Determination device

Abstract

To solve the problem that it is difficult to appropriately determine that there is a fear that access is unauthenticated access.SOLUTION: A determination device includes: a determination unit which determines whether or not there is a fear that an access request being a determination object is unauthenticated access in accordance with a reception state of an access request identical or similar to the access request being the determination object; and an output unit which outputs information corresponding to a determination result obtained by the determination unit.SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] The present invention relates to a determination device, a determination method, and a program. [Background technology]

[0002] It is known that an audit process is performed in a database system to determine whether or not unauthorized access has occurred.

[0003] An example of a document that describes audits in database systems is Patent Document 1. Patent Document 1 discloses a system that includes a means for automatically setting an event audit level within the system and acquiring an audit trail with an optimal amount of information according to the event audit level, and a means for specifying the type of audit trail to be acquired according to the event audit level. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2006-048562 Summary of the Invention [Problem to be solved by the invention]

[0005] In the case of the technology described in Patent Document 1, it is necessary to define in advance the audit target events, that is, the events for which an audit trail is to be acquired when they occur. As a result, there has been a problem in that it is sometimes difficult to properly determine unauthorized access, because it becomes difficult to properly define events due to oversight of rules or changes over time.

[0006] Therefore, one object of the present disclosure is to provide a determination device, a determination method, and a program that can solve the above-mentioned problems. [Means for solving the problem]

[0007] In order to achieve this purpose, the determination device in the present disclosure comprises: a determination unit that determines whether or not the access request to be determined is likely to be an unauthorized access, depending on the reception status of access requests that are the same as or similar to the access request to be determined; an output unit that outputs information according to the determination result by the determination unit; have The structure is as follows.

[0008] In addition, the determination method in the present disclosure includes: The information processing device determining whether the access request to be judged is likely to be an unauthorized access based on the reception status of access requests that are identical to or similar to the access request to be judged; Output information according to the judgment result The structure is as follows.

[0009] In addition, the program in this disclosure In the information processing device, determining whether the access request to be judged is likely to be an unauthorized access based on the reception status of access requests that are identical to or similar to the access request to be judged; Output information according to the judgment result It is a program. [Effects of the Invention]

[0010] According to the above-described configurations, unauthorized access can be more appropriately determined. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 illustrates an example of the configuration of a database management system. [Figure 2] FIG. 2 is a block diagram illustrating a configuration example of a database management device. [Figure 3] FIG. 10 is a block diagram showing a more detailed example of a configuration realized in a second inspection unit. [Figure 4] 10A and 10B are diagrams for explaining examples of determination by a determination unit; [Figure 5] 10A and 10B are diagrams for explaining an example of adjustment by a threshold value adjustment unit; [Figure 6] 10 is a flowchart illustrating an example of the operation of the database management device. [Figure 7] 10 is a flowchart illustrating an example of the operation of the database management device when adjusting a threshold value. [Figure 8] FIG. 2 is a diagram illustrating an example of a hardware configuration of a second database management device according to the present disclosure. [Figure 9] FIG. 2 is a block diagram illustrating a configuration example of a database management device. [Figure 10] 10 is a flowchart illustrating an example of the operation of the database management device. DETAILED DESCRIPTION OF THE INVENTION

[0012] [First embodiment] An example configuration of a database management system 100 according to the present disclosure will be described with reference to FIGS. 1 to 7. FIG. 1 is a diagram illustrating an example configuration of the database management system 100. FIG. 2 is a block diagram illustrating an example configuration of the database management device 300. FIG. 3 is a block diagram illustrating a more detailed example configuration realized in the second auditing unit 350. FIG. 4 is a diagram illustrating an example determination made by the determining unit 354. FIG. 5 is a diagram illustrating an example adjustment made by the threshold adjusting unit 356. FIGS. 6 and 7 are diagrams illustrating an example operation of the database management device 300. Note that the drawings in the present disclosure may be associated with one or more embodiments.

[0013] This disclosure describes a database management system 100 that determines whether an access request to be determined is likely to be unauthorized access, depending on the reception status of access requests that are identical or similar to the access request to be determined. As will be described later, the database management system 100 accumulates information corresponding to the received access requests as accumulated information in a vector DB (database) 357 or the like. Then, the database management system 100 determines whether the access request to be determined is likely to be unauthorized access by checking the reception status of access requests that are identical or similar to the access request to be determined based on the accumulated information.

