Information monitoring device, information monitoring method, and information monitoring program

Abstract

This device provides an information monitoring system that identifies attacker information and leaked files when files are extracted during a cyberattack. [Solution] The information monitoring device comprises a generation unit that generates an embedded file, which, when downloaded or uploaded to the internet, activates a program that recognizes the IP address; an addition unit that adds the embedded file to an electronic file; and a receiving unit that, when the electronic file is illegally leaked, activates the program on a specific server where the illegally leaked electronic file is stored, thereby receiving the IP address of the specific server.

Description

Technical Field

[0001] The present invention relates to an information monitoring device, an information monitoring method, and an information monitoring program.

Background Art

[0002] In recent years, the security of digital information of companies and organizations has been emphasized. In particular, the unauthorized leakage of electronic files containing confidential information can cause significant losses, and systems for strengthening information security have been developed. For example, there is a description of a security countermeasure program that effectively utilizes existing software resources installed in an information processing device to provide a technology for tracking electronic files that have flowed out to a network (Patent Document 1). There is also a description of a file tracking method and an information processing device method that can reduce risks such as information leakage (Patent Document 2).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, in view of the fact that cyberattacks are carried out daily and the number of victims is increasing, there is a need for an information monitoring device or the like that further improves the security of digital files. In particular, it has been difficult to track the leaked files and identify the attacker.

Means for Solving the Problems

[0005] An information monitoring device according to one embodiment of the present invention comprises a generation unit that generates an embedded file, which, when downloaded or uploaded to the Internet, activates a program that recognizes an IP address; an addition unit that adds the created embedded file to an electronic file; and a receiving unit that, when an electronic file is illegally leaked, activates a program on a specific server where the illegally leaked electronic file is stored, thereby receiving the IP address of the specific server.

[0006] In an information monitoring device according to one embodiment of the present invention, the embedded file is an image file, and when downloaded, it may open a file disguised as an electronic file to notify terminal information, IP address, or terminal operation.

[0007] In an information monitoring device according to one embodiment of the present invention, the embedded file is an electronic file that appears as an image file, and when uploaded to the cloud, it is launched as a program by a command in the .htaccess file, and the administrator may have backdoor access.

[0008] In an information monitoring device according to one embodiment of the present invention, the program may refrain from executing files until the server is set upon request from the client.

[0009] An information monitoring method according to one embodiment of the present invention includes a generation step in which a computer generates an embedded file in which a program that recognizes an IP address is launched when the file is downloaded or uploaded to the Internet; an addition step in which the embedded file is added to an electronic file; and a receiving step in which, when an electronic file is illegally leaked, a program is launched on a specific server where the illegally leaked electronic file is stored, thereby receiving the IP address of the specific server.

[0010] An information monitoring program according to one embodiment of the present invention causes a computer to execute a generation function that generates an embedded file, which, when downloaded to an information monitoring device having a recording medium or uploaded to the Internet, activates a program that recognizes the IP address; an addition function that adds the created embedded file to an electronic file; and a receiving function that, when an electronic file is illegally leaked, activates a program on a specific server where the illegally leaked electronic file is stored to receive the IP address of that specific server. [Effects of the Invention]

[0011] According to the information monitoring device of the present invention configured as described above, when the program is activated on a specific server where illegally leaked electronic files are stored, the IP address of that specific server is received, thus providing a system that enhances security against cyberattacks. [Brief explanation of the drawing]

[0012] [Figure 1] Figure 1 is a block diagram of an information monitoring device according to one embodiment of the present invention. [Figure 2] Figure 2 is a flowchart of an information monitoring device according to one embodiment of the present invention. [Modes for carrying out the invention]

[0013] Hereafter, an embodiment of the invention described herein (also referred to as the present invention) will be explained using the figures. Note that the figures are examples only, and the present invention is not limited to those shown in the figures. For example, the illustrated block diagrams of the management server, access terminal, and user terminal, the flowchart, etc., are examples only, and the present invention is not limited to these.

