Monitoring device, monitoring method, and monitoring program

Abstract

This monitoring device (100) comprises: an instruction information processing unit that acquires task instruction information, which is input into a configuration management tool and is utilized when updating the configuration of equipment to be monitored, and analyzes the task instruction information, thereby extracting content to be changed and a location for which the configuration of the equipment to be monitored is to be changed; and an assessment standard creation unit that, on the basis of the content to be changed and the location for which the configuration of the equipment to be monitored is to be changed, creates an assessment standard which defines an assessment method for detecting an alteration in data pertaining to the equipment to be monitored.

Description

[Technical field]

[0001] The present invention relates to a monitoring device, a monitoring method, and a monitoring program. [Background technology]

[0002] Traditionally, RPM (Red Hat Package Manager) has been used to monitor modifications to files used by a system. RPM performs static analysis on file packages set in the system and generates judgment criteria to be used when monitoring file modifications. There is also a conventional technology that reflects the difference between the state of files before a system configuration change is made and the state of files as a result of the configuration change made by an operator in the judgment criteria. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-008376 A [Patent Document 2] International Publication No. 2021 / 014596 Summary of the Invention [Problem to be solved by the invention]

[0004] However, when using RPM, it is possible to correctly generate judgment criteria corresponding to the file binaries, etc. by performing static analysis on the file package. However, for files that are changed and used after installation, such as configuration files, the judgment criteria do not reflect the results of the installation work, and it was necessary to manually create or update the judgment criteria based on the files that reflect the settings.

[0005] In addition, in conventional technology, the criteria for judgment are based on the difference between the state of the file before the system settings are changed and the state of the file as a result of the settings change performed by the worker, which means that the results of the worker's work are to be trusted, which raises security concerns.

[0006] The present invention has been made in consideration of the above, and has an object to provide a method for producing such a device. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems and achieve the object, the monitoring device of the present invention comprises an instruction information processing unit that acquires work instruction information to be input into a configuration management tool, the work instruction information being used when updating the configuration of a monitored device, and analyzes the work instruction information to extract the points at which the configuration of the monitored device changes and the contents of the changes, and a judgment criterion creation unit that creates judgment criteria that define a judgment method for detecting modification of the data of the monitored device based on the points at which the configuration of the monitored device changes and the contents of the changes. Effect of the Invention

[0008] The present invention allows easy generation of criteria that can be used to monitor file modifications. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of a monitoring system according to the present embodiment. [Diagram 2] FIG. 2 is a functional block diagram showing the configuration of the monitoring device according to the present embodiment. [Diagram 3] FIG. 3 is a diagram illustrating an example of a data structure of the operation information DB. [Figure 4] FIG. 4 is a diagram illustrating an example of the data structure of the update information DB. [Diagram 5] FIG. 5 is a diagram showing an example of work instruction information for software installation. [Figure 6]FIG. 6 is a flow chart (1) showing the processing procedure of the monitoring device. [Figure 7] FIG. 7 is a diagram showing an example of work instruction information for changing a setting value in a file. [Figure 8] FIG. 8 is a flowchart (2) showing the processing procedure of the monitoring device. [Figure 9] FIG. 9 is a diagram illustrating an example of work instruction information for log backup. [Figure 10] FIG. 10 is a flowchart (3) showing the processing procedure of the monitoring device. [Figure 11] FIG. 11 is a diagram showing an example of work instruction information for registering a regular job. [Figure 12] FIG. 12 is a flowchart (4) showing the processing procedure of the monitoring device. [Figure 13] FIG. 13 is a diagram illustrating an example of a computer that executes a monitoring program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, a monitoring device, a monitoring method, and a monitoring program disclosed in the present application will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to the embodiments. EXAMPLES

[0011] Fig. 1 is a diagram showing an example of a monitoring system according to the present embodiment. As shown in Fig. 1, the monitoring system includes servers 10a, 10b, and 10c, and a monitoring device 100. The servers 10a to 10c and the monitoring device 100 are connected to each other via a network 30.

[0012] 1 shows servers 10a to 10c, but other servers and devices may be included in the monitoring system. In the following description, the servers 10a to 10c will be collectively referred to as server 10 where appropriate.

