Information processing device, control method for information processing device, and program

Abstract

To appropriately detect attacks while minimizing the impact on the basic functions of information processing equipment. [Solution] An information processing device comprising detection means for detecting an attack against the information processing device, wherein the information processing device comprises adjustment means for adjusting the priority between processing a predetermined function of the information processing device and detection processing by the detection means, and scheduling means for scheduling processing of the predetermined function and detection processing based on the priority adjusted by the adjustment means.

Description

Technical Field

[0001] The present invention relates to an information processing apparatus, a control method for an information processing apparatus, and a program.

Background Art

[0002] In recent years, the damage caused by cyberattacks on information processing apparatuses has been on the increase. Along with this, various security measures have been implemented, but due to the sophistication of cyberattacks, it has become difficult to take countermeasures with conventional security measures such as malware detection and firewalls. In particular, attacks that utilize unknown vulnerabilities called zero-day attacks are difficult to defend against, and there are scattered cases where attackers who have invaded the system of an information processing apparatus due to a zero-day attack misuse the system to damage individuals and companies. Against such sophisticated attacks, in addition to conventional defense at the network boundary, it is necessary to implement security measures such as monitoring the behavior of the system and detecting attacks that attempt to misuse the system.

[0003] In Patent Document 1, attack detection is performed using a plurality of algorithms on logs related to a system, and it is disclosed that the timing of notification, the content of notification, and the contact are changed based on the severity of the detected attack. Thereby, appropriate notification can be performed according to the severity of the attack.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, resource limitations pose a problem when implementing attack detection in embedded devices such as MFPs (Multi-Function Peripherals). When performing attack detection analysis on logs, it is necessary to test all detection algorithms. If multiple algorithms are defined for different attack types, running them all at once can increase the computational resources required for detection processing on resource-constrained devices like MFPs. This could reduce the resources needed for the MFP's basic functions such as printing and scanning, potentially impacting performance.

[0006] This invention has been made in view of the above-mentioned problems, and aims to provide a technology for appropriately performing attack detection while suppressing the impact on the basic functions of the device. [Means for solving the problem]

[0007] The information processing apparatus according to the present invention, which achieves the above objectives, The information processing apparatus is equipped with a detection means for detecting an attack against the information processing apparatus, An adjustment means for adjusting the priority between the processing of a predetermined function of the information processing device and the detection processing by the detection means, A scheduling means that schedules the processing of the predetermined function and the detection process based on the priority adjusted by the adjustment means, It is characterized by having the following features. [Effects of the Invention]

[0008] According to the present invention, attack detection can be appropriately performed while suppressing the impact on the basic functions of the device. [Brief explanation of the drawing]

[0009] [Figure 1] Block diagram showing the connection configuration of an MFP and peripheral devices according to one embodiment. [Figure 2] Internal configuration diagram of the controller section of an MFP according to one embodiment. [Figure 3] A detection algorithm table for the United Nations [Figure 4] Flowchart for implementing an attack detection process in one embodiment [Figure 5] Block diagram of software executed within the controller of an MFP according to one embodiment. [Figure 6] Priority adjustment table according to one embodiment [Figure 7] Mode switching condition table according to one embodiment [Figure 8] Flowchart for implementing priority post-adjustment processing in one embodiment [Figure 9] Flowchart for implementing the processing of one embodiment [Modes for carrying out the invention]

[0010] The embodiments will be described in detail below with reference to the attached drawings. Note that the following embodiments do not limit the invention as defined in the claims. While the embodiments describe multiple features, not all of these features are essential to the invention, and the features may be combined in any way. Furthermore, in the attached drawings, identical or similar configurations are given the same reference numerals, and redundant descriptions are omitted.

[0011] In this book, the embodiments describe a Multi-Functional Peripheral (MFP), which is an image forming apparatus, as an example of an information processing apparatus. However, this embodiment is also applicable to information processing apparatuses other than MFPs.

[0012] <Device configuration> Referring to the block diagram in Figure 1, the connection configuration between the MFP and peripheral devices according to this embodiment will be explained. The MFP 100 is a computer device that functions as an information processing device. The MFP 100, PC (Personal Computer) 110, and management server 120 are connected via LAN 140. The PC 110 is a computer device that performs processing such as sending and receiving print jobs and scan jobs to the MFP 100. The management server 120 manages the MFP 100, and if the MFP 100 is integrated into the organization's authentication system, it performs authentication and authorization of users accessing the MFP 100. When the MFP 100 and management server 120 connect to the Internet, the connection is made via firewall 130. The PC 150 is connected to the MFP 100 and management server 120 via the Internet and can access the MFP 100.

