WO2005050421A1

WO2005050421A1 - Evidential image preservation program, evidential image preservation method, and evidential image preservation device

Info

Publication number: WO2005050421A1
Application number: PCT/JP2004/015081
Authority: WO
Inventors: Osamu Aoki; Hiroaki Kawano
Original assignee: Intelligent Wave Inc.
Priority date: 2003-11-18
Filing date: 2004-10-13
Publication date: 2005-06-02
Also published as: JP2005149267A

Abstract

[PROBLEMS] To provide an evidential image preservation program capable of rapidly preserving an evidential image when an unauthorized operation is caused to a computer. [MEANS FOR SOLVING PROBLEMS] When a computer receives an operation, the computer references a rule or the like to judge whether the operation is an unauthorized operation. If the operation is judged to be unauthorized, display data displayed on the screen by the operation is acquired from a VRAM or a device context and stored as an evidential material having a date and the like in an evidential data storage unit. The evidential data and an unauthorized report may be transmitted via the network to the administrator. For an unauthorized operation, the operation is interrupted and the network connection is cut off.

Description

Specification

Evidence screen storage program, evidence screen storage method and evidence screen storage device

The present invention relates to an evidence screen saving program, an evidence screen saving method, and an evidence screen saving device for saving an evidence screen of an unauthorized operation performed on a computer.

Background art

[0002] In particular, when a company or the like handles important information on a computer and uses the computer by connecting it to a network such as the Internet, it is possible to prevent intrusion of unauthorized data from the outside and prevent unauthorized access to the computer. It is necessary to prevent data leakage and leakage from inside. Also, when a computer is used stand-alone without being connected to a network, it is necessary to prevent unauthorized operations such as illegal copying of data in the computer, erasing or destroying data.

[0003] In order to prevent such unauthorized operations, one is to record the operation history of the computer or network as a log, and in the event of trouble, refer to the log to identify the source of the unauthorized operation. Is commonly done. In addition, in order to detect unauthorized operations promptly and prevent problems from occurring, register unauthorized operation patterns as rules and judge illegal operations by comparing the operations performed by the computer with rules that enforce the operations. Methods have also been used.

[0004] When a fraud is detected by the above method, as a method for stopping the fraud, processing such as interrupting the operation being performed, reporting to the administrator, and warning to the operator are executed. . For example, a method is disclosed in which, when monitoring unauthorized operation in a network, communication is cut off, and a notification report is sent to an administrator and a warning report is sent to an operator (see Patent Document 1). Also, a method of issuing a warning message to a monitor when monitoring operations on a computer is disclosed (see Patent Document 2).

) o

Patent Document 1: Japanese Unexamined Patent Application Publication No. 2002-232232, paragraph number 0005 Patent Document 2: JP-A-2002-258972, paragraph number 0034

Disclosure of the invention

Problems to be solved by the invention

[0005] As in the method described in the patent document, it is important to stop the unauthorized operation itself. For example, when legal action is taken against a person who has performed the unauthorized operation, evidence of the unauthorized operation is required. It is important to save. In addition, even if legal action is not taken, records of browsing are kept in-house, such as when employees are cautioned to visit a recreation website during business hours. Being preferred to be.

[0006] Such evidences must be identified by recording logs in the event that a fraudulent event occurs. In addition, if the accessed file has been changed or the file has been deleted, there is a problem that the operation status at the time when the unauthorized operation was performed cannot be reproduced. In the event that fraud occurs, it is preferable to save credible evidence as soon as possible.

[0007] The present invention has been made in response to such a problem, and it is possible to quickly save an evidence screen at the time of occurrence of an unauthorized operation performed on a computer. It is intended to provide a screen storage program, a evidence screen storage method, and a evidence screen storage device.

