JP4334560B2 - Communication record monitoring device - Google Patents

Description

  The present invention relates to a communication monitoring and recording apparatus capable of easily confirming the contents of a communication sentence flowing through a network.

  In recent years, interest in protecting information such as personal information and trade secrets has increased. Therefore, various solutions for preventing information leakage have been proposed.

  Specifically, there has been proposed a communication monitoring and recording apparatus that can intercept and record a communication sentence flowing through a network and search and display the recorded communication sentence. In this communication monitoring and recording apparatus, for example, a list of communication sentences including a keyword can be displayed by keyword search, or a list of communication sentences matching a designated transmission source / destination can be displayed. Thereby, the discovery of information leakage and the detailed contents of the leaked information can be confirmed. It is also possible to check the source of information leakage by confirming the contents of the communication text communicated before and after the retrieved communication text.

Also, a communication information recording device that “intercepts communication data passing through the target network and classifies it according to the type of the communication data that has been intercepted, and adds new search data and accumulates it in the analysis result database” Have also been proposed (see, for example, Patent Document 1).
International Publication No. 2002/029579 Pamphlet

  However, in the conventional communication monitoring and recording apparatus, when the content of the communication text communicated before and after the retrieved communication text is confirmed, it is necessary to search again after changing the search condition.

  For example, when investigating information leaks due to e-mails, the origin of the information leak is tracked by searching for e-mails that contain the specified keyword and then examining the source and destination of the e-mails. To do.

  In this case, since the communication traffic is enormous, it is very complicated to check the content of the communication text while changing the search condition as needed.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a communication monitoring and recording apparatus capable of easily confirming the contents of a communication sentence flowing through a network.

  The present invention takes the following means in order to solve the above problems.

  The first invention is a communication sentence recording means for recording a communication sentence intercepted from a network in association with an intercept date and time, an input means for inputting search data, and a communication sentence recorded in the communication sentence recording means. A communication text display means for reading a communication text including search data and displaying a communication text list in which the read communication texts are arranged in order of intercept date and time, and a selection means for selecting a target communication text from the communication text list And means for displaying the target communication text selected by the selection means; from the header information of the target communication text selected by the selection means, the unique information of the target communication text and the reference referred to by the target communication text Based on the unique information of the reference message read by the header information reading means and the header information reading means for reading the unique information of the message, the reference message is recorded in the message recording unit. Reference message reading means for reading from the stage, means for displaying the reference message read by the reference message reading means with the latest intercept date and time, and the object read by the header information reading means Based on the unique information of the communication text, the referenced communication text reading means for reading the referenced communication text referring to the target communication text from the communication text recording means, and the referenced text read by the referenced text reading means And a means for displaying a communication message having the earliest intercept date and time.

  According to a second aspect of the present invention, in the communication monitoring and recording apparatus corresponding to the first aspect, the communication message recording unit records an electronic mail, and the header information reading unit is a message ID (specific information of the electronic mail). Message-ID).

  According to a third aspect of the present invention, in the communication monitoring and recording apparatus corresponding to the first or second aspect of the invention, the message recording unit records Web access information, and the header information reading unit stores the Web access information. This is a communication monitoring and recording device that reads URL information that is unique information.

  According to a fourth aspect of the present invention, in the communication monitoring and recording apparatus corresponding to the first or second aspect of the invention, the message recording unit records Web access information, and the header information reading unit stores the Web access information. This is a communication monitoring and recording device that reads a client IP address that is unique information.

  5th invention is the communication monitoring recording apparatus corresponding to any one of 1st invention thru | or 4th invention, whether the said communication text is the communication text encrypted from the header information of the said communication text. A ciphertext determining means for determining whether or not the ciphertext determining means determines that the communication text is an encrypted communication text, and is an encrypted communication text instead of the communication text This is a communication monitoring and recording device that displays the effect.

  According to a sixth aspect of the present invention, in the communication monitoring and recording apparatus corresponding to the first or second aspect, when an electronic mail message is selected by the selecting means, URL information is described in the electronic mail text. If it is determined that the URL information is described by the URL information determination unit and the URL information determination unit, the Web access information corresponding to the URL information is read from the message recording unit and displayed. And a communication monitoring and recording apparatus.

  A seventh aspect of the invention is the communication monitoring and recording apparatus corresponding to any one of the first aspect, the third aspect, or the fourth aspect, wherein the communication text of the Web access information is selected by the selection means The e-mail address information determining means for determining whether or not e-mail address information is described in the Web access information, and when the e-mail address information determining means determines that the e-mail address information is described, A communication record monitoring apparatus further comprising means for reading an e-mail addressed to the mail address information from the message recording means and displaying it.

  An eighth invention is the communication monitoring and recording apparatus corresponding to any one of the first to seventh inventions, wherein the reference message reading means and the referenced message reading means are on the operation screen. This is a communication monitoring and recording apparatus that is executed by designating an icon to be displayed.