[0014] Specifically, for example, the database management system 100 searches the stored information for targets that are identical or similar to the access request to be judged. Then, based on the search results, the database management system 100 checks the reception status of access requests that are identical or similar to the access request to be judged. As an example, the database management system 100 can check the reception status of access requests that are identical or similar to the access request to be judged by calculating the proportion of the search results that account for the stored information.

[0015] As described above, the database management system 100 determines whether or not the access request to be determined is likely to be unauthorized access, depending on the past reception status of access requests that are identical or similar to the access request to be determined. In other words, the database management system 100 can determine whether or not the received access request is likely to be unauthorized access by distinguishing unauthorized access requests that are mixed in with a large number of legitimate access requests, depending on the past reception status, etc.

[0016] Furthermore, the database management system 100 can adjust the likelihood of determining that an access is likely to be unauthorized, depending on the result of determining whether or not there is a possibility of unauthorized access. For example, the database management system 100 checks the degree of fraud that can be determined depending on the determination result. Then, the database management system 100 adjusts the likelihood of determining that an access is likely to be unauthorized, depending on the confirmed degree of fraud. Note that the degree of fraud may be a value that can be determined, for example, depending on the number of consecutive fraud determinations or the proportion of fraud determinations.

[0017] An example of the configuration of the database management system 100 will be described in more detail below with reference to the drawings.

[0018] Fig. 1 shows an example configuration of a database management system 100 according to the present disclosure. Referring to Fig. 1, the database management system 100 includes a client device 200 and a database management device 300. As shown in Fig. 1, the client device 200 and the database management device 300 can be connected to each other via wired or wireless communication so as to be able to communicate with each other.

[0019] The configuration of the database management system 100 is not limited to the example shown in Fig. 1. For example, the database management system 100 can have multiple client devices 200. The database management system 100 may also have multiple database management devices 300. In addition to the configuration shown above, the database management system 100 may also include a server device for building a database outside the database management device 300.

[0020] The client device 200 is an information processing device that transmits an access request to the database management device 300, requesting access to a database managed by the database management device 300. In the present disclosure, the configuration of the client device 200 is not particularly limited. The client device 200 may be a general device.

[0021] For example, the client device 200 transmits an access request including an SQL (Structured Query Language) statement to the database management device 300. The client device 200 may transmit an access request to the database management device 300 that includes, in addition to the SQL statement, identification information (user information) that is information for identifying the client device 200, date and time information, time information, and other arbitrary information.

[0022] The database management device 300 is an information processing device (determination device) that receives access requests to a database that it manages and performs processing in accordance with the received access requests. The database management device 300 can also determine whether the received access request is likely to be an unauthorized access. The database managed by the database management device 300 may be located inside the database management device 300 or outside the database management device 300.

[0023] Fig. 2 shows an example configuration of a database management device 300. Referring to Fig. 2, the database management device 300 has a communication management unit 310, an analysis unit 320, and a data management unit 370. The analysis unit 320 may also include functions as a grammar check unit 330, a first audit unit 340, a second audit unit 350, and a plan generation unit 360. For example, the database management device 300 has a calculation unit such as a CPU and a storage device. The database management device 300 can realize each of the above processing units by, for example, having the calculation unit execute a program stored in the storage device.

[0024] In addition, instead of the above-mentioned CPU, the arithmetic device may have a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an MPU (Micro Processing Unit), an FPU (Floating point number Processing Unit), a PPU (Physics Processing Unit), a TPU (Tensor Processing Unit), a quantum processor, a microcontroller, or a combination thereof.

[0025] The communication management unit 310 is a receiving unit that receives an access request including an SQL statement from the client device 200 .

[0026] The analysis unit 320 performs predetermined analysis processing on the access request received by the communication management unit 310, such as determining whether or not there is a risk of unauthorized access. As described above, the analysis unit 320 can include the functions of the grammar check unit 330, the first inspection unit 340, the second inspection unit 350, and the plan generation unit 360. Note that the analysis unit 320 may have some of the functions exemplified above, such as not having the function of the first inspection unit 340. Furthermore, the analysis unit 320 may have any function other than those exemplified above.

[0027] The grammar check unit 330 checks the grammar of the SQL statement included in the access request received by the communication management unit 310. The grammar check unit 330 may check the grammar using any method, such as checking the grammar according to predetermined rules.

