Unauthorized access detection device, unauthorized access detection method, and unauthorized access detection program

Abstract

To provide an unauthorized access detection apparatus, an unauthorized access detection method, and an unauthorized access detection program capable of detecting an unauthorized access even when the number of accesses is small.SOLUTION: An unauthorized access detection apparatus 1 includes: a communication information acquisition unit 11 which acquires communication information accessed to a server via a network; a word acquisition unit 12 which acquires a word included in a part of a user ID in the communication information or a word similar to a partial character string of the ID; an access counting unit 13 which counts the number of accesses to the server on the basis of an IP address of an access source in the communication information and the word acquired by the word acquisition unit 12; and an access control unit 14 which determines an unauthorized access when the number of accesses within a predetermined period exceeds a threshold, and performs predetermined access control.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a method for detecting unauthorized access.

Background Art

[0002] Conventionally, in providing services via the Internet, measures against online illegal acts have become essential. For example, in Non-Patent Document 1, an authentication system is introduced that performs additional checks such as verification by phone or email for accounts that may be illegally used.

Prior Art Documents

Non-Patent Documents

[0003]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] With the increase in damage caused by more sophisticated unauthorized access attacks, technologies for preventing unauthorized access are needed. As a technology for detecting unauthorized access, for example, a technology that detects a large number of accesses from a specific IP address as unauthorized use is known. However, since it is possible to avoid detection by methods such as changing the IP address before being determined as a large number of accesses, the effect has become weak. On the other hand, reducing the threshold of the number of accesses per unit time regarded as a large number of accesses from the same IP address due to the presence of access via a proxy has been difficult because it causes an increase in false detection.

[0005] An object of the present invention is to provide an unauthorized access detection device, an unauthorized access detection method, and an unauthorized access detection program that can detect unauthorized access even with a small number of accesses. [Means for solving the problem]

[0006] The unauthorized access detection device according to the present invention comprises: a communication information acquisition unit that acquires communication information of access to a server via a network; a word acquisition unit that acquires a word included in a part of the user ID in the communication information, or a word similar to a substring of said ID; an access count unit that counts the number of accesses to the server using the IP address of the access source in the communication information and the word acquired by the word acquisition unit as keys; and an access control unit that determines that an access is unauthorized and performs predetermined access control when the number of accesses over a predetermined period exceeds a threshold.

[0007] The access counting unit may count the access counts by weighting them according to predetermined rules based on the communication information.

[0008] The word acquisition unit may acquire a word if it is possible to construct a word included in a predetermined dictionary data by substituting specific characters in the substring.

[0009] The unauthorized access detection method according to the present invention is performed by a computer and comprises: a communication information acquisition step of acquiring communication information of access to a server via a network; a word acquisition step of acquiring a word included in a part of the user ID in the communication information, or a word similar to a substring of said ID; an access count step of counting the number of accesses to the server using the IP address of the access source in the communication information and the word acquired in the word acquisition step as keys; and an access control step of determining that an access is unauthorized and performing predetermined access control when the number of accesses over a predetermined period exceeds a threshold.

[0010] The unauthorized access detection program according to the present invention is for causing a computer to function as the unauthorized access detection device. [Effects of the Invention]

[0011] According to the present invention, unauthorized access can be detected even with a small number of accesses. [Brief explanation of the drawing]

[0012] [Figure 1] This diagram shows the functional configuration of the unauthorized access detection device in the embodiment. [Figure 2] This is the first figure illustrating the output of the password complexity detection software used by the word acquisition unit in the embodiment. [Figure 3] This is a second figure illustrating the output of the password complexity detection software used by the word acquisition unit in the embodiment. [Figure 4] This is a third figure illustrating the output of the password complexity detection software used by the word acquisition unit in the embodiment. [Figure 5] This is a flowchart showing the processing procedure for the unauthorized access detection method in the embodiment. [Modes for carrying out the invention]

[0013] An example of an embodiment of the present invention will be described below. In the unauthorized access detection method of this embodiment, access restrictions are imposed by counting the number of accesses to a key that concatenates words contained in the ID of a user currently logged into or attempting to log into the server, in addition to the IP address of the source of the access to the server targeted for unauthorized access detection.