  According to a ninth invention, in the communication monitoring and recording apparatus corresponding to any one of the first to eighth inventions, the reference message having the earliest intercept date and time of the reference message read by the reference message reading means In this case, the communication record monitoring apparatus further includes means for displaying the fact.

  According to a tenth aspect of the present invention, in the communication monitoring and recording apparatus corresponding to any one of the first to ninth aspects, the intercepted date and time of the referenced message read by the referenced message reading unit is the latest. In the case of a reference message, the communication record monitoring device further includes means for displaying the fact.

<Action>
Therefore, the present invention has the following effects by taking the above-described means.

  According to a first aspect of the present invention, there is provided a selection means for selecting a target communication message from a communication message list in which communication messages including search data are arranged in order of interception date and time, and the header information of the selected target communication message. Header information reading means for reading the unique information and the unique information of the reference message referred to by the target message, and reading the reference message from the message recording means based on the unique information of the reference message. Means for displaying in the newest order, and means for reading out the referenced communication text referring to the target communication text from the communication text recording means based on the specific information of the target communication text, and displaying in order from the oldest intercepted date and time With this configuration, there is no need to set the source and destination conditions again after entering the search data when checking the communication content, and it is possible to easily check the content of communication text flowing through the network. It is possible to provide a recording apparatus.

  In the second invention, in addition to the operation corresponding to the first invention, the communication text recording means records an electronic mail as a communication text, and the header information reading means is a message ID (Message-) which is unique information of the electronic mail. ID) is read, so the contents of e-mails flowing through the network can be easily confirmed.

  In the third invention, in addition to the operation corresponding to the first invention or the second invention, the communication text recording means records the Web access information as a communication text, and the header information reading means is the unique information of the Web access information. Because the URL information is read, the contents of the Web access information flowing through the network can be easily confirmed.

  In the fourth invention, in addition to the operation corresponding to the first invention or the second invention, the communication sentence recording means records the Web access information as a communication sentence, and the header information reading unit is the unique information of the Web access information. Since the client IP address is read, the contents of the Web access information from the same client can be easily confirmed.

  According to a fifth invention, in addition to the operations corresponding to the first to fourth inventions, means for determining whether or not the communication text is an encrypted communication text from the header information of the communication text is further provided. Since it is provided, it is possible to easily confirm in which exchange the ciphertext is communicated.

  In the sixth invention, in addition to the operation corresponding to the first invention or the second invention, URL information determining means for determining whether or not URL information is described in the e-mail body, URL information is described If the URL information is described in the body of the email, the Web access information corresponding to the URL information is further read out from the message recording means and displayed. Web sites corresponding to URL information can be easily investigated.

  The seventh invention is a mail address for judging whether or not the mail address information of the email is described in the Web access information in addition to the operation corresponding to the first invention, the third invention or the fourth invention. An information determination unit; and a unit that reads out and displays an e-mail addressed to the mail address information from the message recording unit when the mail address information determination unit determines that the mail address information is described. Therefore, if mail address information is described in the Web access information, the contents of the e-mail text corresponding to the mail address information can be easily investigated.

  In the eighth invention, in addition to the operations of the first to seventh inventions, the reading of the reference message and the reading of the referenced message are executed by designating an icon displayed on the operation screen. Therefore, it is possible to easily execute the work for checking the content of the communication text.

  In the ninth aspect of the invention, in addition to the operations of the first to eighth aspects of the invention, when the reference communication sentence is the oldest reference communication sentence, a means for displaying the fact is further provided. It is possible to make the communication monitor recognize that the communication message being made is the first message made in a series of communication without switching the screen.

  In the tenth aspect of the present invention, in addition to the operations of the first to ninth aspects, when the intercepted date and time of the referenced message is the latest referenced message, the tenth invention further includes means for displaying that fact. The communication monitor can recognize that the displayed communication message is the last message in a series of communication without switching the screen.

  ADVANTAGE OF THE INVENTION According to this invention, the communication monitoring recording device which can confirm the content of the communication sentence which flows through a network easily can be provided.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

<First Embodiment>
(1-1. Configuration)
FIG. 1 is a schematic diagram showing a configuration of a communication monitoring and recording apparatus 10 according to the first embodiment of the present invention.

  The communication monitoring and recording apparatus 10 includes a network interface unit 11, a packet data capture unit 12, a communication sentence reconstruction unit 13, a communication sentence recording unit 14, a data input unit 15, a list creation unit 16, a communication sentence display unit 17, and a display switching unit. 20.

  Note that the communication monitoring and recording apparatus 10 can be realized with a hardware configuration, or can be realized as a combination of a hardware configuration and a software configuration. In the latter case, each function as the communication monitoring and recording apparatus 10 is realized by installing a program obtained from a computer-readable storage medium or a network in advance in the software configuration.

  The network interface unit 11 is connected to the network segment 5 to be monitored and has a function of intercepting packets flowing on the network segment 5.

  The packet data capture unit 12 captures packet data intercepted by the network interface unit 11. Further, the packet data capture unit 12 sends the captured packet data to the communication text reconstruction unit 13.

