Source: https://patents.google.com/patent/JP2008021274A/en
Timestamp: 2020-01-24 23:17:34
Document Index: 735045244

Matched Legal Cases: ['art 300', 'art 300', 'art 300', 'art 300', 'art 12', 'art 13', 'art 14', 'art 15', 'art 17', 'art 21', 'art 23', 'art 25', 'art 27']

JP2008021274A - Process monitoring device and method - Google Patents
Process monitoring device and method Download PDF
JP2008021274A
JP2008021274A JP2006198574A JP2006198574A JP2008021274A JP 2008021274 A JP2008021274 A JP 2008021274A JP 2006198574 A JP2006198574 A JP 2006198574A JP 2006198574 A JP2006198574 A JP 2006198574A JP 2008021274 A JP2008021274 A JP 2008021274A
JP2006198574A
健次 佐藤
秀明 武田
2006-06-15 Priority to JP2006165493 priority Critical
2006-07-20 Application filed by Interlex Inc, Hideaki Takeda, インターレックス株式会社, 秀明 武田 filed Critical Interlex Inc
2006-07-20 Priority to JP2006198574A priority patent/JP2008021274A/en
2008-01-31 Publication of JP2008021274A publication Critical patent/JP2008021274A/en
An unauthorized process that operates based on an unknown unauthorized program is detected.
A process monitoring unit for acquiring a current static attribute of a process operating on a computer, a static attribute processing unit for extracting a process requiring attention based on the static attribute, and a process requiring attention. The dynamic attribute acquisition unit 17 that acquires the current dynamic attribute, the dynamic attribute DB 37 that stores the past dynamic attribute, and the past dynamic attribute and the current dynamic attribute use statistical methods. A dynamic attribute processing unit 21 that determines whether or not discrimination is possible, and a display control unit 23 that issues an alarm about the process requiring attention when discrimination is possible.
The present invention relates to a technology for detecting an unauthorized process related to an unauthorized program such as virus software, and more particularly to a technology for detecting an unauthorized process due to an unknown unauthorized program.
Conventionally, a method using a definition file has been widely used as a detection method for malicious programs such as computer viruses and worms. The method using the definition file has a certain effect on the detection of already known viruses, but it is known that it is difficult to detect unknown viruses and variant viruses that have slightly changed known viruses. ing.
Further, as a technique for detecting an unknown virus, a heuristic method is known, and a virus detection technique using the heuristic method is described in Patent Document 1, for example.
JP 2003-186687 A
In the conventional virus detection method using the definition file, there is a problem that the virus is infected if the virus is completely unknown or the definition file is neglected. As a result, it may cause serious damage such as data destruction in the infected computer and information leakage from the computer.
In addition, the heuristic method is a method for determining an evaluation by weighting a problem that has occurred and adding the weights when the problem has occurred. Therefore, in the case of this method, depending on the frequency of occurrence of the problem, weights are rapidly added, and the evaluation is determined in a short-circuited state, resulting in a local minimum problem.
In addition, the heuristic method can be applied to a storage location or a known file whose specified operation is clearly known, but an unknown fraud where it is impossible to predict where and what operation will be performed. It is not valid for the program.
Accordingly, an object of the present invention is to provide a technique for detecting an unauthorized process that operates based on an unknown unauthorized program.
A process monitoring apparatus according to an embodiment of the present invention is based on a means for acquiring a current static attribute of a process operating on a computer, and a current static attribute acquired by the static attribute acquisition means. Static attribute determination means for extracting a cautionary process that may be an unauthorized process; means for acquiring a current dynamic attribute of the cautionary process extracted by the static attribute determination means; Dynamic attribute storage means for storing past dynamic attributes of the process requiring attention; past dynamic attributes stored in the dynamic attribute storage means for the process requiring attention; and dynamic attributes A dynamic attribute determination unit that determines whether or not the current dynamic attribute acquired by the acquisition unit can be distinguished using a statistical method; and the dynamic attribute determination unit includes the past dynamic attribute And said If it is possible to distinguish between the dynamic attributes of the resident is provided with, and alarm means for sounding an alarm about the suspicious process.
In a preferred embodiment, the apparatus further comprises static attribute storage means for storing a past static attribute of a process running on the computer, which is acquired in advance, and the static attribute determination means includes the static attribute determination means. A change determination unit that detects a change in the static attribute by comparing the past static attribute stored in the attribute storage unit with the current static attribute acquired by the acquisition unit; Good. In this case, when the change of the static attribute is detected, the change determination unit determines that the process is a process requiring attention.
