Information processing device and control method therefor

Abstract

To solve the problem that effective coping is not connected because only intrusion detection for detection that intrusion is received is considered even though correspondence assuming that an information processing device is intruded is acquired against sophisticated cyber attacks.SOLUTION: According to the present invention, an information processing device includes first detection means for deterministically detecting an abnormal action of an information processing device, second detection means for stochastically detecting the abnormal action of the information processing device, and coping method determination means for determining coping with the abnormal action in the information processing device on the basis of detection results of the first detection means and the second detection means.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an information processing device and a control method thereof for appropriately detecting and dealing with cyber-attacks. [Background technology]

[0002] Currently, a variety of services are provided over the Internet, including services related to social infrastructure and services that handle finance and personal information. While the Internet is the foundation of our information society, cyber attacks targeting these services are occurring frequently and posing a major threat. For this reason, measures against cyber attacks are considered important.

[0003] As a countermeasure against today's sophisticated cyber attacks, in addition to defensive technology that prevents intrusion into devices, countermeasure technology that minimizes damage when an intrusion into a device is assumed is attracting attention. The latter technology is called intrusion detection technology or EDR (Endpoint Detection & Response).

[0004] There are two methods for detecting cyber attacks using EDR: rule-based detection and statistical detection.

[0005] Rule-based detection, also known as signature detection, is a method in which abnormal patterns are registered in advance in a database (DB), and an abnormality is detected based on whether the target event matches the registered pattern.

[0006] Statistical detection, also known as anomaly detection, is a method in which normal patterns are registered in a database in advance, and an abnormality is detected if the target event deviates from the registered pattern.

[0007] The technology in Patent Document 1 has a means for detecting fraudulent communications using rule-based detection and a means for detecting fraudulent communications using statistical detection, and determines the detection means to which communication data is to be allocated based on the load status of both detection means. This allows the means to be dynamically switched depending on the load status, making it possible to detect fraudulent communications using two means without having to duplicate the detection system. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Patent No. 6964829 Summary of the Invention [Problem to be solved by the invention]

[0009] Patent Document 1 describes detecting cyber-attacks using two detection methods. However, it only mentions the detection methods, and specific countermeasures against cyber-attacks must be considered separately, which does not lead to effective countermeasures. The present invention aims to realize appropriate countermeasures by determining post-detection countermeasures based on the detection results from multiple detection methods, as well as which detection method produced the detection results. [Means for solving the problem]

[0010] The present invention is an information processing device characterized by comprising a first detection means for deterministically detecting abnormal behavior of the information processing device, a second detection means for probabilistically detecting abnormal behavior of the information processing device, and a response method determination means for determining how to respond to abnormal behavior in the information processing device based on the detection results of the first detection means and the second detection means. [Effects of the Invention]

[0011] According to the present invention, an information processing device can detect the intrusion of a cyber attack and take appropriate measures. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a block diagram showing a connection configuration between an MFP according to the present invention, an office environment, and an Internet environment. [Figure 2] 1 is a diagram showing the internal configuration of an MFP according to the present invention; [Figure 3] FIG. 2 is a block diagram showing the configuration of software executed in a controller of the MFP according to the present invention. [Figure 4] FIG. 2 is a diagram showing a screen configuration of a menu according to the present invention. [Figure 5] FIG. 2 is a diagram showing a screen configuration relating to settings according to the present invention. [Figure 6] FIG. 10 is a diagram showing a screen configuration for administrator authentication according to the present invention. [Figure 7] FIG. 2 is a diagram showing a screen configuration relating to security settings according to the present invention. [Figure 8] FIG. 1 is a flowchart for carrying out the processing of the first embodiment according to the present invention. [Figure 9] FIG. 2 is a second block diagram showing a connection configuration between the MFP according to the present invention, an office environment, and an Internet environment. [Figure 10] 2 is a block diagram showing the configuration of software executed in a controller of an MFP according to the present invention and the configuration of software executed in a cloud service. FIG. [Figure 11] FIG. 10 is a third block diagram showing a connection configuration between the MFP according to the present invention, an office environment, and an Internet environment. DETAILED DESCRIPTION OF THE INVENTION

[0013] [Embodiment 1] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In this embodiment, an information processing device that detects cyber attacks from the Internet and takes appropriate measures will be described. Here, the embodiment will be described using an MFP (Multi-Function Peripheral) as an example, but the present invention is a technology that can be applied to any information processing device other than an MFP.