[0013] The server 10 accepts access from a client terminal (not shown) and executes various services. The monitoring system updates the configuration, configuration files, etc. of the server 10 based on work instruction information input to a configuration management tool such as Ansible (registered trademark). The work instruction information includes software installation, update, and deletion, parameter change operations in configuration files, replacement of configuration files, obtaining and updating required files, saving and deleting logs, files, and directories, adding, changing, and deleting accounts, setting up regular jobs, and registering, changing, and deleting services.

[0014] The monitoring device 100 analyzes the work instruction information, selects the scope of monitoring, a judgment method for detecting tampering, and appropriate timing for judgment, and automatically generates judgment criteria that define the correct state of the server 10. The monitoring device 100 monitors the server 10 based on the judgment criteria.

[0015] 2 is a functional block diagram showing the configuration of a monitoring device according to this embodiment. As shown in FIG. 2, the monitoring device 100 includes a communication unit 110, an input unit 120, a display unit 130, a storage unit 140, and a control unit 150.

[0016] The communication unit 110 is a communication interface that transmits and receives various information to and from the server 10 connected via a network 30 or the like. The communication unit 110 is realized by a NIC (Network Interface Card) or the like, and performs communication between the control unit 150 and an external device via a telecommunication line such as a LAN (Local Area Network) or the Internet.

[0017] The input unit 120 is an input interface that accepts various operations from an operator of the monitoring device 100. For example, the input unit 120 is configured with input devices such as a keyboard and a mouse.

[0018] The display unit 130 is an output device that outputs information acquired from the control unit 150, and is realized by a display device such as a liquid crystal display, a printing device such as a printer, or the like.

[0019] The storage unit 140 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 140 has an operation information database (DB) 141, an external vulnerability DB 142, and a change information DB 143.

[0020] The operation information DB 141 holds information on the file to be updated according to the work instruction information and the work content corresponding to the command to perform the update. In the following description, the file to be updated according to the work instruction information is referred to as the "target file." The command to update the file to be updated according to the work instruction information is referred to as the "target command."

[0021] Fig. 3 is a diagram showing an example of the data structure of the operation information DB. As shown in Fig. 3, the operation information DB associates target files, target commands, and operation contents. For example, the operation content corresponding to the target file "httpd" and the target command "apt" is "installation of file."

[0022] The external vulnerability DB 142 holds information on vulnerabilities corresponding to target files. For example, "xy vulnerability, yy vulnerability" and the like are set as vulnerabilities corresponding to the target file "httpd."

[0023] The change information DB 143 holds configuration information of the server 10 to be monitored. Fig. 4 is a diagram showing an example of the data structure of the update information DB. As shown in Fig. 4, the change information DB 143 associates the server 10 (hereinafter, the target server) whose configuration is to be updated based on the work instruction information, the configuration information of the target server, and a determination method. The configuration information of the change information DB 143 includes the configuration of files set in the target server, the file path to each file, the hash value of each file, etc.

[0024] The determination method is set for each type of file set on the target server, and includes an integrity check that checks for configuration matches or mismatches at the binary granularity level, and a configuration check that checks for configuration matches or mismatches on a file-by-file basis.

[0025] Returning to the explanation of Fig. 2, the control unit 150 is realized using a CPU (Central Processing Unit) etc. The control unit 150 has an instruction information processing unit 151, a software analysis unit 152, a change content analysis unit 153, a judgment criterion creation unit 154, a vulnerability judgment unit 155, a device monitoring unit 156, and a judgment result analysis unit 157.

[0026] When the instruction information processing unit 151 acquires work instruction information from the communication unit 110, the input unit 120, etc., it analyzes the work instruction information using the operation information DB 141 and extracts the parts to be changed in the configuration of the server 10 to be monitored and the contents to be changed. For example, the instruction information processing unit 151 extracts the file type to be worked on, the software package to be introduced, and the work contents.

[0027] The software analysis unit 152 determines a judgment method for the target server corresponding to the work content extracted by the instruction information processing unit 151 and the software package, and outputs the method to the judgment criterion creation unit 154 .

[0028] The change content analysis unit 153 uses the change information DB 143 to determine a judgment method corresponding to the file type extracted by the instruction information processing unit 151 , and outputs the method to the judgment criterion creation unit 154 .

