Unauthorized access detection device, unauthorized access detection method, and unauthorized access detection program

Abstract

To provide an unauthorized access detection apparatus, an unauthorized access detection method, and an unauthorized access detection program capable of detecting an unauthorized access even when the number of accesses is small.SOLUTION: An unauthorized access detection apparatus 1 includes: a communication information acquisition unit 11 which acquires communication information accessed to a server via a network; a score acquisition unit 12 which inputs a user ID in the communication information to password complexity detection software to acquire a score indicating a level of security as a password based on complexity of a character string; an access counting unit 13 which counts the number of accesses to the server from the same IP address, while assigning weight with relatively higher numerical values to higher scores; and an access control unit 14 which determines an unauthorized access when the number of accesses within a predetermined period exceeds a threshold, and performs predetermined access control.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a method for detecting unauthorized access. [Background technology]

[0002] Conventionally, measures against online fraudulent activities have become essential when providing services via the Internet. For example, Non-Patent Document 1 introduces an authentication system that performs additional checks, such as verification by telephone or email, on accounts that may be subject to fraudulent use. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Amazon Fraud Detector, Internet<https: / / aws.amazon.com / jp / fraud-detector / > Summary of the Invention [Problem to be solved by the invention]

[0004] As damage caused by more sophisticated unauthorized access attacks increases, technology to prevent unauthorized access is needed. One known technology for detecting unauthorized access is to detect large amounts of access from a specific IP address as unauthorized use, but this is becoming less effective because it is possible to avoid detection by changing the IP address before it is determined to be large amounts of access. On the other hand, due to the existence of access via proxies, it was difficult to lower the threshold for the number of accesses per hour that is considered to be a large number of accesses from the same IP address, as this would result in an increase in false positives.

[0005] An object of the present invention is to provide an unauthorized access detection device, an unauthorized access detection method, and an unauthorized access detection program that can detect unauthorized access even when there are only a few accesses. [Means for solving the problem]

[0006] The unauthorized access detection device of the present invention comprises a communication information acquisition unit that acquires communication information accessed to a server via a network; a score acquisition unit that inputs the user ID in the communication information into password complexity detection software and acquires a score indicating the level of security of the password based on the complexity of the character string; an access number counting unit that counts the number of accesses to the server from the same IP address, weighting the number of accesses with a relatively larger value the higher the score; and an access control unit that determines that the number of accesses in a specified period exceeds a threshold value and performs specified access control.

[0007] The access counting unit may further weight and count the access numbers in accordance with a predetermined rule based on the communication information.

[0008] The score acquisition unit may acquire a relatively higher score for the ID as the degree of similarity to words included in dictionary data decreases and as a brute force attack becomes more difficult.

[0009] The unauthorized access detection method of the present invention is carried out by a computer, and includes the following steps: a communication information acquisition step of acquiring communication information accessed to a server via a network; a score acquisition step of inputting the user ID in the communication information into password complexity detection software to acquire a score indicating the level of security of the password based on the complexity of the character string; an access number counting step of counting the number of accesses to the server from the same IP address, weighting the number of accesses by a relatively larger value the higher the score; and an access control step of determining that the number of accesses in a specified period exceeds a threshold value and performing specified access control.

[0010] The unauthorized access detection program according to the present invention is for causing a computer to function as the unauthorized access detection device. [Effects of the Invention]

[0011] According to the present invention, unauthorized access can be detected even if there are only a small number of accesses. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 2 is a diagram illustrating a functional configuration of an unauthorized access detection device according to an embodiment. [Figure 2] FIG. 10 is a first diagram illustrating an example of the output of password complexity detection software used by the score acquisition unit in the embodiment. [Figure 3] FIG. 10 is a second diagram illustrating an example of the output of the password complexity detection software used by the score acquisition unit in the embodiment. [Figure 4] FIG. 10 is a third diagram illustrating an example of the output of the password complexity detection software used by the score acquisition unit in the embodiment. [Figure 5] 10 is a flowchart showing a processing procedure of an unauthorized access detection method according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] An example of an embodiment of the present invention will be described below. In the unauthorized access detection method of this embodiment, the complexity (randomness) of IDs currently logged in or attempting to log in to the server that is the target of unauthorized access detection is used as an indicator, and access restrictions are imposed by counting the number of accesses with a higher weight given to accesses using IDs that are likely to have been automatically generated by an attacker.