[0014] FIG. 1 is a system configuration diagram showing the connection between an office environment 100 and the Internet 110 according to the present invention. A LAN 105 (Local Area Network) is installed in the office environment 100, and a PC 101, a server 102, an MFP 103, and a firewall 104 are connected via the LAN 105. The PC 101 performs office work processing and sends print jobs to the MFP 103. The server 102 controls office work and provides data storage services. The MFP 103 has the function of outputting electronic data to paper media and reading paper media and converting it into electronic data.

[0015] The LAN 105 is connected to the Internet 110 via a firewall 104 , and when the PC 101 , the server 102 , and the MFP 103 access the Internet 110 , they do so via the firewall 104 .

[0016] FIG. 2 shows the configuration of the MFP 103.

[0017] 2A, the MFP 103 has an operation unit 202 that inputs and outputs data to and from the user. The MFP 103 has a printer unit 203 that outputs electronic data to paper media. The MFP 103 has a scanner unit 204 that reads paper media and converts it into electronic data. The operation unit 202, printer unit 203, and scanner unit 204 are connected to a controller unit 201, and function as an MFP under the control of the controller unit 201.

[0018] 2(B) is a block diagram showing the physical configuration of the controller unit 201 of the MFP. A CPU 211 performs the main arithmetic processing within the controller. The CPU 211 is connected to a DRAM 212 via a bus. The DRAM 212 is used by the CPU 211 as a working memory for temporarily storing program data representing arithmetic instructions during the CPU 211's calculation process and data to be processed. The CPU 211 is connected to an I / O controller 213 via a bus. The I / O controller 213 performs input / output to and from various devices according to instructions from the CPU 211.

[0019] A network I / F 214 is connected to the I / O controller 213, and a LAN device 220 is connected to the network I / F 214. The CPU 211 controls the LAN device 220 via the network I / F 214 to realize communication on the LAN 105, and ultimately to realize communication via the Internet 110.

[0020] A SATA (Serial Advanced Technology Attachment) I / F 215 is connected to the I / O controller 213, and a storage device 221 is connected to the SATA I / F 215. The storage device 221 is a hard disk drive (HDD), a solid state drive (SSD), flash memory, etc. The CPU 211 uses the storage device 221 to permanently store programs for realizing the functions of the MFP, various setting data, and document files.

[0021] A panel I / F 216 is connected to the I / O controller 213, and the CPU 211 performs input and output for the user to the operation unit 202 via the panel I / F 216. A printer I / F 217 is connected to the I / O controller 213, and the CPU 211 performs output processing for paper media using the printer unit 203 via the printer I / F 217. A scanner I / F 218 is connected to the I / O controller 213, and the CPU 211 performs reading processing of an original using the scanner unit 204 via the scanner I / F 218. A USB I / F 219 is connected to the I / O controller 213, and controls any device connected to the USB I / F.

[0022] When performing the copy function, the CPU 211 loads program data from the storage device 221 into the DRAM 212 via the SATA I / F 215. The CPU 211 detects a copy instruction from the user via the operation unit 202 via the panel I / F 216 in accordance with the program loaded into the DRAM 212. When the CPU 211 detects a copy instruction, it receives an original as electronic data from the scanner unit 204 via the scanner I / F 218 and stores it in the DRAM 212. The CPU 211 performs color conversion processing suitable for output on the image data stored in the DRAM 212. The CPU 211 transfers the image data stored in the DRAM 212 to the printer unit 203 via the printer I / F 217, and performs output processing onto paper media.