[0029] The criterion creation unit 154 creates a criterion using a criterion acquired from the software analysis unit 152 or the change content analysis unit 153. For example, when the criterion creation unit 154 creates a criterion for checking the configuration of files set in the target server on a file-by-file basis when the criterion creation unit 154 creates a criterion for checking the configuration of files set in the target server on a file-by-file basis when the criterion creation unit 154 creates a criterion for converting each file set in the target server into a hash value and comparing the files with an appropriate hash value when the criterion creation unit 154 creates a criterion for converting each file set in the target server into a hash value and comparing the files with the ... creating a criterion for comparing the files with the appropriate hash value when the criterion creation unit 154 creates a criterion for converting each file set in the target server into a hash value and creating a criterion for comparing the files with the appropriate hash value when the criterion creation unit 154 creates a criterion for converting each file set in the target server into a hash

[0030] For example, the judgment criteria include a target server, a target file, a judgment method (configuration check or integrity check) to be performed for each target file, a frequency of performing the configuration check or the integrity check, etc. The judgment criteria also include a set of appropriate configurations for performing the configuration check, a hash value of each file for performing the integrity check, etc.

[0031] In response to a request from the criterion creation unit 154, the vulnerability determination unit 155 acquires vulnerability information related to the introduced software from the external vulnerability DB 142 and outputs it to the criterion creation unit 154. The criterion creation unit 154 updates the criterion based on the vulnerability information. For example, the criterion creation unit 154 optimizes the priority order and frequency of integrity checks according to the risk of the introduced software.

[0032] The device monitoring unit 156 monitors the target server using the judgment criteria. When the judgment criteria include configuration confirmation, the device monitoring unit 156 determines whether or not a set of appropriate configurations set in the judgment criteria matches a set of file configurations of the target server. For example, when the configuration confirmation specified in the judgment criteria is file A1, file A2, and file A3, and the file configuration of the target server is A1, file A3, and file A4, the file configurations do not match.

[0033] When the criterion includes an integrity check, the device monitoring unit 156 checks whether a set of appropriate hash values ​​set in the criterion matches a set of hash values ​​calculated from the configuration of the target server (each set file). For example, even if the configuration check specified in the criterion is file A1, file A2, and file A3, and the file configuration of the target server is A1, file A3, and file A3, and the configuration matches, if the hash value of file A3 in the criterion and the hash value of file A3 in the target server are different, they do not match from the viewpoint of integrity.

[0034] The device monitoring unit 156 performs monitoring based on the judgment criteria, and if the judgment criteria are not met, outputs various information related to the judgment result to the judgment result analysis unit 157.

[0035] The determination result analysis unit 157 acquires information on the determination result from the device monitoring unit 156, and reflects the changed configuration in the change information DB 143.

[0036] Next, a description will be given of an example of processing executed by the monitoring apparatus 100 for each piece of work instruction information. An example of software installation, an example of changing a setting value in a file, an example of log saving, and an example of regular job registration will be described below in that order.

[0037] An example of the processing of the monitoring device 100 when work instruction information for software installation is acquired will be described. Fig. 5 is a diagram showing an example of work instruction information for software installation. In the work instruction information 20a for software installation, "hosts:" specifies the target server "web01_server". "apt:name" specifies the name of the software package to be installed. "state=latest" specifies the latest version.

[0038] When the instruction information processing unit 151 receives the work instruction information 20a, it extracts the target file "httpd" and the target command "apt" from the work instruction information 20a, and identifies the work content "install file" corresponding to the extracted target file and target command from the operation information DB 141. The instruction information processing unit 151 outputs the target server, the identified work content, and the name of the software package to be introduced (httpd) to the software analysis unit 152.

[0039] The software analysis unit 152 determines a judgment method for the target server corresponding to the work content and software package extracted by the instruction information processing unit 151, and outputs the result to the judgment criterion creation unit 154. The judgment method corresponding to the work content and software package may be set in advance, or an existing static analysis tool or the like may be used to identify the judgment method corresponding to the work content and software package. Technology related to existing static analysis tools is described in a patent document (JP Patent Publication No. 2019-008376) and the like.

