JP4802114B2 - Information processing system - Google Patents

Description

  The present invention relates to a technique for acquiring an operation history of a computer.

  When investigating the presence or absence of unauthorized intrusion into a computer system or unauthorized access to data, or investigating the cause of a failure, it is useful to analyze information related to the operation history of the computer. For this reason, conventionally, operation histories have been acquired, stored, and used for analysis in various system configurations.

  As this type of prior art, Patent Document 1 describes a configuration in which operation history information is generated in response to an open operation and a close operation on a file stored in an auxiliary storage device and stored in a nonvolatile memory.

  Patent Document 2 describes a configuration in which data corresponding to an operation performed by a user using an input device such as a keyboard is acquired by referring to a key buffer or an API and stored in a nonvolatile storage device. ing.

  Patent Document 3 describes a configuration in which a non-volatile memory is mounted on a network interface and has a function of storing a history of operations performed on a control target system performed via a network.

  In Patent Document 4, when operation information and processing information generated in a computer are extracted as events and registered in a database, the event is analyzed at the same time, and when the event is determined to be a specific event that is illegally connected, A configuration is described in which an event related to the event is searched from a database and fraud determination is performed.

Japanese Patent Laid-Open No. 9-319637 JP 2006-172073 A JP 2005-108176 A JP 2005-222216 A

  As described above, in order to investigate the cause of an unauthorized operation or failure of a computer, it is useful to analyze information related to the operation history of the computer. However, the existing system for storing the operation history of the computer extracts and stores this as an event when a specific operation is performed on the computer. The same applies to any of the systems described in Patent Document 1 to Patent Document 4. In such a system, it is only possible to take a history of operations preset as events. The stored history information itself may be tampered with.

Information relating to access to files stored on a magnetic disk or the like and information stored in a physical memory are very important as materials for knowing the operation history of the computer. Such information is difficult to falsify and has high reliability as information. However, the storage time of these pieces of information on the magnetic disk or the physical memory itself is relatively short.
For example, when a computer accesses a file, information on the last update date and time and the last access date and time of the file is recorded according to the content of the operation. Will be rewritten. Therefore, there is only information about the last performed operation, and information about the previous operation is lost. Further, since information stored in the physical memory is volatile information, it is lost when the computer is stopped or restarted.
For this reason, even if an attempt is made to acquire information after a problem has occurred, it is often impossible to acquire information so far and necessary information cannot be obtained.

  The present invention has been made in view of the above problems, and its purpose is to save information related to file access and information in physical memory, and to provide a reliable and highly usable history regarding computer operations. It is to be used for acquisition.

  In order to achieve this object, the present invention is realized as the following information processing system. This system includes a magnetic disk information acquisition unit that acquires a disk image, which is a storage image of the magnetic disk device of the investigation target device, from the magnetic disk device periodically or at a predetermined timing, and the magnetic disk information acquisition unit acquires the disk image. First information extracting means for extracting time information indicating the time when an operation on a file stored in the magnetic disk device is performed from the recorded disk image, and a memory image which is a storage image of the memory of the investigation target device is periodically Or the memory information acquisition means for acquiring from the memory at a predetermined timing, and the information on the type of the program started in the investigation target apparatus and the start time of the program from the memory image acquired by the memory information acquisition means Second information extraction means and first information extraction means; And a storage means for storing the start time information storage means in association with the time the extracted information and programs extracted by the second information extraction means by means.

More preferably, the storage means stores the information extracted by the first information extraction means and the second information extraction means in time series in the storage means.
The first information extraction means extracts at least file creation time and last update time information as time information from the disk image.

  Another information processing system according to the present invention reads time information indicating a time when an operation is performed on a file stored in the magnetic disk device of the investigation target device from the magnetic disk device periodically or at a predetermined timing. Time information acquisition means, a memory information acquisition means for acquiring a memory image, which is a storage image of the memory of the investigation target device, from the memory periodically or at a predetermined timing, and the memory information acquisition means Information extraction means for extracting information on the type and start time of the program started in the investigation target device from the obtained memory image, time information acquired by the time information acquisition means, and start time of the program extracted by the information extraction means Storage means for associating and storing information in the storage means.

