Information processing device, system, and program

Abstract

To provide an unauthorized access detection device and an unauthorized access detection method for immediately detecting unauthorized file modifications with less data.SOLUTION: An unauthorized access detection device 10 executes: abnormal access request detection processing for acquiring a plurality of input / output request data for accessing a file, and determining whether or not an access mode to the file is abnormal on the basis of patterns of the plurality of acquired input / output request data; abnormal data detection processing for, if the access mode to the file is determined to be abnormal, identifying data to be written into the file on the basis of the acquired input / output request data, and determining whether or not the identified data is abnormal data by identifying a trend of the identified data; and suspicious process resolution processing for, if the identified data is determined as abnormal data, executing prescribed processing related to the access to the file.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an unauthorized access detection device and an unauthorized access detection method. [Background technology]

[0002] In recent years, society has become more and more dependent on computers and the Internet. As a result, attacks on computer networks, including malware, have had a more serious impact on society. In the past, attacks on such networks were often carried out for the purpose of demonstrating the attacker's technical capabilities or for fun, but in recent years, attacks aimed at practical gains, such as the theft of money or personal information, have been increasing.

[0003] Ransomware is an example of malware whose main purpose is to collect money. Ransomware encrypts the user's important files, rendering them unusable, and then demands payment in the form of digital currency or other money in return for restoring the files. Damage caused by ransomware has become noticeable since around 2005, and it has recently become such a serious security issue that it is being mentioned as a major security threat.

[0004] One method of protecting systems from ransomware is to use endpoint defenses such as antivirus products. Conventionally, the main method of malware detection has been to detect malware using signatures that are unique to the malware. However, this method can only detect malware that has been observed in the past and whose signatures are already known.

[0005] Therefore, there is a technology to detect malware by detecting suspicious behavior of ransomware that differs from normal conditions. For example, Patent Document 1 describes a method of attempting to detect ransomware infection in a file system in two stages using machine backup data. In the first stage, the behavior of the file system obtained by loading backup data and creating file system metadata is analyzed. If an abnormality is determined in the first stage, the content of the file corresponding to the file operation is analyzed in the second stage. Here, for example, the entropy of the file is used as a feature. The system combines the analysis results of the first and second stages to determine an infection score that reflects the probability of ransomware infection in the file system. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] U.S. Patent No. 11120131 Summary of the Invention [Problem to be solved by the invention]

[0007] The technology described in Patent Document 1 is different from signature-based detection systems in that it uses a detection method that uses suspicious behavior of ransomware, and is therefore capable of detecting unknown ransomware. However, because it uses backup data to detect ransomware, it has low real-time capabilities and can only protect files that the ransomware attempts to encrypt after a certain number of files have been encrypted.

[0008] The present invention has been made in view of the above circumstances, and its object is to provide a method for detecting illegal files. To provide an unauthorized access detection device and an unauthorized access detection method capable of quickly detecting alteration with a small amount of data. [Means for solving the problem]

[0009] One of the present inventions for solving the above problems is an unauthorized access detection device that includes a control device that executes an abnormal access request detection process that acquires multiple pieces of input / output request data for accessing a file and determines whether or not an access behavior to the file is abnormal based on a pattern of the multiple acquired input / output request data; an abnormal data detection process that, when it is determined that an access behavior to the file is abnormal, identifies data to be written to the file based on the acquired input / output request data and determines whether or not the identified data is abnormal by identifying a trend of the identified data; and a suspicious process handling process that, when it is determined that the identified data is abnormal, executes a specified process regarding access to the file. Effect of the Invention

[0010] According to the present invention, unauthorized file alteration can be detected quickly with a small amount of data. Configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0011] [Figure 1] 1 is a diagram illustrating an example of a configuration of an unauthorized access detection system according to an embodiment of the present invention. [Diagram 2] FIG. 1 is a diagram for explaining an outline of an unauthorized access detection process. [Diagram 3] FIG. 11 is a flow diagram illustrating details of an unauthorized access detection process. [Figure 4] FIG. 11 is a diagram showing an example of a type of IRP whose tendency is analyzed in the present embodiment. [Diagram 5] 13 is a graph showing a comparison between the change in the number of IRPs during a collection period when the IRPs are normal and when the IRPs are abnormal. [Figure 6] FIG. 13 illustrates an example of a file header table. [Figure 7] FIG. 13 illustrates an example of a warning screen. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In this embodiment, the same components are generally designated by the same reference numerals, and repeated explanations are omitted. Note that this embodiment is merely an example for realizing the present invention, and does not limit the technical scope of the present invention.