[0040] The determination method determined by the software analysis unit 152 includes a target server (web01_server), a target file (httpd), a configuration check for the target file, and an integrity check for the target file. The determination method determined by the software analysis unit 152 also includes information on an appropriate configuration set for the target file and a hash value of each file for performing the integrity check.

[0041] The criterion creation unit 154 creates criterion using the judgment method acquired from the software analysis unit 152, and outputs the created criterion to the device monitoring unit 156. The criterion creation unit 154 outputs information on the target file to the vulnerability judgment unit 155, and requests information on the vulnerability of the target file.

[0042] The vulnerability determination unit 155 acquires vulnerability information corresponding to the target file information from the external vulnerability DB 142, and calculates a risk score (low, medium, or high) for the vulnerability. The vulnerability determination unit 155 specifies the risk score using a table that specifies the risk score corresponding to the vulnerability information, and outputs the specified risk score to the determination criterion creation unit 154.

[0043] The above-mentioned criterion creating unit 154 updates the criterion when the risk score received from the vulnerability determining unit 155 is "high". For example, the criterion creating unit 154 sets the frequency of performing the integrity check set in the criterion to a frequency higher than the normal frequency. The criterion creating unit 154 may optimize the priority of the integrity check. The criterion creating unit 154 outputs the updated criterion to the device monitoring unit 156.

[0044] The device monitoring unit 156 monitors the target server using the judgment criteria (or updated judgment criteria). When the judgment criteria include configuration check, the device monitoring unit 156 determines whether or not a set of appropriate configurations set in the judgment criteria matches a set of configurations of the target files of the target server. When the judgment criteria include integrity check, the device monitoring unit 156 determines whether or not a set of appropriate hash values ​​set in the judgment criteria matches a set of hash values ​​calculated from each configuration of the target files of the target server.

[0045] Here, the processing procedure of the monitoring device 100 when work instruction information for software installation is acquired will be described. Fig. 6 is a flowchart (1) showing the processing procedure of the monitoring device. As shown in Fig. 6, the instruction information processing unit 151 of the monitoring device 100 acquires the work instruction information 20a (step S101).

[0046] The instruction information processing unit 151 cooperates with the operation information DB 141 to identify the work content and the installed software package (step S102). The software analysis unit 152 of the monitoring device 100 determines the work content and a determination method corresponding to the installed software package (step S103).

[0047] The criterion creation unit 154 of the monitoring device 100 creates a criterion based on the judgment method (step S104). If the monitoring device 100 does not consider vulnerabilities (step S105, No), the process proceeds to step S108. If the monitoring device 100 considers vulnerabilities (step S105, Yes), the process proceeds to step S106.

[0048] The vulnerability determination unit 155 of the monitoring device 100 acquires vulnerability information of the target file from the external vulnerability DB 142 and identifies a risk score (step S106). The criterion creation unit 154 updates the criterion based on the risk score (step S107).

[0049] The criterion creating unit 154 outputs the criterion to the device monitoring unit 156 (step S108). The device monitoring unit 156 monitors the target server based on the criterion (step S109).

[0050] Next, an example of the processing of the monitoring device 100 when work instruction information for changing a setting value in a file is acquired will be described. Fig. 7 is a diagram showing an example of work instruction information for changing a setting value in a file. In work instruction information 20b for changing a setting value in a file, "hosts:" specifies the target server "web01_server". "lineinfile" specifies the change to the file contents. "regexp:" indicates the current value, and "line:" indicates the changed value.

[0051] When the instruction information processing unit 151 receives the work instruction information 20b, it extracts the target server "web01_server", the target file type (setting file) " / etc / httpd / conf / httpd.conf", and the target commands "lineinfile", "regexp", and "line" from the work instruction information 20b. The instruction information processing unit 151 identifies the work content "setting change" corresponding to the extracted target file type and target command from the operation information DB 141. The instruction information processing unit 151 outputs the target server, the setting file, and the work content (setting change: current value and changed value) to the change content analysis unit 153.

[0052] The instruction information processing unit 151 may recognize the extension of the file written in the path and specify the file type of the operation target file, " / etc / httpd / conf / httpd.conf."

