WO2005048114A1 - 不正監視プログラム、不正監視の方法及び不正監視システム - Google Patents
不正監視プログラム、不正監視の方法及び不正監視システム Download PDFInfo
- Publication number
- WO2005048114A1 WO2005048114A1 PCT/JP2004/009860 JP2004009860W WO2005048114A1 WO 2005048114 A1 WO2005048114 A1 WO 2005048114A1 JP 2004009860 W JP2004009860 W JP 2004009860W WO 2005048114 A1 WO2005048114 A1 WO 2005048114A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- data
- user
- input
- computer
- output data
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F15/00—Digital computers in general; Data processing equipment in general
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F1/00—Details not covered by groups G06F3/00 - G06F13/00 and G06F21/00
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
Definitions
- Fraud monitoring program fraud monitoring method and fraud monitoring system
- the present invention relates to a fraud monitoring program, a fraud monitoring method, and a fraud monitoring system for monitoring fraudulent data that causes a computer to perform fraudulent operations.
- firewalls and vaccine software rules for determining unauthorized data are determined in advance based on keywords, the IP address of the sender, etc., and it is determined whether or not the data is unauthorized by referring to the rules. Is common.
- Patent Document 1 Japanese Patent Application Publication No. 2002-232232
- the firewall and the vaccine software, and the invention described in Patent Document 1 are all for preventing intrusion and leakage of unauthorized data on a network.
- unauthorized operations using a computer are not limited to those via a network.
- an unauthorized third party illegally operates a computer not connected to an external network and outputs information inside the computer to a printer. Write to external disk, and when There is also the danger of information leakage by methods that do not use networks.
- the current monitoring method for unauthorized data is mainly based on a rule base in which keywords, IP addresses, MAC addresses, and the like are registered.
- the contents of rules that can be registered by such a powerful method Is limited. It is preferable to increase the number of rules in order to make the judgment as accurate as possible. However, even if the number of rules is too large, a problem arises in that the processing required for the judgment becomes heavy. Therefore, it is effective if there is a mechanism to register various rules of the cutting power as simply as possible and to refer to the rules efficiently.
- the rule-based improper judgment does not correspond to a registered rule by a completely different method, and if an improper operation is performed, it is difficult to detect the improper operation using the rule base alone. Also have. In order to address this, it is effective to be able to accurately judge the possibility of fraud by capturing patterns of user's operation behavior that are different from those in the past.
- the present invention has been made in response to these problems, and in monitoring unauthorized data that causes a computer to perform an unauthorized operation, not only the network but also the data input / output to / from external devices. It is an object of the present invention to provide a fraud monitoring program, a fraud monitoring method, and a fraud monitoring system that can be monitored and that can set various rules for fraud judgment and apply efficient rules.
- a first invention for solving the problem of the present application is a program for monitoring illegal data that causes a computer to execute an illegal operation, and the program is connected to a network connected to the computer. Or obtaining input / output data input / output through an external connection bus connecting the computer and an external device; specifying identification information for identifying the input / output data user; Acquiring at least a part of the attribute information corresponding to the identification information from a user information storage unit for storing attribute information of each user, determining that the input / output data is invalid data Judgment rule case for storing rules A step of determining whether the input / output data is invalid data by referring to the storage section, and if the input / output data is determined to be invalid data in the above-described invalid data determination step, Stopping the operation to be executed; and determining whether or not the determination data is invalid data, wherein the determination rule storage unit stores a determination rule corresponding to a user attribute.
- the computer may be used as a client or used as a server in the network as long as the computer is connected to the network and has an external connection bus.
- the network includes all networks that can transmit and receive data, such as LAN and dial-up.
- External devices include all peripheral devices, such as printers and drives, that can be connected to a computer through an external connection bus.
- Unauthorized data refers to data that can be used to illegally operate a computer, such as an instruction to transmit a file that is prohibited from being leaked to the outside or an operation by an unauthorized user.
- For the user attribute information for example, the user's age, gender, department, post, etc. are used.
- a step of, in the computer referring to the user information storage unit, determining whether a user corresponding to the identification information has a right to use the computer, If it is determined in the step of determining the use right that there is no use right, the step of stopping the operation performed by the input / output data is executed, and the use right is determined.
- the step is executed prior to the step of judging the unauthorized data, and in the step of judging the use right, when it is judged that the use right is absent, the computer acquires the attribute information. Step or At least one of the steps of determining the unauthorized data may not be executed.
- the attribute of the user is registered in advance for use as one item of the rule, it is possible to easily confirm whether or not the user who has performed the operation has the authority to use the computer. it can. If the user's use authority is determined before the rule is determined, if the operation is performed by a user who does not have authority in the first stage, the operation is stopped before the rule is applied. By doing so, the process of applying the rules can be efficiently performed.
