Process monitoring device and process monitoring method

Abstract

To lessen a work burden involved in updating of a white list.SOLUTION: A process monitoring device (10) includes an abnormality detection unit (13A) that detects an operation abnormality in the device, a white list (14B) that, when no operation abnormality is detected, is created by first process information about a process under operation, and an invalid process detection unit (13B) that, when an operation abnormality is detected, acquires second process information about the process under operation, and detects an invalid process on the basis of a comparison result of the first process information and the second process information. On the basis of a comparison result of the process of the second process information between an operation file generation time and a prescribed reference time, the invalid process detection unit (13B) detects, as an invalid process, a new process that is not listed in the white list in the second process information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a process monitoring technique for detecting unauthorized processes. [Background technology]

[0002] In recent years, with the spread of IOT and cloud services, the number of devices connected to networks has increased, and networks have become larger and more complex. As a result, cyber attacks targeting servers and IOT devices have increased, and technologies for dealing with cyber attacks have been proposed. For example, Patent Document 1 proposes a method for dealing with malware on a terminal by acquiring processes running on the terminal, storing them as a whitelist, and periodically checking the whitelist. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6254414 Summary of the Invention [Problem to be solved by the invention]

[0004] In Patent Document 1, the whitelist needs to be updated when the terminal or software is upgraded, which causes a large workload when updating the whitelist. In addition, in Patent Document 1, a blacklist needs to be prepared in addition to the whitelist, and as the number of malware increases, the workload of selecting and registering processes to be registered in the blacklist increases.

[0005] The present invention has been made to solve such problems, and has an object to provide a process monitoring device that can reduce the workload when updating a whitelist. [Means for solving the problem]

[0006] In order to achieve this object, the process monitoring device of the present invention comprises an anomaly detection unit that detects operational abnormalities of the device based on predetermined detection criteria, a whitelist created using first process information of a process in operation when the operational abnormality is not detected, and a malicious process detection unit that acquires second process information of the process in operation when the operational abnormality is detected, and detects a malicious process based on a comparison result between the first process information and the second process information, and the malicious process detection unit detects a new process that is not listed in the whitelist in the second process information as the malicious process based on a comparison result between the time when the operation file of the process in the second process information was generated and a predetermined reference time.

[0007] Furthermore, among the new processes, a process for which the action file was generated prior to the earliest creation of the whitelist may be added to the whitelist.

[0008] The abnormality detection unit may detect the operational abnormality based on at least one of a CPU utilization rate, a memory utilization rate, a remaining capacity of a storage device, and a network communication volume of the process monitoring device.

[0009] In order to achieve this object, the process monitoring method of the present invention is a process monitoring method that operates in a process monitoring device having an anomaly detection unit that detects operational abnormalities of the device and an unauthorized process detection unit that detects unauthorized processes, and includes the steps of: the anomaly detection unit detecting operational abnormalities of the device based on predetermined detection criteria; creating a whitelist using first process information of a process in operation when the operational abnormality is not detected; and, when the operational abnormality is detected, acquiring second process information of the process in operation and detecting an unauthorized process based on a comparison result between the first process information and the second process information, wherein the step of detecting the unauthorized process detects a new process that is not listed in the whitelist in the second process information as the unauthorized process based on a comparison result between the time when the operation file of the process in the second process information was generated and a predetermined reference time.

[0010] In addition, the specified reference time may be the earliest creation time of the whitelist, and among the new processes, a process in which the operation file was generated after the earliest creation time of the whitelist may be detected as the unauthorized process.

[0011] Furthermore, among the new processes, a process for which the action file was generated prior to the earliest creation of the whitelist may be added to the whitelist.

[0012] The step of detecting an operational abnormality may detect the operational abnormality based on at least one of a CPU utilization rate, a memory utilization rate, a remaining capacity of a storage device, and a network communication volume of the process monitoring device. Effect of the Invention

[0013] According to the present invention, it is possible to provide a process monitoring device that can reduce the workload when updating a whitelist. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 shows an example of the configuration of a process monitoring device according to an embodiment of the present invention. [Diagram 2] FIG. 2 shows an example of a network configuration using a process monitoring device according to an embodiment of the present invention. [Diagram 3] FIG. 3 shows an example of the configuration of a whitelist according to an embodiment of the present invention. [Figure 4] FIG. 4 shows an operation sequence of the process monitoring method according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, an embodiment of the present invention will be described with reference to the drawings. The present invention is not limited to the embodiment described below.