  The communication text reconstruction unit 13 reconstructs the communication text from one or more packets intercepted by the packet data capture unit 13. In addition, the communication text reconstruction unit 13 sends the reconstructed communication text to the communication text recording unit 14.

  The communication text recording unit 14 is a memory that records a communication text intercepted from the network in association with “interception date and time”.

  Specifically, as shown in FIG. 2, when the communication sentence is an electronic mail, the communication sentence recording unit 14 receives the mail ID, the intercept date / time, the transmission source mail address, the transmission destination mail address, and the mail subject (Subject).・ Header information (Message-ID, In-Reply-To, References) ・ Mail text ・ Attached files are recorded in association. By recording these pieces of information, it is possible to conduct a follow-up survey of information leakage.

  Supplementally, when the communication text is an electronic mail, the header information of the electronic mail is shown as in FIG. 3A, and “Message ID” is used as the unique information of the communication text. When a reply is made to a certain electronic mail, as shown in FIGS. 3B and 3C, the header information of the reply mail includes a “References” field F1 and an “In-Reply-To” field F2. Is added, and the Message-ID of the sender mail is described in these fields F1 and F2. Therefore, by recording the header information of these e-mails, it is possible to investigate the mails. Note that the specification of the header information of the e-mail described above is based on RFC2822.

  In addition, when the communication text is Web access information, the communication text recording unit 14 includes an access ID, intercepted date / time, client IP address, server IP address, server port number, requested URL information, method, Referer information, reply data, and the like. Record the association.

  That is, when the communication text is Web access information, the Web access information is shown as shown in FIG. 4A, and “URL information” or “client IP address” and “interception date” are specific information of the communication text. Used as When a link is made from a certain website and connected to another website, a “Referer” field is added to the HTTP header information, and the URL information of the link source website is described. For example, the Web site (http://www.aaaaa.com/) specified by the HTTP header information in FIG. 4A is linked to the Web site specified by the HTTP header information in FIG. When accessing http: //www.aaaaa.coml/update/20061031/008.html), the Referer field F3 of the HTTP header information in FIG. 4B is added to the HTTP header information in FIG. URL information (http://www.aaaaa.com/) of the specified Web site is written. In general, when a plurality of Web pages are accessed continuously, the client IP address of each Web access is the same. Therefore, by recording these HTTP header information as Web access information, it is possible to follow up the Web access information. Note that the specifications of these Web access information are based on RFC2616.

  The data input unit 15 is used to input various data to the communication monitoring / recording apparatus 10, and data is input by a mouse, a keyboard, or the like.

  Specifically, the data input unit 15 has a function that allows “search data” to be input. For example, as shown in FIG. 5, a keyword to be investigated can be input as search data on the keyword input screen displayed on the communication text display unit 17. The input search data is sent to the list creation unit 16.

  Further, the data input unit 15 has a function of selecting a “target communication text” to be monitored from a communication text list created by the list creation unit 16 described later. That is, when search data is input, a communication sentence list including communication sentences matching the conditions is created by the list creation unit 16 and displayed on the communication sentence display unit 17. At this time, for example, as shown in FIG. 6, the communication text can be selected by clicking one communication text from the communication text list via the data input unit 15. Information on the selected target communication message is sent to the display switching unit 20. Note that the method of selecting a target communication message from the communication message list is not limited to a method of clicking with a pointing device such as a mouse, but may be a method of specifying a number associated with a communication message on the communication message list. May be.

  Furthermore, the data input unit 15 has a function that enables selection of communication text switching information. Here, “communication text switching information” is information for switching the communication text displayed on the communication text display unit 17 to another communication text, and “immediate communication text switching information” and “immediate communication text switching information”. "And two types of information. For example, in FIG. 7, when a left arrow icon (hereinafter also referred to as “previous icon”) Y <b> 1 written as “Previous” is clicked, the immediately previous message switching information is sent to the display switching unit 20. Further, in FIG. 7, when a right arrow icon (hereinafter also referred to as “back icon”) Y <b> 2 written as “back” is clicked, immediately after message switching information is sent to the display switching unit 20. Note that the selection of the message switching information can be performed by any selection means, and is not limited to the icons Y1 and Y2.

  Upon receiving the search data from the data input unit 15, the list creation unit 16 reads the communication text including the search data from the communication text recorded in the communication text recording unit 14 and arranges the read communication texts in the order of the intercept date and time. A "communication message list" is created. The communication text list is displayed in a list form as shown in FIG. 6, for example. In this example, four items from mail (communication message M1) addressed to Paul from Joseph to mail (communication message M4) addressed to Mark from John are displayed as a list. Note that the retrieval of the communication text including the retrieval data can be executed by a method using a general full text retrieval algorithm or the like. The list creation unit 16 sends the created communication text list to the communication text display unit 17.

  The communication text display unit 17 is a display or the like for displaying the communication text recorded in the communication text recording unit 14. For example, when a communication text list is received from the communication text list creation unit 16, the communication text list is displayed (see FIG. 6). In addition, when one communication sentence is selected as a target communication sentence from the communication sentence list by the data input unit 15, the content of the text of the target communication sentence is displayed (see FIG. 7).

