DETECTION APPARATUS, DETECTION METHOD, AND DETECTION PROGRAM

Abstract

This detection device (10) acquires the position information and file size of a file that is a falsification detection target. Then, the detection device (10) evaluates changes in the acquired position information or file size, and, if there was a change in the position information or file size, detects falsification of the file that is a falsification detection target.

Description

[Technical field]

[0001] The present invention relates to a detection device, a detection method, and a detection program. [Background technology]

[0002] Conventionally, a method using digest values ​​of file contents is known as a method for detecting tampering. For example, when checking whether the contents of files in a device have been tampered with, a list showing the combination of each file path in the device and the digest value of the file contents is defined in advance as a judgment criterion, and then, when checking whether the contents of the device have been tampered with, this judgment criterion is compared sequentially with the digest values ​​of the file contents in the device, and the presence or absence of tampering is confirmed based on the presence or absence of a difference.

[0003] In addition, methods that use file attribute information in addition to file contents are also known as methods of detecting tampering. For example, there is software that detects file tampering based on changes in the file attribute information. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2019-008376 A [Non-patent literature]

[0005] [Non-Patent Document 1] Starting Linux Security from Scratch (8) Building a Hosted IDS with Tripwire, [online], [Retrieved January 5, 2022], Internet<https: / / atmarkit.itmedia.co.jp / ait / articles / 0203 / 19 / news002_2.html> Summary of the Invention [Problem to be solved by the invention]

[0006] However, conventional techniques have the problem that they may not be able to detect file tampering accurately and quickly. For example, in a conventional method using a digest value of file contents, when checking for tampering, the entire file contents must be read once to generate a digest value of the file contents in a device. If the device contains large files or a large number of files, it takes a long time to read all the file contents, making it difficult to quickly detect tampering of the device.

[0007] In addition, in conventional methods that use file attribute information, there are patterns in which the attribute information does not change even if the file contents are tampered with (patterns in which the contents are rewritten while keeping the file size the same, and patterns in which the timestamp before the change is altered after the file contents are changed, etc.), making it difficult to prevent such file tampering.

[0008] The present invention has been made in view of the above, and has an object to provide a detection device, a detection method, and a detection program that can accurately and quickly detect file tampering. [Means for solving the problem]

[0009] In order to solve the above-mentioned problems and achieve the objective, the detection device of the present invention is characterized by having an acquisition unit that acquires location information and file size of a file that is a target for tampering detection, and a detection unit that determines any change in the location information or file size acquired by the acquisition unit, and detects tampering of the file that is a target for tampering detection if there is a change in the location information or file size. Effect of the Invention

[0010] According to the present invention, it is possible to accurately and quickly detect file tampering. [Brief description of the drawings]

[0011] [Figure 1]FIG. 1 is a block diagram illustrating the configuration of a detection device according to this embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of the criteria stored in the criteria storage unit. [Diagram 3] FIG. 3 is a diagram illustrating information used for tamper detection. [Figure 4] FIG. 4 is a diagram illustrating location information of a file storage area. [Diagram 5] FIG. 5 is a diagram for explaining a comparison between the detection time of the detection device of this embodiment and the conventional detection time. [Figure 6] FIG. 6 is a diagram illustrating another example of the determination criteria. [Figure 7] FIG. 7 is a flowchart illustrating an example of a processing procedure of the pre-processing. [Figure 8] FIG. 8 is a flowchart illustrating an example of a processing procedure of the detection process. [Figure 9] FIG. 9 is a diagram illustrating a computer that executes a program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of a detection device, a detection method, and a detection program according to the present application will be described in detail with reference to the accompanying drawings. The present invention is not limited to the preferred embodiments described below.

[0013] [Detection device configuration] 1 is a block diagram illustrating the configuration of a detection device according to the present embodiment. As illustrated in FIG. 1, a detection device 10 according to the present embodiment includes a communication processing unit 11, an input unit 12, an output unit 13, a control unit 14, and a storage unit 15.