[0053] The change analysis unit 153 identifies the judgment method corresponding to the target server and the setting file by using the change information DB 143. The change analysis unit 153 also obtains the setting file before the setting change from the change information DB 143, and updates the value from the current value to the changed value according to the setting change. The change analysis unit 153 calculates a hash value from the changed setting file. The change analysis unit 153 sets the hash value of the changed setting file as an appropriate hash value for integrity confirmation. The change analysis unit 153 outputs the judgment method to the judgment criterion creation unit 154.

[0054] The criterion creating unit 154 creates a criterion using the judging method acquired from the changes analyzing unit 153 , and outputs the created criterion to the device monitoring unit 156 .

[0055] The device monitoring unit 156 uses the judgment criteria to monitor the configuration file of the target server. When the judgment criteria include a configuration check, the device monitoring unit 156 determines whether or not a set of appropriate configurations set in the judgment criteria matches a set of configurations in the configuration file of the target server. When the judgment criteria include an integrity check, the device monitoring unit 156 determines whether or not a set of appropriate hash values ​​(hash values ​​taking updates into account) set in the judgment criteria matches a set of hash values ​​calculated from each configuration in the configuration file of the target server.

[0056] Here, the equipment monitoring unit 156 performs configuration confirmation and integrity confirmation, and if the configuration files do not match (if modification of the configuration files is detected), it outputs the corresponding target server, information about the modified configuration file, and work instruction information 20b to the judgment result analysis unit 157.

[0057] The determination result analysis unit 157 updates the change information DB 143 based on the information acquired from the device monitoring unit 156. For example, the determination result analysis unit 157 acquires information on the latest setting file from the target server, and updates the information on the setting file of the target server contained in the change information DB 143. The determination result analysis unit 157 may extract the terminal that created the work instruction information 20b from the work instruction information 20b, and display it on the display unit 130 as a confirmation terminal. It is assumed that the work instruction information 20b (as well as other work instruction information) includes information on the terminal that created the work instruction information 20b.

[0058] Here, the processing procedure of the monitoring device 100 when work instruction information for changing a setting value in a file is acquired will be described. Fig. 8 is a flowchart (2) showing the processing procedure of the monitoring device. As shown in Fig. 8, the instruction information processing unit 151 of the monitoring device 100 acquires the work instruction information (step S201). The instruction information processing unit 151 cooperates with the operation information DB 141 to identify the work content and the file type (setting file) of the file to be operated (step S202).

[0059] The change content analysis unit 153 of the monitoring device 100 cooperates with the change information DB 143 to determine the determination method associated with the file type (step S203). The change content analysis unit 153 acquires the setting file from the target server and changes the current value to the changed value (step S204).

[0060] The criterion creating unit 154 of the monitoring device 100 generates a criterion (step S205). The device monitoring unit 156 of the monitoring device 100 determines whether or not a file of the target server has been changed (altered) based on the criterion (step S206).

[0061] If the file of the target server has not been changed (step S207, No), the monitoring device 100 ends the process. On the other hand, if the file of the target server has been changed (step S207, Yes), the determination result analysis unit 157 of the monitoring device 100 updates the change information DB 143 (step S208).

[0062] Next, an example of the processing of the monitoring device 100 when work instruction information for log evacuation is acquired will be described. Fig. 9 is a diagram showing an example of work instruction information for log evacuation. In the work instruction information for log evacuation 20c, "hosts:" specifies the target server "log_server". "dest:" specifies the configuration file " / etc / logrotate.d / router" to be generated. "content:" indicates that the log rotate setting value to be written in the file is specified.

[0063] When the instruction information processing unit 151 receives the work instruction information 20c, it extracts the target server "log_server", the target file type (setting file) " / etc / logrotate.d / router", and the target commands "copy" and "content:" from the work instruction information 20c. The instruction information processing unit 151 identifies the work content "change work by log rotation" corresponding to the extracted target file type and target command from the operation information DB 141. The instruction information processing unit 151 outputs the target server, the setting file, and the work content to the change content analysis unit 153.