[0013] The MFP100 has a panel operation unit 102 and a button operation unit 103 for input and output with the user. The panel operation unit 102 is composed of an electronic panel, allowing the user to operate the MFP100 by touch input. The button operation unit 103 consists of physical buttons, allowing the user to operate the MFP100 by pressing the buttons. The card reader unit 104 can read an IC card when the user holds it over the reader, and authenticate the user. The printer unit 105 outputs electronic data to paper media. The scanner unit 106 reads paper media and converts it into electronic data. The panel operation unit 102, button operation unit 103, card reader unit 104, printer unit 105, and scanner unit 106 are connected to the controller unit 101, and they perform their functions as an MFP according to the control of the controller unit 101.

[0014] <Hardware configuration of the controller section> Next, referring to the block diagram of FIG. 2, the physical configuration of the controller unit 101 of the MFP 100 will be described. The CPU 201 performs the main arithmetic processing within the controller. The CPU 201 is connected to the DRAM 202 via a bus. The DRAM 202 is used by the CPU 201 as a working memory for temporarily arranging program data representing arithmetic instructions and data to be processed during the arithmetic operation by the CPU 201. The CPU 201 is connected to the I / O controller 203 via a bus.

[0015] The I / O controller 203 performs input / output to various devices according to the instructions of the CPU 201. A network I / F 204 is connected to the I / O controller 203. A wired LAN device 220 is connected to the network I / F 204. The CPU 201 realizes communication on the LAN 140 by controlling the wired LAN device 220 via the network I / F 204. A SATA (Serial Advanced Technology Attachment) I / F 205 is connected to the I / O controller 203, and a Flash memory 221 and a Secure memory 222 are connected thereto.

[0016] The CPU 201 uses the Flash memory 221 to permanently store programs for realizing the functions of the MFP and document files. Also, the CPU 201 uses the Secure memory 222 to store data important for security. The Secure memory 222 is encrypted and can only be accessed from a specific module by access control. Therefore, it is protected from leakage of confidential information and unauthorized rewriting.

[0017] The panel I / F 206 is connected to the I / O controller 203, and realizes the user's operation by converting the physical operation of the user input to the panel operation unit 102 into electronic data and transmitting it to the CPU 201. The button I / F 207 realizes the user's operation by converting the physical operation of the user input via the button operation unit 103 into electronic data and transmitting it to the CPU 201. The card reader I / F 208 realizes authentication operations and the like by converting the read information of the IC card input to the card reader unit 104 into electronic data and transmitting it to the CPU 201.

[0018] The printer I / F 209 is connected to the I / O controller 203, and the CPU 201 realizes the output process of paper media using the printer unit 105 via the printer I / F 209. The scanner I / F 210 is connected to the I / O controller 203. The CPU 201 realizes the reading process of the original manuscript using the scanner unit 106 via the scanner I / F 210. The USB I / F 211 is connected to the I / O controller 203 and controls any device connected to the USB I / F 211.

[0019] When implementing the copy function, the CPU 201 reads program data from the Flash memory 221 into the DRAM 202 via the SATA I / F 205. The CPU 201 detects a copy instruction from the user for the panel operation unit 102 and the button operation unit 103 via the panel I / F 206 and the button I / F 207 according to the program read into the DRAM 202. When the CPU 201 detects the copy instruction, it receives the original manuscript from the scanner unit 106 as electronic data via the scanner I / F 210 and stores it in the DRAM 202. The CPU 201 performs color conversion processing and the like suitable for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 105 via the printer I / F 209 and performs the output process to paper media. As described above, the copy function can be realized by combining the print function and the scan function.

[0020] When performing PDL printing, the client PC 110 issues a print command via LAN 140. The CPU 201 reads program data from Flash memory 221 into DRAM 202 via SATA I / F 205, and detects the print command via network I / F 204 according to the module loaded into DRAM 202. When the CPU 201 detects a PDL transmission command, it receives the print data via network I / F 204 and saves the print data to Flash memory 221 via SATA I / F 205. Once the saving of the print data is complete, the CPU 201 expands the print data stored in Flash memory 221 as image data into DRAM 202. The CPU 201 performs color conversion processing and other operations suitable for output on the image data stored in DRAM 202. The CPU 201 transfers the image data stored in DRAM 202 to the printer unit 105 via printer I / F 209 and performs the output process to paper media.

