WO2008004276A2

WO2008004276A2 - Intrusion prevention system against hacker or computer virus, and program thereof

Info

Publication number: WO2008004276A2
Application number: PCT/JP2006/313282
Authority: WO
Inventors: Satoshi Yamada; Takuma Sato
Original assignee: Realcreate Co., Ltd.
Priority date: 2006-07-04
Filing date: 2006-07-04
Publication date: 2008-01-10

Description

Virus and unauthorized intruder intrusion prevention device and program thereof

[0001] The present invention relates to a virus and an unauthorized intrusion for preventing an intruder such as a virus and a hacker from entering the computer or the communication network in an environment where the computer is connected to the communication network via a relay device. The present invention relates to an intruder prevention device and its program.

Background art

[0002] In recent years, with the development of communication networks represented by the Internet, contamination of computers by viruses has become a major social problem. This type of virus enters a computer via a communication network or a storage medium such as a CD. When a computer is infected with a virus, symptoms such as frequent system errors, erasure of files stored in the hard disk and memory, and damage to the hard disk occur.

[0003] Thus, in order to prevent the computer from being contaminated by this type of virus, many so-called software programs have been developed. These software processes the virus when it is deleted or quarantined after it has been taken into the OS (Operating System) stored in the computer's memory. Patent Document 1).

Patent Document 1: Japanese Patent Laid-Open No. 6-230959 However, with the conventional software described above, it is virtually impossible to eradicate viruses that are difficult to cope with new viruses that occur one after another. there were.

[0004] In addition, since conventional software deletes or isolates data determined to be a virus in accordance with a preset definition, data that is not actually a virus can be deleted or isolated by mistake. There is a problem that the reliability is low.

[0005] The present invention has been made to solve the above-described problems, and can reliably detect a virus, and data including a virus and unauthorized intruders such as hackers can be put into a computer. The object is to provide a virus and unauthorized intruder intrusion prevention device and its program that can completely prevent intrusion or, on the contrary, intrusion into a computer-powered communication network.

Disclosure of the invention

[0006] In order to achieve the above-described object, the virus and unauthorized intruder intrusion prevention device according to the present invention is capable of intruding a virus into the computer or the communication network in an environment where a computer is connected to the communication network. A virus and unauthorized intruder intrusion prevention device for preventing a computer, a dividing means for dividing data transmitted to the computer or the communication network into analog data and digital data, and the divided analog data In the frequency band near the boundary of the digital data, the data force detecting means for detecting electrical distortion and the data portion including the electrical distortion detected by the detecting means are recognized as abnormal data, and the abnormal data is passed. It is characterized in that it is provided with a blocking means for blocking the power.

[0007] The blocking means may block the passage of the abnormal data in the transmission / reception unit of the computer.

[0008] Further, dial means may be provided for continuously transmitting numerical data of a predetermined number of digits to the transmission / reception unit of the computer.

[0009] Further, the present invention provides a virus intrusion prevention program for preventing the entry of a virus into the computer or the communication network in an environment where the computer is connected to the communication network. Dividing data transmitted to the communication network into analog data and digital data; detecting electrical distortion from the data in a frequency band near a boundary between the divided analog data and digital data; And a step of recognizing the data portion including the detected electrical distortion as abnormal data and blocking the passage of the abnormal data.

[0010] The method may further comprise the step of continuously transmitting numerical data having a predetermined number of digits to the transmission / reception unit of the computer.

[0011] According to the present invention, a virus can be reliably detected, and data containing a virus can be detected. Unauthorized intruder power such as a power source can be completely prevented from entering the computer or, conversely, the computer power also entering the communication network.

Brief Description of Drawings

FIG. 1 is a schematic diagram showing an overall configuration of a virus intrusion prevention system including a virus and unauthorized intruder intrusion prevention device according to an embodiment of the present invention.

FIG. 2 is a functional block diagram showing the configuration of the virus and unauthorized intruder intrusion prevention device according to the embodiment of the present invention.

