Program, apparatus, and method for determining target device information using a machine response, and database construction apparatus

Abstract

Provided are a program, device and method for determining target information devices, and a database construction device, which determine information about devices connected to a communication network based on information that is publicly available or available as open source intelligence. [Solution] A program for determining target device information for devices connected to a communication network causes a computer to function as target device information search means that searches a device identification database that records multiple pieces of device identification information, including device identification information acquired or determined based on device response information that is information included in or related to responses from devices, for relevant device identification information using the device identification information for the target device as a search query, and determines the searched device identification information as the target device information for the target device. The multiple pieces of device identification information include at least one of device series name information, device model name information, and firmware version information related to the device.

Description

Technical Field

[0001] The present invention relates to a technique for acquiring or determining information about a device connected to a communication network.

Background Art

[0002] IoT (Internet of Things), which integrates various devices such as various sensors, cameras, terminals, communication devices, information processing devices, in-vehicle devices, manufacturing devices, driving devices, and even robots and drones via the Internet, is spreading and expanding. Along with this, there is a very high need to grasp the state of such devices being managed (hereinafter collectively referred to as IoT devices) or to acquire information about specific IoT devices.

[0003] As a management technique for IoT devices connected to such a communication network, for example, Patent Document 1 discloses an information processing terminal connected to a plurality of communication devices such as a projector and a printer via a network. Here, this information processing terminal includes a transmission / reception unit that transmits a search request for searching for communication devices to a plurality of communication devices and receives a search request response including device information unique to the communication device that has received the search request and a transmission method of the communication device, a display control unit that displays a list of the received device information, and an input reception unit that accepts a selection of device information from the list of device information.

[0004] Further, the display control unit of this information processing terminal displays a list of transmission methods corresponding to the selected device information, the input reception unit accepts a selection of a transmission method from the list of transmission methods, and the transmission / reception unit transmits a device selection notification including the selected content and the selected transmission method to the communication device indicated by the selected device information. Patent Document 1 states that this enables identification of a desired communication device even when the communication device is in use, standby state, etc. and the terminal name, etc. cannot be displayed.

[0005] Furthermore, for example, Patent Document 2 discloses a device search server for searching for devices communicably connected. This device search server includes device data storage means for storing in association in advance the identifier of the device, the location data of the device, and function data regarding the functions executable by the device, reception means for receiving a search request regarding the location and functions from a user terminal, and search result transmission means for referring to the location data and function data stored in the device data storage means for the received search request, and transmitting the identifier of the device and further the function data to this user terminal. In Patent Document 2, it is stated that such a device configuration facilitates the selection of a device having a function desired by the user.

Prior Art Documents

Patent Documents

[0006]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0007] Regarding IoT devices, in terms of business operation, maintenance, or security measures, it is strongly required to grasp in detail the state of the managed IoT devices or obtain specific information regarding specific IoT devices. However, as described above, the types and numbers of IoT devices are extremely large.

[0008] Therefore, even when obtaining the state and related information of a specific IoT device among a huge variety and number of IoT devices, it is not realistic to create and prepare in advance a list of device information unique to the device or a list of transmission information of the device as in the technology described in Patent Document 1. Further, it must be said that it is very difficult to store in association with each other the device identifier, location data, and function data of a huge variety and number of IoT devices as in the technology described in Patent Document 2.

[0009] Therefore, an object of the present invention is to provide an object information device determination program, apparatus, and method capable of determining a plurality of information about a device connected to a communication network based on information publicly available or available as OSINT. Another object is to provide a database construction apparatus capable of constructing a database that can be used in the determination. Incidentally, OSINT means Open-Source INTelligence.

Means for Solving the Problems

[0010] According to the present invention, there is provided an object device information determination program that causes a computer to function to determine object device information, which is information about at least one target device among devices connected to a communication network, a plurality of device identification information that is information for identifying the device Report is recorded in association with each other in a device identification database, and the device identification information corresponding to the target device is retrieved using the device identification information about the target device as a search query, and the retrieved device identification information or information linked to the device identification information is determined as the object device information of the target device, causing a computer to function as an object device information retrieval means, the plurality of device identification information recorded in association with each other in the device identification database is in a device corresponding to a certain device identification information or a combination thereof , information related to the state of a file or directory or to the characteristics of the response itself from the deviceUsing a signature that is an identification pattern associating identification information with certain device-specific information or a combination thereof, determined from the identification information determined for the device multiple a number of device-specific information of this A target device information determination program is provided, characterized by the above. Here, the identification information is at least one of an identification number of attribute information, a timestamp, a file size or directory size, a hash value of predetermined data included, and an entity tag in a file or directory related to the device, and as characteristics of the response itself from the device, a response time, a response format, an error message format, a URL (Uniform Resource Locator) or URL format, and an API (Application Programming Interface) format.

[0011] As an embodiment of the target device information determination program according to the present invention, the plurality of device-specific information recorded in association with each other in the device-specific database is information obtained or determined based on device response information that is information included in or related to a response from the device, and the identification information determined for the device is information determined based on the device response information in the device, and it is also preferable that the information can take different values or forms depending on at least the content of any of the plurality of device-specific information. Also in this embodiment, the program Based on the device response information obtained from an external database and / or the device response information obtained or determined from the response to a request to the device, at least one piece of the identification information in the device is determined, and the identification information determined in a device corresponding to a certain device specific information or a combination thereof is associated with the certain device specific information or the combination thereof to generate the above signature, and using this signature, device specific information determination means for determining the device specific information about the device from the identification information of the device; Database construction means for constructing the above device specific database by associating and recording the device specific information determined for each device with each other; It is also preferable to further function the computer as such.

[0012] Also, the target device information determination program according to the present invention using device response information in Embodiment in This target device information determination program Based on the device response information obtained from an external database and / or the device response information obtained or determined from the response to a request to the device, at least one piece of the identification information in the device is determined, and the identification information determined in a device corresponding to a certain device specific information or a combination thereof is associated with the certain device specific information or the combination thereof to generate the above signature, and using this signature, device specific information determination means for determining the device specific information about the device from the identification information of the device; Database construction means for constructing the device specific database by associating and recording the device specific information determined for each device with each other; It is also preferable to further function the computer as such.

[0013] As another embodiment of the target device information determination program according to the present invention, the target device information search means uses the above signature to determine the device specific information corresponding to the target device from the identification information acquired in the target device, and it is also preferable to determine the determined device specific information or information associated with this device specific information as the target device information of the target device.

