Detection device

Abstract

To detect such a possibility that an unauthorized operation has occurred with stable accuracy.SOLUTION: A detection device 10 comprises: an input / output unit 11 that receives input from a keyboard and outputs a key log representing keying records of the keyboard; a determination unit 131 that determines a keyboard layout of the keyboard on which an input operation was performed on the basis of the key log; and an unauthorized operation detection unit 132 that detects such a possibility that an unauthorized operation by a person other than the original user has occurred when the keyboard layout determined by the determination unit 131 is a keyboard layout different from the past keyboard layouts.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a detection device. [Background technology]

[0002] In recent years, research and development of keystroke authentication, a biometric authentication method based on typing, has been actively promoted (Non-Patent Documents 1 and 2). Keystroke authentication has the advantage of biometric authentication in that it does not require ID (identification) or passwords, and also has the advantage of extremely low implementation costs. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Clayton Epp, Michael Lippold, and Regan L. Mandryk, “Identifying Emotional States using Keystroke Dynamics,” CHI 2011·Session: Emotional States, May 7-12, 2011. [Non-patent document 2] Najwa Altwaijry, “Authentication by Keystroke Dynamics: The Influence of Typing Language,” Appl. Sci. 2023, 13, 11478. Summary of the Invention [Problem to be solved by the invention]

[0004] However, conventional authentication methods have the problem of being difficult to stabilize in accuracy. For example, even if the person is typing, authentication may be rejected due to drowsiness or one-handed operation, and so no commercialization of such methods has been achieved yet.

[0005] The present invention has been made in view of the above, and has an object to provide a detection device that can detect the possibility of unauthorized operation with stable accuracy. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the object, the detection device of the present invention is characterized by having an input / output unit that receives input from a keyboard and outputs a key log, which is a record of keystrokes on the keyboard, a determination unit that determines the keyboard layout of the keyboard on which the input operation was performed based on the key log, and a detection unit that, if the keyboard layout determined by the determination unit is a keyboard layout different from the previous keyboard layout, detects that there is a possibility of fraudulent operation by a person other than the original user. [Effects of the Invention]

[0007] According to the present invention, it is possible to detect with stable accuracy that an unauthorized operation has occurred. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram illustrating an example of the configuration of a detection device according to an embodiment. [Figure 2] FIG. 2 is a diagram showing an image of key input. [Figure 3] FIG. 3 is a diagram illustrating an example of a key log. [Figure 4] FIG. 4 is a diagram showing an example of a key log. [Figure 5] FIG. 5 is a diagram showing an example of a keystroke situation on a US keyboard (English keyboard layout). [Figure 6] FIG. 6 is a diagram showing examples of key combination input patterns specific to each keyboard layout. [Figure 7] FIG. 7 is a diagram showing an example of a keystroke state on the keyboard. [Figure 8] FIG. 8 is a diagram showing an example of a key log for a JIS keyboard. [Figure 9] FIG. 9 is a diagram showing an example of a key log using a US keyboard layout. [Figure 10] FIG. 10 is a diagram illustrating an example of the determination by the second determining unit. [Figure 11] FIG. 11 is a diagram showing an example of a key log in which time information is omitted. [Figure 12] FIG. 12 is a diagram showing an example of a keystroke state on the keyboard. [Figure 13] FIG. 13 is a diagram showing an example of a keystroke state on the keyboard. [Figure 14] FIG. 14 shows indicators specific to the US sequence system. [Figure 15] FIG. 15 is a diagram showing special keys for which the keyboard layout can be determined. [Figure 16] FIG. 16 is a flowchart of the detection process according to the embodiment. [Figure 17] FIG. 17 is a flowchart showing the processing procedure of the first determination processing shown in FIG. [Figure 18] FIG. 18 is a flowchart showing the processing procedure of the second determination processing shown in FIG. [Figure 19] FIG. 19 is a diagram for explaining an example of the embodiment. [Figure 20] FIG. 20 is a diagram illustrating an example of a computer that implements a detection device by executing a program. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0010] [Embodiment Mode] In the embodiment, the detection accuracy is improved by narrowing down the detection target to "unauthorized operations" by people other than the original user. Specifically, by determining the user's keyboard layout based on the key log, it is possible to detect the possibility of unauthorized operations from, for example, another country.

