Information processing device, information processing method, and information processing program

Abstract

To achieve immediate incident response and cost reduction.SOLUTION: An information processing device 100 includes: an acquisition unit 121 for acquiring a security log which is information on unauthorized communication stored in an upper-level NW device that is a device configuring an overlay network, an authentication log stored in a cloud server, and a communication log stored in a lower-level NW device that is a device configuring an underlay network; an identification unit 123 for, when a connection source IP address missing in the communication log acquired by the acquisition unit 121 is present in the authentication log and when information on access that is not permitted to be used from the connection source IP address is present in the security log, identifying the information on the access as unauthorized communication; and a blocking instruction unit 124 for instructing to block the unauthorized communication identified by the identification unit 123.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing method, and an information processing program. [Background technology]

[0002] Conventionally, incident management using log information has been performed. For example, the log information is analyzed to grasp the damage situation from information such as the source of the incident, the communication destination, and the authentication history. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] ICT Glossary SIEM, [Retrieved June 20, 2023], Internet (https: / / www.ntt-west.co.jp / business / glossary / words-00223.html) Summary of the Invention [Problem to be solved by the invention]

[0004] In conventional technologies, there is a problem that it is difficult to respond to incidents quickly while keeping costs down. For example, since it is necessary to compare multiple log information, the analysis requires a lot of time and effort. In addition, in order to solve problems as quickly as possible, measures that ignore costs may be taken.

[0005] The present invention has been made in consideration of the above, and has an object to provide an information processing device, an information processing method, and an information processing program that can realize rapid incident response and cost reduction. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the object, the information processing device of the present invention is characterized in that it has an identification unit that identifies information of access as unauthorized communication when a source IP address that does not exist in a communication log stored by a lower NW (network) device, which is a device constituting an underlay network, is present in the authentication log stored by the cloud server and is information regarding authentication for preventing unauthorized logins made in response to an authentication request accepted by a cloud server, and when the source IP address is present in the authentication log stored by the cloud server and information regarding access that is not permitted to be used from the source IP address is present in a security log, which is information regarding unauthorized communications detected and stored by an upper NW device, which is a device constituting an overlay network, and a blocking instruction unit that instructs to block the unauthorized communication identified by the identification unit. Effect of the Invention

[0007] According to the present invention, it is possible to realize a rapid incident response and a reduction in costs. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram for explaining the prior art. [Diagram 2] FIG. 2 is a diagram illustrating an example of the configuration of the information processing device according to the embodiment. [Diagram 3] FIG. 3 is a diagram for explaining an outline of the processing performed by the information processing device according to the embodiment. [Figure 4] FIG. 4 is a diagram for explaining an outline of the processing performed by the information processing device according to the embodiment. [Diagram 5] FIG. 5 is a diagram for explaining an outline of the processing performed by the information processing device according to the embodiment. [Figure 6] FIG. 6 is a diagram for explaining an outline of the processing performed by the information processing device according to the embodiment. [Figure 7] FIG. 7 is a flowchart showing an example of a flow of processing by the information processing device according to the embodiment. [Figure 8]FIG. 8 is a diagram illustrating an example of a computer that executes an information processing program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, with reference to the drawings, an embodiment of an information processing device, an information processing method, and an information processing program according to the present application will be described in detail. Note that the present invention is not limited to the embodiment. In addition, in the description of the drawings, the same parts are denoted by the same reference numerals, and duplicated explanations will be omitted.

[0010] [Prior Art] First, the conventional technology will be described with reference to Fig. 1. Fig. 1 is a diagram for explaining the conventional technology. In the following, a device constituting an overlay network will be referred to as an upper NW device, and a device constituting an underlay network will be referred to as a lower NW device. Here, the upper NW device refers to, for example, a cloud proxy server or a UTM (Unified Threat Management). Also, the lower NW device refers to, for example, network equipment such as a DPI (Deep Packet Inspection), a router, or a switch.