In a preferred embodiment, the apparatus further comprises an abnormality determination condition storage unit that stores a predetermined abnormality determination condition regarding a static attribute of a process, and the static attribute determination unit is a process that requires attention as the change determination unit. The determined process may further include an abnormality determination unit that determines whether or not there is an abnormality by comparing the current static attribute with the abnormality determination condition stored in the abnormality determination condition storage unit. Good. The abnormality determining means excludes the process determined to be abnormal by the abnormality determination as an unauthorized process from the process requiring attention, and the warning means is determined to be an unauthorized process by the abnormality determining means. An alert may be issued for the process.
In a preferred embodiment, the apparatus further comprises means for extracting a related process having a predetermined relationship with the caution process based on the dynamic attribute of the caution process acquired by the dynamic attribute acquisition means. Also good. The dynamic attribute acquisition unit may acquire a current dynamic attribute of the related process, and the dynamic attribute determination unit may determine the related process.
In a preferred embodiment, predetermined operation restriction storage means for storing an action restriction condition for restricting the operation of the process, and a normal process that is not considered a caution process in the static attribute determination means, When the operation restriction condition is satisfied, operation restriction means for restricting the operation of the normal process may be further provided.
In a preferred embodiment, the operation restriction condition includes a static attribute of a process restricted to operate on the monitored computer and a content of the operation restriction, and the operation restriction unit includes a current process of the normal process. If the static attribute matches the operation restriction condition, the operation restriction of the specified content may be performed.
In a preferred embodiment, in response to an alarm issued by the alarm means, a user input relating to at least one of stopping an operation of a process requiring attention relating to the alarm or approving the continuation of the operation is accepted. You may further provide the reception means.
In a preferred embodiment, the static attribute of the process includes the start location of the program related to the process, information related to the creation of the program related to the process, the size of the program related to the process, and the parent-child relation related to the program call related to the process (parent process). Name), the parity of the program related to the process, and the public call function of the program related to the process.
In a preferred embodiment, the dynamic attribute of the process includes at least one of a process thread number, a process memory usage status, a process redirector send / receive status, a process hard disk access status, and a process CPU usage status. It may include one or more.
Hereinafter, an unauthorized process detection apparatus according to an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram showing a functional configuration of an unauthorized process detection apparatus according to an embodiment of the present invention.
The unauthorized process detection apparatus 1 according to the present embodiment monitors a program executed on a computer and a state of a process started by the program, and an unauthorized process operating on a monitored computer or suspected to be unauthorized. Detect processes. In this specification, processes are classified as follows according to the degree of abnormality. In other words, processes that are extremely abnormal and apparently affected by unauthorized programs are unauthorized processes, processes that are not abnormal are normal processes, and processes that are abnormal to some extent but cannot be determined to be unauthorized processes. Called the process of caution.
The unauthorized process detection device 1 according to the present embodiment is realized, for example, by executing a predetermined computer program in a general-purpose computer system. At this time, it may be realized on the same computer as the computer to be monitored.
The detection apparatus 1 includes a process monitoring unit 11, a static attribute processing unit 14 including a process change determination unit 13 and an abnormality determination unit 15, a dynamic attribute acquisition unit 17, a dynamic attribute processing unit 21, and display control. Unit 23, process activation control unit 25, and process analysis unit 27. Further, the detection apparatus 1 has a process history database 31, a process static attribute database 33, an abnormality determination condition database 35, a process dynamic attribute database 37, and a program as storage means for storing predetermined information. An operation restriction condition database 41, a monitoring target process storage unit 43, and a process characteristic database 45 are provided.
The process monitoring unit 11 monitors a process (hereinafter referred to as a process) executed by a program operating in the computer. For example, the process monitoring unit 11 acquires various types of information related to processes executed by the computer at the time of starting each process or at an arbitrary timing during operation. Here, processes that are not displayed by the normal OS function can be monitored. Then, with respect to the process currently being executed, information regarding the process acquired by the process monitoring unit 11 can be output to a predetermined display device or printer.
Here, the information regarding the process acquired by the process monitoring unit 11 includes, for example, a static attribute and a dynamic attribute of the process described later.
In addition, the process monitoring unit 11 monitors a process registered in the monitoring target process storage unit 43 as a priority monitoring target. In other words, the process monitoring unit 11 periodically collects information about the process subject to priority monitoring not only when it is activated but also during operation. On the other hand, for processes that are not registered in the monitoring target process storage unit 43, the process monitoring unit 11 collects information regarding the processes at the time of starting each process.