[0014] FIG. 1 is a diagram showing the functional configuration of an unauthorized access detection device 1 according to this embodiment. The unauthorized access detection device 1 is an information processing device that includes a control unit 10, a storage unit 20, and various input / output interfaces, and acquires communication information for a server to be detected and detects access from an ID that is suspected of being unauthorized. The unauthorized access detection device 1 may be incorporated as a function of the server to be detected, or may be configured as an external management server capable of collecting communication information within a predetermined network.

[0015] The control unit 10 is a part that controls the entire unauthorized access detection device 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

[0016] The storage unit 20 is a storage area for various programs for causing the hardware group to function as the unauthorized access detection device 1, various data, etc., and may be a ROM, RAM, flash memory, hard disk drive (HDD), or the like.

[0017] The control unit 10 includes a communication information acquisition unit 11, a score acquisition unit 12, an access number count unit 13, and an access control unit 14.

[0018] The communication information acquisition unit 11 acquires communication information about access to the server via a network, including at least the IP address of the access source and the ID of the user who made the access.

[0019] The score acquisition unit 12 inputs the user ID in the communication information into password complexity detection software and acquires a score that indicates the level of security as a password based on the complexity of the character string.

[0020] Here, the score acquisition unit 12 uses known software such as "zxcvbn" to acquire a relatively high score for an ID, the lower the similarity to words contained in the dictionary data and the more difficult a brute force attack is. A high score indicates the password's complexity, i.e., its security (strength), and when used as an ID, an ID with a high score indicates a high probability of being random and automatically generated.

[0021] The access counting unit 13 counts the number of accesses from the IP address of the access source obtained from the communication information to the detection target server, weighting the number of accesses with a relatively larger value (≧1) as the score increases. Furthermore, the access counting unit 13 may further adjust the weight in accordance with a predetermined rule based on the communication information. Specifically, for example, the IP address of the access source may be evaluated according to the domain, and the number of accesses may be counted several times or several tens of times higher for accesses from a domain suspected of fraudulent activity that has been predefined, or for accesses suspected of fraudulent activity by other known detection methods.

[0022] If the number of accesses counted in a predetermined period exceeds a threshold, the access control unit 14 determines that the access is unauthorized and performs predetermined access control, such as refusing access from the same IP address or presenting a warning message to the user.

[0023] 2 to 4 are diagrams illustrating examples of the output of password complexity detection software used by the score acquisition unit 12 in this embodiment. Here we show an example of the evaluation results output when the password complexity detection software "zxcvbn" is entered with three IDs, "Tr0ub4dour&3," "jAFdeaOVZa3fnnsea7eiNR," and "s1mple," instead of a password, which is its intended use.

[0024] Password complexity detection software evaluates the password complexity of an input string. For example, a string that still retains its legibility as an English word, such as replacing "a" with "@," will be given a low score. In the case of values ​​that are supposed to be shown to others as the user's own name, such as IDs, users who use values ​​that are significantly less visible are likely to be automatically generating IDs and are likely to be conducting aggressive unauthorized access. Therefore, by giving a higher score, i.e., a password that is difficult to guess and is shown to be safe, a lower score is given to IDs, and by weighting it as two or more consecutive accesses, even a small number of accesses can be judged as unauthorized access.

[0025] For example, IDs entered into password complexity detection software are rated on a five-point scale: "Tr0ub4dour&3" receives a score of 2; "jAFdeaOVZa3fnnsea7eiNR," which is more random and difficult to guess, receives a score of 4; and "s1mple," which resembles an English word and is relatively easy to guess, receives a score of 0. The access counting unit 13 counts a weighted number of times according to this score, for example, 1 time for a score of 0, 10 times for a score of 1, and so on.