[0014] As yet another further embodiment of the target device information determination program according to the present invention, the target device information search means preferably performs a search on the device specific database using a certain device specific information or a combination thereof as a search query, generates device statistical information obtained by aggregating the searched device specific information, and outputs it.

[0015] Furthermore, the target device information determination program according to the present invention using device response information in Embodiment in The device specific database stores, in association with the device, device identification / speculation information which is information related to the identified state or speculated attributes in the device, determined from the device response information of the device or information obtained from the device response information. It is also preferable that the target device information search means determines the device identification / speculation information associated with the device related to the searched device specific information as the target device information of the target device.

[0017] According to the present invention, there is also provided a target device information determination program for causing a computer to function to determine target device information which is information about at least one target device among devices connected to a communication network. Using the information that identifies the device as device identification information, and using a signature that is an identification pattern in which identification information determined in a device corresponding to a certain device identification information or a combination thereof is associated with the certain device identification information or the combination thereof, determine the device identification information corresponding to the target device from the identification information obtained in the target device, and cause a computer to function as target device information determination means for determining the determined device identification information or information linked to this device identification information as the target device information of the target device 、 The identification information is the related to the state of a file or directory in the device or from the device information related to the characteristics of the response itself report a A target device information determination program is provided, which is characterized in that.

[0018] According to the present invention, further provided is a target device information determination device for determining target device information, which is information about at least one target device among devices connected to a communication network, a plurality of device identification information that is information for identifying the device report search for the device identification information corresponding to the target device as a search query in a device identification database recorded in association with each other, and determine the searched device identification information or information linked to the device identification information as the target device information of the target device, which is target device information search means having The plurality of device identification information recorded in association with each other in the above device identification database is , information related to the state of a file or directory or to the characteristics of the response itself from the device determined from the identification information determined for the device using a signature that is an identification pattern associating identification information in a device corresponding to a certain device identification information or a combination thereof with the certain device identification information or the combination thereof multiple a number of device identification information of this A target device information determination device is provided, which is characterized in that.

[0019] According to the present invention, there is also provided a database construction device for constructing a database used to determine target device information, which is information about at least one target device among devices connected to a communication network, This database is a database that enables searching for device identification information, which is information for identifying the device, for the target device as a search query, and determining the searched device identification information or information associated with this device identification information as the target device information of the target device. This database construction device identification information determination means for determining at least one identification information related to the state of a file or directory in the device or related to the characteristics of the response itself from device response information, which is information included in or related to the response from the device; signature generation means for generating a signature, which is an identification pattern in which the identification information determined in a device corresponding to a certain device identification information or a combination thereof is associated with the certain device identification information or the combination thereof; database construction means for using this signature to determine the device identification information for the device from the identification information of the device, and recording a plurality of the device identification information determined for each device in association with each other to construct the above database and do A database construction device is provided, which is characterized by the above.

[0020] According to the present invention, there is further provided a method for determining target device information in a computer for determining target device information, which is information about at least one target device among devices connected to a communication network, a step of constructing a device identification database in which a plurality of device identification information, which is information for identifying the device and includes device identification information obtained or determined based on device response information, which is information included in or related to the response from the device, are recorded in association with each other; For the device-specific database, using the device-specific information about the target device as a search query, search for the device-specific information corresponding to the target device, and determine the searched device-specific information or the information associated with this device-specific information as the target device information of the target device; having The plurality of device-specific information recorded in the device-specific database in association with each other is , information related to the state of a file or directory or to the characteristics of the response itself from the device Using a signature that is an identification pattern associating identification information in a device corresponding to a certain device-specific information or a combination thereof with the certain device-specific information or the combination thereof, determined from the identification information determined for the device multiple a number of device-specific information of this A target device information determination method is provided, characterized by the above.

[0021] According to the present invention, there is also provided a target device information determination program for causing a computer to function to determine target device information, which is information about at least one target device among devices connected to a communication network, A plurality of device-specific information that is information for identifying the device, including device-specific information obtained or determined based on device response information that is information included in or related to a response from the device, for a device-specific database in which the plurality of device-specific information is recorded in association with each other, using the device-specific information about the target device as a search query, search for the device-specific information corresponding to the target device, and determine the searched device-specific information or the information associated with the device-specific information as the target device information of the target device; target device information search means for causing a computer to function A target device information determination program for causing a computer to function as described above is provided.

[0022] As an embodiment of the target device information determination program according to the present invention, this program device identification information determination means for determining the device identification information about the device based on the device response information obtained from an external database and / or the device response information obtained or determined from the response to a request to the device; database construction means for constructing a device identification database from the determined device identification information; It is also preferable to further cause the computer to function as such.

[0023] Also, in the above embodiment, the device identification information determination means determines at least one piece of identification information related to the state of a file or directory in the device or related to the characteristics of the response from the device response information in the device, generates a signature, which is an identification pattern in which the identification information determined in a device corresponding to a certain device identification information or a combination thereof is associated with the certain device identification information or the combination thereof, and it is also preferable to use this signature to determine the device identification information about the device from the identification information of the device.

[0024] Furthermore, the device identification database according to the present invention determines at least one piece of identification information related to the state of a file or directory in the device or related to the characteristics of the response from the device response information in the device, generates a signature, which is an identification pattern in which the identification information determined in a device corresponding to a certain device identification information or a combination thereof is associated with the certain device identification information or the combination thereof, uses this signature to determine the device identification information about the device from the identification information of the device, and records the device identification information determined about the device in association with each other for each device. It is also preferable that it is constructed by doing so.

[0025] As another embodiment of the target device information determination program according to the present invention, the target device information search means uses the above signature to determine the device specific information corresponding to the target device from the identification information acquired in the target device, and it is also preferable to determine the determined device specific information or information associated with this device specific information as the target device information of the target device.

[0026] Furthermore, the identification information according to the present invention is information related to at least one of the identification number, time stamp, size, hash value, and entity tag of the attribute information in the file or directory related to the device, and the response time, response format, error message format, URL (Uniform Resource Locator) or URL format, and API (Application Programming Interface) format in the response from the device. It is also preferably information related to at least one of them.

[0027] As yet another embodiment of the target device information determination program according to the present invention, the target device information search means preferably searches the device specific database using a certain device specific information or a combination thereof as a search query, generates device statistical information obtained by aggregating the searched device specific information, and outputs it.

[0028] Furthermore, as yet another embodiment of the target device information determination program according to the present invention, the device specific database stores, in association with the device, device identification / speculation information that is information related to the identified state or speculated attributes in the device determined from the device response information of the device or information obtained from the device response information. It is also preferable that the target device information search means determines the device identification / speculation information associated with the device related to the searched device specific information as the target device information of the target device.