[0014] The communication processing unit 11 is realized by a NIC (Network Interface Card) or the like, and controls communication between a target device (not shown) that holds a file that is a target for tamper detection and the control unit 14 via an electric communication line such as a LAN (Local Area Network) or the Internet. For example, the communication processing unit 11 receives a set of a file path, a digest value of the file contents, location information of the file, a digest value of the location information, and attribute information of the file from the target device.

[0015] The input unit 12 is realized by using input devices such as a keyboard and a mouse, and inputs various instruction information such as a command to start processing to the control unit 14 in response to an input operation by an operator. The output unit 13 is realized by a display device such as a liquid crystal display. For example, the output unit 13 outputs a result of tampering detection.

[0016] The storage unit 15 stores data and programs necessary for various processes by the control unit 14, and has a criterion storage unit 15a. For example, the storage unit 15 is a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk.

[0017] The judgment criteria storage unit 15a stores judgment criteria created in advance for detecting tampering. For example, as shown in Fig. 2, the judgment criteria storage unit 15a stores a file path, a digest value of the file contents, location information of the file, a digest value of the location information of the file, and attribute information of the file as judgment criteria. Fig. 2 is a diagram showing an example of judgment criteria stored in the judgment criteria storage unit.

[0018] The control unit 14 has an internal memory for storing programs that define various processing procedures and required data, and executes various processes using these. For example, the control unit 14 has an acquisition unit 14a, a storage unit 14b, and a detection unit 14c. Here, the control unit 14 is an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0019] The acquisition unit 14a acquires the location information and file size of the file that is the target of tampering detection. The acquisition unit 14a may acquire a digest value of the location information of the file instead of the location information of the file, or may acquire the digest value of the location information of the file together with the location information of the file. For example, the acquisition unit 14a acquires the digest value of the location information and the file size of the file that is the target of tampering detection.

[0020] The acquiring unit 14a acquires the location information and the file size of the file that is the target of tampering detection, for example, when the judgment criteria are generated and when tampering detection is performed.

[0021] For example, when the judgment criteria are generated, the acquisition unit 14a acquires from the target device a set of the file path, the digest value of the file contents, the file location information, the digest value of the location information, and the file attribute information for the file that is the target of tamper detection.

[0022] Furthermore, when tampering detection is performed, the acquiring unit 14a acquires the location information and file size of the file that is the target of tampering detection from the target device. Note that, when tampering detection is performed, the acquiring unit 14a may acquire a set of the file path, the digest value of the file contents, the file location information, the digest value of the location information, and the file attribute information for the file that is the target of tampering detection from the target device.

[0023] The storage unit 14b generates a criterion including the location information or the file size acquired by the acquisition unit 14a, and stores the criterion in the criterion storage unit 15a. For example, the storage unit 14b generates a set of a file path, a digest value of the file contents, location information of the file, a digest value of the location information, and attribute information of the file as the criterion, and stores the set in the criterion storage unit 15a.

[0024] The detection unit 14c determines a change in the location information or file size acquired by the acquisition unit 14a, and detects tampering of the file that is the target of tampering detection if there is a change in the location information or the file size. The detection unit 14c may also determine a change in the digest value or file size of the location information acquired by the acquisition unit 14a, and detect tampering of the file that is the target of tampering detection if there is a change in the digest value or file size of the location information.

[0025] For example, the detection unit 14c compares the location information and file size included in the judgment criteria stored in the judgment criteria memory unit 15a with the location information and file size acquired when performing tampering detection, and if any of the location information and file size does not match, it detects tampering of the file that is the target of tampering detection, assuming that there has been a change in the location information or file size.