  The display switching unit 20 includes a header information reading unit 21, an immediately preceding communication text switching unit 22, and an immediately following communication text switching unit 23, and has a function of switching the display screen of the communication text display unit 17. As will be described later, the display switching unit 20 performs communication according to the immediately preceding message switching information or the immediately following message switching information transmitted when the previous icon Y1 or the subsequent icon Y2 is selected via the data input unit 15. The display of the sentence display unit 17 is switched.

  The header information reading unit 21 reads, from the header information of the target communication text selected by the data input unit 15, the specific information of the target communication text and the specific information of the “reference communication text” referred to by the target communication text. Is.

  Here, when the communication text is an electronic mail, “Message-ID” is used as unique information of the communication text. Therefore, the Message-ID described in the “References” field F1 or “In-Reply-To” field F2 of the target communication message is read as unique information of the reference communication message. On the other hand, when the communication text is Web access information, “URL information” or “client IP address” and “interception date and time” are read as unique information of the communication text.

  Further, the header information reading unit 21 receives the message switching information from the data input unit 15. At this time, if the message switching information is “immediate message switching information”, the message-ID and URL information, which is the unique information of the reference message read from the header information, or the client IP address and intercepted date and time It is sent to the message switching unit 22. On the other hand, when the message switching information is “immediate message switching information”, the message-ID and URL information, which is the unique information of the message read from the header information, or the client IP address and the intercepted date and time are displayed. It is sent to the switching unit 23.

  The immediately preceding message switching unit 22 receives the unique information of the reference message from the header information reading unit 21, and reads the reference message from the message recording unit 14 based on the unique information of the reference message. It has a function of displaying the read reference communication text on the communication text display unit 17 in the order of the latest intercept date and time. For example, in FIG. 7, when the previous icon Y1 is clicked and the immediately preceding message switching information is selected, the immediately preceding message switching unit 22 displays the References field of the email M1 displayed in the message display unit 17 and the In- Read the Message-ID described in the Reply-To field. Subsequently, the electronic mail corresponding to the read Message-ID is searched from the electronic mail recorded in the communication text recording unit 14. Then, of the retrieved e-mails, an e-mail with an intercept date and time closest to the e-mail and date of the e-mail M1 displayed on the communication message display unit 17 is displayed on the communication message display unit 17.

  In the case of Web access information, the URL information described in the Referer field of Web access W1 displayed on the message display unit 17 is read. Subsequently, the Web access corresponding to the read URL information is searched from the Web access recorded in the communication message recording unit 14. Then, of the searched web accesses, the web access having the intercept date and time closest to the intercept date and time of the web access W1 displayed on the message display portion 17 is displayed on the message display portion 17.

  In the case of Web access information, the client IP address and intercept date and time of Web access W1 displayed on the communication message display unit 17 are read. Subsequently, the Web access corresponding to the read client IP address is searched from the Web access recorded in the communication message recording unit 14. Then, of the retrieved web accesses, the web access of the intercepted date and time closest to the intercepted date and time of the web access W1 before the intercepted date and time of the web access W1 displayed on the communicated text display unit 17 is displayed on the communicated text display unit 17. It is good.

  Immediately after the communication message switching unit 23 receives the unique information of the target communication message from the header information reading unit 21, based on the unique information of the target communication message, the communication message recording that refers to the target communication message is recorded. It has a function to read from the unit 14 and a function to display the read referenced communication text on the communication text display unit 17 in the order of the intercepted date and time. Thereby, the communication text of the intercept date and time closest to the intercept date and time of the communication text displayed on the communication text display unit 17 is displayed. The “referenced communication text” is a communication text in which the Message-ID of the target communication text is described in the References field or In-Reply-To field when the communication text is an e-mail. If the message is Web access, the message containing the URL information of the target message in the Referer field or the client IP address is the same as the client IP address of the target message and the intercept date and time is intercepted. It is a message after the date and time.

(1-2. Operation)
Next, the operation of the communication monitoring / recording apparatus 10 according to the first embodiment of the present invention will be described.

(Interception of correspondence)
First, an operation in which the communication monitoring and recording apparatus 10 intercepts a communication sentence will be described with reference to FIG.

  First, when the communication monitoring and recording apparatus 10 is connected to the network segment 5, it starts to intercept packets flowing on the network segment 5 (steps S1 and S2). For example, when a certain user transmits an e-mail on the network segment 5, a plurality of packets constituting the e-mail are intercepted via the network interface unit 11.

  Subsequently, the communication text is reconstructed from the packet intercepted by the network interface unit 11 (step S3). For example, a packet intercepted by the network interface unit 11 is taken into the communication monitoring and recording device 10 by the packet data capture unit 12, and an email transmitted by a certain user is reconstructed by the communication text reconstruction unit 13.