[0021] <Functional Configuration> Next, referring to the block diagram in Figure 5, we will describe an example of a functional configuration realized by the software executed in the controller unit 101 of the MFP100 in Embodiment 1.

[0022] The panel operation control unit 501 displays a user-facing screen image on the panel operation unit 102, detects user touch operations, and executes processes associated with screen components such as buttons displayed on the screen. The button operation control unit 502 executes processes associated with buttons when the user presses a button located on the button operation unit 103. The card reader control unit 503 reads the IC card held over the user by the reader located on the card reader unit 104, and executes processes according to the information read.

[0023] The data storage unit 504 stores data in the Flash memory 221 or reads data from the Flash memory 221 in response to requests from other control units. For example, if a user wants to change some device settings, the panel operation control unit 501 detects what the user has entered into the panel operation unit 102, and in response to a request from the panel operation control unit 501, the data storage unit 504 saves the setting value in the Flash memory 221.

[0024] The job control unit 505 controls job execution according to instructions from other control units.

[0025] The image processing unit 506 processes the image data into a format suitable for each application, according to instructions from the job control unit 505. The printing processing unit 507 prints and outputs the image onto paper media via the printer interface 209, according to instructions from the job control unit 505. The scanning processing unit 508 reads the placed document via the scanner interface 210, according to instructions from the job control unit 505.

[0026] The network control unit 509, according to the settings stored in the data storage unit 504, sets network settings such as IP addresses to the TCP / IP control unit 510 when the system starts up or when a setting change is detected. The TCP / IP control unit 510 performs network packet transmission and reception processing via the network interface 204 according to instructions from other controls. The USB control unit 511 controls the USB interface 211 and controls any USB-connected device. The communication port control unit 512 controls the port used by the TCP / IP control unit 510 when sending and receiving packets.

[0027] The log acquisition unit 520 collects logs related to the behavior within the MFP100. Specifically, these behavioral logs are logs related to the operation of programs running within the MFP100 and user operations. These are recorded within the MFP100 in the form of system logs, audit logs, network logs, etc. The information recorded in the logs may include the time the event occurred, information about the user or program that performed the event, information about the commands and system calls executed, execution permissions, information about the files and directories being operated on, and information about the hostname or IP address being accessed.

[0028] The attack detection unit 521 detects attacks against the MFP100 by analyzing logs acquired by the log acquisition unit 520. The attack detection unit 521 detects attacks by applying one or more detection algorithms according to the type of attack to information regarding the behavior of the information processing device (i.e., logs). An attacker may exploit unknown vulnerabilities in the MFP100 to carry out an attack. If an attack occurs, the attacker may use the MFP100's shell to execute various commands or misuse its functions. In response to this, the attack detection unit 521 detects an attack if the MFP100 exhibits behavior that it would not normally exhibit.

[0029] For example, an attacker might launch an editor via the MFP100's shell or execute a search command to find a target program in order to carry out an attack by tampering with the MFP100's programs or settings. The MFP100 is equipped with commands that enable the above processes, but these are not executed in normal use cases. The attack detection unit 521 can determine that an attack has occurred when it detects typical attacker behavior that would not occur in such MFP100 use cases.

[0030] To detect an attack, a detection algorithm table 301, as shown in Figure 3, is referenced. The detection algorithm table 301 contains "Attack," "Detection Algorithm," and "Severity." "Attack" contains information about the attack to be detected, and may include one or more of the following: attack type, attack classification, impact, attack potential, complexity, and CVSS (Common Vulnerability Scoring System) value.

[0031] "Attack type" indicates the type of attack, such as "collection of user information within an MFP," "modification / disabling of a firewall," or "intrusion into the internal network using an MFP as a stepping stone." "Attack classification" categorizes the attacker's actions from reconnaissance to the execution of the objective, and examples include well-known cybersecurity frameworks such as Cyber ​​kill chain and MITRE ATT&CK's tactical classification. In the example in Figure 3, "attack classification" can include reconnaissance, defense evasion, and lateral deployment. Note that attack classification can also be based on attack methods or characteristics rather than processes.