More preferably, the storage means stores the information acquired by the time information acquisition means and the information extracted by the information extraction means in time series in the storage means.
Further, the time information extraction means reads at least information on the file creation time and the last update time from the magnetic disk device.

  Furthermore, another information processing system of the present invention includes a survey target device and an analysis server connected to the survey target device. Then, the investigation target device includes a magnetic disk information acquisition unit that acquires a disk image that is a storage image of the magnetic disk device from the magnetic disk device periodically or at a predetermined timing, and a memory image that is a storage image of the memory. Memory information acquisition unit that acquires from memory periodically or at a predetermined timing, transmission control that transmits the disk image acquired by the magnetic disk information acquisition unit and the memory image acquired by the memory information acquisition unit to the analysis server A part. On the other hand, the analysis server extracts time information indicating a time when an operation is performed on a file stored in the magnetic disk device from the disk image acquired by the magnetic disk information acquisition unit, and the memory acquired by the memory information acquisition unit An information extraction unit that extracts information on the type and start time of the program started in the investigation target device from the image, and an alignment unit that aligns the information extracted by the information extraction unit in time series and stores the information in the storage unit Prepare.

Furthermore, another information processing system of the present invention includes a survey target device and an analysis server connected to the survey target device. And a time information acquisition unit that reads out and acquires time information indicating a time when an operation is performed on a file stored in the magnetic disk device from the magnetic disk device periodically or at a predetermined timing; A memory information acquisition unit for acquiring a memory image, which is a storage image of the memory, from the memory periodically or at a predetermined timing, and the time information acquired by the time information acquisition unit and the memory acquired by the memory information acquisition unit A transmission control unit that transmits the image to the analysis server. On the other hand, the analysis server includes an information extraction unit that extracts information about the type and start time of the program started in the investigation target device from the memory image acquired by the memory information acquisition unit, and the time information acquired by the time information acquisition unit. And an alignment unit that aligns information extracted by the information extraction unit in time series and stores the information in the storage unit.
More preferably, in this system, the investigation target device can further include an external storage device that stores information acquired by the time information acquisition unit and the memory information acquisition unit. In this case, the analysis server reads and acquires information from the external storage device.

  According to the present invention configured as described above, it is possible to obtain a reliable and highly usable history regarding the operation of the computer by acquiring information from the memory and storing it in association with the information of the magnetic disk device. it can.

The best mode for carrying out the present invention (hereinafter referred to as an embodiment) will be described below in detail with reference to the accompanying drawings.
FIG. 1 is a diagram showing an overall configuration of an information processing system to which the present embodiment is applied.
As shown in FIG. 1, the present embodiment includes a survey target device 100 and an analysis server 200. The investigation target device 100 and the analysis server 200 are connected via a communication line, and data transmission from the investigation target device 100 to the analysis server 200 is possible.

  The connection method between the investigation target device 100 and the analysis server 200 is not limited to a specific specific connection method. For example, the survey target device 100 and the analysis server 200 may be directly connected via a communication cable, or may be connected via a LAN or other network. Any communication protocol such as TCP / IP may be used as necessary. In the example illustrated in FIG. 1, one survey target apparatus 100 is connected to one analysis server 200, but this is only a minimum configuration. Actually, a plurality of investigation target devices 100 may be connected to one analysis server 200.

