Unauthorized access detection device, data store and unauthorized access detection method
The unauthorized access detection device monitors network communications to prevent file encryption in data stores by blocking unauthorized uploads and deletions, addressing the limitations of existing technologies in managing large data store backups and preventing ransomware attacks.
Patent Information
- Application Number
- JP2023178750
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2023-10-17
- Publication Date
- 2025-04-30
AI Technical Summary
Existing technologies are inadequate in preventing file encryption in data stores, especially when attackers delete files and upload encrypted versions, and they struggle with managing backups of large data stores, which incur high costs.
A control unit in an unauthorized access detection device monitors network communications to identify uploads to a data store, assesses whether the uploaded files are encrypted, and determines if the access is unauthorized, blocking such communications and alerting users.
This solution effectively prevents file encryption in data stores by detecting and blocking unauthorized file uploads and deletions, thereby safeguarding data from ransomware attacks and reducing the need for costly backups.
Smart Images
Figure 2025068761000001_ABST
Abstract
Description
[Technical field]
[0001] The present invention relates to an unauthorized access detection device, a data store, and an unauthorized access detection method. [Background technology]
[0002] In recent years, society has become more and more dependent on computers and the Internet. As a result, attacks on computer networks, including those using malware, have had a more serious impact on society. Furthermore, whereas attacks were previously just a way for attackers to show off their technical capabilities or for fun, attacks aimed at practical gain, such as stealing money or personal information, are on the rise.
[0003] Ransomware is a type of malware whose main purpose is to collect money. This malware encrypts the user's important files, rendering them unusable, and the criminals then demand payment in the form of digital currency in exchange for restoring the files. Damage caused by ransomware has become noticeable since around 2005, and it has recently become such a serious security issue that it is being mentioned as a major security threat.
[0004] Traditional ransomware has targeted local storage. However, with the improvement of cloud storage technology, an increasing number of organizations are storing important files on cloud storage rather than on local storage. In this situation, attacker groups may shift their target of attacks from local storage to cloud storage in order to continue raising funds. In fact, several organizations expect the emergence of ransomware targeting the cloud in the future.
[0005] The most common method of attacking cloud storage is to use conventional ransomware to attack files on local storage that are synchronized with files on cloud storage. For example, there is ransomware that actively searches for file systems synchronized with cloud storage and attempts to encrypt files. However, in order for such ransomware to achieve its purpose, files synchronized with cloud storage must exist on local storage, and it is foreseeable that attacks will become impossible if the storage location of files is shifted from local storage to cloud storage.
[0006] In light of this situation, we can foresee the emergence of ransomware that attacks files that are not synchronized with local storage. Existing antivirus products that monitor local file access and writing cannot protect against such ransomware.
[0007] Patent Document 1 discloses a technology for detecting suspicious file updates on an independent data store. Patent Document 1 describes a method for repeatedly scanning files stored in an independent data store when communication to the data store is detected, and judging whether malicious activity is in progress from the difference in metadata before and after the file update. For this judgment, for example, the entropy of the file and the magic number of the file are treated as meta-information. [Prior art documents] [Patent documents]
[0008] [Patent Document 1] Patent Application No. 2019-507825 Summary of the Invention [Problem to be solved by the invention]
[0009] The technology described in Patent Document 1 is different from the technology that detects file encryption on local storage, and can detect file encryption on a data store that is not synchronized with a data store including cloud storage. However, it can only determine whether malicious activity is in progress after the file is updated. Patent Document 1 provides a method for periodically creating backups of files as a countermeasure, but if the data store is huge, creating backups requires high maintenance and management costs.
[0010] In addition, due to the technical characteristics of comparing the differences in meta-information before and after a file update, it is possible to update files, but it is not possible to deal with attacks such as deleting a file on the data store and then uploading an encrypted file of the deleted file to encrypt the file on the data store.
[0011] Therefore, an object of the present invention is to provide a technique that can prevent encryption of files in a data store. [Means for solving the problem]
[0012] In order to solve the above problems, one representative unauthorized access detection device of the present invention has a control unit that acquires network communication from an application, determines whether the network communication is communication to a data store, and if the network communication is communication to the data store, determines whether the network communication is communication for uploading a file to the data store, and if the network communication is communication for uploading a file to the data store, evaluates whether the file is encrypted, and determines whether the network communication is unauthorized access based on the results of the evaluation. Effect of the Invention
[0013] According to one aspect of the present invention, encryption of files in a data store can be prevented.
