Device, method and program

Abstract

To provide a network monitoring device capable of enhancing the accuracy of detection on illegal access to a network device.SOLUTION: A network monitoring device comprises: an authentication history gathering part which gathers an authentication history of access to a management function of a network device to be monitored; a statistic value calculation part which calculates statistic value information of the authentication history; and a display part which displays the statistic value information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an apparatus, a method, and a program. [Background technology]

[0002] Network devices typically have internal management functions for controlling or monitoring the functions of the network devices from the outside, and administrators remotely access these management functions. There is technology that detects unauthorized access to the network by monitoring access to the management functions of network devices.

[0003] For example, Patent Document 1 discloses a technology that compares accesses shown in log information with accesses for predetermined processing that have been applied for in advance, and detects, as unauthorized accesses, accesses shown in the log information that do not match the accesses for the predetermined processing that have been applied for. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2020-095750 Summary of the Invention [Problem to be solved by the invention]

[0005] However, the invention described in the above-mentioned Patent Document 1 detects only accesses that do not match the accesses for the predetermined processing that have been applied for in advance as unauthorized accesses, but this alone is not enough to detect the majority of unauthorized accesses.

[0006] An example of an object of the present disclosure is to provide a network monitoring device that can improve the accuracy of detecting unauthorized access to a network device. [Means for solving the problem]

[0007] A network monitoring device according to one aspect of the present disclosure includes an authentication history collection means for collecting authentication history of access to the management functions of the network device being monitored, a statistical value calculation means for calculating statistical value information of the authentication history, and a display means for displaying the statistical value information.

[0008] A network monitoring method according to one aspect of the present disclosure collects authentication history of accesses to management functions of a network device to be monitored, calculates statistical value information of the authentication history, and displays the statistical value information.

[0009] In one aspect of the present disclosure, a recording medium stores a program that causes a computer to collect authentication history of access to management functions of a monitored network device, calculate statistical value information of the authentication history, and display the statistical value information. [Effects of the Invention]

[0010] One example of the effect of the present disclosure is that it is possible to provide a network monitoring device that can improve the accuracy of detecting unauthorized access to a network device. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram showing the configuration of a network monitoring device according to the first embodiment. [Figure 2] FIG. 2 is a diagram showing a hardware configuration in which the network monitoring device according to the first embodiment is realized by a computer device and its peripheral devices. [Figure 3] FIG. 3 is an example of a screen displaying statistical value information in the first embodiment. [Figure 4] FIG. 4 shows another example of a screen displaying statistical value information in the first embodiment. [Figure 5] FIG. 5 is a flowchart showing the operation of network monitoring in the first embodiment. [Figure 6] FIG. 6 is a block diagram showing the configuration of a network monitoring device according to the second embodiment. [Figure 7] FIG. 7 shows an example of displaying a list of authentication information in the authentication history in the second embodiment. [Figure 8] FIG. 8 shows another example of displaying a list of authentication information in the authentication history in the second embodiment. [Figure 9] FIG. 9 is a flowchart showing the operation of network monitoring in the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] Next, an embodiment will be described in detail with reference to the drawings.

[0013] [First embodiment] Fig. 1 is a block diagram showing the configuration of a network monitoring device 100 according to the first embodiment. Referring to Fig. 1, the network monitoring device 100 includes an authentication history collection unit 101, a statistical value calculation unit 102, and a display unit 103. The network monitoring device 100, which is an essential component of this embodiment, will be described in detail below.

[0014] The network monitoring device 100 collects authentication histories of accesses to network devices 200 (200a, 200b, ..., 200n) connected to the network monitoring device 100 via a network, and monitors unauthorized access to the network devices 200. Each network device 200 is a device for relaying and transferring data over the network, and is equipped with a management function for externally controlling and monitoring the functions of the device. Access to the management function is typically configured to require login (authentication) for security reasons. Each network device 200 also has an authentication function that authenticates a user by verifying their username and password when they log in, and an authentication history storage function that stores the authentication history. The authentication history is a record of information related to authentication (authentication information). The authentication history storage function stores authentication information, such as the authentication time, the network device 200 that performed the authentication, the access source, the authentication result, and the user name, in association with each other.

[0015] 2 is a diagram illustrating an example of a hardware configuration in which the network monitoring device 100 according to the first embodiment of the present disclosure is realized by a computer device 500 including a processor. As shown in Fig. 2, the network monitoring device 100 includes a CPU (Central Processing Unit) 501, memories such as a ROM (Read Only Memory) 502 and a RAM (Random Access Memory) 503, a storage device 505 such as a hard disk that stores a program 504, a communication interface 508 for network connection, and an input / output interface 511 for inputting and outputting data. In the first embodiment, the authentication history acquired by the authentication history collection unit 101 is input to the network monitoring device 100 via the communication interface 508.