[0023] When PDL (Page Description Language) printing is performed, the PC 101 issues a print instruction via the LAN 105. The CPU 211 loads program data from the storage device 221 into the DRAM 212 via the SATA I / F 215, and detects a print instruction via the network I / F 214 in accordance with the program loaded into the DRAM 212. When the CPU 211 detects a PDL transmission instruction, it receives print data via the network I / F 214 and saves the print data in the storage device 221 via the SATA I / F 215. After saving the print data, the CPU 211 develops the print data saved in the storage device 221 into the DRAM 212 as image data. The CPU 211 performs color conversion processing suitable for output on the image data stored in the DRAM 212. The CPU 211 transfers the image data stored in the DRAM 212 to the printer unit 203 via the printer I / F 217, and performs output processing onto paper media.

[0024] 3 is a block diagram showing the configuration of software executed by the controller unit 201 of the MFP. System software such as the BIOS (Basic Input / Output System) and OS (Operating System) is not included here. All software executed by the controller unit 201 is executed by the CPU 211. The CPU 211 loads controller software 300 stored in the storage device 221 into the DRAM 212 and then executes the software.

[0025] An operation control unit 301 displays a screen image for the user on the operation unit 202, detects user operations, and executes processing associated with screen components such as buttons displayed on the screen.

[0026] In response to a request from another control unit, the data storage unit 302 stores and reads data in the storage device 221. For example, if a user wants to change some device setting, the operation control unit 301 detects the content entered by the user into the operation unit 202, and in response to a request from the operation control unit 301, the data storage unit 302 saves the content as a setting value in the storage device 221.

[0027] A network control unit 303 performs network settings such as IP address settings in a TCP / IP control unit 304 according to the setting values ​​stored in the data storage unit 302 when the system is started or when a setting change is detected.

[0028] The TCP / IP control unit 304 performs transmission and reception processing of network packets via the network I / F 214 in accordance with instructions from other controls.

[0029] The USB control unit 305 controls the USB I / F 219 and controls any device connected via USB.

[0030] A job control unit 306 controls job execution according to instructions from other control units.

[0031] An image processing unit 307 processes image data into a format suitable for each purpose in accordance with instructions from the job control unit 306 .

[0032] The print processing unit 308 follows instructions from the job control unit 306 and prints and outputs an image on a paper medium via the printer I / F 217 .

[0033] The reading control unit 309 reads the placed original document via the scanner I / F 218 in accordance with instructions from the job control unit 306. For example, when executing a copy function, the operation control unit 301 detects a request to start the copy function and instructs the job control unit 306 to copy. The job control unit 306 instructs the reading control unit 309 to read the original document and obtains a scanned image. The job control unit 306 instructs the image processing unit 307 to convert the scanned image into a format suitable for printing. The job control unit 306 instructs the print processing unit 308 to print and outputs the copy results.

[0034] The authentication unit 310 performs processing to determine whether or not the operator is an administrator for operations that require administrator privileges. In secure printing, which prevents printed materials from being taken away by starting printing processing after authenticating the MFP user, the authentication unit 310 performs processing to determine whether or not the operator is a user of the MFP.

[0035] The log collection unit 311 collects various behaviors of the MFP as log data in order to detect cyber-attacks, and records them in the storage device 221. Typical log data include an event log, a system log, a network log, and a security log, and specific examples are shown below.

[0036] The event log includes the following data related to MFP events:

[0037] That is, "MFP startup / shutdown and the time," "user / administrator login / logout times," "program and service startup / shutdown and the time," and "user operations such as printing, scanning, copying (operation content, operation time)." It also includes "operations of system setting values ​​such as passwords and other account information, time, access control lists, networks, and certificates (operation content, operation time)."