[0014] Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]
[0015] [Figure 1] 1 is a diagram illustrating an example of an overall configuration of an unauthorized access detection system according to a first embodiment. [Diagram 2] FIG. 2 is a functional block diagram illustrating an example of a configuration of a local terminal according to the first embodiment. [Diagram 3] FIG. 2 is a block diagram illustrating an example of a hardware configuration of a local terminal according to the first embodiment. [Figure 4] 11 is a diagram illustrating an example of a communication monitoring destination information table used in the unauthorized access detection unit of the first embodiment. FIG. [Diagram 5] 4 is a diagram illustrating an example of a file meta-information table used in the unauthorized access detection unit of the first embodiment; FIG. [Figure 6] 13 is a diagram illustrating an example of a file header table used in the unauthorized access detection unit of the first embodiment. FIG. [Figure 7] 11 is a flowchart illustrating an example of an unauthorized access detection process executed in the local terminal according to the first embodiment. [Figure 8] 13 is a flowchart illustrating an example of a process for determining whether or not a suspicious change has been made to file meta-information. [Figure 9] 13 is a flowchart illustrating an example of a backup process of a deletion target file executed in the local terminal of the first embodiment. [Figure 10] FIG. 11 is a diagram illustrating an example of a warning screen output by an unauthorized access detection unit according to the first embodiment. [Figure 11] FIG. 11 is a diagram illustrating an example of an overall configuration of an unauthorized access detection system according to a second embodiment. [Figure 12] FIG. 13 is a diagram illustrating an example of the overall configuration of an unauthorized access detection system according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
[0016] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In this embodiment, the same components are generally designated by the same reference numerals, and repeated explanations are omitted. Note that this embodiment is merely an example for realizing the present invention, and does not limit the technical scope of the present invention. EXAMPLES
[0017] The first embodiment will be described below with reference to FIGS.
[0018] This embodiment relates to a technology that obtains network communication from an application, determines whether the network communication is communication to a data store, and if the network communication is communication to a data store, determines whether the network communication is communication for uploading a file to the data store, and if the network communication is communication for uploading a file to the data store, evaluates whether the file is encrypted, and determines whether the network communication is unauthorized access based on the results of the evaluation.
[0019] In this embodiment, unauthorized access refers to access that attempts to encrypt a file on the data store by updating or adding a file on the data store through uploading an encrypted file.
[0020] In the following embodiment, information sharing will be described as an example in which the functions are realized by a computer executing software, but the functions may be realized by hardware logic.
[0021] FIG. 1 is a diagram illustrating an example of an overall configuration of an unauthorized access detection system according to a first embodiment.
[0022] 1, the unauthorized access detection system 100 includes a local terminal 101 and a data store 105. The local terminal 101 and the data store 105 are connected to the Internet 103 via networks 102 and 104, respectively.
[0023] The networks 102 and 104 may be, for example, a wired LAN (Local Area Network), a wireless LAN, or a global network. The Internet 103 is a type of global network that relays communication between the local terminal 101 and the data store 105, and any communication method may be used.
[0024] The data store 105 receives a file operation request or a data store setting update request through communication from the local terminal 101, and transmits the result of the file operation or the result of the data store setting update to the local terminal 101. The local terminal 101 includes an unauthorized access detection unit 200 that detects unauthorized access from the local terminal 101 to the data store 105.
[0025] 1, the unauthorized access detection system is configured with the local terminal 101 and the data store 105, but other devices may relay communications, the local terminal 101 may be connected to other data stores, and the data store 105 may be connected to other local terminals. It is sufficient that the unauthorized access detection system has at least one local terminal and at least one data store.
[0026] FIG. 2 is a functional block diagram illustrating an example of the configuration of the local terminal 101 according to the first embodiment.
[0027] The local terminal 101 of the first embodiment includes an application 201 and an unauthorized access detection unit 200. The unauthorized access detection unit 200 includes a network communication acquisition unit 202, a suspicious communication detection unit 203, and an unauthorized access handling unit 204.
[0028] When an application 201 attempts to communicate with the data store 105 over a network, the communication data transmitted from the application 201 is intercepted by a network communication acquisition unit 202. The intercepted communication data is passed to a suspicious communication detection unit 203.
[0029] The suspicious communication detection unit 203 includes a communication discrimination filter 211, a suspicious file upload detection filter 212, a file meta information recording unit 213, and a file backup unit 214, and determines whether communication data transmitted from the application 201 is an encrypted file. Details of each unit included in the suspicious communication detection unit 203 will be described later with reference to FIG. 3.
[0030] The result of the determination by the suspicious communication detection unit 203 is transmitted to the unauthorized access handling unit 204. When the determination result indicates that the communication data transmitted from the application 201 is highly likely to be an encrypted file, the unauthorized access handling unit 204 blocks the transmission of the communication data by the application 201, warns the user of the blocked communication information, and transmits the communication information to the outside. The unauthorized access handling unit 204 may execute all of these three processes, or may execute one or two of the three processes. When the determination result indicates that the communication data transmitted from the application 201 is highly likely to be an encrypted file, the communication data transmitted by the application 201 is transmitted to the data store 105.
[0031] FIG. 3 is a block diagram illustrating an example of a hardware configuration of the local terminal 101 according to the first embodiment.
[0032] The local terminal 101 is realized by a general information processing device such as a PC as shown in FIG. 1, and includes a communication interface (communication IF) 111, a CPU (Central Processing Unit) 112, an input / output interface (input / output IF) 113, a main memory 114, a storage device 115, and a communication path 106 connecting these respective parts.
[0033] The communication IF 111 is connected to a network 102. The network 102 may be, for example, a wired LAN (Local Area Network) or a wireless LAN, or may be a global network such as the Internet.
[0034] The CPU 112 executes a program stored in the storage device 115 and controls each unit of the local terminal 101 .
[0035] The input / output IF 113 is connected to an input / output device 117 for inputting and outputting data from a keyboard, a display, and the like, and mediates the input and output of data.
[0036] The main memory 114 is a semiconductor storage device such as a RAM (Random Access Memory), and temporarily stores programs that are loaded from the storage device 115 and executed by the CPU 112, as well as necessary work data.