[0014] Figure 1 is a diagram showing an overall schematic of one embodiment of the present invention. The information monitoring device 5 according to one embodiment of the present invention comprises a generation unit 15 that generates an embedded file which, when downloaded to a computer or uploaded to the internet, activates a program that recognizes an IP address; an addition unit 17 that adds the created embedded file to an electronic file 103; and a receiving unit 25 which, when the electronic file 103 is illegally leaked, activates a program on a specific server where the illegally leaked electronic file 103 is stored, thereby receiving the IP address of the specific server. The electronic file 103 may be an image file, a document file, or source code such as a program.

[0015] The information monitoring device 5 consists of a generation unit 15, an addition unit 17, and a receiving unit 25. The receiving unit 25 may be located on the user terminal. On the user terminal 10, the generation unit 15 generates an embedded file that launches a program to recognize the IP address when information is leaked illegally. Specifically, the embedded file is a file disguised as an electronic file, which is placed in a directory on the user terminal 10 or the server where important files are located. The embedded file may be an electronic file that looks like an image file, and when uploaded to the cloud, it may be launched as a program by a command in the .htaccess file, giving the administrator backdoor access. The addition unit 17 adds the created embedded file to the electronic file 103. This electronic file 103 may be a hidden file named shell.jpeg, and may be a program that looks like a jpeg file. The program may not execute the file until the server is requested and configured by the client.

[0016] The management server 20 consists of a receiving unit 25. The receiving unit 25 launches a program on the server where the illegally leaked electronic file 103 is recorded and receives the IP address of the server. In addition to the IP address, the information received may also include terminal information and terminal operation history.

[0017] The access terminal 30 is a terminal that extracts the electronic file 103 from the user terminal 10. The network server 40 is a server that uploads the extracted electronic file 103. When the electronic file 103 is uploaded to the network server 40, as described above, the management server 20 receives information such as the IP address in the receiving unit 25.

[0018] The management server 20 may have a simulation tool that can evaluate how vulnerable the organization's systems are using methods from the access terminal 30 (such as connecting to information monitoring devices or C2 servers, file theft, and overwriting server settings). Specifically, it can periodically test for vulnerabilities such as file uploads and backdoors. The management server 20 can perform vulnerability assessments by overwriting server configuration files.

[0019] The management server 20 may have a function to detect when the .htaccess or web.config file is uploaded or modified by the access terminal 30. .htaccess is a file used to control the basic operation of the web server on a directory basis. web.config is a file used to configure various settings, from upload capacity to access control, transfer, and error display. Normally, only the system administrator makes changes to these files, so a warning is issued immediately if an abnormal change is detected. The management server 20 can provide a function specifically for "anomaly detection" of unintended file extensions or configuration changes in specific configuration files.

[0020] The management server 20 may have a function of providing a service that strengthens the monitoring and control functions for file uploads. For example, it may be a mechanism that checks whether a file is an executable file for each extension and rejects files not on the permission list. Also, it is possible to control only the file types permitted in a specific directory. Compared with the normal file inspection function, the technology that simultaneously verifies whether the uploaded file overwrites the system settings can monitor the security from multiple perspectives simultaneously when the file is uploaded.

[0021] The management server 20 may have a function of immediately notifying the management server 20 when a configuration file is added to the directory of the user terminal 10 on the server. This enables early detection of unintended configurations and overwrites, and early response to attacks. A service that combines the real-time monitoring of the server configuration and the alert function for specific file uploads can issue alerts for a specific directory.

[0022] The management server 20 may have a function of detecting and immediately blocking communications by the access terminal 30 to a remote server or a C2 server. The C2 server is a command server for the access terminal 30 to issue commands to malware or receive stolen information. By blocking communications in real time when the information monitoring device 5 or malware attempts to communicate with an external server, the activities of the access terminal 30 can be suppressed. The management server 20 can provide a service that learns communication patterns in advance and immediately detects signs of C2 communication.

[0023] The management server 20 may have a function of using a simulation function that mimics the behavior patterns of the access terminal 30 (such as file theft, remote server connection, modification of configuration files, etc.) to test how the enterprise system responds. Furthermore, a defense function that automatically responds to attacks (e.g., blocking the IP when a file theft attempt is made) can also be incorporated. It is possible to test the defensive power of the organizational system by mimicking typical attacker behaviors and further automate defensive actions based on the results.