[0032] "Impact" refers to the degree of impact the attack will have on the system. In the example in Figure 3, "Impact" can include low, medium, high, etc. Not only the direct impact on the system but also the impact of secondary damage may be considered. "Attackability" represents the likelihood that the system will be attacked. In the example in Figure 3, "Attackability" can include low, medium, high, etc. For example, the number of publicly available attack codes for the attack in question can be counted, and the higher the number, the higher the attackability can be judged. "Ease of Attack" represents how easy it is to carry out the attack. In the example in Figure 3, "Ease of Attack" can include low, medium, high, etc. For example, the more complex the conditions for the attack to succeed, such as requiring information gathering before the attack, requiring privilege escalation, or being only possible under specific settings, the lower the ease of attack is judged.

[0033] The "CVSS score" is a value (score) calculated based on the Common Vulnerability Scoring System, a well-known method for evaluating vulnerabilities. This allows for the quantitative calculation of attack severity under a consistent standard. Note that the CVSS score is not the only option; other evaluation criteria used to quantitatively calculate attack severity may also be used.

[0034] The "Detection Algorithm" section describes the algorithms used to detect attacks. Examples include "whoami," "stopping firewalld using systemctl," and "connecting to an external client via ssh." The "Detection Algorithm" section also describes specific conditions for detecting attacks from logs, such as the commands used in the attack, command arguments, and targets.

[0035] "Severity" is a value that indicates the degree of impact of an attack on a three-level scale: high, medium, and low. Severity is determined based on information about the attack. For example, a CVSS value of 0.0 to 3.0 is low, 3.1 to 7.0 is medium, and 7.1 to 10.0 is high. Alternatively, the severity may be determined so that the later stages of the attack process indicated by the attack classification result in higher severity. In addition, multiple pieces of attack information may be combined to calculate severity. Severity may also be expressed as a continuous value (e.g., 0.0 to 10.0) rather than on a three-level scale. Furthermore, there may be detection algorithms corresponding to other severity levels. In that case, one or more detection algorithms may be grouped and managed according to the severity of the attack, and the priority of detection processing may be set on a group basis. For example, two or more detection algorithms may be assigned a severity of "high," and the priority of detection processing by two or more detection algorithms corresponding to "high" severity may be set to be higher.

[0036] The attack detection unit 521 detects an attack by determining whether the information contained in the log is an attack based on one or more detection algorithms listed in the detection algorithm table 301 described above. Here, we have exemplified the detection of an attack based on a command that would not be executed in the use case of the MFP100, but it may also be detected from other system behaviors such as unusual process behavior or library loading. Alternatively, unusual behavior may be detected using AI. Furthermore, here we have exemplified the detection of the attack detection unit 521 performing detection on the log, but it may also detect the execution of commands or system calls within the MFP100 as events and perform detection on the information contained in the events. Thus, the information regarding behavior may be log information that records the behavior of a program, or event information that indicates the behavior of a program.

[0037] The scheduling unit 522 controls the execution schedule of each program to be executed within the MFP100 according to the priority set for each program. Specifically, the scheduling unit 522 manages the execution order of each program by switching the allocation of resources necessary for execution to each process (thread) generated when a program is executed. The scheduling unit 522 performs this switching according to the predetermined priority for each program. Processes (threads) to which resources such as the CPU201 are allocated with higher priority by the scheduling unit 522 can complete execution in a shorter time than other processes (threads). On the other hand, processes (threads) with lower priority will take longer to execute, but they can perform processing little by little with fewer resources.

[0038] The notification unit 523 notifies the administrator that an attack has occurred on the system when the attack detection unit 521 detects an attack, and prompts them to take countermeasures.

[0039] The priority adjustment unit 531 adjusts the priority between the processes that perform the printing and scanning functions of the MFP100 (e.g., basic functions) and the threads generated by the attack detection unit 521. When adjusting the priority, the priority adjustment table 601 shown in Figure 6 is referred to. The priority adjustment table 601 contains modes and priorities. There are three modes: performance priority mode, balanced mode, and security priority mode, and each has a corresponding priority value pre-set. The priority values ​​are set for assigning priority values ​​to the processes that perform the printing and scanning functions of the MFP100 and to the severity-based threads generated by the attack detection unit 521. Note that the basic functions may include at least one of the printing function and the scanning function.

