Patent Description:
In recent years, society is undergoing a major transformation with the advent of various innovative technologies. While such major transformation is expected to bring about a more convenient and affluent society, there are concerns about the expansion of damage caused by cyber attacks and the bloated risk of social losses that could not have occurred before.

For example, rapid digitization increases security threats such as cyber attacks on control systems in factories, plants, and the like, which are not directly connected to the Internet, and important infrastructures which provide services indispensable for life and social activities.

In the area of the important infrastructures, it is not uncommon to find infrastructure facilities such as several thousand server devices and several tens of thousands to several hundreds of thousands of control devices, and a successful cyber attack at any one location could have far-reaching effects. In view of the reliability of each device constituting the system, a software authenticity determination technique for stably operating the system for always confirming the mixing or alteration of an unauthorized device and preventing abnormal operation is important.

A hash value of a file is often used for software authenticity determination. The hash value is a sequence having compact bit length data generated from the original data, and is generated from the original data by a hash function having unidirectional property. The hash value generated by the hash function is a unique value generated from the original data, and it is guaranteed that the hash value is the same data when the hash value is the same.

For example, in software authenticity determination using the hash value of a file, the hash value obtained at the time when no falsification has occurred is stored as a correct value in a normal state. Then, an authenticity determination program is periodically executed on a file to be determined in the device, and software authenticity determination using the stored correct answer value is performed. In the software authenticity determination, a hash value is calculated from the file to be determined, and compared with the correct value, to detect unauthorized falsification to the file to be determined. However, for a file in which content information is periodically updated or a file in which writing occurs due to an event such as execution of a program, a fixed hash value is not calculated. Therefore, in the authenticity determination method using the comparison of hash values, the inclusion of these files in the determination target files causes erroneous detection. Therefore, in the authenticity determination using the hash value comparison, it is assumed that the file to be determined is a file whose file content does not change, that is, a static file.

In light of the above, when using file hash values to determine software authenticity, it is required to select a static file which does not cause any change to be determined. As a conventional method of selecting a static file, a method of static analysis, dynamic analysis, and selection using a snapshot has been used.

The static analysis is a method for excluding a file to be changed by referring to meta information given to the file. With respect to a specific software package file, meta information given by a developer of the package is referred to for each file, a file having a tag in which overwriting occurs, that is, a dynamic file in which rewriting occurs is excluded, and the remaining file is selected as a static file. In this selection method, the selectable file is a file in which meta information is defined.

The dynamic analysis is a method for monitoring a system call for a certain period of time and extracting an unchanged file as a static file. For a file in which meta information is not defined as in static analysis, the behavior of the file by the system call is monitored by providing a fixed monitoring time, and the remaining file excluding the changed file during the monitoring time is selected as the static file. In this system, if the monitoring time is sufficiently long, the accuracy is improved, but there is a possibility that files which do not change accidentally during the monitoring time or files with a long cycle of change may be included in the actual operation time width.

The selection using a snapshot is a method for monitoring the behavior of the file in the same manner as the dynamic analysis, and the snapshot of the file is acquired twice at fixed intervals, and the difference is analyzed to select the file having no change as a static file. In this method, similar to the dynamic analysis, there is a possibility that a file which has not occurred accidentally or a file with a long cycle of change may be included within the monitoring time.

As a conventional technique for monitoring falsification, the following techniques exist. For example, there has been proposed a technique for generating a combination of static file paths and data, dynamic file paths, and directory paths that satisfy the conditions for storing files on the basis of a list of files used for collation and a determination condition of elements of the list (PTL <NUM>). Also, there has been proposed a technique for comparing common definition information with a file to be managed, determining whether or not there is a file that satisfies all conditions of the common definition information, and extracting the common definition information corresponding to the file to be managed (PTL <NUM>).