- the first invention is characterized in that the computer refers to a profile storage unit for storing log data relating to the input / output data as a profile for each user, and obtains the log data obtained in the data obtaining step.
- the step of stopping the operation performed by the input / output data includes the step The operation executed by the input / output data may be stopped even when it is determined that the operation is unique in the step of determining whether the input / output data is present.
- a log file for each user is created by collecting log data for each user to create an opening file, and it is determined whether or not the user has performed a peculiar operation by referring to the katakana profile. By doing so, it is possible to judge impersonation of an authorized user by a third party that cannot be determined by the rules, and possible unauthorized operations that are within the scope of the authority but not normally performed .
- the step of stopping an operation executed by the input / output data when the input / output data is acquired Another feature is to execute session disconnection processing.
- the operation executed by the input / output data is stopped. Further, it may be characterized in that the processing executed by the driver is stopped.
- a process for immediately stopping the execution is performed.
- the process being executed is the transmission and reception of data through the network, by performing the disconnection process of the session being executed, information leakage or the like due to external transmission of data can be prevented. If the process being executed is an operation on an external device via the external connection bus, by stopping the process executed by the driver, information leakage or the like due to data output can be prevented.
- a second invention for solving the problem of the present application is a program for monitoring unauthorized data that causes a computer to execute an unauthorized operation, the program being connected to a network connected to the computer. Or obtaining input / output data input / output through an external connection bus connecting the computer and an external device; specifying identification information for identifying the input / output data user; Acquiring at least a part of the attribute information corresponding to the identification information from a user information storage unit for storing attribute information of each user, determining that the input / output data is invalid data It is determined whether the input / output data is invalid data by referring to a determination rule storage unit that stores rules to be performed.
- the determination rule corresponding to the attribute of the user is stored in the determination rule storage unit, and in the step of determining the unauthorized data,
- a fraud monitoring program characterized in that, in the attribute information obtaining step, it is determined whether the data is fraudulent data by referring to the determination rule corresponding to the obtained attribute information.
- the first invention stops processing executed by the data when the data is determined to be invalid data, whereas the user who is the operator who executed the processing relating to the data, or a computer or the like, It is characterized by coping with illegal data by notifying the terminal administrator of a warning!
- the first invention and the second invention are related to the improper execution of the unauthorized monitoring program. It can also be specified as a method of regular monitoring. It can also be configured as a fraud monitoring system using the above fraud monitoring program.
- the first invention is a system for monitoring unauthorized data that causes a computer to execute an unauthorized operation, and comprises a network connected to the computer or an external device connecting the computer to an external device.
- Data acquisition means for acquiring input / output data input / output via a connection bus, identification information identification means for identifying identification information for identifying a user from the input / output data, and a user having authority to use the computer.
- User information storage means for storing attribute information of each user; attribute information acquisition means for acquiring at least a part of attribute information corresponding to the identification information from the user information storage means; Determination rule storage means for storing a rule that determines that Means for determining whether the input / output data is invalid data, and stopping the operation performed by the input / output data if the invalid data determination means determines that the input / output data is invalid data. Stopping means, wherein the determination rule storage means stores a determination rule corresponding to the attribute of the user, and in the unauthorized data determination means, the attribute information obtaining means includes: It can be configured as a fraud monitoring system characterized by determining whether the data is fraudulent data by referring to the determination rule corresponding to the acquired attribute information.
- the first invention includes a use right determination unit that determines whether a user corresponding to the identification information has a use right of the computer with reference to the user information storage unit.
- the stopping means stops the operation executed by the input / output data even when the usage right determination means determines that the usage right is not provided, and the usage right determination means determines the unauthorized data determination. If it is started prior to the means and if the use right determination means determines that there is no use right! ⁇ , at least one means of the attribute information acquisition means or the illegal data determination means is not started. It is characterized by
- a profile storage means for storing log data relating to the input / output data as a profile for each user
- a unique operation determining unit that determines whether the input / output data acquired by the data acquiring unit is unique compared to the tendency of the user's daily operation, and the stopping unit includes: The operation executed by the pre-filled output data may be stopped even when the unique operation determination means determines that the operation is unique.
- the first invention is characterized in that when the data acquisition means acquires the input / output data from a network, the stop means executes a session disconnection process. .
- the first invention is characterized in that when the data acquisition means acquires the externally connected bus power, the input / output data, the stop means stops the processing executed by the driver. Talk about this.
- a second invention is a system for monitoring unauthorized data that causes a computer to execute an unauthorized operation, and through a network connected to the computer or an external connection bus connecting the computer and an external device.
- Data acquisition means for acquiring input / output data to be input / output, identification information identification means for identifying identification information for identifying a user from the input / output data, and attributes of each user with respect to a user who has authority to use the computer
- User information storing means for storing information
- attribute information obtaining means for obtaining at least a part of attribute information corresponding to the identification information from the user information storing means; and determining that the input / output data is invalid data.