[0013] 1 is a diagram showing an example of the configuration of an unauthorized access detection system 1 according to this embodiment. The unauthorized access detection system 1 includes an unauthorized access detection device 10, an input / output device 108 such as a keyboard, a mouse, a touch panel, or a display, and a management device 20. In this embodiment, the unauthorized access detection device 10 is incorporated in a user terminal 30 (described below) used by a user, but may be configured separately from the user terminal.

[0014] The user terminal 30 is an information processing device used by users of an organization, and issues instructions to execute applications, which will be described later.

[0015] The management device 20 is an information processing device used by an administrator who manages the unauthorized access detection device 10. The administrator is an administrator of the security management department of the organization to which the user belongs, or an administrator of an external security management organization such as a managed service.

[0016] The unauthorized access detection device 10 stores one or more applications executed by an OS (Operating System) described later. The unauthorized access detection device 10 executes various applications automatically or based on a user's instruction. The application accesses (reads and writes data) various files stored in a storage device 105, which will be described later.

[0017] Furthermore, the unauthorized access detection device 10 detects unauthorized encryption of data used by an application or the like in the unauthorized access detection device 10 and writing to a file (hereinafter referred to as encrypted writing) caused by ransomware or the like. Specifically, as will be described later, the unauthorized access detection device 10 detects the presence or absence of an abnormality in the access pattern by monitoring an input / output request packet (IRP) for an application to access a file. If it is determined that there is an abnormality, it determines whether the data to be written to the file is abnormal (suspicious) by calculating the degree of randomness of the data to be written, etc. If it is determined that the data to be written to a file is abnormal, the unauthorized access detection device 10 blocks writing to the file and transmits information related to the IRP, etc. to the management device 20.

[0018] The unauthorized access detection device 10 is an information processing device including a communication interface (communication IF) 101, a control unit 102, an input / output interface (input / output IF) 103, a main memory 104, a storage device 105, and a communication path 106 such as a bus or cable connecting each of these components.

[0019] The control unit 102 is a CPU (Central Processing Unit) or the like, and includes a main memory 104 and controls each part of the unauthorized access detection device 10.

[0020] The main memory 104 is a semiconductor storage device such as a random access memory (RAM) or a read only memory (ROM), and temporarily stores various programs and necessary work data.

[0021] The storage device 105 is, for example, a large-capacity magnetic storage device or semiconductor storage device such as a hard disk drive (HDD) or a solid state drive (SSD), and records various programs and necessary data.

[0022] The input / output IF 103 is connected to an input / output device 108 and mediates the input and output of data.

[0023] The communication IF 101 is composed of a NIC (Network Interface Card), a wireless communication module, a USB (Universal Serial Interface) module, a serial communication module, etc. The unauthorized access detection device 10 is connected via a network 107. The network 107 may be the Internet, a LAN (Local Area Network), a WAN (Wide Area Network), Or it may be a wired or wireless communication network such as a dedicated line.

[0024] The management device 20 also includes the same hardware as above.

[0025] Next, the unauthorized access detection device 10 (storage device 105) stores each program of an IRP collection unit 121, a suspicious process detection unit 122, and a suspicious process handling unit 123. In addition, the unauthorized access detection device 10 (storage device 105) stores an AI (artificial intelligence) model. The file server 120 stores a file definition table 124 and a file header table 125.

[0026] Here, the unauthorized access detection device 10 stores an OS (Operating System) for executing each application. The OS includes an I / O manager. The I / O manager receives input / output data, which is a predetermined structure data, when an I / O request (I / O: Input / Output) related to file access is generated from a process that is generated and executed by an application. Generates a request packet (IRP).

[0027] The IRP collection unit 121 is a program that collects input / output request packets (IRPs) generated by the I / O manager. The IRPs are collected in a kernel mode related to the OS.

[0028] The suspicious process detection unit 122 is a program that uses the IRP collected by the IRP collection unit 121 to evaluate whether or not a process that executes a file access is a suspicious process.

[0029] Specifically, the suspicious process detection unit 122 includes an IRP anomaly detection filter 311 and a write data detection filter 312. The IRP anomaly detection filter 311 acquires a plurality of pieces of input / output request data (IRP) for accessing a file, and determines whether the manner of access to the file is abnormal based on the pattern of the acquired plurality of pieces of input / output request data.

[0030] Here, the IRP anomaly detection filter 311 determines whether or not the access mode to the file is abnormal by using the AI ​​model 124. The AI ​​model 124 is a trained model that has learned the characteristics of an I / O request packet related to file access.

[0031] When the write data detection filter 312 determines that the access pattern to the file is abnormal, it identifies the data to be written to the file based on the input / output request data acquired by the suspicious process detection unit 122, and determines whether the identified data is abnormal by identifying the trend of the identified data (written data).