<CIT> refers to detecting malicious traffic of HTTP. Network traffic data including HTTP requests is obtained and a test vector feature of the traffic data is generated. Based on the feature vector a classification is performed using a pre-trained malicious traffic detection model, to detect a malicious HTTP request. This includes determining whether a request body of an HTTP request is a static file or whether all fields of the request body are empty. In this case the corresponding HTTP request is removed and the data in the HTTP request is extracted and subjected to unified processing.

<CIT> refers to machine learning classification using Markov modelling. A representation of a sequence of sections of a file is generated and a probability is determined for each transition between at least two sequential sections in the representation based on a model including conditional probabilities trained using a land change modeller.

<CIT> refers to an endpoint-based man in the middle attack detection using machine learning. Man in the middle detection tests are initiated to determine whether communications between two nodes of a computing network may have been subject to an interception by a third node. The man in the middle detection test may use a machine learning model.

However, in the static analysis method, the target to be determined is limited to a file in which the meta information is defined, and there is a possibility that the target range of software authenticity determination is narrowed and the accuracy is lowered. The dynamic analysis or the selection method using a snapshot is based on the time axis, and there is a possibility that a file which has not changed accidentally is included within the monitored time. Therefore, there is a possibility that a file which is not originally a target of software authenticity determination becomes a target, and accuracy of software authenticity determination may become deteriorated.

Furthermore, in the prior art for determining a path of a static file based on a list of files used for collation and the determination conditions of the elements of the list, the file registered in the predetermined collation information is targeted, and the same problem as the static analysis occurs. In addition, the conventional technique for extracting a desired common definition by comparing the common definition information with a file to be managed also uses predetermined common definition information, so that a problem similar to the static analysis occurs.

In view of the aforementioned circumstances, an object of the present invention is to improve the accuracy of software authenticity determination and ensure stable operation of the system.

The object of the invention is solved by the subject matter of the independent claims. Advantageous embodiments are disclosed in the dependent claims. According to an example a learning unit learns each feature of a dynamic file and a static file to generate a learning model. An extraction unit acquires a predetermined file group at a reference point of time from an external device using the predetermined file group, and extracts a determination target file, which is the static file, from the predetermined file group on the basis of the learning model.

According to the present invention, the accuracy of software authenticity determination can be improved and the system can be stably operated.

An embodiment of an information processing device, an information processing method, and an information processing program disclosed in the present application will be described below in detail, with reference to the drawings. It should be noted that the following embodiment does not limit the information processing device, the information processing method, and the information processing program disclosed in the present application.

<FIG> is a block diagram of an authenticity determination system according to an embodiment. As shown in <FIG>, an authenticity determination system <NUM> according to the present embodiment includes an authenticity determination server <NUM> which is an information processing device, a monitored device <NUM> which is an external device for the authenticity determination server <NUM>, and a learning data providing device <NUM>. The authenticity determination server <NUM>, the monitored device <NUM>, and the learning data providing device <NUM> are connected via a network.

The monitored device <NUM> is, for example, a control device arranged in an infrastructure system or a server device for providing infrastructure services. The monitored device <NUM> is a server which may be exposed to a threat of unauthorized software falsification, and as the target of software authenticity detection monitoring, the monitored device <NUM> is required to avoid difficult recovery situations through prompt detection and handling of unauthorized falsification. The monitored device <NUM> includes a hash value generation unit <NUM> and a file group <NUM>.

The file group <NUM> is a data group used for operating the monitored device <NUM>, and includes both a static file and a dynamic file. File data included in the file group <NUM> may be subject to unauthorized falsification. That is, the file data included in the file group <NUM> becomes a determination target of software authenticity determination by the authenticity determination server <NUM>.

The hash value generation unit <NUM> receives a transmission request requesting for a hash value of each piece of file data included in the file group <NUM> of the monitored device <NUM> in operation, from the authenticity determination server <NUM>. Here, the hash value generation unit <NUM> has a hash function common to a hash function of the authenticity determination server <NUM>. Then, the hash value generation unit <NUM> calculates a hash value of each piece of file data included in the file group <NUM>. Thereafter, the hash value generation unit <NUM> outputs the calculated hash value of each piece of file data included in the file group <NUM>, to the authenticity determination server <NUM>.