- a determination rule storage unit for storing a determination rule; and the input / output Means for determining whether the data is invalid data, and when the invalid data determination means determines that the data is invalid data, the operation executed by the input / output data is invalid.
- Notification means for notifying the terminal device operated by the user or the administrator that the operation is an appropriate operation, and the determination rule storage means stores a determination rule corresponding to the attribute of the user.
- the fraudulent data determining means determines whether the data is fraudulent data by referring to the determination rule corresponding to the attribute information acquired by the attribute information acquiring means. You can do it.
- the invention's effect [0027] According to the present invention, in monitoring unauthorized data that causes a computer to execute an unauthorized operation, it is possible to monitor data input / output not only to a network but also to an external device, and a person without impersonation authority is provided. This can prevent information leakage, etc. due to unauthorized data output.
- FIG. 1 and FIG. 2 are diagrams showing examples in which the fraud monitoring system according to the present invention is used for monitoring a network and monitoring a connection with an external device, respectively.
- FIG. 3 is a diagram showing an installation position of the fraud monitoring system according to the present invention.
- FIGS. 4 and 5 are block diagrams showing a first configuration of the fraud monitoring system according to the present invention.
- FIG. 6 is a diagram showing an example of a user data storage unit of the fraud monitoring system according to the present invention.
- FIG. 7 is a diagram illustrating an example of a fraud rule storage unit of the fraud monitoring system according to the present invention.
- FIG. 8 is a flowchart showing the flow of the fraud monitoring program according to the present invention.
- the fraud monitoring system not only monitors various data flowing through a network, but also connects to an external device such as an output device such as a printer or an external storage device such as an external disk drive. It is also characterized by the ability to monitor externally connected buses.
- the fraud monitoring system according to the present invention may be provided on an internal network such as a corporate LAN and a gateway of the Internet to monitor the network, or provided on a mail server through the network. Sending and receiving e-mail You may monitor the communication. Further, it may be used for monitoring segments in the internal network, for monitoring individual user terminals with the network, or for monitoring connections with external devices.
- FIG. 1 is an example of a case where the present invention is used for monitoring a network, and a fraud monitoring system according to the present invention includes a fraud monitoring server 10, a user data storage unit 12, and a fraud rule storage unit 13. .
- the fraud monitoring server 10 may be provided in the gateway between the internal network and the Internet to monitor the leakage of unauthorized data of the internal network as a whole, or may be provided in the internal network and It may be used for monitoring unauthorized data leakage.
- the fraud monitoring server 10 obtains all input / output data flowing through the network, and obtains, from the user data storage unit 12, information relating to the attribute of the user who performs data input / output.
- the fraud rule storage unit 13 stores rules that are determined to be fraudulent according to user attributes in addition to general rules for judging fraudulent data.
- the input / output data is referred to a general determination rule, and the rule corresponding to the attribute acquired from the user data storage unit 12 is referred to determine whether the input / output data is invalid. For the input / output data determined to be invalid, the process of shutting down the session in which input / output is attempted is performed.
- FIG. 2 shows an example in which the present invention is used for monitoring an externally connected bus.
- the fraud monitoring system includes a fraud monitoring program 11 stored in the HDD 214 of the processing device 210, a user data storage unit 12 These programs and stored data are read from the HDD 214 when monitoring is performed, and are processed by the processing device 210.
- the basic various programs for hardware control such as input control and output control stored in the ROM 213 are activated.
- the CPU 211 performs arithmetic processing while making the RAM 212 function as a work area for the fraud monitoring program 11.
- the fraud monitoring program 11 issues an instruction flowing through the external connection bus 23.
- Data is acquired, and information on the attribute of the user who performed the operation on the instruction data is acquired from the user data storage unit 12.
- the fraud rule storage unit 13 stores rules that are determined to be fraudulent according to user attributes, in addition to general fraudulent data determination rules, and the fraud monitoring program 11 stores the instruction data in the fraudulent rule storage.
- a process is performed to determine whether the rule falls under a general determination rule stored in the unit 13 and to determine whether the rule falls under a rule corresponding to the attribute acquired from the user data storage unit 12. For the instruction data determined to be invalid, processing for stopping the processing executed by the driver program 22, for example, stopping printout or stopping communication with a computer directly connected to the external connection bus 23 And so on.
- FIG. 4 shows a judgment method in which rules according to the user's attributes are added to the judgment rule for fraud.
- Fig. 5 It shows a configuration for executing the method of making a determination.
- the fraud determination is performed by the data acquisition unit 14 to obtain data to be determined, by the fraudulent operation determination unit 15 to determine a rule-based fraudulent operation, and by the interruption processing execution unit 16.
- the processing is performed in the order of cancellation.