[0032] Here, the write data detection filter 312 judges whether the specified data (write data) is abnormal or not by using the file header table 125. The file header table 125 is a table that stores the types of files that hold data with a high degree of randomness (entropy in this embodiment) in association with the headers of the files of the types.

[0033] Next, the suspicious process handling unit 123 is a program that executes a predetermined process regarding access to a file when it is determined that the data (written data) identified by the written data detection filter 312 is abnormal data.

[0034] For example, when the suspicious process handling unit 123 determines that the data identified by the written data detection filter 312 is abnormal data, the suspicious process handling unit 123 blocks access to a file to which the identified data is written. In addition, the suspicious process handling unit 123 transmits information about an IRP related to the blocked access to the management device 20.

[0035] The control unit 102 executes each program of each information processing device in the unauthorized access detection system 1 described above by reading it from the main memory 104 or the storage device 105. Furthermore, each program can be recorded on, for example, a portable or fixed recording medium and distributed. Note that all or a part of these programs may be realized using virtual information processing resources provided using virtualization technology, process space separation technology, or the like, such as a virtual server provided by a cloud system. Furthermore, all or a part of these programs may be realized by a service provided by a cloud system via an API (Application Programming Interface), for example. Note that the programs or data held by the unauthorized access detection system 1 may be held in a device other than the information processing device illustrated in FIG. 1. Furthermore, in this embodiment, the above-mentioned The functions are realized by a computer executing the software, but may also be realized by hardware logic. Next, the processing performed by the unauthorized access detection system 1 will be described.

[0036] <Outline of unauthorized access detection process> 2 is a diagram for explaining an overview of the unauthorized access detection process performed by the unauthorized access detection system 1. This process is repeatedly performed, for example, when the unauthorized access detection device 10 is started. Here, a case where the unauthorized access is ransomware will be explained, but the same applies to other types of file encryption by suspicious processes.

[0037] First, application 301 creates a process for file access (writing data to a file or reading data from a file) based on an execution instruction of a suspicious application due to, for example, a user's mistaken identity. The created process sends an I / O request for file access to the I / O manager, which converts the I / O request into an IRP and sends the converted IRP to a file system device. The data content included in the IRP is then written to a file.

[0038] The IRP collection unit 121 collects IRPs sent from processes and transmits the collected IRPs to the suspicious process detection unit 122.

[0039] The IRP anomaly detection filter 311 of the suspicious process detection unit 122 judges whether the manner of file access is abnormal or not based on the extracted IRP pattern. Furthermore, the write data detection filter 312 judges whether the data related to this file access is abnormal or not. Through these processes, encrypted writing that the ransomware is attempting to perform (is performing) is detected. The judgment result by the suspicious process detection unit 122 is transmitted to the suspicious process handling unit 123.

[0040] When the suspicious process handling unit 123 receives the judgment result from the suspicious process detection unit 122, it blocks the IRP based on the received judgment result so that the IRP is not sent to the file system device, and transmits information about the IRP to the management device 20. Note that the suspicious process handling unit 123 may execute only one of these processes. This ends the unauthorized access detection process. Next, the unauthorized access detection process will be described in detail.

[0041] FIG. 3 is a flow diagram illustrating the details of the unauthorized access detection process. First, when each application of the unauthorized access detection device 10 is started (S401), the IRP collection unit 121 monitors each application and attempts to acquire IRPs sent from the process of each application for a predetermined collection period (3 seconds in this embodiment) (S402).

[0042] The shorter the collection period, the more real-time ransomware detection is possible. However, if the collection period is too short, the difference in data between the IRPs collected when ransomware or other software is encrypting and writing data and the IRPs collected under normal circumstances will be small, and ransomware may not be detected sufficiently. Therefore, it is preferable to set the collection period long enough to satisfy these conditions.

[0043] Next, the IRP anomaly detection filter 311 determines whether the trend of the IRP collected in S402 (i.e., the manner of access to the file) is abnormal (S403). That is, the IRP anomaly detection filter 311 determines whether the trend of the IRP collected in S402 is abnormal by comparing the trend of the IRP data during the collection period collected in S402 with the trend of the IRP data collected during a normal collection period.

[0044] For example, the IRP anomaly detection filter 311 analyzes the IRP using anomaly detection using unsupervised learning, which is one of the machine learning techniques. Specifically, the IRP anomaly detection filter 311 creates an AI model 124 that has previously learned the number of IRPs of each type during a collection period under normal conditions. The IRP anomaly detection filter 311 calculates the degree of deviation between the number of IRPs of each type collected in S402 and the number of IRPs of each type during a collection period under normal conditions by the AI ​​model 124, and when the calculated degree of deviation exceeds a predetermined threshold, it determines that the trend of the IRPs collected in S402 is abnormal. Note that the analysis method of the IRP trend described here is an example. Other machine learning techniques may be used, or a method other than machine learning (e.g., pattern matching) may be used.

