JP5515963B2 - Log check device, program, and processing method - Google Patents

Description

  The present invention relates to a work log check processing technique for detecting a specific operation during work based on log information of the applied work.

  In recent years, with regard to data processing work executed as a business, in order to mitigate risks such as falsification of important information, leakage, etc., a mechanism for monitoring work contents, a mechanism for guaranteeing the legitimacy of the work, and the like are required. For example, auditing necessary for “internal control report” in “Financial Instruments and Exchange Law” is an example of work requiring confirmation of legitimacy.

  As a conventional method for checking the correctness of work, operations performed in the past in computer units or user units are recorded as “profiles”, and are recorded in the newly performed operations and the profile of the user or computer. There is a system that calculates a deviation from an operation and detects an operation that has not appeared in a past operation from the performed operation.

International Publication WO 2005/048119 JP-A-5-94212 JP 2001-175724 A

  In the conventional method, when “unusual behavior” during work is detected from log information such as “profile”, the operation record is handled for a wide range such as a computer unit or a user unit. Therefore, in the conventional method, the correctness of the work to be checked may not be confirmed.

  For example, the following problems arise when the log of the same work is simply compared with the work to be checked (hereinafter referred to as the application work) and the validity of the application work is confirmed.

  For example, a case in which a part of the file contents is illegally changed between operations to read the information of the operation target file in the application work, or other information is illegally changed while the information of the specific file is being changed. This is a case where an operation for changing file information is performed. In other words, if an illegal operation is performed during a legitimate work and the illegal operation itself falls under an operation that is determined as a legitimate work according to a separate correct procedure (application), It is difficult to detect fraudulent work performed in the past.

  FIG. 11 is a diagram illustrating an example of log information of application work to be checked.

  The log information shown in FIG. 11A represents a part of the log information of the work P1 “change the contents of the important file fileA”.

  The log information shown in FIG. 11 (B) includes “the contents of the important file fileA” in the application P2 for which “the contents of the general file fileB are changed and then the contents are compared with the general file fileD”. Represents a part of the log information of the work that performed the “change” operation.

  Here, it is assumed that the log information shown in FIG. 11B is a check target, and at that time, the log information shown in FIG. 11A has already been verified.

  In the log information shown in FIG. 11 (B), the operation steps (open fileA; write fileA; close fileA) on lines 05 to 07 indicate operations on the non-target file fileA in the requested work. The operation steps in the 05th to 07th lines are operations corresponding to the work of “changing the contents of the important file fileA”, and are operations outside the range permitted in the application work P2. Therefore, the worker who performed the application work P2 may have altered the important file fileA without applying for the work of “changing the contents of the important file fileA”.

  However, if the same worker has legitimately performed the work P1 in the past on the same computer, the log information shown in FIG. 11B corresponding to the operation whose legitimacy has been confirmed in the past, lines 05 to 07. A row operation may be identified as a safe operation. For this reason, it is not possible to correctly detect operations (operations from line 05 to line 07) that may be fraudulently performed during the application work P2.

  Furthermore, in order to guarantee the correctness of the work, the present inventor limits the commands that can be used in the requested work and the data (file name) that is the target of the work, and the limited commands and file names. We examined a method for detecting operations that may be fraudulent by extracting from the log information the parts that are used in operations.

  However, in the case of the studied method, there are the following problems. For example, in the log information shown in FIG. 11B, the worker can temporarily back up the contents of the file fileB to the file fileC as a device for performing the application work P2 “change the contents of the file fileB”. Is performed "(see lines 02 and 09).

  However, if “copy command”, “delete command”, “file fileC”, etc. are not specified as commands, files, etc. usable in this application work P2, line 02, 09 Line is detected as an illegal operation. On the other hand, “copy command”, “delete command”, and the like are commands that are easily used in unauthorized operations, and are originally detected when a command that can use such a command is specified. There is also a possibility that an illegal operation that should be detected cannot be detected.