The learning data providing device <NUM> is a computer for providing file data used for learning by the authenticity determination server <NUM>. The learning data providing device <NUM> provides the authenticity determination server <NUM> with file data used for learning a learning model of software authenticity determination designated from the authenticity determination server <NUM>. The learning data providing device <NUM> stores files of various OSs (Operating System). For example, the learning data providing device <NUM> has a plurality of virtual servers for holding system files of different OSs.

Next, the authenticity determination device <NUM> will be described next. As shown in <FIG>, the authenticity determination server <NUM> includes a verification unit <NUM>, a verification result registration unit <NUM>, an authenticity determination instruction unit <NUM>, a normal state hash value storage unit <NUM>, a hash value generation unit <NUM>, a file information acquisition unit <NUM>, an extraction unit <NUM>, a teacher data creation unit <NUM>, and a learning unit <NUM>.

The teacher data creation unit <NUM> and the learning unit <NUM> perform processing for generating a determination target classification learning model <NUM> to be used when performing software authenticity determination on file data held by the monitored device <NUM>. That is, the teacher data creation unit <NUM> and the learning unit <NUM> perform processing in the learning phase of the determination target classification learning model <NUM>.

The teacher data creation unit <NUM> acquires file data to be used for learning, from the learning data providing device <NUM>. For example, the teacher data creation unit <NUM> acquires file data of a static file and file data of a dynamic file designated by an administrator, from a learning data providing device <NUM>.

A method of selecting file data used for learning will be described below. For example, in the present embodiment, any one of the following three types or a combination thereof is used as a selection target of file data to be used for learning, based on the OS domain type. The first is a <NUM>-bit version of centOS8 (™), an OS used in Linux(™) distribution. The second is a <NUM>-bit version of Ubutu20. <NUM>(™), also an OS used in Linux distribution. The third is a <NUM>-bit version Windows <NUM> (™). In the following description, these are simply referred to as "centOS," "Ubuntu" and "Windows.

Further, data capable of specifying whether the file data is a static file or a dynamic file is selected among the file data of the respective OSs described above. In the present embodiment, it is determined whether certain file data is a static file or a dynamic file, based on the following criteria.

For example, it is determined whether the file data to be used for learning collected from the centOS and the Ubuntu is a static file or a dynamic file by referring to the file system hierarchy standard of Linux. More specifically, the file data existing under the control of a specific directory for storing an invariable file such as a static setting file and a read-only file is regarded as a static file. For example, files under the control of /etc/, /boot, /user/bin are considered static files. File data existing under a specific directory for storing a transient or temporary file such as a file data spool file or a log file is considered as a dynamic file. For example, /var represents the following file data as a dynamic file. For Windows, file data whose update date is older than one year is considered a static file, and file data whose update date is within one year is considered a dynamic file.

In file data used for learning collected from Windows, file data whose update date is older than one year is considered a static file, and file data whose update date is within one year is considered a dynamic file.

In the case of the file data of the centOS and the Ubuntu, the teacher data creation unit <NUM> receives designation that the file data existing under the control of a specific directory storing an invariant file is a static file. The teacher data creation unit <NUM> receives designation that the file data existing under the control of a specific directory storing transient or temporary file data is a dynamic file among the file data of the centOS and the Ubuntu. In the case of the file data of Windows, the teacher data creation unit <NUM> receives designation of a static file for a file whose update date is older than one year and designation of a dynamic file for a file whose update date is within one year. The teacher data creation unit <NUM> collects the binary of the static file and the dynamic file in the file data group used for learning, from the learning data providing device <NUM> in accordance with the above designation.