[0037] The storage device 115 is, for example, a large-capacity magnetic storage device or semiconductor storage device such as a hard disk drive (HDD) or a solid state drive (SSD), and records programs executed by the CPU 112 and data used by the CPU 112.
[0038] The storage device 115 stores an unauthorized access detection unit 200, a communication monitoring destination information table 205, a file header table 206, a file meta-information table 207, and a file storage unit 208. The unauthorized access detection unit 200 includes programs for a network communication acquisition unit 202, a suspicious communication detection unit 203, and an unauthorized access handling unit 204.
[0039] The network communication acquisition unit 202 is a program that acquires network communications sent from the application 201. The network communications may be acquired by a local proxy, or may be acquired by filtering the communications in kernel mode.
[0040] The suspicious communication detection unit 203 stores a communication discrimination filter 211, a suspicious file upload detection filter 212, a file meta information recording unit 213, and a file backup unit 214. The suspicious communication detection unit 203 is a program that uses the network communication collected by the network communication acquisition unit 202 to evaluate whether communication accessing the data store 105 is unauthorized access by a method described later.
[0041] The unauthorized access handling unit 204 is a program that blocks network communication determined to be unauthorized access by the suspicious communication detection unit 203, notifies the user of information about the blocked communication, and transmits information about the blocked network communication to the outside.
[0042] The communication monitoring destination information table 205 is used when determining network communications to be detected by the suspicious communication detection unit 203. Details of the communication monitoring destination information table 205 will be described later with reference to FIG.
[0043] The file header table 206 is used when evaluating the file headers transmitted in network communications by the suspicious communication detection unit 203. Details of the file header table 206 will be described later with reference to FIG.
[0044] The file meta-information table 207 is used for evaluating file meta-information transmitted in network communications in the suspicious communications detection unit 203 and for recording file meta-information. Details of the file meta-information table 207 will be described later with reference to FIG.
[0045] The file storage unit 208 is a program that stores the file to be deleted as a backup when a request to delete a file on the data store 105 is sent via network communication.
[0046] The communication path 116 is, for example, an information transmission medium such as a bus or a cable.
[0047] The programs and data stored in the storage device 115 may be held in another storage device, for example, a storage device external to the local terminal 101.
[0048] FIG. 4 is a diagram showing an example of the communication monitoring destination information table 205 used in the unauthorized access detection unit 200 of the first embodiment.
[0049] The communication monitoring destination information table 205 stores information used to determine whether the network communication acquired by the network communication acquisition unit 202 is a network communication to be monitored. This information is used by a communication discrimination filter 211 included in the suspicious communication detection unit 203. Details of the process using the communication monitoring destination information table 205 will be described later with reference to FIG.
[0050] An entry in the communication monitoring destination information table 205 has fields for ID 401 , host 402 , API path 403 , HTTP method 404 , and communication type 405 .
[0051] In the ID 401, an identifier for uniquely identifying one piece of data corresponding to each record of the communication monitoring destination information table 205 is stored.
[0052] The host 402 stores host information for determining, using the destination host of the network communication acquired by the network communication acquisition unit 202, whether the acquired network communication is to be monitored.
[0053] The API path 403 stores API path information for determining, using the API path of the network communication acquired by the network communication acquisition unit 202, whether the acquired network communication is to be monitored.
[0054] The HTTP method 404 stores HTTP method information for determining, using the HTTP method of the network communication acquired by the network communication acquisition unit 202, whether the acquired network communication is to be monitored.
[0055] The communication type 405 indicates the effect that a network communication that satisfies all of the host 402, the API path 403, and the HTTP method 404 has on data storage.
[0056] Using Figure 4 as an example, if the field of ID401 has a value of 1, the destination host of the network communication is example1.com, the API path is / FILES, and the HTTP method is POST, the network communication is a communication to upload a file to the data store 105.
[0057] The communication monitoring destination information table 205 shown in FIG. 4 is an example, and may not include some fields, or may include other information for determining whether the network communications acquired by the network communication acquisition unit 202 are to be monitored.
[0058] FIG. 5 is a diagram showing an example of the file meta-information table 207 used in the unauthorized access detection unit 200 of the first embodiment.
[0059] The file meta-information table 207 stores information used to determine whether the network communication acquired by the network communication acquisition unit 202 is an unauthorized access. This information is used by a suspicious file upload detection filter 212 included in the suspicious communication detection unit 203. The file meta-information table 207 is also written in a file meta-information recording unit 213. Details of the process using the file meta-information table 207 will be described later with reference to FIG. 7.
[0060] An entry in the file meta-information table 207 has the following fields: ID 501 , data store ID 502 , entropy 503 , header value 504 , extension 505 , and updater organization 506 .
[0061] In the ID 501, an identifier for uniquely identifying one piece of data corresponding to each record of the file meta-information table 207 is stored.
[0062] When a file uploaded via network communication is managed on the data store 105, an identifier that uniquely identifies the file by the data store 105 is stored in the data store ID 502.
[0063] In the entropy 503, the entropy value of the file identified by the data store ID 502 is stored.
[0064] The header value 504 stores the header value of the file identified by the data store ID 502. The length of the stored header value may be a constant, or only the header value included in a table showing known file header information may be acquired. Also, a field for recording the length of the acquired file header may be provided in the entry of the file meta-information table 207.
[0065] The extension 505 stores the extension of the file identified by the data store ID 502 .