  Therefore, with a simple command or file name determination, there is a high possibility that a legitimate operation is misidentified or an unauthorized operation is missed.

  It is an object of the present invention to check a technique for checking whether an operation being performed is permitted as an application work from the log information of the application work, and detecting an operation that deviates from an allowable range in the work. Is to provide.

Log checking apparatus disclosed in the present application, 1) work for each type, a first storage unit for storing a weighting value information that associates a and the weighting values each one or more operation contents executed in another work the acting industry If, 2) the performed on a computer system, a work type of work, and a second storage unit that stores log information indicating one or more operations of each operation content in the working, 3) the second based on stored in the storage unit the log information and said weight value information stored in the first storage unit, for each of the work type, calculated for one or more of each respective operations performed in the another the acting industry work a third storage unit for storing the weighting value, 4) and the application receiving section that acquires working application information indicating the application contents of the work of the execution schedule, 5) work when the work before SL execution schedule is performed Log information Contains calculated weight value for one or more operations content is, stored in said third storage unit, the weighted value of the operation content corresponding to the work type of work that is specified based on the working application information to determines whether included within a predetermined allowable range determined based on, is calculated weight value for one or more operations that are included in the work of the log information when the work is performed before the SL execution schedule and a processing unit that to output the alert information when it is determined not to fall within the allowable range.

  According to the log check device described above, a range of operations that involve data processing is requested in advance, and the contents of operations performed during the task deviate from the range of valid operations in the same task in the past (non-permissible range). ) Can be determined for each operation item during the work, and the “unique operation” executed in the middle of the normal operation during the work can be specified. Therefore, an unauthorized operation can be detected more accurately.

It is a figure which shows the structural example of the log check apparatus disclosed as one embodiment of this invention. It is a figure which shows the example of the weight value information of the weight value memory | storage part in one embodiment of this invention. It is a figure which shows the example of the standard deviation information of the standard deviation memory | storage part in one embodiment of this invention. It is a figure which shows the example of the work application in one embodiment of this invention. It is a figure which shows the example of an output of the alert information in one embodiment of this invention. It is a figure which shows the flow (1) of a process of the log check apparatus in one embodiment of this invention. It is a figure which shows the flow (2) of a process of the log check apparatus in one embodiment of this invention. It is a figure explaining another example of calculation of a weight value in one embodiment of the present invention. It is a figure explaining another example of calculation of a weight value in one embodiment of the present invention. It is a figure which shows the hardware structural example of the log check apparatus in one embodiment of this invention. It is a figure which shows the log information example of the application work used as a check object.

  FIG. 1 is a diagram illustrating a configuration example of a log check device disclosed as an embodiment of the present invention.

  The log check device 1 is a work executed in the work system 5, and is a device that outputs information for checking the validity of the work applied in advance.

  The work system 5 may be one or a plurality of systems (systems 5A to 5C). The log check device 1 can acquire log information from the work system 5 via an arbitrary network or data medium.

  The log information is information for recording the contents of operation steps executed in the requested work. In the present embodiment, one line of log information represents one operation step executed in the work.

  The log check device 1 includes a weight value storage unit 10, a standard deviation storage unit 11, a user interface unit 12, an application reception unit 13, a log information acquisition unit 14, a log information storage unit 15, a comparison processing unit 16, and an update unit 17. Prepare.

  The weight value storage unit 10 is a storage unit that stores, for each operation executed in the work, weight value information indicating the association between the content of the operation item and the weight value.

  An operation item is an element (operation content) that identifies the operation content, and stores, for example, the type of command executed in the operation, the data or data attribute that is the operation target, and the data that is the operation target. It is a place.

  In the weight value information, a weight value is defined for each content of each operation item.

  A low weight value is set for an operation content that does not affect security and an operation content that is unlikely to be used in an unauthorized operation. A high weight value is set for an operation content that has a significant impact on security and an operation content that is likely to appear in an unauthorized operation. Further, the weight values corresponding to the respective operation elements in the same item are set by using values having sufficient differences, for example, values having different numbers of digits, values by exponents, and the like.