- These parts are not physically separated, but are stored in the HDD 214 as programs of a part of the fraud monitoring program 11 that executes each part, and are sequentially read out and the RAM 212 is used as a work area.
- the arithmetic processing may be executed by the CPU 211 while functioning! /.
- the data acquisition unit 14 acquires data flowing through a network or an external connection bus.
- the data to be obtained includes the identification data of the user who has performed the operation on the data.
- the identification data is based on the login ID used when the user logged in to the computer. Specified.
- the user attribute information corresponding to the user identification data acquired by the data acquisition unit 14 is acquired from the user data storage unit 12.
- FIG. 6 is an example of the attribute information of the user stored in the user data storage unit 12, and the record provided for each user stores the user ID and the attribute information such as the department and the type of job. .
- the unauthorized operation determination unit 15 refers to the unauthorized rule storage unit 13 and determines whether the data acquired by the data acquisition unit 14 corresponds to a rule that should be determined to be unauthorized.
- the illegal rule storage unit 13 stores rules that should be generally determined to be illegal regardless of the attributes of the user, and rules for each attribute that defines items that are not permitted according to the attributes of the user. You.
- rules generally used for judging fraud on the basis of keywords, URLs, IP addresses, MAC addresses, and the like correspond.
- the latter corresponds to, for example, operation authority defined for a specific operation according to a department or position.
- FIG. 7 shows an example of a judgment rule determined according to the attribute of the user stored in the fraud rule storage unit 13.
- the record provided in units of power rules is applied to the target attribute.
- the rules are stored.
- the right to send e-mail is granted only to regular employees or more. For example, if you try to send the e-mail of the intern nurse shown in the example in Fig. 6, it is determined that you do not have permission to send, and the mail sending process will be stopped.
- the interruption processing execution unit 16 executes the process executed by the operation.
- the process for stopping is executed. In other words, for the input / output data through the network, the process of blocking the session that tried to perform the input / output is executed, and for the execution process data through the external connection bus, the printout stop or the external disk Processing such as stopping writing to the file is executed.
- the unauthorized operation determination unit 15 when acquiring the user attribute information from the user data storage unit 12, if there is no data corresponding to the user ID, or if the user ID is the retirement of the user, etc. If the access is invalidated by an unauthorized person, it is determined that the access is performed by an unauthorized person, that the unauthorized You can even perform an interruption by 16. If access by an unauthorized person is determined before the rule-based determination in this way, the processing load on the system can be reduced, and prompt determination and interruption processing can be executed.
- the fraud determination is performed by acquiring data to be determined by the data acquisition unit 14, determining a rule-based unauthorized operation by the unauthorized operation determination unit 15, and determining a rule base by the unique operation determination unit 18.
- the determination of an unauthorized operation from the operation pattern of each user that does not depend on the operation pattern and the suspension of the target processing by the interruption processing execution unit 16 are executed.
- These parts are not physically separated, but are stored in the HDD 214 as a part of the fraud monitoring program 11 that executes each part, and are read out sequentially and the RAM 212 functions as a work area.
- the calculation process may be executed by the CPU 211 while doing so, as in the case of FIG.
- the data acquisition unit 14 acquires the data to be determined, the illegal operation determination unit 15 determines the rule-based unauthorized operation, and the interruption processing execution unit 16 cancels the targeted processing.
- the interruption processing execution unit 16 cancels the targeted processing. Is the same as in the case of FIG.
- This configuration is characterized in that a profile is created for each user in the profile creation unit 19, and an unusual operation is determined in the unique operation determination unit 18 based on the operation pattern card for each user.
- the data acquired by the data acquisition unit 14 is determined by an unusual operation determination unit 18 that performs determination based on an operation pattern for each user, together with an unauthorized operation determination unit 15 that performs determination based on a rule base.
- a past operation pattern of each user is registered in the user profile 17, and the unique operation determination unit 18 compares the operation of the acquired data with the operation pattern of the user registered in the user profile 17, and When it is determined that the operation is a peculiar operation, the interruption by the interruption processing execution unit 16 is executed. For example, if an operation is performed during a time when the operation is not normally performed, or if a large number of operations that are not normally performed are performed, fraudulent acts by the user or impersonation using another person's user ID are performed. Processing is interrupted as possible.
- the operation pattern registered in the user profile 17 is created from the data used for the determination in the unique operation determination unit 18 and the attribute information of the user in the user data storage unit 12. Can. A log of the data acquired by the data acquisition unit 14 may be used. Updating the profile may be performed as an online process each time new data is acquired, or may be performed through periodic batch processing.
- the unique operation determination unit 18 is provided with a knowledge engine for determining an operation pattern unique to the user profile 17.
- the knowledge engine has an artificial intelligence function that distinguishes between normal operations and unusual operations, the structure of artificial intelligence may be based on Bayesian's network or neural network. Good.