  When the communication text is reconstructed by the communication text reconstruction unit 13, the reconstructed communication text is recorded in the communication text recording unit 14 (step S4). When the communication text is recorded in the communication text recording unit 14, index data that helps the list creation unit 16 and the display switching unit 20 to search for the communication text is recorded in association with each other. Information such as the network address of the transmission source and the transmission destination is also recorded in association with each other.

  In this way, the communication text is recorded in the communication text recording unit 14 until the communication monitoring and recording apparatus 10 releases the connection with the network segment 5 (step S5).

(Investigation of correspondence)
Next, a procedure for investigating a communication sentence by the communication monitoring and recording apparatus 10 will be described with reference to FIG.

  First, a keyword as search data is input through the data input unit 15 by an operation of a communication monitor (step T1). For example, a keyword is input on a keyword input screen as shown in FIG. As a result, the keyword is sent from the data input unit 15 to the list creation unit 16 as search data.

  Subsequently, in the list creation unit 16, a communication sentence including the keyword input by the data input unit 15 is read from the communication sentence recording unit 14, and a communication sentence list that is a list of the read communication sentences is created. Is displayed on the communication text display unit 17 (step T2). Here, a list of e-mails as shown in FIG. 6 is displayed as a communication text list.

  Then, when one communication sentence is selected as a target communication sentence from the communication sentence list via the data input unit 15, the content of the selected target communication sentence is displayed on the communication sentence display unit 17 (step T3, T3). T4). For example, in FIG. 6, when the email M1 is selected on the screen of the communication text display unit 17, the content of the selected text of the email M1 is displayed on the communication text display unit 17, as shown in FIG. . A front icon Y1 and a back icon Y2 are displayed on the screen together with the contents of the e-mail M1.

  When the “previous icon Y1” is selected via the data input unit 15 on the screen of the communication message display unit 17 as described above, the immediately previous communication message switching information is sent to the header information reading unit 21.

  When the header information reading unit 21 receives the immediately preceding message switching information, the unique information of the reference message is read from the message recording unit 14 based on the header information of the target message displayed on the message display unit 17. (Steps T5 and T6). For example, when the target communication message is an e-mail, Message-ID that is unique information of the reference communication message is read from the In-Reply-To field or the References field in the header information of the e-mail M1.

  Subsequently, the reference message is read from the message recording unit 14 based on the unique information of the reference message (step T7).

  Then, among the read reference communication texts read out by the previous communication text switching unit 22, the reference communication text with the latest intercept date and time recorded in the communication text recording unit 14 is displayed in the communication text display unit 17 as the “preceding communication text”. It is displayed (step T8).

  On the other hand, when “after icon Y2” is selected via the data input unit 15 in step T5, the header information reading unit 21 uses the header information of the target communication message displayed on the communication message display unit 17 to The unique information of the target message is read (steps T5 and T9). For example, when the communication text is an email, the Message-ID included in the header information is read as unique information of the email M1.

  Subsequently, the referenced message is read from the message recording unit 14 based on the unique information of the target message (step T10). For example, in the case of an electronic mail, an electronic mail in which the Message-ID of the electronic mail M1 is described in the In-Reply-To field or the References field is read from the communication text recording unit 14.

  Then, among the read-referenced communication texts read out by the immediately-communication message switching unit 23, the oldest referenced communication message recorded in the communication message recording unit 14 is the communication message display unit as “immediately-communication message”. 17 (step T11).

(1-3. Effect)
As described above, the communication monitoring and recording apparatus 10 according to the present embodiment selects data for selecting any communication sentence as a target communication sentence from a communication sentence list in which communication sentences including search data are arranged in order of interception date and time. From the input unit 15 and the header information of the target message, the header information reading unit 21 that reads the unique information of the target message and the unique information of the reference message referred to by the target message, the reference message Based on the unique information, the reference message is read from the message recording unit 14, and the immediately preceding message switching unit 22 for displaying the latest intercepted date and time, and the target message based on the unique information of the target message When the communication content is confirmed by the configuration including the immediately-communication unit 23 for reading the referred communication message referring to the communication message from the communication message recording unit 14 and displaying the oldest intercepted date and time, the search data It is not necessary to newly set the source or destination of the conditions or the like after the input, the contents of the communication text flowing network readily ascertainable.

  In the communication monitoring and recording apparatus 10, the communication text recording unit 14 records an electronic mail as a communication text, and the header information reading unit 21 reads a message ID (Message-ID) that is unique information of the electronic mail. The contents of e-mail flowing through the network can be easily confirmed.

  Further, in the communication monitoring and recording apparatus 10, the communication text recording unit 14 records Web access information as a communication text, and the header information reading unit 21 reads URL information that is unique information of the Web access information, and thus flows through the network. The contents of Web access information can be easily confirmed.

  In the communication monitoring and recording apparatus 10, the reading of the reference message and the reading of the referenced message are executed by clicking the icons Y1 and Y2 displayed on the operation screen. Can be easily performed.