[0066] The updater organization 506 stores organizational information of an updater attempting to update the data store 105, the organizational information being acquired from the data store 105 using the network communication acquired by the network communication acquisition unit 202 or information included in the network communication.
[0067] The file meta-information table 207 shown in FIG. 5 is an example, and some fields may not be included, or other fields for storing file meta-information may be included.
[0068] FIG. 6 is a diagram showing an example of the file header table 206 used in the unauthorized access detection unit 200 of the first embodiment.
[0069] The file header table 206 stores header information of file types that normally produce high values when the randomness of a file is calculated. This information is used by the suspicious file upload detection filter 212 included in the suspicious communication detection unit 203. The process using the file header table 206 will be described in detail later with reference to FIG.
[0070] An entry in the file header table 206 has the following fields: ID 601 , file type 602 , header value 603 , and header length 604 .
[0071] In the ID 601, an identifier for uniquely identifying one piece of data corresponding to each record in the file header table 206 is stored.
[0072] The file type 602 stores the name of the file type.
[0073] The header value 603 stores a header value used to identify the file header.
[0074] In the header length 604, the length of the header value 603 is stored.
[0075] The file header table 206 shown in FIG. 6 is an example, and some fields may not be included, or other fields for storing file header information may be included.
[0076] Next, a process for detecting communication that overwrites a file on the data store 105 with an encrypted file will be described with reference to FIG.
[0077] FIG. 7 is a flowchart illustrating an example of an unauthorized access detection process executed by the local terminal 101 according to the first embodiment.
[0078] First, when a network communication is sent from the application 201, the network communication is acquired by the network communication acquisition unit 202 (S701).
[0079] Next, it is determined whether the destination host of the acquired network communication is equal to any of the entries of host 402 included in communication monitoring destination information table 205 of FIG. 5, thereby determining whether the acquired network communication is communication to a monitored host (S702).
[0080] In S702, if the destination host of the network communication is a value different from any of the entries for host 402 contained in the communication monitoring destination information table 205, it is determined that the acquired network communication is not communication to the monitored host (NO in S702), the network communication is sent to the destination host (S703), and the process ends.
[0081] On the other hand, in S702, if the destination host of the network communication is equal to any of the entries for host 402 included in the communication monitoring destination information table 205, it is determined that the acquired network communication is communication to a monitoring destination host (YES in S702), and the process proceeds to S704.
[0082] In S704, the destination host, API path, and HTTP method of the acquired network communication are used to determine the communication type by comparing them with the host 402, API path 403, and HTTP method 404 contained in the communication monitoring destination information table 205 of FIG. 4, and it is determined whether the acquired network communication is communication related to a file upload.
[0083] If the acquired network communication is not a communication related to a file upload in S704 (No in S704), the network communication is sent to the data store 105 (S705), and the process ends.
[0084] On the other hand, if the acquired network communication is communication related to file uploading in S704 (Yes in S704), the process proceeds to S706, where the process proceeds to a process of determining whether the network communication is unauthorized access. The processes of S702 to S705 are performed by the communication discrimination filter 211 included in the suspicious communication detection unit 203.
[0085] In the processes of S706, S709 to S711, file information transmitted from the acquired network communication is acquired, and the file information is analyzed to determine whether the acquired network communication is unauthorized access. The processes of S706, S709 to S711 are performed by the suspicious file upload detection filter 212 included in the suspicious communication detection unit 203.
[0086] In S706, the degree of randomness is calculated from the entropy of the file, and it is determined whether the calculated value exceeds a specified value. In this evaluation, the characteristic that the degree of randomness is higher when the file is encrypted compared to normal files is used. The evaluation of the file information may be performed using a method other than the method of calculating entropy. For example, the degree of randomness may be evaluated using a method using template matching that determines the probability of the existence of a specific bit pattern, or a method that uses statistics on the probability that the same character is included in a string of a certain length.
[0087] The default value may be a constant value regardless of the file type, or may be determined for each file type. For example, image files and encrypted ZIP files are known to have a high degree of randomness even under normal circumstances, so a high default value may be set for these files. In addition, this default value may be determined using machine learning or the like to learn the degree of randomness under normal circumstances to create a model, and the created model may be used to determine the default value.
[0088] The length of the file data used to calculate the randomness level may be the entire file or a portion of the file. For example, some ransomware that encrypts only the beginning of a file encrypts it, and there is malware that adds a Base64-encoded encryption key to the end of a file. When the randomness level of the entire file encrypted by such ransomware is evaluated, the calculated randomness level may be the same as that of a normal file. Therefore, the randomness level of the beginning portion of the file may be evaluated to determine whether the file is encrypted.
[0089] If it is determined in S706 that the randomness of the file is equal to or less than the specified value (No in S706), the network communication is determined not to be an unauthorized access, and the process proceeds to S707.
[0090] In the process of S707, the file meta-information of the file uploaded to the data store 105 is recorded in the file meta-information table 207 of Fig. 5 by the file meta-information recording unit 213. In the unauthorized access detection unit 200 of the first embodiment, the file meta-information recorded is the data store ID 502, entropy 503, header value 504, extension 505, and updater organization 506. This information is extracted from the network communication information, and is recorded in the file meta-information table 207 by the file meta-information recording unit 213. Thereafter, the file is transmitted to the data store 105 (S708), and the process ends.