  FIG. 2 is a diagram illustrating an example of the weight value information in the weight value storage unit 10.

  In the weight value information shown in FIG. 2, for each predetermined work type, “command type” indicating the type of the operated command, “importance of the target file” indicating the attribute of the operated file, For items such as “file location” indicating the storage location, a weight value is defined for each item element.

  Regarding “command type”, for example, classification according to the type of write command, read command, other command, and the importance of data processed by the command (high, medium, low) The weight value is defined according to the combination with the category.

  A weight value = 1000 is set in an item of an operation having a large security impact, for example, an operation by a write command to a file having high importance. A weight value = 10 is set in an operation item with a small security impact, for example, an operation item by other commands (for example, commands such as open and close) for a file with low importance. .

  In addition, a weight value is set for “importance of the file” according to the element “high, medium, low”. Note that the importance classification of each file is set in advance.

  For “file location”, a weight value is defined according to the distance between the location where the actually operated file is stored and the location where the requested work target file is stored. For example, when the actually operated file is a file to be applied, weight value = 0 is set. If the actually operated file is a file in the same folder as the file for which the application has been applied, weight value = 100 is set. In addition, when the actually operated file is in the folder one level higher or lower than the folder of the requested target file, the weight value = 200 is set.

  The standard deviation storage unit 11 calculates, for each work type, standard deviation information indicating the average value and standard deviation of the weight values calculated for each operation item, calculated from log information of legitimate work executed in the past. Is a storage unit.

  FIG. 3 is a diagram illustrating an example of standard deviation information in the standard deviation storage unit 11.

  The standard deviation information shown in Fig. 3 includes the average value and standard deviation for each operation item, the number of times log information is checked, and the checked log information for each type of work applied and the importance of the requested target file. The total number of rows is recorded.

  Note that the standard deviation information is calculated using only log information of work determined to be valid.

  The user interface unit 12 creates a work application indicating a work to be performed based on information input via an input device (not shown) and an alert issued by the comparison processing unit 16. A processing unit that generates alert information and outputs the alert information via an output device (not shown).

  The work application is information including the type of work to be applied, the time zone when the work is scheduled, the system (working system) in which the work is executed 5, the data to be worked, the storage location, and the like.

  FIG. 4 is a diagram illustrating an example of a work application.

  The work application shown in FIG. 4 has data items such as work (work type), work date and time (time zone), work target system, worker, work ID, approver, and work target file.

  The work is information indicating the type of work to be applied, such as “information reading work”, “information correction”, “information deletion”, and the like.

  The work date and time (time zone) is information indicating the scheduled date and start / end time of the requested work.

  The work target system is information indicating a system in which the requested work is performed, for example, system identification information (system name, computer name, etc.) of the work system 5.

  The worker is identification information (worker name, worker ID, etc.) of the applied worker.

  The work ID is identification information of the applied work itself.

  The approver is identification information (approver name, approver ID, etc.) of the approver of the applied work.

  The work target file is information indicating identification information (file name) of data to be processed in the applied work and a location (path name, folder name, etc.) where the data is stored.

  Further, the user interface unit 12 identifies the line (operation step) where the alert is issued and the operation item based on the log information to be checked corresponding to the work application based on the alert issued by the comparison processing unit 16. Then, alert information indicating the specified line and item is generated. Further, the user interface unit 12 generates alert information including the alert level when the comparison processing unit 16 determines the alert level.

  The alert information is output via an output device (display device, printer, etc.) provided in the log check device 1. An example of alert information will be described later.

  The application receiving unit 13 is a processing unit that acquires and holds the work application created by the user interface unit 12.

  The log information acquisition unit 14 is a processing unit that acquires log information of a work related to a work application from the work system 5 and stores the log information in the log information storage unit 15.

