Output control apparatus, computer-readable medium for storing program for output control apparatus, output control method, and output control system

• US 9,747,437 B2
• Filed: 05/08/2013
• Issued: 08/29/2017
• Est. Priority Date: 11/09/2010
• Status: Active Grant

• Current Assignee: Digital Arts Inc.
• Original Assignee: Digital Arts Inc.
• Inventors: Takahashi, Noriyuki, Dogu, Toshio
• Primary Examiner(s): DADA, BEEMNET W
• Application Number:
  US13/889,359
• Publication Number:
  US 20130247195A1
• Time in Patent Office: 1,574 Days
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Provided is an output section that outputs data to outside; a condition storage section that stores an abnormal condition showing at least one of a characteristic of data to be outputted from the output section by means of malicious software and a characteristic of an operational pattern of the output section that results when the malicious software outputs data; and an output control section that prohibits output of data when at least one of a characteristic of data to be outputted from the output section and a characteristic of an operational pattern of the output section satisfies the abnormal condition.

Claims

1. An output control apparatus comprising:

an output section that outputs data to outside;

a condition storage section that stores an abnormal condition showing a characteristic of an operational pattern of the output section that results when malicious software outputs data and a normal condition showing a characteristic of an operational pattern of the output section that results when software other than the malicious software outputs data; and

an output control section that controls output of data by the output section based on the likelihood that malicious software is responsible for the output by prohibiting output of data when a characteristic of an operational pattern of the output section satisfies the abnormal condition, permitting output of the data when the characteristic of the operational pattern of the output section satisfies the normal condition, and inquiring a user whether to output the data when the characteristic of the operational pattern of the output section does not satisfy either the abnormal condition or the normal condition, wherein

the output control section confirms the validity of the user'"'"'s instruction of whether to output the data, receives the user'"'"'s instruction when the validity of the user'"'"'s instruction is confirmed, and permits output of the data when the received user'"'"'s instruction is to output the data.

5. The output control apparatus according to claim 1, wherein

the characteristic of an operational pattern includes whether a user of a user terminal including the output control apparatus has indicated acceptance of an operation.

8. The output control apparatus according to claim 1, wherein

the characteristic of an operational pattern includes whether a user of a user terminal including the output control apparatus has indicated acceptance of a change in the output destination of the data or a background output by the output section.

11. The output control apparatus according to claim 1, wherein

the characteristic of an operational pattern includes the output destination of the data.

12. The output control apparatus according to claim 1, wherein

the characteristic of an operational pattern includes whether a URL, domain name, or IP address of a site in communication with a user terminal including the output control apparatus matches a URL, domain name, or IP address of a site that is the intended destination of the data.

2. A non-transitory computer-readable medium storing therein a program that causes a computer to function as an output control apparatus comprising:

an output section that outputs data to outside;

a condition storage section that stores an abnormal condition showing a characteristic of an operational pattern of the output section that results when malicious software outputs data and a normal condition showing a characteristic of an operational pattern of the output section that results when software other than the malicious software outputs data; and

an output control section that controls output of data by the output section based on the likelihood that malicious software is responsible for the output by prohibiting output of data when a characteristic of an operational pattern of the output section satisfies the abnormal condition, permitting output of the data when the characteristic of the operational pattern of the output section satisfies the normal condition, and inquiring a user whether to output the data when the characteristic of the operational pattern of the output section does not satisfy either the abnormal condition or the normal condition, wherein

the output control section confirms the validity of the user'"'"'s instruction of whether to output the data, receives the user'"'"'s instruction when the validity of the user'"'"'s instruction is confirmed, and permits output of the data when the received user'"'"'s instruction is to output the data.

13. The non-transitory computer-readable medium according to claim 2, wherein

the characteristic of an operational pattern includes whether a user of a user terminal including the output control apparatus has indicated acceptance of an operation.

14. The non-transitory computer-readable medium according to claim 2, wherein

the characteristic of an operational pattern includes whether a user of a user terminal including the output control apparatus has indicated acceptance of a change in the output destination of the data or a background output by the output section.