In the process history database 31, information related to the process acquired by the process monitoring unit 11 is accumulated. The history information stored in the process history database 31 can be output as a process history to a predetermined display device or printer.
FIG. 2 shows an example of the data structure of the process history database 31. That is, the process history database 31 includes, for example, as a data item, a process name 311, a program manufacturer name 312, a program (software) name 313, a program version 314, a parent process name 315 that started this process, This process includes a start time 316, an end time 317, a start location 318 on the computer, and a process size 319.
The process static attribute database 33 stores static attributes in the process information acquired by the process monitoring unit 11. Here, the static attribute of a process includes, for example, a start location relating to a program related to the process, creation time information, a program size, a parent-child relation (parent process name) relating to a program call, a parity, and a public call function. Including.
FIG. 3 shows an example of the data structure of the static attribute database 33. That is, the static attribute database 33 includes, for example, as a data item, a process name 331, a manufacturer name 332 of a program related to this process, a program (software) name 333, a version 334, a parent process name 335 that started this process, and Includes process size 3336. Each item of the static attribute database 33 is automatically updated for a process determined to be normal by the process change determination unit 12 described later.
The static attribute processing unit 14 includes a process change determination unit 13 and an abnormality determination unit 15. The static attribute processing unit 14 extracts a process requiring attention based on the current static attribute of each process. Detailed processing of the process change determination unit 13 and the abnormality determination unit 15 will be described below.
The process change determination unit 13 compares the static attribute of the process being executed with the static attribute of the same process acquired in the past, and whether or not the current static attribute has changed from the past static attribute. Determine.
For example, when a process is activated on a computer being monitored, first, the process monitoring unit 11 acquires a static attribute of the process at the time of activation. Then, the process change determination unit 13 compares the past static attribute stored in the static attribute database 33 with the newly acquired current static attribute.
If the static attribute is changed as a result of the comparison, the process change determination unit 13 notifies the abnormality determination unit 15 of the current static attribute of the process requiring attention, with the process as a process requiring attention. This is because, when a virus is infected, the static attribute of the process may change, so the process with the changed static attribute is likely to be an unauthorized process.
On the other hand, if the static attribute is not changed, the process change determination unit 13 determines that the process is a normal process, and based on the current process information acquired by the process monitoring unit 11, the process history database 31 and the static attribute are determined. The target attribute database 33 is updated.
Here, the process change determination unit 13 stores past static attributes in the static attribute database 33, such as a process that occurs when a newly installed program is started for the first time (hereinafter referred to as a new process). For a process that does not exist, first, information on the current process acquired by the process monitoring unit 11 is stored in the process history database 31 and the static attribute database 33. Further, the process change determination unit 13 notifies the abnormality determination unit 15 of the current static attribute of the new process, as in the case of the process requiring attention.
Furthermore, the process change determination unit 13 extracts a process in which a parent process cannot be found or a process in which an external process is a parent process as a process requiring attention.
The operation restriction condition database 41 stores conditions related to operation restriction in the computer to be monitored. The operation restriction condition database 41 stores in advance a program that restricts the operation of the computer to be monitored and the contents of the restricted operation.
For example, in the operation restriction condition database 41, information for specifying a program such as an attribute of a program that is completely prohibited from being installed or executed on a monitored computer is registered in advance. Therefore, in the operation restriction condition database 41, it is possible to register in advance an illegal program such as a known virus or attribute information of a program not permitted by the administrator. The operation restriction condition database 41 may store a certain operation condition for permitting or prohibiting the operation as the content of the operation restriction together with information for specifying the program. For example, the attributes of the program and the operation conditions of the program (for example, the time zone, day of the week, period, etc. during which the operation is permitted or prohibited) can be registered in the operation restriction condition database 41.
The process activation control unit 25 determines whether or not to permit the operation of the process determined by the process change determination unit 13 as a normal process.
For example, the process activation control unit 25 determines whether or not the normal process satisfies the operation restriction condition stored in the operation restriction condition database 41. When the condition is satisfied, the process activation control unit 25 performs the operation restriction of the content specified in the operation restriction condition database 41. For example, when a process related to a program whose operation is completely prohibited is activated, the process activation control unit 25 forcibly stops the activation, and a process related to a program whose operation is prohibited for a predetermined period of time is started. When activated, the process activation control unit 25 forcibly stops the activation within the period.
In the abnormality determination condition database 35, conditions for determining the abnormality of the static attribute of the process are stored in advance. This abnormality determination condition is a condition that determines that the process is clearly abnormal.