[0029] Furthermore, the device specific information according to the present invention is Information identifying the IP (Internet Protocol) address of the device, information identifying the port number in the device, information identifying the protocol in the communication of the device, information identifying the organization or individual related to the ownership or management of the device, information identifying the location or region of the device, information identifying the ASN (Autonomous System number) of the network to which the device is connected, information identifying the host part in the IP address of the device, information identifying the FQDN (Fully Qualified Domain Name) of the device, information identifying the type which is the device type of the device, information identifying the organization or individual related to the manufacture or sale of the device, information identifying the series name of the device, information identifying the model name of the device, and information identifying the version of the firmware related to the device It is also preferable that it is at least one of them.

[0030] According to the present invention, there is also a target device information determination program that causes a computer to function as a target device information determination means for determining target device information, which is information about at least one target device among devices connected to a communication network, using, as device identification information, information identifying the device, and using a signature, which is an identification pattern in which identification information determined in a device corresponding to a certain device identification information or a combination thereof is associated with the certain device identification information or the combination thereof, to determine, from the identification information obtained in the target device, the device identification information corresponding to the target device, and causing the computer to function as target device information determination means for determining the determined device identification information or information linked to this device identification information as the target device information of the target device, The identification information is information related to the state of a file or directory in the device or related to the characteristics of the response, determined based on device response information, which is information included in or related to the response from the device. There is provided a target device information determination program characterized by this.

[0031] According to the present invention, there is further provided a target device information determination apparatus that determines target device information, which is information about at least one target device among devices connected to a communication network, a target device information search means that searches for device identification information corresponding to the target device using, as a search query, the device identification information about the target device from among a plurality of device identification information, which is information for identifying the device and is acquired or determined based on device response information included in or related to a response from the device, and which is recorded in a device identification database in which the plurality of device identification information is associated with each other, and determines the searched device identification information or information linked to the device identification information as the target device information of the target device A target device information determination apparatus having the above is provided.

[0032] According to the present invention, there is also provided a database construction apparatus that constructs a database used for determining target device information, which is information about at least one target device among devices connected to a communication network, This database is a database that enables searching for device identification information corresponding to the target device using, as a search query, the device identification information for identifying the target device, and determining the searched device identification information or information linked to this device identification information as the target device information of the target device, This database construction apparatus has an identification information determination means for determining at least one piece of identification information related to the state of a file or directory in the device or related to a feature of the response from device response information included in or related to a response from the device, and a signature generation means for generating a signature, which is an identification pattern in which the determined identification information in a device corresponding to a certain device identification information or a combination thereof is associated with the certain device identification information or the combination thereof, Using this signature, the device-specific information about the device is determined from the identification information of the device, and for each device, the device-specific information determined for the device is recorded in association with each other to construct the above database, and database construction means A database construction apparatus characterized by having

[0033] According to the present invention, further, a target device information determination method in a computer that determines target device information that is information about at least one target device among devices connected to a communication network, A step of constructing a device-specific database in which a plurality of device-specific information, which is information for specifying the device and includes device-specific information acquired or determined based on device response information that is information included in or related to a response from the device, are recorded in association with each other, A step of searching the device-specific database for the device-specific information about the target device as a search query, and determining the searched device-specific information or information associated with this device-specific information as the target device information of the target device A target device information determination method having

Advantages of the Invention

[0034] According to the target information device determination program, apparatus, and method of the present invention, a plurality of information about devices connected to a communication network can be determined based on information that is publicly available or available as OSINT (Open-Source INTelligence). Further, according to the database construction apparatus of the present invention, a database that can be used in the determination can be constructed.

Brief Description of the Drawings

[0035]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Embodiments for Carrying Out the Invention

[0036] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0037] [Target Equipment Information Determination Apparatus] FIG. 1 is a functional block diagram showing a functional configuration in an embodiment of a target equipment information determination apparatus according to the present invention.

[0038] The target equipment information determination apparatus 1 of the present embodiment shown in FIG. 1 is an apparatus that determines "target equipment information", which is information about at least one target equipment that is the target of information determination among "IoT devices" connected to a communication network.

[0039] Hereinafter, the "IoT devices" include, for example, various sensors, terminals such as cameras and smartphones, communication devices including routers and access points, information processing devices including various servers such as web servers and FTP servers and personal computers (PCs), in-vehicle devices, manufacturing devices, driving devices, further mobile bodies including robots and drones, and device groups constituting an infrastructure management system, and various and diverse devices connected to a communication network shall be applicable.

[0040] In addition, as the "target device information" to be determined by this device, (although it will be described in detail as device identification information later), for example, the type of the target device, series name, model name, firmware version information, etc. can be mentioned. There is a very high need to acquire such information, for example, in terms of business operation, maintenance, or as a security measure.

[0041] In order to realize the determination process of the "target device information" as described above, the target device information determination device 1, as its feature, (A1) Based on the "device response information" which is information included in or related to the response from the IoT device, a plurality of "device identification information" including the "device identification information (of the IoT device)" acquired or determined are recorded in association with each other in the "device identification database", (A2) Using the "device identification information" about the target device as a search query, further "device identification information" corresponding to the target device is searched, and the searched "device identification information" or the information linked to this "device identification information" is determined as the "target device information" of the target device by the target device information search means (in FIG. 1, the target device information search and determination unit 113) is provided.

[0042] Among these, the "device identification information" of the IoT device in the above (A1) is information for identifying the IoT device, and although it will be described in detail later, it can be the same information as the above-mentioned "target device information", for example, the type of the target device, series name, model name, firmware version information, etc. Also, although this will be described in detail later, such "device identification information" can also be acquired or determined based on the "device response information".

[0043] Here, this "device response information" is, for example, the response from the web server to the request of the client browser, the banner information in the HTTP (Hyper Text Transfer Protocol) reply header included therein, and further the error message included in the response, etc. Generally, (a) It can be obtained as open-source intelligence (OSINT) from various websites and the like that disclose the content of the responses of IoT devices. Also, this "device response information" can be, for example, (b) Information (such as timestamps and response times) obtained or determined from the responses (responses) returned by actually sending (normal or legitimate) requests to IoT devices.

[0044] Therefore, the "device identification information" in the above (A1), and thus the "device identification database", can be generated and constructed from publicly available or OSINT-obtainable information. As a result, according to the target device information determination device 1, a plurality of "target device information" (including, for example, the device identification information used in the search) can be determined based on publicly available or OSINT-obtainable information. Hereinafter, the functional configuration of the target device information determination device 1 of the present embodiment will be described in detail.