[0011] [Detection device] First, a detection device according to an embodiment will be described. Fig. 1 is a block diagram showing an example of the configuration of a detection device according to an embodiment.

[0012] As shown in Fig. 1, a detection device 10 according to an embodiment detects the possibility of unauthorized operation by a person other than the original user by determining a user's keyboard layout based on a key log, which is a record of keystrokes from a keyboard 20. Possible examples of unauthorized operation by a person other than the original user include unauthorized operation from another country. The keyboard 20 is any keyboard that can input symbols and / or special characters.

[0013] The detection device 10 includes an input / output unit 11 , a storage unit 12 , and a control unit 13 .

[0014] The input / output unit 11 is an interface that controls the input and output of various data. The input / output unit 11 accepts input such as the user's typing information and the typing information of the detection target. The input / output unit 11 functions as a key logger that receives input from the keyboard and outputs a key log that is a record of keystrokes on the keyboard.

[0015] Here, a keylogger refers to software that receives input from a keyboard and outputs information about key operations. Below, we will explain in more detail using the Windows OS (Operating System) as an example.

[0016] Figure 2 shows an image of key input. Normally, when a user types a key on the keyboard, as shown in Figure 2, a scan code based on the physical layout of the key on the keyboard is first passed to the keyboard device driver.

[0017] The keyboard device driver maps scan codes to virtual key codes based on the keyboard layout. Virtual key codes are predefined and independent of the keyboard type or physical key layout.

[0018] The virtual key code mapped by the keyboard device driver is used to create a message along with various information about typing (for example, how many times the same key is pressed consecutively).

[0019] The active application receives the message and enters the key.

[0020] In this manner, the keys pressed by the user are input to the application. In this embodiment, the term "keylogger" refers to software that monitors these messages and outputs information about key operations.

[0021] Specifically, a keylogger monitors the WM_KEYDOWN or WM_SYSKEYDOWN message that occurs when a key is pressed, and the WM_KEYUP or WM_SYSKEYUP message that occurs when a key is released. Here, we have used the names for Windows OS as an example, but even in other OSes, the term "keylogger" refers to software that monitors information output from the keyboard driver in general.

[0022] For example, a program using the Python pynput package functions as a keylogger. Figure 3 shows an example of a keylog.

[0023] When collecting a key log using the pynput package, it is possible to record something like the one shown in Figure 3. In this example, when a key is pressed, the key, time, and "Pressed" are recorded. When a key is held down, the key, time, and "Held" are recorded. When a key is released, the key, time, and "Released" are recorded.

[0024] Here, "Pressed" is recorded when the first WM_KEYDOWN or WM_SYSKEYDOWN keystroke occurs (when the number of consecutive inputs is 0). "Held" is recorded when WM_KEYDOWN or WM_SYSKEYDOWN occurs (not limited to the first time). "Released" is recorded when WM_KEYUP or WM_SYSKEYUP occurs. In this example, UNIX (registered trademark) Time is recorded as the time information.

[0025] When pressing a key, the first "Held" is recorded at the same time as "Pressed." If you press key 2 while continuing to press key 1, "Pressed" for key 2 is not recorded. This is thought to be because continuous input is already in progress when key 2 is pressed, so "Pressed" is not recorded.

[0026] The storage unit 12 stores data, programs, etc. that are referenced when the control unit 13 executes various processes. The storage unit 12 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 12 has a key log storage area 121 that complements the key log output by the input / output unit 11.

[0027] The control unit 13 is responsible for overall control of the detection device 10. The functions of the control unit 13 are realized, for example, by a CPU (Central Processing Unit) executing a program stored in the storage unit 12. The control unit 13 includes, for example, a determination unit 131 and an unauthorized operation detection unit 132.

[0028] The determination unit 131 determines the keyboard layout of the keyboard on which the input operation was performed based on the key log. The determination unit 131 analyzes the key log and determines the keyboard layout of the keyboard on which the input operation was performed based on whether or not a key combination input specific to a predetermined keyboard layout, a character input specific to a predetermined keyboard layout, or a key combination that can co-occur specific to a predetermined keyboard layout has occurred when a special key is input. The determination unit 131 has a first determination unit 1311 and a second determination unit 1312.