[0011] Previous security measures divided networks into a trusted "inside" and an untrusted "outside," and measures were taken at the border between these two locations. For example, an internal network would be an in-house LAN (Local Area Network) or a data center connected via a VPN (Virtual Private Network), while an external network would be the Internet. For example, measures taken at the border include installing security devices such as firewalls, proxies, and IDS (Intrusion Detection System) / IPS (Intrusion Prevention System) at the border to block cyber attacks from outside by monitoring and controlling communications.

[0012] These conventional security measures are based on the premise that the data and systems to be protected are inside the network. However, with the spread of cloud computing, it is not uncommon to find that things to be protected are on the outside, on the Internet. As the objects to be protected are now scattered in various places, the boundaries have become blurred, and it is becoming difficult to take sufficient measures using conventional thinking.

[0013] This is why the idea of ​​zero trust is becoming more widespread. Zero trust security services implement various security measures based on the premise that all communications are not trusted. Specifically, this includes encrypting communication paths that are not related to whether they are inside or outside the network, strengthening user authentication by using multi-factor authentication, and comprehensive log monitoring of networks and the various devices connected to them. Many security solutions to realize zero trust have already appeared. For example, EDR is being installed, which enables early detection and response to cyber attacks by monitoring client devices and analyzing logs.

[0014] Under such circumstances, incident management using log information has been conventionally performed. For example, by analyzing the log information, the damage situation is grasped from information such as the source of the incident, the communication destination, and the authentication history.

[0015] However, in the conventional technology, there is a problem that it is difficult to respond to incidents quickly while keeping costs down. For example, when an incident occurs, it is necessary to collect log information such as the source, communication destination, and authentication history stored in upper and lower network devices, and accurately grasp the damage caused by the incident. However, it is necessary to compare and analyze log information that is not integrated by device or ID (identification) unit, which requires a lot of time and effort. In addition, there are cases where measures that ignore costs are taken in order to solve the problem quickly.

[0016] Therefore, the information processing device 100 according to the embodiment has an acquisition unit 121 that acquires a security log, which is information on unauthorized communications stored in an upper network device that is a device constituting an overlay network, an authentication log stored in a cloud server, and a communication log stored in a lower network device that is a device constituting an underlay network, an identification unit 123 that identifies the information on the access as unauthorized communication when a source IP address that is not present in the communication log acquired by the acquisition unit 121 is present in the authentication log and when information on access that is not permitted to be used from the source IP address is present in the security log, and a blocking instruction unit 124 that instructs blocking of the unauthorized communication identified by the identification unit 123.

[0017] This configuration provides the benefits of rapid incident response and reduced costs.

[0018] In addition, the information processing system 1, which is a system including the information processing device 100, provides a zero trust security service unique to a line operator (carrier), in which the underlay network and overlay network work together to provide defense against the ICT (Information and Communication Technology) environment, which is becoming increasingly complex and posing increasing cyber risks due to new working styles such as remote work and new business expansion through the use of IoT (Internet of Things), etc.

[0019] The information processing system 1 provides a secure NaaS (Network as a Service) type ICT service in which the functions of the overlay network and the underlay network are closely integrated. Companies that use the services of this information processing system 1 can easily start, change, and cancel the services of this information processing system 1 instantly by applying through the management portal site, without having to spend costs on outsourcing to an IT (Information Technology) vendor or on network design, making it possible to reduce costs from design to operation.

[0020] In the information processing system 1, the overlay network and the underlay network are provided by the same provider. Also, a user of the information processing system 1 can flexibly use the system by, for example, using only the overlay network and using another company's underlay network.

[0021] [Configuration of information processing device] Next, the configuration of the information processing device 100 will be described with reference to Fig. 2. As shown in Fig. 2, the information processing device 100 has a communication unit 110, a control unit 120, and a storage unit 130. Note that each of these units may be held in a distributed manner in a plurality of devices. The processing of each of these units will be described below.