Means for solving the problem

[0008] A first invention for solving the above-mentioned problem is a proof screen storage program for storing a proof screen of an unauthorized operation performed on a computer, wherein the computer accepts the proof screen by the computer. Determining whether the operation performed is an unauthorized operation; obtaining the display data displayed on the screen of the computer by the operation if the operation is determined to be an unauthorized operation; And storing the evidence data with the information specifying the operation in the evidence data storage unit in the evidence data storage unit. When the operation is determined to be an unauthorized operation, the computer is caused to execute a step of recording at least one log of a keystroke, a network, an application, or an operation system applied to the computer. You can also. [0009] In the first invention, by storing the display data displayed on the computer screen by the operation determined to be the unauthorized operation, the evidence of the unauthorized operation can be saved quickly. . The operation history of the computer may be recorded as a log at all times.However, by recording the log after it is determined that the operation is unauthorized, the evidence that the operation has been performed together with the data displayed on the screen is effective. Can be saved

[0010] Incidentally, in the present invention, any judging method may be used for judging an unauthorized operation, such as judging based on a pre-registered rule base or judging based on a user profile obtained by analyzing a user's operation tendency. The file format of the display data to be saved is not limited to a specific format as long as it can reproduce the screen display. The information for specifying the operation uses the user ID of the user who performed the operation, the time when the operation was performed, and the like.

[0011] A second invention for solving the above-mentioned problem is a proof screen storage program for storing a proof screen of an unauthorized operation performed on a computer, wherein the computer accepts the proof screen by the computer. Determining whether the operation performed is an unauthorized operation; obtaining the display data displayed on the screen of the computer by the operation if the operation is determined to be an unauthorized operation; And transmitting, to the management server via a network, evidence data with information specifying the operation. And causing the computer to execute a step of transmitting at least one log of a keystroke, a network, an application, or an operation system applied to the computer to the management server when the operation is determined to be an unauthorized operation. It may be characterized.

[0012] In the second invention, as in the first invention, the acquired display data is transmitted to the management server, and the management server monitors the unauthorized operation centrally, thereby saving the evidence of the unauthorized operation. In addition, the administrator can take quick and quick responses. The requirements for the ability to record logs to increase the evidentiality, the method of determining unauthorized operation, the file format of the display data, and the information for specifying the operation are the same as in the first invention. [0013] Further, in the first invention and the second invention, in the step of obtaining the display data, the data written by the operation in the virtualized display area is obtained as display data. It can also be a feature.

[0014] In the present invention, the force required to identify the display data displayed on the screen by an unauthorized operation as evidence is that the display data displayed on the screen is written in a virtual display area such as a device context. It can be specified from the issued data.

[0015] Further, in the first invention and the second invention, in the step of obtaining the display data, the data written by the operation in a buffer for displaying a screen of the computer is written. It can also be obtained as display data.

[0016] In order to identify display data displayed on the screen due to unauthorized operation, data written to a buffer for displaying a screen, such as VRAM, provided on a video board for displaying a screen of a computer is used. You can get it.

[0017] The first invention and the second invention can also be grasped as an evidence screen saving method that can be performed by executing the above-described evidence screen saving program. Further, it can be configured as an evidence screen storage device using the above evidence screen storage program.

That is, the evidence screen saving method according to the first invention is an evidence screen saving method for saving an evidence screen of an unauthorized operation performed on a computer, wherein the computer A step of determining whether the received operation is an unauthorized operation; and a step of the computer acquiring display data displayed on a screen of the computer by the operation when the operation is determined to be an unauthorized operation. And storing the evidence data in which the information specifying the operation is added to the display data in the evidence data storage unit.

An evidence screen saving method according to a second invention is an evidence screen saving method for saving an evidence screen of an unauthorized operation performed on a computer, wherein the computer accepts the evidence screen. A step of determining whether the operation is an unauthorized operation; and, if the operation is determined to be an unauthorized operation, the computer acquires display data displayed on a screen of the computer by the operation. Transmitting the evidence data with the information specifying the operation to the display data to a management server via a network; and the management server stores the evidence data in an evidence data storage unit. And storing the evidence screen.

