the found infected document of the computer virus is extracted (S11). Subsequently, a document having a document ID (203) that matches the parent document ID in the information area 204 of the trace virus 100 is searched for. In that case, tracking can be made more efficient by starting from a document in the same machine indicated by the machine ID 202.

For example, in the example of FIG. 5, the trace virus 1 is simultaneously added to the detected infected document of the computer virus.
If there is 00C, the trace virus 100B having the same (document ID) is specified as the parent from the 204 (parent document ID) ID and B006 in the information area 103 of the trace virus 100C. In addition, trace virus 100
The parent trace virus 100A is sequentially identified from B 204 (parent document ID).

However, after the infection, the document name is changed,
It is also possible that the document has been moved. In this case, since the document name or the directory path where the document exists does not match the trace virus information section, it is necessary to find a match from other directories and "trace virus information" in the machine. It is checked whether the found parent document is infected with the found computer virus (S13). In this case, the process is continued until a parent document that is not infected with the computer virus is found or the computer virus enters the company (inside the organization) (S14).

Next, the infection of the child document is traced from the route traced as described above, as shown in FIG.

Specifically, a parent document ID that matches the document ID of the trace virus information area 203 serving as the starting point
A document having (204) is searched for (S21).

For example, according to the example of FIG. 5, the trace virus 1 on the left side is used as the trace virus 100 serving as the starting point.
If 00A is specified, 203 of the information area 103
(Document ID) The trace virus 100 having 204 (parent document) in the information area 103 with the same ID and B004 as the ID and B004 is searched for. For example, it is conceivable that there is a plurality of the central trace virus 100B.

However, after the infection, the document name is changed,
It is also possible that the document has been moved. In this case, since the document name or the directory path where the document exists does not match the information part of the trace virus, it is necessary to find a match from other directories and “information of the trace virus” in the machine.

Further, by narrowing down documents having a creation / change date and time after the date and time information (201) of the parent trace virus, the search can be made more efficient. further,
It is checked whether the found child document is infected with the found virus (S22). S21 and S22 are continued until a virus-free document is found for all routes derived from the infection routes found in the processes S11 to S15 in FIG. 6 (S23).

In the simple example shown in FIG. 8, it is assumed that a genuine computer virus has been found in the document J (the thick arrow in the figure), and the parent document ID of the information area 103 of the trace virus 100 is determined by the procedure shown in FIG. Documents having matching document IDs are sequentially searched. Then, it checks whether the parent document is infected with a computer virus. As a result,
Documents were searched in the order of JIFEA, and no real computer virus was found in document A. Therefore, it can be estimated from the document E that a real computer virus has entered.

As described above, when a genuine computer virus is detected, it is possible to trace the infection route of the computer virus by simultaneously following the record information of the trace virus that has been infected.

As described above, according to the first embodiment of the present invention, this special trace virus 100 has an infection function by self-replication like an ordinary computer virus, and has environmental information, parent-child information at the time of infection. Records information, etc. Therefore, all computer documents in the company (in the organization) can track the infection route by tracking environmental information, parent-child information, and the like at the time of the infection. (Even if there is an exceptionally uninfected document group or a distribution route of the document group, it is possible to follow the route in reverse from the exclusive relationship from the trace infected document.) Refers to a computer document.

Consider a case where a document containing a computer virus comes in from such an environment. The trace virus according to the first embodiment and the real virus are not related to each other. However, as described above, documents that have not been infected by the trace virus are immediately infected by the trace virus when they enter the company (organization), so that the infection route of the real computer virus and the infection route of the trace virus match thereafter. It is thought that it is. Therefore,
If a computer virus detection software or, unfortunately, a computer virus is found due to the onset of the computer virus, if you check the trace virus record according to the present invention which must infect the same document,
It is possible to track the route of infection.

It should be noted that the trace virus 100 is not one type, but a plurality of types are prepared corresponding to the types of the computer viruses described above. This trace virus may be developed independently, but it analyzes the real virus found,
Detoxified ones may be used. Multiple types of trace virus bodies are used to cover all routes of infection, but if a virus that spreads through an uncovered route is later found, the computer virus is analyzed and rendered harmless, and the trace virus body is used. By using this, the effect of the embodiment of the present invention can be improved temporarily.

Next, a second embodiment of the present invention will be described.

