Abstract:
A monitoring apparatus include a memory which stores a program for executing procedures and a processor coupled to the memory and executes the procedures based on the program, wherein the procedures includes detecting a destination of access from a server apparatus to a storage apparatus on the basis of a result of analysis of a packet transmitted and received between the storage apparatus and the server apparatus, the storage apparatus including a plurality of storage areas, the server apparatus executing a plurality of virtual servers, part of the plurality of storage areas being allocated to each of the plurality of virtual servers as an accessible storage area, and determining that abnormal access is performed from the server apparatus to the storage apparatus when the storage areas of the detected destination are beyond a certain criterion in the plurality of storage areas.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
       [0001]    This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2011-211653, filed on Sep. 27, 2011, the entire contents of which are incorporated herein by reference. 
       FIELD 
       [0002]    The embodiments discussed herein are related to a monitoring apparatus, a control method, and a control program. 
       BACKGROUND 
       [0003]    There are technologies to connect physical servers to storage apparatuses over networks. The technologies include Internet Small Computer System Interface (iSCSI), in which physical servers are coupled to storage apparatuses over Internet Protocol (IP) networks. Network addresses, such as IP addresses, are given to the physical servers and the storage apparatuses coupled over the IP networks on the basis of network devices installed in the physical servers and the storage apparatuses, and the physical servers communicate with the storage apparatuses by using the network addresses. 
         [0004]    Multiple virtual machines (VMs) can be run on the physical servers to access the storage apparatuses on the networks in recent years. 
         [0005]    Since the network addresses used in the communication are given to the respective network devices. In other words, the network addresses are not given to the respective VMs running on the physical servers. Accordingly, the network addresses allocated to the network devices (e.g. NIC (Network Interface Card)) installed in the physical servers are used in access from the VMs running on the physical servers to the storage apparatuses. In other words, the multiple VMs running on the physical servers may use the same network addresses to access the storage apparatuses. 
         [0006]    Since the multiple physical servers access the storage apparatuses over the networks, accessible areas in the storage apparatuses can be restricted for every physical server from the viewpoint of security. However, any physical server can make access beyond the accessible areas that are set in advance due to, for example, faulty or malicious software (such access is hereinafter called unauthorized access). Such unauthorized access can be monitored by capturing packets on the networks. For example, packet capture apparatuses are provided in the networks and source physical servers are identified on the basis of the network addresses included in the packets captured by the packet capture apparatuses to monitor the presence of access to areas outside the accessible areas of the storage apparatuses included in the packets. 
         [0007]    However, when the source IP addresses are allocated to the respective network devices (e.g. NIC) installed in the physical servers, as described above, even if the packets are acquired, it may not be determined which VMs running on the physical severs transmits the packets. 
         [0008]    Accordingly, it is not possible to determine whether the respective VMs make access to areas outside the allocated areas or within the allocated areas by using the source network addresses. 
         [0009]    In other words, in the identification by using the source IP addresses, it is not possible to determine whether the access from the physical servers executing the virtual servers is unauthorized access or authorized access to the storage apparatuses. 
         [0010]    Related art is disclosed in, for example, Japanese Laid-open Patent Publication No. 2005-269486. 
       SUMMARY 
       [0011]    According to an aspect of the embodiments, a monitoring apparatus includes a memory which stores a program for executing procedures and a processor coupled to the memory and executes the procedures based on the program, wherein the procedures include detecting a destination of access from a server apparatus to a storage apparatus on the basis of a result of analysis of a packet transmitted and received between the storage apparatus and the server apparatus, the storage apparatus including a plurality of storage areas, the server apparatus executing a plurality of virtual servers, part of the plurality of storage areas being allocated to each of the plurality of virtual servers as an accessible storage area, and determining that abnormal access is performed from the server apparatus to the storage apparatus when the storage areas of the detected destination are beyond a certain criterion in the plurality of storage areas. 
         [0012]    The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims. 