[0020] An evidence screen storage device corresponding to the first invention is an evidence screen storage device for saving an evidence screen of an unauthorized operation performed on a computer, wherein the operation received by the computer is an unauthorized operation. Operation means for judging whether the operation is illegal, and when the operation is judged to be an illegal operation by the illegal operation judgment means, display data displayed on the screen of the computer is acquired by the operation. Evidence data storage means, comprising: display data acquisition means; and evidence data storage means for storing evidence data obtained by adding information for specifying the operation to the display data acquired by the display data acquisition means. Device. When the unauthorized operation determining means determines that the operation is an unauthorized operation, the information processing apparatus further comprises a log recording means for recording at least one log of a keystroke, a network, an application, or an operation system of the computer. You can also.

[0021] An evidence screen storage device according to the second invention is an evidence screen storage device for saving an evidence screen of an unauthorized operation performed on a computer, wherein the operation received by the computer is an unauthorized operation. Operation means for judging whether the operation is illegal, and when the operation is judged to be an illegal operation by the illegal operation judgment means, display data displayed on the screen of the computer is acquired by the operation. Display data acquisition means, and evidence data transmission means for transmitting, via a network, evidence data in which display data acquired by the display data acquisition means with information specifying the operation is transmitted to a management server. This is the evidence screen storage device. When the unauthorized operation determining means determines that the operation is an unauthorized operation, at least one log of a keystroke, a network, an application, or an operation system concerning the computer is transmitted to the management server. It can be characterized by having no transmission means.

[0022] Further, the evidence screen storage device corresponding to the first invention and the second invention is characterized in that the display data storage device The data acquisition means may acquire data written by the operation in the virtualized display area as display data. Further, the display data obtaining means obtains, as display data, data written by the operation in a buffer for displaying a screen of the computer.

The invention's effect

[0023] According to the present invention, at the time of occurrence of an unauthorized operation performed on a computer, data displayed on a screen can be promptly saved as evidence, so that legal action is required. It is also possible to easily prove the fact of unauthorized operation. As a result, a deterrent effect works for computer users, and an effect of preventing the occurrence of unauthorized operations can be expected.

BEST MODE FOR CARRYING OUT THE INVENTION

The best mode for carrying out the present invention will be described below in detail with reference to the drawings. The following description is an example of an embodiment of the present invention, and the present invention is not limited to such an embodiment.

FIG. 1 is a diagram showing an overall configuration of an example in which the evidence screen storage device according to the present invention is used for monitoring a terminal connected to a network. FIG. 2 is a diagram showing a monitoring position on a network in an example in which the evidence screen storage device according to the present invention is used for monitoring a terminal connected to the network. FIG. 3 is a diagram showing an outline of a function of an example in which the evidence screen storage device according to the present invention is used for monitoring a terminal connected to a network. FIG. 4 is a block diagram showing a configuration of a fraud monitoring system using the evidence screen storage program according to the present invention. FIG. 5 is a diagram showing an outline of the processing by the evidence screen saving program which is useful in the present invention. FIG. 6 is a diagram showing an example of a table for storing the evidence data acquired by the evidence screen saving program according to the present invention. FIG. 7 is a flowchart showing a processing procedure of an evidence screen storage program that is useful in the present invention.

[0026] The evidence screen storage device according to the present invention saves an evidence screen of an unauthorized operation performed on a computer, but may be used in a stand-alone computer. To monitor computers connected to the network May be. In the former case, the data related to the evidence screen is stored in the combi- ter used by the user.

FIG. 1 shows an example used for monitoring a computer connected to the latter network. In FIG. 1, a plurality of user terminals are connected by an in-house network such as a LAN, and the in-house network is connected to the Internet. The fraud monitoring server monitors data flowing on the network and monitors activities such as sending and receiving unauthorized information to and from the Internet.

In the example of FIG. 1, the evidence screen storage device working on the present invention monitors illegal operations in two parts. One is to monitor the operation performed on the user terminal, and if it is determined that the operation is unauthorized, capture the operation screen at the time of the unauthorized operation and store it in the user terminal or the unauthorized monitoring server. The other is that when the fraud monitoring server monitors data flowing through the network and detects data that corresponds to an unauthorized operation, it identifies the user terminal that sends and receives the data and displays the operation displayed on the user terminal based on the data. Capture the screen and store it on the user terminal or the fraud monitoring server.