[0014] Figure 1 shows the functional configuration of the unauthorized access detection device 1 in this embodiment. The unauthorized access detection device 1 is an information processing device equipped with a control unit 10 and a storage unit 20, as well as various input / output interfaces, and acquires communication information to the server to be detected and detects access from IDs suspected of being unauthorized. Note that the unauthorized access detection device 1 may be incorporated as a function of the server to be detected, or may be configured as an external management server capable of collecting communication information within a predetermined network.

[0015] The control unit 10 is a part that controls the entire unauthorized access detection device 1, and realizes each function in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

[0016] The storage unit 20 is a storage area for various programs and various data for causing the hardware group to function as the unauthorized access detection device 1, and may be a ROM, a RAM, a flash memory, a hard disk drive (HDD), or the like.

[0017] The control unit 10 includes a communication information acquisition unit 11, a word acquisition unit 12, an access count unit 13, and an access control unit 14.

[0018] The communication information acquisition unit 11 acquires communication information accessed to the server via the network. The communication information includes at least the IP address of the access source and the ID of the accessed user.

[0019] The word acquisition unit 12 acquires a word included in a part of the user ID in the communication information, or a word similar to a partial character string of this ID. Here, the word acquisition unit 12 detects a word included in the ID or a character string similar to the word using, for example, existing software (e.g., "zxcvbn") for detecting the complexity of the password. Specifically, the word acquisition unit 12 acquires this word when a word included in the predetermined dictionary data can be formed by replacing between specific characters in the partial character string of the ID.

[0020] The access count unit 13 counts the number of accesses to the server using the IP address of the access source obtained from the communication information and the word acquired by the word acquisition unit 12 as keys. At this time, the access count unit 13 counts the number of accesses with weights according to predetermined rules based on the communication information. Specifically, for example, the IP address of the access source may be evaluated according to the domain, and accesses from domains suspected of being fraudulent, as defined in advance, or accesses suspected of being fraudulent by other known detection methods, may be counted with weights of several times or tens of times.

[0021] The access control unit 14 determines that an access attempt is unauthorized if the number of access attempts counted over a predetermined period exceeds a threshold, and performs predetermined access control actions such as rejecting access from the same IP address or displaying a warning message to the user.

[0022] Figures 2 to 4 illustrate the output of the password complexity detection software used by the word acquisition unit 12 in this embodiment. Here, we illustrate the evaluation results output when three IDs—"Tr0ub4dour&3", "jAFdeaOVZa3fnnsea7eiNR", and "s1mple"—are entered into the password complexity detection software "zxcvbn" instead of a password, which is its intended use.

[0023] Password complexity detection software uses the ability to identify and output words that match or are similar to substrings within the input string, as one of the metrics used to evaluate complexity (randomness). For example, from "Tr0ub4dour&3", the word "troubadour", which is similar to the substring "Tr0ub4dour", is extracted by replacing "0" with "o" and "4" with "a". Similarly, from "jAFdeaOVZa3fnnsea7eiNR", "seale", which is similar to the substring "sea7e", is extracted by replacing "7" with "l", and from "s1mple", "simple" is extracted by replacing "l" with "i".

[0024] The words extracted in this way are concatenated with an IP address, and the number of accesses to the server is counted using a string like "1.1.1.1troubadour" as the key.

[0025] In this situation, attackers attempting to gain unauthorized access need to create a large number of IDs, so the IDs tend to take the form of "ID + sequential number" or "fixed string + ID of another service." Furthermore, since internet services require login via ID linking as part of two-factor authentication, attackers handling a large number of IDs may try to improve usability by including linked IDs or phone numbers within the ID itself. One method to hide such phone numbers or serial numbers is to use hash values, but since hash values ​​are long (32 characters), it is usually difficult to include them in IDs that have length limitations. Therefore, the number of accesses from multiple IDs that have been unified using a fixed string (word) (for example, IDs generated in large numbers by sequential numbering) is aggregated.

[0026] Figure 5 is a flowchart showing the processing procedure of the unauthorized access detection method in this embodiment. This process is executed repeatedly at predetermined intervals, such as at regular intervals or when communication is detected.

[0027] In step S1, the communication information acquisition unit 11 acquires communication information related to access to the server to be detected.