         [0013]    It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0014]      FIG. 1  illustrates an information processing system according to an embodiment; 
           [0015]      FIG. 2  is a block diagram illustrating a server in the present embodiment illustrated in  FIG. 1 ; 
           [0016]      FIG. 3  is a block diagram of a monitoring apparatus in the present embodiment illustrated in  FIG. 1 ; 
           [0017]      FIG. 4  is a block diagram of the information processing system in the present embodiment illustrated in  FIG. 1 ; 
           [0018]      FIG. 5  illustrates an example of the configuration of the information processing system when a storage apparatus is allocated to virtual servers; 
           [0019]      FIG. 6  illustrates an iSCSI command format used to read data in iSCSI; 
           [0020]      FIG. 7  illustrates a format in a Command Descriptor Block (CDB); 
           [0021]      FIG. 8  illustrates a specific area information table; 
           [0022]      FIG. 9  illustrates an access determination information table; 
           [0023]      FIG. 10  is a block diagram of an information processing system according to a first embodiment; 
           [0024]      FIG. 11  is a flow chart illustrating a process in a monitoring apparatus in the first embodiment; 
           [0025]      FIG. 12  is a block diagram of an information processing system according to a second embodiment; 
           [0026]      FIG. 13  is a flow chart illustrating a process in a monitoring apparatus in the second embodiment; 
           [0027]      FIG. 14  is a block diagram of an information processing system according to a third embodiment; 
           [0028]      FIG. 15  is a flow chart illustrating a process in a monitoring apparatus in the third embodiment; 
           [0029]      FIG. 16  is a block diagram of an information processing system according to a fourth embodiment; 
           [0030]      FIG. 17  illustrates another access determination information table; and 
           [0031]      FIG. 18  is a flow chart illustrating a process in a monitoring apparatus in the fourth embodiment. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0032]    Information processing systems according to embodiments will herein be described with reference to the attached drawings. 
         [0033]      FIG. 1  illustrates an information processing system according to an embodiment. Referring to  FIG. 1 , the information processing system includes multiple servers  100 , a network  200 , a monitoring apparatus  300 , and multiple storage apparatuses  400 . The multiple servers  100 , the monitoring apparatus  300 , and the multiple storage apparatuses  400  are coupled to each other over the network  200 . Each server  100  executes virtual machines (VMs). The monitoring apparatus  300  monitors the servers  100  and the storage apparatuses  400 . Each storage apparatus  400  include multiple disks in which data is stored. The configuration including the servers  100  and the storage apparatuses  400  may be considered as a minimum configuration of the information processing system. 
         [0034]      FIG. 2  is a block diagram illustrating the server  100  in the present embodiment illustrated in  FIG. 1 . Referring to  FIG. 2 , the server  100  includes a central processing unit (CPU)  201 , a main storage  202 , a system controller  203 , a bus  204 , a network controller  207 , a power supply  209 , a disk controller  212 , and a hard disk  213 . The server  100  is controlled by the CPU  201 . 
         [0035]    The system controller  203  is coupled to the CPU  201  and the main storage  202 . The system controller  203  controls data transfer between the CPU  201  and the main storage  202  and data transfer between the CPU  201  and the bus  204 . The network controller  207  and the disk controller  212  are coupled to the system controller  203  via the bus  204 . 
         [0036]    At least part of programs in an operating system (OS) executed by the CPU  201  and application programs is temporarily stored in the main storage  202 . A variety of data for processing in the CPU  201  is stored in the main storage  202 . For example, a random access memory (RAM) is used as the main storage  202 . 
         [0037]    The hard disk  213  is coupled to the disk controller  212 . The disk controller  212  controls the hard disk  213 . 
         [0038]    The hard disk  213  stores an application program  3000  used by the CPU  201  to execute the VMs on the main storage  202 , a control program  2000  used by the CPU  201  to perform control, for example, calling of the application program  3000 , and a variety of data. 
         [0039]    The network controller  207  is coupled to the other servers  100  and the storage apparatuses  400  illustrated in  FIG. 1 , and performs transmission and reception of data between the server  100  and the storage apparatuses  400 . 