[0045] 4 is a diagram showing an example of the type of IRP that is the target of trend analysis in this embodiment. In addition to writing and reading data, IRPs include commands such as creating, opening, or closing a file, accessing a directory, and flushing a buffer. These IRPs are IRPs in which a deviation in the number of executions compared to normal times is observed when ransomware performs encrypted writing.

[0046] 5 is a graph showing a comparison between the change in the number of IRPs under normal conditions and the change in the number of IRPs under abnormal conditions during the collection period. The horizontal axis indicates time, and the vertical axis indicates the number of IRPs sent in three seconds. As shown in the figure, the number of IRPs under comparison 502 is much larger than the number of IRPs under normal conditions 501, and there is a discrepancy between the two. In such a case, the IRP abnormality detection filter 311 determines that the trend of the IRPs under comparison is abnormal.

[0047] Next, as shown in FIG. 4, if the trend of the IRP collected in S402 is abnormal (S403: Yes), the IRP anomaly detection filter 311 executes processing of S404, and if the trend of the IRP collected in S402 is not abnormal (S403: No), the IRP anomaly detection filter 311 executes processing of S412.

[0048] In S404, the IRP anomaly detection filter 311 identifies and acquires the payload of an IRP (IRP_WRITE) for writing data from among the IRPs collected in S402. This payload contains the contents of the data to be written to a file when IRP_WRITE is sent to a file system device.

[0049] Then, the IRP anomaly detection filter 311 determines whether the data to be written to the file is abnormal based on the acquired payload (S405).

[0050] In this embodiment, the IRP anomaly detection filter 311 calculates the randomness level based on the entropy of data written to a file, and determines whether the calculated randomness level is lower than a predetermined value. This determination method utilizes the characteristic that the randomness level of data encrypted and written by ransomware is higher than the randomness level of data when writing normal data.

[0051] The default value may be a constant value regardless of the file to which the data is written, or may be different for each file to which the data is written. For example, image files and encrypted ZIP files are known to have a high degree of randomness even under normal circumstances, so a high default value may be set for IRP_WRITE for writing data to these files. In addition, this default value may be determined based on the results of a trained model that has been trained on the degree of randomness under normal circumstances and created by machine learning or the like.

[0052] The degree of randomness may be calculated based on a calculation method other than the entropy-based calculation method. For example, the probability of a specific bit pattern occurring during normal data writing may be calculated and the bit pattern of the data written based on the payload may be compared with the probability of the occurrence. The degree of randomness may be evaluated using a statistical method in which the data written to the file is unnatural data if there is a high probability that the same character is included in a character string of a certain length in the data written based on the payload.

[0053] Furthermore, whether the data written to the file is abnormal may be calculated based on other parameters that represent the characteristics of the data created by the encryption process, in addition to parameters other than the randomness. For example, if the payload writes data other than a specific pattern, it may be determined that the data written to the file is abnormal.

[0054] If the data to be written to the file is abnormal (S405: No), the IRP anomaly detection filter 311 executes processing of S406, and if the data to be written to the file is not abnormal (S405: Yes), the IRP anomaly detection filter 311 executes processing of S412.

[0055] In S406, the IRP anomaly detection filter 311 identifies the trend of the data to be written based on the payload, and determines whether there is a significant difference from the trend of the data of the write destination file (data before writing) based on the payload.

[0056] In this embodiment, the IRP anomaly detection filter 311 determines whether the difference between the randomness of data written based on the payload (first randomness) and the randomness of data of the file to which the data is written based on the payload (data of the file before writing) (second randomness) is equal to or greater than a predetermined threshold value. However, the difference in tendency may be determined based on a parameter other than the randomness (for example, a specific data pattern).

[0057] If there is a large difference between the trend of the data after writing and the trend of the data before writing (S406: Yes), the IRP anomaly detection filter 311 executes processing of S410, and if there is no large difference between the trend of the data after writing and the trend of the data before writing (S406: No), it executes processing of S407.

[0058] In S407, the IRP anomaly detection filter 311 determines whether the data write start position based on the payload is the beginning of the file. Specifically, the IRP anomaly detection filter 311 obtains the offset (the data write position based on the beginning of the file) included in the payload obtained in S404, and determines whether the obtained offset is 0.

[0059] If the start position for writing data based on the payload is the beginning of the file (S407: Yes), the IRP anomaly detection filter 311 executes processing of S408, and if the start position for writing data based on the payload is not the beginning of the file (S407: No), the IRP anomaly detection filter 311 executes processing of S409.