[0022] The communication unit 110 is realized by a NIC (Network Interface Card) or the like, and enables communication between the control unit 120 and an external device via an electric communication line such as a LAN or the Internet. For example, the communication unit 110 enables communication between the control unit 120 and a higher-level NW device or a lower-level NW device.

[0023] The storage unit 130 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. Information stored in the storage unit 130 includes, for example, information on authentication (hereinafter, appropriately referred to as an "authentication log" or "cloud log"), information on security (hereinafter, appropriately referred to as a "security log"), information on communication (hereinafter, appropriately referred to as a "communication log" or "NW log"), information on unauthorized communication, information on a higher-level NW device, information on a lower-level NW device, other information necessary for identifying unauthorized communication, and other information necessary for blocking unauthorized communication.

[0024] Here, the security log is, for example, a log related to unauthorized communication detected by a higher-level NW device. The authentication log is, for example, a log related to an authentication request accepted by a cloud server. The communication log is, for example, flow data of each network device that is a lower-level NW device.

[0025] Additionally, authentication-related information includes, for example, the date and time when authentication was requested, ID, source IP address and port, authentication result, etc. Additionally, security-related information includes, for example, the date and time when suspicious communications suspected to be unauthorized communications detected by the cloud proxy were detected, the type of detection, destination IP address and port, and source IP address and port.

[0026] The information related to the communication includes, for example, the date and time of each communication, the destination IP address and port, the source IP address and port, the protocol, the number of transferred bytes, etc. The information stored in the storage unit 130 is not limited to the above-mentioned examples.

[0027] The control unit 120 is realized using a CPU (Central Processing Unit), an NP (Network Processor), an FPGA (Field Programmable Gate Array), etc., and executes a processing program stored in a memory. As shown in Fig. 2, the control unit 120 has an acquisition unit 121, an output unit 122, an identification unit 123, and a cutoff instruction unit 124. Each unit of the control unit 120 will be described below.

[0028] The acquisition unit 121 acquires a security log, which is information on unauthorized communications stored in a higher-level NW device, an authentication log stored in a cloud server, and a communication log stored in a lower-level NW device. For example, the acquisition unit 121 acquires information such as detection date and time, detection type, destination IP address and port, and source IP address and port as the security log stored in the higher-level NW device, information such as date and time, ID, source IP address and port, and authentication result as the authentication log stored in the cloud server, and information such as date and time, destination IP address and port, source IP address and port, protocol, and number of transferred bytes as the communication log stored in the lower-level NW device.

[0029] The output unit 122 outputs information obtained by matching the security log, authentication log, and communication log acquired by the acquisition unit 121. For example, the output unit 122 matches and displays the authentication-related information, security-related information, and communication-related information acquired by the acquisition unit 121 for each terminal or for each identification information.

[0030] The identification unit 123 identifies unauthorized communication using the authentication information, security information, and communication information acquired by the acquisition unit 121. For example, when an IP address that does not exist in the communication information exists in the authentication information and information on access that is not permitted to be used from the IP address exists in the security information, the identification unit 123 identifies the access information as unauthorized communication. Here, "not permitted" means that the IP address is not set as an IP address that is permitted to access.

[0031] For example, when the IP address "192.0.2.222" that does not exist in the communication information among the information acquired by the acquisition unit 121 is present in the authentication information, and when the security information contains information about access that is not permitted to be used from the IP address "192.0.2.222", the identification unit 123 identifies the access information as unauthorized communication.

[0032] For example, the identification unit 123 compares the source IP address included in the security log with the source IP address included in the communication log, and determines whether or not log information in which the source IP address included in the security log is the same as the source IP address included in the communication log is present, and compares the source IP address included in the security log with the source IP address included in the authentication log and determines whether or not log information in which the source IP address included in the security log is the same as the source IP address included in the authentication log is present.If it is determined as a result of the determination that log information in which the source IP address included in the security log is the same as the source IP address does not exist in the communication log and log information in which the source IP address included in the security log is the same as the source IP address included in the authentication log is present, the identification unit 123 identifies the log information of the source IP address included in the security log as unauthorized communication.