FIG. 3 is a diagram showing analog data including abnormal data.

FIG. 4 is a diagram showing digital data including abnormal data.

FIG. 5 is a diagram showing the structure of normal data.

FIG. 6 is a diagram showing the structure of data including abnormal data.

FIG. 7 is a diagram showing a communication record in the virus and unauthorized intruder prevention device according to the embodiment of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described with reference to the drawings. Here, FIG. 1 is a schematic diagram showing the overall configuration of a virus and unauthorized intruder intrusion prevention system equipped with a virus and unauthorized intruder intrusion prevention device according to an embodiment of the present invention, and FIG. 2 is an embodiment of the present invention. FIG. 3 is a functional block diagram showing a configuration of a virus and unauthorized intruder intrusion prevention device according to FIG.

As shown in FIG. 1, a virus and unauthorized intruder prevention system 1 includes a computer 8 having a hard disk drive 2, a CPU 3, a memory 4, a LAN board 5, a mouse 6 and a keyboard 7. The computer 8 is installed on the hard disk drive 2 via a storage medium such as a CD-ROM, and is installed with a virus and unauthorized intruder prevention program power S. As a result, it can function as a virus and unauthorized intruder prevention device.

As shown in FIG. 2, the virus and unauthorized intruder intrusion prevention device 11 includes an OS processing unit 12 for supporting a plurality of operating systems (OS) and a computer 8 or a communication network 9. The data sent to is divided into analog data and digital data In addition, a data dividing unit 13 that analyzes data like a LAN analyzer, a frequency band identifying unit 14 that identifies a frequency band of the data when transmitting and receiving data in a transmitting and receiving unit such as the LAN board 5 and the router 10, A data amount calculation unit 15 that calculates the volume of data to be transmitted and received in the transmission / reception unit, and a frequency band calculation unit 16 that calculates an appropriate frequency band according to the environment of the computer 8 such as the data transmission speed and the installation location of the computer 8. And a load adjusting unit 17 that adjusts the communication load according to the data volume calculated by the data amount calculating unit 15, and a data guiding unit 18 that guides the data to an appropriate route such as analog or digital, CPU3, memory 4, etc. , Sent to the transmission speed adjustment section 19 that adjusts the data transmission speed to increase the transmission speed, and the transmission / reception section of the LAN board 5 and router 10 of the computer The numerical data setting unit 20 for setting numerical data of a predetermined number of digits (for example, 6 rows and 4 columns) at random and the numerical data set by the numerical data setting unit 20 are transmitted to the transmission / reception unit. Continued dial unit 21, data division unit 13, distortion detection unit 22 for detecting electrical distortion in the frequency band (about 4KHz) near the boundary between analog data and digital data divided, and distortion detection The data portion including the electrical distortion detected by the unit 22 is recognized as abnormal data, and is provided with a data blocking unit 23 that blocks passage of the abnormal data.

[0016] In the virus and unauthorized intruder prevention device 11 having such a configuration, when data including a virus is transmitted from the communication network 9 through the router 10 to the computer 8, first, The data is forcibly divided into analog data and digital data by the data dividing unit 13 and analysis of R value, noise, echo, interruption, etc. is performed on each data. As a result, as shown in Fig. 3 and Fig. 4, large electrical signal disturbances V, V (hereinafter referred to as `` Electricity '') in the frequency band (4KHz) near the boundary between analog data and digital data. Is detected by the distortion detector 22.

A D

At the same time, it is recognized as abnormal data 28, and the passage of the abnormal data 28 through the LAN board 5 is blocked by the data blocking unit 23.

[0017] At this time, the electrical distortions V and V occur in the frequency band (4 KHz) near the boundary between the analog data and the digital data for the following reason.

A D

[0018] In general, normal data 24 is divided by each packet 25 as shown in FIG. It is transmitted as digital data, and has a header part 26 and a footer part 27 at the beginning and the end of the data, respectively. On the other hand, the abnormal data 28 including the virus is transmitted by a method of being inserted into the normal data 24 as shown in FIG. 6, and the abnormal data 28 including the virus is always included in the header portion 29 and the footer portion. There are 30. In other words, abnormal data 28 including viruses is different from the normal data 24 because the number and order of the header and footer sections are different. The electrical distortion V and V can be confirmed by analyzing interruptions, etc.