         [0040]    The power supply  209  supplies electric power to the hardware in the server  100  via power lines (not illustrated). 
         [0041]    The hardware described above realizes the processing function of the server  100 . 
         [0042]      FIG. 3  is a block diagram of the monitoring apparatus  300  in the present embodiment illustrated in  FIG. 1 . Referring to  FIG. 3 , the monitoring apparatus  300  includes a CPU  221 , a main storage  222 , a system controller  223 , a bus  224 , a network controller  227 , a power supply  229 , a disk controller  232 , and a hard disk  233 . The monitoring apparatus  300  is controlled by the CPU  221 . 
         [0043]    The system controller  223  is coupled to the CPU  221  and the main storage  222 . The system controller  223  controls data transfer between the CPU  221  and the main storage  222  and data transfer between the CPU  221  and the bus  224 . The network controller  227  and the disk controller  232  are coupled to the system controller  223  via the bus  224 . 
         [0044]    At least part of programs in an OS executed by the CPU  221  and application programs is temporarily stored in the main storage  222 . A variety of data for processing in the CPU  221  is stored in the main storage  222 . For example, a RAM is used as the main storage  222 . 
         [0045]    The hard disk  233  is coupled to the disk controller  232 . The disk controller  232  controls the hard disk  233 . 
         [0046]    The hard disk  233  stores an application program  1000  executed by the CPU  221  on the main storage  222 , a control program  4000  used by the CPU  221  to perform control, for example, calling of the application program  1000 , and a variety of data. The hard disk  233  stores, for example, a specific area information table  510 . The specific area information table  510  will be described below. 
         [0047]    The network controller  227  is coupled to the servers  100  and the storage apparatuses  400  illustrated in  FIG. 1  and performs transmission and reception of data between the servers  100  and the storage apparatuses  400 . 
         [0048]    The power supply  229  supplies electric power to the hardware in the monitoring apparatus  300  via power lines (not illustrated). 
         [0049]    The hardware described above realizes the processing function of the monitoring apparatus  300 . 
         [0050]      FIG. 4  is a block diagram of the information processing system in the present embodiment illustrated in  FIG. 1 . The CPU  201  in the server  100  executes the application program  3000  on the main storage  202  to cause the VMs to be executed in the server  100 . Referring to  FIG. 4 , a “VMA”  110  and a “VMB”  120 , and a “VMC”  130  and a “VMD”  140  are executed in the respective servers  100 . Each server  100  includes a hypervisor  150 . The hypervisor  150  manages the VMs and controls input and output. 
         [0051]    The storage apparatus  400  includes a “disk  0 ”  410 , a “disk  1 ”  420 , a “disk  2 ”  430 , and a “disk  3 ”  440 . Data is stored in the “disk  0 ”  410  to the disk  3 ″  440 . The “disk  0 ”  410  is associated with the “VMA”  110 , the disk  1 ″  420  is associated with the “VMB”  120 , the disk  2 ″  430  is associated with the “VMC”  130 , and the disk  3 ″  440  is associated with the “VMD”  140 . 
         [0052]    The CPU  221  in the monitoring apparatus  300  executes the application program  1000  on the main storage  222  to execute a packet capturer  310  and a logic executor  320  in the monitoring apparatus  300 . The hard disk  233  stores virtual system configuration information  540 . The virtual system configuration information  540  indicates the VMs and the disks associated with the VMs. The packet capturer  310  acquires packets transmitted and received between the servers  100  and the storage apparatuses  400  over the network  200 . The packet capturer  310  may acquire packets, for example, via a port mirroring of a switch or a tap device. The logic executor  320  performs a variety of processing by referring to an IP address included in each packet to detect unauthorized access to the storage apparatus  400 . 
         [0053]      FIG. 5  illustrates an example of the configuration of the information processing system when the storage apparatus  400  is allocated to the respective servers  100  and the respective virtual servers (the VMA  110  to the VMD  140 ) by using the iSCSI. 