<FIG> is a diagram for explaining creation of teacher data As shown in the collected data <NUM> in <FIG>, the teacher data creation unit <NUM> adds a label "<NUM>" to a file which can be regarded as the collected dynamic file, and adds a label "<NUM>" to a file which can be regarded as the static file, thereby making a teacher label of each file. Further, the teacher data creation unit <NUM> creates a feature vector representing the number of appearances of one byte character represented by hexadecimal for each file, to create teacher data <NUM>. The teacher data <NUM> shown in in <FIG> represents a vector in which the number of appearances of hexadecimal numbers from <NUM> to ff for each file is arranged in order. In the present embodiment, the number of appearances of bytes is used as the feature for each file, and the file size is not taken into consideration. However, the method of calculating the feature is not limited thereto, and the teacher data creation unit <NUM> may obtain the feature in consideration of other indexes such as file size.

Thereafter, the teacher data creation unit <NUM> outputs, to the learning unit <NUM>, teacher data which is binary data to which a teacher label indicating whether the file is a static file or a dynamic file is added.

The learning unit <NUM> receives the input of the teacher data from the teacher data creation unit <NUM>. Then, the learning unit <NUM> performs learning by using the acquired teacher data, and performs Hyper parameter tuning with the highest classification accuracy, to generate the learned determination target classification learning model <NUM>. That is, the learning unit <NUM> learns each feature of the dynamic file and the static file to generate the learning model. Here, the determination target classification learning model <NUM> corresponds to an example of the learning model. More specifically, the learning unit <NUM> learns each feature of the dynamic file and the static file by using the binary data of the static file and the dynamic file. The learning unit <NUM> also learns by using the learning data of each OS domain type.

More specifically, the learning unit <NUM> according to the present embodiment performs parameter tuning and cross verification by grid search using a classification algorithm called a support vector machine, and sets a model having the highest classification accuracy as the determination target classification learning model <NUM>. Thereafter, the learning unit <NUM> outputs the learned determination target classification learning model <NUM> to the extraction unit <NUM>.

The file information acquisition unit <NUM> and the extraction unit <NUM> perform processing for classifying and extracting static files to be used as determination targets when performing software authenticity determination on file data held by the monitored device <NUM>. That is, the file information acquisition unit <NUM> and the extraction unit <NUM> perform processing in the classification phase of the determination target classification learning model <NUM>.

The file information acquisition unit <NUM> acquires, from the file information acquisition unit <NUM>, the file group <NUM> included in the monitored device <NUM> at the reference point of time when it is confirmed that the monitored device <NUM> is in the normal state. Then, the file information acquisition unit <NUM> outputs the acquired file group <NUM> to the extraction unit <NUM>.

The extraction unit <NUM> acquires the file group <NUM> from the file information acquisition unit <NUM>. Then, the extraction unit <NUM> inputs the acquired file group <NUM> to the learned determination target classification learning model <NUM>, and classifies it into a static file and a dynamic file. That is, the extraction unit <NUM> extracts a determination target file which is a static file, from a predetermined file group on the basis of the learning model. Here, the file group <NUM> corresponds to an example of the predetermined file, and the determination target classification learning model <NUM> corresponds to an example of the learning model. More specifically, the extraction unit <NUM> receives the input of the predetermined file group, classifies the predetermined file group that has been input on the basis of the learning model into a static file or a dynamic file, and extracts the static file.

Thereafter, the extraction unit <NUM> extracts the static file included in the file group <NUM>, and causes the authenticity determination server <NUM> to hold the extracted static file as a determination target file group <NUM>. In so doing, the extraction unit <NUM> adds a list of determination target files representing the extracted static files, to the determination target file group <NUM>.

The hash value generation unit <NUM> and the normal state hash value storage unit <NUM> perform processing for securing a hash value of a determination target file in a normal state, as a reference of software authenticity determination. That is, the hash value generating unit <NUM> and the normal state hash value storage unit <NUM> perform processing of the normal state hash value storage phase.