  The log information storage unit 15 is a storage unit that stores log information.

  The comparison processing unit 16 obtains log information to be checked, calculates a weight value for each operation item in each row (operation step) of the log information based on the weight value information, and the log information A process for determining whether the weight value for each operation item in each row is within the allowable range determined based on the average value and standard deviation of the standard deviation information, and as a result of the determination, the weight value is within the allowable range. When not included, the processing unit performs processing for issuing an alert for the item.

  In addition, the comparison processing unit 16 sets an alert level corresponding to the number of alerts issued for items in one row (operation step), and a plurality of alerts in the row (operation step) in the log information. When is issued, the alert level corresponding to the number of alerts is determined.

  As an example, when three levels of alert levels 1 to 3 are set, when the number of alert setting items is 1, alert level = 1, and when the number of items is 2, alert level = 2. When the number of items is 3 or more, alert level = 3 is set.

  The user interface unit 12 generates and outputs alert information based on the alert issued by the comparison processing unit 16.

  FIG. 5 is a diagram illustrating an output example of alert information.

  The alert information output example shown in FIG. 5 shows an example in which alert information is output as a display screen.

  The alert information display screen 200 displays display items of “target log information” 201, “alert summary” 202 and “alert occurrence log details” 203, “confirmation end” button 210 and “view target log” button 211. .

  “Target log information” 201 is a display area in which the contents of the work application corresponding to the log information to be checked are displayed.

  The “alert summary” 202 is a display area for displaying the number of items or the number of lines (operation steps) corresponding to each alert level when the alert level is set.

  “Alert occurrence log details” 203 is a display area in which the contents of each row (operation step) where an alert is issued are displayed. “Alert occurrence log details” 203 displays, for example, line numbers, log contents, alert levels, alert contents, and the like.

  The line number is line identification information in the log information. For example, “05” indicates 05 lines of log information.

  The log content is information indicating the operation content of the corresponding line (operation step) of the log information. For example, “open / data / section3 / fileB” on line 05 has items of “operation command = open (open), target file = file fileB, file location = folder data / section3”, and “file fileB. Indicates an “open” operation.

  The alert level is information indicating the determined alert level. For example, “1” on line 05 indicates alert level = 1.

  The alert content is information indicating an operation item on the line where the alert is issued. For example, line 05 indicates that an alert has been issued for the item “file location”. Line 06 indicates that an alert has been issued for two items “command type, file contents”.

  The “confirmation end” button 210 is an operation button for indicating that the content of the display screen has been confirmed. By pressing or selecting the “end confirmation” button 210, the user interface unit 12 switches the display screen from the alert information display screen shown in FIG. 5 to another screen, for example, an alert information display screen for another work application. .

  The “view target log” button 211 is an operation button for requesting browsing of detailed information of the displayed log information. When the “view target log” button 211 is pressed or selected, the user interface unit 12 generates and displays a display screen showing detailed information of the target log information being displayed on the alert information display screen shown in FIG.

  The user interface unit 12 may output the alert information as file format data.

  The update unit 17 is a processing unit that acquires log information for which no alert is set in the determination processing of the comparison processing unit 16 and updates the standard deviation information of the same work type using the acquired log information. .

  Hereinafter, the processing flow of the log check device 1 will be described in more detail.

  6 and 7 are diagrams showing a processing flow of the log check device 1 in the present embodiment.

  Step S1: The user interface unit 12 of the log check device 1 creates a work application related to a work to be performed based on information input by the worker via an input device, a display device, etc. To pass.

  Step S2: The application accepting unit 13 accepts a work application from the user interface unit 12, and holds the accepted work application in a storage unit (not shown) in the log check device 1.

  Step S3: The comparison processing unit 16 extracts the weight value information of the corresponding work type from the weight value storage unit 10 based on the work type of the work item of the work application received by the application receiving unit 13.