[0028] The first audit unit 340 determines whether a received access request is likely to be unauthorized access according to predetermined rules. For example, the first audit unit 340 has predetermined rules such as information indicating data access authority and information indicating access-allowed times for each user. The first audit unit 340 then checks whether the received access request satisfies the predetermined rules, thereby determining whether the received access request is unauthorized access.

[0029] It should be noted that, in cases where no rules have been defined in advance, the processing of the first inspection unit 340 may be omitted. Furthermore, the rules used by the first inspection unit 340 when making a determination may be defined arbitrarily.

[0030] The second audit unit 350 searches for an object that is the same as or similar to the access request to be judged from the stored information that has been accumulated in advance, and then, based on the search result, the second audit unit 350 judges whether the access request to be judged is likely to be an unauthorized access.

[0031] 3 shows a more detailed example configuration of the second audit unit 350. Referring to FIG. 3, the second audit unit 350 can include functions as a vectorization unit 351, an accumulation unit 352, a search unit 353, a determination unit 354, a notification unit 355, and a threshold adjustment unit 356. The second audit unit 350 can also use a vector DB 357. The vector DB 357 may be present inside the database management device 300 or may be present outside the database management device 300.

[0032] The vectorization unit 351 vectorizes the SQL statement or the like included in the access request received by the communication management unit 310. In other words, the vectorization unit 351 calculates a vector value that represents the characteristics of the SQL statement or the like, depending on the SQL statement or the like included in the access request. Here, vectorization refers to numerically expressing characteristics such as the length of a sentence or the words used, using a multidimensional vector. The vectorization unit 351 can perform vectorization using any method.

[0033] For example, the vectorization unit 351 can perform vectorization by counting the number of occurrences of each word included in an SQL statement, etc. The vectorization unit 351 may perform vectorization using any model that has been trained in advance, such as by utilizing a method using distributed representation.

[0034] The vectorization unit 351 may vectorize any information included in the access request in addition to the SQL statement. For example, the vectorization unit 351 may vectorize information included in the access request other than the SQL statement, such as user information such as user identification information and date and time information.

[0035] The storage unit 352 stores the vector values ​​calculated by the vectorization unit 351 in the vector DB 357. By storing the vector values, the storage unit 352 can store a plurality of vector values ​​as stored information in the vector DB 357. In other words, the storage unit 352 can store, as stored information, vector values ​​corresponding to access requests received by the communication management unit 310 functioning as a receiving unit.

[0036] The search unit 353 searches for targets that are the same as or similar to the access request to be judged from the information stored in the vector DB 357. For example, the search unit 353 can perform the above search using vector values ​​that vectorize the access request to be judged. The search unit 353 can treat each access request received by the communication management unit 310 as the access request to be judged. However, the search unit 353 may treat only some of the access requests received by the communication management unit 310 as the access requests to be judged. For example, the search unit 353 may be configured to treat access requests received by the communication management unit 310 that have not been judged to be unauthorized access by the first inspection unit 340 as the access requests to be judged.

[0037] Specifically, for example, the database management system 100 can perform the above-described search by performing a proximity search on the vector DB 357 using the result of vectorization by the vectorization unit 351 of an SQL statement, etc., included in the access request to be determined. Here, proximity search refers to specifying a vector value to be searched as a search key and searching for a group of vector values ​​close to the specified search key. For example, the search unit 353 specifies, as the search key, a vector value calculated by the vectorization unit 351 vectorizing the SQL statement, etc., included in the access request to be determined. Then, using the specified search key, the search unit 353 searches for a group of vector values ​​including a vector value identical to or similar to the vector value specified as the search key from among the vector values ​​stored as accumulated information in the vector DB 357. As an example, the search unit 353 can search for a group of vector values ​​whose similarity with the vector value specified as the search key is equal to or greater than a predetermined similarity threshold from among multiple vector values ​​stored as accumulated information in the vector DB 357. Note that the group of vector values ​​may include one or more vector values.

[0038] The aforementioned similarity refers to a value indicating how similar the vector values ​​to be compared are. For example, the similarity may be cosine similarity, which is the cosine value of the angle between two vector values. However, the similarity may be any value that can be calculated by performing a predetermined process on the cosine value, or any value other than cosine similarity.