[0064] The change content analysis unit 153 identifies a determination method corresponding to the target server and setting file by using the change information DB 143. Taking into account changes due to log rotation, the change content analysis unit 153 adds a setting file for the Logrotate service to the setting files to be monitored in the determination method. Since the logs of the target server are rotated daily, an instruction to store six generations of logs in the target server is added to the determination method. An instruction to identify the log file to be monitored in a specified format (original file name + date added to the end of the log file name in YYYY-MM-DD) is added to the determination method.

[0065] The change analysis unit 153 sets a judgment method for performing configuration check and integrity check for the setting file of the target server. The change analysis unit 153 sets a judgment method for setting configuration check and access source check for the log file of the target server. The change analysis unit 153 outputs the judgment method to the judgment criterion creation unit 154.

[0066] The criterion creating unit 154 creates a criterion using the criterion acquired from the change content analyzing unit 153, and outputs the created criterion to the device monitoring unit 156. The criterion creating unit 154 generates a criterion for the setting file and a criterion corresponding to the log file name after rotation for checking the log file configuration. For example, the log file name after rotation is predicted to be the original file name + date based on the information included in the criterion. Note that, in order to deal with file names that change after rotation, the criterion may be generated so that the date portion at the end is simply ignored and only the original file name portion is monitored.

[0067] The device monitoring unit 156 monitors the target server using the judgment criteria. When the judgment criteria include a configuration check, the device monitoring unit 156 determines whether or not a set of appropriate configurations set in the judgment criteria matches a set of configurations of the target files of the target server. When the judgment criteria include an integrity check, the device monitoring unit 156 determines whether or not a set of appropriate hash values ​​set in the judgment criteria matches a set of hash values ​​calculated from each configuration of the target files of the target server.

[0068] Here, the processing procedure of the monitoring device 100 when work instruction information for log evacuation is acquired will be described. Fig. 10 is a flowchart (3) showing the processing procedure of the monitoring device. As shown in Fig. 10, the instruction information processing unit 151 of the monitoring device 100 acquires the work instruction information (log evacuation) 20c (step S301).

[0069] The instruction information processing unit 151, in cooperation with the operation information DB 141, identifies the operation content and the file type (setting file) of the operation target file (step S302). The change content analysis unit 153 of the monitoring device 100, in cooperation with the change information DB 143, determines the judgment method (step S303).

[0070] The criterion creation unit 154 of the monitoring device 100 generates a criterion for a setting file and a criterion for checking a log file configuration (step S304). The device monitoring unit 156 of the monitoring device 100 determines whether or not a file of a target server has been changed (altered) based on the criterion (step S305).

[0071] Next, an example of the processing of the monitoring device 100 when work instruction information for periodic job registration is acquired will be described. Fig. 11 is a diagram showing an example of work instruction information for periodic job registration. In work instruction information 20d for periodic job registration, "hosts:" specifies the target server "file_server". "cron:" indicates periodic execution, "minute:" and "hour:" indicate the execution timing, and "job:" indicates the target command "cron" to be executed. Furthermore, the "curl" command in the job indicates that a file will be downloaded.

[0072] When the instruction information processing unit 151 receives the work instruction information 20d, it extracts the target server "file_server", the target file " / etc / crontab", and the target commands "cron" and "curl:" from the work instruction information 20b. The instruction information processing unit 151 identifies the work content "setting change, file download, periodic execution" corresponding to the type of the extracted target file and the target command from the operation information DB 141. The instruction information processing unit 151 outputs the target server, the setting file, and the work content (setting change, file download, periodic execution) to the change content analysis unit 153.

[0073] The change analysis unit 153 identifies a determination method corresponding to the target server and the work content by using the change information DB 143. For example, the change analysis unit 153 identifies the change content of the cron setting and periodic execution (file download). The change analysis unit 153 generates a determination method in which the configuration check and the integrity check are performed for the setting file that is the target of the cron setting, and the downloaded file is excluded before the cron execution and the configuration check is performed after the cron execution. The change analysis unit 153 may additionally set, in the determination method, the corresponding downloaded file in accordance with the timing of the cron execution of the target server, and the integrity check is performed using the hash value of the downloaded file.