  Assume that the work application shown in FIG. 4 is accepted. In this case, on the basis of the work “reading information” and the work target file “file fileA” of the work application, the comparison processing unit 16 uses the weight value information shown in FIG. For each item of “Importance of file” and “Location of file”, the weight value in the column of “Work type” is “Read information” and “Demand level of target file” is “High” is extracted.

  Step S4: Further, the comparison processing unit 16 extracts the standard deviation information corresponding to the work type of the work application from the standard deviation storage unit 11.

  The comparison processing unit 16 extracts, for each item, an average value and a standard deviation in a column where “work type” is “read information” and “demand level of target file” is “high”.

  Step S5: The worker carries out the work application work in the work system 5.

  Step S6: The work system 5 outputs log information that records the details of the operation being performed by the worker.

  Step S <b> 7: The log information acquisition unit 14 of the log check device 1 acquires the log information output from the work system 5 and stores it in the log information storage unit 15.

  Step S <b> 8: The comparison processing unit 16 extracts log information corresponding to the work application received by the application receiving unit 13 from the log information storage unit 15.

  Step S9: The comparison processing unit 16 determines whether or not the processing after Step S10 has been performed for all the rows (operation steps) of the log information. If all the log information lines have not been processed (NO in step S9), the process proceeds to step S10. If all log information lines have been processed (YES in step S9), the process proceeds to step S13.

  Step S10: Based on the weight value information, the comparison processing unit 16 calculates a weight value for each item of command type, file importance, and file location in each line of the extracted log information. Further, the comparison processing unit 16 obtains an average value and a standard deviation corresponding to the calculated weight value of each item in the standard deviation information.

  As an example, the comparison processing unit 16 calculates a weight value for the following log information line contents (log contents) as follows.

(1) In the case of the line of “read work file (read / data / section1 / fileA)”,
Command type (read) weight value = 100;
File importance (fileA = high) weight value = 100;
File location (data / section1 /) weight value = 0
It becomes.

(2) In the case of the line “Change data of work file (write / data / section1 / fileA)”,
Command type (write) weight value = 1000;
File importance (fileA = high) weight value = 100;
File location (data / section1 /) weight value = 0
It becomes.

(3) In the case of the line “Read low-priority file out of work (read / data / section2 / fileC)”
Command type (read) weight value = 100;
File importance (fileC = low) weight value = 1;
File location (data / section2 /) weight value = 500
It becomes.

(4) In the case of the line “Write to high-priority file not to be worked on (write / data / section2 / fileD)”,
Command type (write) weight value = 1000;
File importance (fileC = low) weight value = 100;
File location (data / section2 /) weight value = 500
It becomes.

  Step S11: The comparison processing unit 16 determines whether or not the calculated deviation of the weight value of the item is included in the allowable range based on the standard deviation information.

  If the deviation of the item weight value is not included in the allowable range based on the standard deviation information (NO in step S11), the process proceeds to step S12 and is included in the allowable range based on the standard deviation information. If YES (YES in step S11), the process returns to step S9.

  Here, the allowable range is within 90% of the normal distribution based on the average value and standard deviation of the standard deviation information, and within the range of “average value ± 2 * standard deviation”. Etc.

  For example, in the case of each row exemplified in the process of step S10, the determination is made as follows.

(1) In the case of the line of “read work file (read / data / section1 / fileA)”,
Command type: No alert (deviation is within tolerance);
File importance: No alert;
File location: No alert. Therefore, no alert is issued for this line.

(2) In the case of the line “Change data of work file (write / data / section1 / fileA)”,
Command type: Alert (deviation is outside the allowable range);
File importance: No alert;
File location: No alert. Therefore, for this row, the number of issued alerts = 1 and alert level = 1 is set.

(3) In the case of the line “Read low-priority file out of work (read / data / section2 / fileC)”
Command type: No alert;
File importance: No alert;
File location: With alert. Therefore, for this row, the number of issued alerts = 1 and alert level = 1 is set.