FIG. 2 is a diagram illustrating a hardware configuration of a computer that implements the survey target device 100 and the analysis server 200.
A computer 10 shown in FIG. 2 includes a CPU 10a that is a calculation means, a main memory 10c that is a main storage device, and a display mechanism 10d that performs display output to a display device. Also, a network interface 10f for connecting to an external device via a network, a magnetic disk device 10g and a flexible disk drive 10j as auxiliary storage devices, a sound mechanism 10h for performing sound output, and a keyboard as an input device / Mouse 10i. Further, as shown in FIG. 2, the main memory 10c and the display mechanism 10d are connected to the CPU 10a via an M / B (motherboard) chip set 10b. The network interface 10f, the magnetic disk device 10g, the sound mechanism 10h, the keyboard / mouse 10i, and the flexible disk drive 10j are connected to the M / B chipset 10b via the bridge circuit 10e.

  In FIG. 2, each component is connected via a bus. For example, the CPU 10a and the M / B chip set 10b, and the M / B chip set 10b and the main memory 10c are connected via a CPU bus. Further, the M / B chipset 10b and the display mechanism 10d may be connected via an AGP (Accelerated Graphics Port). However, if the display mechanism 10d includes a PCI Express compatible video card, the M / B The chip set 10b and the video card are connected via a PCI Express (PCIe) bus. When connecting to the bridge circuit 10e, for example, PCI Express can be used for the network interface 10f. For the magnetic disk device 10g, for example, serial ATA (AT Attachment), parallel transfer ATA, PCI (Peripheral Components Interconnect), or the like can be used. Furthermore, for the keyboard / mouse 10i and the flexible disk drive 10j, a USB (Universal Serial Bus) or the like can be used.

  Note that FIG. 2 only illustrates a hardware configuration of a computer suitable for realizing the survey target device 100 and the analysis server 200, and it is needless to say that the configuration is not limited to the illustrated configuration. For example, as the auxiliary storage device, only the magnetic disk device 10g may be provided without the flexible disk drive 10j, or a drive using various optical disks as media may be provided. Further, the audio mechanism 10h may be provided as a function of the M / B chipset 10b without being an independent configuration.

FIG. 3 is a diagram illustrating the functional configuration of the survey target device 100 and the analysis server 200 in the present embodiment.
Referring to FIG. 3, the investigation target device 100 of this embodiment includes a magnetic disk information acquisition unit 110, a memory information acquisition unit 120, and a transmission control unit 130. These functions are realized, for example, by the program-controlled CPU 10a when the survey target apparatus 100 is configured by the computer shown in FIG. The program is stored in the magnetic disk device 10g, read into the main memory 10c at the time of execution, and read from the main memory 10c to the CPU 10a for execution. This program may be stored and distributed in various storage media such as removable magnetic disks and optical disks such as flexible disks and CD-ROMs, flash memory and other semiconductor memories, or distributed via a network. it can.

  The magnetic disk information acquisition unit 110 acquires a disk image (image file) that is a storage image of a recording medium (magnetic disk) of the magnetic disk device 10g. The disk image is acquired periodically or at a specific timing set in advance.

  The memory information acquisition unit 120 acquires a memory image (image file) that is a storage image of the main memory 10c. Acquisition of the memory image is performed periodically or at a specific timing set in advance.

  The transmission control unit 130 transmits the information acquired by the magnetic disk information acquisition unit 110 and the memory information acquisition unit 120 to the analysis server 200 via, for example, the network interface 10f of FIG. The transmission timing may be immediately transmitted when the magnetic disk information acquisition unit 110 or the memory information acquisition unit 120 acquires information. The information acquired by the magnetic disk information acquisition unit 110 and the memory information acquisition unit 120 is temporarily stored in the magnetic disk device 10g, and is set at a preset timing, such as periodically or at the time of system startup or termination. You may make it transmit with.