[0045] [Device Functional Configuration, Target Device Information Determination Program, and Method] Similarly, according to the functional block diagram of FIG. 1, the target device information determination device 1 includes a communication interface 101, a device identification information storage unit 102, a signature storage unit 103, a device identification database (DB) storage unit 104, a search result storage unit 105, a keyboard (KB) / display (DP) 106, and a processor / memory.

[0046] Here, this processor - memory stores an embodiment of the target device information determination program according to the present invention, and also has computer functions. By executing this target device information determination program, it performs target device information determination processing. From this, the target device information determination device 1 may be a device dedicated to this target device information determination processing, but it can also be a cloud server, a non - cloud server, a personal computer (PC), a notebook or tablet computer, or a smartphone, etc., on which the target device information determination program according to the present invention is installed.

[0047] Furthermore, this processor - memory has a device specific information determination unit 111 including an identification information determination unit 111a and a signature generation unit 111b, a database construction unit 112, a target device information search - determination unit 113 including a device statistical information determination unit 113a and a device identification / speculation information determination unit 113b, a communication control unit 121, and an input / output control unit 122. Note that these functional components can be regarded as the functions of the target device information determination program stored in the processor - memory, and also, the flow of processing shown by connecting the functional components of the target device information determination device 1 in the functional block diagram of FIG. 1 with arrows can be understood as an embodiment of the target device information determination method according to the present invention.

[0048] Similarly, in the functional block diagram of FIG. 1, when there is already acquired device specific information, the device specific information determination unit 111, in addition to that, (a) From an external database, for example, a database of a website that discloses the content of the response of IoT devices, the "device response information" acquired via the communication interface 101 and the communication control unit 121, and (b) The "device response information" acquired or determined from the response to a (normal or legitimate) request to the IoT device (received via the communication interface 101 and the communication control unit 121) Based on one or both (both in this embodiment) of these, it determines the device specific information about the IoT device and stores it in the device specific information storage unit 102 as appropriate.

[0049] Regarding the above (a), there are multiple well-known websites that collect and disclose responses obtained when a request is sent for a certain IP (Internet Protocol) address. From such websites, it is possible to obtain, for example, device response information associated with an IP address as OSINT. Incidentally, information collected from overseas websites often contains problems such as character garbling. In this case, it is also preferable to perform data formatting processing on the collected information. Also, it is preferable to delete extra information that is not related to subsequent processing at this stage.

[0050] Furthermore, regarding the above (b), for example, regarding the IP address obtained from a website that discloses an IP address, device response information associated with the IP address may be obtained from the response obtained when an actual request is sent. Here, for example, it is also possible to use WHOIS information, which is public information regarding the registrant of an IP address or domain name.

[0051] Furthermore, in a wireless LAN (Local Area Network) such as Wi-Fi (registered trademark), information such as SSID (Service Set IDentifier) and MAC (Media Access Control) address is usually included in various signals exchanged within the LAN (including probe responses and beacons from routers and access points), and furthermore, it may be possible to legitimately identify a global IP address from such various signals. It is also preferable to obtain such various signals as device response information. Incidentally, when obtaining such information, it is also preferable to install or stay the device 1 within the wireless LAN that is the information acquisition target.

[0052] Next, device-specific information is determined from the device response information described above. Here, examples of device-specific information that can be determined include, for example, (a) Information for identifying the IP address of an IoT device, (a) Information for identifying the port number in an IoT device, (c) Information for identifying the protocol in the communication of an IoT device, (e) Information for identifying an organization or individual (hereinafter abbreviated as "organization") related to the ownership or management of an IoT device, (g) Information for identifying the location or region (hereinafter abbreviated as "city") of an IoT device, (i) Information for identifying the ASN (Autonomous System number) of the network to which an IoT device is connected, (k) Information for identifying the host part in the IP address of an IoT device, (m) Information for identifying the FQDN (Fully Qualified Domain Name) of an IoT device, (o) Information for identifying the type which is the device type of an IoT device, (q) Information for identifying an organization or individual (hereinafter abbreviated as "manufacturer (or vendor)") related to the manufacture or sale of an IoT device, (s) Information for identifying the series name of an IoT device, (u) Information for identifying the model name of an IoT device, (w) Information for identifying the version of the firmware related to an IoT device, (y) Information for identifying the SSID of the LAN to which an IoT device is connected, and (z) Information for identifying the MAC address of an IoT device may be mentioned. It is also preferable that at least one of these is determined as device identification information from the device response information.

[0053] For example, in the banner information (HTTP reply header) included in the acquired device response information, for example, HTTP / 1.1 ******* Server: 00-router *** Date: *** *** *** *** ** When there is a character string like this, the series name (device-specific information) in the above (sa) can be determined as "00-router". In addition, the same character string may exist in the error message included in the acquired device response information. In this case as well, it is possible to determine the series name (device-specific information) from the error message.

[0054] Similarly, in the functional block diagram of FIG. 1, the device-specific information determination unit 111 determines further device-specific information from the device response information. In the present embodiment, the device-specific information determination unit 111 determines the "identification information" of the IoT device from the device response information, and uses the "signature", which is an identification pattern generated in advance, to determine the (further) device-specific information about the IoT device from the determined "identification information".

[0055] Specifically, the identification information determination unit 111a of the device-specific information determination unit 111 determines from the device response information obtained from the response to the request to the IoT device · At least one of (a) the identification number of the attribute information (for example, inode number), (b) the timestamp (for example, mtime (last modification time)), (c) the file size (number of bytes) or the directory size (number of bytes), (d) the hash value of the predetermined data included, and (e) the entity tag (Etag) in the file or directory related to the IoT device as "static identification information". may be determined.

[0056] For example, the inode number in (a) above is a number assigned to the attribute information of the file or directory related to the accessed IoT device, and it is often included in the device response information. However, for example, it may have different values depending on the series name, model name, and firmware version of the IoT device. Thus, the inode number can be identification information when determining the device-specific information of the IoT device.

[0057] Also, the above-mentioned (b) timestamp (e.g., mtime), the above-mentioned (c) file size (or directory size), and the hash value of the above-mentioned (d) predetermined data, which can be included in the device response information, usually have different values (or may have different values) depending on, for example, the series name, model name, and firmware version of the IoT device, and can be identification information.

[0058] Furthermore, the above-mentioned (e) Etag is an identifier associated with a specific version of the resource obtained from the URL (Uniform Resource Locator) related to the accessed IoT device, and it is also often included in the device response information. However, in some cases, it may have different ID values depending on, for example, the series name, model name, and firmware version of the IoT device. That is, the Etag can also be identification information when determining the device-specific information of the IoT device.