As shown in the example of FIG. 2, the position where the fraud monitoring server monitors the data on the network is, in addition to the monitoring of the data executed in the user terminal, the segment unit of the network. It can be placed in various locations, such as monitoring data transmitted and received by a mail server, monitoring data at a mail server, and monitoring data at a gateway.

FIG. 3 shows an example of the respective functions of the user terminal and the fraud monitoring server in the case where the evidence screen storage device according to the present invention is used for monitoring a computer connected to a network. At the user terminal, the evidence screen storage program according to the present invention is executed, and when an unauthorized operation is detected, a warning message is displayed on a display and a warning sound is generated. At the same time, the screen displayed by the unauthorized operation is captured, and the display data of the screen together with the information such as the time of occurrence is transmitted to the fraud monitoring server as evidence data with the identification information of the terminal.

[0031] In the fraud monitoring server, information such as terminal identification information and occurrence time is classified as a key. Evidence data is stored. In addition to the evidence data, it is also possible to obtain and store from the user terminal various types of operations after the fraud has occurred. The fraud monitoring server may also display a warning message on the display and generate a warning sound to promptly notify the administrator of the occurrence of an illegal operation.

With reference to FIG. 4, the configuration of the fraud monitoring system using the evidence screen saving program that works on the present invention will be described. The user terminal 10 includes a CPU 11, a RAM 12, a ROM 13, a HDD 14, and a video board 15. The HDD 14 stores a fraud monitoring program 141 for monitoring for fraudulent operations including a evidence screen saving program that is useful for the present invention, and stores fraud rules for storing rules for judging fraudulent operations. Unit 142 is provided with an evidence data storage unit 143 that stores data related to an evidence screen when an unauthorized operation is performed. The video board 15 includes a VRAM 16 which is a buffer for writing screen content to be displayed on the display 17. It should be noted that the HDD 14 storing the fraud monitoring program 141 may use another storage medium such as a flash memory capable of storing a program!

[0033] In order to perform monitoring by the fraud monitoring program 141 stored in the HDD 14, basic various programs for hardware control such as input control and output control stored in the ROM 13 are started, and the RAM 12 The CPU 11 performs arithmetic processing while making the function as a work area of the fraud monitoring program 141. Judgment of unauthorized operation is performed by arithmetic processing that compares the operation accepted by the user terminal 10 with the rule stored in the illegal rule storage unit 142, and when it is determined that the operation is unauthorized, the operation is displayed on the display 17 Perform the screen capture.

Here, the display data of the screen to be captured is specified by acquiring the data written in the virtualized display area such as the device context in the arithmetic processing in the CPU 11 and the RAM 12. can do. Alternatively, the data written by the operation in the VRAM 16 which is a buffer for displaying on the display 17 can be acquired and specified.

[0035] Display data of the captured screen includes data for identifying the operation, such as the time when the ID operation of the user who performed the operation was received. This is added to and stored in the evidence data storage unit 143. Figure 6 shows an example of a table that stores the evidence data obtained in this way.Records provided for each operation to be processed are displayed on the display together with the date and time of receipt of the operation and the user ID. The file name of the displayed data is recorded. As for the powerful screen file itself, the format of the powerful file stored in the evidence data storage unit 143 may be any format.

[0036] Further, after the occurrence of fraud, logs of operations performed on the computer, such as keystrokes, networks, applications, or operation systems, in addition to the direct operations of performing the fraudulent operations, are recorded. You can also record it. Such a log can be used to prove the operation history of the user and prove that unauthorized operation has been performed in conjunction with the evidence screen. However, considering the resources of the hardware that records the log, it is preferable that the log is recorded after the occurrence of the fraud.