  Referring to FIG. 3, the analysis server 200 of this embodiment includes an information extraction unit 210, a data sort unit 220, a data storage unit 230, and a data analysis unit 240. Among these functions, the data storage unit 230 is realized by the magnetic disk device 10g when the analysis server 200 is configured by the computer 10 shown in FIG. 2, for example. On the other hand, the information extraction unit 210, the data sort unit 220, and the data analysis unit 240 are realized by a program-controlled CPU 10a. The program is stored in the magnetic disk device 10g, read into the main memory 10c at the time of execution, and read from the main memory 10c to the CPU 10a for execution. This program may be stored and distributed in various storage media such as removable magnetic disks and optical disks such as flexible disks and CD-ROMs, flash memory and other semiconductor memories, or distributed via a network. it can.

  The information extraction unit 210 analyzes the disk image of the magnetic disk device 10g and the memory image of the main memory 10c received from the investigation target device 100. Then, information relating to the operation history of the file stored in the magnetic disk device 10g (hereinafter referred to as magnetic disk information) is extracted from the disk image, and information relating to program activation (hereinafter referred to as memory information) is extracted from the memory image. Extract.

  The magnetic disk information extracted from the disk image of the magnetic disk device 10g is information regarding the operation history of the file, and includes the last update date, the last access date, and the creation date. These pieces of information are called MAC time etc. after the acronym of update (Modify), access (Access), and creation (Create), and many such as UNIX (registered trademark of The Open Group) and Windows of US Microsoft Corporation This information is recorded when a corresponding operation is performed on a file in the operating system. Note that the information to be extracted is not limited to these. As long as the information is recorded in response to an operation on the file, there are various information such as the date and time when the file was moved on the recording medium (magnetic disk) of the magnetic disk device 10g and the date and time when the latest update was performed. Time information can be extracted.

FIG. 4 is a diagram showing an example of magnetic disk information extracted from the disk image of the magnetic disk information 10g.
In the magnetic disk information shown in FIG. 4, information such as “date and time”, “file size”, “(MAC time) state”, “absolute path”, and the like is registered according to the operation on the file. For example, the registered content in the column 401 surrounded by a broken line is:

Date: Monday, June 6, 2005 10: 34: 9 File size: 192730 bytes Status: Update (m)
Absolute path: / Documents and Settings / Shin-yaIDE / Local Settings / Temporary Internet Files / Content. IE5 / W949UPID / 20050601173658 [1]. jpg

It is. In the “status”, “m” is described as shown in the figure for update according to the operation content, “a” is described for access, and “c” is created for file creation.

  The memory information extracted from the memory image of the main memory 10c is information related to program activation. For example, the type of the activated program and the activation command and the date and time information (the date and time when the program was activated and the activation command are Issue date and time).

FIG. 5 is a diagram illustrating an example of memory information extracted from the memory image of the main memory 10c.
The memory information shown in FIG. 5 includes “line number”, “display indicating whether a process and a thread are separated”, “process number”, and “memory usage” for each process and thread generated according to program execution. , “Execution date and time”, “address on memory”, “page directory”, and “program type” are described. For example, the registration content on line 129 is

Line number: 129
Different process and thread: Process Process number: 1076
Memory usage: None Execution date: June 5, 2005, 0:35:18 Address on memory: 0x02138c40
Page directory: 0x0575e000
Program type: cmd. exe

It is. Also, the registration contents on line 130 are:

Line number: 130
Different process and thread: Thread process number: 1112
Memory usage: 588 bytes Execution date: None Address on memory: 0x021c1180
Page directory: None Program type: None

It is.

  The data sort unit 220 stores the information extracted by the information extraction unit 210 in the data storage unit 230 in association with the time (specifically, for example, arranged in time series). Here, the magnetic disk information can be arranged according to the date and time recorded in the individual information. Also, the memory information can be arranged according to information on the date and time when the program is started. That is, the data sort unit 220 associates the magnetic disk information and the memory information based on each time information, and specifies the execution order of each operation (hereinafter, the magnetic disk information and the memory information are combined). Called history information).