[0016] <Process monitoring device configuration> Fig. 1 shows an example of the configuration of a process monitoring device according to an embodiment of the present invention. In the example of the configuration in Fig. 1, a process monitoring device 10 configures a network together with another communication device 20. The process monitoring device 10 and the communication device 20 are connected to an external communication network NW via a router 50.

[0017] The process monitoring device 10 and the communication device 20 have a function of executing a process. The process monitoring device 10 has a process monitoring function in addition to the function of executing a process. The communication device 20 can function as the process monitoring device 10 by adding the process monitoring function.

[0018] The process monitoring device 10 acquires processes operating within the device and stores them as a whitelist as a measure against malware from the communication network NW. The process monitoring device 10 is configured to determine whether a new process not included in the whitelist is an unauthorized process and detect the unauthorized process. Note that the whitelist in this embodiment is used to detect unauthorized processes, so that the operation of a new process not included in the whitelist is permitted.

[0019] Since the processes running within a device are frequently updated when installing or updating software, etc., if a new process that is not on the whitelist is running and is legitimate, the whitelist must be updated as necessary, because if the whitelist is not updated, even processes that are running normally will be judged as malicious processes.

[0020] The process monitoring device 10 of the present embodiment is configured to compare process information registered in the whitelist with process information of processes running in the device when an operational abnormality of the device is detected based on the CPU usage rate, etc., and detect an unauthorized process based on the comparison result. If it is determined that the new process is not an unauthorized process, the whitelist is updated by adding the new process.

[0021] In this embodiment, when an abnormality in the operation of the device is detected, an unauthorized process is detected and the result is used to update the whitelist, thereby reducing the workload associated with updating the whitelist compared to updating the whitelist periodically.

[0022] <Process monitoring device configuration> The process monitoring device 10 includes an I / F unit 11, a process execution unit 12, a control unit 13, a storage unit 14, and a display unit 15 as main circuit units.

[0023] <Process execution part> The process execution unit 12 is a circuit for executing processes in the process monitoring device 10, and includes a CPU 12A and a memory 12B for executing the processes. As an increase in unauthorized processes increases the usage rate of the CPU 12A and the memory 12B, the operating status of the CPU 12A and the memory 12B of the process execution unit 12 can be used to detect abnormal operation of the device.

[0024] ​The I / F unit 11 is a circuit for connecting to each communication device in the network and an external communication network. Since the communication devices in the network are subject to cyber attacks via the I / F unit 11, the network traffic via the I / F 11 can be used to detect abnormal operation of the device.

[0025] <Storage section> The memory unit 14 is composed of a storage device such as a hard disk or semiconductor memory. The memory unit 14 stores various processing data and programs used for detecting anomalies and unauthorized processes in the control unit 13. As the number of unauthorized processes increases, the capacity of the memory unit 14 is compressed, so the remaining capacity of the memory unit 14 can be used to detect abnormalities in the operation of the device.

[0026] The main processing data stored in the memory unit 14 include process operation information 14A and a whitelist 14B.

[0027] <Process operation information> The process operation information 14A is data representing information on processes operating within the process monitoring device 10. The process operation information 14A is used when comparing information on the operating process with process information on the whitelist when an abnormal operation of the device is detected.

[0028] The process operation information 14A records time information when an operation file was generated for each process. The time information when an operation file was generated is used to determine whether the process information in operation is an unauthorized process when an abnormal operation of the device is detected.

[0029] <Whitelist> The whitelist 14B holds processes (first process information) that are running in the device when no operational abnormality is detected in the device. This is because it is presumed that processes that are running in a state in which no operational abnormality is detected in the device are not unauthorized processes. For example, the whitelist is created when a network is newly constructed or expanded.

[0030] The whitelist 14B is used to detect unauthorized processes in new processes by comparing with information on processes in operation. Since the whitelist of this embodiment is used to detect unauthorized processes, the operation of a new process that is not on the whitelist is permitted. If the new process is not an unauthorized process, it is added to the whitelist.

[0031] <Program> The program 14P is a program for implementing various processing units used for anomaly detection processing and unauthorized process detection processing in the control unit 13 by cooperating with the CPU of the control unit 13. This program 14P is stored in advance in the storage unit 14 from an external device or a recording medium (neither of which is shown) connected via the I / F unit 11.