[0060] In S408, the IRP anomaly detection filter 311 refers to the file header table 125 and determines whether the array of data written based on the payload includes the array of data of a specified file header (a file header registered in the file header table 125) (whether the data array of a specified length from the beginning of the data to be written matches the file header).

[0061] (File Header Table) 6 is a diagram showing an example of the file header table 125. The file header table 125 stores the type of a known type of file (a file in which the entropy of data written normally is high) that is written from an application via an IRP or the like and that holds data with a generally high degree of randomness, and information on the data in the file that characterizes the type of file.

[0062] In this embodiment, the characterizing data is the header of the file, but other data may be used. In addition, files with a generally high degree of randomness include, for example, image files or video files that have undergone standardized data processing (data compression, etc.).

[0063] The file header table 125 has each data of the ID 201 of each file type, the type 202 of the file (e.g., extension), the data array of the header of the file of that type (header value 203), and the length of the header portion (header length 204). The IRP anomaly detection filter 311 judges whether or not there is a record among the records of the file header table 125 whose contents of the header value 203 are the same as a binary array of a predetermined length from the beginning of the data written based on the payload.

[0064] 3, if the leading portion of the data written based on the payload contains a data sequence of a predetermined file header (S408: Yes), the IRP anomaly detection filter 311 executes the process of S412. On the other hand, if the leading portion of the data written based on the payload does not contain a data sequence of a predetermined file header (S408: No), the IRP anomaly detection filter 311 executes the process of S410. In this case, the writing based on the payload is considered to be the writing of unauthorized data that does not occur under normal circumstances, such as rewriting the file header, or the writing of unauthorized data with a high degree of randomness to a type of file to which data with a low degree of randomness is not written (s405).

[0065] In S409, the IRP anomaly detection filter 311 determines whether or not the beginning of the file into which data is to be written based on the payload includes a predetermined file header (a file header registered in the file header table 125). For example, the IRP anomaly detection filter 311 opens the file into which data is to be written based on the payload. The contents of the file header can be confirmed in the same manner as in the process of S408, for example.

[0066] If the beginning of the file to which data is to be written based on the payload contains a specified file header (S409: Yes), the IRP anomaly detection filter 311 executes processing of S412, and if the beginning of the file to which data is to be written based on the payload does not contain a specified file header (S409: No), the IRP anomaly detection filter 311 executes processing of S410.

[0067] In S410, the suspicious process handling unit 123 determines that the writing of data based on the payload is based on ransomware (suspicious encrypted writing), and blocks access to the file to which the data is written. For example, the suspicious process handling unit 123 blocks IRP (blocks writing by IRP_WRITE).

[0068] Furthermore, the suspicious process handling unit 123 transmits information about the blocked IRP to the management device 20 (S411). This information includes not only the information about the IRP, but also the basis for determining that the encrypted writing is suspicious (information indicating the processing contents of S403 to S409) or the determination The management device 20 displays a warning screen 701, which will be described later, based on the received information.

[0069] The suspicious process handling unit 123 may transmit the information based on e-mail or a predetermined chat tool. The suspicious process handling unit 123 may transmit the information to an external application via a predetermined API included in the unauthorized access detection device 10. Only one of S410 and S411 may be performed.

[0070] In S412, the unauthorized access detection device 10 repeats the processes from S401 onwards.

[0071] (Warning screen) 7 is a diagram showing an example of a warning screen 701. The warning screen 701 may be displayed by the management device 20 or may be displayed by the unauthorized access detection device 10.

[0072] The warning screen 701 has an analysis result table display section 702. The analysis result table display section 702 displays a detection time 711 of the encrypted writing, a name 712 of a process that transmitted an IRP detected as a suspicious encrypted writing, a file path 713 to which data was written by the IRP detected as a suspicious encrypted writing, an entropy value 714 of the written data included in the payload of the IRP detected as a suspicious encrypted writing, an entropy value 715 of the data of the file to which data was written by the IRP detected as a suspicious encrypted writing, and a result 716 of a determination process related to the header.

[0073] The result 716 of the judgment process displays a BOOLEAN value indicating whether the beginning of the write data contained in the payload of the IRP detected as a suspicious encrypted data write or the beginning of the destination file matches any of the header values ​​203 in the file header table 125 (S408, S409).

[0074] The analysis result table display unit 702 may display only a part of the above display contents, or may display contents other than the above display contents.

[0075] As described above, the unauthorized access detection device 10 of this embodiment determines whether the access behavior to the file is abnormal based on the pattern of the acquired IRP, and if it determines that the access behavior to the file is abnormal, it identifies the data to be written to the file based on the acquired IRP (data written by IRP_WRITE), and by identifying the tendency of the identified data, it determines whether the data is abnormal, and if it determines that the identified data is abnormal, it executes a predetermined process related to the access to the file.