[0059] Also, the identification information determination unit 111a determines device response information including the request transmission time, response reception time, etc. (or the time taken for the transmission and reception) from the response to the request to the IoT device, and from this device response information, · At least one of the following in the response from the IoT device: (f) response time, (g) response format, (h) error message format, (i) URL or URL format, and (j) API (Application Programming Interface) format may be determined as "dynamic identification information".

[0060] For example, the above-mentioned (f) response time is a value calculated and determined from the device response information as described above. However, in some cases, it may have different values depending on, for example, the series name, model name, and firmware version of the IoT device, and can be identification information when determining the device-specific information of the IoT device.

[0061] In addition, the response format of (g) above, the error message format of (h) above, the URL format of (i) above, and the API (Application Programming Interface) format of (j) above that may be included in the device response information may have different formats (for example, differences in the letters, symbols, logos, etc. within or around them, or differences in the position of the letters, symbols, logos, etc.) depending on, for example, the series name, model name, or firmware version of the IoT device, and may serve as identification information.

[0062] Furthermore, with regard to the URL in (i) above, for example, a normal response from an IoT device may have a different URL from a response including an error message. In this case, both URLs, or information on the difference between the two URLs, can be used as identification information.

[0063] Although the above (a) to (j) are given as examples of (static and dynamic) identification information, it is of course possible to use information other than the above (a) to (j) as identification information, provided that the information can be acquired or determined from device response information. However, in practice, it is preferable to adopt at least one of the above (a) to (j) as identification information, and it is even more preferable to adopt multiple of the above (a) to (j) as identification information.

[0064] Also in the functional block diagram of Figure 1, the signature generation unit 111b of the device identification information determination unit 111 generates a "signature," which is an identification pattern that corresponds to a certain device identification information or a combination thereof, using identification information determined in an IoT device that corresponds to this certain device identification information or a combination thereof, and stores it in the signature storage unit 103 as appropriate.

[0065] FIG. 2 is a table showing a specific example of a signature according to the present invention.

[0066] As shown in FIG. 2, the signature of this specific example is table information in which the corresponding static identification information and / or dynamic identification information is associated with each piece of device identification information or combination thereof (each device identification information ID). For example, ·(Machine-specific information ID) = 000x: {···, (Series name) = "00-router", (Firmware version) = "1.2.**", ···} is associated with a set of identification information: {inode = ***, mtime = 2021-**-** **:**:**, ···, r_time = ***, URL = ********, ···}. Here, r_time is the response time. For identification information that could not be obtained or determined, the corresponding field can be left blank (or set to "none").

[0067] Also, the signature generation unit 111b preferably updates the generated signature based on the new relationship between the device-specific information and the identification information related to the IoT device as soon as a new relationship is found from, for example, the newly collected information about the IoT device or the newly determined identification information. This can determine more device-specific information for each IoT device or increase the accuracy rate of the determined device-specific information. As a result, it becomes possible to construct a more accurate (more appropriately reflecting the current situation) device-specific database in the database construction process described later.

[0068] Returning to the functional block diagram of FIG. 1, the device-specific information determination unit 111 compares the content of the "signature" (generated and updated and stored in the signature storage unit 103) as described above with the "identification information" determined from the device response information obtained from the response to the request to the IoT device, and further determines the device-specific information in the IoT device.

[0069] Specifically, in the example described above, in a certain IoT device, a set of identification information: {inode=***, mtime=2021-**-** **:**:**, ···, r_time=***, URL=********, ···} has been obtained, and when the series name: 00-router is acquired as device-specific information, from the above (device-specific information ID)=000x: {···, (series name)="00-router", (firmware version)=”1.2.**”, ···}, the firmware version of the IoT device (as device-specific information) can be determined to be 1.2.** Of course, as a result of matching the set of identification information with the "signature", it is possible that a certain device-specific information cannot be uniquely determined, and there may be a case where a plurality of candidates that may apply are obtained. For example, in the above example, from another (device-specific information ID)=000y, it is also possible that the firmware version of the IoT device (as device-specific information) is 1.3.** In such a case, it may be possible not to make any determination for device-specific information of a type that cannot be uniquely determined, or any of the obtained plurality of device-specific information (for example, (firmware version)=”1.2.**” and ”1.3.**”) can be determined as device-specific information (as candidates).

[0070] Incidentally, the more different identification information is obtained (for example, when a set of identification information consisting of two or more static identification information and two or more dynamic identification information is obtained), the greater the number of device-specific information that can be uniquely determined may be. In any case, in this way, the device-specific information determination unit 111 matches the "signature" with the collected set of identification information for each IoT device that has collected information, and determines as much device-specific information that has not yet been found as possible, and grasps as much device-specific information as possible for each IoT device.

[0071] Also in the functional block diagram of FIG. 1, the database construction unit 112 constructs a device identification database by associating and recording the device identification information (set) determined for each IoT device that has collected information with each other, and appropriately stores it in the device identification DB storage unit 104.

[0072] FIG. 3 is a table showing a specific example of the device identification database according to the present invention.

[0073] As shown in FIG. 3, the device identification database of this specific example is table information in which the device identification information (set) determined for one IoT device is associated and recorded for each record corresponding to one row of the table (for each record ID). Specifically, for example, when (record ID) = 000y, · A set of device identification information: {(IP address) = "1**.1**.2**.4*", (type) = "router", (series name) = "00-router", (model name) = "ABC98700YZ3", (firmware version) = "1.3.12", ···} is associated. For device identification information that could not be obtained or determined, that column can be left blank (or none).

[0074] Here, such a device identification database can be constructed, for example, by inputting the device identification information initially obtained for a certain IoT device, the device identification information obtained or determined from the device response information thereof, and further the device identification information determined using the generated signature into a pre-prepared DB template.

[0075] Also, the database construction unit 112 preferably updates the constructed device identification database with the new device identification information as soon as the device identification information related to the IoT device is newly determined, for example, from the newly collected information about the IoT device or using the updated signature. This makes it possible to improve the search accuracy in the target device information search process described later.

[0076] Returning to the functional block diagram of FIG. 1, the target device information search / determination unit 113 searches the device identification database stored in the device identification DB storage unit 104 for additional device identification information corresponding to the target device for which information is to be determined (e.g., device identification information that has already been acquired) as a search query, and determines the searched device identification information or information associated with this device identification information as the "target device information" of this target device.