[0016] The CPU 501 runs an operating system to control the entire network monitoring device 100 according to the first embodiment of the present invention. The CPU 501 also reads programs and data into memory from a recording medium 506 mounted in, for example, a drive device 507. The CPU 501 also functions as the authentication history collection unit 101, the statistical value calculation unit 102, the display unit 103, or parts of these units in the first embodiment, and executes processing or commands in the flowchart shown in Fig. 5, which will be described later, based on the program.

[0017] The recording medium 506 is, for example, an optical disk, a flexible disk, a magneto-optical disk, an external hard disk, or a semiconductor memory. Some of the recording media in the storage device are non-volatile storage devices, and the programs are recorded therein. The programs may also be downloaded from an external computer (not shown) connected to a communication network.

[0018] The input device 509 is realized by, for example, a mouse, a keyboard, built-in key buttons, etc., and is used for input operations. The input device 509 is not limited to a mouse, a keyboard, or built-in key buttons, and may be, for example, a touch panel. The output device 510 is realized by, for example, a display, and is used to check output.

[0019] As described above, the first embodiment shown in FIG. 1 is realized by the computer hardware shown in FIG. 2. However, the means for realizing each unit of the network monitoring device 100 in FIG. 1 is not limited to the configuration described above. Furthermore, the network monitoring device 100 may be realized by a single physically coupled device, or may be realized by two or more physically separated devices connected by wire or wirelessly. For example, the input device 509 and the output device 510 may be connected to the computer device 500 via a network. Furthermore, the network monitoring device 100 in the first embodiment shown in FIG. 1 can also be configured using cloud computing or the like.

[0020] In FIG. 1, the authentication history collection unit 101 is a means for collecting authentication histories of accesses to the management functions of the network device 200. In this embodiment, accesses to the management functions of the network device 200 refer to the above-mentioned management functions, excluding communication processes provided by functions that the network device 200 originally has. The authentication history collection unit 101 acquires authentication histories stored in the authentication history storage function of each network device 200, such as a router, hub, gateway, or switch, connected to the network. The authentication history is linked to authentication information such as the authentication time, the network device 200 that performed the authentication, the access source, the authentication result, and the user name. The authentication history collection unit 101 outputs the authentication history acquired in this manner to the statistics calculation unit 102.

[0021] The statistical value calculation unit 102 calculates statistical value information of the authentication history. The statistical value information is a value obtained by adding up authentication results, such as the number of authentications or the number of authentication successes or failures, for each network device 200 over a predetermined period. The statistical value calculation unit 102 may calculate the ratio of the number of authentication successes or the number of authentication failures to the total number of authentications for the network device 200 being monitored. The predetermined period is not particularly limited and may be, for example, one day or one week. The statistical value calculation unit 102 may calculate a total statistical value for all network devices 200 being monitored or a statistical value for each individual network device 200. The statistical value calculation unit 102 may calculate the trend in the number of authentication successes or failures for each predetermined period. In this case, it is possible to grasp the change over time in the risk of attacks involving intrusion into the network device 200. After calculating the statistical value information, the statistical value calculation unit 102 outputs the information to the display unit 103.

[0022] The display unit 103 is a means for displaying the calculated statistical information. The display unit 103 outputs the statistical information to the output device 510 or the like. FIG. 3 is an example of a screen displaying statistical information in the first embodiment. However, FIG. 3 is merely an example of the statistical information, and the display may not be a pie chart. The example in FIG. 3 shows the number of authentication successes and failures in the network device 200 monitored by the network monitoring device 100 over a predetermined period, as well as the success rate and failure rate relative to the total number of authentication attempts. An administrator managing the network device 200 can infer that the lower the number of authentication successes and the higher the number of failures in the network device 200, the higher the risk of an attack involving external intrusion. The display unit 103 may also output statistical information on the number of authentication attempts per predetermined period, or the number of authentication successes or failures, in a manner that allows comparisons to be made. FIG. 4 is another example of a screen displaying statistical information in the first embodiment. The example in FIG. 4 shows a bar graph showing the number of authentication attempts per day, divided into the number of successes and the number of failures. If the number of authentication attempts or failures increases sharply in a certain period (for example, by several times or more compared to the previous day), the administrator can infer that there may have been a risk of an external attack during that period.