[0076] In this way, the unauthorized access detection device 10 judges whether or not an encrypted write has occurred based on the IRP pattern and the data written to the file specified by the IRP. That is, it is possible to judge whether or not an abnormal data write has occurred based only on the IRP directly related to the file access. This makes it possible to quickly detect unauthorized file alterations using a small amount of data. For example, it is possible to detect encryption or writing of random numbers that is not intended by the user, which is performed by ransomware, in real time.

[0077] Furthermore, when the unauthorized access detection device 10 of this embodiment determines that the data written by IRP_WRITE is abnormal, it blocks access to the file to which the data is to be written.

[0078] This helps prevent unauthorized file modification by ransomware, etc.

[0079] In addition, when the unauthorized access detection device 10 of this embodiment determines that the data written by IRP_WRITE is abnormal data, it transmits information to the management device 20 indicating that the access pattern to the file is abnormal or that the write data is abnormal data.

[0080] This allows administrators and others to obtain information characteristic of unauthorized file modifications caused by ransomware, etc.

[0081] In addition, when the unauthorized access detection device 10 of this embodiment determines that the write data via IRP_WRITE is abnormal data, it transmits to the management device 20 information on the basis for determining that the access mode to the file is abnormal or information on the basis for determining that the write data is abnormal data.

[0082] This allows administrators and others to deduce the cause of unauthorized file changes caused by ransomware, etc.

[0083] In addition, the unauthorized access detection device 10 of this embodiment determines whether the access behavior to a file is abnormal based on the IRP pattern and the AI ​​model 124 that has learned the characteristics of the input / output request data for accessing the file.

[0084] This makes it possible to accurately detect abnormal access patterns to files.

[0085] Furthermore, the unauthorized access detection device 10 of this embodiment calculates the degree of randomness of data written by IRP_WRITE, and if the calculated degree of randomness is equal to or greater than a predetermined threshold, determines that the write data is abnormal.

[0086] Data written by unauthorized access such as ransomware is often data with generally irregular content, such as encrypted data. Therefore, by determining that the written data is abnormal data when the degree of randomness is equal to or greater than a threshold, it is possible to accurately detect abnormal access patterns to files.

[0087] In addition, the unauthorized access detection device 10 of this embodiment determines that the written data is abnormal data when the difference between the first randomness level, which is the randomness level of the data written to the file based on the IRP, and the second randomness level, which is the randomness level of the data of the file before it is written based on the IRP, is greater than or equal to a predetermined threshold.

[0088] This makes it possible to accurately detect whether a normal file, whose data generally has a low degree of randomness, has been written through unauthorized access.

[0089] Furthermore, the unauthorized access detection device 10 of this embodiment determines that the data to be written is abnormal data if the randomness of the data written to a file based on an IRP is equal to or greater than a predetermined threshold value, and if the start position of the data to be written on the file is the beginning of the file, and it is determined that the data sequence at the beginning of the data does not include the data sequence of the header in the file header table 125.

[0090] If the IRP writes data from the beginning of a file, but is not a request to write the header of an existing file type, the data being written is likely to be abnormal. Therefore, the above configuration can detect unauthorized file modifications that are typically performed by ransomware, etc.

[0091] In addition, when the randomness of the data written to a file based on an IRP is equal to or greater than a predetermined threshold, the unauthorized access detection device 10 of this embodiment determines that the data to be written is abnormal data if it determines that the data to be written does not include data in the file that characterizes the file holding data with a high randomness.

[0092] Although the IRP was a request to write data with a high degree of randomness, if the write data includes data held by a file of a type that holds data with a high degree of randomness, the data write is highly likely to be a normal data write. Therefore, the above configuration can prevent false positives of unauthorized file alterations made by ransomware or the like.

[0093] In addition, in this embodiment, when the randomness of data written to a file based on an IRP is equal to or greater than a predetermined threshold and the start position of the write in the file to which the data is to be written is the beginning of the file, if it is determined that the data to be written does not include a header in the file that characterizes the file as holding data with a high randomness in the file header table 125, then the unauthorized access detection device 10 determines that the data to be written is abnormal data.

[0094] The header is the data that most characterizes the type of file and its data contents. Therefore, when the data writing start position is the beginning of the file, by using such a header to determine whether the data is abnormal, it is possible to more reliably prevent false positives of unauthorized file modification by ransomware, etc.

[0095] In addition, when the randomness of data written to a file based on an IRP is equal to or greater than a predetermined threshold, the unauthorized access detection device 10 of this embodiment determines that the data to be written is abnormal data if it determines that the file does not contain data within the file that characterizes the file as holding data with a high degree of randomness.