[0038] The system log also includes the following data about the MFP system:

[0039] These include "kernel messages and debug information," "disk and file system errors and warnings," "hardware events such as temperature and power supply status," "CPU usage, memory usage, and storage usage," "network traffic and bandwidth," and "application response time."

[0040] The network log also includes the following data related to the MFP's network: "sender / receiver destination address (IP address)," "sender / receiver time," "sender / receiver interval," "sender / receiver data size," and "sender / receiver data payload."

[0041] The security log also includes the following data related to MFP security: "failed login attempts," "account lock / unlock," and "permit / deny access control to administrator functions, files, and directories (boxes)." It also includes "firewall control and denial."

[0042] This log data can be collected using a system log service (eg, syslog) or an audit daemon (eg, Auditd).

[0043] The rule-based detection unit 312 registers abnormal behavior in a database in advance and detects an abnormality based on whether the behavior to be detected matches the registered behavior. To achieve this, the rule-based detection unit 312 has a management unit that manages abnormal behavior and a comparison unit that compares the behavior to be detected with the behavior managed by the management unit. Because rule-based detection involves a comparison with abnormal behavior, it may be possible to definitively detect abnormal behavior. Note that the behavior here is information obtained by analyzing the logs collected by the log collection unit 311.

[0044] An example of detection using logs classified as event logs is the detection of program launches for debugging purposes, etc., that would never be executed in the normal use case of an MFP. Such program launches are registered in the management unit as abnormal behavior, and the program launches are compared by the comparison unit. If the launch of a program registered as a program that would never be executed is detected, it is detected as abnormal behavior.

[0045] Another example of detection using logs classified as event logs is when a system setting value is changed by someone other than the administrator. This type of behavior is registered in the management unit as abnormal behavior, and the change in the system setting value is compared by the comparison unit. If a system setting value is changed when the administrator is not logged in, it is detected as abnormal behavior. System setting values ​​include startup verification and runtime verification, which will be described later in Figure 7, but this example is not limited to specific system setting values.

[0046] Another example of detection using logs classified as event logs is a change in a system setting value that is variable in a general-purpose system but is fixed and does not change in an MFP use case. This type of behavior is registered in the management unit as abnormal behavior, and the change in the system setting value is compared by the comparison unit. If such a system setting value is changed, it is detected as abnormal behavior. System setting values ​​that are fixed and do not change in an MFP use case include environment variables and login scripts, but this does not limit the examples to specific setting values.

[0047] An example of detection using logs classified as network logs is the IP address of a C&C (Command & Control) server, which is the source of malware control and also the destination of data in the event of an information leak. Data transmission and reception to such an IP address is registered in the management unit as abnormal behavior, and the data transmission and reception are compared by the comparison unit. If data transmission and reception to an IP address registered as an unauthorized data recipient is detected, it is detected as abnormal behavior.

[0048] Another example of detection using logs classified as network logs is the transmission of data outside of MFP usage hours. MFP usage hours are sometimes linked to the installation location. For example, an MFP installed in a library will match the library's opening hours, and an MFP installed in a retail store will match the retail store's business hours. It is also possible that an MFP administrator explicitly sets usage hours for an MFP installed in an office. Such data transmission outside usage hours is registered in the management unit as abnormal behavior, and the data transmission is compared by the comparison unit. If data is transmitted at a time registered as outside usage hours, it is detected as abnormal behavior.

[0049] Although examples of rule-based detection have been given above, the examples given above are not all that apply to rule-based detection, and are not limited to these.

[0050] The statistical detection unit 313 registers normal behavior in a database in advance and detects an abnormality based on whether the behavior of the detection target deviates from the registered behavior. To achieve this, the statistical detection unit 313 has a management unit that manages normal behavior and a determination unit that calculates the similarity between the behavior of the detection target and the behavior managed by the management unit and determines whether the similarity exceeds a threshold. Unlike rule-based detection, statistical detection is probabilistic because it detects based on similarity. Note that the behavior here is also information obtained by analyzing the logs collected by the log collection unit 311, just like the rule-based detection unit 312.