[0026] The detection unit 14c may further detect tampering using a digest value of the file contents. For example, when there is a change in the location information or the file size, the detection unit 14c may further determine whether there is a change in the digest value of the file contents, and when there is a change in the digest value of the file contents, detect tampering of the file that is the target of tampering detection. To explain more specifically, for example, when checking whether a file of the target device has been tampered with, the detection unit 14c compares the file path in the judgment criteria with the location information of the file (or the digest value of the location information), the attribute information of the file, and each piece of information in the device, and checks whether there is a mismatch. If there is no mismatch, the detection unit 14c determines that the device has not been tampered with and ends the check. If there is a mismatch, the detection unit 14c compares the digest value of the file contents in the judgment criteria of the file path with the digest value of the file in the device, and if there is a mismatch, determines that the content of the file has been tampered with.

[0027] Here, information used for tamper detection will be described with reference to FIG. 3. FIG. 3 is a diagram for explaining information used for tamper detection. As illustrated in FIG. 3, types of file content tampering include, for example, "overwrite update", "append", and "file replacement". In the example of FIG. 3, in the case of overwrite update, the file attribute information (i-node number and file size) does not change, so the detection unit 14c cannot detect tampering of the file content using only the file attribute information, but it is possible to detect tampering using the position information. In the case of appending, which is a small size, the detection unit 14c cannot detect tampering using only the position information because the position information does not change, but it is possible to detect tampering by combining it with the file size out of the file attribute information.

[0028] In this way, the detection unit 14c detects that the file contents have been tampered with by combining the location information of the storage area of ​​the file on the file system with the file size as a method of detecting file tampering. For example, in a file system such as ext2 of Linux (registered trademark), the storage area is managed in units called blocks, which correspond to data block numbers. In the case of a Windows (registered trademark) file system, it corresponds to a cluster number. The block number indicates a position on the storage medium, and the entire file can be read by tracing multiple block numbers associated with the file. In other words, the block number is an address on the storage, and it is difficult for a user to easily change it.

[0029] Here, the location information of a file storage area will be explained using FIG. 4. FIG. 4 is a diagram for explaining the location information of a file storage area. A block is the smallest unit for saving data used in an ext file system (corresponding to a cluster in FAT (File Allocation Table)). As shown in the example in FIG. 4, one file is made up of multiple blocks and is managed in an i-node table. Also, for example, when the file contents are rewritten, the contents are written to a different block and the correspondence between the file and the blocks is updated.

[0030] In this way, the detection device 10 detects file tampering using location information (block number, etc.) of the file storage area in addition to the file attribute information, and therefore can quickly and accurately detect file tampering. Also, as shown in Fig. 5, according to the results of measurements in a verification environment, the detection device 10 can significantly reduce the average detection time per file by acquiring location information (block number, etc.) and file attribute information, compared to the digest value of the file contents. In other words, it is possible to acquire location information and file attribute information much faster than acquiring the digest value of the file contents, and it is possible to shorten the time during which detection is impossible.

[0031] Usually, to check whether the contents of files in a device have been tampered with, the contents of the files in the device are read in sequence and compared with the original contents to check whether they have been changed. However, when there are large files or a large number of files, reading all the file contents takes time, although it is possible to check them strictly. The detection device 10 reads the location information of the file storage area on the file system and the file size instead of the file contents, and compares them with the original location information and file size to check whether they have been changed. Here, by using a mechanism in which the file contents are read only for files whose location information or file size has been changed and compared with the original contents, the amount and frequency of reading the file contents can be reduced, and tampering of the device can be detected quickly. Note that the location information and attribute information of a file are generally very small compared to the size of the file itself, and it takes only a short time to obtain them.

[0032] Furthermore, there are patterns in which attribute information alone does not change even if the file contents are tampered with, so the detection device 10 can more accurately detect that a file has been tampered with by checking not only the attribute information but also the location information of the file's storage area in combination.

[0033] It should be noted that examples of the judgment criteria are not limited to those illustrated in Fig. 2. For example, as illustrated in Fig. 6, if there is a digest value of the block number (digest value of the location information), the block number, which is location information, is not necessary. Fig. 6 is a diagram for explaining another example of the judgment criteria.