         [0054]    The physical disk  410  is installed in the storage apparatus  400  (although one physical disk  410  is illustrated in  FIG. 5  for convenience, multiple physical disks are actually installed). 
         [0055]    Each server  100  includes a virtual disk uniquely associated with the physical disk  410 . For example, virtual disks  160  having the same configuration are arranged in the respective servers  100 . 
         [0056]    A logical disk1  111 , a logical disk2  121 , a logical disk3  131 , and a logical disk4  141  are allocated to the VMA  110 , the VMB  120 , the VMC  130 , and the VMD  140 , respectively. The logical disk1  111 , the logical disk2  121 , the logical disk3  131 , and the logical disk4  141  are allocated as areas used to access exclusive areas where the corresponding VMs are not capable of accessing the same area in the virtual disks  160  in the physical servers in which the respective logical disks are installed. 
         [0057]      FIG. 6  illustrates an iSCSI command format  610  used to read data in the iSCSI. 
         [0058]      FIG. 7  illustrates a format  620  in a Command Descriptor Block (CDB) when data is read in actual communication between the server  100  and the storage apparatus  400  using the iSCSI. 
         [0059]      FIG. 8  illustrates the specific area information table  510 . Information indicating a specific area in all the disks of a virtual storage is recorded in the specific area information table  510 . The specific area information table  510  includes columns of item number  511 , variable  512 , and description  513 . A variable “IP (initiator)”in an item number “1” indicates the IP address of Initiator. The IP address of Initiator is the IP address of the physical server. A variable “IP (target)” in an item number “2” indicates the IP address of Target. The IP address of Target is the IP address of the storage apparatus  400 . A variable “Logical Unit Number (LUN)” in an item number “3” indicates the value of an LUN. The LUN is the number identifying each logical unit resulting from division of the storage apparatus into certain areas. A variable “Logical Block Address (LBA)” in an item number “4” indicates the start value of an LBA. The LBA is the address number identifying each logical block resulting from further division of each certain area and the start value of the LBA indicates the beginning LBA of an area. A variable “LBA range” in an item number “5” indicates Offset of the LBA. The Offset of the LBA indicates the number of logical blocks included in the area. The Offset of the LBA may be set to an arbitrary value. For example, when the Offset of the LBA is set to “10”, the certain unit area includes ten logical blocks. 
         [0060]      FIG. 9  illustrates an access determination information table  520 . Information about access to a certain area is recorded in the access determination information table  520 . The access determination information table  520  indicates which physical server accesses which area in the storage apparatus and is generated in association with each physical server. The access determination information table  520  includes columns of item number  521 , variable  522 , and description  523 . A variable “IP (target)” in an item number “1” indicates the IP address of Target. A variable “time” in an item number “2” indicates an access time when a physical server accesses an area in the storage apparatus. The logic executor  320  performs determination of whether the storage apparatus is abnormally accessed when a certain time elapsed since the access time. A variable “LUN” in an item number “3” indicates the value of the LUN of the accessed area. A variable “LBA” in an item number “4” indicates the start value of the LBA of the accessed area. A variable “LBA range” in an item number “5” indicates Offset of the LBA defining the range of the accessed area. A variable “access count” in an item number “6” indicates the number of times when the LBA is accessed. 
         [0061]      FIG. 10  is a block diagram of an information processing system according to a first embodiment. The same reference numerals are used in  FIG. 10  to identify the components described above. A description of such component s is omitted herein. In the first embodiment, it is determined that, as in the case of the VMB  120 , access to the storage apparatus  400  including areas other than the area allocated to the VMB  120  is abnormal. It is determined that, as in the case of the VMD  140 , access to part of the area allocated in the VMD  140  in the storage apparatus  400  is normal. 
         [0062]    Referring to  FIG. 10 , the respective servers  100  execute the VMA  110  and the VMB  120  and the VMC  130  and the VMD  140 . The VMA  110  allocates the logical disk 1  111  from the virtual disk  160 . The VMB  120  allocates the logical disk 2  121  from the virtual disk  160 . The VMC  130  allocates the logical disk 3  131  from the virtual disk  160 . The VMD  140  allocates the logical disk 4  141  from the virtual disk  160 . Each iSCSI  170  is a storage interface to connect the storage apparatus  400  to the corresponding server  100 . 