For example, the abnormality determination condition database 35 stores predetermined conditions that are determined to be invalid processes, such as a process start location, a process call function, and a process call relation (parent process). Examples of the predetermined condition include a place where the process cannot be started normally, a function which cannot be normal as a process call function, a call relation which cannot be normal as a process call relation (parent process), etc. It is. In addition, the abnormality determination condition database 35 stores, as abnormality determination conditions, conditions that can be regarded as unauthorized processes for each process based on the past history of process size, parity, creation time information, or parent-child relations. Also good. The condition that can be regarded as an unauthorized process may be a condition indicating a predetermined range (for example, process size OO or more).
The abnormality determination unit 15 compares the static attribute of the process requiring attention received from the process change determination unit 13 with the abnormality determination condition stored in the abnormality determination condition database 35 to determine whether the process is an unauthorized process. Determine whether or not. That is, when the static attribute of the process requiring attention matches the abnormality determination condition, the abnormality determination unit 15 determines that the process requiring attention is an unauthorized process and notifies the display control unit 23 of the process.
Here, since the abnormality determination condition sets a condition that can clearly determine that the process is an unauthorized process, an unauthorized process that matches this condition is excluded from the process requiring attention. Therefore, a process requiring attention from which an obvious illegal process is excluded is a target of verification using dynamic attributes described below.
The verification using dynamic attributes by the dynamic attribute acquisition unit 17 and the dynamic attribute processing unit 21 is a process requiring attention except for processes that are clearly determined to be normal or determined to be abnormal by determination using static attributes. Do. Detailed processing of the dynamic attribute acquisition unit 17 and the dynamic attribute processing unit 21 will be described below. Here, the dynamic attributes are dynamic with respect to each process such as the number of process threads, the memory usage status of the process, the redirector transmission / reception status of the process, the hard disk access status of the process, and the CPU usage status of the process. An attribute that changes to.
The dynamic attribute acquisition unit 17 acquires dynamic attributes of a process requiring attention, dynamic information of the entire system, and the like. In other words, the dynamic attribute acquisition unit 17 activates the dynamic attribute of the process and the entire system at the time of starting the focused attention process or at any timing when the focused attention process is operating. Get dynamic information. The dynamic attributes of the process requiring attention and the dynamic information of the entire system acquired here are stored in the dynamic attribute database 37.
The dynamic attribute database 37 stores a dynamic attribute table 371 that stores actual data of dynamic information acquired by the dynamic attribute acquisition unit 17 and an analysis that stores a correlation index that is a characteristic after analysis by statistical processing described later. And a table.
FIG. 4 shows an example of the data structure of the dynamic attribute table 371. That is, the dynamic attribute table 371 includes, for example, as a data item, a process name 3711, a process thread number 3712, a start time 3713 on the parent-child relation, a number of bytes allocated to the dynamic private memory of the process on the parent-child relation 3714, a parent-child Number of allocated bytes 3715 of the dynamic shared memory of the process on the relation, number of bytes 3716 of the virtual address of the process on the parent-child relation, transmission traffic rate (number of bytes / second) of the redirector 3717, rate of received traffic of the redirector (number of bytes / number) Second) 3718, hard disk access rate 3719, CPU load rate 3720, and acquisition date 3721 of these data.
If the process requiring attention is a new process, the dynamic attribute of the new process is not stored in the dynamic attribute acquisition unit 17 before that process. Therefore, when a new process is started, dynamic attributes are stored in the dynamic attribute database 37 for the first time. Here, at least in the case of a new process, it is considered that this process is operating in a normal state. Therefore, in the following processing, the dynamic attribute acquired when the new process is started is treated as a normal state dynamic attribute. .
The dynamic attribute processing unit 21 analyzes the process requiring attention based on the dynamic attributes stored in the dynamic attribute database 37. For example, the dynamic attribute processing unit 21 analyzes current and past dynamic attributes for abnormalities in the process requiring attention using a statistical method such as regression analysis, correlation analysis, nonlinear analysis, or white noise test.
Here, if the process requiring attention is a new process, it cannot be compared with a past dynamic attribute, and therefore, the current dynamic attribute is determined based on whether or not a predetermined determination condition regarded as an unauthorized process is met. For example, the determination condition is such that the value of each item of the dynamic attribute is not less than a value that cannot be normal.
When the dynamic attribute processing unit 21 determines that the process requiring attention is likely to be an unauthorized process, that is, the abnormality of the process requiring attention is high, the dynamic attribute processing unit 21 notifies the display control unit 23 of identification information of the process. On the other hand, when it is determined here that the anomaly is not so high, the display control unit 23 is also notified to allow the user to determine whether or not to make a monitoring target.
