UNAUTHORIZED ACCESS DETECTING SYSTEM AND UNAUTHORIZED ACCESS DETECTING METHOD

• US 20160373447A1
• Filed: 06/19/2014
• Published: 12/22/2016
• Est. Priority Date: 07/05/2013
• Status: Active Grant

• Current Assignee: Nippon Telegraph and Telephone Corporation
• Original Assignee: Nippon Telegraph and Telephone Corporation
• Inventors: AKIYAMA, Mitsuaki, YAGI, Takeshi
• Granted Patent: US 10,142,343 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

In an unauthorized access detecting system, authentication information to be leaked outside is generated. In the unauthorized access detecting system, the generated authentication information is set on an analyzing host, and a program to be analyzed is operated on the analyzing host. In the unauthorized access detecting system, access to a content using the authentication information is detected, and if the access using the authentication information is detected, the access is identified as unauthorized access.

Claims

1. An unauthorized access detecting system, comprising:

a generating unit that generates authentication information to be leaked outside;

an operating unit that sets the authentication information generated by the generating unit on a host and causes a program to be analyzed to operate on the host;

a detecting unit that detects access to a content using the authentication information; and

an identifying unit that identifies, if access using the authentication information is detected by the detecting unit, the access as unauthorized access.

2. The unauthorized access detecting system according to claim 1, further comprising a storing unit that obtains information on a host that has made the access identified as unauthorized access by the identifying unit, and stores the information into a storage unit.

3. The unauthorized access detecting system according to claim 2, further comprising an access preventing unit that detects access from a host identified by the information on the host stored in the storage unit, and prevents access from the host.

4. The unauthorized access detecting system according to claim 2, wherein the storing unit obtains an internet protocol (IP) address as the information on the host, and stores the IP address into the storage unit.

5. An unauthorized access detecting system, comprising:

a generating unit that generates authentication information;

an operating unit that sets the authentication information generated by the generating unit on a host and causes a program to be analyzed to operate on the host;

a detecting unit that detects unauthorized access to a content using the authentication information; and

an identifying unit that identifies, as a program that leaks out information, a program that operates on the host set with the authentication information if unauthorized access using the authentication information has been detected by the detecting unit.

6. The unauthorized access detecting system according to claim 5, further comprising a storage unit that stores therein the authentication information generated by the generating unit, wherein

the detecting unit determines whether authentication information used in access to the content coincides with the authentication information stored in the storage unit, and if there is coincidence, the detecting unit detects the access as unauthorized access.

7. The unauthorized access detecting system according to claim 5, further comprising a deleting unit that detects the program identified by the identifying unit and deletes the program if the program is detected.

8. The unauthorized access detecting system according to claim 5, further comprising a collecting unit that collects the same program as the program identified by the identifying unit from a Web space.

9. An unauthorized access detecting method executed by an unauthorized access detecting system, the unauthorized access detecting method including:

a generating step of generating authentication information to be leaked outside;

an operating step of setting the authentication information generated by the generating step on a host and causing a program to be analyzed to operate on the host;

a detecting step of detecting access to a content using the authentication information; and

an identifying step of identifying, if access using the authentication information is detected by the detecting step, the access as unauthorized access.

10. The unauthorized access detecting method according to claim 9, further including a storing step of obtaining information on a host that has made the access identified as unauthorized access by the identifying step and storing the information into a storage unit.

11. The unauthorized access detecting method according to claim 10, further including an access preventing step of detecting access from a host identified by the information on the host stored in the storage unit and preventing access from the host.

12. The unauthorized access detecting method according to claim 10, wherein in the storing step, as the information on the host, an internet protocol (IP) address of the host is obtained and stored into the storage unit.

13. An unauthorized access detecting method executed by an unauthorized access detecting system, the unauthorized access detecting method including:

a generating step of generating authentication information;

an operating step of setting the authentication information generated by the generating step on a host and causing a program to be analyzed to operate on the host;

a detecting step of detecting unauthorized access to a content using the authentication information; and

an identifying step of identifying, if unauthorized access using the authentication information is detected by the detecting step, a program that operates on the host set with the authentication information, as a program that leaks out information.

14. The unauthorized access detecting method according to claim 13, further including a storing step of storing the authentication information generated by the generating step into a storage unit, wherein

in the detecting step, whether authentication information used in access to the content coincides with the authentication information stored in the storage unit is determined, and if there is coincidence, the access is detected as unauthorized access.

15. The unauthorized access detecting method according to claim 13, further including a deleting step of detecting the program identified by the identifying step, and deleting the program if the program is detected.

16. The unauthorized access detecting method according to claim 13, further including a collecting step of collecting the same program as the program identified by the identifying step from a Web space.