[0077] Here, in the present embodiment, the target device information search / determination unit 113 (a) may receive a search request and search query information from the terminal of the searcher (FIG. 1) via the communication interface 101 and the communication control unit 121, perform a search process (device identification information determination process) based on this, and return the search process result (device identification information determination process result) to the terminal of the searcher who is the requester, or (b) may receive the search request and search query information input from the keyboard (KB) 106 via the input / output control unit 122, perform a search process (device identification information determination process) based on this, and display the search process result (device identification information determination process result) on the display (DP) 106, or appropriately store and manage it in the search result storage unit 105.

[0078] FIG. 4 is a display image diagram showing a specific example of the search process result (device identification information determination process result) by the target device information search / determination unit 113. The display image shown in this FIG. 4 is an image displayed on the terminal screen of the searcher (FIG. 1) or the display 106.

[0079] According to the display image of FIG. 4, (series name) = "00-router" is input to the upper search window as a search query, and (IP address) = "1**.1**.2**.4*" is also specified (or input as a search query), and as a result of performing a search process (device identification information determination process) using the device identification database, it can be seen that various corresponding device identification information has been searched as the "target device information".

[0080] Specifically, as other device characteristic information (target device information) in the IoT device with (series name) = "00-router" and (IP address) = "1**.1**.2**.4*", (a) (Port number) = "8080", (b) (Organization) = "**One Corporation", (c) (City) = "Kobe", (d) (ASN) = "****", (e) (Host) = "1**.1**.2**.4*", (f) (Type) = "Router", (g) (Manufacturer) = "Zero Zero Devices", (h) (Model name) = "ABC98700YZ3", and (i) (Firmware version) = "1.3.12" has been determined.

[0081] Also, in this specific example, the acquisition date and time, which is the date and time when the displayed device identification information was first acquired and determined, and the final acquisition date and time, which is the date and time when it was last updated, are also displayed.

[0082] Here, as a specific search method, in the target device information determination device 1, for example, the following types of searches are also possible. (a) Free word search Search for device identification information that contains the string entered in the search window and information (such as maintenance information and update history information of the corresponding device) that is pre-associated with it and contains the string. (b) IP address search Search for device identification information that corresponds to the IP address entered in the search window and information (such as maintenance information and update history information of the corresponding device) that is pre-associated with it. Here, address specification in CIDR (Classless Inter-Domain Routing) notation is also possible. (c) Port search Search for device identification information that corresponds to the port number entered in the search window and information that is pre-associated with it. (d) Protocol search Search for device identification information that corresponds to the protocol entered in the search window and information that is pre-associated with it. (e) City search Search for device identification information corresponding to the city (city name) entered in the search window and information pre-linked thereto.

[0083] (f) ASN Search Search for device identification information corresponding to the ASN entered in the search window and information pre-linked thereto. (g) Organization Search Search for device identification information corresponding to the organization entered in the search window and information pre-linked thereto. (h) FQDN Search Search for device identification information corresponding to the FQDN entered in the search window and information pre-linked thereto. (i) Type Search Search for device identification information (device identification information in IoT devices of the type) corresponding to the type entered in the search window and information pre-linked thereto. (j) Manufacturer (or Vendor) Search Search for device identification information (device identification information in IoT devices of the manufacturer (or the vendor)) corresponding to the manufacturer (or vendor) entered in the search window and information pre-linked thereto.

[0084] (k) Series Search Search for device identification information (device identification information in IoT devices of the series name) corresponding to the series name entered in the search window and information pre-linked thereto. (l) Model Search Search for device identification information (device identification information in IoT devices of the model name) corresponding to the model name entered in the search window and information pre-linked thereto. (m) Firmware Version Search Search for device identification information (device identification information in IoT devices corresponding to the firmware version) corresponding to the firmware version entered in the search window and information pre-linked thereto.

[0085] (n) Title Search Search for information obtained from device response information (such as banner information) having a title that includes the string entered in the search window. (o) Server search Search for device identification information of the server corresponding to the string entered in the search window. (p) Banner search Search for information obtained from the response (or banner information) that includes the string entered in the search window. (q) Period-specified search Search for device identification information corresponding to the specified (or entered in the search window) period and information pre-associated therewith.

[0086] Furthermore, in this specific example, the target device information determination device 1 can also perform AND search and OR search using a plurality of device identification information as search queries. It is also possible to perform a NOT search for those that do not satisfy a certain device identification information (content).

[0087] Here, for example, when using an IP address and other limited device identification information as search queries, the set of searched device identification information (corresponding IoT devices) may be determined to be one, but depending on the search query, of course, the set (corresponding IoT devices) often becomes two or more. Hereinafter, a preferred embodiment of presenting the search result (device identification information determination result) in such a case will be described.

[0088] Returning to the functional block diagram of FIG. 1, the device statistical information determination unit 113a of the target device information search and determination unit 113 generates and outputs "device statistical information" obtained by aggregating the searched device identification information as a result of performing a search on the device identification database using a certain device identification information or a combination thereof as a search query.

[0089] Specifically, the device statistics information determination unit 113a may, for example, collect a large number of port number information obtained as a result of performing a search using (series name) = "00-router" as a search query, and generate and output information such as "The port number most frequently used in 00-router is ***, and the second most frequently used port number is ***,..." as "device statistics information", as well as ranking information on "port numbers used in 00-router".

[0090] Similarly, as "device statistics information", for example, ranking information on "the city where 00-router is located", ranking information on "the model name of 00-router in use", and further information such as "the distribution of firmware versions used in 00-router" may be generated and output.

[0091] Also in the functional block diagram of FIG. 1, the device identification and speculation information determination unit 113b of the target device information search and determination unit 113 also determines the "device identification and speculation information", which is information (tagged) associated with the IoT device related to the searched device identification information, as the target device information of the target device.

[0092] Here, the "device identification and speculation information" is information related to the identified state or speculated attributes in the IoT device determined from the device response information of the IoT device or information obtained from this device response information. The device identification database stores this "device identification and speculation information" associated with (tagged to) the corresponding IoT device (for example, the corresponding record ID). Here, for example, information from the website of the manufacturer (vendor) of the IoT device or websites introducing the IoT device may also be used to determine this "device identification and speculation information".