- the session interruption processing is executed, and the execution processing data transmitted through the external connection bus is transmitted to the print file. This is corrected as a process such as suspension or suspension of writing to an external disk is executed.However, if it is determined that the operation is unauthorized, the user who performed the operation or the administrator of the computer / network A warning may be notified to the user.
- the attribute information that is active on the ID is acquired from the user database (S04).
- the rule database (S05) it is determined whether the acquired attribute does not correspond to the rule defined for each attribute (S06). If so, it is determined that the operation is performed by a person who does not have the operation authority who is strong in the operation, and a process of canceling the operation related to the input / output data is executed (S08). If not applicable, then it is determined whether the obtained input / output data does not correspond to general rules (S07). If so, it is determined that the operation is an illegal operation, and a process of canceling the operation on the input / output data is executed (S08). If not applicable, correct As an ordinary operation, the operation related to the input / output data is executed as it is. Brief Description of Drawings
- FIG. 1 is a diagram showing an example in which a fraud monitoring system according to the present invention is used for monitoring a network.
- FIG. 2 is a diagram showing an example in which the fraud monitoring system according to the present invention is used for monitoring a connection with an external device.
- FIG. 3 is a diagram showing an installation position of a fraud monitoring system according to the present invention.
- FIG. 4 is a block diagram showing a first configuration of a fraud monitoring system according to the present invention.
- FIG. 5 is a block diagram showing a second configuration of the fraud monitoring system according to the present invention.
- FIG. 6 is a diagram showing an example of a user data storage unit of the fraud monitoring system according to the present invention.
- FIG. 7 is a diagram showing an example of a fraud rule storage unit of the fraud monitoring system according to the present invention.
- FIG. 8 is a flowchart showing a flow of a fraud monitoring program working on the present invention. Explanation of symbols
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Storage Device Security (AREA)
- Computer And Data Communications (AREA)
Description
Claims
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/579,668 US20070083938A1 (en) | 2003-11-17 | 2004-07-09 | Invalidity monitoring program, invalidity monitoring method and invalidity monitoring system |
EP04747328A EP1686486A1 (en) | 2003-11-17 | 2004-07-09 | Invalidity monitoring program, invalidity monitoring method, and invalidity monitoring system |
HK07105805.7A HK1098224A1 (en) | 2003-11-17 | 2007-05-31 | Invalidity monitoring method, and invalidity monitoring system |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2003-387212 | 2003-11-17 | ||
JP2003387212A JP3758661B2 (ja) | 2003-11-17 | 2003-11-17 | 不正監視プログラム、不正監視の方法及び不正監視システム |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2005048114A1 true WO2005048114A1 (ja) | 2005-05-26 |
Family
ID=34587420
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2004/009860 WO2005048114A1 (ja) | 2003-11-17 | 2004-07-09 | 不正監視プログラム、不正監視の方法及び不正監視システム |
Country Status (7)
Country | Link |
---|---|
US (1) | US20070083938A1 (ja) |
EP (1) | EP1686486A1 (ja) |
JP (1) | JP3758661B2 (ja) |
KR (1) | KR100836439B1 (ja) |
CN (1) | CN100590613C (ja) |
HK (1) | HK1098224A1 (ja) |
WO (1) | WO2005048114A1 (ja) |
Families Citing this family (30)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7752129B2 (en) | 1998-10-21 | 2010-07-06 | Island Intellectual Property Llc | Systems and methods for managing client accounts |
US7668772B1 (en) | 1998-10-21 | 2010-02-23 | Island Intellectual Property Llc | Systems and methods for money fund banking with flexible interest allocation |
US7536350B1 (en) | 1998-10-21 | 2009-05-19 | Island Intellectual Property Llc | Systems and methods for providing enhanced account management services for multiple banks |