  The data analysis unit 240 reads data from the data storage unit 230 and analyzes operations performed in the survey target device 100. Specifically, for example, a timing pattern at which a specific program is activated is analyzed, an operation pattern for a specific file is analyzed, or a computer (investigation target device 100) is selected from a specific pattern appearing in magnetic disk information and memory information. The operation method can be estimated. Note that the data analysis unit 240 is not an indispensable component, and the time-series magnetic disk information and memory information stored in the data storage unit 230 may be output in a list format or the like. In this case, a person browses and analyzes the output list, and an operation performed on the computer (survey target device 100) can be estimated.

FIG. 6 is a diagram showing an example in which history information (magnetic disk information and memory information) is arranged in time series.
FIG. 6 shows memory information or magnetic disk information for each part surrounded by a broken line. In FIG. 6, portions 601 and 603 are memory information, and portions 602, 604, and 605 are magnetic disk information. Further, these portions 601 to 605 are arranged in time series from top to bottom.

Referring to the part 601 in FIG. 6, from the registered contents in the 36th line, the start time is 5:23:32 on November 13, 2006, and the type of the started program is notnotepad. exe, which indicates that the note pad was activated at this time. Also, referring to part 602, test. lnk time information

Mon Nov 13 2006 05:36:47 444 m. c ~

And test. txt time information

Mon Nov 13 2006 05:36:51 33. . c ~

It can be seen that a file “test.txt” has been generated. From the information of these portions 601 and 602, it is determined that the notepad is activated at this time and the file “test.txt” is generated.

Further, referring to the part 603, from the registered content in the 38th line, the start time is 6:11:53 on November 13, 2006, and the type of the started program is notnotepad. exe, which indicates that the note pad was activated at this time. Also, referring to part 604, test. lnk time information

Mon Nov 13 2006 06:13:10 444. a. ~

And test. txt time information

Mon Nov 13 2006 06:13:32 52 ma. ~

It can be seen that the file “test.txt” has been updated. From the information of these portions 603 and 604, it is determined that the note pad is activated at this time and the file “test.txt” is edited (updated).

By the way, the portion 605 in FIG.

50960. . c-/-rwxrwxrwx 0 0 1682-128-4 / WINNT / system32 / notepad. exe
50960. . c-/-rwxrwxrwx 0 0 1682-128-4 / WINNT / system32 / notepad. exe (deleted-realloc)

This indicates that the file has been manipulated using Notepad. However, since the information remaining as magnetic disk information is only the time when the last operation was performed on the file (last update time, last access time, etc.), when compared with the information obtained from the parts 601 to 604 described above, It can be said that the degree of utilization as a history is low.

FIG. 7 is a diagram illustrating another example in which history information is arranged in time series.
FIG. 7 shows information (part 701) on Friday, June 3, 2005, information (part 702) on June 5 (Sunday), and information (part) on June 6 (Monday) in the same year. 703). In the figure, a part 701 and a part 703 are part of the history information for the corresponding day. It is assumed that the history information of the portions not shown in the figures on June 3 and 6 are combined to determine that an operation in a normal operation on the console has been performed on both days as a whole.

  Referring to the portion 702 of FIG. 7, the history information on June 5 is different from the other days (June 3 and 6), and there is no magnetic disk information (that is, the trace of operation on the magnetic disk device 10g). There is only memory information. In addition, the program helix. exe is a program tool started from a CD-ROM. Therefore, if the history information on June 3 and 6 is compared with the history information on June 5, the normal operation using the program tool started from the CD-ROM will be performed on June 5. It is determined that a different operation has been performed. As a result, for example, when a problem such as the possibility of information leakage is detected in a predetermined system, it is determined that it is necessary to investigate that the problem operation may have been performed on June 5, 2005. Can do.

  As a method of finding such a specific operation and a time zone in which such an operation was performed from history information when an operation different from the normal operation is performed on the investigation target device 100 in a specific time zone. For example, an existing data mining technique can be used.