The hash value generation unit <NUM> acquires each determination target file in a normal state included in the determination target file group <NUM>. Next, the hash value generation unit <NUM> calculates a hash value of each acquired determination target file. That is, the hash value generation unit <NUM> obtains a first hash value of each of the determination target files extracted by the extraction unit <NUM>. Thereafter, the hash value generation unit <NUM> stores the hash value of each determination target file in a normal state, in the normal state hash value storage unit <NUM>.

The normal state hash value storage unit <NUM> acquires and stores the hash value calculated from the determination target file in a normal state at the reference point of time, from the hash value generation unit <NUM>. Hereinafter, the hash value calculated from the determination target file in a normal state is called "normal state hash value.

The authenticity determination instruction unit <NUM>, the verification unit <NUM>, and the verification result registration unit <NUM> perform software authenticity determination processing of the file group <NUM> included in the monitored device <NUM> at the time of operation. That is, the authenticity determination instruction unit <NUM>, the verification unit <NUM>, and the verification result registration unit <NUM> perform processing of the authenticity determination phase.

The authenticity determination instruction unit <NUM> acquires identification information of each determination target file from the determination target file list added to the determination target file group <NUM>. Then, the authenticity determination instruction unit <NUM> transmits a hash value calculation request to the hash value generation unit <NUM> of the monitored device <NUM> together with identification information of each determination target file. The authenticity determination instruction unit <NUM> repeats the above-mentioned processing for starting the software authenticity determination periodically, such as once a day.

The verification unit <NUM> receives the hash value of the file group <NUM> included in the monitored device <NUM> in operation, from the hash value generation unit <NUM> of the monitored device <NUM>. The file group <NUM> included in the monitored device <NUM> in operation is the file group <NUM> obtained after a lapse of time from the reference point of time, and is the file group <NUM> having a possibility of being falsified. In the following description, the hash value of the file group <NUM> included in the monitored device <NUM> in operation is called "hash value having falsification possibility.

The verification unit <NUM> acquires a normal state hash value of each determination target file from the normal state hash value storage unit <NUM>. Then, the verification unit <NUM> compares the hash value having falsification possibility of each of the determination target files with the normal state hash value, to determine whether or not the values coincide with each other. Thus, the verification unit <NUM> determines whether or not the determination target file obtained at the point of time coincides with the determination target file obtained at the reference point of time. The verification unit <NUM> determines that no falsification has been performed on the determination target file whose values match. On the other hand, the verification unit <NUM> determines that the falsification has been performed for the determination target file whose values are not coincident. Thereafter, the verification unit <NUM> outputs, to the verification result registration unit <NUM>, a verification result of falsification of the monitored device <NUM> that indicates whether falsification has been performed on the file group <NUM> of the monitored device <NUM> or not.

As described above, the verification unit <NUM> acquires, from an external device, a second hash value of each of the determination target files after a lapse of time from the reference point of time that the external device has, compares the first hash value with the second hash value, and verifies whether or not the predetermined file group has been falsified. Here, the monitored device <NUM> is an example of the external device, the normal state hash value is an example of the first hash value, the hash value having falsification possibility is an example of the second hash value, and the file group <NUM> is an example of the predetermined file group.

The verification result registration unit <NUM> receives the input of the verification result of falsification of the monitored device <NUM> from the verification unit <NUM>. When acquiring the verification result indicating that falsification has been performed, the verification result registration unit <NUM> registers the verification result indicating that the monitored device <NUM> has been illegally falsified, in a registration place for the verification result that the authenticity determination server <NUM> has. The administrator can confirm that illegal falsification has been performed on the monitored device <NUM>, by confirming the registration place for the verification result in the authenticity determination server <NUM>.

<FIG> is a diagram showing an example of a result of classifying falsified files by the authenticity determination server according to an embodiment. Referring to <FIG>, next is described the result of classification of falsified files by the authenticity determination server <NUM> according to the present embodiment. Here, three cases of using the file data of the centOS as the teacher data set which is the original data for creating the teacher data, using the file data of the centOS and the Ubuntu, and using the file data of the centOS, the Ubuntu and Windows, will be described as examples.