[0039] Furthermore, the search unit 353 can search for a group of vector values ​​identical or similar to a vector value specified as a search key from among all vector values ​​stored as accumulated information in the vector DB 357. The search unit 353 may search for a group of vector values ​​identical or similar to a vector value specified as a search key from among vector values ​​stored as accumulated information in the vector DB 357 that satisfy a predetermined condition. For example, the search unit 353 may search for a group of vector values ​​identical or similar to a vector value from among vector values ​​stored as accumulated information in the vector DB 357 that satisfy a predetermined condition, such as the elapsed time since storage in the vector DB 357 being within one week. In other words, the search unit 353 may search for a group of vector values ​​identical or similar to a vector value from among some of the vector values ​​stored as accumulated information in the vector DB 357.

[0040] The determination unit 354 determines whether the access request to be determined is likely to be an unauthorized access, based on the reception status of access requests that are the same as or similar to the access request to be determined. For example, the determination unit 354 checks the reception status of access requests that are the same as or similar to the access request to be determined, based on the search result by the search unit 353. Then, the determination unit 354 determines whether the access request to be determined is likely to be an unauthorized access, based on the result of the check.

[0041] For example, the determination unit 354 checks the reception status of access requests that are identical to or similar to the access request to be determined by calculating the proportion of the search results of the search unit 353 that account for the accumulated information based on the search results of the search unit 353. In other words, as shown in FIG. 4, the determination unit 354 checks the reception status of the access request by calculating the proportion of the vector values ​​found by the proximity search to the vector values ​​stored as accumulated information in the vector DB 357. Then, the determination unit 354 determines whether the access request to be determined is likely to be unauthorized access based on whether the calculated proportion satisfies a predetermined condition. As an example, the determination unit 354 can determine whether the access request to be determined is likely to be unauthorized access based on whether the calculated proportion is below a predetermined determination threshold. For example, if the calculated proportion is below the predetermined determination threshold, the determination unit 354 determines that the access request to be determined is likely to be unauthorized access. On the other hand, if the calculated ratio is equal to or greater than the predetermined determination threshold, the determination unit 354 determines that the access request to be determined is unlikely to be an unauthorized access.

[0042] As described above, there are cases where the search unit 353 searches for vector values ​​that satisfy a predetermined condition among the vector values ​​stored as accumulated information in the vector DB 357. In this case, the determination unit 354 may calculate the proportion of the vector values ​​found by the neighborhood search to the vector values ​​that satisfy the above condition among the vector values ​​stored in the vector DB 357. In this way, the determination unit 354 may determine the value used to calculate the proportion depending on the conditions when the search unit 353 performs the search, etc.

[0043] The notification unit 355 issues a notification according to the determination result by the determination unit 354. In other words, the notification unit 355 functions as an output unit that outputs information according to the determination result by the determination unit 354.

[0044] For example, the notification unit 355 can notify the user that it has determined that the access request being judged is likely to be an unauthorized access, in response to the determination that the access request being judged is likely to be an unauthorized access. At this time, the notification unit 355 may notify the user that it has determined that the access request being judged is likely to be an unauthorized access, as well as information corresponding to the access request being judged, such as an SQL statement or other arbitrary information.

[0045] In addition to the above-described example, the notification unit 355 may issue a notification indicating that the risk of unauthorized access has been determined to be low in response to a determination that the risk of unauthorized access is low. The notification unit 355 may also notify information other than that exemplified above, such as outputting information according to the determination result within a predetermined interval at a predetermined interval. For example, as described above, the notification unit 355 can output information based on the determination result, such as the notification described above, in response to the determination by the determination unit 354. The notification unit 355 may be configured to issue the notification described above to a predetermined notification destination, for example. The notification unit 355 may display the notification on a screen display device connected to the database management device 300, or may transmit the notification to another external device connected to the database management device 300.

[0046] The threshold adjustment unit 356 is an adjustment unit that adjusts the likelihood of determining that an access is likely to be unauthorized, depending on the determination result by the determination unit 354. For example, as shown in Fig. 5, the threshold adjustment unit 356 adjusts the likelihood of determining that an access is likely to be unauthorized, depending on the degree of unauthorized determination that can be determined depending on the determination result by the determination unit 354. Note that the degree of unauthorized determination may be a value that can be determined, for example, depending on the number of consecutive determinations that indicate that an access is likely to be unauthorized (unauthorized determinations) or the proportion of unauthorized determinations out of all determinations.