[0093] Specifically, as the device identification and speculation information (tag information), for example, (a) Information indicating that the IoT device is determined to be using a vulnerable protocol or a vulnerable chipset based on the machine response information and the acquired / determined device-specific information. (b) Information indicating that the IoT device is determined to be in the initial state at the time of factory shipment based on the machine response information and the acquired / determined device-specific information. (c) Information indicating that the IoT device is found to have information related to default IDs and passwords leaked based on the acquired / determined information. (d) Information indicating that the IoT device is found to have information related to default IDs and passwords publicly known based on the acquired device manuals, etc. (e) Information indicating that the IoT device is found to have the manufacturer support ended based on the acquired / determined device-specific information. (f) Information indicating that the IoT device is found to have no authentication mechanism or the authentication mechanism is not enabled based on the acquired / determined information. (g) Information indicating that the IoT device is found to have no explicit support expiration date and that a predetermined period (e.g., one year) or more has elapsed since the last firmware update based on the acquired / determined information. (h) Information indicating that the IoT device is found not to be the latest firmware version based on the acquired / determined device-specific information. (i) Information indicating that the IoT device is presumed to be of type "***" based on the machine response information (especially the banner information). (j) Information indicating that the manufacturer (or vendor) is presumed to be "***" based on the machine response information (especially the banner information). (k) Information indicating that the series name is presumed to be "***" based on the machine response information (especially the banner information). (l) Information indicating that the model name is presumed to be "***" based on the machine response information (especially the banner information), and (m) Information indicating that the firmware version is presumed to be "***" based on the machine response information (especially the banner information). At least one of them can be adopted.

[0094] As described above, in the target device information search and determination unit 113 of the present embodiment, device identification information, device statistical information, and device discovery / speculation information are determined as "target device information". However, all of these pieces of information are useful and can be very helpful in business operations, maintenance, or as security measures.

[0095] For example, in the present embodiment, by obtaining such information, it is possible to check whether any unintended IoT devices are exposed in the global IP addresses managed by the user, or to check the usage status in a predetermined area for the IoT devices that the user is using or planning to introduce (or a specific one).

[0096] It is also possible to grasp the tendency of the firmware versions used for specific IoT devices, or to check the distribution status of the ports used in the botnets of the IoT devices reported in the news. Furthermore, it is possible to check whether there are any ports that can be used as stepping stones in the user's network, and also how the ports are distributed.

[0097] It is also possible to visualize the public exposure status to the outside of the IoT devices managed by the user, to grasp whether there are any IoT devices used in attacks, and further to search for what actual IoT devices are being used in a predetermined area.

[0098] Furthermore, as the device identification and speculation information (tag information) described above, information related to the maintenance and security of IoT devices (for example, information on whether an IoT device has security problems) can be actively adopted, and a maintenance and security alarm service that appropriately presents such information to users can also be provided. For example, a service that presents an alarm indicating that the default ID of the user's IoT device has leaked and prompts the user to change the ID may be provided.

[0099] Furthermore, in companies promoting telework, a security service can also be implemented to check whether there are any security problems with IoT devices such as PCs and routers in the homes of employees. Also, promotional and marketing activities such as prompting replacement, for example, for IoT devices whose manufacturer support period has passed, can be carried out.

[0100] <Other Embodiments Related to Determination of Target Device Information> As described above, the process of searching for device identification information using the "device identification database" and determining the target device information has been explained. Hereinafter, embodiments of determining the target device information without using this "device identification database" will be described.

[0101] Similarly, in the functional block diagram of FIG. 1, the target device information search and determination unit 113 (target device information determination means) of this embodiment uses the "signature" stored in the signature storage unit 103 to determine the device identification information corresponding to this target device from the identification information obtained in the target device, and determines the determined device identification information or the information associated with this device identification information as the target device information of this target device.

[0102] Here, the identification information can be either or both of static identification information (e.g., a timestamp) and dynamic identification information (e.g., a response time) determined based on the device response information. Therefore, such identification information can be determined on the spot from the device response information obtained as a result of actually sending a request to the target device, and then the further device identification information (target device information) of the target device can be determined immediately using the signature. That is, it becomes possible to acquire the target device information (device identification information) in real time.

[0103] Note that the target device information determination device 1 may be capable of performing both (a) the target device information determination process using the device identification database and (b) the target device information determination process directly using the signature described above, or it may be a device capable of performing only one of the processes. For example, it may not have (or construct) a device identification database and determine the device identification information (target device information) only using the signature.

[0104] [Database Construction Device] FIG. 5 is a functional block diagram showing the functional configuration in an embodiment of the database construction device according to the present invention, and a schematic diagram showing another embodiment of the target device information determination device according to the present invention.

[0105] Specifically, in the embodiment shown in FIG. 5, instead of the "target device information determination device 1" (FIG. 1) connected to the Internet in the embodiment shown in FIG. 1, a "database construction device 2" and a "target device information determination device 3" both connected to the Internet are adopted.

[0106] Here, the target device information determination device 3 has a communication function and a data input / output function, and a target device information search / determination unit 313, and this target device information search / determination unit 313 performs the same function as the target device information search / determination unit 113 (FIG. 1) of the target device information determination device 1 (FIG. 1).

[0107] The database construction device 2 also includes a communication interface 201, a device identification information storage unit 202, a signature storage unit 203, a device identification DB storage unit 204, and a device identification information determination unit 211 including an identification information determination unit 211a and a signature generation unit 211b. These (functional) components perform the same functions as the components with the same names in the target device information determination device 1 (Fig. 1). Furthermore, the database construction / access unit 212 of this database construction device 2 performs the same function as the database construction unit 112 (Fig. 1), and further, it also performs the function of mediating the interaction between the device identification database and the target device information search / determination unit 313 in response to a database access request from the target device information determination device 3 (the target device information search / determination unit 313).

[0108] By adopting the configuration described above, the target device information determination device 3 can entrust the construction and management of the device identification database to the database construction device 2, and without having its own device identification database, it can perform the device identification information search process (target device information determination process). Of course, here, the target device information determination device 3 can also access the database construction device 2 and perform the target device information (device identification information) determination process using the above-described signature directly.

[0109] In this embodiment, the searcher (Fig. 5) may operate the target device information determination device 3 to perform device identification information search (target device information determination), or may send a search process request from an external terminal to the target device information determination device 3 to cause the device identification information search process (target device information determination process) to be performed. Furthermore, the database construction device 2 may be a device that provides the constructed device identification database and signature to an external information processing device for use there.

[0110] As described in detail above, according to the present invention, a plurality of information about devices connected to a communication network can be determined based on information that is publicly available or available as OSINT. Also, a database that can be used in the course of such determination can be constructed.

[0111] Incidentally, currently, with the spread and expansion of the IoT, there is a very high need to grasp in detail the status of devices being managed or to obtain specific information about specific devices, either for business operation, maintenance, or security measures. The present invention is capable of fully meeting such needs.

[0112] Regarding the various embodiments of the present invention described above, various changes, modifications, and omissions within the scope of the technical idea and perspective of the present invention can be easily made by those skilled in the art. The foregoing description is merely an example and is not intended to impose any restrictions. The present invention is limited only by the scope of the claims and their equivalents.