[0040] Priority values ​​range from, for example, -20 to 19, with lower values ​​indicating higher priority. In performance priority mode, the priority of the basic functions, the printing and scanning processes, is set to 0, while attack detection threads are set to 5, 10, and 15 respectively, which are lower priorities than the basic functions. In balanced mode, high-severity attack detection threads are set to 0, the same as the basic functions, while medium and low-severity detection threads are set to 5 and 10 respectively, which are lower priorities than the basic functions. In security priority mode, attack detection threads are set to -15, -10, and -5 respectively, which are higher priorities than the basic functions. The priority adjustment unit 531 adjusts the priority by switching between these modes according to the conditions. Note that the priority values ​​are examples and other values ​​may be set.

[0041] For the conditions for switching modes, refer to the mode switching condition table 701 in Figure 7. Let's explain the case where the resource usage status of the basic function, for example, CPU usage, is used as the switching trigger. The priority adjustment unit 531 monitors the CPU usage rate used by the basic function and switches modes according to the value described in the mode switching conditions. Specifically, if the CPU usage rate is 30% or less, it switches to security priority mode; if it is between 31% and 69%, it switches to balanced mode; and if it is 70% or more, it switches to performance priority mode. In this way, the priority between the processing of the basic function and the detection process can be adjusted according to the resource usage status of the processing of the basic function. As a result, when the load on the basic function is high, the execution of the basic function is prioritized, and when the load is low, attack detection is prioritized, so that attack detection can be performed appropriately while minimizing the impact on the basic function.

[0042] Alternatively, time zones can be used as triggers for switching modes. For example, performance-prioritizing mode could be used during peak hours in the office (weekdays 8:30-17:00), while security-prioritizing mode could be used during off-peak hours (weekdays 22:00-8:30, and on holidays). In between these periods (weekdays 17:00-22:00), a balanced mode could be used. In this way, the priority of processing basic functions and detection processes can be adjusted according to the time of day. This allows for appropriate attack detection while minimizing the impact on basic functions.

[0043] Alternatively, the network environment may be used as a switching trigger to switch modes. The priority adjustment unit 531 acquires network environment information identified by the network environment identification unit 533 (described later) and switches to a mode appropriate to the environment. For example, in the case of an intranet environment, since perimeter defense exists and security risks are reduced, it switches to performance priority mode. On the other hand, in the case of a public environment, since it is directly connected to the internet and security risks are high, it is set to security priority mode. In the case of a SOHO environment, although network perimeter defense is not applied as in an intranet environment, it is operated on a private network, so it is set to an intermediate balanced mode. This makes it possible to perform attack detection with an appropriate priority according to the security risks of the network environment. Note that although an example of automatic identification of the network environment has been shown here, the network environment specified by the user may also be acquired by the network environment specification unit 534 (described later).

[0044] As an alternative switching trigger, user-specified mode can also be used. Specifically, the priority adjustment unit 531 obtains the mode specified by the user via the priority specification unit 535 (described later) and switches directly to that mode. This allows the MFP user to freely set the appropriate mode.

[0045] The priority adjustment unit 531 may use one of these switching triggers, or it may use multiple triggers. When multiple triggers are used, there may be multiple modes that satisfy the conditions. In that case, the mode determined by the trigger with the highest priority may be adopted according to the pre-set priority of the triggers. Alternatively, the mode may be switched using a composite condition that combines the switching conditions of multiple triggers.

[0046] The network environment information collection unit 532 collects information regarding the settings of the MFP100 stored in the data storage unit 504, as well as information obtained from other devices such as DNS servers and DHCP servers present in the network to which the MFP100 belongs. Hereinafter, other devices present in the network will be referred to as network devices. Information regarding the settings of the MFP100 includes, for example, the IP address and its type (global address, private address), and information regarding whether or not the MFP100 uses a proxy server when communicating with devices outside the LAN. Furthermore, it also includes information regarding the settings of the communication protocol and setting information regarding the network environment stored in the data storage unit 504 of the MFP100.

[0047] Information obtained from network devices may include, for example, the source IP address and type (global address, private address) of packets received by the MFP100, the port used for communication, and the packet's TTL (Time to Live). It may also include information on responses to ARP (Address Resolution Protocol) sent by the MFP and responses from DNS (Domain Name System) servers. Furthermore, it may include information such as DHCP (Dynamic Host Configuration Protocol) server option information. While the above examples illustrate the information collected by the network environment information collection unit 532, other information that the MFP100 can collect may also be referenced.

[0048] In the following, the settings of the MFP100 and the information obtained from network devices described above will be referred to as network environment information. The collected network environment information is stored in the data storage unit 504. Processing by the network environment information collection unit 532 is started at the start of operation or at any instruction given by the user or management server 120.