[0091] On the other hand, if it is determined in S706 that the randomness of the file exceeds the specified value (Yes in S706), it is determined that the network communication is highly likely to be unauthorized access, and the process proceeds to the next detection process, S709.
[0092] In the process of S709, it is determined whether the header of the file uploaded through network communication is included in the file header table 206 of Fig. 6. The file header table 206 stores file headers of file types with high entropy and high degree of randomness.
[0093] Therefore, if the file header is not included in the file header table 206 in S709 (Yes in S709), even though the randomness of the file was determined to be high in the process of S706, the file header is not that of a file with a known high randomness. Therefore, it is determined that the file uploaded via network communication is likely to be an encrypted file, and the network communication is determined to be unauthorized access (S711), and the process proceeds to S712 and subsequent processes.
[0094] On the other hand, in S709, if the file header is included in the file header table 206 (No in S709), it is found that the high randomness of the file is normal. Therefore, the process proceeds to S710 to perform the next detection process.
[0095] In the process of S710, it is determined whether the network communication is a communication for updating a file in the data store 105, and if it is a communication for updating a file in the data store 105, it is determined whether there is a suspicious change in the file meta information of the file to be uploaded to the data store 105 by comparing it with the file information included in the file meta information table 207 in Fig. 5. Details of the process of S710 will be described later with reference to Fig. 8.
[0096] If it is determined in S710 that there are no suspicious changes in the file meta information of the file to be uploaded to the data store 105 (No in S710), the network communication is determined to be not an unauthorized access, the file meta information of the file to be uploaded to the data store 105 is recorded in the file meta information table 207 by the file meta information recording unit 213 (S707), the file is sent to the data store 105 (S708), and the processing is terminated.
[0097] If it is determined in S710 that there is a suspicious change in the file meta information of the file to be uploaded to the data store 105 (Yes in S710), the network communication is determined to be unauthorized access (S711), and the process proceeds to S712 and subsequent steps. In this embodiment, when the process proceeds to S711, the network communication is determined to be unauthorized access, but a process may be added in which a suspiciousness level calculated by another EDR (Endpoint Detection and Response) product or the like is input, and the input suspiciousness level is used to determine whether the access is unauthorized.
[0098] In S712, since it is determined that the network communication is an unauthorized access, the network communication is blocked.
[0099] Next, a warning is given to the user that the network communication has been determined to be unauthorized access (S713). The warning information may include not only the determination result but also network communication information and the grounds for determining that the access is unauthorized. The warning is given, for example, by displaying a warning screen on the input / output device 117. Details of the warning screen will be described later with reference to FIG. 10.
[0100] Next, the blocked network communication information is sent to the outside (S714), and the process ends. The destination of the network communication information may be a security management department of the organization to which the user belongs, which manages the security of the user's PC, or an external security management organization such as a managed service. The destination of the network communication information may also be an organization that provides the program of the unauthorized access detection unit 200 of the first embodiment.
[0101] The network communication information may be transmitted by sending a message to an email or chat tool, or may be transmitted to an external application via an API.
[0102] The information to be transmitted may include not only the network communication information but also the grounds for determining that the access is unauthorized and the result of the determination.
[0103] The processing of S712 to S714 is performed by the unauthorized access handling unit 204.
[0104] Although the local terminal 101 of this embodiment shows an example in which the three processes of S712 to S714 are executed, the local terminal 101 may execute one or two of the three processes.
[0105] According to the process of Figure 7, encryption of files in the data store 105 can be prevented by detecting communications that overwrite files on the data store 105 with encrypted files, blocking the network communications, warning the user that the network communications have been determined to be unauthorized access, and transmitting information about the blocked network communications to the outside.
[0106] Next, the process of determining whether or not there is any suspicious change in the file meta information of a file to be uploaded to the data store 105 will be described with reference to FIG.
[0107] FIG. 8 is a flowchart showing an example of the process of determining whether or not a suspicious change has been made to the file meta-information in S710 of FIG.
[0108] First, the destination host, API path, and HTTP method of the network communication acquired in S701 of FIG. 7 are compared with the host 402, API path 403, and HTTP method 404 contained in the communication monitoring destination information table 205, respectively, to determine the communication type, thereby determining whether the acquired network communication is a communication for updating a file in the data store 105 (S801).
[0109] If it is determined in S801 that the network communication is not a communication for updating a file in the data store 105 (No in S801), it is not possible to detect it with this detection process, so it is determined that there are no suspicious changes in the file meta information of the file to be uploaded to the data store 105 (S802), and the process is terminated.
[0110] If it is determined in S801 that the network communication is communication for updating a file in the data store 105 (Yes in S801), the file management ID of the file to be updated on the data store 105 is obtained from the network communication information (S803).
[0111] Next, file meta-information having the same file management ID as the file management ID obtained in S803 is obtained from the file meta-information table 207 (S804). The file meta-information table 207 contains file meta-information recorded by the file meta-information recording unit 213 when the network communication for uploading a file to the data store 105 is determined to be normal. Therefore, it is possible to compare the file meta-information having the same file management ID obtained from the file meta-information table 207 with the meta-information of the file transmitted by the network communication.
[0112] Next, the file meta information acquired in S804 is compared with the meta information of the file transmitted via network communication to evaluate whether there is any change in the file header (S805). If the file header at the beginning of the file has been encrypted by file encryption, this can be detected by this evaluation. In addition, since the process of changing the file header is not a normal process, if the file header has changed, it can be determined that the file on the data store 105 has been illegally changed.