US8150766B1 (en) | 2003-01-27 | 2012-04-03 | Island Intellectual Property Llc | System and method for investing public deposits |
KR100462828B1 (ko) * | 2004-06-22 | 2004-12-30 | 엔에이치엔(주) | 명령어의 유효성 판단 방법 및 그 시스템 |
US8336085B2 (en) * | 2004-11-15 | 2012-12-18 | Microsoft Corporation | Tuning product policy using observed evidence of customer behavior |
JP4849205B2 (ja) * | 2005-09-05 | 2012-01-11 | 有限会社ヒロアイ・システムズ | 不正アクセス防止手段 |
US7730478B2 (en) * | 2006-10-04 | 2010-06-01 | Salesforce.Com, Inc. | Method and system for allowing access to developed applications via a multi-tenant on-demand database service |
US7752107B1 (en) | 2007-02-28 | 2010-07-06 | Island Intellectual Property Llc | System and method for managing aggregated accounts |
JP4264113B2 (ja) * | 2007-04-23 | 2009-05-13 | Sky株式会社 | 端末監視装置及び端末監視プログラム |
US8353032B1 (en) * | 2007-06-29 | 2013-01-08 | Symantec Corporation | Method and system for detecting identity theft or unauthorized access |
US20090210935A1 (en) * | 2008-02-20 | 2009-08-20 | Jamie Alan Miley | Scanning Apparatus and System for Tracking Computer Hardware |
KR101023805B1 (ko) * | 2008-10-15 | 2011-03-21 | (주)씨디네트웍스 | 파일 입출력정보를 이용한 디지털 콘텐츠 보호 방법 및 장치 |
JP2010250502A (ja) * | 2009-04-14 | 2010-11-04 | Nec Corp | 異常操作検出装置、異常操作検出方法、および異常操作検出プログラム |
US8781931B1 (en) | 2009-05-26 | 2014-07-15 | Island Intellectual Property Llc | Method and system for allocating deposits over a plurality of depository institutions |
US8370236B1 (en) | 2009-11-24 | 2013-02-05 | Island Intellectual Property Llc | Method and system for allocating funds over a plurality of time deposit instruments in depository institutions |
JP5396314B2 (ja) | 2010-03-10 | 2014-01-22 | 株式会社日立製作所 | 不正操作検知システム及び不正操作検知方法 |
US8458089B1 (en) | 2010-06-14 | 2013-06-04 | Island Intellectual Property Llc | System, method and program product for administering fund movements using depository institution groups |
JP5417533B2 (ja) | 2010-06-28 | 2014-02-19 | 株式会社日立製作所 | 計算機システムの管理方法及びクライアントコンピュータ |
WO2012001765A1 (ja) | 2010-06-29 | 2012-01-05 | 株式会社日立製作所 | 不正操作検知方法、及び、不正操作を検知する計算機 |
US8583545B1 (en) | 2010-09-20 | 2013-11-12 | Island Intellectual Property Llc | Systems and methods for money fund banking with flexible interest allocation |
WO2012111144A1 (ja) * | 2011-02-18 | 2012-08-23 | 株式会社日立製作所 | 不正操作検知方法、不正操作検知システム及び計算機読み取り可能な非一時的記憶媒体 |
US9152791B1 (en) * | 2011-05-11 | 2015-10-06 | Trend Micro Inc. | Removal of fake anti-virus software |
US8452702B1 (en) | 2011-09-08 | 2013-05-28 | Island Intellectual Property Llc | System, method and program product for minimizing fund movements |
US8655689B1 (en) | 2011-10-13 | 2014-02-18 | Island Intellectual Property Llc | System, method and program product for modeling fund movements |
US9805344B1 (en) | 2015-01-23 | 2017-10-31 | Island Intellectual Property, Llc | Notification system and method |
JP6440203B2 (ja) | 2015-09-02 | 2018-12-19 | Kddi株式会社 | ネットワーク監視システム、ネットワーク監視方法およびプログラム |
JP7180073B2 (ja) * | 2018-01-04 | 2022-11-30 | 富士通株式会社 | 判定プログラム、判定方法、および判定装置 |
US12051104B1 (en) | 2020-11-24 | 2024-07-30 | Island Intellectual Property, Llc | Systems, methods and program products for allocation to maximize insurance or maximize interest for client accounts |
CN117648895B (zh) * | 2024-01-26 | 2024-04-12 | 全智芯(上海)技术有限公司 | 失效分析方法及装置、计算机可读存储介质、终端 |
Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH05120194A (ja) * | 1991-10-29 | 1993-05-18 | Nec Eng Ltd | フアイル保護方式 |
JPH1125045A (ja) * | 1997-06-30 | 1999-01-29 | Nec Corp | アクセス制御方法とその装置及び属性証明書発行装置並びに機械読み取り可能な記録媒体 |
JP2002232451A (ja) * | 2001-02-02 | 2002-08-16 | Layer Seven Co Ltd | 通信管理方法、通信監視装置、および、コンピュータシステム |
JP2002288087A (ja) * | 2001-03-23 | 2002-10-04 | Humming Heads Inc | 情報処理装置及びその方法、情報処理システム及びその制御方法、プログラム |
JP2003044297A (ja) * | 2000-11-20 | 2003-02-14 | Humming Heads Inc | コンピュータリソースの制御を行なう情報処理方法および装置、情報処理システム及びその制御方法並びに記憶媒体、プログラム |
JP2003233521A (ja) * | 2002-02-13 | 2003-08-22 | Hitachi Ltd | ファイル保護システム |
JP2003296193A (ja) * | 2002-04-02 | 2003-10-17 | Seiko Instruments Inc | 不正アクセス監視装置及び方法、並びに不正アクセス監視プログラム |
Family Cites Families (24)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH06236310A (ja) * | 1993-02-09 | 1994-08-23 | Hitachi Ltd | 出力データ保護方法 |