[0033] More specifically, the identification unit 123, for example, first compares the source IP address included in the security log with the source IP address information included in the communication log, and determines whether or not log information in the communication log has a source IP address that is the same as the source IP address "192.0.2.222" included in the security log.

[0034] Next, the identification unit 123 compares the source IP address included in the security log with the source IP address information included in the authentication log, and determines whether or not there is log information in the authentication log whose source IP address is the same as the source IP address "192.0.2.222" included in the security log.

[0035] As a result, the identification unit 123 determines that there is no log information in the communication log whose source IP address is the same as the source IP address "192.0.2.222" included in the security log, and if it determines that there is log information in the authentication log whose source IP address is the same as the source IP address "192.0.2.222" included in the security log, it identifies the following log information for the source IP address "192.0.2.222" included in the security log as unauthorized communication: "Detection date and time: 2023 / 1 / 23 17:59:38, Detection type: Storage service access, Destination IP: Port: 203.0.113.111:443, Source IP: Port: 192.0.2.222:11663."

[0036] The cut-off instruction unit 124 instructs to cut off the unauthorized communication identified by the identification unit 123. For example, the cut-off instruction unit 124 instructs to cut off the unauthorized communication by using identification information associated with the unauthorized communication identified by the identification unit 123. For example, the cut-off instruction unit 124 cuts off the unauthorized communication by instructing an external device (such as a higher-level NW device) to cut off communication whose destination or source is an account indicated by identification information (ID) "1234567" associated with the unauthorized communication identified by the identification unit 123.

[0037] Also, for example, the cut-off instruction unit 124 may instruct the upper NW device to cut off the unauthorized communication by using information on the IP address of the unauthorized communication identified by the identification unit 123. More specifically, the cut-off instruction unit 124 may instruct the upper NW device to cut off the communication to the destination IP address "203.0.113.111" of the unauthorized communication identified by the identification unit 123. Also, for example, the cut-off instruction unit 124 may instruct the upper NW device to cut off the communication from the source IP address "192.0.2.222" of the unauthorized communication identified by the identification unit 123.

[0038] [Outline of processing by information processing device] Next, the process performed by the information processing device 100 will be described with reference to Figures 3 to 5. Figures 3 to 5 are diagrams for explaining an overview of the process performed by the information processing device 100.

[0039] The acquisition unit 121 acquires a security log, which is information on unauthorized communication stored in a higher-level NW device, an authentication log stored in a cloud server, and a communication log stored in a lower-level NW device. In the example of FIG. 3, the acquisition unit 121 acquires a security log, an authentication log (cloud log), and a communication log (NW log). Here, the security log is a log of information detected by a cloud proxy or the like of a higher-level NW device (e.g., suspicious communication such as access to an external storage service from an unauthorized IP address), and includes information such as detection date and time, detection type, destination IP:Port, and origin IP:Port. The authentication log is a log of authentication information, and includes information such as date and time, ID, origin IP:Port, and authentication result. In addition, the communication log is a communication log of an underlay NW, and includes information such as date and time, destination IP:Port, origin IP:Port, protocol, and number of transferred bytes. In the example of FIG. 4, FIG. 4(1) corresponds to the communication log, FIG. 4(2) corresponds to the security log, and FIG. 4(3) corresponds to the authentication log.

[0040] Then, output unit 122 collates and outputs the information of the cloud log, security log, and NW log acquired by acquisition unit 121. For example, output unit 122 collates and displays the information of the cloud log, security log, and NW log for each IP address or identification information.