A D

It is thought that.

As described above, according to the virus and unauthorized intruder intrusion prevention device 11 described above, the abnormal data 28 including the virus is reliably blocked in the transmission / reception unit of the computer 8, and thus enters the inside of the computer 8. There is nothing. Even if the computer 8 is infected by a storage medium such as a CD or floppy disk (registered trademark) contaminated with a virus, the abnormal data 28 including the virus is reliably blocked in the transmission / reception unit. Therefore, it is possible to prevent a computer or the like connected to the communication network 9 from entering the communication network 9 from being infected with a virus.

[0020] In addition, in the virus and unauthorized intruder intrusion prevention device 11 described above, the numerical data with a predetermined number of digits set at random in the numerical data setting unit 20 is always supplied to the dial unit 21 and the LAN board 5, the router 10, etc. Is sent to the transceiver. However, if the numerical data is transmitted, it includes not only digital data but also analog data, so if both numerical data are not analyzed, unauthorized intrusion such as The person is unable to perceive the presence of the computer 8. In addition, a spare parameter is added to the parameters built into the router 10 and computer 8, and as shown in the log contents of data No. 5 and No. 8 in Fig. 7. The IP address of the transmission / reception unit is displayed as “00000000”, so that an intruder such as a hacker cannot recognize the IP address. Therefore, an unauthorized intruder cannot enter the inside of the computer 8, and the unauthorized intruder power can be surely protected for the computer 8.

[0021] As described above, according to the embodiment of the present invention, it is possible to reliably block the intrusion of an unauthorized intruder such as abnormal data including a virus or the power of a hat. Therefore, it is possible to easily cope with new viruses and unauthorized intruders that occur one after another, and to reliably protect computers and communication networks against viruses and unauthorized intruders. In addition, it is possible to improve reliability without actually deleting or isolating non-virus data.

Note that the present invention can also be applied to a wireless LAN, thereby reliably preventing eavesdropping, information falsification, leakage, and destruction, which are problems in the wireless LAN, thereby improving security. Can be planned.

Claims

The scope of the claims

[1] A virus and unauthorized intruder intrusion prevention device for preventing a virus and unauthorized intruder from entering the computer or the communication network in an environment where the computer is connected to a communication network,

Dividing means for dividing data transmitted to the computer or the communication network into analog data and digital data;

A detecting means for detecting the data force electrical distortion in a frequency band near a boundary between the divided analog data and the digital data;

A blocking means for recognizing the data portion including the electrical distortion detected by the detecting means as abnormal data and blocking the passage of the abnormal data;

A virus and unauthorized intruder intrusion prevention device characterized by comprising:

2. The virus and unauthorized intruder intrusion prevention device according to claim 1, wherein the blocking means blocks the passage of the abnormal data in a transmission / reception unit of the computer.

[3] The virus and unauthorized intruder intrusion prevention device according to claim 1 or 2, further comprising dial means for continuously transmitting numerical data having a predetermined number of digits to the transmission / reception unit of the computer. apparatus.

[4] A virus and unauthorized intruder intrusion prevention program for preventing entry of a virus and unauthorized intruder into the computer or the communication network in an environment where the computer is connected to a communication network,

Dividing data transmitted to the computer or the communication network into analog data and digital data;

Detecting electrical distortion from the data in a frequency band near a boundary between the divided analog data and digital data;

Recognizing the data portion including the detected electrical distortion as abnormal data and blocking the passage of the abnormal data;

A virus and unauthorized intruder intrusion prevention program characterized by comprising:

[5] The virus and unauthorized intruder intrusion prevention method according to claim 4, further comprising a step of continuously transmitting numerical data of a predetermined number of digits to the transmission / reception unit of the computer at random. Stop program,