Next, another embodiment of the present invention will be described.
In this embodiment, the information acquired from the investigation target device is not directly transferred to the analysis server, but is temporarily stored in an external storage device for data storage and then transferred to the analysis server. In an actual system, there may be a case where the investigation target device is operationally prohibited from connecting to the network, or a case where the investigation target device cannot always connect directly to the analysis server due to a firewall setting. Further, since the data size of the disk image is large, it may be difficult to directly transfer from the investigation target apparatus to the analysis server. Therefore, in the present embodiment, information for analysis is temporarily stored in an external storage device connected to the investigation target device. Then, the analysis server reads information from the external storage device, or the investigation target device temporarily connected to the analysis server reads information from the external storage device and transfers it to the analysis server.

FIG. 8 is a diagram showing an overall configuration of an information processing system to which this embodiment is applied.
As shown in FIG. 8, the present embodiment includes a survey target device 300 and an analysis server 400. The survey target device 300 and the analysis server 400 are connected via a communication line, and data transmission from the survey target device 300 to the analysis server 400 is possible. A data storage device 330 is connected to the investigation target device 300 of this embodiment. The connection method between the investigation target device 300 and the analysis server 400 is not limited to a specific specific connection method. However, as described above, the investigation target device 300 may be prohibited from connecting to the network. In the example shown in FIG. 8, one investigation target device 300 is connected to one analysis server 400, but this is only a minimum configuration. Actually, a plurality of investigation target devices 300 may be connected to one analysis server 400. Further, the survey target device 300 and the analysis server 400 of the present embodiment are realized by a hardware configuration as shown in FIG. 2, for example, in the same manner as the survey target device 100 and the analysis server 200 in the system shown in FIG. .

FIG. 9 is a diagram illustrating the functional configuration of the investigation target device 300 and the analysis server 400 in the present embodiment.
Referring to FIG. 9, the investigation target device 300 of this embodiment includes a time information acquisition unit 310 and a memory information acquisition unit 320. These functions are realized by a program-controlled CPU 10a, for example, when the investigation target device 300 is configured by the computer 10 shown in FIG. The program is stored in the magnetic disk device 10g, read into the main memory 10c at the time of execution, and read from the main memory 10c to the CPU 10a for execution. This program may be stored and distributed in various storage media such as removable magnetic disks and optical disks such as flexible disks and CD-ROMs, flash memory and other semiconductor memories, or distributed via a network. it can. Also, as shown in FIG. 8, a data storage device 330 is connected to the investigation target device 300 of this embodiment. The data storage device 330 is realized by an external magnetic disk device connected to the investigation target device 300 via, for example, a USB.

  The time information acquisition unit 310 reads the time information (MAC time etc.) of the file recorded on the magnetic disk device 10 g and sends it to the data storage device 330. The time information is read out periodically or at a specific timing set in advance. The function of the time information acquisition unit 310 is realized by, for example, a system program installed in an operating system.

  The memory information acquisition unit 320 acquires a memory image (image file) that is a storage image of the main memory 10 c and sends it to the data storage device 330. Acquisition of the memory image is performed periodically or at a specific timing set in advance.

  The data storage device 330 receives and stores information (time information and memory image) acquired by the time information acquisition unit 310 and the memory information acquisition unit 320. The information stored in the data storage device 330 is transferred to the analysis server 400 at a specific timing set in advance, such as after the end of the work using the survey target device 300. If data can be transferred from the survey target device 300 to the analysis server 400, the survey target device 300 may read the data from the data storage device 330 and transfer it to the analysis server 400. As described above, the survey target apparatus 300 and the analysis server 400 may be directly connected to each other via a communication cable. In addition, when the investigation target apparatus 300 is normally prohibited from connecting to the network (during business hours, etc.), the connection may be temporarily permitted and data may be transferred to the analysis server 400. On the other hand, the data storage device 330 may be connected to the analysis server 400 so that the analysis server 400 reads data directly from the data storage device 330.