[0047] For example, the threshold adjustment unit 356 adjusts the likelihood of determining that an access is likely to be fraudulent, depending on whether the degree of fraudulent determination satisfies a predetermined condition. For example, if a predetermined number of consecutive determinations of fraudulent access have occurred, the possibility of a false positive is considered. Therefore, if a predetermined number of consecutive determinations of fraudulent access have occurred, the threshold adjustment unit 356 determines that the degree of fraudulent determination satisfies the predetermined condition and performs adjustments to reduce the possibility of a false positive. For example, the threshold adjustment unit 356 performs at least one of increasing the similarity threshold and decreasing the determination threshold, depending on the above-described conditions. It should be noted that which of the above adjustments the threshold adjustment unit 356 performs, or whether to perform both, may be determined arbitrarily. Furthermore, the method of adjustment, such as the degree of threshold adjustment, may also be set arbitrarily depending on the conditions.

[0048] For example, as described above, the threshold adjustment unit 356 adjusts the likelihood of determining that an access is likely to be unauthorized by adjusting the values ​​of the similarity threshold, the determination threshold, etc., depending on whether the degree of determination of unauthorized access satisfies a predetermined condition. Note that the threshold adjustment unit 356 may adjust the likelihood of determining that an access is likely to be unauthorized depending on conditions other than those exemplified above. For example, the threshold adjustment unit 356 may be configured to adjust the likelihood of determining that an access is likely to be unauthorized depending on the proportion of determinations that indicate that an access is likely to be unauthorized across all determinations.

[0049] The vector DB 357 stores the vector values ​​calculated by the vectorization unit 351. As described above, the vector DB 357 may exist inside the database management device 300 or outside the database management device 300.

[0050] The vector DB 357 may be configured to delete vector values ​​in accordance with a predetermined condition, such as deleting vector values ​​that have been stored in the vector DB 357 for more than one week. The vector DB 357 may be configured to delete vector values ​​in accordance with an external instruction.

[0051] For example, the second inspection unit 350 may have the configuration described above.

[0052] The plan generating unit 360 plans the order in which to perform read / write operations on a database using an SQL statement included in an access request. The function of the plan generating unit 360 may be a general one.

[0053] The plan generation unit 360 can plan the order in which to perform processes such as reading and writing using access requests that have been determined by the first audit unit 340 and the second audit unit 350 to have a low risk of unauthorized access. The plan generation unit 360 can also plan the order in which to perform processes such as reading and writing using access requests received by the communication management unit 310, regardless of the results of the determination by the first audit unit 340 and the second audit unit 350.

[0054] For example, the analysis unit 320 may have the configuration described above.

[0055] The data management unit 370 performs processes such as reading and writing data from and to the database managed by the database management device 300, depending on the results of the plan created by the plan generation unit 360. The data management unit 370 may have a general configuration.

[0056] The above is an example of the configuration of the database management device 300. Next, an example of the operation of the database management device 300 will be described with reference to FIGS.

[0057] 6 is a flowchart showing an example of the operation of the database management device 300 when the second audit unit 350 determines whether an access request is likely to be unauthorized access. Referring to Fig. 6, the vectorization unit 351 vectorizes an SQL statement or the like included in the access request to be determined (step S101). The vectorization unit 351 may vectorize not only the SQL statement but also information other than the SQL statement included in the access request, such as user information such as user identification information and date and time information.

[0058] The search unit 353 searches for an object that is the same as or similar to the vector value vectorized by the vectorization unit 351 from the information stored in the vector DB 357 (step S102). For example, the database management system 100 can perform the above search by performing a proximity search on the vector DB 357 using the result of vectorization by the vectorization unit 351 of an SQL statement or the like included in the access request to be judged.

[0059] The determination unit 354 determines whether the access request to be determined is likely to be unauthorized access based on the search result by the search unit 353 (step S103). For example, if a predetermined condition is satisfied, such as the proportion of the vector values ​​found by the search to the vector values ​​stored in the vector DB 357 being lower than a determination threshold (step S103, YES), the determination unit 354 determines that the access request to be determined is likely to be unauthorized access (step S104). Furthermore, the notification unit 355 issues a notification based on the determination result by the determination unit 354 (step S105). On the other hand, if the above condition is not satisfied (step S103, NO), the determination unit 354 determines that the access request to be determined is unlikely to be unauthorized access (step S106).