As will be described later, when the user designates a process to be continuously monitored, the process name and the like are registered in the monitoring target process storage unit 43.
Further, the dynamic attribute processing unit 21 may expand the range of processes to be monitored. That is, a related process having a predetermined relationship with a new process or a process requiring attention may be extracted and additionally registered in the monitoring target process storage unit 43 as a monitoring target process. This is because, in the case of a process in which a part of the code has been rewritten, such as a code injection type virus, the process itself does not noticeably act illegally, but it is started from the process in which the part of the code has been rewritten. This is because a child process (or a hidden child process that apparently has no parent-child relationship) may perform an illegal movement, and such a child process or the like is also monitored.
Here, a process having a predetermined relationship is, for example, a process that is always started when a monitored process operates even if there is no clear parent-child relationship in addition to a process with a clear parent-child relationship. A process that operates in a manner related to the monitored process.
The dynamic attribute processing unit 21 further analyzes whether or not there is a statistically logical correlation in the past dynamic attributes for cautionary processes other than the new process, or it is clear from a certain time. The degree of abnormality of the process requiring attention is determined by determining the presence or absence of a characteristic change.
For example, the dynamic attribute processing unit 21 refers to the dynamic attribute database 37, the dynamic dedicated memory byte number 3714, the dynamic shared memory byte number 3715 of the process requiring attention, the redirector transmission, the received traffic rates 3717, 3718, and For the hard disk access rate 3719 and the like, data from the data acquired in the new process to the latest data is acquired. Then, the dynamic attribute processing unit 21 analyzes each acquired data and determines whether or not there is a characteristic change that increases suddenly at a certain point in time. If there is some characteristic change, the process is likely to be an unauthorized process.
For example, when the number of redirector transmission traffic 3717 has increased significantly from a certain point in time, the process was affected by some malicious program before that point, and the anomaly is high. Conceivable.
Or, if the process requiring attention is a word processing software process, there is normally no correlation between the transmission traffic rate 3717 of the redirector representing network transmission. This is because word processing software usually does not have a communication function. Nevertheless, if, for example, a regression analysis is performed and the word processor software process is clearly correlated with the redirector transmission traffic rate 3717, the word processor software process is likely to be an unauthorized process. .
The dynamic attribute processing unit 21 may perform the following processing. That is, the dynamic attribute database 37 stores the dynamic attributes acquired when the process requiring attention is normal, and the dynamic attributes acquired after being monitored as the process requiring attention. Therefore, the dynamic attribute processing unit 21 analyzes the normal dynamic attribute and the dynamic attribute after being monitored using a statistical method. Then, the dynamic attribute processing unit 21 determines whether or not the two dynamic attributes can be distinguished, for example, the dynamic attribute after being monitored and the dynamic attribute after being monitored indicates a difference of a predetermined significance level or more. .
If it is possible to discriminate between the normal and the dynamic attributes after being monitored, the process after being monitored has characteristics that are different from normal and may be considered abnormal. it can.
Here, an example in the case of performing statistical processing on the dynamic attribute at the normal time and the dynamic attribute after being monitored will be described with reference to FIG.
First, as shown in the figure, the dynamic attribute database 37 includes a data group 1 as normal dynamic attribute data and data groups 2 to n as dynamic attribute data acquired after becoming a monitoring target. It is remembered. The number of samples in each data group is 500. Here, the data item of the dynamic attribute is analyzed by using the transmission traffic rate 3717 of the redirector.
The dynamic attribute processing unit 21 performs regression analysis using these data. Assume that the result is as shown in FIG. That is, when the individual data (x 1n , y 1n ) of the data group 1 is represented by y 1n = α1 + β1x 1n + ε 1n , and the error 1n ε follows a normal distribution, the data group 1 is represented by the regression line 1 (y = Return to α1 + β1x). Further, the data groups 2 to n are similarly regressed to the regression line 2 (y = α2 + β2x). Here, the intercepts α and slopes β of the regression lines 1 and 2 are different (α1 ≠ α2, β1 ≠ β2).
As can be seen from the above, first, since the data groups 2 to n are regressed to the same straight line, they show the same tendency and are classified into a common category. On the other hand, since the data group 1 returns to a straight line different from the data groups 2 to n, the data group 1 shows a tendency different from the tendency shown by the data groups 2 to n, and the category in which the data groups 2 to n are classified. It can be understood that it does not belong to. Therefore, the data group 1 and the data groups 2 to n can be distinguished.