Note that the fraud rule storage unit 142 provided in the user terminal 10 may be provided as the fraud rule storage unit 21 in the fraud monitoring server 20 that monitors the network including the user terminal 10. Generally, when a rule for judging fraud is set for each user, a common rule is applied to a plurality of terminals belonging to the same network, where it is preferable to use the fraud rule storage unit 142 provided in the user terminal 10. When applying, it is preferable to use the fraud rule storage unit 21 provided in the fraud monitoring server 20.

[0038] The acquired evidence data may be stored in the evidence data storage unit 143 in the user terminal 10, but in order to reduce the risk of deleting the evidence data, the acquired evidence data is under the control of the administrator. It is preferable to use the evidence data storage unit 22 provided in the fraud monitoring server 20.

FIG. 5 shows an outline of the processing by the evidence screen storage program that is useful in the present invention.

Note that the components described below are not physically separated, but are stored in the HDD 14 as a part of the fraud monitoring program 141 that executes each component as shown in FIG. The arithmetic processing may be executed by the CPU 11 while the RAM 12 functions as a work area.

[0040] First, when the user terminal accepts the operation, the fraud determining unit determines the operation. It is determined whether or not the racing is an illegal operation. Such a determination can be made in comparison with a rule stored in a fraudulent rule storage unit created based on a general fraudulent pattern pattern, but is not limited to a rule-based determination and can be performed by a user. Pattern power Compared with the created user profile or the like, an illegal operation may be determined from unique behavioral power.

When it is determined that the operation is an unauthorized operation, the display data acquisition unit acquires display data to be displayed on the display of the user terminal by the operation. The display data to be acquired is specified from the data written to VRAM or device context. The display data is saved as an image file and stored in the evidence data storage unit with information identifying the operation, such as the date and time of receipt of the operation and the user ID. Further, such evidence data may be transmitted to a management server or the like via a network and stored. Further, in order to stop the unauthorized operation, the stop processing execution unit may execute processing such as displaying a warning message, generating a warning sound, stopping the operation, and disconnecting the network.

The display of the warning message and the generation of the warning sound may be performed on the user terminal side or may be performed on the management server side. In the case of performing on the user terminal side, even if no fraud is detected, various settings such as specific time, random, startup, etc. are performed and a dummy warning message or warning sound is emitted and monitoring is performed. It is possible to increase the deterrence effect on the user by clarifying that the information is being checked. In this case, it is possible to actually perform even the capture of the screen.

With reference to the flowchart of FIG. 7, a description will be given of a processing procedure of an evidence screen storage program that is useful for the present invention. First, data received by the computer for determining whether or not the power is an unauthorized operation is acquired (S01). Next, by referring to the rules stored in the fraud rule database (S02), it is determined whether or not the power falls under the fraud rules by comparing the obtained data (S03). If it does not correspond to the illegal rule, the illegal operation determination processing ends.

[0044] If the user falls under the fraudulent rule, the user checks whether the computer operated by the user is capable of generating a warning sound or a warning message (S04). Is set to occur In this case, a warning sound or a warning message is generated (S05). Subsequently, display data to be displayed by the operation of performing the fraud determination is obtained from the device context (S06). The display data is attached with information for identifying unauthorized operations such as a date (S07), and is stored as evidence in a database or the like (S08). Further, the setting of whether or not to transmit the display data to the management server is confirmed (S09), and if the transmission is set, it is also transmitted to the management server (S10).

Brief Description of Drawings

[FIG. 1] A proof screen storage device according to the present invention is used for monitoring terminals connected to a network.

V is a diagram illustrating an entire configuration of an example.

FIG. 2 is a diagram showing a monitoring position on a network in an example in which the evidence screen storage device according to the present invention is used for monitoring a terminal connected to the network.

[Fig. 3] The evidence screen storage device according to the present invention is used for monitoring terminals connected to a network.

FIG. 5 is a diagram showing an outline of functions of an example.

FIG. 4 is a block diagram showing a configuration of a fraud monitoring system using a proof screen storage program that is useful in the present invention.

FIG. 5 is a diagram showing an outline of a process performed by the evidence screen storage program according to the present invention.

FIG. 6 is a diagram showing an example of a table for storing evidence data obtained by an evidence screen saving program according to the present invention.