[0049] The network environment identification unit 533 identifies, based on the network environment information collected by the network environment information collection unit 532, which of the predefined network environments, such as SOHO, public, or intranet, the network environment to which the MFP100 is connected.

[0050] Here, the network environment of the MFP100 was illustrated as an example, but it may be identified as a different network environment. Below, based on the network environment information to which the MFP100 is connected as described above, the network environment identifier identified from a security perspective for the MFP100 will be referred to as the network environment identifier. As an example of how to identify a network environment, suppose that proxy settings on the MFP100 or communication from a proxy server is detected. In this case, it is identified as an intranet environment where network perimeter defense by a proxy server is applied, and this is used as the network environment identifier. If network perimeter defense is not applied, as in an intranet environment, but it is operating on a private network, it is identified as a SOHO environment, and this is used as the network environment identifier.

[0051] If an environment is accessible to an unspecified number of users, such as when a global IP address is assigned or when communicating directly with external servers or clients, it is identified as a public environment and this is used as the network environment identifier. In the example in Figure 1, the MFP100 is determined to be in a public environment because it is directly connected to the internet without going through a proxy server. Here, a rule-based determination method for identifying network environments based on specific conditions has been illustrated, but network environment determination can also be performed using AI that has learned the relationship between collected network environment information and network environment identifiers.

[0052] The network environment selection unit 534 accepts the network environment specified by the user based on user input information. For example, it accepts the network environment selected by the user via touch input through the user-facing network environment selection screen displayed by the panel operation unit 102. Alternatively, physical buttons corresponding to each network environment may be provided, and the network environment specified by the user may be accepted as input information via the button operation unit 103.

[0053] The priority designation unit 535 accepts the mode specified by the user's input information. For example, it accepts the mode selected by the user via touch input through the user-facing mode selection screen displayed by the panel operation unit 102. The current mode setting may also be displayed on the screen so that the currently set mode can be confirmed. Alternatively, physical buttons corresponding to each mode may be provided, and the mode specified by the user may be accepted as input information via the button operation unit 103.

[0054] <Processing> Next, the procedure for attack detection according to this embodiment will be explained with reference to the flowchart in Figure 4. Each step will be described by adding the letter S to the beginning of its symbol.

[0055] In S401, the attack detection unit 521 creates attack detection threads according to severity. For example, if there are three severity levels: high, medium, and low, a total of three threads are created for each severity level. In this case, the higher the severity, the higher the priority of the thread.

[0056] In S402, the attack detection unit 521 detects that a new log has been recorded by the log acquisition unit 520. In S403, the attack detection unit 521 adds information (tasks) corresponding to the newly detected log to the queue. Here, a queue is provided for each attack detection thread, and the same log information (tasks) is added to each queue.

[0057] In S404, the scheduling unit 522 allocates resources to attack detection threads according to a priority-based schedule. In S405, the scheduling unit 522 checks the queue of attack detection threads to which resources have been allocated, and proceeds to S406 if log information exists. If no log information exists, it waits for a certain period of time and then checks the queue again.

[0058] In S406, the attack detection unit 521 executes an attack detection algorithm on the log corresponding to the log information obtained from the queue. At that time, it selects and executes a detection algorithm of the severity corresponding to the attack detection thread from the detection algorithm table 301. If an attack is detected, in S407 the notification unit 523 notifies the administrator that an attack has occurred on the system and prompts them to take countermeasures.

[0059] As described above, in this embodiment, the priority between the processing of the basic functions of the information processing device and the detection process is adjusted. For example, the execution priority of the detection algorithm is determined according to the severity of the attack. According to this embodiment, detection algorithms for high-severity attacks are executed early by preferentially utilizing resources (such as CPU usage), while for low-severity attacks, the processing time is slightly longer, but resource consumption is reduced. This makes it possible to perform attack detection appropriately while considering the balance between security and performance.

[0060] While the above example shows creating separate threads for each severity level, it is also acceptable to create separate processes for each severity level. Furthermore, while the above example shows executing multiple detection algorithms corresponding to each severity level together within separate threads, it is also acceptable to create separate threads or processes for each detection algorithm.

[0061] [Example 1] Furthermore, depending on the state of the MFP100, the system may adjust the priority of each function within the MFP100 accordingly. The attack detection flow of this process will be explained using Figure 8, which shows the flowchart of the process. Each step will be described by adding the letter S to the beginning of its symbol.