JPH07104882A (ja) * | 1993-10-06 | 1995-04-21 | Toshiba Corp | ポータブルコンピュータシステム |
US6658565B1 (en) * | 1998-06-01 | 2003-12-02 | Sun Microsystems, Inc. | Distributed filtering and monitoring system for a computer internetwork |
US7073196B1 (en) * | 1998-08-07 | 2006-07-04 | The United States Of America As Represented By The National Security Agency | Firewall for processing a connectionless network packet |
US7155480B2 (en) * | 1998-09-21 | 2006-12-26 | Microsoft Corporation | Client-server conference and user seeking through a server storing a list comprising active conference servers and excluding nonactive conference servers |
US6732149B1 (en) * | 1999-04-09 | 2004-05-04 | International Business Machines Corporation | System and method for hindering undesired transmission or receipt of electronic messages |
US6678827B1 (en) * | 1999-05-06 | 2004-01-13 | Watchguard Technologies, Inc. | Managing multiple network security devices from a manager device |
US7100195B1 (en) * | 1999-07-30 | 2006-08-29 | Accenture Llp | Managing user information on an e-commerce system |
US6986061B1 (en) * | 2000-11-20 | 2006-01-10 | International Business Machines Corporation | Integrated system for network layer security and fine-grained identity-based access control |
JP3723076B2 (ja) * | 2000-12-15 | 2005-12-07 | 富士通株式会社 | 不正侵入防御機能を有するip通信ネットワークシステム |
US7350229B1 (en) * | 2001-03-07 | 2008-03-25 | Netegrity, Inc. | Authentication and authorization mapping for a computer network |
US7681032B2 (en) * | 2001-03-12 | 2010-03-16 | Portauthority Technologies Inc. | System and method for monitoring unauthorized transport of digital content |
US7921290B2 (en) * | 2001-04-18 | 2011-04-05 | Ipass Inc. | Method and system for securely authenticating network access credentials for users |
US7356840B1 (en) * | 2001-06-19 | 2008-04-08 | Microstrategy Incorporated | Method and system for implementing security filters for reporting systems |
US20030084331A1 (en) * | 2001-10-26 | 2003-05-01 | Microsoft Corporation | Method for providing user authentication/authorization and distributed firewall utilizing same |
US6892309B2 (en) * | 2002-02-08 | 2005-05-10 | Enterasys Networks, Inc. | Controlling usage of network resources by a user at the user's entry point to a communications network based on an identity of the user |
US6990592B2 (en) * | 2002-02-08 | 2006-01-24 | Enterasys Networks, Inc. | Controlling concurrent usage of network resources by multiple users at an entry point to a communications network based on identities of the users |
US7536548B1 (en) * | 2002-06-04 | 2009-05-19 | Rockwell Automation Technologies, Inc. | System and methodology providing multi-tier-security for network data exchange with industrial control components |
US7356695B2 (en) * | 2002-08-01 | 2008-04-08 | International Business Machines Corporation | Multi-level security systems |
US7386889B2 (en) * | 2002-11-18 | 2008-06-10 | Trusted Network Technologies, Inc. | System and method for intrusion prevention in a communications network |
US7669225B2 (en) * | 2003-05-06 | 2010-02-23 | Portauthority Technologies Inc. | Apparatus and method for assuring compliance with distribution and usage policy |
US7509673B2 (en) * | 2003-06-06 | 2009-03-24 | Microsoft Corporation | Multi-layered firewall architecture |
US7328451B2 (en) * | 2003-06-30 | 2008-02-05 | At&T Delaware Intellectual Property, Inc. | Network firewall policy configuration facilitation |
US7493650B2 (en) * | 2003-07-01 | 2009-02-17 | Portauthority Technologies Inc. | Apparatus and method for ensuring compliance with a distribution policy |
-
2003
- 2003-11-17 JP JP2003387212A patent/JP3758661B2/ja not_active Expired - Lifetime
-
2004
- 2004-07-09 KR KR1020067007740A patent/KR100836439B1/ko active IP Right Grant
- 2004-07-09 US US10/579,668 patent/US20070083938A1/en not_active Abandoned
- 2004-07-09 WO PCT/JP2004/009860 patent/WO2005048114A1/ja not_active Application Discontinuation
- 2004-07-09 CN CN200480033781A patent/CN100590613C/zh not_active Expired - Fee Related
- 2004-07-09 EP EP04747328A patent/EP1686486A1/en not_active Withdrawn
-
2007
- 2007-05-31 HK HK07105805.7A patent/HK1098224A1/xx not_active IP Right Cessation
Patent Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH05120194A (ja) * | 1991-10-29 | 1993-05-18 | Nec Eng Ltd | フアイル保護方式 |