[0051] An example of detection using logs classified as event logs is the time of user operations such as printing, scanning, and copying. The operation time of User A, who works during normal business hours, is registered in the management department as normal business hours. If an operation is performed during a time different from the time registered in the management department, it will be detected as probabilistically abnormal behavior.

[0052] Another example of detection using logs classified as event logs is a large amount of printing during an unusual time period. User A's usual operating hours are registered in the management unit, and the operation time is judged by the judgment unit. If User A performs a large amount of printing during a time period different from the time period registered in the management unit, this is detected as probabilistically abnormal behavior.

[0053] An example of detection using logs classified as network logs is the sending of data to a C&C (Command & Control) server, which is the source of malware control and also the destination of data in the event of an information leak. The example of IP addresses was given in the explanation of rule-based detection above. However, IP addresses can change frequently. Therefore, while it is not possible to identify IP addresses, among programs that continue to send data at specific times or at regular intervals, programs with unclear purposes can be detected as probabilistically abnormal behavior.

[0054] While the above shows that probabilistic detection is performed by the management unit and judgment unit, it is also possible to achieve this using machine learning. Normal behavior is input into the machine learning as learning data to generate a learning model of normal behavior. This model can be used to detect the target behavior. The detection described above only describes some of the combinations of logs, such as "time," "time and number of printed pages," and "data transmission interval," but by using machine learning, various combinations of logs can be used as a black box.

[0055] Although examples of statistical detection have been given above, the examples given above are not all that are possible with statistical detection, and are not limited to these.

[0056] The countermeasure determination unit 314 determines a countermeasure based on the detection results of the rule-based detection unit 312 and the statistical detection unit 313, i.e., based on the type of detection result from each detection unit. The rule-based detection unit 312 is capable of deterministic detection, while the statistical detection unit 313 is probabilistic. In the case of deterministic detection, it is possible to determine a countermeasure and implement the countermeasure. On the other hand, in the case of probabilistic detection, there remains the possibility of erroneous detection, so it is possible to determine a countermeasure, but it is difficult to decide whether to actually take action. Therefore, in the case of abnormal behavior determined as deterministic detection by the rule-based detection unit 312, the countermeasure determination unit 314 determines to "determine a countermeasure and implement the determined countermeasure." In all other cases, it determines to "determine a countermeasure and alert the administrator to the abnormal behavior and the determined countermeasure."

[0057] One specific countermeasure is to restart the MFP. Modern MFPs have a startup tamper detection function and an automatic recovery function that detects tampering of system software such as the BIOS and OS, and the controller software 300, when the MFP starts up. If tampering is detected, the MFP has a function to restore the original software in a securely protected area or via the network. Enabling these functions and restarting the MFP is one effective countermeasure. Another countermeasure is to degrade functions, such as blocking the network or disabling only the functions related to the abnormal behavior. Note that abnormal behavior is diverse, and multiple countermeasures can be assumed for a single abnormal behavior. Because it is difficult to specify countermeasures, we will not limit the countermeasures for abnormal behavior.

[0058] The countermeasure implementation unit 315 implements the countermeasure determined by the countermeasure determination unit 314 .

[0059] If the countermeasure decision unit 314 decides to "decide on the countermeasure and implement the decided countermeasure," the decided countermeasure is implemented. An example of this is restarting the MFP. The settings of the startup tamper detection function and the automatic recovery function are checked, and if they are disabled, the settings are changed to enable them and the MFP is restarted. The timing of implementation may be immediately following the detection of abnormal behavior and the decision on the countermeasure. On the other hand, the timing of implementation may also be determined taking into account the operating state of the MFP, such as when printing or scanning.

[0060] If it is decided to "decide how to deal with the problem and alert the administrator of the abnormal behavior and the determined action," the administrator is alerted. The alert to the administrator may be sent via the operation unit 202, or may be sent as alert information to a pre-registered email address.