[0032] <Control Unit> The control unit 13 has a CPU and its peripheral circuits, and realizes a processing unit for executing anomaly detection processing and unauthorized process detection processing by reading out a program 14P from the storage unit 14 and having it cooperate with the CPU. The main processing units realized by the control unit 13 are anomaly detection unit 13A and unauthorized process detection unit 13B.

[0033] <Anomaly detection section> The abnormality detection unit 13A is configured to detect an abnormal operation of the device based on a predetermined detection criterion. The abnormal operation of the process monitoring device is determined based on the operating status of the process monitoring device 10. For example, the abnormal operation can be detected based on the CPU usage rate of the process execution unit 12, the memory usage rate, the remaining capacity of the storage unit 14, the amount of network communication via the I / F 11, and the like.

[0034] Specifically, it may be determined that an operational abnormality has occurred in the device when at least one of the CPU usage rate of the process execution unit 12, the memory usage rate, the remaining capacity of the storage unit 14, the amount of network communication via the I / F 11, etc., exceeds a predetermined threshold. The conditions for determining whether an operational abnormality has occurred in the device may be appropriately determined depending on the operational status of the network, etc.

[0035] <Unauthorized process detection unit> When the unauthorized process detection unit 13B detects an abnormal operation of the process monitoring device, it acquires process information of the process in operation and detects the unauthorized process based on the comparison result between the process information in operation (second process information) and the process information in the whitelist (first process information).

[0036] Specifically, it is determined whether a new process is an unauthorized process based on a comparison result between the time of generation of the operation file of the new process not on the whitelist and a predetermined reference time. For example, among new processes, a process whose operation file was generated after the earliest creation of the whitelist can be detected as an unauthorized process. The predetermined reference time for determining an unauthorized process is not limited to the earliest creation of the whitelist, and can be appropriately determined according to the confirmation status of the unauthorized process, such as when it is confirmed that no unauthorized process has invaded.

[0037] <Display> The display unit 15 is a processing unit for displaying the operating status of the device and each piece of information stored in the storage unit 14. The display unit 15 is also used to display alert information when an unauthorized process is detected by the unauthorized process detection unit 13B.

[0038] <Process monitoring device operation> The operation of the process monitoring device according to the present embodiment will be described. Fig. 2 shows an example of a network configuration using the process monitoring device according to the embodiment of the present invention. Fig. 3 shows an example of a whitelist configuration according to the embodiment of the present invention.

[0039] 2 is composed of a process monitoring device 10, a communication device 20, a switch 30, and a HUB 40. When a network is newly constructed or expanded, the process monitoring device 10 and the communication device 20 are arranged so that they are connected via the switch 30 and the HUB 40, and the process monitoring device 10, the communication device 20, and the switch 30 are assigned IP addresses for IP communication.

[0040] In this embodiment, the whitelist is created when a network is newly constructed or expanded. The whitelist created when a network is newly constructed or expanded is used when determining whether an active process is an unauthorized process during network operation. The whitelist created when a network is newly constructed or expanded can be updated by adding a new process as necessary during network operation.

[0041] The whitelist in Figure 3 is composed of the following information: [Process ID], [Process Name], [Path], [CPU Usage], and [Memory Usage]. In the configuration example in Figure 3, [a.exe], [abil.exe], [test.exe], and [maru.exe] are saved as the whitelist.

[0042] In this embodiment, for a new process that is not listed on the whitelist and is currently running, it is determined whether the new process is an unauthorized process based on the results of a comparison between the time when the operation file of the new process was created and a specified reference time.

[0043] For example, among new processes, a process whose operation file was created after the earliest creation of the whitelist can be detected as a malicious process because if the operation file had already been created when the whitelist was created, it is presumed not to be a malicious process.

[0044] The predetermined reference time used to determine whether or not a process is an unauthorized process is not limited to the time when the whitelist described above was first created, and can be appropriately determined according to the confirmation status of the unauthorized process, such as when it is confirmed that no unauthorized process has invaded. Therefore, the storage unit 14 is configured to hold time information such as when the whitelist was created or updated, together with the whitelist of FIG. 3, as data of the predetermined reference time.

[0045] <Operation sequence of process monitoring method> 4 is an operation sequence of a process monitoring method according to an embodiment of the present invention. The process monitoring method of this embodiment includes a step in which an anomaly detection unit detects an operation anomaly of the device based on a predetermined detection criterion, a step in which, when no operation anomaly is detected, a whitelist is created using process information of an active process, and, when an operation anomaly is detected, a step in which the process information of the active process is acquired and an unauthorized process is detected based on a comparison result between the process information of the whitelist and the process information at the time of the operation anomaly.