[0074] The criterion creating unit 154 creates a criterion using the criterion acquired from the change content analyzing unit 153, and outputs the created criterion to the device monitoring unit 156. The criterion creating unit 154 generates a criterion for a configuration file that is the subject of cron settings, and a criterion for a downloaded file. The criterion creating unit 154 may acquire the corresponding downloaded file in accordance with the timing of cron execution of the target server, and may reflect in the criterion that integrity check is performed using the hash value of the downloaded file.

[0075] The device monitoring unit 156 monitors the target server using the judgment criteria. When the judgment criteria include a configuration check, the device monitoring unit 156 determines whether or not a set of appropriate configurations set in the judgment criteria matches a set of configurations of the target files of the target server. When the judgment criteria include an integrity check, the device monitoring unit 156 determines whether or not a set of appropriate hash values ​​set in the judgment criteria matches a set of hash values ​​calculated from each configuration of the target files of the target server.

[0076] Here, since it is assumed that the target server periodically executes cron while the device monitoring unit 156 is monitoring the target server and the contents of the file change when the file is downloaded, the downloaded file may be set in advance as an exception to the judgment. Note that, as described above, when the judgment criteria reflect the hash value of a file that is periodically downloaded, the device monitoring unit 156 may check the integrity of the downloaded file based on the judgment criteria.

[0077] At this time, depending on the timing of the reflection in the judgment criteria and the monitoring in the target server, it is expected that the judgment result will be NG (alteration of the file contents has been detected). In this case, after receiving NG, the judgment result analysis unit 157 cooperates with the change content analysis unit 153 to obtain the file downloaded at the time of regular execution, and compares the integrity check result (hash value) at the time of NG with the hash value of the downloaded file. If the two hash values ​​match, the judgment criteria creation unit 154 updates the judgment criteria with that hash value and passes it to the device monitoring unit 156. The device monitoring unit 156 performs monitoring based on the new judgment criteria.

[0078] That is, when it is determined that the configuration of the monitored device changes periodically, the criterion creating unit 154 creates a new criterion that reflects the changed configuration.

[0079] Here, the processing procedure of the monitoring device 100 when work instruction information for regular job registration is acquired will be described. Fig. 12 is a flowchart (4) showing the processing procedure of the monitoring device. As shown in Fig. 12, the instruction information processing unit 151 of the monitoring device 100 acquires the work instruction information (regular job registration) 20d (step S401).

[0080] The instruction information processing unit 151 cooperates with the operation information DB 141 to identify the work content (update work, periodic execution) (step S402). The change content analysis unit 153 of the monitoring device 100 cooperates with the change information DB 143 to determine the determination method (step S403).

[0081] The criterion creating unit 154 of the monitoring device 100 generates a criterion for the configuration file and a criterion for checking the periodic execution contents (step S404). The device monitoring unit 156 of the monitoring device 100 monitors whether the file of the target server has been changed (altered) based on the criterion (step S405).

[0082] Next, the effects of the monitoring device 100 according to this embodiment will be described. The monitoring device 100 analyzes work instruction information, selects the scope of monitoring, a judgment method for detecting alteration, and appropriate timing for judgment, and automatically generates judgment criteria that define the correct state of the server 10. The monitoring device 100 monitors the server 10 based on the judgment criteria. This makes it possible to easily generate judgment criteria to be used for monitoring file alterations, and to appropriately perform monitoring.

[0083] When it is determined that the configuration of the monitored device changes periodically, the monitoring device 100 creates a new judgment criterion that reflects the changed configuration. This makes it possible to detect alterations even if the configuration of the monitored server 10 changes periodically.

[0084] Furthermore, the above-described mechanism makes it possible to automatically perform monitoring that reflects the contents of the configuration work immediately after the configuration work is performed using the configuration management tool.

[0085] The change content analysis unit 153 of the monitoring device 100 may further execute the following process in cooperation with the change information DB. When the change content analysis unit 153 acquires information on a certain setting file from the instruction information processing unit 151, it acquires information on the setting files of each target server recorded in the change information 143 and identifies the configuration of the common part. The change content analysis unit 153 outputs information on a judgment method for performing a configuration check of the configuration of the common part to the judgment criteria creation unit 145, and the judgment criteria creation unit 154 creates judgment criteria for detecting such common part modification. This makes it possible to create judgment criteria based on highly reliable setting files used by many servers 10.