[0023] The operation of the network monitoring device 100 configured as above will be described with reference to the flowchart of FIG.

[0024] 5 is a flowchart showing an outline of the operation of the network monitoring device 100 in the first embodiment. Note that the processing according to this flowchart may be executed based on program control by the processor described above.

[0025] 5, first, the authentication history collection unit 101 collects authentication history of accesses to the management functions of the network device 200 (step S101). Next, the statistical value calculation unit 102 calculates statistical value information of the authentication history (step S102). Finally, the display unit 103 displays the calculated statistical value information (step S103). This completes the operation of the network monitoring device 100.

[0026] In the network monitoring device 100 according to the first embodiment, the display unit 103 displays statistical information on the authentication history of accesses to the management functions of the network device 200. This makes it possible to grasp the possibility of unauthorized access to the network device 200 based on authentication results such as the number of times authentication has been performed on the network device 200 or the number of times authentication has succeeded or failed. Therefore, even access other than that requested in advance can be detected as unauthorized access, thereby improving the accuracy of detecting unauthorized access to the network device 200.

[0027] [Second embodiment] Next, a second embodiment of the present disclosure will be described in detail with reference to the drawings. Below, the description of the present embodiment will be omitted to the extent that it does not become unclear. The functions of each component in each embodiment of the present disclosure can be realized not only by hardware but also by a computer device or software based on program control, similar to the computer device shown in FIG. 2 .

[0028] 6 is a block diagram showing the configuration of a network monitoring device 110 according to the second embodiment of the present disclosure. The network monitoring device 110 will be described with reference to FIG. 6, focusing on the differences from the network monitoring device 100 according to the first embodiment.

[0029] A network monitoring device 110 according to the second embodiment includes an authentication history collection unit 111, an authentication history accumulation unit 112, a statistical value calculation unit 113, a list creation unit 114, a display item reception unit 115, a display unit 116, an abnormality detection unit 117, and a warning unit 118. The authentication history accumulation unit 112 is a unit that accumulates the authentication history for each network device 210 collected by the authentication history collection unit 111. Furthermore, the authentication history collection unit 111 and the statistical value calculation unit 113 are similar to the authentication history collection unit 101 and the statistical value calculation unit 102 according to the first embodiment, and therefore a description thereof will be omitted here.

[0030] The list creation unit 114 is a means for creating a list of authentication information in the authentication history for a predetermined period. The list is a display of all authentication information in the authentication history, and the authentication information includes the authentication time, the network device 210 that performed the authentication, the access source, the authentication result, the user name, the access means, the authentication result, and the reason for the authentication failure. The access means may be, for example, a console or a vty (Virtual Teletype), and may further include ssh (Secure Shell), telnet (Teletype Network), etc. as communication protocols used to access the vty.

[0031] The list creation unit 114 may create a list by arranging the authentication information in order of authentication time. Alternatively, the list creation unit 114 may create a list by extracting only authentication histories that meet predetermined conditions from the authentication histories stored in the authentication history storage unit 112. Alternatively, when access to a specific network device 210 is scheduled for maintenance work or the like, the list creation unit 114 may create a list of authentication histories related to the scheduled access. In this case, the list creation unit 114 extracts authentication histories for the time period of the maintenance work and authentication histories that include the user names of the users scheduled to access.

[0032] The display item receiving unit 115 is a means for receiving a selection of display items of authentication information to be displayed. The display item receiving unit 115 receives display items to be displayed in a list of authentication information, for example, via the input device 509. The display items include at least information about the network device 210 that performed the authentication, access source information such as an IP address, the authentication result, and the reason for failure if the authentication fails.

[0033] The display unit 116 displays the list created by the list creation unit 114 on the output device 510, etc. When the display item receiving unit 115 receives display items to be displayed, the display unit 116 displays only the received display items.

[0034] The anomaly detection unit 117 is a means for detecting an anomaly when an anomaly is found in statistical value information or authentication history. The anomaly detection unit 117 detects an anomaly, for example, when the number of authentication attempts or failures increases suddenly during a certain period in statistical value information calculated every predetermined period. A sudden increase refers to, for example, when the number of authentication attempts or failures increases by several times or more compared to the previous period. The anomaly detection unit 117 may also detect an anomaly when access attempts are made to multiple network devices 210. The anomaly detection unit 117 may also detect an anomaly when an anomaly is found in the authentication history in the created list. The anomaly detection unit 117 detects an anomaly, for example, when an authentication history includes an authentication failure due to a different username or password for each network device 210. The anomaly detection unit 117 may also detect an anomaly when an authentication attempt is made during an unusual usage time. Furthermore, the anomaly detection unit 117 may detect an anomaly when the authentication history includes the authentication history of a user who has not logged in for a predetermined period (for example, one month or more) or the authentication history of a user who has logged in for the first time.