[0041] Furthermore, the information processing device 100 identifies and blocks unauthorized communications using each piece of information. In the example of Fig. 4, when an IP address "192.0.2.222" that does not exist in a communication log (Fig. 4(1)) as information related to communications is present in an authentication log (Fig. 4(3)) as information related to authentication, and information on access that is not permitted to be used from the IP address "192.0.2.222" is present in a security log (Fig. 4(2)) as information related to security, the identification unit 123 suspects unauthorized login and identifies the information on the access as unauthorized communication.

[0042] Next, the identification of unauthorized communication by the identification unit 123 will be described with reference to Fig. 5. Fig. 5(1) shows information recorded in a security log. Fig. 5(2) shows information recorded in a communication log. Fig. 5(3) shows information recorded in an authentication log.

[0043] For example, the identification unit 123 first compares the security log with the communication log and determines whether or not there is a communication log in which the source IP address included in the security log is the same as the source IP address. More specifically, the identification unit 123 compares the source IP address included in the security log shown in Fig. 5(1) with the source IP address information included in the communication log shown in Fig. 5(2), and determines that a communication in which the source IP address is the same as the source IP address "192.0.2.222" included in the security log does not exist in the communication log within a certain period from the detection date and time "2023 / 1 / 23 17:59:38" of the detected security log information.

[0044] Next, the identifying unit 123 compares the security log with the authentication log and determines whether or not there is an authentication log in which the source IP address included in the security log is the same as the source IP address. More specifically, the identifying unit 123 compares the source IP address included in the security log shown in Fig. 5(1) with the source IP address information included in the authentication log shown in Fig. 5(3) and determines that a communication in which the source IP address is the same as the source IP address "192.0.2.222" included in the security log exists in the authentication log within a certain period from the detection date and time "2023 / 1 / 23 17:59:38" of the detected security log information.

[0045] Then, when there is no communication log with the same source IP address as the detected security log and there is an authentication log, the identifying unit 123 identifies the detected information as unauthorized communication. More specifically, since the same log information as the source IP address "192.0.2.222" included in the security log shown in Fig. 5(1) does not exist in the communication log shown in Fig. 5(2) but exists in the security log shown in Fig. 5(3), the identifying unit 123 identifies the log information "detection date and time: 2023 / 1 / 23 17:59:38, detection type: storage service access, destination IP: Port: 203.0.113.111:443, source IP: Port: 192.0.2.222:11663" of the source IP address "192.0.2.222" included in the security log shown in Fig. 5(1) as unauthorized communication.

[0046] Returning to the description of Fig. 4, the cut-off instruction unit 124 instructs the upper NW device to freeze the ID and cut off the unauthorized communication by setting the upper NW device not to permit authentication from the ID associated with the unauthorized communication identified by the identification unit 123. More specifically, as shown in Fig. 4(4), the cut-off instruction unit 124 freezes the ID and instructs the cut-off of the unauthorized communication by setting the upper NW device not to permit authentication from the ID "1234567" associated with the unauthorized communication identified by the identification unit 123.

[0047] In this way, when the information processing device 100 detects access to an external storage service that is not permitted to be used from a source IP address that is not present in the communication log of the underlay network but is present in an authentication log from a different source IP address such as an external network, and the source IP address is not present in the communication log of the underlay network, the information processing device 100 suspects unauthorized login from a location other than the underlay network and locks the account.

[0048] At this time, the cutoff instruction unit 124 may instruct to cut off the unauthorized communication by using information on the IP address of the unauthorized communication identified by the identification unit 123, in addition to freezing the ID, to cut off the unauthorized communication. More specifically, the cutoff instruction unit 124 instructs the upper NW device to cut off communication to the destination IP address "203.0.113.111" of the unauthorized communication identified by the identification unit 123, thereby instructing the upper NW device to cut off communication from the source IP address "192.0.2.222" of the unauthorized communication identified by the identification unit 123, thereby instructing the upper NW device to cut off communication.