According to the present embodiment, even for a process having an anomaly that cannot be clearly distinguished from a normal state by a static attribute or the like, a dynamic attribute indicating a state when the process is operating is collected. It is possible to discriminate by analyzing this using a statistical method.
The display control unit 23 outputs an alarm and notifies the user of a process that is regarded as an unauthorized process by the abnormality determination unit 15 and the dynamic attribute processing unit 21 or a process that is detected as a process requiring attention. Thereby, the user can know an unauthorized process or a process requiring attention that cannot be determined as an unauthorized process.
For example, the display control unit 23 displays a list screen 100 of processes that are considered abnormal, including an unauthorized process and a process requiring attention as shown in FIG. 6, for example, and receives an instruction from the user.
As shown in the figure, the process list 100 displays information 110 related to an unauthorized process and a process requiring attention, and receives a countermeasure input in a countermeasure reception area 120. Further, when this screen is displayed, the display control unit 23 may present a recommended measure 130 to the user. For example, “stop” of the process may be recommended for a process that affects software in the system area, and re-installation may be recommended for a process that has been changed to different software.
Here, when “permitted” is selected as a countermeasure by the user, the process is permitted to operate continuously. When “continuation monitoring” is selected as a countermeasure, the process is registered in the monitoring target process storage unit 43 and becomes a priority monitoring target process. Furthermore, when “stop” is selected as a countermeasure, the process is forcibly stopped by the process activation control unit 25.
Note that the process list 100 may be displayed in different display modes such as changing the color according to the degree of abnormality of the unauthorized process and the process requiring attention.
Further, the display control unit 23 displays a reception screen 200 for receiving registration of operation restriction as shown in FIG. As shown in the figure, the reception screen 200 includes an input area 210 for information related to a program related to operation restriction, and an input area 220 for content of action restriction. Information input on the reception screen 200 is stored in the operation restriction condition database 41.
The display control unit 23 may request the process analysis unit 27 to analyze an unauthorized process or a process requiring attention. At this time, the display control unit 23 may change the manner of alarming the user according to the analysis result.
The process analysis unit 27 acquires the characteristics of the requested process stored in advance in the process characteristics database 45, and determines the level of abnormality of the process in consideration of the characteristics. For example, the process analyzing unit 27 intentionally uses a timer when the requested process is operating every other hour even though it is a process that originally operates only when the system is started. Therefore, it is determined that the abnormality is high.
In this case, the display control unit 23 may display the process list 100 in a display mode different from other processes in order to notify that the abnormality of the process is high.
In addition, the display control unit 23 displays the operation state of the process (sonar chart, process history) or the parent-child relationship of the process (process tree) based on the information stored in the process history database 31, The current process status acquired by the monitoring unit 11 can be displayed in real time (process monitor).
For example, FIG. 8 shows an example of a sonar chart 300 in which the operation states of processes are displayed in time series.
The sonar chart 300 shown in the figure shows the time axis in the circumferential direction and the operation region of the process in the radial direction, and each point indicates the start of one process. The process operation area is a system software area 310, a standard program area 320, a hard disk area 330, and an external / network area 340 in order from the area close to the center.
By using the sonar chart 300, it is possible to easily find a process having a common start timing of the process.
For example, FIG. 9 shows an example of a process tree 400 that displays processes having a parent-child relationship in the sonar chart 300.
The process tree 400 displays only the processes having a parent-child relationship with the selected process. As a result, the process in which the parent-child relationship is hidden or cannot be discovered is displayed as a single point.
An example of a processing procedure in the unauthorized process monitoring apparatus having the configuration described above will be described with reference to the flowchart of FIG.
First, when a process is newly started in the monitoring target computer or when a process registered in the monitoring target process storage unit 43 is operating, the process monitoring unit 11 performs operations related to these processes. A physical attribute and a static attribute are acquired (S11).
Next, the process change determination unit 13 compares the static attribute of the process acquired here with the static attribute stored in the static attribute database 33, and sets the static attribute of the process being monitored. It is determined whether or not there has been a change (S12).
Here, when there is no change in the static attribute (S12: no change), the process activation control unit 25 indicates whether or not an operation restriction to be stopped at this time is set for the process. Determination is made with reference to 41 (S21).
Then, if the process is a process for which an operation restriction to be stopped at this time is set (S21: Yes), the process activation control unit 25 forcibly stops the process (S22). On the other hand, if there is no operation restriction at the current time in the process (S21: No), the process history database 31 and the static attribute database 33 are updated based on the information acquired by the process monitoring unit 11, and the process is terminated ( S23).