15. The non-transitory computer-readable medium according to claim 2, wherein

the characteristic of an operational pattern includes the output destination of the data.

16. The non-transitory computer-readable medium according to claim 2, wherein

the characteristic of an operational pattern includes whether a URL, domain name, or IP address of a site in communication with a user terminal including the output control apparatus matches a URL, domain name, or IP address of a site that is the intended destination of the data.

3. An output control method comprising:

storing, in a condition storage section, an abnormal condition showing a characteristic of an operational pattern of an output section that results when malicious software outputs data and a normal condition showing a characteristic of an operational pattern of the output section that results when software other than the malicious software outputs data; and

controlling output of data based on the likelihood that malicious software is responsible for the output by;

comparing, with the abnormal condition, a characteristic of an operational pattern of the output section, and when the characteristic of the operational pattern of the output section satisfies the abnormal condition, prohibiting output of the data;

comparing, with the normal condition, the characteristic of the operational pattern of the output section, and when the characteristic of the operational pattern of the output section satisfies the normal condition, permitting output of the data;

inquiring a user whether to output the data when the characteristic of the operational pattern of the output section does not satisfy either the abnormal condition or the normal condition; and

confirming the validity of the user'"'"'s instruction, made in response to said inquiring, of whether to output the data, receiving the user'"'"'s instruction when the validity of the user'"'"'s instruction is confirmed, and permitting output of the data when the received user'"'"'s instruction is to output the data.

6. The output control method according to claim 3, wherein

the characteristic of an operational pattern includes whether a user of a user terminal performing the output control method has indicated acceptance of an operation.

9. The output control method according to claim 3, wherein

the characteristic of an operational pattern includes whether a user of a user terminal performing the output control method has indicated acceptance of a change in the output destination of the data or a background output by the output section.

17. The output control method according to claim 3, wherein

the characteristic of an operational pattern includes the output destination of the data.

18. The output control method according to claim 3, wherein

the characteristic of an operational pattern includes whether a URL, domain name, or IP address of a site in communication with a user terminal performing the output control method matches a URL, domain name, or IP address of a site that is the intended destination of the data.

4. An output control system comprising:

a server; and

a terminal that exchanges information with the server via a communication line, wherein

the terminal includes;

an output section that outputs data to outside; and

a characteristic information collecting section that collects characteristic information showing a characteristic of an operation of the output section, and transmits the characteristic information to the server, and

the server includes;

a condition storage section that stores an abnormal condition showing a characteristic of an operation of the output section that results when malicious software outputs data and a normal condition showing a characteristic of an operational pattern of the output section that results when software other than the malicious software outputs data; and

a deciding section that receives the characteristic information and controls output of the data based on the likelihood that malicious software is responsible for the output by deciding to prohibit output of the data when the characteristic information satisfies the abnormal condition, deciding to permit output of the data when the characteristic information satisfies the normal condition, deciding whether to prohibit or permit output of the data on the basis of inquiring a user whether to output the data when the characteristic information does not satisfy either the abnormal condition or the normal condition, and notifying the output section of the decision, wherein

the output section does not output the data to outside when having received the decision to prohibit the output of the data, and

the deciding section confirms the validity of the user'"'"'s instruction of whether to output the data, receives the user'"'"'s instruction when the validity of the user'"'"'s instruction is confirmed, and permits output of the data when the received user'"'"'s instruction is to output the data.

7. The output control system according to claim 4, wherein

the characteristic of an operation of the output section includes whether a user of the terminal has indicated acceptance of an operation.

10. The output control system according to claim 4, wherein

the characteristic of an operation of the output section includes whether a user of the terminal has indicated acceptance of a change in the output destination of the data or a background output by the output section.

19. The output control system according to claim 4, wherein

the characteristic of an operation of the output section includes the output destination of the data.

20. The output control system according to claim 4, wherein

the characteristic of an operation of the output section includes whether a URL, domain name, or IP address of a site in communication with the terminal matches a URL, domain name, or IP address of a site that is the intended destination of the data.