[0113] If the file header has changed in S805 (No in S805), it is determined that there has been a suspicious change in the file meta information of the file to be uploaded to the data store 105 (S806), and the determination process ends.
[0114] On the other hand, if it is determined in S805 that there is no change in the file header (Yes in S806), the file meta information acquired in S804 is compared with the meta information of the file transmitted via network communication to determine whether the file extension has been changed (S807).
[0115] If it is determined in S807 that the file extension has been changed (No in S807), since it is abnormal for the extension to be changed even though the file header has not changed, it is determined that there has been a suspicious change in the file meta information of the file to be uploaded to the data store 105 (S806), and the process is terminated.
[0116] On the other hand, if the file extension has not been changed in S807 (Yes in S807), it is evaluated whether the change in the randomness between the file meta information acquired in S804 and the meta information of the file transmitted via network communication is equal to or less than a specified value (S808). Since the randomness of a file does not change significantly if it is the same file type, if there is a significant change exceeding the specified value, it is highly likely that the file has been encrypted. The specified value may be a constant value regardless of the file type, or may be determined for each file type. In addition, machine learning or the like may be used to learn the randomness under normal conditions to create a model, and the created model may be used to determine the specified value.
[0117] If the change in the randomness exceeds the specified value in S808 (No in S808), it is determined that there is a suspicious change in the file meta information of the file to be uploaded to the data store 105 (S806), and the process ends.
[0118] On the other hand, if the change in the randomness level is equal to or less than the specified value in S808 (Yes in S808), it is determined whether there is a change in the organization of the updater based on the file meta information acquired in S804 and the meta information of the file transmitted by network communication (S809). For files that are likely to be modified by a different organization, a flag may be set so that the process of S808 is not performed. Also, the process of S808 may be performed only on specified files.
[0119] In S809, if the updater organization has been changed (No in S809), it is determined that there has been a suspicious change in the file meta information of the file to be uploaded to the data store 105 (S806), and the process ends.
[0120] On the other hand, if there is no change in the updater organization in S809 (Yes in S809), it is determined that there is no suspicious change in the file meta information of the file to be uploaded to the data store 105 (S802), and the process ends.
[0121] The detection process for detecting suspicious changes to file meta information using file meta information when uploading a file to data store 105 shown in Figure 8 is just one example, and only one or more of the evaluations S805 to S809 may be performed, or a combination of evaluations other than the above for detecting suspicious changes to file meta information may be performed.
[0122] There are two methods for encrypting files on the data store 105. The first method is to overwrite files on the data store 105 with encrypted file data. To counter this method, files on the data store 105 can be protected by detecting the upload of an encrypted file and blocking the network communication.
[0123] The second method is to first delete the file on the data store 105 and then upload a new encrypted file. With this method, even if the upload of an encrypted file is detected and network communication is blocked, the file cannot be protected if the file on the data store 105 is deleted first.
[0124] Therefore, in order to handle such cases, the unauthorized access detection unit 200 may include a function for backing up and protecting the file to be deleted when a communication for deleting a file on the data store 105 is detected. The process of detecting a communication for deleting a file on the data store 105 and backing up the file to be deleted will be described with reference to FIG.
[0125] FIG. 9 is a flowchart illustrating an example of a backup process of a deletion target file executed by the local terminal 101 according to the first embodiment.
[0126] First, when a network communication is sent from the application 201, the network communication is acquired by the network communication acquisition unit 202 (S901).
[0127] Next, it is determined whether the destination host of the acquired network communication is equal to any of the entries of host 402 included in communication monitoring destination information table 205 of FIG. 5, thereby determining whether the acquired network communication is communication to a monitored host (S902).
[0128] In S902, if the destination host of the network communication is a value different from any of the entries for host 402 contained in the communication monitoring destination information table 205, it is determined that the acquired network communication is not communication to the monitored host (NO in S902), the network communication is sent to the destination host (S903), and the process ends.
[0129] On the other hand, in S902, if the destination host of the network communication is equal to any of the entries for host 402 included in the communication monitoring destination information table 205, it is determined that the acquired network communication is communication to a monitoring destination host (YES in S902), and the process proceeds to S904.
[0130] In S904, the destination host, API path, and HTTP method of the acquired network communication are used to determine the communication type by comparing the host 402, API path 403, and HTTP method 404 contained in the communication monitoring destination information table 205 of FIG. 4, respectively, and it is determined whether the acquired network communication is communication related to file deletion.
[0131] If it is determined in S904 that the acquired network communication is not communication related to file deletion (No in S904), the unauthorized access detection process in FIG. 7 is executed (S905), and the process ends.
[0132] On the other hand, in S904, if the acquired network communication is communication related to file deletion (Yes in S904), the process proceeds to S906, where the process proceeds to back up the file to be deleted. The processes of S902 to S905 are performed by the communication discrimination filter 211 included in the suspicious communication detection unit 203.
[0133] Next, the file backup unit 214 included in the suspicious communication detection unit 203 acquires information about the file to be deleted from the acquired network communication, and uses the acquired information to request the data store 105 to download the file to be deleted (S906).
[0134] Next, the data store 105 that has received the request transmits the requested file to the local terminal 101, and the file backup unit 214 included in the suspicious communication detection unit 203 downloads the transmitted file to be deleted (S907).