[0029] The first determination unit 1311 analyzes the key log and determines the keyboard layout of the keyboard on which the input operation was performed based on whether or not a key combination specific to a predetermined keyboard layout was input when a special key was input, or whether or not a character specific to a predetermined keyboard layout was input.

[0030] Specifically, the first determination unit 1311 analyzes the key log, and when a key combination input specific to a keyboard layout different from the previous keyboard layout occurs when a special key is input, the first determination unit 1311 determines that the keyboard on which the input operation is performed has a keyboard layout different from the previous keyboard layout. Alternatively, when a character input specific to a keyboard layout different from the previous keyboard layout occurs when a special key is input, the first determination unit 1311 determines that the keyboard on which the input operation is performed has a keyboard layout different from the previous keyboard layout. If the first determination unit 1311 determines that the keyboard layout is different from the previous keyboard layout, it displays an indicator (a different keyboard layout indicator) indicating that the keyboard layout is different from the previous keyboard layout.

[0031] The following describes the determination made by the first determination unit 1311. Fig. 4 is a diagram showing an example of a key log. Fig. 5 is a diagram showing an example of a keystroke situation on a US layout (English layout) keyboard.

[0032] Depending on the keyboard layout, there are differences in the keys that can only be entered while holding "shift".

[0033] For example, to enter "@", you only need to press the key to the right of "P" when using the JIS keyboard layout (a common Japanese keyboard layout), but when using the US keyboard layout, you need to press "2" while holding down "shift", as shown in Figure 5. The key log for this case is shown in Figure 4.

[0034] This kind of keylog of "@" sandwiched between "Held" and "Released" of the "shift" key can exist in the US layout, but not in the JIS layout. In other words, if "Held" of "@" occurs after "Held" of "shift" occurs but before "Released" of "shift" occurs, it is determined that the layout is not JIS.

[0035] In addition to "@", there are several other keys whose input availability during "shift" varies depending on the keyboard layout (Reference 1). Figure 6 shows examples of key combination input patterns specific to keyboard layouts. As shown in Figure 6, depending on the combination of input availability during "shift", it is possible to determine whether typing is performed using the JIS layout or a keyboard layout different from the JIS layout. Reference 1: “Keyboard layout”, [Retrieved April 16, 2024], Internet<URL:https: / / docs.oracle.com / cd / E19253-01 / 819-0400 / new-357 / index.html>

[0036] Therefore, the first judgment unit 1311 analyzes the key log, and when it determines that a key combination input specific to a keyboard layout different from the previous keyboard layout (for example, JIS layout) has occurred (such as inputting "@" during shift), it determines that the keyboard layout on which the input operation was performed is an arrangement different from the JIS layout.

[0037] Furthermore, as shown in Figure 6, even when a character input occurs that cannot be directly entered from the JIS layout, such as "Formula (1) (Italian Lira)," it is possible to determine that the keyboard layout on which the J input operation was performed is a different layout from the IS layout.

[0038]

number

[0039] Therefore, the first determination unit 1311 analyzes the key log, and when it determines that a character input specific to a keyboard layout different from the previous keyboard layout (for example, JIS layout) has occurred (such as when "expression (1) (Italian lira)" is input as a single character), it determines that an operation has been performed from a keyboard layout different from the previous keyboard.

[0040] The second determination unit 1312 analyzes the key log and determines the keyboard layout of the keyboard on which the input operation was performed based on whether or not a key combination that can co-occur unique to a predetermined keyboard layout occurs when a special key is input. If there is no Hold key other than the shift key and a key combination that can co-occur unique to a predetermined keyboard layout exists, the second determination unit 1312 determines the keyboard layout of the keyboard on which the input operation was performed based on the key combination that can co-occur.

[0041] The second determination unit 1312 determines whether the determined keyboard layout is different from the previous keyboard layout. If the second determination unit 1312 determines that the keyboard layout is different from the previous keyboard layout, it displays an indicator of the different keyboard layout.

[0042] The determination by the second determination unit 1312 will be described. Fig. 7 is a diagram showing an example of a keyboard keystroke state. Fig. 8 is a diagram showing an example of a key log for a JIS layout keyboard. Fig. 9 is a diagram showing an example of a key log for a US layout keyboard. Fig. 10 is a diagram showing an example of a determination by the second determination unit 1312.