[0028] In step S2, the word acquisition unit 12 obtains the ID of the accessing user, and uses password complexity detection software to acquire the word if there is a substring in this ID that matches or is similar to the word.

[0029] In step S3, the access count unit 13 evaluates the likelihood of unauthorized access based on the communication information and determines a weight value (≧1) for the access count.

[0030] In step S4, the access count unit 13 counts the number of accesses to the target server within a predetermined period for each key formed by concatenating the IP address of the access source with each word obtained in step S2, by the weight value determined in step S3.

[0031] In step S5, the access control unit 14 determines whether the number of accesses counted in step S4 exceeds a preset threshold. If the determination is YES, the process moves to step S6; if the determination is NO, the process ends.

[0032] In step S6, the access control unit 14 rejects access from the IP address or restricts access to the user (ID) associated with the IP address for any "IP address + word" where the number of accesses exceeded the threshold in step S5.

[0033] According to this embodiment, the unauthorized access detection device 1, when it obtains a word contained in a part of the ID string of a user who has accessed the server and is currently logged in or attempting to log in, or a word similar to a part of the string, counts the number of accesses to the server using the source IP address and the word as keys. As a result, when the unauthorized access detection device 1 determines that an access is unauthorized and performs predetermined access control when the number of accesses during a predetermined period exceeds a threshold, it can detect words used as fixed strings that are concatenated with sequential numbers or random strings, etc. Even if there are only a few accesses with a single ID, unauthorized access can be appropriately detected by aggregating accesses from a large number of similar IDs that have been automatically generated with sequential numbers or random strings, etc.

[0034] The unauthorized access detection device 1 detects unauthorized access by weighting and counting the number of accesses according to predetermined rules based on communication information, and by incorporating other judgment criteria into the indicator, thus improving detection accuracy.

[0035] The unauthorized access detection device 1 may use a method to obtain a word if it can be formed by substituting specific characters in a substring to a word included in a predetermined dictionary data, and this can be easily implemented with existing password complexity detection software.

[0036] Furthermore, this will enable, for example, the detection of unauthorized access on the network and the suppression of unauthorized logins to services, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs): "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0037] Although embodiments of the present invention have been described above, the present invention is not limited to the embodiments described above. Furthermore, the effects described in the embodiments described above are merely a list of the most preferred effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0038] The unauthorized access detection method by the unauthorized access detection device 1 is implemented by software. When implemented by software, the programs constituting this software are installed on an information processing device (computer). These programs may be distributed to users by being recorded on removable media such as a CD-ROM, or by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of Symbols]

[0039] 1. Unauthorized Access Detection Device 10 Control Unit 11. Communication Information Acquisition Unit 12 Word Acquisition Section 13. Access count section 14 Access Control Unit 20 Memory section

Claims

1. A communication information acquisition unit that acquires communication information when accessing a server via a network, A word acquisition unit that acquires a word included in a part of the user's ID in the aforementioned communication information, or a word similar to a substring of said ID, An access count unit counts the number of accesses to the server using the IP address of the access source in the aforementioned communication information and the word obtained by the word acquisition unit as keys. The system includes an access control unit that determines an access is unauthorized and performs predetermined access control when the number of accesses during a predetermined period exceeds a threshold, The word acquisition unit is an unauthorized access detection device that acquires a word when it is possible to construct a word included in predetermined dictionary data by substituting specific characters in the substring.

2. The unauthorized access detection device according to claim 1, wherein the access counting unit counts the number of accesses by weighting them according to a predetermined rule based on the communication information.

3. A communication information acquisition step that acquires communication information when accessing a server via a network, A word acquisition step to obtain a word that is included in part of the user's ID in the aforementioned communication information, or a word that is similar to a substring of said ID, An access count step that counts the number of accesses to the server using the IP address of the access source in the aforementioned communication information and the word obtained in the aforementioned word acquisition step as keys, The computer executes an access control step in which, if the number of accesses during a predetermined period exceeds a threshold, it determines that the access is unauthorized and performs predetermined access control. An unauthorized access detection method that, in the word acquisition step, acquires a word if it can be formed by substituting specific characters in the substring to form a word included in predetermined dictionary data.

4. An unauthorized access detection program for causing a computer to function as an unauthorized access detection device according to claim 1 or claim 2.

Images