[0049] Here, the matching process by the output unit 122 will be described with reference to FIG. 6. FIG. 6 shows matching between an authentication log and a security log. FIG. 6(1) to (4) are the same as FIG. 4(1) to (4). To explain using the example of FIG. 6, for example, the output unit 122 obtains the source IP address (in FIG. 6(2)) "192.0.2.222" and the detection date and time "2023 / 1 / 23 17:59:38" related to unauthorized communication contained in the security log (FIG. 6(2)), and matches the information in the authentication log (FIG. 6(3)) using the source IP address "192.0.2.222" as a key. Then, as a result of the matching, the output unit 122 extracts information on the ID "1234567" corresponding to the source IP address "192.0.2.222" included in the authentication log and the authentication date and time "2023 / 1 / 23 17:59:30" when the authentication was performed.

[0050] Then, as shown in Fig. 6(5), the output unit 122 outputs the extracted information, that is, ID "1234567", source IP address "192.0.2.222", authentication date and time (described as "authentication" in Fig. 6) "2023 / 1 / 23 17:59:30", and detection date and time (described as "security" in Fig. 6) "2023 / 1 / 23 17:59:38", as one record. In other words, by outputting the information matched by the process described above, the output unit 122 can output information that can be confirmed by comparing the detection result of unauthorized communication based on the security log with the authentication result based on the authentication log, thereby reducing the burden on the system administrator when analyzing the cause of the incident, and achieving a quick incident response and cost reduction.

[0051] [flowchart] Next, a flow of processing by the information processing device 100 will be described with reference to Fig. 7. Note that the steps below may be executed in a different order, and some processing may be omitted.

[0052] First, the acquisition unit 121 acquires a security log, which is information on unauthorized communications stored in a higher-level NW device, an authentication log stored in a cloud server, and a communication log stored in a lower-level NW device (step S101). For example, the acquisition unit 121 acquires information such as detection date and time, detection type, destination IP address and port, and source IP address and port as the security log stored in the higher-level NW device, information such as date and time, ID, source IP address and port, and authentication result as the authentication log stored in the cloud server, and information such as date and time, destination IP address and port, source IP address and port, protocol, and number of transferred bytes as the communication log stored in the lower-level NW device.

[0053] Next, the output unit 122 outputs information obtained by matching the information related to authentication, the information related to security, and the information related to communication acquired by the acquisition unit 121 (step S102). For example, the output unit 122 matches the information related to authentication, the information related to security, and the information related to communication acquired by the acquisition unit 121 for each piece of identification information, and displays the result.

[0054] Then, the identification unit 123 determines whether or not a communication log exists in which the source IP address of the security log is the same as the source IP address of the security log (step S103). If the identification unit 123 determines that a communication log exists in which the source IP address of the security log is the same as the source IP address of the security log (step S103 "YES"), the information processing device 100 ends the process.

[0055] On the other hand, if the identification unit 123 determines that there is no communication log whose source IP address is the same as the security log's source IP address (step S103 "NO"), the identification unit 123 determines whether there is an authentication log whose source IP address is the same as the security log's source IP address (step S104).

[0056] Here, if the identifying unit 123 determines that there is no authentication log in which the source IP address in the security log is the same as the source IP address (step S104 "NO"), the information processing device 100 ends the process. On the other hand, if the identifying unit 123 determines that there is an authentication log in which the source IP address in the security log is the same as the source IP address (step S104 "YES"), the identifying unit 123 determines that the source IP address that is not present in the communication log acquired by the acquiring unit 121 is present in the authentication log and that the security log contains information on access that is not permitted to be used from the source IP address, and identifies the information on the access as unauthorized communication (step S105).

[0057] Then, the cut-off instruction unit 124 instructs the identification unit 123 to cut off the unauthorized communication identified by the identification unit 123 (step S106). For example, the cut-off instruction unit 124 uses identification information included in the unauthorized communication identified by the identification unit 123 to instruct the identification unit 123 to cut off the unauthorized communication.