[0096] When the file to which data is written contains data that characterizes the file as having high randomness, even if the randomness of the written data is equal to or greater than a predetermined threshold, the data is likely to be written normally. Therefore, the above configuration can prevent false positives of unauthorized file alterations made by ransomware or the like.

[0097] In addition, in this embodiment, if the randomness of data written to a file based on an IRP is equal to or greater than a predetermined threshold and the start position of the write in the file to which the data is to be written is not the beginning of the file, the unauthorized access detection device 10 determines that the data to be written is abnormal data if it determines that the file does not contain a file header that holds data with a high randomness in the file header table 125.

[0098] The header is the data that most characterizes the type of file and its data contents. Therefore, if the data writing start position is not the beginning of the file, by using the header of the writing destination file to determine whether the data is abnormal, it is possible to more reliably prevent false positives of unauthorized file modifications performed by ransomware, etc.

[0099] The present invention is not limited to the above-described embodiment, and can be implemented using any components without departing from the spirit of the present invention. The above-described embodiment and modified examples are merely examples, and the present invention is not limited to these contents as long as the characteristics of the invention are not impaired. Furthermore, although various embodiments and modified examples have been described above, the present invention is not limited to these contents. Other aspects conceivable within the scope of the technical concept of the present invention are also included in the present invention. Included in the range.

[0100] For example, part of the hardware included in each device of this embodiment may be provided in another device.

[0101] Furthermore, each program of each device may be provided in another device, a program may consist of multiple programs, or multiple programs may be integrated into one program.

[0102] Furthermore, the application may be stored in a device other than the unauthorized access detection device 10.

[0103] In addition, in this embodiment, the unauthorized access detection device 10 identifies the type of file whose data has a high degree of randomness by its header using the file header table 125, but it may also be possible to identify files whose data has a high degree of randomness by a characteristic part other than the file header. [Explanation of symbols]

[0104] 1 Unauthorized access detection system, 10 Unauthorized access detection device, 121 IRP collection unit, 122 Suspicious process detection unit, 123 Suspicious process handling unit

Claims

1. a processor; a storage device storing a program; An information processing device having: Execution of the program causes the processor to: (A) obtaining first input / output request data for accessing a file; (B) identifying first write data to be written to the file based on the acquired first input / output request data; (C) determining that the first write data is abnormal data when all of the conditions related to the first write data are satisfied; (D) when it is determined that the first write data is abnormal data, performing a predetermined process regarding access to the file. Device.

2. the predetermined process includes blocking access to the file to which the first write data is to be written.

10. The apparatus of claim 1.

3. a trained model that has learned the characteristics of input / output request data for accessing a file is stored in a storage device; By executing the program, the processor: determining whether an access pattern to the file is abnormal based on a pattern of the first input / output request data and the trained model; 10. The apparatus of claim 1.

4. By executing the program, the processor performs at least the following process (C): Calculating a first randomness of the first write data; If the first randomness is equal to or greater than a first predetermined threshold, it is determined that a first condition included in the group of conditions is satisfied.

10. The apparatus of claim 1.

5. By executing the program, the processor performs at least the following process (C): Calculating a second randomness of data of the file before the specified first write data is written; When the difference between the first random number degree and the second random number degree is equal to or greater than a second predetermined threshold, it is determined that the second condition included in the group of conditions is satisfied.

5. The apparatus of claim 4.

6. By executing the program, the processor performs at least the following process (C): determining that a third condition included in the group of conditions is satisfied when a predetermined portion of the first write data does not match a known file header in a situation where the write start position of the first write data on the file is the beginning of the file; 5. The apparatus of claim 4.

7. By executing the program, the processor performs at least the following process (C): determining that a fourth condition included in the group of conditions is satisfied when the write start position of the first write data on the file is other than the beginning of the file and the beginning of the file does not match a known file header; 5. The apparatus of claim 4.

8. the known file header is a file header of a predetermined type of file, The predetermined type is a type of file that is written normally and is known to generally contain data with a high degree of randomness.

8. Apparatus according to claim 6 or 7.

9. The determination of the match with the predetermined file header is made by determining whether the known file header matches partial data extracted from the beginning of the comparison data by the length of the known file header, the comparison data is the first write data or the data of the file; 8. Apparatus according to claim 6 or 7.