  The analysis server 400 of the present embodiment includes an information extraction unit 410, a data sort unit 420, a data storage unit 430, and a data analysis unit 440. Among these functions, the data storage unit 430 is realized by the magnetic disk device 10g when the analysis server 400 is configured by the computer 10 shown in FIG. 2, for example. On the other hand, the information extraction unit 410, the data sort unit 420, and the data analysis unit 440 are realized by a program-controlled CPU 10a. The program is stored in the magnetic disk device 10g, read into the main memory 10c at the time of execution, and read from the main memory 10c to the CPU 10a for execution. This program may be stored and distributed in various storage media such as removable magnetic disks and optical disks such as flexible disks and CD-ROMs, flash memory and other semiconductor memories, or distributed via a network. it can.

  The information extraction unit 410 analyzes the memory image of the main memory 10c among the information received from the investigation target device 300 (time information obtained from the magnetic disk device 10g and the memory image of the main memory 10c), and stores memory information (program Information on the activation of.

  The data sorting unit 420 associates the magnetic disk information such as the MAC time received from the investigation target device 300 with the memory information extracted by the information extracting unit 410 according to the time (specifically, for example, in time series). And stored in the data storage unit 430. Here, the magnetic disk information and the memory information are the same as the magnetic disk information and the memory information in the embodiment described with reference to FIGS. Therefore, the data sorting unit 420 associates the magnetic disk information and the memory information based on each time information, and specifies the execution order of each operation.

  The data analysis unit 440 reads data from the data storage unit 430 and analyzes operations performed in the survey target device 300. Specifically, for example, a timing pattern at which a specific program is activated is analyzed, an operation pattern for a specific file is analyzed, or a computer (investigation target device 300) is selected from a specific pattern appearing in magnetic disk information and memory information. The operation method can be estimated. Note that the data analysis unit 440 is not an essential component, and the time-series magnetic disk information and memory information stored in the data storage unit 430 may be output in a list format or the like. In this case, a person browses and analyzes the output list, and an operation performed on the computer (survey target device 300) can be estimated.

  The history information combining the magnetic disk information and the memory information is as described above with reference to FIGS. Therefore, a reliable and highly usable history can be obtained regarding the operation in the survey target apparatus 300. And it becomes easy to search for a time zone in which an operation different from the normal operation is performed. As described above, by analyzing the history information obtained by the present embodiment using an existing data mining technique, an operation different from the normal operation and a time zone in which the operation was performed are found from the history information. It is also possible.

1 is a diagram illustrating an overall configuration of an information processing system to which an embodiment of the present invention is applied. It is a figure which illustrates the hardware constitutions of the computer which implement | achieves the investigation object apparatus and analysis server of this embodiment. It is a figure explaining the functional structure of the investigation object apparatus and analysis server in this embodiment. It is a figure which shows the example of the magnetic disc information extracted from the disc image of magnetic disc information in this embodiment. It is a figure which shows the example of the memory information extracted from the memory image of the main memory in this embodiment. It is a figure which shows the example which arranged the history information (magnetic disk information and memory information) in this embodiment in time series. It is a figure which shows the other example which arranged the history information in this embodiment in time series. It is a figure which shows the whole structure of the information processing system with which other embodiment of this invention is applied. It is a figure explaining the functional structure of the investigation object apparatus and analysis server in this embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10a ... CPU, 10c ... Main memory, 10g ... Magnetic disk device, 100, 300 ... Investigation target device, 200, 400 ... Analysis server, 110 ... Magnetic disk information acquisition unit, 120, 320 ... Memory information acquisition unit, 130 ... Transmission Control unit, 210, 410 ... Information extraction unit, 220, 420 ... Data sort unit, 230, 430 ... Data storage unit, 240, 440 ... Data analysis unit, 310 ... Time information acquisition unit, 330 ... Data storage device

Claims (9)

