Illegal communication detector, illegal communication detector control method, and storage medium storing program for illegal communication detector control

• US 20050022000A1
• Filed: 04/07/2004
• Published: 01/27/2005
• Est. Priority Date: 07/25/2003
• Status: Active Grant

• Current Assignee: Fujifilm Business Innovation Corp. (Fujifilm Holdings Corporation)
• Original Assignee: Fuji Xerox Company Limited (Xerox Holdings Corp.)
• Inventors: Inomata, Kohshiro, Mitsutake, Katsuya
• Granted Patent: US 7,487,368 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

An illegal communication detector that is mounted in a communication path between external devices and a protection-targeted device to monitor contents of communications delivered to the protection-targeted device, the illegal communication detector including: a recording unit that records at least part of information transmitted from the external devices to the protection-targeted device; a determination unit that regards one of the external devices as a device of interest; and a communication control unit that detects, if the determination means conclude that at least part of the recorded information complies with the predetermined illegal communication standard rule, that the contents of communication are derived from an illegal communication, and performing a predetermined process concerning the communication with the device of interest.

Claims

1. An illegal communication detector that is mounted in a communication path between specific devices and a protection-targeted device to monitor contents of communications delivered to the protection-targeted device, the illegal communication detector comprising:

a recorder that records at least part of information transmitted from the specific devices to the protection-targeted device;

a detector that regards one of the specific devices as a device of interest and detects, when at least part of the recorded information transmitted from the device of interest complies with a predetermined illegal communication standard rule, that the contents of communication are derived from an illegal communication.

2. The illegal communication detector according to claim 1, wherein the illegal communication standard rule is formulated according to a number of an item of method information included in the recorded information.

3. The illegal communication detector according to claim 1, wherein the illegal communication standard rule is formulated according to a number of request count for each type of URI included in the recorded information.

4. The illegal communication detector according to claim 1, further comprising a memory that stores information identifying protection information that is at least part of information transmittable by the protection-targeted device, wherein the illegal communication standard rule is formulated according to a number of accesses to the protection information identified by the stored information.

14. The illegal communication detector according to claim 1, wherein the detector determines, in accordance with the information transmitted from the device of interest and recorded that prevails after authenticating a user transmitting information from the device of interest, whether a predetermined illegal communication standard rule is complied with.

5. An illegal communication detector that is mounted in a communication path between specific devices and a protection-targeted device to monitor contents of communications delivered to the protection-targeted device, the illegal communication detector comprising:

a recorder that records at least part of information transmitted from the specific devices to the protection-targeted device;

a memory that stores information about conditions for the communication from each of the specific devices;

a detector that regards one of the specific devices as a device of interest and detects, when at least part of the recorded information transmitted from the device of interest complies with the information about the conditions for the communication, that the contents of communication are derived from an illegal communication.

6. The illegal communication detector according to claim 5, wherein the information about the conditions for the communication includes a group information of IP addresses.

7. The illegal communication detector according to claim 5, wherein the information about the conditions for the communication includes information indicating an access time.

8. The illegal communication detector according to claim 5, wherein the information about the conditions for the communication is set by extracting information from the communication history.

9. An illegal communication detector that is mounted in a communication path between specific devices and a protection-targeted device to monitor contents of communications delivered to the protection-targeted device, the illegal communication detector comprising:

a recorder that records at least part of information transmitted from the specific devices to the protection-targeted device;

a detector that regards one of the specific devices as a device of interest and detects, when at least part of the recorded information transmitted from the device of interest complies with a predetermined illegal communication standard rule, that the contents of communication are derived from an illegal communication

a communication controller that performs a predetermined process concerning the communication with the device of interest.

10. The illegal communication detector according to claim 9, further comprising an acquiring part that acquires information about a contact to be reached upon detection of an illegal communication, wherein, upon detection of an illegal communication, the communication controller conveys specified information to the contact to be reached.

11. The illegal communication detector according to claim 10, wherein the acquiring unit acquires authentication information about a user transmitting information from the device of interest and obtains contact information about the authenticated user as the contact information for use when an illegal communication is detected.

12. The illegal communication detector according to claim 9, wherein, upon detection of an illegal communication, the communication controller stores information for identifying a device of interest involved in the illegal communication and performs a process for stopping information transmission from the device of interest, which is identified by the stored information, to the protection-targeted device.

13. The illegal communication detector according to claim 10, wherein, if predetermined information is not received from the contact to which the specified information is conveyed, the communication controller stores the information for identifying a device of interest involved in the illegal communication and performs a process for stopping the information transmission from the device of interest, which is identified by the stored information, to the protection-targeted device.

15. An illegal communication detector that is included in a system providing communication between a first network and a second network to monitor contents of communications delivered from a device in the first network to a protection-targeted device that is in the second network, the illegal communication detector comprising:

a recorder that records at least part of information transmitted from the specific devices to the protection-targeted device;

a detector that regards one of the specific devices as a device of interest and detects, when at least part of the recorded information transmitted from the device of interest complies with a predetermined illegal communication standard rule, that the contents of communication are derived from an illegal communication.

16. A method for controlling an illegal communication detector that is mounted in a communication path between external devices and a protection-targeted device to monitor contents of communications delivered to the protection-targeted device, the method comprising:

recording at least part of information transmitted from the external devices to the protection-targeted device;

regarding one of the specific devices as a device of interest;

detecting, when at least part of the recorded information transmitted from the device of interest complies with a predetermined illegal communication standard rule, that the contents of communication are derived from an illegal communication.

17. A method for controlling an illegal communication detector that is mounted in a communication path between external devices and a protection-targeted device to monitor contents of communications delivered to the protection-targeted device, the method comprising:

recording at least part of information transmitted from the specific devices to the protection-targeted device;

regarding one of the specific devices as a device of interest;

detecting, when at least part of the recorded information transmitted from the device of interest complies with the information about the conditions for the communication from each of the specific devices, that the contents of communication are derived from an illegal communication.

18. A method for controlling an illegal communication detector that is mounted in a communication path between external devices and a protection-targeted device to monitor contents of communications delivered to the protection-targeted device, the method comprising:

recording at least part of information transmitted from the specific devices to the protection-targeted device;

regarding one of the specific devices as a device of interest;

detecting, when at least part of the recorded information transmitted from the device of interest complies with a predetermined illegal communication standard rule, that the contents of communication are derived from an illegal communication

performing a predetermined process concerning the communication with the device of interest.

19. A storage medium readable by a computer, the storage medium storing a program of instructions executable by the computer, which causes an illegal communication detector mounted in a communication path between external devices and a protection-targeted device for monitoring contents of communications delivered to the protection-targeted device to perform a function, the function comprising:

recording at least part of information transmitted from the external devices to the protection-targeted device;

regarding one of the specific devices as a device of interest;

detecting, when at least part of the recorded information transmitted from the device of interest complies with a predetermined illegal communication standard rule, that the contents of communication are derived from an illegal communication.