[0058] [effect] The information processing device 100 according to the embodiment has an acquisition unit 121 that acquires a security log, which is information on unauthorized communications stored in an upper network device that is a device constituting an overlay network, an authentication log stored in a cloud server, and a communication log stored in a lower network device that is a device constituting an underlay network, an identification unit 123 that identifies the information on the access as unauthorized communication when a source IP address that is not present in the communication log acquired by the acquisition unit 121 is present in the authentication log and when information on access that is not permitted to be used from the source IP address is present in the security log, and a blocking instruction unit 124 that instructs blocking of the unauthorized communication identified by the identification unit 123.

[0059] As a result, the information processing device 100 collects and merges each piece of information, so that even when an incident occurs, it is possible to quickly identify the communication destination on an ID or IP address basis, dramatically improving the accuracy of identifying the cause and the speed of response and measures. In addition, the personnel costs required for incident response are significantly reduced.

[0060] Furthermore, if the information processing device 100 finds access information suspected of being an unauthorized login among the collected and merged information, it identifies it as unauthorized communication and blocks it, thereby reducing the time and effort required to analyze each piece of information and consider actions based on the analysis results, thereby enabling quick incident response and cost reduction.

[0061] The identification unit 123 of the information processing device 100 according to the embodiment compares the source IP address included in the security log with the source IP address included in the communication log, determines whether or not log information in which the source IP address included in the security log is the same as the source IP address included in the communication log, compares the source IP address included in the security log with the source IP address included in the authentication log, and determines whether or not log information in which the source IP address included in the security log is the same as the source IP address included in the authentication log is present; if log information in which the source IP address included in the security log is the same as the source IP address included in the security log is not present in the communication log and log information in which the source IP address included in the security log is the same as the source IP address included in the authentication log is present, identifies the log information of the source IP address included in the security log as an unauthorized communication.

[0062] As a result, when the information processing device 100 finds access information suspected of being an unauthorized login from the collected and merged information, it determines whether the source IP address information of the access information is present in the communication log or the authentication log, and if it is present only in the authentication log, it identifies the access information as an unauthorized communication and blocks it, thereby reducing the time and effort required to analyze each piece of information and consider actions based on the analysis results, thereby achieving a quicker incident response and reduced costs.

[0063] The information processing device 100 according to the embodiment includes an output unit 122 that outputs information obtained by matching the security log, the authentication log, and the communication log acquired by the acquisition unit 121.

[0064] As a result, the information processing device 100 can collect, collate, and output data from each device, thereby reducing the burden on the system administrator when analyzing the cause of an incident, and achieving a rapid response to incidents and reduced costs.

[0065] The cut-off instruction unit 124 of the information processing device 100 according to the embodiment uses the identification information included in the unauthorized communication identified by the identification unit 123 to issue an instruction to cut off the unauthorized communication.

[0066] As a result, the information processing device 100 can take measures such as disallowing authentication from IDs of unauthorized communications, thereby achieving rapid incident response and cost reduction.

[0067] [program] It is also possible to create a program in which the processes executed by the information processing device 100 described in the above embodiment are written in a language executable by a computer. In this case, the same effects as those of the above embodiment can be obtained by having the computer execute the program. Furthermore, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by a computer to realize the same processes as those of the above embodiment.

[0068] Fig. 8 is a diagram showing an example of a computer that executes an information processing program. As shown in Fig. 8, a computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0069] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0070] 8, the hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. The tables described in the above embodiments are stored in the hard disk drive 1090 or memory 1010, for example.

[0071] Furthermore, the information processing program is stored in the hard disk drive 1090, for example, as a program module in which instructions to be executed by the computer 1000 are written. Specifically, the hard disk drive 1090 stores a program module 1093 in which each process executed by the computer 1000 described in the above embodiment is written.