[0062] In S801, the priority adjustment unit 531 monitors the switching trigger. In S802, the priority adjustment unit 531 determines which mode satisfies the switching conditions corresponding to the switching trigger. In S803, the priority adjustment unit 531 determines whether the mode that satisfies the switching conditions is different from the current mode. If it is the same as the current mode, the process terminates without performing a mode switch. On the other hand, if it is different from the current mode, the process proceeds to S804. In S804, the priority adjustment unit 531 sets the priority corresponding to the mode determined in S802 for each process and thread.

[0063] As explained above, this modified version allows for flexible adjustment of the priority between basic functions and attack detection functions according to the status of the MFP100. This makes it possible to perform attack detection while appropriately adjusting the balance between security and performance according to the status of the MFP100.

[0064] [Differentiation 2] In the above embodiment, the scheduling unit 522 controlled the execution schedule of programs according to the priority set for each program executed within the MFP100. Here, we will show another modification. Specifically, we will show an example in which the scheduling unit 522 controls jobs related to the printing process of the MFP100. In the MFP100 of this modification, the print server receives and manages print jobs from clients. The print execution process receives the jobs sent from the print server and executes the printing process.

[0065] The following describes the processing flow of this modified example, using Figure 9, which shows a flowchart of the process. Each step will be described by adding the letter S to the beginning of its symbol.

[0066] In S901, the scheduling unit 522 monitors the jobs managed by the print server. In S902, if there are new jobs, the scheduling unit 522 proceeds to S903. In S903, the scheduling unit 522 checks whether attack detection processing is in progress. If attack detection processing is not in progress, the process proceeds to S904, and the scheduling unit 522 permits the print server to send jobs. On the other hand, if attack detection processing is in progress, the process proceeds to S905, and the scheduling unit 522 instructs the print server to stop sending jobs for a certain period of time.

[0067] In S903, the attack detection processes that are checked vary depending on the mode. For example, in security-first mode, all threads of all severity levels are checked. In balanced mode, threads corresponding to medium and high severity levels are checked. In performance-first mode, threads with high priority are checked. Note that the threads checked may be categorized in ways other than those described above, depending on the mode.

[0068] As explained above, this modified version allows for the appropriate execution of attack detection while balancing security and performance by controlling printing jobs according to the execution status of the detection process.

[0069] The disclosures herein include the following information processing devices, methods for controlling the information processing devices, and programs.

[0070] (Item 1) The information processing apparatus is equipped with a detection means for detecting an attack against the information processing apparatus, An adjustment means for adjusting the priority between the processing of a predetermined function of the information processing device and the detection processing by the detection means, A scheduling means that schedules the processing of the predetermined function and the detection process based on the priority adjusted by the adjustment means, An information processing device characterized by comprising:

[0071] (Item 2) The information processing device according to item 1, characterized in that the adjustment means calculates the severity of an attack based on one or more of the following: attack classification, which classifies the attacker's actions into processes from reconnaissance to the execution of the objective; impact, which indicates the degree of impact caused by the attack; attackability, which indicates the likelihood of being attacked; attack ease, which indicates how easy it is to carry out the attack; and a score based on the Common Vulnerability Scoring System, and determines the priority of the detection process based on the severity.

[0072] (Item 3) The information processing apparatus according to item 1 or 2, characterized in that the detection means detects the attack by applying one or more detection algorithms corresponding to the type of attack to information regarding the behavior of the information processing apparatus.

[0073] (Item 4) The system further comprises a grouping means for grouping one or more detection algorithms according to the severity of the attack, The information processing apparatus according to item 3, characterized in that the adjustment means sets the priority of the detection process on a group basis.

[0074] (Item 5) The information processing device according to item 3, characterized in that the information relating to the aforementioned behavior is log information recording the behavior of the program, or event information indicating the behavior of the program.

[0075] (Item 6) The information processing device according to any one of items 1 to 5, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection processing according to the resource usage status of the processing of the predetermined function.

[0076] (Item 7) The information processing apparatus according to any one of items 1 to 6, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection processing according to the time of day.

[0077] (Item 8) The information processing device according to any one of items 1 to 6, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection process according to network environment information.

[0078] (Item 9) The information processing device includes a collection means for collecting information about the network to which it is connected, The collection means further comprises an identification means for identifying network environment information based on the information collected by the collection means, The information processing apparatus according to item 8, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection process according to the network environment information identified by the identification means.