Description of Reference Numerals

[0113] 1, 3 Target device information determination device 101, 201 Communication interface 102, 202 Device specific information storage unit 103, 203 Signature storage unit 104, 204 Device specific database (DB) storage unit 105 Search result storage unit 106 Keyboard (KB) · Display (DP) 111, 211 Device specific information determination unit 111a, 211a Identification information determination unit 111b, 211b Signature generation unit 112 Database construction unit 113, 313 Target device information search · determination unit (target device information search means, target device information determination means) 113a Device statistical information determination unit 113b Device identification · inference information determination unit 121, 221 Communication control unit 122 Input / output control unit 2 Database construction device 212 Database construction · access unit

Claims

1. A target device information determination program that causes a computer to function as a means for determining target device information, which is information about at least one target device among devices connected to a communication network, using, as a search query, the device identification information about the target device, searches a device identification database in which a plurality of device identification information, which is information for identifying the device, is recorded in association with each other, for the device identification information corresponding to the target device, and causes a computer to function as a target device information search means for determining, as the target device information of the target device, the searched device identification information or information associated with the device identification information, wherein the plurality of device identification information recorded in the device identification database in association with each other is a plurality of device identification information determined from the identification information determined for the device, using a signature that is an identification pattern associating the identification information related to the state of a file or directory or the characteristics of the response itself from the device corresponding to a certain device identification information or a combination thereof, with the certain device identification information or the combination thereof, characterized in that it is a target device information determination program.

2. wherein the plurality of device identification information recorded in the device identification database in association with each other is information obtained or determined based on device response information, which is information included in or related to the response from the device, and the identification information determined for the device is information determined based on the device response information in the device, and is information that can take different values or forms depending on at least the content of any of the plurality of device identification information, characterized in that it is the target device information determination program according to Claim 1.

3. device identification information determination means for determining at least one piece of the identification information in the device based on the device response information obtained from an external database and / or the device response information obtained or determined from the response to a request to the device, generating the signature that associates the identification information determined in the device corresponding to a certain device identification information or a combination thereof, with the certain device identification information or the combination thereof, and determining, using the signature, the device identification information about the device from the identification information of the device, Database construction means for constructing the device identification database by recording, for each device, the device identification information determined for the device in association with each other The target device information determination program according to claim 2, characterized in that the computer is further caused to function as such

4. The device identification database stores, in association with the device, device identification / speculation information which is information related to the identified state or speculated attribute in the device, determined from the device response information of the device or information obtained from the device response information The target device information search means also determines the device identification / speculation information associated with the device related to the searched device identification information as the target device information of the target device The target device information determination program according to claim 2 or 3, characterized in that

5. The identification information is at least one of the identification number of the attribute information, time stamp, file size or directory size, hash value of the predetermined data included, and entity tag in the file or directory related to the device, and the response time, response format, error message format, URL (Uniform Resource Locator) or URL format, and API (Application Programming Interface) format as characteristics of the response itself from the device. The target device information determination program according to any one of claims 1 to 4, characterized in that

6. The target device information search means determines, using the signature, the device identification information corresponding to the target device from the identification information obtained in the target device, and also determines the determined device identification information or the information associated with the device identification information as the target device information of the target device. The target device information determination program according to any one of claims 1 to 5, characterized in that

7. The target device information search means searches the device identification database with a certain device identification information or a combination thereof as a search query, generates and outputs device statistical information obtained by aggregating the searched device identification information. The target device information determination program according to any one of claims 1 to 6, characterized in that

8. A target device information determination program that causes a computer to function to determine target device information, which is information about at least one target device among devices connected to a communication network, using, as device identification information, the identification information determined in a device corresponding to a certain device identification information or a combination thereof, as a signature, which is an identification pattern associated with the certain device identification information or the combination thereof, to determine, from the identification information obtained in the target device, the device identification information corresponding to the target device, and causing the computer to function as target device information determination means for determining the determined device identification information or information linked to the device identification information as the target device information of the target device, wherein the identification information is information related to the state of a file or directory in the device or related to the characteristics of the response itself from the device A target device information determination program characterized by this.

9. A target device information determination device that determines target device information, which is information about at least one target device among devices connected to a communication network, having target device information search means for searching, as a search query, the device identification information about the target device in a device identification database that records a plurality of device identification information, which is information for identifying the device, in association with each other, to search for the device identification information corresponding to the target device, and determining the searched device identification information or information linked to the device identification information as the target device information of the target device and the plurality of device identification information recorded in the device identification database in association with each other are a plurality of device identification information determined from the identification information determined for the device, using a signature, which is an identification pattern associating identification information related to the state of a file or directory in a device corresponding to a certain device identification information or a combination thereof or related to the characteristics of the response itself from the device, with the certain device identification information or the combination thereof A target device information determination device characterized by this.

10. A database construction device that constructs a database used to determine target device information, which is information about at least one target device among devices connected to a communication network, The database searches for device identification information, which is information for identifying the target device for the target device, as a search query, and determines the retrieved device identification information or information associated with the device identification information as target device information for the target device. The database is capable of doing so. The database construction device Identification information determination means for determining at least one piece of identification information related to the state of a file or directory in the device or related to the characteristics of the response itself from device response information, which is information included in or related to the response from the device. Signature generation means for generating a signature, which is an identification pattern in which the identification information determined in a device corresponding to a certain device identification information or a combination thereof is associated with the certain device identification information or the combination thereof. Database construction means for constructing the database by using the signature to determine the device identification information for the device from the identification information of the device, and associating and recording a plurality of pieces of the device identification information determined for each device with each other. A database construction device characterized by having the above.

11. A method for determining target device information in a computer that determines target device information, which is information about at least one target device among devices connected to a communication network. A step of constructing a device identification database in which a plurality of pieces of device identification information, which are information for identifying the device and include device identification information obtained or determined based on device response information, which is information included in or related to the response from the device, are recorded in association with each other. A step of searching the device identification database for the device identification information corresponding to the target device by using the device identification information for the target device as a search query, and determining the retrieved device identification information or information associated with the device identification information as the target device information for the target device. having The plurality of device-specific information recorded in the device-specific database in association with each other is identification information related to the state of a file or directory in a device corresponding to a certain device-specific information or a combination thereof, or information related to the characteristics of the response itself from the device, and a plurality of device-specific information determined from the determined identification information for the device using a signature that is an identification pattern associating the certain device-specific information or a combination thereof with the identification information A method for determining target device information, characterized in that it is as described above.

Images