[0024] The management server 20 may have a tool that sets different attack scenarios according to the server environment, such as server software, and analyzes the specific vulnerabilities of the server. Thereby, it is possible to dynamically learn different configuration overwrite risks and countermeasures for each type of server and respond accordingly. The scenario is, for example, an attack scenario that exploits file extensions. The access terminal 30 exploits the server settings and vulnerabilities to infiltrate a system that can upload malicious files. At this time, by disguising the file extension, the file filtering on the server side can be avoided.

[0025] When file theft or modification of server settings in the user terminal 10 is detected, the management server 20 may have a function of immediately tracing the path of the attack (e.g., remote server connection, C2 server communication, file upload). This function helps to visualize the entire path from the origin of the attack and clarify where and what kind of defense is required. The management server 20 can trace the attack path in real time, visualize the flow of the attacker's actions, and in particular, dynamically track the paths of file theft and remote connections.

[0026] The management server 20 may have a function to detect attacks that spoof MIME types during file uploads or manipulate access to specific file extensions by exploiting server settings. This allows for proactive blocking of the risk of malicious file extensions being recognized as executable files. Since MIME type conversion detection is difficult to identify with existing security services, adding this functionality can prevent attacks at the file upload stage.

[0027] The management server 20 may have a function to automatically restore from a backup when it detects modifications to configuration files such as .htaccess and web.config. This allows the server configuration to be quickly restored to its normal state even if unintended modifications occur, minimizing the impact on services. The management server 20 can provide a comprehensive security solution with automated detection and immediate restoration of configuration file modifications, enhanced attack prevention, and improved vulnerability management.

[0028] The management server 20 may have a service that monitors patterns considered to be precursors to attacks using an AI model, such as communications and requests that differ from normal operation, and signs of changes in configuration files, and predicts and notifies of the risk of an attack occurring. Specifically, the AI ​​is anomaly detection, learning normal network traffic and user behavior patterns and detecting abnormal behavior in real time based on that. This allows preventative measures to be taken before an attack occurs. The method of learning abnormal fluctuations in system settings and communications and performing anomaly detection in real time in order to detect "precursors" to an attack can "predict before an attack occurs," whereas conventional attack detection is "reaction after an attack occurs."

[0029] The management server 20 may have a function that allows it to prepare a honeypot with intentionally introduced vulnerabilities in the user terminal 10, and when the access terminal 30 infiltrates, it can isolate the attacker internally by defending the entire system of the user terminal 10 while providing a response that disguises an attack, thereby allowing it to understand the attacker's behavior patterns and intent. This allows for investigation of the methods used by the access terminal 30 and can be used to strengthen security measures. The "fake response" function to provide false information to the access terminal 30 and dynamic isolation through the honeypot simultaneously enable behavioral analysis and prevention of attacks by the access terminal 30.

[0030] The management server 20 may have a function to score in real time how much a change affects the entire system when a user terminal 10 modifies its server configuration files or system files. For example, if a critical modification to a configuration file occurs, it can immediately issue an alert with a high score, allowing for priority of action. In this way, the management server 20 can automatically evaluate the "impact" of a modification and determine the priority of action in real time.

[0031] The management server 20 may have a function to detect suspicious operations that differ from the behavior of the user terminal 10 (e.g., access to files that the administrator does not normally access, uploading files with unintended extensions) and issue a warning. It can learn user operations and immediately issue a warning if it considers any actions that differ from these to be abnormal. This allows the management server 20 to provide a mechanism that issues an alert only when file uploads or configuration file modifications differ from normal operations.

[0032] The management server 20 may have a function to quickly analyze the extent of damage to user terminals 10 in the event of an attack by access terminals 30 and immediately report which files and settings were affected. It may also be equipped with a recovery support function to restore normal settings and data to minimize damage. This function, which instantly analyzes the damage situation after an attack and supports the recovery process, can facilitate rapid recovery in the security field, and the coordination of automatic detection of the scope of damage and recovery support functions makes the response after an attack more efficient.

[0033] The management server 20 may have AI-based automatic attack pattern learning and defense response enhancement functions. Specifically, the AI ​​is a prediction using a machine learning model, which predicts future attack patterns based on past attack data and access logs. By automatically learning newly discovered vulnerabilities and attack patterns from past access terminals 30 and providing a defense system that prepares for the next attack, the ability to respond to unknown attack patterns is enhanced. Unlike conventional definition-based defense systems, the function that learns attack patterns in real time and automatically enhances defense response increases defensive capabilities each time an attack occurs.