  In the present embodiment, when the previous icon Y1 or the subsequent icon Y2 is selected by the data input unit 15, the immediately preceding communication sentence or the immediately following communication sentence is retrieved from the communication sentence recording unit 14, but these immediately preceding communications The sentence or the immediately following communication sentence may be recorded in association with each communication sentence in advance. In this case, the message recording unit 14 records the ID of the immediately preceding message and the ID of the immediately following message for each message. Specifically, as shown in FIG. 10, in the case of an electronic mail, the immediately preceding mail ID and the immediately following mail ID are recorded in association with individual mail IDs. In the case of Web access information, the immediately preceding access ID and the immediately following access ID are recorded in association with each access ID. Further, as shown in the concept in FIG. 11, it is conceivable to record the reference / referenced relationship as a tree structure of a communication text ID. As a result, it is possible to improve the response speed when the communication monitor attempts to view the communication text made immediately before or the communication text made immediately after.

  In the present embodiment, when the communication text is an email, Message-ID is used as unique information of the communication text, but sender information can also be used. That is, when the immediately preceding message switching information is selected, an email corresponding to the sender's email address is displayed. When immediately after the message switching information is selected, an email corresponding to the destination email address is displayed. Also good.

  Further, the communication message display unit 17 according to the present embodiment displays the previous icon Y1 and the rear icon Y2 together with the content of the communication message, but displays an icon when there is no reference message or referenced message. You may make it not. For example, when there is no immediately preceding communication sentence, the previous icon Y1 is not displayed as shown in FIG. 12, or the previous icon Y1 is displayed as a broken line instead of a solid line as shown in FIG. Thereby, the communication monitor can switch the screen to indicate that the communication message displayed on the communication message display unit 17 is the first message in the series or the last message. Can be recognized. As a result, it is possible to quickly perform operations such as finding information leakage and confirming details of leaked information.

<Second Embodiment>
FIG. 14 is a schematic diagram showing a configuration of a communication monitoring and recording apparatus 10T according to the second embodiment of the present invention. In addition, the same code | symbol is attached | subjected to the part same as the already demonstrated part, and the overlapping description is abbreviate | omitted unless there is particular description. In addition, the following description is also omitted in the following embodiments.

  That is, in the communication monitoring and recording apparatus 10T according to the present embodiment, the display switching unit 20 further includes a ciphertext determination unit 24.

  The ciphertext determination unit 24 determines whether or not the communication text is an encrypted communication text from the header information of the communication text.

  For example, in the case of an electronic mail, it is determined whether or not the mail body is an encrypted “encrypted mail” based on information described in the “Content-Type” field of the mail header. Specifically, in the case of a processing system called PGP (Pretty Good Privacy), as shown in FIG. 15, the character string “multipart / encrypted” is described in the “Content-Type” field R1 of the mail header H1. Therefore, by checking the presence / absence of this character string, it is determined whether or not it is an encrypted mail. In the case of a processing system called SMIME (Secure / Multipurpose Internet Mail Extensions), as shown in FIG. 16, the character string “application / x-pkcs7-mime” is stored in the “Content-Type” field R2 of the mail header H2. Described. Therefore, by checking the presence / absence of this character string, it is determined whether or not it is an encrypted mail. Note that the ciphertext determination unit 24 can determine whether or not the ciphertext is based on the information in the “Content-Type” field even in other implementations.

  Further, when the selected communication text is a cipher text, the cipher text determination unit 24 sends a message to that effect to the communication text display unit 17. In response to this, the message display unit 17 displays that the message is an encrypted message such as “This is an encrypted mail” instead of the selected message as shown in FIG. .

  As described above, the communication monitoring / recording device 10T according to the present embodiment includes the ciphertext determination unit 24. Therefore, when the selected target communication message is a ciphertext, “the fact that it is a ciphertext”. "Can be displayed. As a result, it is possible to easily confirm in what kind of exchange the ciphertext was communicated, and promptly perform work to find information leakage or confirm details of leaked information Can be done.

  The ciphertext determination unit 24 according to the present embodiment has been described by taking e-mail as an example, but is not limited thereto. For example, the ciphertext determination unit 24 determines whether the communication is encrypted communication such as SSL (Secure Sockets Layer) based on the server port number information of the Web access information or the method information of the Web access information. Is also possible. That is, if the server port number is 443, it can be determined that the encryption communication is based on SSL, and if the method information is the CONNECT method, it can be determined that the communication is SSL encryption communication. If it is determined that SSL communication is being performed, a message to that effect is sent to the message display unit 17. In response to this, the message display unit 17 displays “This is SSL communication.” As shown in FIG.

<Third Embodiment>
FIG. 19 is a schematic diagram showing a configuration of a communication monitoring and recording apparatus 10U according to the third embodiment of the present invention.

  In the communication monitoring and recording apparatus 10U according to the present embodiment, the display switching unit 20 further includes a URL information determination unit 25.