First, the case where the determination target classification learning model <NUM> is generated by using the file data of the centOS will be described. When the file data of the centOS is used as the verification data, the value of AUC (Area Under Curve) is <NUM> or more, and the classification can be performed with high accuracy. When the Ubuntu file data is used as the verification data, the value of AUC is <NUM> or more, and the classification can be performed with high accuracy. That is, even in the verification of unlearned Ubuntu file data, classification can be performed with high accuracy, and it can be seen that the same OS domain has generalization performance. On the other hand, when the file data of Windows is used as the verification data, the AUC value is less than <NUM> and the classification accuracy is low.

Second, the case where the determination target classification learning model <NUM> is generated by using the file data of the centOS and the Ubuntu will be described. When the file data of the centOS is used as the verification data, the value of AUC is <NUM> or more, and the classification can be performed with high accuracy. When the Ubuntu file data is used as the verification data, the value of AUC is <NUM> or more, and the classification can be performed with high accuracy. That is, when the verification data of the same domain type is classified with respect to the teacher data used for learning, classification can be performed with high accuracy. On the other hand, when the file data of Windows is used as the verification data, the AUC is <NUM> or more, and the classification accuracy is somewhat good.

Third, the case in which the determination target classification learning model <NUM> is generated by using the file data of the centOS, the Ubuntu and the Windows will be described. It can be said that the value of AUC is <NUM> or more and the classification is possible with high accuracy in both cases where the file data of centOS is used as the verification data, the file data of Ubuntu is used as the verification data, and the file data of Windows is used as the verification data. That is, when the verification data of the same domain type is classified with respect to the teacher data used for learning, classification can be performed with high accuracy.

<FIG> is a flowchart of processing in a learning phase of the authenticity determination server according to an embodiment. Next, with reference to <FIG>, the flow of processing in the learning phase of the authenticity determination server <NUM> according to the present embodiment will be described.

The teacher data creation unit <NUM> acquires file data to be used for learning, from the learning data providing device <NUM>. For example, the teacher data creation unit <NUM> acquires binary data of each of a static file and a dynamic file in a file data group to be used for learning, from the learning data providing device <NUM>, according to an instruction from the administrator (step S101).

The teacher data creation unit <NUM> adds a label representing a dynamic file or a static file to each file, and creates a feature vector representing the number of appearances of a <NUM>-byte character expressed in hexadecimal for each file, to create teacher data (step S102).

The teacher data creation unit <NUM> outputs, to the learning unit <NUM>, the teacher data which is binary data to which a teacher label indicating whether the file is a static file or a dynamic file is added. The learning unit <NUM> uses the teacher data acquired from the teacher data creation unit <NUM>, to perform learning for Hyper parameter tuning with the highest classification accuracy, and generates the learned determination target classification learning model <NUM> (step S103).

The learning unit <NUM> outputs the learned determination target classification learning model <NUM> to the extraction unit <NUM>. The extraction unit <NUM> stores the determination target classification learning model <NUM> acquired from the learning unit <NUM> (step S104).

<FIG> is a flowchart of processing in the classification phase and the normal state hash value storage phase of the authenticity determination server according to the embodiment. Next, the flow of processing in the classification phase and the normal state hash value storage phase of the authenticity determination server <NUM> according to the present embodiment will be described with reference to <FIG>.

The file information acquisition unit <NUM> acquires, from the file information acquisition unit <NUM>, the file group <NUM> of the monitored device <NUM> at the reference point of time confirmed as the normal state (step S201).

The extraction unit <NUM> acquires the file group <NUM> from the file information acquisition unit <NUM>. Then, the extraction unit <NUM> inputs the acquired file group <NUM> to the learned determination target classification learning model <NUM>, and classifies it into a static file and a dynamic file (step S202).