[0135] Next, the file backup unit 214 included in the suspicious communication detection unit 203 saves the downloaded file in the file storage unit 208, thereby backing it up (S908).
[0136] Next, the network communication regarding the file deletion request is sent to the data store 105 (S909), and the process ends. Upon receiving the network communication regarding the file deletion request, the data store 105 executes the deletion of the file.
[0137] According to the process of Figure 9, by detecting communications that delete a file on the data store 105 and backing up the file to be deleted, it is possible to deal with attacks such as deleting a file on the data store once and then uploading an encrypted file of the deleted file to encrypt the file on the data store.
[0138] Next, a warning screen to be displayed to the user when unauthorized access is detected, which is used in S713 of FIG. 7, will be described with reference to FIG.
[0139] FIG. 10 is a diagram showing an example of a warning screen output by the unauthorized access detection unit 200 according to the first embodiment.
[0140] 10, the warning screen 1001 has an analysis result display table 1002. The entries in the analysis result display table 1002 have an occurrence time 1011, a destination host name 1012, an API path 1013, an uploaded file name 1014, entropy 1015, entropy before change 1016, file type 1017, and file type before change 1018.
[0141] The occurrence time 1011 indicates the time when the unauthorized access was detected.
[0142] The destination host name 1012 indicates the destination host name of the network communication sent by the application 201 .
[0143] The API path 1013 indicates the API path of the network communication sent by the application 201 .
[0144] The upload file name 1014 indicates the file name of the file to be uploaded, obtained from the network communication sent by the application 201 .
[0145] The entropy 1015 indicates an entropy value calculated by the suspicious file upload detection filter 212 included in the suspicious communication detection unit 203 .
[0146] The pre-change entropy 1016 indicates the entropy value included in the file meta information acquired in S804 of FIG. 8 by the suspicious file upload detection filter 212 included in the suspicious communication detection unit 203.
[0147] 7 from the file header table 206 in S709 of Fig. 7 in the suspicious file upload detection filter 212 included in the suspicious communication detection unit 203. If the file type 602 cannot be obtained in S709, the file type 1017 indicates an extension that can be obtained from the file name obtained from the network communication.
[0148] The pre-change file type 1018 indicates the file type included in the file meta-information acquired in S804 by the suspicious file upload detection filter 212 included in the suspicious communication detection unit 203.
[0149] The analysis result display table 1002 may include only a portion of the entries shown in FIG. 10, or may include other information related to the analysis results.
[0150] An upload permission button 1003 and an upload block button 1004 are buttons for informing the local terminal 101 of a decision to retry a blocked upload through a user operation. For re-uploading, operations by suspicious applications may be prevented by using multi-factor authentication or the like.
[0151] According to the first embodiment, it is possible to detect communication that overwrites a file on the data store 105 with an encrypted file, block the network communication, warn the user that the network communication has been determined to be unauthorized access, and transmit information about the blocked network communication to the outside, thereby preventing encryption of files in the data store.
[0152] In addition, by detecting communications that delete files on the data store 105 and backing up the files to be deleted, it is possible to respond to attacks such as deleting a file on the data store once and then uploading an encrypted file of the deleted file to encrypt the file on the data store. EXAMPLES
[0153] The second embodiment will be described below with reference to FIG.
[0154] The unauthorized access detection unit 200 in the first embodiment is implemented in the local terminal 101, but in the second embodiment, the unauthorized access detection unit 200 is implemented in a device different from the local terminal 101 as shown in FIG.
[0155] FIG. 11 is a diagram illustrating an example of the overall configuration of an unauthorized access detection system 100 according to the second embodiment.
[0156] 11, the unauthorized access detection system 100 includes a local terminal 101, a data store 105, and an unauthorized access detection device 1104. The local terminal 101, the data store 105, and the unauthorized access detection device 1104 are connected to the Internet 103 via networks 102, 104, and 1103, respectively.
[0157] The networks 102, 104, and 1103 may be, for example, a wired LAN (Local Area Network), a wireless LAN, or a global network. The Internet 103 is a type of global network that relays communication between the local terminal 101 and the data store 105, and the communication method is not important.
[0158] The data store 105 receives a file operation request or a data store setting update request through communication from the local terminal 101, and transmits the result of the file operation or the result of the data store setting update to the local terminal 101. The unauthorized access detection device 1104 includes an unauthorized access detection unit 200 that detects unauthorized access from the local terminal 101 to the data store 105.
[0159] The configuration of the unauthorized access detection unit 200 is the same as that of the first embodiment. The unauthorized access detection unit 200 monitors the communication between the local terminal 101 and the data store 105, and performs the unauthorized access detection process as shown in Fig. 7. If unauthorized access is determined, the network communication is blocked, a warning is given to the user that the network communication has been determined to be unauthorized access, and information about the blocked network communication is transmitted to the outside.
[0160] Furthermore, by performing the backup process as shown in FIG. 9, communication for deleting a file on the data store 105 is detected and the file to be deleted is backed up.
[0161] By adopting the configuration shown in the second embodiment, the user of the unauthorized access detection system 100 does not need to install the unauthorized access detection unit 200 in the local terminal 101 of his / her own organization, and implementation becomes easier. EXAMPLES
[0162] The third embodiment will be described below with reference to FIG.
[0163] The unauthorized access detection unit 200 in the first embodiment is implemented in the local terminal 101, but in the third embodiment, the unauthorized access detection unit 200 is implemented in the data store 105 as shown in FIG.