         [0063]    The storage apparatus  400  includes an iSCSI  180 , a logical block “L0”  411 , a logical block “L1”  412 , a logical block “L2”  413 , a logical block “L3”  421 , a logical block “L4”  422 , a logical block “L5”  423 , a logical block “L6”  431 , a logical block “L7”  432 , a logical block “L8”  433 , a logical block “L9”  441 , a logical block “L10”  442 , and a logical block “L11”  443 . The logical block “L0”  411  to the logical block “L2”  413  are allocated to the VMA  110 . The logical block “L3”  421  to the logical block “L5”  423  are allocated to the VMB  120 . The logical block “L6”  431  to the logical block “L8”  433  are allocated to the VMC  130 . The logical block “L9”  441  to the logical block “L11”  443  are allocated to the VMD  140 . The iSCSI  180  is a storage interface to connect the storage apparatus  400  to each server  100 . The logic executor  320  in the monitoring apparatus  300  refers to the IP address of Initiator, the IP address of Target, the LUN, the LBA, and the LBA range included in the packet analyzed by the packet capturer  310  to record the number of each logical block and the access count to the logical block in association with each other in the access determination information table  520  illustrated in  FIG. 9 . 
         [0064]      FIG. 11  is a flow chart illustrating a process in the monitoring apparatus  300  in the first embodiment. 
         [0065]    Referring to  FIG. 11 , in Step S 101 , the logic executor  320  acquires the current time. Then, the process goes to Step S 102 . 
         [0066]    In Step S 102 , the logic executor  320  determines whether a certain time elapsed from the difference between the time acquired in Step S 101  and the time when Step S 102  was previously performed. If the certain time elapsed (YES in Step S 102 ), the process goes to Step S 105 . If the certain time did not elapse (NO in Step S 102 ), the process goes to Step S 103 . 
         [0067]    In Step S 103 , the packet capturer  310  acquires a packet transmitted and received between the server  100  and the storage apparatus  400  over the network  200 . Then, the process goes to Step S 104 . 
         [0068]    In Step S 104 , the logic executor  320  updates the access count to each key for every specific area in the access determination information table  520  corresponding to the source physical server of the packet acquired by the packet capturer  310  on the basis of the IP address of Initiator, the IP address of Target, the LUN, and so on of the packet. The key is an area identified by the three items including the LUN, the LBA, and the LBA range. Then, the process goes back to Step S 102 . 
         [0069]    In Step S 105 , the logic executor  320  refers to the access determination information table  520  to acquire the access count to each key for every specific area. In the first embodiment, the logic executor  320  uses each logical block as an example of the specific area unit to acquire the access count to each key in the logical block. Then, the process goes to Step S 106 . 
         [0070]    In Step S 106 , the logic executor  320  determines whether the access counts to all the keys are larger than zero ( 0 ). If the access counts to all the keys are larger than zero (YES in Step S 106 ), the process goes to Step S 107 . If the access counts to all the keys are not larger than zero (NO in Step S 106 ), the process goes to Step S 108 . 
         [0071]    In Step S 107 , the logic executor  320  determines that the access from the VM to the storage apparatus is abnormal. Then, the process goes to Step S 109 . 
         [0072]    In Step S 108 , the logic executor  320  determines that the access from the VM to the storage apparatus is normal. Then, the process goes to Step S 109 . 
         [0073]    In Step S 109 , the logic executor  320  clears the access counts to all the keys. For example, the logic executor  320  sets the access count in the access determination information table  520  to zero. Then, the process goes back to Step S 101 . 
         [0074]    According to the first embodiment, it is determined that the access to the entire specific area in a unit time is abnormal and that the access to part of the specific area in the unit time is normal. This is based on the fact that the normal VM possibly accesses a specific disk area in the unit time but a malicious VM possibly accesses the entire disk area in the unit time. On the basis of the possibility described above, it is determined that the physical servers accessing the entire specific area in the unit time include the VMs performing the unauthorized access. 