[0043] For example, consider the mistimed typing of "Released" as shown in Figure 7. If you type "shift" and "7" as shown in Figure 7, you can input "&" in the JIS layout (box W21 in Figure 8).

[0044] On the other hand, in the US keyboard layout, to input "&", it is necessary to input "shift" and "7". Therefore, the key log will be as shown in Figure 9 (box W22 in Figure 9).

[0045] When typing like this, the key that is released after releasing the "shift" key to input "&" is either "6" (JIS layout) or "7" (US layout). In other words, the key that co-occurs with "&" before and after the shift key is released ("6" or "7") is specific to the keyboard layout.

[0046] This makes it possible to determine the keyboard layout from the key log, as shown in Figure 10. Specifically, the fact that the key that co-occurs with "&" before and after the shift key is released is "6" is an indicator of the JIS layout. The fact that the key that co-occurs with "&" before and after the shift key is released is "7" is considered to be an indicator of the US layout. However, the fact that the key that co-occurs with "&" before and after the shift key is released is "7" is a necessary condition for the US layout.

[0047] FIG. 11 is a diagram showing an example of a key log omitting time information. As shown in FIG. 11, when entering "&", we will consider whether it is possible for the key released after releasing the "shift" key to be "7" in the JIS layout. FIG. 12 is a diagram showing an example of the keystroke status of the keyboard. FIG. 13 is a diagram showing an example of the keystroke status of the keyboard.

[0048] An example will be described below, taking the case of typing in which the timing of "released" of "shift," "7," and "6" is off, as shown in Figure 12, and the period C1 from when "shift" is "released" to when "7" is "released" is less than approximately 0.032 seconds (frame W23 in Figure 13). For example, in the case of default settings for the Windows OS, the continuous keystroke speed is approximately 30 times per second, so the period C1 is less than 1 / 30 seconds (less than approximately 0.032 seconds), but the period C1 depends on the type and settings of the OS.

[0049] In the case of the timing shown in FIG. 12, the keylog sequence shown in FIG. 11 appears in the JIS layout, but in the case of the JIS layout, a key other than the shift key must be held down.

[0050] Therefore, the necessary conditions for the US keyboard layout are that "no keys other than the shift key are in Hold mode" and the key log sequence "{"Held": [&]}, {"Released": [Key.shift]}, {"Released": [7]}" shown in FIG. 11 appears. Therefore, strictly speaking, the indicators for the US keyboard layout are that "no keys other than the shift key are in Hold mode" and the key log sequence "{"Held": [&]}, {"Released": [Key.shift]}, {"Released": [7]}" shown in FIG. 11 appears. The second determination unit 1312 can use this necessary and sufficient condition to determine whether the keyboard layout in which "&" is input is the JIS keyboard layout or the US keyboard layout.

[0051] In addition to these, there are other combinations that are unique to the US keyboard layout. Figure 14 shows indicators unique to the US keyboard layout. "There are no Hold keys other than the shift key" and "the combination shown in Figure 14 occurs before and after the 'Released' shift key" are indicators unique to the US keyboard layout. For example, the second combination, "No Hold keys other than the shift key" and the appearance of the keylog sequence "{"Held": [(]}, {"Released": [Key.shift]}, {"Released": [9]}" (enter "(" with "shift" and "9")) is an indicator of the US keyboard layout. The same applies to others.

[0052] 15 is a diagram showing special keys for which the keyboard layout can be determined. The determination unit 131 can determine the keyboard layout from the input of the special characters shown in FIG. 15 by using the first determination unit 1311 and the second determination unit 1312 in combination.

[0053] If the keyboard layout determined by the determination unit 131 is different from the previous keyboard layout, the unauthorized operation detection unit 132 detects that there may have been an unauthorized operation by a person other than the original user. If the first determination unit 1311 or the second determination unit 1312 determines that the keyboard used for input operation has a keyboard layout different from the previous keyboard layout, the unauthorized operation detection unit 132 detects that there may have been an unauthorized operation. Specifically, if there is an indicator of a different keyboard layout by the determination unit 131, the unauthorized operation detection unit 132 detects that there may have been an unauthorized operation.

[0054] [Detection process] Next, the detection process according to the embodiment will be described with reference to the flowchart of FIG.

[0055] As shown in FIG. 16, in the detection device 10, the input / output unit 11 receives input of typing information and the like of the detection target (step S11), and outputs a key log (step S12).