[0026] FIG. 5 is a flowchart showing the processing steps of the unauthorized access detection method according to this embodiment. This process is repeatedly executed at a predetermined timing, such as at a fixed cycle or when communication is detected.

[0027] In step S1, the communication information acquisition unit 11 acquires communication information relating to access to a server to be detected.

[0028] In step S2, the score acquisition unit 12 acquires the ID of the accessing user, and then acquires a score indicating the complexity of this ID using password complexity detection software.

[0029] In step S3, the access number counter 13 determines a weight value (≧1) for the number of accesses in accordance with the score acquired in step S2.

[0030] In step S4, the access counting unit 13 counts the number of accesses to the server to be detected within a predetermined period of time for each IP address of the access source, in accordance with the weight value determined in step S3.

[0031] In step S5, the access control unit 14 determines whether the number of accesses counted in step S4 exceeds a preset threshold value. If the determination is YES, the process proceeds to step S6, and if the determination is NO, the process ends.

[0032] In step S6, the access control unit 14 restricts access from an IP address whose access count exceeds the threshold in step S5 by either refusing access from that IP address or outputting a warning to that user (ID).

[0033] According to this embodiment, the unauthorized access detection device 1 inputs the ID of the user who accessed the server into password complexity detection software, obtains a score indicating the level of security of the password based on the complexity of the character string, and counts the number of accesses to the server from the same IP address, weighting it with a relatively larger number the higher the score. As a result, when the number of accesses in a specified period exceeds a threshold, the unauthorized access detection device 1 determines that the access is unauthorized and performs specified access control, and assigns a greater weight to accesses that use a random character string suspected to be automatically generated as an ID.Therefore, even if the number of accesses is small, the threshold will be exceeded before the attacker changes their IP address, and unauthorized access can be detected appropriately.

[0034] The unauthorized access detection device 1 further weights and counts the number of accesses according to predetermined rules based on communication information, thereby detecting unauthorized access using an index that takes other judgment criteria into account, which is expected to improve detection accuracy.

[0035] The unauthorized access detection device 1 can efficiently identify the automatically generated randomly generated attacker's ID and appropriately detect unauthorized access by using a method in which the lower the similarity of the ID to words contained in the dictionary data and the more difficult a brute force attack is, the higher the score obtained.

[0036] This will enable, for example, detection of unauthorized access on the network and prevention of unauthorized logins to services, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0037] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0038] The unauthorized access detection method by the unauthorized access detection device 1 is realized by software. When realized by software, the programs constituting this software are installed in an information processing device (computer). These programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of symbols]

[0039] 1. Unauthorized access detection device 10 Control Unit 11 Communication information acquisition unit 12 Score Acquisition Section 13 Access count section 14 Access control section 20 Memory section

Claims

1. a communication information acquisition unit that acquires communication information accessed via a network to a server; a score acquisition unit that inputs the user ID in the communication information into password complexity detection software and acquires a score that indicates the level of security as a password based on the complexity of a character string; an access number counting unit that counts the number of accesses to the server from the same IP address by weighting the number of accesses with a relatively larger value as the score increases; and an access control unit that, when the number of accesses in a predetermined period exceeds a threshold, determines that the access is unauthorized and performs predetermined access control.

2. 2. The unauthorized access detection device according to claim 1, wherein the access counting unit further weights the number of accesses in accordance with a predetermined rule based on the communication information and counts the number of accesses.

3. 3. The unauthorized access detection device according to claim 1, wherein the score acquisition unit acquires a relatively higher score for the ID when the ID has a lower similarity to words contained in dictionary data and when a brute force attack is more difficult.

4. a communication information acquisition step of acquiring communication information accessed via a network to a server; a score acquisition step of inputting the user ID in the communication information into password complexity detection software and acquiring a score indicating the level of security as a password based on the complexity of a character string; an access counting step of counting the number of accesses from the same IP address to the server by weighting the number of accesses by a relatively larger value as the score increases; and an access control step of determining that the access is unauthorized and performing predetermined access control when the number of accesses in a predetermined period exceeds a threshold.

5. 3. An unauthorized access detection program for causing a computer to function as the unauthorized access detection device according to claim 1.

Images