[0046] When no abnormality in the operation of the device is detected, such as when a new network is being constructed, information on the processes in operation is acquired, and a whitelist is created and maintained (steps S1-1, S1-2).

[0047] The operating status of the device, such as the CPU usage rate of the process execution unit, is acquired, and an abnormality in the operation of the device is detected based on the operating status (steps S1-3 and 1-4).

[0048] If an abnormality in the operation of the device is detected (step S1-4: YES), information about the process in operation is obtained and compared with the whitelist to obtain information about the creation of a new process that is not on the whitelist (steps S1-5, S1-6, S1-7).

[0049] The information at the time the new process was created is compared with a predetermined reference time, and if the time the new process was created is before the predetermined reference time (step S1-8: YES), the new process is determined to be not an unauthorized process and is added to the whitelist (step S1-9).

[0050] The creation time of the new process is compared with a predetermined reference time, and if the creation time of the new process is after the predetermined reference time (step S1-8: NO), the new process is determined to be an unauthorized process and an alert is displayed (step S1-10).

[0051] <Effects of this embodiment> In this way, in this embodiment, the whitelist is configured to be updated when an abnormality in the operation of the device is detected, thereby reducing the workload associated with updating the whitelist compared to updating the whitelist periodically.

[0052] <Extended embodiment> Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Explanation of symbols]

[0053] 10...process monitoring device, 11...I / F unit, 12...process execution unit, 13...control unit, 13A...anomaly detection unit, 13B...rogue process detection unit, 14...memory unit, 14A...process operation information, 14B...whitelist, 14P...program, 15...display unit, 20...communication equipment, 30...switch, 40...hub, 50...router, NW...communication network.

Claims

1. an anomaly detection unit that detects an operational anomaly of the device based on a predetermined detection criterion; a whitelist created using first process information of a process in operation when the operational abnormality is not detected; a malicious process detection unit that, when detecting the operation abnormality, acquires second process information of the process in operation and detects a malicious process based on a comparison result between the first process information and the second process information; The unauthorized process detection unit Based on a comparison result between a generation time of an operation file of the process of the second process information and a predetermined reference time, a new process not listed in the whitelist in the second process information is detected as the unauthorized process. Process monitoring equipment.

2. The predetermined reference time is the earliest creation time of the whitelist, Among the new processes, a process in which the action file was generated after the earliest creation of the whitelist is detected as the unauthorized process. The process monitoring device of claim 1 .

3. Among the new processes, a process in which the action file was generated before the earliest creation of the whitelist is added to the whitelist.

3. The process monitoring device according to claim 1 or 2.

4. The abnormality detection unit is The operation abnormality is detected based on at least one of a CPU utilization rate, a memory utilization rate, a remaining capacity of a storage device, and a network communication volume of the process monitoring device. The process monitoring device according to any one of claims 1 to 3.

5. A process monitoring method that operates in a process monitoring device having an abnormality detection unit that detects an abnormality in the operation of a device and an unauthorized process detection unit that detects an unauthorized process, The abnormality detection unit detects an abnormality in the operation of the device based on a predetermined detection criterion; creating a whitelist using first process information of a process in operation when the operational abnormality is not detected; acquiring second process information of the process in operation when the operation abnormality is detected, and detecting an unauthorized process based on a comparison result between the first process information and the second process information; Including, The step of detecting an unauthorized process includes: Based on a comparison result between a generation time of an operation file of the process of the second process information and a predetermined reference time, a new process not listed in the whitelist in the second process information is detected as the unauthorized process. Process monitoring methods.

6. The predetermined reference time is the earliest creation time of the whitelist, Among the new processes, a process in which the action file was generated after the earliest creation of the whitelist is detected as the unauthorized process. The method of claim 5 .

7. Among the new processes, a process in which the action file was generated before the earliest creation of the whitelist is added to the whitelist.

7. The process monitoring method according to claim 5 or 6.

8. The step of detecting an operational abnormality includes: The operation abnormality is detected based on at least one of a CPU utilization rate, a memory utilization rate, a remaining capacity of a storage device, and a network communication volume of the process monitoring device. A process monitoring method according to any one of claims 5 to 7.

Images