[0056] Then, the first determination unit 1311 performs a first determination process (step S13). In the first determination process, the key log is analyzed, and the keyboard layout of the keyboard on which the input operation is performed is determined based on whether or not a key combination input specific to a predetermined keyboard layout or a character input specific to a predetermined keyboard layout has occurred when a special key is input. Then, when a key combination input specific to a keyboard layout that is different from the previous keyboard layout or a character input specific to a keyboard layout has occurred, the first determination unit 1311 displays an indicator of a different keyboard layout.

[0057] The unauthorized operation detection unit 132 determines whether or not an indicator of a different keyboard layout is present in the first determination process (step S14).

[0058] If an indicator of a different keyboard layout is found in the first determination process (step S14: Yes), the unauthorized operation detection unit 132 detects that there is a possibility that an unauthorized operation has been performed by a person other than the intended user (step S17).

[0059] In the first determination process, if there is no indicator of a different keyboard layout (step S14: No), the process proceeds to second determination process by the second determination unit 1312 (step S15).

[0060] In the second determination process, the key log is analyzed, and the keyboard layout of the keyboard on which the input operation was performed is determined based on whether or not a key combination that can co-occur unique to a predetermined keyboard layout occurs when a special key is input. If the determined keyboard layout is different from the previous keyboard layout, the second determination unit 1312 displays an indicator of the different keyboard layout.

[0061] The unauthorized operation detection unit 132 determines whether or not an indicator of a different keyboard layout is present in the second determination process (step S16).

[0062] If there is an indicator of a different keyboard layout in the second determination process (step S16: Yes), the unauthorized operation detection unit 132 detects that there is a possibility of unauthorized operation by a person other than the intended user (step S17).If there is no indicator of a different keyboard layout in the second determination process (step S16: No), the process returns to step S11 and proceeds with the detection process for the next typing information to be detected.

[0063] [First judgment process] FIG. 17 is a flowchart showing the processing procedure of the first determination processing shown in FIG.

[0064] The first determination unit 1311 analyzes the key log and determines whether or not a key combination input specific to a keyboard layout different from the previous keyboard layout has occurred when a special key is input (step S21).

[0065] If an input of a key combination specific to a keyboard layout different from the previous keyboard layout occurs (step S21: Yes), the first determination unit 1311 determines that the keyboard on which the input operation is performed has a keyboard layout different from the previous keyboard layout, and then displays an indicator of the different keyboard layout (step S23).

[0066] If a key combination input specific to a keyboard layout different from the previous keyboard layout has not occurred (step S21: No), the first determination unit 1311 determines whether a character input specific to a keyboard layout different from the previous keyboard layout has occurred (step S22).

[0067] If a character input specific to a keyboard layout different from the previous keyboard layout occurs (step S22: Yes), the first determination unit 1311 determines that the keyboard on which the input operation is performed has a keyboard layout different from the previous keyboard layout, and then displays an indicator of the different keyboard layout (step S23).

[0068] If a character input specific to a keyboard layout different from the previous keyboard layout has not occurred (step S22: No), the first determination unit 1311 ends the first determination process. In this case, the first determination unit 1311 may display an indicator indicating that the keyboard layout is the same as the previous keyboard layout.

[0069] [Second judgment process] FIG. 18 is a flowchart showing the processing procedure of the second determination processing shown in FIG.

[0070] The second determination unit 1312 determines whether or not there is a combination of keys that can co-occur specific to a predetermined keyboard layout when there is no hold other than the shift key (step S31).

[0071] If there is no Hold key other than the shift key and there is no combination of keys that can co-occur specific to the predetermined keyboard layout (step S31: No), the second determination unit 1312 ends the second determination process.

[0072] When there is no Hold key other than the shift key, and there is a combination of keys that can co-occur specific to a specific keyboard layout (step S31: Yes), the second determination unit 1312 determines the keyboard layout of the keyboard on which the input operation was performed, for example, based on the combination of keys that can co-occur (see FIG. 14) (step S32).

[0073] The second determining unit 1312 determines whether the determined keyboard layout is different from the previous keyboard layout (step S33).

[0074] If the keyboard layout is different from the previous keyboard layout (step S33: Yes), the second determination unit 1312 displays an indicator of the different keyboard layout (step S34).