In the second embodiment, the trace virus 10
0 in the information area 103A as shown in FIG.
(205) to facilitate the process of searching for a child.

The information area 103A of FIG. 9 includes the date and time (201), machine ID (202), and document ID (2) shown in FIG.
03), parent document ID (204) and child document ID (2)
05), and the area is variable because there are a plurality of children.

In this configuration, when the trace virus 100 generates a child trace virus by the self-replication function of the virus main body (101), the parent information recording unit (102)
Records the above information in the child information area (103A) and simultaneously records the following information in the "own" information area (103A).

In the child document ID portion 205, the host document name (parasitic (infected) by the child trace virus) and the directory where the host document existed when the trace virus infection occurred The path (that is, information on the document ID area of the child trace virus 203) is recorded. For example, in the example of FIG. 8, if E is a parent document, F, G
F and G are recorded as child documents in the child document ID (205) of the trace virus 100 with the parent document. This has the effect of facilitating a route search from the parent to the child.

Next, a third embodiment of the present invention will be described.

In the third embodiment, the trace virus information area is provided with the family ID shown in FIG. 10 to facilitate route search.

The information area (103B) of FIG. 10 has a family ID section (206) in addition to the date and time (201) and the machine ID (202).

Although it is conceivable that a family tree may continue indefinitely, the area is fixed. In the third embodiment, ancestor IDs up to five generations ago are provided. When the trace virus 100 generates a child trace virus by the self-replication function of the virus body (101), the parent information recording unit (102)
Information is recorded in the child information area (103B) as follows.

First, as shown in FIG. 11, the date and time when the child was born is recorded in the date and time portion 201. 202 machine ID
In the section, the ID (for example, IP address or the like) of the machine at the time when the child was born is recorded. Then, as shown in FIG. 11, at the bottom area of the family ID section 206, the document name of the host (where the child trace virus is parasitized (infected)) and the time when the trace virus infection occurs, Record the directory path where the host documentation was located. 2
In the remaining part of the family ID part 06, information from the bottom of the family ID part up to five generations before is copied as shown in FIG. For example, in the example of FIG. 8, 106 (the family I
D) stores A, E, F, I, and J. Thereby, there is an effect that a route search from a child to an ancestor becomes easy.

Next, a fourth embodiment of the present invention will be described.

FIG. 12 is a schematic diagram showing the configuration of the trace virus 100 in which the information transmitter (104) is added to the management server 300, and the status of the report to the management server 300.

The management server 300 communicates with the trace virus 100, stores information from the trace virus, and has a function of inquiring about the location of the trace virus 100 (described later in the embodiment). It is a system with installed.

When the trace virus 100 generates a child trace virus by the self-replication function of the virus main body (101), the parent information recording unit (102) transfers the child information virus (103) to the child information area (103). Record the information as follows. Thereafter, the information recorded in the child information area (103) is transmitted to the management server 300 by the operation of the information transmission function (104). Thus, since the route search may be performed based on the information stored in the management server, the search can be performed in a short time. At the same time, even if
Even if the information area of the trace virus 100 or the trace virus 100 itself is destroyed by another virus, the report information up to that point is stored in the management server 300.
, The route search is not interrupted.

As described above, according to the fourth embodiment, the first
In all of the embodiments to the third embodiment, it takes a very long time since the route search must be executed on a plurality of machines while tracking the information of the trace virus. There is also a danger that the information area of the trace virus or the trace virus itself may be destroyed or rewritten by another virus.
Therefore, the record information in each of the above embodiments is reported to the management server in the company (in the organization) each time, so that the route can be searched in a short time.

Next, a fifth embodiment of the present invention will be described.

FIG. 13 is a schematic diagram showing the configuration of a trace virus to which a response function (105) to the management server 300 is added, and the status of a response to an inquiry from the management server 300.

When the trace virus 100 generates a child trace virus by the self-replication function of the virus main body (101), the parent information recording unit (102) transfers the child information area (103) to the child information area (103). Record the information as follows. Thereafter, the information recorded in the child information area (103) is transmitted to the management server 300 by the operation of the information transmission function (104).

Next, the response function (105) checks whether or not there is a location confirmation inquiry from the management server 300. If there is a location confirmation inquiry that matches the own ID, the current machine ID, the document name, and the directory path where the self is present are reported to the management server 300. Thus, after being infected with the trace virus 100,
Searching when the document name is changed or moved is facilitated. Further, if the ID of a document which is considered to be infected with a genuine computer virus is registered in the management server 300, it is possible to confirm the location of the document at the time of activation and to take action.