[0060] The above is an example of the operation of the database management device 300 when determining whether or not an access request is likely to be unauthorized access. Note that the process of storing the vector values ​​vectorized by the vectorization unit 351 as accumulated information in the vector DB 357 may be performed, for example, each time the vectorization unit 351 vectorizes information corresponding to an access request. Next, with reference to FIG. 7 , an example of the operation of the database management device 300 when adjusting the processing content according to the determination result by the determination unit 354 will be described.

[0061] 7 is a flowchart showing an example of the operation of the database management device 300 when adjusting the processing content according to the determination result by the determination unit 354. Referring to Fig. 7, the threshold adjustment unit 356 checks whether the degree of determination of unauthorized access that can be determined according to the determination result by the determination unit 354 satisfies a predetermined condition (step S201).

[0062] If the degree of unauthorized access determination satisfies the condition, such as a predetermined number of consecutive determinations indicating a possible unauthorized access (YES in step S201), the threshold adjustment unit 356 adjusts at least one of the similarity threshold and the determination threshold (step S202). On the other hand, if the degree of unauthorized access determination does not satisfy the condition (NO in step S201), the threshold adjustment unit 356 does not perform adjustment.

[0063] The above is an example of the operation of the database management device 300 when adjusting the processing content. The threshold value adjusting unit 356 may perform the operation illustrated in FIG.

[0064] As described above, the database management device 300 includes the search unit 353 and the determination unit 354. With this configuration, the determination unit 354 can determine whether the access request to be determined is likely to be unauthorized access by checking the reception status of access requests that are the same as or similar to the access request to be determined based on the search results by the search unit 353. This allows the database management device 300 to make a determination based on accumulated information without having to set rules or the like in advance. As a result, the database management device 300 can make a more appropriate determination.

[0065] Furthermore, the database management device 300 has a threshold adjustment unit 356. With this configuration, the threshold adjustment unit 356 can adjust the likelihood of determining that an access is likely to be unauthorized, depending on the degree of unauthorized determination that can be determined based on the determination result by the determination unit 354. As a result, it is possible to reduce the possibility of false positives and perform more appropriate determinations.

[0066] [Second embodiment] Next, a determination device 400, which is a modified example of the database management device 300, will be described with reference to Fig. 8 to Fig. 10. Fig. 8 is a diagram showing an example of the hardware configuration of the determination device 400. Fig. 9 is a block diagram showing an example of the configuration of the determination device 400. Fig. 10 is a flowchart showing an example of the operation of the determination device 400.

[0067] The determination device 400 is an information processing device that determines whether an access request to be determined is likely to be an unauthorized access, depending on the reception status of access requests that are the same as or similar to the access request to be determined. Fig. 8 shows an example of the hardware configuration of the determination device 400. Referring to Fig. 8, the determination device 400 has, as an example, the following hardware configuration. ·CPU(Central Processing Unit)401(Arithmetic unit) ROM (Read Only Memory) 402 (storage device) RAM (Random Access Memory) 403 (storage device) Programs 404 loaded into RAM 403 A storage device 405 for storing the program group 404 A drive device 406 that reads and writes data from a recording medium 410 outside the information processing device A communication interface 407 for connecting to a communication network 411 outside the information processing device Input / output interface 408 for inputting and outputting data Bus 409 connecting each component

[0068] 9 by the CPU 401 acquiring the program group 404 and executing it. The program group 404 is stored in advance in the storage device 405 or the ROM 402, for example, and is loaded into the RAM 403 or the like by the CPU 401 for execution as needed. The program group 404 may be supplied to the CPU 401 via the communication network 411, or may be stored in advance in the recording medium 410, and the drive device 406 may read out the programs and supply them to the CPU 401.

[0069] 8 shows an example of the hardware configuration of the determination device 400. The hardware configuration of the determination device 400 is not limited to the above-described case. For example, the determination device 400 may be configured with only a part of the above-described configuration, such as not including the drive device 406. Furthermore, the CPU 401 may be a GPU or the like exemplified in the first embodiment.

[0070] The determination unit 421 determines whether the access request to be determined is likely to be an unauthorized access, depending on the reception status of access requests that are the same as or similar to the access request to be determined.

[0071] For example, the determination unit 421 has accumulated information that stores information corresponding to access requests, and the determination unit 421 can check the reception status of access requests that are the same as or similar to the access request to be determined by referring to the accumulated information.