[0061] FIG. 4 shows a menu screen 401 displayed on the operation unit 202, which allows the user to instruct the execution of various functions of the MFP. Button 402 is used by the user to instruct the copy function. Button 403 is used by the user to instruct the scan and save function. Button 404 is used by the user to instruct the scan and send function. Button 405 is used by the user to instruct changes to the settings of the device. By pressing button 405, a settings screen 501 can be displayed. A display area 406 displays various messages for the user that occur during device operation. For example, warnings from the warning display unit 316 can be displayed in the display area 406.

[0062] FIG. 5 shows a settings screen 501 displayed on the operation unit 202, which allows the user to specify various settings. This screen itself does not have any specific setting items, but is an intermediate layer that serves as a guide to detailed setting items. Pressing button 502 can display a security settings screen 701. Pressing button 503 can display a device settings screen (not shown). Pressing button 504 can display a user settings screen (not shown). Pressing button 505 can start a software update. Display area 506 displays various messages for the user that occur while the device is operating.

[0063] FIG. 6 shows an administrator authentication screen 601 displayed on the operation unit 202, which is used by the user to enter an administrator authentication code. This screen is displayed prior to the execution of a function requiring administrator privileges, and confirms that the operator has administrator privileges. For example, it is displayed before the security setting screen 701 is displayed, or before a software update is started after pressing button 505. Reference numeral 602 denotes an area where the user enters the administrator authentication code, and button 603 is used to start checking the authentication code entered in 602. The authentication code is checked by the authentication unit 310, and if authentication is successful, the process requiring administrator privileges is executed, and if authentication is unsuccessful, the execution of the process requiring administrator privileges is aborted.

[0064] FIG. 7 shows a security settings screen 701 on which security settings for the MFP 103 are configured. For example, if startup verification 702 is selected, a startup verification function that verifies the integrity of the controller software 300 is enabled at system startup. If runtime verification 704 is selected, a runtime verification function that verifies the integrity of the software to be executed is enabled at software execution. Pressing button 704 stores the selection state of the security settings screen 701 as device settings in the data storage unit 302. Because the software verification processes of the startup verification function and runtime verification function require computation time for verification, the device's operating speed decreases compared to when verification is not performed. In other words, there is a trade-off between security and processing performance. Administrators must configure the settings taking into account operation, installation policies, and user satisfaction. Although the MFP 103 is a multi-user device, only operators with administrator privileges can operate this screen. While all users are affected by the settings, only the administrator can configure them.

[0065] Using FIG. 8, a flow in which the controller software 300 of the MFP 103 detects abnormal behavior of the MFP and takes action in the MFP will be described.

[0066] In step S801 , the log collection unit 311 collects the log of the MFP 103 .

[0067] In S802, the rule-based detection unit 312 detects abnormal behavior using the log collected in S801. If abnormal behavior is detected, the process proceeds to S804, and if abnormal behavior is not detected, the process proceeds to S803.

[0068] In S803, the statistical detection unit 313 detects abnormal behavior using the logs collected in S801. If abnormal behavior is detected, the process proceeds to S806, and if abnormal behavior is not detected, log collection is repeated.

[0069] In S804, the countermeasure determination unit 314 determines a countermeasure based on the abnormal behavior, the information of the detection unit that detected it, and the detection result.

[0070] In S805, the countermeasure implementation unit 315 implements the countermeasure determined in S804.

[0071] In S806, the countermeasure determination unit 314 determines a countermeasure based on the abnormal behavior, the information of the detection unit that detected it, and the detection result.

[0072] In S807, the corrective action implementation unit 315 alerts the administrator of the corrective action determined in S806 and information about the abnormal behavior.

[0073] As a result, it is possible to detect abnormal behavior of an information processing device due to a cyber attack and to take appropriate measures against the detected abnormal behavior.