As described above, according to the fifth embodiment, the function of reporting the location of the user in the case of having corresponding parent-child information or family information in response to a call from a server in the company is provided. Searching can be easily performed even if the document name is changed or moved after the infection with the trace virus.

Next, a sixth embodiment of the present invention will be described.

FIG. 14 shows a function of self-inactivating (suspending) or self-erasing the trace virus 100 (106).
Trace virus 100 is outside (outside the organization)
In the case of, it is made invalid or deleted.

The trace virus configuration of the fourth embodiment or the fifth embodiment is further provided with a function (106) of self-invalidation (stop function) or self-erasure. When the trace virus 100 goes outside the company (outside the organization), a gateway, proxy server, firewall 40 provided at the boundary between the inside (inside the organization) and the outside (outside the organization)
0, etc., the trace virus information transmission function (10
4) and communication with the management server 300 cannot be performed. As a result, the trace virus self-deactivated (function stopped)
Alternatively, the self-erasing function invalidates or erases itself. Note that in this embodiment, the parent needs to perform an operation of confirming communication with the management server 300 before starting copying of the child.

As described above, according to the sixth embodiment, the trace virus spread in the company (inside the organization) is a harmless virus, but it is a problem that the virus is transmitted outside the company (outside the organization). is there. Therefore, when a document is sent outside the company, it is basically intended to remove the trace virus, but it is possible to prevent the trace virus from leaking out by mistake.

Next, a seventh embodiment of the present invention will be described.

The seventh embodiment enhances the function of self-invalidating (stopping function) or self-erasing, and erasing not only the trace virus 100 but also the host document (1).
07). The operation is the same as that of the sixth embodiment, except that not only the trace virus 100 is invalidated and deleted, but also the host document is deleted.

According to the present embodiment, it is possible to prevent unauthorized removal of documents (information) by managing the means for removing trace viruses. This is particularly effective when a document is taken out via a network due to intrusion of a hacker.

The above-described operation can solve the problem of the prior art that the computer virus cannot be traced even if the computer virus can be detected and removed, and a path to eradicate the infection can be opened.

[0072]

As described above, according to the first aspect of the present invention, the infection history of the trace virus is sequentially examined, and the infection route of the computer virus is estimated based on the infection route of the trace virus. Computer virus intrusion is detected. As a result, even if a computer virus can be found and removed, the conventional problem that the infection route cannot be traced even if it can be solved can be solved, and the infection can be eradicated by preventing the infection by preventing the infection.

According to the second aspect of the present invention, the presence of a computer virus in the parent document is sequentially confirmed based on the document information of the parent trace virus, and the entry point of the computer virus is detected. Can be done efficiently.

According to the third aspect of the present invention, the child documents are sequentially traced based on the document information of the child trace virus,
By checking for computer virus infections, the entire intrusion status can be checked without fail.

According to the fourth aspect of the present invention, the trace virus reports history information to the management server and responds to an inquiry from the management server. It is possible to efficiently search for a route of a location without requiring human intervention in a short time.

According to the fifth aspect of the present invention, since the trace virus has history information such as the date and time of infection and the source of infection, it is possible to search for the route of infection of the trace virus.

Further, according to the invention of claim 6, since the trace virus has the child document information of the infection destination or the family document information, the route search of the infection of the trace virus can be efficiently performed.

According to the seventh aspect of the present invention, since the history information is sent to the management server, it is not necessary to manually check the history information of the trace virus such as a document, so that the efficiency can be reduced.

Further, according to the invention of claim 8, since the trace virus or the like is erased before inadvertently flowing out of the management area, the trace virus can be thoroughly managed.

[Brief description of the drawings]

FIG. 1 is a flowchart of a method for detecting a computer virus infection route according to a first embodiment of the present invention.

FIG. 2 is a configuration diagram of a trace virus used in the first embodiment of the present invention.