[0164] FIG. 12 is a diagram illustrating an example of the overall configuration of an unauthorized access detection system 100 according to the third embodiment.
[0165] 12, the unauthorized access detection system 100 includes a local terminal 101 and a data store 105. The local terminal 101 and the data store 105 are connected to the Internet 103 via networks 102 and 104, respectively.
[0166] The networks 102 and 104 may be, for example, a wired LAN (Local Area Network), a wireless LAN, or a global network. The Internet 103 is a type of global network that relays communication between the local terminal 101 and the data store 105, and any communication method may be used.
[0167] The data store 105 receives a file operation request or a data store setting update request through communication from the local terminal 101, and transmits the result of the file operation or the result of the data store setting update to the local terminal 101. The data store 105 includes an unauthorized access detection unit 200 that detects unauthorized access to the data store 105 from the local terminal 101.
[0168] The configuration of the unauthorized access detection unit 200 is the same as that of the first embodiment. The unauthorized access detection unit 200 monitors the communication between the local terminal 101 and the data store 105, and performs the unauthorized access detection process as shown in Fig. 7. If unauthorized access is determined, the network communication is blocked, a warning is given to the user that the network communication has been determined to be unauthorized access, and information about the blocked network communication is transmitted to the outside.
[0169] Furthermore, by performing the backup process as shown in FIG. 9, communication for deleting a file on the data store 105 is detected and the file to be deleted is backed up.
[0170] By adopting the configuration shown in Example 3, the user of the unauthorized access detection system 100 does not need to go through the procedure of installing the unauthorized access detection unit 200 in the local terminal 101, and unauthorized access detection can be performed in all communications with the data store 105. [Explanation of symbols]
[0171] 100...unauthorized access detection system, 101...local terminal, 105...data store, 200...unauthorized access detection unit, 201...application, 202...network communication acquisition unit, 203...suspicious communication detection unit, 204...unauthorized access handling unit, 211...communication discrimination filter, 212...suspicious file upload detection filter, 213...file meta information recording unit, 214...file backup unit
Claims
1. Capture network traffic from your application, determining whether the network communication is a communication to a data store; If the network communication is a communication to the data store, determining whether the network communication is a communication for uploading a file to the data store; If the network communication is a communication for uploading a file to the data store, evaluating whether the file is encrypted; An unauthorized access detection device comprising a control unit that determines whether the network communication is unauthorized access based on a result of the evaluation.
2. 2. The unauthorized access detection device according to claim 1, The control unit is an unauthorized access detection device that cuts off the network communication if the network communication is determined to be unauthorized access;
3. 2. The unauthorized access detection device according to claim 1, The control unit is If the network communication is determined to be an unauthorized access, the unauthorized access detection device notifies the user of the result of the determination.
4. 2. The unauthorized access detection device according to claim 1, The control unit is the unauthorized access detection device, when it is determined that the network communication is unauthorized access, transmitting the result of the determination to an external device;
5. 2. The unauthorized access detection device according to claim 1, Further comprising a file storage unit, The control unit is determining whether the network communication is a communication requesting the deletion of a file in the data store; If the network communication is a communication requesting deletion of a file in the data store, the unauthorized access detection device stores the file to be deleted in the file storage unit.
6. Capture network traffic from your application, determining whether the network communication is a communication for uploading a file; If the network communication is a communication for uploading the file, evaluating whether the file is encrypted; A data store including a control unit that determines whether the network communication is unauthorized access based on a result of the evaluation.
7. 7. The data store of claim 6, The control unit is A data store that blocks the network communication if the network communication is determined to be an unauthorized access.
8. 7. The data store of claim 6, The control unit is If the network communication is determined to be an unauthorized access, the data store notifies the user of the result of the determination.
9. 7. The data store of claim 6, The control unit is If the network communication is determined to be an unauthorized access, the data store transmits the result of the determination to an external device.
10. 7. The data store of claim 6, Further comprising a file storage unit, The control unit is determining whether the network communication is a communication requesting the deletion of a file in the data store; If the network communication is a communication requesting deletion of a file in the data store, the data store stores the file to be deleted in the file storage unit.
11. Capture network traffic from your application, determining whether the network communication is a communication to a data store; If the network communication is a communication to the data store, determining whether the network communication is a communication for uploading a file to the data store; If the network communication is a communication for uploading a file to the data store, evaluating whether the file is encrypted; An unauthorized access detection method that determines whether the network communication is unauthorized access based on a result of the evaluation.
12. The unauthorized access detection method according to claim 11, The unauthorized access detection method includes blocking the network communication if the network communication is determined to be unauthorized access.
13. The unauthorized access detection method according to claim 11, If the network communication is determined to be an unauthorized access, the unauthorized access detection method notifies a user of the result of the determination.
14. The unauthorized access detection method according to claim 11, The unauthorized access detection method further comprises the steps of: transmitting a result of said determination to an external device if said network communication is determined to be unauthorized access.
15. The unauthorized access detection method according to claim 11, determining whether the network communication is a communication requesting the deletion of a file in the data store; If the network communication is a communication requesting deletion of a file in the data store, the file to be deleted is stored in a storage device.
Citation Information
Patent Citations
Low-chlorine-content polyphenylene sulfide, its manufacturing method, resin composition, and molded article
JP2019507825A