[0034] [Detection device processing procedure] Next, an example of a processing procedure of processing executed by the detection device 10 will be described with reference to Fig. 7 and Fig. 8. Fig. 7 is a flowchart showing an example of a processing procedure of pre-processing. Fig. 8 is a flowchart showing an example of a processing procedure of detection processing.

[0035] First, the procedure of the pre-processing will be described with reference to Fig. 7. As illustrated in Fig. 7, the acquisition unit 14a of the detection device 10 acquires the location information and file size of a file that is a target for tampering detection (step S101). For example, when a judgment criterion is generated, the acquisition unit 14a acquires a set of a file path, a digest value of the file contents, the file location information, a digest value of the location information, and file attribute information for the file that is a target for tampering detection from the target device.

[0036] Then, the storage unit 14b generates a criterion including the location information or the file size acquired by the acquisition unit 14a (step S102), and stores the criterion in the criterion storage unit 15a (step S103). For example, the storage unit 14b generates a set of the file path, the digest value of the file contents, the location information of the file, the digest value of the location information, and the attribute information of the file as the criterion, and stores the set in the criterion storage unit 15a.

[0037] Next, a procedure of the detection process will be described with reference to Fig. 8. As illustrated in Fig. 8, when tampering detection is performed, the acquisition unit 14a acquires location information and a file size of a file that is a target of tampering detection (step S201).

[0038] Then, the detection unit 14c compares the location information and file size acquired when detecting tampering with the location information and file size of the judgment criteria stored in the judgment criteria storage unit 15a (step S202). As a result, the detection unit 14c determines whether or not both the location information and the file size match (step S203).

[0039] If both the location information and the file size match (Yes at step S203), the detection unit 14c determines that there has been no tampering and ends the process. If either or both of the location information and the file size do not match (No at step S203), the detection unit 14c detects tampering of the file that is the target of tampering detection (step S204).

[0040] [Effects of the embodiment] In this way, the detection device 10 according to the embodiment acquires the location information and file size of a file that is a target of tamper detection, determines whether the acquired location information or file size has changed, and detects tampering of the file that is a target of tamper detection if there is a change in the location information or file size. This enables the detection device 10 to accurately and quickly detect file tampering.

[0041] That is, the detection device 10 detects file tampering using location information (such as block number) of the file storage area in addition to the file size, and therefore can quickly and accurately detect file tampering.

[0042] [System configuration, etc.] Each component of each device shown in the figures according to the above embodiment is a functional concept, and does not necessarily have to be physically configured as shown in the figures. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figures, and all or a part of them can be functionally or physically distributed and integrated in any unit according to various loads, usage conditions, etc. Furthermore, each processing function performed by each device can be realized in whole or in any part by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0043] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by a known method. In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

[0044] 〔program〕 It is also possible to create a program in which the processing performed by the detection device 10 described in the above embodiment is written in a language executable by a computer. In this case, the same effects as those of the above embodiment can be obtained by having the computer execute the program. Furthermore, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by a computer to realize the same processing as those of the above embodiment.

[0045] Fig. 9 is a diagram showing a computer that executes a program. As shown in Fig. 9, a computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070, and these components are connected by a bus 1080.

[0046] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012, as exemplified in FIG. 9. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031, as exemplified in FIG. 9. The disk drive interface 1040 is connected to a disk drive 1041, as exemplified in FIG. 9. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, as exemplified in FIG. The video adapter 1060 is connected to a display 1061, as exemplified in FIG. 9.

[0047] 9, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the above programs are stored in, for example, the hard disk drive 1031 as program modules in which instructions to be executed by the computer 1000 are written.

[0048] Moreover, the various data described in the above embodiment are stored as program data, for example, in the memory 1010 or the hard disk drive 1031. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the memory 1010 or the hard disk drive 1031 into the RAM 1012 as necessary, and executes various processing procedures.