  The URL information determination unit 25 determines whether URL information is described in the e-mail body. Specifically, as shown in FIG. 20, when the target communication sentence is an e-mail and the previous icon Y1 or the subsequent icon Y2 is selected by the data input unit 15, the URL information determination unit 25 displays “http A character string such as “: //” is searched to determine whether URL information is described in the body of the e-mail (steps U1 and U2). If it is determined that URL information is described in the e-mail body, the URL information is sent to the communication text display unit 17. In response to this, the message display unit 17 displays an arrow icon (hereinafter also referred to as “Web icon”) Y3 written as “After (Web)” as shown in FIG. 21 (step U2-). Yes, U3).

  When the web icon Y3 is selected on the screen of the communication text display unit 17, the URL information determination unit 25 sends Web access information corresponding to the URL information described in the e-mail body from the communication text recording unit 14. It is read and displayed on the message display unit 17.

  As described above, the communication monitoring and recording apparatus 10U according to the present embodiment includes the URL information determination unit 25. Therefore, when the URL information is described in the e-mail body, the communication monitor can display the Web icon. By clicking Y3, you can easily check the website corresponding to the URL information.

  As a result, it is possible to easily confirm in which exchange the selected e-mail was communicated, and work for discovering information leakage and confirming details of leaked information It can be done quickly.

<Fourth Embodiment>
FIG. 22 is a schematic diagram showing a configuration of a communication monitoring and recording apparatus 10V according to the fourth embodiment of the present invention.

  In the communication monitoring and recording apparatus 10V according to the present embodiment, the display switching unit 20 further includes a mail address information determination unit 26.

  The e-mail address information determination unit 26 determines whether e-mail address information is described in the Web access information. Specifically, as shown in FIG. 23, when the target message is Web access information, when the previous icon Y1 or the subsequent icon Y2 is selected by the data input unit 15, the mail address information determination unit A character string such as “@ ---. jp” is searched to determine whether or not e-mail address information is described in the Web access information (steps V1 and V2). When it is determined that the mail address information is described in the Web access information, the mail address information is sent to the communication text display unit 17. In response to this, as shown in FIG. 24, the message display unit 17 displays an arrow icon (hereinafter also referred to as “mail icon”) Y4 written as “mail” (step V2-). Yes, V3).

  When the mail icon Y4 is selected on the screen of the communication message display unit 17, the mail address information determination unit 26 records an e-mail with the mail address information described in the Web access information as the transmission destination. Search from part 14. When an electronic mail is searched, the electronic mail is displayed on the communication text display unit 17.

  As described above, the communication monitoring and recording apparatus 10V according to the present embodiment includes the mail address information determination unit 26. Therefore, when the communication monitor describes the mail address information in the Web access information, By clicking the mail icon Y4, the contents of the e-mail text corresponding to the mail address information can be easily investigated.

  As a result, it is possible to easily confirm in which exchange the selected Web access information was communicated, and work for finding information leaks and confirming details of leaked information Can be performed promptly.

<Others>
Note that the method described in the above embodiment is a program that can be executed by a computer, such as a magnetic disk (floppy (registered trademark) disk, hard disk, etc.), an optical disk (CD-ROM, DVD, etc.), a magneto-optical disk (MO). ), And can be distributed in a storage medium such as a semiconductor memory.

  In addition, as long as the storage medium can store a program and can be read by a computer, the storage format may be any form.

  In addition, an OS (operating system) operating on the computer based on an instruction of a program installed in the computer from the storage medium, MW (middleware) such as database management software, network software, and the like implement the above-described embodiment. A part of each process may be executed.

  Furthermore, the storage medium in the present invention is not limited to a medium independent of a computer, but also includes a storage medium that downloads and stores or temporarily stores a program transmitted via a LAN, the Internet, or the like.

  Further, the number of storage media is not limited to one, and the case where the processing in the above embodiment is executed from a plurality of media is also included in the storage media in the present invention, and the media configuration may be any configuration.

  The computer according to the present invention executes each process in the above-described embodiment based on a program stored in a storage medium, and is a single device such as a personal computer or a system in which a plurality of devices are connected to a network. Any configuration may be used.

  In addition, the computer in the present invention is not limited to a personal computer, but includes an arithmetic processing device, a microcomputer, and the like included in an information processing device, and is a generic term for devices and devices that can realize the functions of the present invention by a program. .