[0072] The output unit 422 outputs information according to the determination result by the determination unit 421. For example, in response to a determination that there is a possibility of unauthorized access, the output unit 422 may output a notification that there is a possibility of unauthorized access.

[0073] The above is an example of the configuration of the determination device 400. Next, an example of the operation of the determination device 400 will be described with reference to FIG.

[0074] Fig. 10 is a flowchart showing an example of the operation of the determination device 400. Referring to Fig. 10, the determination unit 421 determines whether the access request to be determined is likely to be an unauthorized access, depending on the reception status of access requests that are the same as or similar to the access request to be determined (step S301).

[0075] The output unit 422 outputs information according to the determination result by the determination unit 421 (step S302).

[0076] The above is an example of the operation of the determination device 400.

[0077] As described above, the determination device 400 includes the determination unit 421 and the output unit 422. With this configuration, the determination unit 421 can determine whether the access request to be determined is likely to be an unauthorized access, depending on the reception status of access requests that are identical to or similar to the access request to be determined. This allows the determination device 400 to make a determination based on the reception status, even without setting rules or the like in advance. As a result, the determination device 400 can make a more appropriate determination.

[0078] The above-described determination device 400 can be realized by incorporating a predetermined program into an information processing device such as the determination device 400. Specifically, a program according to another aspect of the present disclosure is a program that causes an information processing device such as the determination device 400 to determine whether an access request to be determined is likely to be unauthorized access, depending on the reception status of access requests that are identical to or similar to the access request to be determined, and output information according to the determination result.

[0079] In addition, the determination method executed by an information processing device such as the above-mentioned determination device 400 is a method in which the information processing device such as the determination device 400 determines whether the access request to be determined is likely to be an unauthorized access depending on the reception status of access requests that are identical to or similar to the access request to be determined, and outputs information according to the determination result.

[0080] A program having the above-described configuration, a computer-readable recording medium having the program recorded thereon, or a determination method, etc., can achieve the same functions and effects as the above-described determination device 400, and therefore can achieve the above-described object of the present disclosure.

[0081] <Additional Notes> A part or all of the above-described embodiments can be described as follows: The following provides an overview of the determination device and other components of the present disclosure. However, the present disclosure is not limited to the following configuration.

[0082] (Appendix 1) a determination unit that determines whether or not the access request to be determined is likely to be an unauthorized access, depending on the reception status of access requests that are the same as or similar to the access request to be determined; an output unit that outputs information according to the determination result by the determination unit; have Judgment device. (Appendix 2) The determination unit checks the reception status of access requests that are the same as or similar to the access request to be determined based on accumulated information that has accumulated information corresponding to the access requests, and determines whether the access request to be determined is likely to be an unauthorized access based on the confirmation result. 2. The determination device according to claim 1. (Appendix 3) An adjustment unit adjusts the likelihood of determining that the access is likely to be unauthorized, depending on the determination result by the determination unit. 10. The determination device according to claim 1 or 2. (Appendix 4) a search unit that searches the stored information for an object that is the same as or similar to an access request that is the object to be judged; The determination unit checks the reception status of access requests that are the same as or similar to the access request to be determined based on the search result by the search unit, and determines whether the access request to be determined is likely to be an unauthorized access based on the check result. 3. The determination device according to claim 2. (Appendix 5) The determination unit checks the reception status of access requests that are the same as or similar to the access request to be determined by calculating the proportion of the search results of the search unit to the stored information, according to the search results of the search unit. 5. The determination device according to claim 4. (Appendix 6) The determination unit determines that there is a possibility of unauthorized access when the proportion of the search results by the search unit to the stored information is below a predetermined threshold. 6. The determination device according to claim 5. (Appendix 7) The stored information includes vector values ​​that can be calculated according to at least a Structured Query Language (SQL) statement included in the access request; The search unit calculates the vector value according to the access request to be judged, and searches the stored information for an object that is the same as or similar to the calculated vector value. 10. The determination device according to claim 4, wherein the first and second electrodes are connected to a first electrode. (Appendix 8) The adjustment unit determines the degree of fraud determination in accordance with the determination result by the determination unit, and adjusts the likelihood of determining that the access is likely to be fraudulent in accordance with the determination result. 4. The determination device according to claim 3. (Appendix 9) The information processing device determining whether the access request to be judged is likely to be an unauthorized access based on the reception status of access requests that are identical to or similar to the access request to be judged; Output information according to the judgment result Judgment method. (Appendix 10) In the information processing device, determining whether the access request to be judged is likely to be an unauthorized access based on the reception status of access requests that are identical to or similar to the access request to be judged; Output information according to the judgment result A program to realize the processing.