[0072] Furthermore, data used for information processing by the information processing program is stored as program data, for example, in the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the hard disk drive 1090 into the RAM 1012 as necessary, and executes each of the above-mentioned procedures.

[0073] Note that the program module 1093 and program data 1094 relating to the information processing program are not limited to being stored in the hard disk drive 1090, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 relating to the control program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0074] [others] Although various embodiments have been described in detail herein with reference to the drawings, these embodiments are merely examples and are not intended to limit the present invention to these embodiments. The features described herein can be realized in various ways, including various modifications and improvements based on the knowledge of those skilled in the art.

[0075] Furthermore, the above-mentioned "module (-er suffix, -or suffix)" can be read as a unit, a means, a circuit, etc. For example, a communication module, a control module, and a storage module can be read as a communication unit, a control unit, and a storage unit, respectively. [Explanation of symbols]

[0076] 1. Information Processing Systems 100 Information processing device 110 Communications Department 120 Control section 121 Acquisition Department 122 Output section 123 Specific part 124 Shutdown instruction section 130 Storage section

Claims

1. an identification unit that identifies information on an access as unauthorized communication when a source IP address that does not exist in a communication log stored by a lower network device that is a device constituting an underlay network is information on authentication for preventing unauthorized logins made in response to an authentication request accepted by a cloud server and exists in the authentication log stored by the cloud server, and when information on access from the source IP address that is not set as an IP address that is permitted to access exists in a security log that is information on unauthorized communication detected and stored by an upper network device that is a device constituting an overlay network; a cut-off instruction unit that instructs a higher-level network device to cut off the unauthorized communication identified by the identification unit; 13. An information processing device comprising:

2. The identification unit is comparing the source IP address included in the security log with the source IP address included in the communication log, and determining whether or not log information in which the source IP address included in the security log is the same as the source IP address included in the communication log exists; comparing the source IP address included in the security log with the source IP address included in the authentication log, and determining whether or not log information in which the source IP address included in the security log is the same as the source IP address included in the authentication log exists; If it is determined that the log information in which the source IP address included in the security log is the same as the source IP address does not exist in the communication log and that the log information in which the source IP address included in the security log is the same as the source IP address exists in the authentication log, the log information of the source IP address included in the security log is identified as an unauthorized communication.

2. The information processing apparatus according to claim 1,

3. an output unit that compares the security log, the authentication log, and the communication log and outputs the compared information; 2. The information processing apparatus according to claim 1, further comprising:

4. The cut-off instruction unit issues an instruction to cut off the unauthorized communication by using identification information included in the unauthorized communication identified by the identification unit.

2. The information processing apparatus according to claim 1,

5. 1. A computer-implemented method comprising: an identifying process for identifying information on a source IP address as unauthorized communication when the source IP address does not exist in a communication log stored by a lower network device that is a device constituting an underlay network, and is information on authentication for preventing unauthorized logins made in response to an authentication request accepted by a cloud server, the information being present in the authentication log stored by the cloud server, and information on access from the source IP address that is not set as an IP address that is permitted to access exists in a security log that is information on unauthorized communication detected and stored by an upper network device that is a device constituting an overlay network; a cut-off instruction step of instructing a higher-level network device to cut off the unauthorized communication identified by the identification step; 13. An information processing method comprising:

6. an identifying step of identifying the access information as unauthorized communication when a source IP address that does not exist in a communication log stored by a lower network device that is a device constituting an underlay network is information regarding authentication for preventing unauthorized logins made in response to an authentication request accepted by a cloud server and exists in the authentication log stored by the cloud server, and when information regarding access from the source IP address that is not set as an IP address that is permitted to access exists in a security log that is information regarding unauthorized communication detected and stored by an upper network device that is a device constituting an overlay network; a blocking step of instructing a higher-level network device to block the unauthorized communication identified by the identifying step; An information processing program characterized by causing a computer to execute the above.

Images