[0035] Furthermore, when the list creation unit 114 creates a list of authentication histories related to scheduled accesses, the anomaly detection unit 117 detects an anomaly if the created list includes an authentication history different from the schedule. For example, the anomaly detection unit 117 detects an anomaly if the created list includes an authentication history of a user name scheduled for access in a time period different from the schedule, or an authentication history from a user different from the user name scheduled for access in the scheduled time period.

[0036] The warning unit 118 is a means for warning an administrator when an abnormality is detected. The warning unit 118 outputs the authentication history in which the abnormality is detected to the output device 510 such as a display device. In this case, the warning unit 118 may highlight the corresponding authentication history in the list displayed by the display unit 116, for example by adding color to it.

[0037] Here, a method of detecting an abnormality by the network monitoring device 110 will be described in detail with reference to the drawings. FIG. 7 shows an example of displaying a list of authentication information in the authentication history in the second embodiment. As shown in FIG. 7, the authentication information in the authentication history includes the network device name, IP address, authentication time, user name, access means, authentication result, and authentication failure reason. In the example of FIG. 7, the entered password for network device C is different, and the entered user name for network device D is different. In this case, the abnormality detection unit 117 detects an abnormality in the authentication history for network device C and network device D, and the warning unit 118 warns the administrator. In this case, the warning unit 118 may highlight the authentication histories of network device C and network device D by underlining them in the list displayed by the display unit 116, as shown in FIG. 7. Note that the display unit 116 may also display statistical value information for the authentication history together with the list of authentication information in the authentication history, as shown in FIG. 7.

[0038] FIG. 8 is another example of displaying a list of authentication information in the authentication history in the second embodiment. FIG. 8 shows an example in which the list creation unit 114 has created a list of authentication histories related to scheduled accesses. In the example of FIG. 8, it is assumed that access from the user name "test" is scheduled from 4:00 to 4:30 on February 21, 2022. In the authentication history list of FIG. 8, the authentication time for network device A differs from the scheduled time period, and the user name for network device C differs. In this case, the abnormality detection unit 117 detects an abnormality in the authentication histories for network device C and network device D. As shown in FIG. 8, the warning unit 118 highlights the authentication histories of network device A and network device C by underlining them in the list displayed by the display unit 116.

[0039] The operation of the network monitoring device 110 configured as above will be described with reference to the flowchart of FIG.

[0040] 9 is a flowchart showing an outline of the operation of the network monitoring device 110 in the second embodiment. Note that the processing according to this flowchart may be executed based on program control by the processor described above.

[0041] As shown in FIG. 9, first, the authentication history collection unit 111 collects authentication histories of accesses to the management function of the network device 210 (step S111). Next, the statistical value calculation unit 113 calculates statistical value information of the authentication history (step S112). If an abnormality is found in the statistical value information (S113; YES), the abnormality detection unit 117 detects the abnormality, and the warning unit 118 warns the administrator (step S114), and the process ends. On the other hand, if the abnormality detection unit 117 does not find an abnormality in the statistical value information (S113; NO), the process proceeds to step S115. Next, if access to a specific network device 210 for maintenance work or the like is scheduled (S115; YES), the list creation unit 114 creates a list of authentication histories related to the scheduled access (step S116). Next, if the created list contains an authentication history that is different from the plan (S117; YES), the abnormality detection unit 117 detects an abnormality, and the warning unit 118 warns the administrator (step S118). On the other hand, if the created list does not contain an authentication history that is different from the plan (S117; NO), the abnormality detection unit 117 ends the process.

[0042] In step S115, if access to the specific network device 210, such as for maintenance work, is not scheduled (S115; NO), the list creation unit 114 creates a list of authentication histories for a predetermined period (step S119). Next, if the created list shows an abnormality in the authentication history (S120; YES), the abnormality detection unit 117 detects the abnormality, and the warning unit 118 warns the administrator (step S118). On the other hand, if the created list shows no abnormality in the authentication history (S120; NO), the abnormality detection unit 117 ends the processing. With this, the network monitoring device 110 ends its operation.