[0075] If the keyboard layout is the same as the previous keyboard layout (step S33: No), the second determination unit 1312 ends the second determination process. In this case, the second determination unit 1312 may display an indicator indicating that the keyboard layout is the same as the previous keyboard layout.

[0076] [Effects of the embodiment] In this manner, in the embodiment, by analyzing the key log and determining the user's keyboard layout, it is possible to detect, for example, the possibility of unauthorized operations from another country. Therefore, according to the embodiment, by narrowing the detection target to unauthorized operations from keyboards (e.g., from another country) with a keyboard layout different from the keyboard layout of the keyboard that has been used until now, it is possible to improve the accuracy. Furthermore, in the embodiment, since keyboard layout-specific indicators can be defined completely on a rule-based basis without using machine learning, it is possible to stabilize the detection accuracy.

[0077] [Example] An example of the embodiment will be described below. Figure 19 is a diagram for explaining an example of the embodiment.

[0078] For example, an input / output unit 11 (key logger) is installed on a base server 10A for remote work currently in operation, and a key log is stored in a key log storage area 121. The key log stored in the key log storage area 121 is analyzed by a detection device 10 to detect, for example, the possibility of unauthorized operation from another country. Alternatively, the base server 10A may be provided with the functions of a determination unit 131 and an unauthorized operation detection unit 132.

[0079] [System configuration of the embodiment] The detection device 10 is a functional concept and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the detection device 10 is not limited to that shown in the figure, and all or part of it can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0080] Furthermore, all or any part of the processes performed in the detection device 10 may be realized by a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), and a program analyzed and executed by the CPU and the GPU (Graphics Processing Unit). Furthermore, each process performed in the detection device 10 may be realized as hardware using wired logic.

[0081] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters described above and illustrated can be changed as appropriate unless otherwise specified.

[0082] [program] 20 is a diagram showing an example of a computer in which the detection device 10 is realized by executing a program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0083] The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0084] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the detection device 10 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing the same process as the functional configuration of the detection device 10 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0085] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0086] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0087] Although the present invention has been described above as an embodiment, the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention. [Explanation of symbols]

[0088] 10. Detection Device 10A Stepping Stone Server 11 Input / output section 12 Storage section 13 Control Unit 20 keyboards 121 Key Log Storage 131 Judgment section 132 Tamper detection unit 1311 First Judgment Section 1312 Second Judgment Section

Claims

1. an input / output unit that receives input from a keyboard and outputs a key log that is a record of keystrokes on the keyboard; a determination unit that determines the keyboard layout of the keyboard on which the input operation is performed based on the key log; a detection unit that detects, when the keyboard layout determined by the determination unit is different from the previous keyboard layout, that there is a possibility that an unauthorized operation has been performed by a person other than the original user; A detection device comprising:

2. The detection device according to claim 1, wherein the determination unit determines the keyboard layout of the keyboard on which the input operation was performed based on whether or not a key combination specific to a predetermined keyboard layout, a character input specific to a predetermined keyboard layout, or a key combination that can co-occur specific to a predetermined keyboard layout has occurred when inputting a special key.

3. The determination unit a first determination unit that analyzes the key log and determines, when a key combination input specific to a keyboard layout different from the previous keyboard layout occurs at the time of inputting the special key, or when a character input specific to a keyboard layout different from the previous keyboard layout occurs, that the keyboard on which the input operation is performed has a keyboard layout different from the previous keyboard layout. and The detection device according to claim 2, characterized in that the detection unit detects that there is a possibility of fraudulent operation when the first determination unit determines that the keyboard on which the input operation was performed has a keyboard layout different from the previous keyboard layout.

4. The determination unit a second determination unit that analyzes the key log, and if there is a combination of keys that can co-occur specific to a predetermined keyboard layout when the special key is input and there is no hold other than the shift key, determines the keyboard layout of the keyboard on which the input operation was performed based on the combination of keys that can co-occur, and determines whether or not the determined keyboard layout is a keyboard layout different from the previous keyboard layout; and The detection device according to claim 2 or 3, characterized in that the detection unit detects that there is a possibility of fraudulent operation when the second determination unit determines that the keyboard on which the input operation was performed has a keyboard layout different from the previous keyboard layout.

Images