[0079] (Item 10) The system further includes an environment specification means for receiving the specified network environment information, The information processing apparatus according to item 8, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection process according to the network environment information specified by the environment specification means.

[0080] (Item 11) The system further comprises a designation means for receiving a designation of the mode of the information processing device, The information processing apparatus according to any one of items 1 to 10, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection process according to the mode specified by the designation means.

[0081] (Item 12) The information processing device according to any one of items 1 to 11, characterized in that the predetermined function includes at least one of a printing function and a scanning function.

[0082] (Item 13) A control method for an information processing device that performs detection processing to detect an attack on the information processing device, An adjustment step to adjust the priority between the processing of a predetermined function of the information processing device and the detection process, A scheduling step that schedules the processing of the predetermined function and the detection process based on the priority adjusted by the adjustment step, A control method for an information processing device, characterized by having the following features.

[0083] (Item 14) A program that causes a computer to execute the control method for the information processing device described in item 13.

[0084] (Other embodiments) The present invention can also be realized by supplying a program that implements one or more of the functions of the above-described embodiments to a system or device via a network or storage medium, and by having one or more processors in the computer of that system or device read and execute the program. It can also be realized by a circuit (e.g., an ASIC) that implements one or more functions.

[0085] The invention is not limited to the embodiments described above, and various modifications and variations are possible without departing from the spirit and scope of the invention. Accordingly, claims are attached to disclose the scope of the invention. [Explanation of symbols]

[0086] 520: Log acquisition unit, 521: Attack detection unit, 522: Scheduling unit, 523: Notification unit, 531: Priority adjustment unit, 532: Network environment information collection unit, 533: Network environment identification unit, 534: Network environment specification unit, 535: Priority specification unit

Claims

1. The information processing apparatus is equipped with a detection means for detecting an attack against the information processing apparatus, An adjustment means for adjusting the priority between the processing of a predetermined function of the information processing device and the detection processing by the detection means, A scheduling means that schedules the processing of the predetermined function and the detection process based on the priority adjusted by the adjustment means, An information processing device characterized by comprising:

2. The information processing apparatus according to claim 1, wherein the adjustment means calculates the severity of an attack based on one or more of the following: attack classification, which classifies the attacker's actions into processes from reconnaissance to the execution of the objective; impact, which indicates the degree of impact caused by the attack; attackability, which indicates the likelihood of being attacked; attack ease, which indicates how easy it is to carry out the attack; and a score based on the Common Vulnerability Scoring System, and determines the priority of the detection process based on the severity.

3. The information processing apparatus according to claim 1, characterized in that the detection means detects the attack by applying one or more detection algorithms corresponding to the type of attack to information regarding the behavior of the information processing apparatus.

4. The system further comprises a grouping means for grouping one or more detection algorithms according to the severity of the attack, The information processing apparatus according to claim 3, characterized in that the adjustment means sets the priority of the detection process on a group basis.

5. The information processing device according to claim 3, characterized in that the information relating to the aforementioned behavior is log information recording the behavior of the program, or event information indicating the behavior of the program.

6. The information processing apparatus according to claim 1, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection processing according to the resource usage status of the processing of the predetermined function.

7. The information processing apparatus according to claim 1, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection process according to the time of day.

8. The information processing apparatus according to claim 1, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection process according to network environment information.

9. The information processing device includes a collection means for collecting information about the network to which it is connected, The collection means further comprises an identification means for identifying network environment information based on the information collected by the collection means, The information processing apparatus according to claim 8, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection process according to the network environment information identified by the identification means.

10. The system further includes an environment specification means for receiving the specified network environment information, The information processing apparatus according to claim 8, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection process according to the network environment information specified by the environment specification means.

11. The system further comprises a designation means for receiving a designation of the mode of the information processing device, The information processing apparatus according to claim 1, characterized in that the adjustment means adjusts the priority between the processing of the predetermined function and the detection process according to the mode specified by the designation means.

12. The information processing apparatus according to claim 1, characterized in that the predetermined function includes at least one of a printing function and a scanning function.

13. A control method for an information processing device that performs detection processing to detect an attack on the information processing device, An adjustment step to adjust the priority between the processing of a predetermined function of the information processing device and the detection process, A scheduling step that schedules the processing of the predetermined function and the detection process based on the priority adjusted by the adjustment step, A control method for an information processing device, characterized by having the following features.

14. A program for causing a computer to execute the control method of the information processing device described in claim 13.

Images