         [0075]    If it is determined in Step S 107  that the access from the VM to the storage apparatus is abnormal, for example, the logic executor  320  may notify a manager that the abnormal access occurs by using an electronic mail or the like. If it is determined in Step S 107  that the access from the VM to the storage apparatus is abnormal, for example, the logic executor  320  may output a log indicating the abnormal access. 
         [0076]      FIG. 12  is a block diagram of an information processing system according to a second embodiment. The same reference numerals are used in  FIG. 12  to identify the components described above. A description of such component s is omitted herein. In the second embodiment, it is determined that, as in the case of the VMB  120 , sequential access to the areas defined by the LBA indicated by Lx ( 411  to  443 ) and Offset, including areas other than the area allocated to the VMB  120  in the storage apparatus  400  is abnormal. It is determined that, as in the case of the VMD  140 , access to part of the area allocated in the VMD  140  in the storage apparatus  400  is normal. 
         [0077]      FIG. 13  is a flow chart illustrating a process in the monitoring apparatus  300  in the second embodiment. 
         [0078]    Referring to  FIG. 13 , in Step S 201 , the logic executor  320  acquires the current time. Then, the process goes to Step S 202 . 
         [0079]    In Step S 202 , the logic executor  320  determines whether a certain time elapsed from the difference between the time acquired in Step S 201  and the time when Step S 202  was previously performed. If the certain time elapsed (YES in Step S 202 ), the process goes to Step S 205 . If the certain time did not elapse (NO in Step S 202 ), the process goes to Step S 203 . 
         [0080]    In Step S 203 , the packet capturer  310  acquires a packet transmitted and received between the server  100  and the storage apparatus  400  over the network  200 . Then, the process goes to Step S 204 . 
         [0081]    In Step S 204 , the logic executor  320  updates the access count to each key for every specific area in the access determination information table  520  corresponding to the source physical server of the packet acquired by the packet capturer  310  on the basis of the IP address of Initiator, the IP address of Target, the LUN, and so on of the packet. Then, the process goes back to Step S 202 . 
         [0082]    In Step S 205 , the logic executor  320  refers to the access determination information table  520  to acquire the access count to each key for every specific area. In the second embodiment, the logic executor  320  uses each logical block as an example of the specific area unit to acquire the access count to each key in the logical block. Then, the process goes to Step S 206 . 
         [0083]    In Step S 206 , the logic executor  320  determines whether the key immediately before the accessed key is set zero ( 0 ). For example, the logic executor  320  refers to the access determination information table  520  to determine whether the last logical block is accessed. If the key immediately before the accessed key is set to zero (YES in Step S 206 ), the process goes to Step S 207 . If the key immediately before the accessed key is not set to zero (NO in Step S 206 ), the process goes to Step S 208 . 
         [0084]    In Step S 207 , the logic executor  320  determines that the access from the VM to the storage apparatus is normal. Then, the process goes to Step S 209 . 
         [0085]    In Step S 208 , the logic executor  320  determines that the access from the VM to the storage apparatus is abnormal. Then, the process goes to Step S 209 . 
         [0086]    In Step S 209 , the logic executor  320  initializes the access counts to all the keys to zero to clear the access counts to all the keys. Then, the process goes back to Step S 201 . 
         [0087]    According to the second embodiment, it is determined that the sequential access to the entire specific area from the logical block “L0” to the logical block “L5” is abnormal and that the access to part of the specific area in the unit time is normal. This is based on the fact that, although there is a probability that the entire specific area of the disk is accessed also in the normal access, such an access is possibly redundantly performed at random. In contrast, when a malicious VM accesses the entire specific area, the specific area is possibly sequentially accessed in order to efficiently collect data. 