[0083] Note that some or all of the configurations described in Supplementary Notes 2 to 8 that are dependent on the determination device described in Supplementary Note 1 may also be dependent in a similar dependent relationship on the determination method described in Supplementary Note 9 and the program described in Supplementary Note 10. Furthermore, not limited to Supplementary Notes 9 and 10, some or all of the configurations described as Supplements may also be dependent on various hardware, software, various recording means for recording software, or systems within the scope of the above-mentioned embodiments.

[0084] The programs described in the above embodiments and appendices can be stored in and supplied to a computer using various types of non-transitory computer-readable media. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic storage media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical storage media (e.g., magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / Ws, and semiconductor memories (e.g., mask ROMs, PROMs (Programmable ROMs), EPROMs (Erasable PROMs), flash ROMs, and RAMs (Random Access Memory)). The programs may also be supplied to a computer by various types of transitory computer-readable media. Examples of transitory computer-readable media include electrical signals, optical signals, and electromagnetic waves. The transitory computer-readable media can supply the programs to a computer via wired communication paths such as electric wires and optical fibers, or wireless communication paths.

[0085] Although the present disclosure has been described above with reference to the above-described embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate. [Explanation of symbols]

[0086] 100 Database Management Systems 200 Client Device 300 Database management device (determination device) 310 Communications Management Department 320 Analysis Department 330 Grammar Check Section 340 First Audit Department 350 Second Audit Department 351 Vectorization Department 352 Storage Unit 353 Search Department 354 Judgment section 355 Notification Department 356 Threshold adjustment unit 357 Vector DB 360 Planning Generation Unit 370 Data Management Department 400 Judgment device 401 CPU 402 ROM 403 RAM 404 Programs 405 Storage device 406 Drive Unit 407 Communication Interface 408 Input / Output Interface 409 Bus 410 Recording Media 411 Communication Network 421 Judgment section 422 Output section

Claims

1. a determination unit that determines whether or not the access request to be determined is likely to be an unauthorized access, depending on the reception status of access requests that are the same as or similar to the access request to be determined; an output unit that outputs information according to the determination result by the determination unit; have Judgment device.

2. The determination unit checks the reception status of access requests that are the same as or similar to the access request to be determined based on accumulated information that has accumulated information corresponding to the access requests, and determines whether the access request to be determined is likely to be an unauthorized access based on the confirmation result. The determination device according to claim 1 .

3. An adjustment unit adjusts the likelihood of determining that the access is likely to be unauthorized, depending on the determination result by the determination unit. The determination device according to claim 1 .

4. a search unit that searches the stored information for an object that is the same as or similar to an access request that is the object to be judged; The determination unit checks the reception status of access requests that are the same as or similar to the access request to be determined based on the search result by the search unit, and determines whether the access request to be determined is likely to be an unauthorized access based on the check result. The determination device according to claim 2 .

5. The determination unit checks the reception status of access requests that are the same as or similar to the access request to be determined by calculating the proportion of the search results of the search unit to the stored information, according to the search results of the search unit. The determination device according to claim 4 .

6. The determination unit determines that there is a possibility of unauthorized access when the proportion of the search results by the search unit to the stored information is below a predetermined threshold. The determination device according to claim 5 .

7. The stored information includes a vector value that can be calculated according to at least a Structured Query Language (SQL) statement included in the access request, and The search unit calculates the vector value according to the access request to be judged, and searches the stored information for an object that is the same as or similar to the calculated vector value. The determination device according to claim 4 .

8. The adjustment unit determines the degree of fraud determination in accordance with the determination result by the determination unit, and adjusts the likelihood of determining that the access is likely to be fraudulent in accordance with the determination result. The determination device according to claim 3 .

9. The information processing device determining whether the access request to be judged is likely to be an unauthorized access based on the reception status of access requests that are identical to or similar to the access request to be judged; Output information according to the judgment result Judgment method.

10. In the information processing device, determining whether the access request to be judged is likely to be an unauthorized access based on the reception status of access requests that are identical to or similar to the access request to be judged; Output information according to the judgment result A program to realize the processing.

Images