FIG. 3 is a configuration diagram of an information area of FIG. 2;

FIG. 4 is an explanatory diagram showing the action of the parent trace virus of the infection source and the child trace virus of the infection destination of FIG. 2;

FIG. 5 is an explanatory diagram showing a specific example of an information area of a trace virus in FIG. 2;

FIG. 6 is a flowchart showing a procedure of tracking the infection route of a parent document in the method of detecting the infection route of a computer virus in FIG. 1;

FIG. 7 is a flowchart showing a procedure for tracking an infection route of a child document in the method of detecting an infection route of a computer virus in FIG. 1;

FIG. 8 is an explanatory diagram for searching for a computer virus in a specific example in the method of detecting a computer virus infection route in FIG. 1;

FIG. 9 is a configuration diagram of a trace virus information area according to the second embodiment of the present invention.

FIG. 10 is a configuration diagram of a trace virus information area according to the third embodiment of the present invention.

FIG. 11 is an explanatory diagram showing an operation of copying to the information area of FIG. 10;

FIG. 12 is a diagram showing a fourth embodiment of the present invention.

FIG. 13 is a diagram showing a fifth embodiment of the present invention.

FIG. 14 is a diagram showing a sixth embodiment of the present invention.

[Explanation of symbols]

 Reference Signs List 101 Trace virus main body 102 Information recording function 103 Information area 104 Information transmission function 105 Response function 106 Self-deletion function 300 Management server 400 Firewall, etc.

Claims (9)

[Claims] 1. A computer virus infection route detection method that traces the infection route of a computer virus that intrudes into a specific information processing area from the outside, self-replicates into a document such as a machine, a program, or a data file and infects the document. A method for identifying a trace virus unrelated to the computer virus, which has a self-replication function similar to the computer virus and records infection history information assumed to take the same infection route as the computer virus. When the computer virus is found, the infection history information of the trace virus in a specific investigation area is sequentially examined starting from the trace virus present in the found document or the like. Search and identify the route of trace virus infection based on the Transmission-detection method of the computer virus and detecting the intrusion point to a specific study area by estimating the infection route of the computer virus based on the infection route of the race virus. 2. In a relationship between a parent trace virus as a source of infection of a document or the like and a child trace virus as a destination of infection of a document or the like, document information for specifying a document in which the parent trace virus exists in the infection history information of the child trace virus. When a computer virus is found, the document information containing the parent trace virus is sequentially identified based on the trace virus history information of the document existing in the found computer virus, and the infection route of the trace virus is searched for and identified. 2. The computer virus infection route detecting method according to claim 1, wherein the computer virus intrusion point is detected. 3. A child document that specifies a document in which the parent trace virus exists in the infection history information of the parent trace virus in relation to the parent trace virus that is the source of infection of the document and the child trace virus that is the destination of infection of the document. Information is stored, and when the intrusion of the computer virus is detected, the child document information in which the child trace virus exists is sequentially searched and specified by the trace history of the trace virus infection of the document present in the detected computer virus. 2. The computer virus infection route detection method according to claim 1, wherein the computer virus is detected in the document or the like, and the intrusion status of the computer virus is detected by tracking the child document. 4. An infection history of each trace virus is reported to a management server in a specific investigation area, or a response to an inquiry from the management server is made. 2. The method according to claim 1, wherein the route is estimated and detected. 5. The function of the trace virus to record a virus itself that is transmitted by self-replication of a document such as a machine, a program, or a data file, and history information such as self-replication environment information, date, and parent-child information. 4. The method according to claim 1, further comprising an information area for writing various information as history information by the recording function part. 6. In the relationship between a parent trace virus that is a source of a trace virus such as a document and a child trace virus that is a destination of a document or the like, the history information of the trace virus is a document of a destination such as a document. 6. The method of detecting a computer virus infection route according to claim 5, wherein information such as document information is included as child document information, or parent document information of an infection source such as a document is included as family document information. 7. The trace virus has an information transmission function of transmitting history information to a management server that manages the trace virus, or a function of responding to the management server in addition to the information transmission function. A method for detecting a computer virus infection route according to claim 5. 8. The trace virus has a function of self-invalidating, self-erasing, or erasing the entire parent document when contact with a management server managing the trace virus is lost. Claim 7
A method for detecting a computer virus infection route according to the above. 9. A virus, which is transmitted by self-replication of a document such as a machine, a program, a data file or the like, a function part for recording history information such as self-replication environment information, date, parent-child information, and a recording function for the function A recording medium for recording a trace virus having an information area for writing various types of information as history information in parts.