JPH1125045A (ja) * | 1997-06-30 | 1999-01-29 | Nec Corp | アクセス制御方法とその装置及び属性証明書発行装置並びに機械読み取り可能な記録媒体 |
JP2003044297A (ja) * | 2000-11-20 | 2003-02-14 | Humming Heads Inc | コンピュータリソースの制御を行なう情報処理方法および装置、情報処理システム及びその制御方法並びに記憶媒体、プログラム |
JP2002232451A (ja) * | 2001-02-02 | 2002-08-16 | Layer Seven Co Ltd | 通信管理方法、通信監視装置、および、コンピュータシステム |
JP2002288087A (ja) * | 2001-03-23 | 2002-10-04 | Humming Heads Inc | 情報処理装置及びその方法、情報処理システム及びその制御方法、プログラム |
JP2003233521A (ja) * | 2002-02-13 | 2003-08-22 | Hitachi Ltd | ファイル保護システム |
JP2003296193A (ja) * | 2002-04-02 | 2003-10-17 | Seiko Instruments Inc | 不正アクセス監視装置及び方法、並びに不正アクセス監視プログラム |
Also Published As
Publication number | Publication date |
---|---|
CN100590613C (zh) | 2010-02-17 |
CN1882924A (zh) | 2006-12-20 |
EP1686486A1 (en) | 2006-08-02 |
JP3758661B2 (ja) | 2006-03-22 |
KR20060107743A (ko) | 2006-10-16 |
US20070083938A1 (en) | 2007-04-12 |
JP2005149243A (ja) | 2005-06-09 |
KR100836439B1 (ko) | 2008-06-09 |
HK1098224A1 (en) | 2007-07-13 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2005048114A1 (ja) | 不正監視プログラム、不正監視の方法及び不正監視システム | |
US8219496B2 (en) | Method of and apparatus for ascertaining the status of a data processing environment | |
US20100037324A1 (en) | Computer file control through file tagging | |
US7331061B1 (en) | Integrated computer security management system and method | |
US8291498B1 (en) | Computer virus detection and response in a wide area network | |
AU2009265026B2 (en) | A system and method of data cognition incorporating autonomous security protection | |
US7831672B2 (en) | Systems and methods for securing computers | |
JP3900501B2 (ja) | ネットワーク接続制御プログラム、ネットワーク接続の制御方法及びネットワーク接続制御システム | |
JP2008541273A5 (ja) | ||
US20040088565A1 (en) | Method of identifying software vulnerabilities on a computer system | |
JP2006252256A (ja) | ネットワーク管理システム、方法およびプログラム | |
JP2006268544A (ja) | ネットワーク接続制御システム、ネットワーク接続制御方法、およびネットワーク接続制御プログラム | |
GB2507360A (en) | Threat detection through the accumulated detection of threat characteristics | |
TWI235580B (en) | Network security system and method for recording and resisting hacker | |
JP4984531B2 (ja) | サーバ監視プログラム、中継装置、サーバ監視方法 | |
US11924235B2 (en) | Leveraging user-behavior analytics for improved security event classification | |
CN109766694A (zh) | 一种工控主机的程序协议白名单联动方法及装置 | |
US20220014563A1 (en) | Cloud native discovery and protection | |
CN107317816A (zh) | 一种基于客户端应用程序鉴别的网络访问控制方法 | |
JP2006066982A (ja) | ネットワーク接続制御システム | |
JP2005322261A (ja) | 不正監視プログラム、不正監視の方法及び不正監視システム | |
JP2002259187A (ja) | 異常ファイル検出および除去を目的とした着脱可能ファイル監視システム | |
US20180124076A1 (en) | Method for transmitting data | |
JP5046181B2 (ja) | セッション制御システム及びセッション制御方法 | |
US20130246795A1 (en) | System, method, and computer program product for allowing content transfer based on a signature and a context thereof |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
WWE | Wipo information: entry into national phase |
Ref document number: 200480033781.9 Country of ref document: CN |
|
AK | Designated states |
Kind code of ref document: A1 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A1 Designated state(s): BW GH GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
WWE | Wipo information: entry into national phase |
Ref document number: 1020067007740 Country of ref document: KR Ref document number: 1029/KOLNP/2006 Country of ref document: IN |
|
WWE | Wipo information: entry into national phase |
Ref document number: 12006500967 Country of ref document: PH |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2004747328 Country of ref document: EP Ref document number: 2007083938 Country of ref document: US Ref document number: 10579668 Country of ref document: US |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
WWW | Wipo information: withdrawn in national office |
Ref document number: DE |
|
WWP | Wipo information: published in national office |
Ref document number: 2004747328 Country of ref document: EP |
|
WWP | Wipo information: published in national office |
Ref document number: 1020067007740 Country of ref document: KR |
|
WWP | Wipo information: published in national office |
Ref document number: 10579668 Country of ref document: US |
|
NENP | Non-entry into the national phase |
Ref country code: JP |