[0086] Here, an example of a computer that executes a monitoring program will be described. Fig. 13 is a diagram showing an example of a computer that executes a monitoring program. A computer 1000 has, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. Each of these components is connected by a bus 1080.

[0087] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052. The video adapter 1060 is connected to, for example, a display 1061.

[0088] Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each piece of information described in the above embodiments is stored in the hard disk drive 1031 or memory 1010, for example.

[0089] The monitoring program is stored in the hard disk drive 1031, for example, as a program module 1093 in which commands to be executed by the computer 1000 are written. Specifically, the hard disk drive 1031 stores the program module 1093 in which each process executed by the monitoring device 100 described in the above embodiment is written.

[0090] Furthermore, data used for information processing by the monitoring program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-mentioned procedures.

[0091] Note that the program module 1093 and program data 1094 related to the monitoring program are not limited to being stored in the hard disk drive 1031, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 related to the monitoring program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0092] Although the embodiment to which the invention made by the present inventor is applied has been described above, the present invention is not limited by the description and drawings which form a part of the disclosure of the present invention according to the present embodiment. In other words, other embodiments, examples, operation techniques, etc. made by those skilled in the art based on the present embodiment are all included in the scope of the present invention. [Explanation of symbols]

[0093] 100 Monitoring equipment 110 Communications Department 120 Input section 130 Display section 140 Storage section 141 Operation information DB 142 External vulnerability DB 143 Change Information DB 150 Control section 151 Instruction information processing unit 152 Software Analysis Department 153 Change Content Analysis Section 154 Criteria Creation Department 155 Vulnerability determination section 156 Equipment Monitoring Department 157 Judgment result analysis section

Claims

1. an instruction information processing unit that acquires work instruction information to be input to a configuration management tool, the work instruction information being used when updating a configuration of a monitored device, and extracts a portion of the configuration of the monitored device that is to be changed and a content of the change by analyzing the work instruction information; a vulnerability determination unit that acquires vulnerability information corresponding to file information of the monitoring target device from a storage unit that stores vulnerability information for files, and calculates a vulnerability risk score using the vulnerability information; a criterion creation unit that creates a criterion including a determination method for detecting alteration of data of the monitored device and a frequency of performing the determination method based on the location of the change in the configuration of the monitored device and the change content and the risk score; A monitoring device comprising:

2. The monitoring device described in claim 1, characterized in that when it is determined by analyzing the work instruction information that the configuration of the monitored equipment changes periodically, the judgment criteria creation unit recreates the judgment criteria to reflect the changed configuration.

3. The monitoring device described in claim 1, further comprising an update content analysis unit that compares configuration information of multiple monitored devices and identifies common parts among the multiple configuration information, and the judgment criteria creation unit further creates judgment criteria that define a judgment method for detecting modifications to the common parts among the multiple configuration information.

4. 4. The monitoring device according to claim 1, further comprising a device monitoring section that detects alteration of data in the monitored device based on the judgment criteria.

5. an instruction information processing step of acquiring work instruction information to be input to a configuration management tool, the work instruction information being used when updating a configuration of a monitored device, and analyzing the work instruction information to extract the location and content of the change in the configuration of the monitored device; a vulnerability determination step of acquiring vulnerability information corresponding to the file information of the monitoring target device from a storage unit that stores vulnerability information for files, and calculating a vulnerability risk score using the vulnerability information; a criterion creating step of creating a criterion including a method for detecting alteration of data of the monitored device and a frequency of performing the method, based on the location of the change in the configuration of the monitored device and the change content and the risk score; A monitoring method comprising:

6. an instruction information processing step of acquiring work instruction information to be input to a configuration management tool, the work instruction information being used when updating a configuration of a monitored device, and analyzing the work instruction information to extract a portion of the configuration of the monitored device that will be changed and the contents of the change; a vulnerability determination step of acquiring vulnerability information corresponding to the file information of the monitoring target device from a storage unit that stores vulnerability information for files, and calculating a vulnerability risk score using the vulnerability information; a criterion creating step of creating a criterion including a determination method for detecting alteration of data of the monitored device and a frequency of performing the determination method, based on the location and content of the change in the configuration of the monitored device and the risk score; A monitoring program that causes a computer to execute the following.

Images