[0034] The management server 20 may be specialized for the cloud server environment of the user terminal 10 and may have functions that combine multiple defense layers, such as file upload, server configuration overwriting, and detection of anomalies in remote communication. Threat detection and defense are enhanced based on the specific settings and vulnerabilities of the cloud environment. Multi-layered defense that takes cloud-specific settings into account can provide methods for identifying vulnerabilities and multi-layered defense approaches in the cloud environment.

[0035] The management server 20 may have a function to trace the infection route in real time and block the spread of infection if malware infiltrates the system of the user terminal 10. For example, if malware attempts to spread via a specific file, it may restrict access to that file to prevent its spread to other parts of the system.

[0036] The management server 20 may have a function to detect spoofing attacks (such as IP spoofing and communication pattern spoofing) carried out by the access terminal 30 against the server and network, immediately identify the attack, and take countermeasures. This strengthens defenses against actions by the access terminal 30 to evade detection by spoofing its IP address, and enables real-time detection of IP and communication pattern spoofing and dynamic responses.

[0037] The management server 20 may have a function to analyze attacker tendencies and patterns based on past attack logs from the access terminal 30 and predict future attacks. This allows for proactive measures, such as strengthening the defense system based on trends when attacks are frequent during specific time periods or system states. The management server 20 can predict attacks from log data analysis, prepare a defense system in advance, and automatically adjust the defense strategy by learning from past data.

[0038] The management server 20 may have a function to dynamically control the permissions of files uploaded to or requested by user terminals 10, and to issue warnings or restrict access if unusual file extensions or MIME types are used. This system allows for immediate response if specific extensions or settings are suddenly changed. The management server 20 dynamically manages file permission control and can react in real time to unauthorized file uploads or setting changes.

[0039] The management server 20 may have a function that uses AI to analyze the configuration files and settings of the user terminal 10 and automatically optimize risky settings. Specifically, the AI ​​manages dynamic resources and optimizes defensive resources in real time based on prediction results. This allows for immediate configuration changes when vulnerable settings are detected, for example, to ensure security. The management server 20 can automatically propose and implement configuration changes, thereby improving system security.

[0040] The management server 20 may have a function to learn the normal access rights of user terminals 10 and applications, detect abnormal permission changes or access in real time, and immediately adjust permissions. This allows for automatic restriction in the event of unexpected permission changes, protecting against attacks. The abnormal access permission detection and immediate automatic adjustment function allows for dynamic management of access rights and restriction of abnormal permission operations in real time.

[0041] The management server 20 may have a function to learn the behavior patterns of the access terminals 30 using AI and dynamically optimize security rules according to those patterns. Specifically, the AI ​​makes real-time decisions and autonomously determines appropriate defensive measures in response to attack predictions. Based on the patterns of attacks frequently carried out by the access terminals 30, it modifies and strengthens the rules to immediately contain the attacks. The management server 20 can provide adaptive defense, unlike conventional static rule-based systems, by having the AI ​​learn the attack patterns of the access terminals 30 and automatically adjusting the security rules accordingly.

[0042] The management server 20 may have a function to detect and immediately respond to zero-day attacks (attacks exploiting unknown vulnerabilities) by access terminals 30, based on the behavior of the existing system. This enables a rapid response to unknown threats. The management server 20 can provide a system for predicting and immediately responding to unknown vulnerabilities, particularly technology for predicting and responding to zero-day attacks.

[0043] The management server 20 may have a function that, in the event of an attack by an access terminal 30, visualizes the scope of the incident's impact on the entire system and immediately proposes a priority response for the most affected areas. This prevents the damage from spreading and allows for priority response to the areas with the greatest impact. The management server 20 can provide a mechanism that immediately visualizes the scope of the incident's impact and automatically determines the priority of response.