10. Execution of the program causes the processor to: (E) acquiring second input / output request data for accessing a file different from the file; (F) identifying second write data to be written to the separate file based on the acquired second input / output request data; (G) determining that the second write data is abnormal data when all of the conditions related to the second write data are satisfied; (H) when it is determined that the second write data is abnormal data, executing the predetermined process regarding access to the other file; where: As the process (G), by executing the program, the processor performs at least: Calculating a third randomness of the second write data; If the third randomness is equal to or greater than a third predetermined threshold, it is determined that a fifth condition included in the group of conditions (G) is satisfied; If the write start position of the first write data in the separate file is other than the beginning of the separate file, and the beginning of the separate file does not match a known file header, it is determined that the sixth condition included in the group of conditions (G) is satisfied.

7. The apparatus of claim 6.

11. By executing the program, the processor performs at least the following process (C): determining that a seventh condition included in the group of conditions is satisfied when a predetermined portion of the first write data does not match a known file header in a situation where the write start position of the first write data on the file is the beginning of the file; determining that the seventh condition is satisfied when the write start position of the first write data on the file is other than the beginning of the file and the beginning of the file does not match a known file header; 5. The apparatus of claim 4.

12. the predetermined processing includes displaying warning information including a path to the file and text indicating that the condition group (C) is satisfied; 10. The apparatus of claim 1.

13. 13. A system comprising an apparatus according to any one of claims 1 to 4 or 12.

14. A program that causes an information processing device to perform the following processes: (A) obtaining first input / output request data for accessing a file; (B) identifying first write data to be written to the file based on the acquired first input / output request data; (C) determining that the first write data is abnormal data when all of the conditions related to the first write data are satisfied; (D) When it is determined that the first write data is abnormal data, a predetermined process regarding access to the file is executed.

15. the predetermined process includes blocking access to the file to which the first write data is to be written. The program according to claim 14.

16. a trained model that has learned the characteristics of input / output request data for accessing a file is stored in a storage device; The program includes, before the process (B): determining whether an access pattern to the file is abnormal based on a pattern of the first input / output request data and the trained model; The program according to claim 14 , which causes the information processing device to perform the following:

17. The program includes, as the process (C), at least: Calculating a first randomness of the first write data; If the first randomness is equal to or greater than a first predetermined threshold, it is determined that a first condition included in the group of conditions is satisfied. The program according to claim 14 , which causes the information processing device to perform the following:

18. The program includes, as the process (C), at least: Calculating a second randomness of data of the file before the specified first write data is written; When the difference between the first random number degree and the second random number degree is equal to or greater than a second predetermined threshold, it is determined that the second condition included in the group of conditions is satisfied. The program according to claim 17 , which causes the information processing device to perform the following:

19. The program includes, as the process (C), at least: determining that a third condition included in the group of conditions is satisfied when a predetermined portion of the first write data does not match a known file header in a situation where the write start position of the first write data on the file is the beginning of the file; The program according to claim 17 , which causes the information processing device to perform the following:

20. The program includes, as the process (C), at least: determining that a fourth condition included in the group of conditions is satisfied when the write start position of the first write data on the file is other than the beginning of the file and the beginning of the file does not match a known file header; The program according to claim 17 , which causes the information processing device to perform the following:

21. the known file header is a file header of a predetermined type of file, The predetermined type is a type of file that is written normally and is known to generally contain data with a high degree of randomness.

21. The program according to claim 19 or 20.

22. The determination of the match with the predetermined file header is made by determining whether the known file header matches partial data extracted from the beginning of the comparison data by the length of the known file header, the comparison data is the first write data or the data of the file; 21. The program according to claim 19 or 20.

23. The program: (E) acquiring second input / output request data for accessing a file different from the file; (F) identifying second write data to be written to the separate file based on the acquired second input / output request data; (G) determining that the second write data is abnormal data when all of the conditions related to the second write data are satisfied; (H) when it is determined that the second write data is abnormal data, executing the predetermined process regarding access to the other file; where: As the process (G), the program at least: Calculating a third randomness of the second write data; If the third randomness is equal to or greater than a third predetermined threshold, it is determined that a fifth condition included in the group of conditions (G) is satisfied; If the write start position of the first write data in the separate file is other than the beginning of the separate file, and the beginning of the separate file does not match a known file header, it is determined that the sixth condition included in the group of conditions (G) is satisfied. The program according to claim 19, which causes the information processing device to perform the following:

24. The program includes, as the process (C), at least: determining that a seventh condition included in the group of conditions is satisfied when a predetermined portion of the first write data does not match a known file header in a situation where the write start position of the first write data on the file is the beginning of the file; determining that the seventh condition is satisfied when the write start position of the first write data on the file is other than the beginning of the file and the beginning of the file does not match a known file header; The program according to claim 17 , which causes the information processing device to perform the following:

25. the predetermined processing includes displaying warning information including a path to the file and text indicating that the condition group (C) is satisfied; The program according to claim 14.

Images