[0049] Note that the program module 1093 and program data 1094 relating to the program are not limited to being stored in the hard disk drive 1031, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via a disk drive or the like. Alternatively, the program module 1093 and program data 1094 relating to the program may be stored in another computer connected via a network (such as a local area network (LAN) or wide area network (WAN)) and read by the CPU 1020 via the network interface 1070.

[0050] Although the embodiment to which the invention made by the present inventor is applied has been described above, the present invention is not limited by the description and drawings which form a part of the disclosure of the present invention according to the present embodiment. In other words, other embodiments, examples, operation techniques, etc. made by those skilled in the art based on the present embodiment are all included in the scope of the present invention. [Explanation of symbols]

[0051] 10. Detection Device 11 Communication processing unit 12 Input section 13 Output section 14 Control section 14a Acquisition part 14b Storage area 14c Detection unit 15 Storage section 15a Judgment criteria storage section

Claims

1. an acquisition unit for acquiring location information, an i-node number, and a file size of a file to be subjected to tamper detection; a detection unit that determines changes in the location information, the i-node number, and the file size acquired by the acquisition unit, and detects tampering by overwriting the file that is the target of tampering detection if there is a change only in the location information, detects tampering by appending to the file that is the target of tampering detection if there is a change in the file size and no change in the i-node number, and detects tampering by file replacement to the file that is the target of tampering detection if there is a change in the location information and a change in the i-node number; A detection device comprising:

2. The method further includes a storage unit that generates a criterion including the location information, the i-node number, and the file size acquired by the acquisition unit, and stores the criterion in a storage unit; The acquisition unit acquires location information, an i-node number, and a file size of a file that is a target of tamper detection when tamper detection is performed, The detection device described in claim 1, characterized in that the detection unit compares the location information, the i-node number, and the file size included in the judgment criteria stored in the memory unit with the location information, the i-node number, and the file size acquired when performing tampering detection, and if any of the location information, the i-node number, and the file size do not match, it detects tampering of the file that is the target of tampering detection, assuming that tampering has occurred by overwriting update, tampering by appending, or tampering by file replacement.

3. The acquisition unit acquires a digest value of location information of a file that is a target for tamper detection, the i-node number, and a file size, The detection device described in claim 1, characterized in that the detection unit determines changes in the digest value of the location information, the i-node number, and the file size acquired by the acquisition unit, and if there is a change in the digest value of the location information, the i-node number, or the file size, detects tampering of the file that is the target of tamper detection.

4. The detection device described in claim 1, characterized in that when there is a change in the location information, the i-node number, or the file size, the detection unit further determines whether there has been a change in a digest value of the file contents, and when there has been a change in the digest value of the file contents, detects tampering of a file that is a target for tampering detection.

5. A detection method performed by a detection device, comprising: An acquisition step of acquiring location information, an i-node number, and a file size of a file to be subjected to tamper detection; A detection method which determines changes in the location information, the i-node number, and the file size acquired by the acquisition process, and if there is a change only in the location information, detects tampering by overwriting the file that is the target of tampering detection, detects tampering by appending to the file that is the target of tampering detection, if there is a change in the file size and no change in the i-node number, and detects tampering by file replacement to the file that is the target of tampering detection, if there is a change in the location information and a change in the i-node number.

6. An acquisition step of acquiring location information, an i-node number, and a file size of a file to be subjected to tamper detection; a detection step of determining changes in the location information, the i-node number, and the file size acquired by the acquisition step, detecting tampering by overwriting the file that is the target of tampering detection if there is a change only in the location information, detecting tampering by appending to the file that is the target of tampering detection if there is a change in the file size and no change in the i-node number, and detecting tampering by file replacement to the file that is the target of tampering detection if there is a change in the location information and a change in the i-node number; A detection program that causes a computer to execute the above steps.

Images