Magnetic disk information acquisition means for acquiring a disk image, which is a storage image of the magnetic disk device of the investigation target device, from the magnetic disk device periodically or at a predetermined timing;
First information extraction means for extracting time information representing a time when an operation is performed on a file stored in the magnetic disk device from the disk image acquired by the magnetic disk information acquisition means;
Memory information acquisition means for acquiring a memory image, which is a storage image of a memory of the investigation target device, from the memory periodically or at a predetermined timing;
Second information extraction means for extracting from the memory image acquired by the memory information acquisition means information on the type of program started in the investigation target device and the start time of the program;
Storage means for associating and storing the time information extracted by the first information extraction means and the information on the start time of the program extracted by the second information extraction means in a storage means. Information processing system.   The information according to claim 1, wherein the storage means stores the information extracted by the first information extraction means and the second information extraction means in time series in the storage means. Processing system.   2. The information processing system according to claim 1, wherein the first information extraction unit extracts at least information on a creation time and a last update time of the file as the time information from the disk image. Time information acquisition means for reading out and acquiring from the magnetic disk device periodically or at a predetermined timing time information indicating a time when an operation is performed on a file stored in the magnetic disk device of the investigation target device;
Memory information acquisition means for acquiring a memory image, which is a storage image of a memory of the investigation target device, from the memory periodically or at a predetermined timing;
Information extraction means for extracting from the memory image acquired by the memory information acquisition means information on the type of program started in the investigation target device and the start time of the program;
An information processing system comprising: storage means for associating and storing the time information acquired by the time information acquisition means and information on the start time of the program extracted by the information extraction means in a storage means .   5. The information according to claim 4, wherein the storage means stores the information acquired by the time information acquisition means and the information extracted by the information extraction means in time series in the storage means. Processing system.   5. The information processing system according to claim 4, wherein the time information acquisition unit reads at least information on the creation time and the last update time of the file from the magnetic disk device. A survey target device, and an analysis server connected to the survey target device;
The survey target device is:
A magnetic disk information acquisition unit that acquires a disk image, which is a storage image of the magnetic disk device of the investigation target device, from the magnetic disk device periodically or at a predetermined timing;
A memory information acquisition unit for acquiring a memory image, which is a storage image of the memory of the investigation target device, from the memory periodically or at a predetermined timing;
A transmission control unit that transmits the disk image acquired by the magnetic disk information acquisition unit and the memory image acquired by the memory information acquisition unit to the analysis server;
The analysis server
The memory image acquired by the memory information acquisition unit is extracted from the disk image acquired by the magnetic disk information acquisition unit to extract time information representing the time when an operation is performed on the file stored in the magnetic disk device. An information extraction unit for extracting information on the type of the program started in the investigation target device and the start time of the program;
An information processing system comprising: an alignment unit that aligns information extracted by the information extraction unit in time series and stores the information in a storage unit. A survey target device, and an analysis server connected to the survey target device;
The survey target device is:
A time information acquisition unit that reads out and acquires time information indicating a time when an operation is performed on a file stored in the magnetic disk device of the investigation target device from the magnetic disk device periodically or at a predetermined timing;
A memory information acquisition unit for acquiring a memory image, which is a storage image of the memory of the investigation target device, from the memory periodically or at a predetermined timing;
A transmission control unit that transmits the time information acquired by the time information acquisition unit and the memory image acquired by the memory information acquisition unit to the analysis server;
The analysis server
An information extraction unit that extracts information about the type of the program activated in the investigation target device and the activation time of the program from the memory image acquired by the memory information acquisition unit;
An information processing system comprising: an alignment unit that aligns the time information acquired by the time information acquisition unit and the information extracted by the information extraction unit in time series and stores them in a storage unit. The investigation target device further includes an external storage device that stores information acquired by the time information acquisition unit and the memory information acquisition unit,
The information processing system according to claim 8, wherein the analysis server reads and acquires the information from the external storage device.

Images