[0043] In the network monitoring device 110 according to the second embodiment of the present disclosure, if an anomaly is found in the statistical value information or authentication history in the created list, the anomaly detection unit 117 detects the anomaly, and the warning unit 118 warns the administrator. This allows the administrator to be notified when an anomaly is found in the statistical value information or authentication history. Furthermore, in the network monitoring device 110, the anomaly detection unit 117 detects an anomaly if the created list contains an authentication history of a user who has not logged in for a predetermined period of time, or an authentication history of a user who has logged in for the first time. Furthermore, the anomaly detection unit 117 detects an anomaly if the created list contains an authentication history that differs from what was expected. This makes it possible to detect the possibility of an attack that misuses legitimate authentication information, even if authentication is successful.

[0044] Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

[0045] For example, although multiple operations are described in a sequential order in the form of a flowchart, the order of description does not limit the order in which the multiple operations are performed. Therefore, when implementing each embodiment, the order of the multiple operations can be changed within the scope that does not affect the content.

[0046] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes.

[0047] (Appendix 1) an authentication history collecting means for collecting an authentication history of access to a management function of a network device to be monitored; a statistical value calculation means for calculating statistical value information of the authentication history; a display means for displaying the statistical value information; Network monitoring equipment.

[0048] (Appendix 2) the statistical value calculation means calculates the number of authentication successes or failures in the network device during a predetermined period based on the authentication history; 2. The network monitoring device of claim 1.

[0049] (Appendix 3) further comprising a list creation means for creating a list of authentication information of the authentication history for a predetermined period of time; the display means displays the list together with the statistical value information. 3. The network monitoring device according to claim 1 or 2.

[0050] (Appendix 4) the list creation means creates a list of the authentication information in order of authentication time. 4. The network monitoring device of claim 3.

[0051] (Appendix 5) the list creation means, when an access to a specific network device is scheduled, creates a list of authentication history associated with the scheduled access; 5. The network monitoring device according to claim 3 or 4.

[0052] (Appendix 6) an anomaly detection means for detecting an anomaly when an anomaly is found in the statistical value information or the authentication history; and a warning means for warning an administrator when an abnormality is detected. 6. A network monitoring device according to any one of appendices 1 to 5.

[0053] (Appendix 7) the statistical value calculation means calculates statistical value information for each predetermined period; the abnormality detection means detects an abnormality when the number of authentication attempts or the number of failures increases suddenly. 7. The network monitoring device of claim 6.

[0054] (Appendix 8) the anomaly detection means detects an anomaly when an attempt is made to access a plurality of network devices; 7. The network monitoring device of claim 6.

[0055] (Appendix 9) The anomaly detection means detects an anomaly when the authentication history includes an authentication history of a user who has not logged in for a predetermined period of time or an authentication history of a user who has logged in for the first time. 7. The network monitoring device of claim 6.

[0056] (Appendix 10) the anomaly detection means detects an anomaly when an authentication history different from the expected history is included; 7. The network monitoring device of claim 6.

[0057] (Appendix 11) Collecting authentication history of access to management functions of monitored network devices; Calculating statistical information of the authentication history; The network monitoring method further comprises displaying the statistical information.

[0058] (Appendix 12) Collecting authentication history of access to management functions of monitored network devices; Calculating statistical information of the authentication history; A recording medium storing a program for causing a computer to display the statistical value information. [Explanation of symbols]

[0059] 100, 110 Network monitoring device 101, 111 Authentication History Collection Department 102, 113 Statistical value calculation section 103, 116 Display section 112 Authentication history storage unit 114 List Creation Department 115 Display Item Reception Section 117 Abnormality detection unit 118 Warning section 200, 210 Network equipment

Claims

1. a statistical value calculation means for calculating statistical value information of an authentication history from an authentication history of accesses to a target device that is a device to be monitored; a display means for displaying a screen including a graph showing the time transition of the statistical value information.

2. The statistical value information is the number of successful authentications on the target device.

10. The apparatus of claim 1.

3. The statistical value information is the number of authentication failures in the target device.

10. The apparatus of claim 1.

4. the statistical value calculation means calculates two types of statistical value information from the authentication history; the display means displays the time transitions of the two types of statistical value information separately.

10. The apparatus of claim 1.

5. The two types of statistical value information are the number of authentication successes on the target device and the number of authentication failures on the target device.

5. The apparatus of claim 4.

6. The computer calculating statistical value information of the authentication history from the authentication history of accesses to the target device that is the device to be monitored; A method for displaying a screen including a graph showing the time progression of the statistical value information.

7. a function of calculating statistical value information of the authentication history from the authentication history of access to the target device that is a device to be monitored; a function of displaying a screen including a graph showing the time transition of the statistical value information; A program that enables a computer to achieve this.

Images