FIG. 7 is a flowchart showing a processing procedure of an evidence screen storage program that is useful in the present invention.

Explanation of symbols

[0046] 10 user terminals

11 CPU

12 RAM

13 ROM

14 HDD

141 Fraud Monitoring Program

142 Fraud Rule Storage Evidence data storage Bidet board VRAM

Display Fraud monitoring server Fraud rule storage Evidence data storage

Claims

The scope of the claims

[1] An evidence screen saving program for saving an evidence screen of an unauthorized operation performed on a computer, the program comprising:

Determining whether the operation received by the computer is an unauthorized operation;

Acquiring the display data displayed on the computer screen by the operation when the operation is determined to be an unauthorized operation;

Storing, in the evidence data storage unit, evidence data obtained by adding information identifying the operation to the display data;

Screen save program to run

[2] causing the computer to execute a step of recording at least one log of keystrokes, a network, an application, or an operation system applied to the computer when the operation is determined to be an unauthorized operation.

The evidence screen storage program according to claim 1, wherein:

[3] An evidence screen saving program for saving an evidence screen of an unauthorized operation performed on a computer, wherein the computer has:

Transmitting, via a network, evidence data obtained by adding information specifying the operation to the display data,

Screen save program to run

[4] causing the computer to execute a step of transmitting, to the management server, at least one log of keystrokes, a network, an application, or an operation system relating to the computer when the operation is determined to be an unauthorized operation. thing

The evidence screen storage program according to claim 3, characterized in that:

[5] The evidence screen storage program according to claim 1 or 3, wherein in the step of acquiring the display data, the data written by the operation in the virtualized display area is acquired as display data. .

[6] In the step of acquiring the display data, acquiring the data written by the operation in a buffer for displaying a screen of the computer as the display data.

The evidence screen storage program according to claim 1 or 3, characterized in that:

[7] An evidence screen saving method for saving an evidence screen of an unauthorized operation performed on a computer,

The computer acquiring display data displayed on the computer screen by the operation when the operation is determined to be an unauthorized operation;

A step in which the computer stores, in the evidence data storage unit, evidence data in which information for specifying the operation is added to the display data;

A method of saving an evidence screen, comprising:

[8] An evidence screen saving method for saving an evidence screen of an unauthorized operation performed on a computer,

The computer transmitting, via a network, evidence data obtained by adding information identifying the operation to the display data, to a management server;

A step of storing the evidence data in the evidence data storage unit by the management server.

[9] An evidence screen storage device for saving an evidence screen of an unauthorized operation performed on a computer,

Unauthorized operation determining means for determining whether the operation received by the computer is an unauthorized operation;

A display data acquisition unit configured to acquire display data displayed on the screen of the computer by the operation when the operation is determined to be an unauthorized operation by the unauthorized operation determination unit;

Evidence data storage means for storing evidence data in which information for specifying the operation is added to the display data acquired by the display data acquisition means;

An evidence screen storage device, comprising:

[10] When the unauthorized operation determining means determines that the operation is an unauthorized operation, a log recording at least one log of a keystroke, a network, an application, or an operation system applied to the computer. The evidence screen storage device according to claim 9, further comprising a recording unit.

[11] An evidence screen storage device for saving an evidence screen of an unauthorized operation performed on a computer,

Evidence data transmitting means for transmitting, via a network, evidence data obtained by adding information for specifying the operation to the display data obtained by the display data obtaining means,

An evidence screen storage device, comprising:

[12] If the unauthorized operation determining means determines that the operation is an unauthorized operation, at least one log of a keystroke, a network, an application, or an operation system applied to the computer is stored in the management server. Log sending means to send to To reserve

12. The evidence screen storage device according to claim 11, wherein:

[13] The display data obtaining means obtains, as display data, data written by the operation in a virtual display area.

The evidence screen storage device according to claim 9 or 11, wherein:

[14] The evidence screen storage according to claim 9 or 11, wherein the display data obtaining unit obtains, as display data, data written by the operation in a buffer for displaying a screen of the computer. apparatus.