The extraction unit <NUM> extracts the static file included in the file group <NUM>, and causes the authenticity determination server <NUM> to hold the extracted static file as the determination target file group <NUM>. The hash value generation unit <NUM> acquires each determination target file in a normal state included in the determination target file group <NUM>. Next, the hash value generation unit <NUM> calculates a normal state hash value of each acquired determination target file (step S203).

The hash value generation unit <NUM> stores the hash value of each determination target file in a normal state in the normal state hash value storage unit <NUM> (step S204).

<FIG> is a flowchart of processing in the authenticity determination phase of the authenticity determination server according to the embodiment. Next, with reference to <FIG>, the flow of processing in the authenticity determination phase of the authenticity determination server <NUM> according to the present embodiment will be described.

The authenticity determination instruction unit <NUM> acquires identification information of each determination target file from the determination target file list added to the determination target file group <NUM>. Then, the authenticity determination instruction unit <NUM> transmits a calculation request for a hash value together with identification information of each determination target file, to the hash value generation unit <NUM> of the monitored device <NUM> (step S301).

The hash value generation unit <NUM> of the monitored device <NUM> acquires each piece of file data of the file group <NUM> and calculates each hash value having falsification possibility. The verification unit <NUM> receives the hash value having falsification possibility of the file group <NUM> of the monitored device <NUM> in operation, from the hash value generation unit <NUM> of the monitored device <NUM> (step S302).

Next, the verification unit <NUM> acquires a normal state hash value of each determination target file from the normal state hash value storage unit <NUM>. Then, the verification unit <NUM> compares the hash value having falsification possibility of each of the determination target files with the normal state hash value, and verifies the presence/absence of falsification in each piece of file data (step S303).

The verification result registration unit <NUM> receives the input of the verification result of falsification of the monitored device <NUM>, from the verification unit <NUM>. When acquiring the verification result indicating that falsification has been performed, the verification result registration unit <NUM> registers the verification result indicating that the monitored device <NUM> has been illegally falsified, in a registration place for the verification result in the authenticity determination server <NUM> (step S304).

As described above, the authenticity determination server <NUM> according to the present embodiment extracts a determination target file, which is a static file, from the file group <NUM> of the monitored device <NUM> by using the learning model generated by learning the features of the static file and the dynamic file. Then, the authenticity determination server <NUM> compares a normal state hash value obtained from a determination target file at a reference point of time when it is considered that no falsification is performed, with the hash value having falsification possibility that is obtained from the determination target file of the monitored device <NUM> in operation, and detects falsification on the monitored device <NUM>.

Thus, the static file can be easily and comprehensively extracted from the file group <NUM> of the monitored device <NUM>. By performing software authenticity determination using the extracted static file as a determination target file, a wide target range of software authenticity determination can be secured, and a file which is not the target of software authenticity determination can be removed from the determination target files. Therefore, the accuracy of software authenticity determination can be improved, stably operating the system.

The components of the devices illustrated in the drawings are functional concepts and do not necessarily need to be physically configured in the same way as illustrated in the drawings. That is to say, specific forms of distribution and integration of the devices are not limited to those illustrated in the figures, and all or part thereof can be configured being functionally or physically distributed or integrated in optional increments, in accordance with various types of loads, usage states, and so forth. In particular, it is also possible to have a configuration in which the monitored device <NUM> includes the normal state hash value storage unit <NUM> and the verification unit <NUM>. When the verification unit <NUM> is arranged in the monitored device <NUM>, the monitored device <NUM> transmits a verification result to the authenticity determination server <NUM>, and the authenticity determination server <NUM> registers the acquired verification result. Further, any or all of the processing functions performed by each device may be implemented by a CPU (Central Processing Unit) and a program analyzed and executed by the CPU, or may be implemented as hardware by wired logic.

Also, out of the processes described in the present embodiment, all or part of processes described as being automatically performed can be manually performed. Alternatively, all or part of processes described as being manually performed can be automatically performed by known methods. In addition, information including the processing procedure, control procedure, specific name, various data and parameters that are shown in the above documents and drawings may be arbitrarily changed unless otherwise described.