When the static attribute is changed in step S12 or the target process is a new process, the following process is performed with the process as a caution process. That is, the abnormality determination unit 15 compares the static attribute of the process with the abnormality determination condition database 35, and performs abnormality determination using the static attribute (S13).
Here, if the static attribute of the target process matches the abnormality determination condition, the display control unit 23 issues an alarm regarding the process as an unauthorized process (S25).
On the other hand, when the static attribute of the target process does not match the abnormality determination condition, the dynamic attribute acquisition unit 17 acquires the dynamic attribute of the target process and stores it in the dynamic attribute database 37 (S14).
Then, the dynamic attribute processing unit 21 determines anomaly using the dynamic attribute, and determines whether the target process is an obvious illegal process (S15).
Here, when the process requiring attention is an obvious illegal process, the display control unit 23 issues an alarm with the process as an illegal process (S25).
On the other hand, when the caution process cannot be determined to be an obvious illegal process, the dynamic attribute processing unit 21 extracts a related process of the caution process and registers it in the monitoring target process storage unit 43 (S16, S17).
Further, the dynamic attribute processing unit 21 refers to the dynamic attribute database 37 and performs statistical processing on the dynamic attributes of the process requiring attention (S18). By this process, the process determined to be highly abnormal among the processes requiring attention (S19: Yes) is notified to the user (S27). Here, a process that has not been determined to be highly abnormal may be notified to the user as a process requiring attention.
It is a functional block diagram of the detection apparatus of the unauthorized process which concerns on one Embodiment of this invention. An example of the data structure of the process history database 31 is shown. An example of the data structure of the static attribute database 33 is shown. An example of the data structure of the dynamic attribute table 371 is shown. It is explanatory drawing of an example of the statistical process using a dynamic attribute. It is a list screen of processes that seem to be abnormal. It is an operation restriction registration screen. It is the sonar chart which displayed the operation state of the process in time series. It is a process tree that displays parent-child processes in a sonar chart. It is a flowchart which shows the process sequence in an unauthorized process monitoring apparatus.
DESCRIPTION OF SYMBOLS 1 Unauthorized process detection apparatus 11 Process monitoring part 12 Process change determination part 13 Process change determination part 14 Static attribute processing part 15 Abnormality determination part 17 Dynamic attribute acquisition part 21 Dynamic attribute processing part 23 Display control part 25 Process start control part 27 Process analysis unit 31 Process history database 33 Static attribute database 35 Abnormality determination condition database 37 Dynamic attribute database 41 Operation restriction condition database 43 Monitored process storage unit 45 Process characteristic database
Means for obtaining current static attributes of processes running on the computer;
Based on the current static attribute acquired by the static attribute acquisition unit, a static attribute determination unit that extracts a cautionary process that may be an unauthorized process;
Means for acquiring a current dynamic attribute of the process requiring attention extracted by the static attribute determination means;
Dynamic attribute storage means for storing past dynamic attributes of the process requiring attention, acquired in advance;
A past dynamic attribute stored in the dynamic attribute storage unit and a current dynamic attribute acquired by the dynamic attribute acquisition unit relating to the process requiring attention can be distinguished using a statistical method. Dynamic attribute determination means for determining whether or not
A process monitoring apparatus comprising: an alarm unit that issues an alarm about the process requiring attention when the dynamic attribute determination unit can discriminate between the past dynamic attribute and the current dynamic attribute.
Static attribute storage means for storing a past static attribute of a process running on the computer, acquired in advance,
The static attribute determination means compares the past static attribute stored in the static attribute storage means with the current static attribute acquired by the acquisition means, Provided with a change determination means for detecting a change,
The process monitoring apparatus according to claim 1, wherein the change determination unit determines that the process is a process requiring attention when a change in a static attribute is detected.
An abnormality determination condition storage means for storing an abnormality determination condition relating to a static attribute of the process that is determined in advance is further provided,
The static attribute determination unit compares the current static attribute with the abnormality determination condition stored in the abnormality determination condition storage unit for a process determined to be a caution process by the change determination unit. And further comprising an abnormality determining means for determining the presence or absence of abnormality,
The abnormality determining means excludes the process determined to be abnormal by the abnormality determination as an unauthorized process from the process requiring attention,
The process monitoring apparatus according to claim 2, wherein the warning unit issues a warning for a process that is determined to be an unauthorized process by the abnormality determination unit.
Based on the dynamic attribute of the process requiring attention acquired by the dynamic attribute acquisition means, further comprising means for extracting a related process having a predetermined relationship with the process requiring attention;
The dynamic attribute acquisition means acquires a current dynamic attribute of the related process,
The process monitoring apparatus according to claim 1, wherein the dynamic attribute determination unit determines the related process.