[0044] The management server 20 may have a function to dynamically change the system's defense settings according to the type and nature of the attack by the access terminal 30, and to automatically adopt the optimal defense posture for the attack. For example, if a DDoS attack is detected, network traffic restrictions can be strengthened, and if SQL injection occurs, database layer defenses can be strengthened. The management server 20 can respond flexibly to the situation by using technology to dynamically change system settings according to the nature of the attack.

[0045] The management server 20 may have a function to generate a detailed audit log in real time when changes occur to server settings or configuration files on the user terminal 10, clearly recording the history of the changes. This allows for a quick response based on the change history, even in the event of unexpected configuration changes. The technology for generating real-time audit logs when configuration changes occur is a function that visualizes specific configuration modifications and strengthens system change tracking, automatically generating audit logs and recording the content of the changes and the reasons for them.

[0046] The management server 20 may have a function to evaluate vulnerabilities in each layer (e.g., application, database, network) within the cloud environment of the user terminal 10 and automatically report risks corresponding to each layer. This enables centralized management of risks across the entire cloud and strengthens security measures for each layer. The management server 20 can dynamically evaluate each layer of the cloud environment and report risks for each vulnerability.

[0047] The management server 20 may have a function that uses an AI model to predict attack patterns by access terminals 30 and automatically reallocates defensive resources (e.g., defense strength, traffic filtering rules, enhanced user authentication, etc.) to areas where attacks are likely to occur. Specifically, the AI ​​is reinforcement learning, a technology that automatically learns and iteratively optimizes defensive strategies. This enables rapid defense against predicted attacks by access terminals 30. The technology of reallocating defensive resources in real time based on attack predictions can, in particular, enable dynamic resource allocation to respond immediately to attack patterns predicted by the AI.

[0048] The management server 20 may have a function to detect if multiple abnormal file operations occur in a chain reaction on the user terminal 10 in a short period of time, and to investigate and monitor the entire file system. For example, if a batch write operation is performed on multiple folders, or if an access operation is performed on a folder that is not normally accessed, it will be automatically detected as a sign of an attack on the access terminal 30. The technology of monitoring abnormal file operations in a chain reaction and analyzing multiple abnormal operations together can detect attacks with higher accuracy by focusing on chain reactions rather than just a single anomaly.

[0049] The management server 20 may have a function to automatically tune the settings of the user terminal 10's defense processes (e.g., firewall rules, access control, log monitoring, etc.) according to the system status and attack patterns. This ensures that optimized defenses are always maintained. The function to automatically optimize the settings of the defense processes, especially the real-time tuning function, can respond to evolving threats.

[0050] The management server 20 may have the function of evaluating the scope of impact when an incident occurs at the user terminal 10 and immediately analyzing and presenting specific business risks (e.g., data leakage, service outage, etc.). This supports rapid decision-making when an incident occurs. The management server 20 can immediately evaluate the impact of an incident as a business risk, and in particular, can convert technical impacts into business risks.

[0051] The management server 20 may have a function to analyze the effectiveness of the defenses against past attacks on the access terminal 30, evaluate how effective the defenses were, and automatically provide suggestions for improvements for future attacks. This allows for a continuous improvement in the accuracy of attack response. The function to analyze the effectiveness of defenses and automatically generate improvement suggestions supports the construction of a continuously evolving defense system and automates the process of "effectiveness analysis and automatic improvement" of defenses.

[0052] Figure 2 is a flowchart of an information monitoring device 5 according to one embodiment of the present invention. In this embodiment, the information monitoring device 5 operates in cooperation with a user terminal 10 and a management server 20. Each stage of the flowchart will be described in detail below.

[0053] Step 5 is the generation of an embedded file. On the user terminal 10, the generation unit 15 generates an embedded file that can launch a program to collect specific information (hereinafter referred to as "tracking information") when information is illegally leaked. This embedded file transmits the recorded server location information to the administrator server 20 or the user terminal 10. For example, this embedded file contains a program that can be transmitted to a specific management server, mobile terminal, computer, etc., after data including location information (IP address), terminal-specific information (MAC address, terminal ID, etc.), and operation history information (date and time of file access and operation details) has been recorded on the computer. This program is designed to operate intentionally at the destination of the leak and provides a function for tracking illegal leaks.