In one embodiment, the authenticity determination server <NUM> may be implemented by installing an information processing program that executes the above-described information processing, as packaged software or online software, on a desired computer. For example, by causing an information processing device to execute the above-described information processing program, it is possible to cause the information processing device to function as the authenticity determination server <NUM>. The information processing device described here may not only include a server computer but also include desktop and laptop personal computers. Additionally, mobile communication terminals such as smartphones, cellular telephones, PHSs (Personal Handyphone System), and so forth, and further, slate terminal and the like, such as PDAs (Personal Digital Assistant) and so forth, are included in the scope of information processing devices.

The authenticity determination server <NUM> can be implemented as a management server device for providing a client, which is a terminal device used by a user, with services related to the above-mentioned management processing. For example, the management server device is implemented as a server device which receives the configuration input request and provides a management service for performing configuration input. In this case, the management server device may be implemented as a Web server, or may be implemented as a cloud for providing a service related to the above-mentioned management processing by outsourcing.

<FIG> is a diagram showing an example of the computer which executes the learning program. A computer <NUM> includes, for example, a memory <NUM> and a CPU <NUM>. The computer <NUM> also has a hard disk drive interface <NUM>, a disc drive interface <NUM>, a serial port interface <NUM>, a video adapter <NUM>, and a network interface <NUM>. These components are connected to each other via a bus <NUM>.

The memory <NUM> includes a ROM (Read Only Memory) <NUM> and a RAM (Random Access Memory) <NUM>. The ROM <NUM> stores a boot program such as a BIOS (BASIC Input Output System) or the like, for example. The hard disk drive interface <NUM> is connected to a hard disk drive <NUM>. The disc drive interface <NUM> is connected to a disc drive <NUM>. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted in the disk drive <NUM>. The serial port interface <NUM> is connected to, for example, a mouse <NUM> or a keyboard <NUM>. The video adapter <NUM> is connected to, for example, a display <NUM>.

The hard disk drive <NUM> stores, for example, an OS <NUM>, an application program <NUM>, a program module <NUM>, and program data <NUM>. In other words, a learning program that defines each processing of the authenticity determination server <NUM> having the similar function to the authenticity determination server <NUM> is implemented as the program module <NUM> on which computer-executable codes are described. The program module <NUM> is stored in, for example, the hard disk drive <NUM>. For example, the program module <NUM> for executing the same processing as the processing performed by the functional element of the authenticity determination server <NUM> is stored on the hard disk drive <NUM>. Note that the hard disk drive <NUM> may be replaced with a Solid State Drive (SSD).

In addition, the setting data used in the processing in the above embodiment is stored in, for example, the memory <NUM> or hard disk drive <NUM> as the program data <NUM>. The CPU <NUM> then reads out the program module <NUM> and the program data <NUM> stored in the memory <NUM> or the hard disk drive <NUM> to the RAM <NUM> as necessary, and executes the processing of the embodiments described above.

Claim 1:
An information processing device, comprising:
a learning unit (<NUM>) for learning each feature of a dynamic file and a static file to generate a learning model (<NUM>), wherein the learning unit (<NUM>) performs the learning using teacher data (<NUM>) for each of a plurality of Operating System (OS) domain types;
an extraction unit (<NUM>) for acquiring a predetermined file group at a reference point of time from an external device that uses the predetermined file group, the predetermined file group including determination files of the plurality of Operating System (OS) domain types and for extracting a determination target file, which is the static file, from the predetermined file group on the basis of the learning model (<NUM>);
a hash value generation unit (<NUM>) for calculating a first hash value of the determination target file extracted by the extraction unit (<NUM>); and
a verification unit (<NUM>) for acquiring, from the external device, a second hash value of the determination target file after a lapse of time from a reference point of time that the external device has, comparing the first hash value with the second hash value, and verifying whether or not the predetermined file group has been falsified.