         [0088]      FIG. 14  is a block diagram of an information processing system according to a third embodiment. The same reference numerals are used in  FIG. 14  to identify the components described above. A description of such component s is omitted herein. Numbers in parentheses added to the logical block “L0”  411  to the logical block “L11”  443  indicate the number of times when the logical blocks are accessed by the server  100  in a certain time. In the third embodiment, it is determined that, as in the case of the logical block “L0”  411  to the logical block “L5”  423 , access to the entire specific area at random without redundancy is abnormal. It is determined that, as in the case of the logical block “L6”  431  to the logical block “L11”  443 , redundant access to the entire specific area is normal. 
         [0089]      FIG. 15  is a flow chart illustrating a process in the monitoring apparatus  300  in the third embodiment. 
         [0090]    Referring to  FIG. 13 , in Step S 301 , the logic executor  320  acquires the current time. Then, the process goes to Step S 302 . 
         [0091]    In Step S 302 , the logic executor  320  determines whether a certain time elapsed from the difference between the time acquired in Step S 301  and the time when Step S 302  was previously performed. If the certain time elapsed (YES in Step S 302 ), the process goes to Step S 305 . If the certain time did not elapse (NO in Step S 302 ), the process goes to Step S 303 . 
         [0092]    In Step S 303 , the packet capturer  310  acquires a packet transmitted and received between the server  100  and the storage apparatus  400  over the network  200 . Then, the process goes to Step S 304 . 
         [0093]    In Step S 304 , the logic executor  320  updates the access count to each key for every specific area in the access determination information table  520  corresponding to the source physical server of the packet acquired by the packet capturer  310  on the basis of the IP address of Initiator, the IP address of Target, the LUN, and so on of the packet. Then, the process goes back to Step S 302 . 
         [0094]    In Step S 305 , the logic executor  320  refers to the access determination information table  520  to acquire the access count to each key for every specific area. In the third embodiment, the logic executor  320  uses each logical block as an example of the specific area unit to acquire the access count to each key in the logical block. Then, the process goes to Step S 306 . 
         [0095]    In Step S 306 , the logic executor  320  determines whether the access counts to all the keys are larger than n and smaller than m. If the determination condition is met (YES in Step S 306 ), the process goes to Step S 307 . If the determination condition is not met (NO in Step S 306 ), the process goes to Step S 308 . 
         [0096]    In Step S 307 , the logic executor  320  determines that the access from the VM to the storage apparatus is abnormal. Then, the process goes to Step S 309 . 
         [0097]    In Step S 308 , the logic executor  320  determines that the access from the VM to the storage apparatus is normal. Then, the process goes to Step S 309 . 
         [0098]    In Step S 309 , the logic executor  320  clears the access counts to all the keys. Then, the process goes back to Step S 301 . 
         [0099]    According to the third embodiment, it is determined that the access to the entire specific area at random without redundancy is abnormal and that the redundant access to the entire specific area at random is normal. This is based on the fact that there is a probability that the entire specific area of the disk is accessed also in the normal access. In contrast, when a malicious VM accesses the entire specific area, the specific area is possibly accessed without redundancy in order to efficiently collect data. Arbitrary values meeting the condition “n&lt;m” may be set for m and n used in Step S 306 . 
         [0100]      FIG. 16  is a block diagram of an information processing system according to a fourth embodiment. The same reference numerals are used in  FIG. 16  to identify the components described above. A description of such component s is omitted herein. It is assumed in  FIG. 16  that data is recorded in the logical block “L0”  411 , the logical block “L1”  412 , the logical block “L3”  421 , and the logical block “L5”  423 . In the fourth embodiment, it is determined that access to the logical block “L0”  411 , the logical block “L1”  412 , the logical block “L3”  421 , and/or the logical block “L5”  423  is abnormal. 