[0074] In the first embodiment, a configuration in which all functions are realized by the MFP 103 alone is shown, but a case in which the statistical detection unit 313 is realized by machine learning is also shown. Because machine learning requires computational resources, it may be difficult to realize it by the MFP 103 alone. To address this issue, a configuration in which the statistical detection unit 313 is offloaded to a cloud service may be considered.

[0075] 9 shows a system configuration diagram for offloading to a cloud service. The MFP 103 can access a cloud service 901 via a LAN 105 in an office environment, a firewall 104, and the Internet 110.

[0076] 10 shows the software configuration when offloading to a cloud service. Unlike the first embodiment, the log receiving unit 1001, statistical detection unit 313, response method determination unit (cloud) 1002, and response method transmission unit 1003 are configured on the cloud service side. The statistical detection unit 313 and response method determination unit (cloud) 1002 are the same as those in the first embodiment. The log receiving unit 1001 receives from the MFP 101 log information required for processing by the statistical detection unit 313 on the cloud service side, and the response method transmission unit 1003 transmits the response method determined by the statistical detection unit 313 on the cloud service side to the MFP 103.

[0077] These configurations make it possible to offload the statistical detection unit 313 to a cloud service, enabling statistical detection to be achieved using machine learning that requires computational resources.

[0078] In addition, offloading the statistical detection unit 313 to a cloud service makes it possible to achieve statistical detection using not only log information from a single MFP 103, but also log information from other MFPs 1103, as shown in Figure 11.

[0079] [Other Examples] (Other embodiments) The present invention can also be realized by executing the following process: software (programs) that realize the functions of the above-described embodiments are supplied to a system or device via a network or various storage media, and the computer (or CPU, MPU, etc.) of the system or device reads and executes the programs.

Claims

1. An information processing device, a first detection means for deterministically detecting abnormal behavior of the information processing device; a second detection means for probabilistically detecting abnormal behavior of the information processing device; a countermeasure decision unit that decides how to deal with abnormal behavior in the information processing device based on the detection results of the first detection unit and the second detection unit; An information processing device comprising:

2. the first detection means definitively detects abnormal behavior of the information processing device based on the start of a program or a change in setting data; 2. The information processing apparatus according to claim 1, wherein the second detection means probabilistically detects abnormal behavior that differs from normal behavior of the information processing apparatus.

3. the first detection means detects abnormal behavior of the information processing device based on rules; 2. The information processing device according to claim 1, wherein the second detection means detects abnormal behavior of the information processing device based on a probabilistic process.

4. 4. The information processing apparatus according to claim 3, wherein the first detection means detects abnormal behavior when a program that is not normally started is started.

5. The information processing device according to claim 1, characterized in that the countermeasure determination means determines a countermeasure to be taken in response to the first detection means and its results, executes the countermeasure in the information processing device, and determines a countermeasure to be taken in response to the second detection means and its results, and issues a warning in the information processing device.

6. The information processing device described in claim 1, characterized in that the countermeasure determination means, as a countermeasure to the first detection means and its results, enables a tampering detection function and an automatic recovery function of the system software and controller software of the information processing device, and restarts the information processing device.

7. 4. The information processing apparatus according to claim 3, wherein the countermeasure determination means cuts off a network of the information processing apparatus as a countermeasure against the detection result of the first detection means.

8. A control method for an information processing device, comprising: a first detection step in which a first detection means definitively detects abnormal behavior of an information processing device; a second detection step in which second detection means probabilistically detects abnormal behavior of the information processing device; a countermeasure determination step in which a countermeasure determination means determines how to deal with abnormal behavior in the information processing device based on detection results in the first detection step and the second detection step; A control method comprising:

9. Computer, An information processing device, a first detection means for deterministically detecting abnormal behavior of the information processing device; a second detection means for probabilistically detecting abnormal behavior of the information processing device; a countermeasure decision unit that decides how to deal with abnormal behavior in the information processing device based on the detection results of the first detection unit and the second detection unit; A computer program for causing a computer to function as an information processing device, comprising:

Images