An operation restriction storage means for storing an operation restriction condition for restricting the operation of a predetermined process;
The process monitoring apparatus according to claim 1, further comprising: an operation restriction unit that restricts an operation of the normal process when a normal process that is not regarded as a process requiring attention in the static attribute determination unit satisfies the operation restriction condition. .
The operation restriction condition includes a static attribute of a process restricted to operate on the monitored computer and a content of operation restriction.
The process monitoring apparatus according to claim 5, wherein the operation restriction unit restricts the operation of designated content when a current static attribute of the normal process matches the operation restriction condition.
In response to an alarm issued by the alarm means, further comprising a receiving means for accepting user input regarding at least one of stopping the operation of the process requiring attention related to the alarm or approving the continuation of the operation, The process monitoring apparatus according to claim 1.
The static attribute of the process includes the start location of the program related to the process, information related to the creation of the program related to the process, the size of the program related to the process, the parent-child relation (parent process name) related to the program call related to the process, and the process related The process monitoring apparatus according to claim 1, wherein the process monitoring apparatus includes at least one of a parity of the program and a public call function of the program related to the process.
The dynamic attribute of the process includes at least one of a process thread number, a process memory usage status, a process redirector transmission / reception status, a process hard disk access status, and a process CPU usage status. The process monitoring apparatus according to claim 1.
Obtaining the current static attributes of a process running on the computer;
Extracting a cautionary process that may be an unauthorized process based on the acquired current static attribute;
Obtaining a current dynamic attribute of the extracted sensitive process;
Determining whether a past dynamic attribute for the process of caution and the acquired current dynamic attribute can be distinguished using statistical techniques;
And a step of issuing an alarm for the process requiring attention when the past dynamic attribute and the current dynamic attribute can be distinguished.
By being executed on the computer,
A computer program for process monitoring that performs a step of issuing an alarm for the process requiring attention when the past dynamic attribute and the current dynamic attribute can be distinguished.
JP2006198574A 2006-06-15 2006-07-20 Process monitoring device and method Pending JP2008021274A (en)
JP2006165493 2006-06-15
JP2006198574A JP2008021274A (en) 2006-06-15 2006-07-20 Process monitoring device and method
JP2008021274A true JP2008021274A (en) 2008-01-31
ID=39077138
JP2006198574A Pending JP2008021274A (en) 2006-06-15 2006-07-20 Process monitoring device and method
JP (1) JP2008021274A (en)
JP2010009187A (en) * 2008-06-25 2010-01-14 Kddi R & D Laboratories Inc Information processor, information processing system, program, and recording medium
JP2010271775A (en) * 2009-05-19 2010-12-02 Kddi Corp Processor and program
JP2011501279A (en) * 2007-10-15 2011-01-06 ベイジン ライジング インフォメーション テクノロジー カンパニー、リミテッド Method and apparatus for detecting malicious acts of a computer program
JP2011525662A (en) * 2008-06-18 2011-09-22 シマンテック コーポレーションＳｙｍａｎｔｅｃ Ｃｏｒｐｏｒａｔｉｏｎ System and method for establishing and monitoring software evaluation
JP2013542536A (en) * 2010-12-21 2013-11-21 北京中天安泰信息科技有限公司 How to standardize the execution behavior of a computer system
JP2014101008A (en) * 2012-11-20 2014-06-05 Nissan Motor Co Ltd On-vehicle machine and security system
JP2014182837A (en) * 2013-03-19 2014-09-29 Trusteer Ltd Malware discovery method and system
JP2015011549A (en) * 2013-06-28 2015-01-19 Kddi株式会社 Web page monitoring device, web page monitoring system, web page monitoring method and computer program
JP2015528171A (en) * 2012-07-20 2015-09-24 テンセント テクノロジー （シェンジェン） カンパニー リミテッド Method and device for displaying process information
JP2015531508A (en) * 2012-09-06 2015-11-02 トライアムファント， インコーポレイテッド system and method for automated memory and thread execution anomaly detection in computer networks
CN106104497A (en) * 2014-03-20 2016-11-09 日本电气株式会社 Information processor and method for detecting abnormality
2006-07-20 JP JP2006198574A patent/JP2008021274A/en active Pending
US9230067B2 (en) 2010-12-21 2016-01-05 Antaios (Beijing) Information Technology Co., Ltd. Method for normalizing a computer system
CN106104497B (en) * 2014-03-20 2019-07-16 日本电气株式会社 Information processing unit and method for detecting abnormality