It is a schematic diagram which shows the structure of the communication monitoring recording apparatus which concerns on the 1st Embodiment of this invention. It is a schematic diagram which shows the concept of the communication recording part which concerns on the same embodiment. It is a figure which shows the concept of the header information of an email. It is a figure which shows the concept of HTTP header information. It is a schematic diagram which shows the concept of the search data input screen which concerns on the same embodiment. It is a schematic diagram which shows the concept with the communication sentence list | wrist which concerns on the same embodiment. It is a figure which shows the concept of the display screen of the target communication text which concerns on the same embodiment. It is a flowchart for demonstrating the operation | movement which intercepts the communication text by the communication monitoring recording device which concerns on the embodiment. It is a flowchart for demonstrating the investigation procedure of the communication text by the communication monitoring recording apparatus which concerns on the embodiment. It is a schematic diagram which shows the modification of the communication recording part which concerns on the same embodiment. It is a schematic diagram which shows the concept of the modification of the communication recording part which concerns on the same embodiment. It is a figure which shows the example of a display screen of the communication text display part which concerns on the same embodiment. It is a figure which shows the example of a display screen of the communication text display part which concerns on the same embodiment. It is a schematic diagram which shows the structure of the communication monitoring recording apparatus which concerns on the 2nd Embodiment of this invention. It is a figure which shows the concept of the mail header information in PGP. It is a figure which shows the concept of the mail header information in SMIME. It is a figure which shows the example of the display screen of the communication text display part which concerns on the same embodiment. It is a figure which shows the example of the display screen of the communication text display part which concerns on the same embodiment. It is a schematic diagram which shows the structure of the communication monitoring recording device which concerns on the 3rd Embodiment of this invention. It is a flowchart for demonstrating operation | movement of the URL information determination part which concerns on the same embodiment. It is a figure which shows the example of the display screen of the communication text display part which concerns on the same embodiment. It is a schematic diagram which shows the structure of the communication monitoring recording device which concerns on the 4th Embodiment of this invention. It is a flowchart for demonstrating operation | movement of the mail address information determination part which concerns on the embodiment. It is a figure which shows the example of the display screen of the communication text display part which concerns on the same embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Communication monitoring recording device, 11 ... Network interface part, 12 ... Packet data capture part, 13 ... Communication text reconstruction part, 14 ... Communication text recording part, 15 ... Data Input unit, 16 ... list creation unit, 17 ... communication message display unit, 20 ... display switching unit, 21 ... header information reading unit, 22 ... previous message switching unit, 23 ... -Immediately after message switching unit, 24 ... ciphertext determination unit, 25 ... URL information determination unit, Y1 ... front icon, Y2 ... back icon, Y3 ... Web icon, Y4 ... mail icon.

Claims (5)

A message recording means for recording a message intercepted from the network in association with the intercept date and time,
Input means for entering search data;
A communication message display unit for reading a communication message including the search data from the communication message recorded in the communication message recording unit, and displaying a communication message list in which the read communication messages are arranged in the order of intercept date;
Selection means for selecting a target communication sentence from the communication sentence list;
Means for displaying a target message selected by the selection means;
Header information reading means for reading, from the header information of the target communication text selected by the selection means, the specific information of the target communication text and the specific information of the reference communication text referred to by the target communication text;
A reference message reading unit that reads the reference message from the message recording unit based on the unique information of the reference message read by the header information reading unit;
Means for displaying the reference message read by the reference message reading means with the latest intercept date and time;
Based on the specific information of the target communication text read by the header information reading means, the referenced communication text reading means for reading the referenced communication text referring to the target communication text from the communication text recording means;
Wherein the referenced communication text reading referenced communication text read by means, interception date a communication monitoring recording and means for displaying the oldest,
URL information determination means for determining whether or not URL information is described in the e-mail text when an e-mail message is selected by the selection means;
Means for reading out and displaying the web access information corresponding to the URL information from the message recording means when it is determined that the URL information is described by the URL information determining means;
A communication monitoring and recording apparatus comprising: A message recording means for recording a message intercepted from the network in association with the intercept date and time,
Input means for entering search data;
A communication message display unit for reading a communication message including the search data from the communication message recorded in the communication message recording unit, and displaying a communication message list in which the read communication messages are arranged in the order of intercept date;
Selection means for selecting a target communication sentence from the communication sentence list;
Means for displaying a target message selected by the selection means;
Header information reading means for reading, from the header information of the target communication text selected by the selection means, the specific information of the target communication text and the specific information of the reference communication text referred to by the target communication text;
A reference message reading unit that reads the reference message from the message recording unit based on the unique information of the reference message read by the header information reading unit;
Means for displaying the reference message read by the reference message reading means with the latest intercept date and time;
Based on the specific information of the target communication text read by the header information reading means, the referenced communication text reading means for reading the referenced communication text referring to the target communication text from the communication text recording means;
Wherein the referenced communication text reading referenced communication text read by means, interception date a communication monitoring recording and means for displaying the oldest,
When the communication text of the Web access information is selected by the selection means, a mail address information determination means for determining whether or not email address information of an email is described in the Web access information;
Means for reading and displaying an e-mail addressed to the e-mail address information from the message recording means when the e-mail address information determining means determines that e-mail address information is described;
A communication record monitoring apparatus comprising: In the communication monitoring and recording apparatus according to claim 1 or 2,
The communication monitoring and recording apparatus, wherein the reference message reading unit and the referenced message reading unit are executed by designating an icon displayed on an operation screen. In the communication monitoring and recording apparatus according to any one of claims 1 to 3,
A communication record monitoring apparatus, further comprising means for displaying, when the reference communication text read by the reference communication text reading means is the oldest reference communication text. In the communication monitoring and recording apparatus corresponding to any one of claims 1 to 4,
A communication record monitoring apparatus, further comprising means for displaying, when the referenced communication text read by the referenced communication text reading means is the latest referenced communication text.

Images