Unauthorized access detecting system and unauthorized access detecting method

• US 10,142,343 B2
• Filed: 06/19/2014
• Issued: 11/27/2018
• Est. Priority Date: 07/05/2013
• Status: Active Grant

• Current Assignee: Nippon Telegraph and Telephone Corporation
• Original Assignee: Nippon Telegraph and Telephone Corporation
• Inventors: Akiyama, Mitsuaki, Yagi, Takeshi
• Primary Examiner(s): Simitoski, Michael
• Application Number:
  US14/901,934
• Publication Number:
  US 20160373447A1
• Time in Patent Office: 1,622 Days
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

In an unauthorized access detecting system, authentication information to be leaked outside is generated. In the unauthorized access detecting system, the generated authentication information is set on an analyzing host, and a program to be analyzed is operated on the analyzing host. In the unauthorized access detecting system, access to a content using the authentication information is detected, and if the access using the authentication information is detected, the access is identified as unauthorized access.

Claims

1. An unauthorized access detecting system, comprising:

processing circuitry configured to

generate authentication information that is used to log in to a predetermined server,

set the generated authentication information generated on a predetermined analyzing host and cause a program to be analyzed to operate on the predetermined analyzing host, wherein the program is allowed access to the set authentication information,

detect unauthorized access to a content at a predetermined server using the authentication information,

obtain a program corresponding to the authentication information by referring to a table stored in a memory, the table prescribing correspondence between the authentication information and the program, and

identify, as a program that leaks out information, the program that operates on the predetermined analyzing host set with the authentication information if unauthorized access using the authentication information has been detected.

2. The unauthorized access detecting system according to claim 1, wherein the memory stores therein the generated authentication information, and

the processing circuitry determines whether authentication information used in access to the content coincides with the authentication information stored in the memory, and if there is coincidence, the processing circuitry detects the access as unauthorized access.

3. The unauthorized access detecting system according to claim 1, the processing circuitry being configured to detect the identified program and delete the program when the program is detected.

4. The unauthorized access detecting system according to claim 1, wherein the identified program was collected from the Internet.

5. An unauthorized access detecting method executed by an unauthorized access detecting system, the unauthorized access detecting method including:

a generating step of generating authentication information that is used to log in to a predetermined server;

an operating step of setting the authentication information generated by the generating step on a predetermined analyzing host and causing a program to be analyzed to operate on the predetermined analyzing host, wherein the program is allowed access to the set authentication information;

a detecting step of detecting unauthorized access to a content at the predetermined server using the authentication information;

an obtaining step of obtaining a program corresponding to the authentication information by referring to a table stored in a memory, the table prescribing correspondence between the authentication information and the program, and

an identifying step of identifying, if unauthorized access using the authentication information is detected by the detecting step, a program that operates on the predetermined analyzing host set with the authentication information, as a program that leaks out information.

6. The unauthorized access detecting method according to claim 5, further including a storing step of storing the authentication information generated by the generating step into the memory, wherein

in the detecting step, whether authentication information used in access to the content coincides with the authentication information stored in the memory is determined, and if there is coincidence, the access is detected as unauthorized access.

7. The unauthorized access detecting method according to claim 5, further including a deleting step of detecting the program identified by the identifying step, and deleting the program if the program is detected.

8. The unauthorized access detecting method according to claim 5, wherein the identified program was collected from the Internet.