[0054] The embedded files generated by the generation unit 15 may be placed in a directory where important electronic files 103 stored on the user terminal 10 or server are located. Furthermore, because the embedded files are generated in a way that integrates naturally with other existing files, they are difficult for unauthorized accessers to detect. In addition, these embedded files can be disguised as common file formats such as PDF files or image files, thereby creating an environment in which data leakage can occur without arousing suspicion from attackers.

[0055] Step 10 is the addition of an embedded file. The generated embedded file is added to electronic file 103. This electronic file 103 is a file containing business data and confidential information stored on the terminal or server, and is highly likely to be a priority target for leakage if an attacker gains unauthorized access.

[0056] By adding an embedded file, the electronic file 103 gains the ability to collect tracking information. In particular, if the electronic file 103 is disguised as a PDF or image file, the access terminal 30 is highly likely to leak it outside the company without suspicion, maximizing the effectiveness of the embedded file.

[0057] Step 15 involves receiving and analyzing the data after it has been leaked. If a cyberattack is carried out using the access terminal 30, a large amount of internal company data, including electronic files 103, is uploaded to the network server 40 by the unauthorized accesser. At this time, the program contained in the embedded file is activated to collect information about the source and destination of the leak. This information may include the IP address of the source, information about the connecting terminal (e.g., OS, browser, application version, etc.), and the operation history at the time of the leak.

[0058] The collected information is transmitted via the network to the receiving unit 25 of the management server 20. The receiving unit 25 immediately receives the transmitted information and analyzes it. Based on the results of this analysis, the management server 20 sends a warning to the user terminal 10 as needed to prompt appropriate action.

[0059] The above information monitoring program may be recorded on a processor-readable recording medium, and the recording medium can be a "non-temporary tangible medium," such as tape, disk, card, semiconductor memory, or programmable logic circuit. Furthermore, the information monitoring program may be supplied to the processor via any transmission medium capable of transmitting it (such as a communication network or broadcast wave). In other words, for example, the proposed program may be downloaded and executed from a network using an information processing device such as a smartphone. The present invention can also be realized in the form of a data signal embedded in a carrier wave, where the information monitoring program is embodied through electronic transmission.

[0060] The above information monitoring program can be implemented using, for example, scripting languages ​​such as ActionScript and JavaScript®, or object-oriented programming languages ​​such as Objective-C, Java®, C++, Python, and R. [Explanation of Symbols]

[0061] 5 Information monitoring device 10 User terminals 15 Generation part 17 Additional Section 20 Management Server 25 Receiving section 30 Access terminals 40 Network Servers 103 Electronic files

Claims

1. A generation unit that generates embedded files, which launches a program that recognizes the IP address when downloaded or uploaded to the internet, An addition unit that adds the aforementioned embedded file to the electronic file, The system includes a receiving unit that, when the aforementioned electronic file is illegally leaked, activates the program on the specific server where the illegally leaked electronic file is stored, thereby receiving the IP address of the specific server. information monitoring device

2. The aforementioned embedded file is an image file, and when downloaded, it opens a file disguised as an electronic file to notify terminal information, IP address, or terminal operation. The information monitoring device according to feature 1.

3. The aforementioned embedded file is an electronic file that appears as an image file, and when uploaded to the cloud, it is launched as a program by a command in the .htaccess file, giving the administrator backdoor access. The information monitoring device according to feature 1.

4. The aforementioned program will not execute the file until the server is requested and configured by the client. The information monitoring device according to feature 3.

5. A generation step that generates an embedded file in which a program that recognizes the IP address is launched when the computer downloads or uploads to the internet, An additional step of adding the aforementioned embedded file to the electronic file, When the aforementioned electronic file is illegally leaked, the program is activated on the specific server where the illegally leaked electronic file is stored, and a receiving step is performed to receive the IP address of the specific server. An information monitoring method that performs this task.

6. An information monitoring device having a recording medium, comprising a generation function that generates embedded files, in which a program that recognizes the IP address is launched on a computer when the file is downloaded or uploaded to the internet, An additional function to add the aforementioned embedded file to an electronic file, When the aforementioned electronic file is illegally leaked, the program is activated on the specific server where the illegally leaked electronic file is stored, thereby providing a receiving function to receive the IP address of the specific server. An information monitoring program that executes the following actions.

Images