         [0101]      FIG. 17  illustrates an access determination information table  530 . Information about access to a certain area is recorded in the access determination information table  530 . The access determination information table  530  includes columns of item number  531 , variable  532  and description  533 . A variable “IP (target)” in an item number “1” indicates the IP address of Target. A variable “time” in an item number “2” indicates an access time when an area is accessed. The logic executor  320  performs determination of whether the storage apparatus is abnormally accessed when a certain time elapsed since the access time. A variable “LUN” in an item number “3” indicates the value of the LUN of the accessed area. A variable “LBA” in an item number “4” indicates the start value of the LBA of the accessed area. A variable “LBA range” in an item number “5” indicates Offset of the LBA defining the range of the accessed area. A variable “access count” in an item number “6” indicates the number of times when the LBA is accessed. A variable “writing field” in an item number “7” indicates whether writing to the corresponding key occurs. If the logical block “L0”  411 , the logical block “L1”  412 , the logical block “L3”  421 , and/or the logical block “L5”  423  in which the data is recorded is accessed, the logic executor  320  switches the flag of the writing occurrence recording field corresponding to the logical block from “0” to “1.” 
         [0102]      FIG. 18  is a flow chart illustrating a process in the monitoring apparatus  300  in the fourth embodiment. 
         [0103]    Referring to  FIG. 18 , in Step S 401 , the logic executor  320  acquires the current time. Then, the process goes to Step S 402 . 
         [0104]    In Step S 402 , the logic executor  320  determines whether a certain time elapsed from the difference between the time acquired in Step S 401  and the time when Step S 402  was previously performed. If the certain time elapsed (YES in Step S 402 ), the process goes to Step S 405 . If the certain time did not elapse (NO in Step S 402 ), the process goes to Step S 403 . 
         [0105]    In Step S 403 , the packet capturer  310  acquires a packet transmitted and received between the server  100  and the storage apparatus  400  over the network  200 . Then, the process goes to Step S 404 . 
         [0106]    In Step S 404 , the logic executor  320  updates the access count to each key for every specific area in the access determination information table  520  corresponding to the source physical server of the packet acquired by the packet capturer  310  on the basis of the IP address of Initiator, the IP address of Target, the LUN, and so on of the packet. Then, the process goes back to Step S 402 . 
         [0107]    In Step S 405 , the logic executor  320  refers to the access determination information table  520  to acquire the access count to each key for every specific area. In the fourth embodiment, the logic executor  320  uses each logical block as an example of the specific area unit to acquire the access count to each key in the logical block. Then, the process goes to Step S 406 . 
         [0108]    In Step S 406 , the logic executor  320  determines whether the access count to the key is larger than zero (0) and the flag of the writing field is set to one (1). If the determination condition is met (YES in Step S 406 ), the process goes to Step S 407 . If the determination condition is not met (NO in Step S 406 ), the process goes to Step S 408 . 
         [0109]    In Step S 407 , the logic executor  320  determines that the access from the VM to the storage apparatus is abnormal. Then, the process goes to Step S 409 . 
         [0110]    In Step S 408 , the logic executor  320  determines that the access from the VM to the storage apparatus is normal. Then, the process goes to Step S 409 . 
         [0111]    In Step S 409 , the logic executor  320  initializes the access counts to all the keys and the flag of the writing field to zero to clear the access counts to all the keys. Then, the process goes back to Step S 401 . 
         [0112]    The fourth embodiment is based on the fact that, if a malicious VM accesses the disk by using a standard OS command (for example, Is or cp) to attempt file search, the access is made to the areas having data written therein. 
         [0113]    According to the first to fourth embodiments described above, the communication pattern of an iSCSI packet is analyzed in the access to the virtual storage and it is determined whether an abnormal behavior occurs in the communication pattern to detect the abnormality in security, thereby detecting the unauthorized access from the VM to the storage apparatus. It is possible to perform the security monitoring that is not dependent on the hypervisor layer by using the external monitoring method by the packet capturing. Owing to the versatility of the external monitoring method, the embodiments are applicable to Information Communication Technology (ICT) systems in multiple virtualized architectures including VMWare and XEN. The embodiments are also applicable to physical host systems using the virtual storages, in addition to the virtual systems using the virtual servers. 
         [0114]    According to the above embodiments, it is detected whether the access from the physical server executing the virtual servers is abnormal access. 
         [0115]    All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiments of the present invention have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.