(4) In the case of the line “Write to high-priority file not to be worked on (write / data / section2 / fileD)”,
Command type: With alert;
File importance: No alert;
File location: With alert. Therefore, for this row, the number of issued alerts = 2 and alert level = 2 is set.

  In the above-described examples (1) to (4), the line (1) indicates a normal operation along the application work, and no alert is issued even in the determination by the comparison processing unit 16.

  On the other hand, the lines (2) to (4) are lines indicating operations that may be illegal.

  The log check device 1 can appropriately issue an alert from the log information for an operation that may be illegal.

  Step S12: The comparison processing unit 16 issues an alert for the item in the row. Further, the comparison processing unit 16 determines an alert level based on the number of alerts issued in that row. Thereafter, the process returns to step S9.

  Step S13: When all the lines of the log information have been processed (YES in Step S9), the user interface unit 12 checks whether an alert has been issued for the log information to be checked. If at least one alert has been issued for the log information (YES in step S13), the process proceeds to step S14. If no alert has been issued (NO in step S13), the process proceeds to step S16.

  Step S14: The user interface unit 12 specifies the line where the alert is issued, acquires the alert level, and extracts the contents of the line from the log information.

  Further, the user interface unit 12 acquires the work application held by the application receiving unit 13 and generates alert information including the content of the line (log content) where the alert is issued, the alert level, information on the work application, and the like. Output.

  Step S15: For example, the user interface unit 12 displays the alert information screen shown in FIG. 5 on the display device of the auditor's computer. The auditor can audit the work contents by confirming the line where the alert is issued and the alert level in the work log concerning the work application from the output display screen.

  Step S16: The updating unit 17 uses the weight value of each line of log information for which no alert has been issued, to calculate the average value and standard deviation of the standard deviation information of the same work type stored in the standard deviation storage unit 11. Recalculate and update.

  For example, the update unit 17 updates the standard deviation information according to the following procedure.

  (ST1) The updating unit 17 calculates an average value of the “weight values” of the items in each row in the log information of work corresponding to one work application.

  First, the update unit 17 calculates an average value of “weight” of each item of “command type”, “file importance”, and “file location” in each row of log information.

  For example, the average of the values of “command type”, “file importance”, and “file location” of each line of the log information in the application work P3 is calculated.

The weight value of the line “read / data / section1 / fileA” is
Command type: 100;
File importance: 100;
File location: 0
And

The weight value of the line “write / data / section1 / fileA” is
Command type: 1000;
File importance: 100;
File location: 0
And

The weight value of the line “read / data / section2 / fileC” is
Command type: 100;
File importance: 1;
File location: 500
And

In this case, the average weight value of each item is
Average weight value of command type: 400
Average weight value of file importance: 67;
Average of file location weight values: 166.7
It becomes.

  (ST2) The updating unit 17 reflects the average value in the standard deviation information.

  The updating unit 17 calculates the average of the weight values of the standard deviation information from the average value of the weight values calculated from the log information and the average value of the weight values of the corresponding standard deviation information stored in the standard deviation storage unit 11. Update the value.

  For example, the standard deviation information stored in the standard deviation storage unit 11 from the average value of the weight values of each item obtained in (ST1), the average value of the corresponding standard deviation information shown in FIG. Update the average value of.

  Here, the average value (400) of the “command type” weight value obtained from the log information of the application work P3 and the standard deviation information of the same work type (reading of information and the importance of the target file = medium) The update unit 17 recalculates the average value from the average value (151) of the “command type” and the number of executions (26). That is, “(400 + 151 × 26) ÷ 27 = 160.2”, and the update unit 17 sets the average value of the command type of the standard deviation information of the work type (reading of information and the importance of the target file = medium) to “151”. To “160.2”.

  (ST3) The updating unit 17 calculates the distribution of weights in the log information using the updated average value.

  The updating unit 17 calculates the variance of the weight value of the log information from the updated average value and the weight value of each line of the log information using the following formula.

Variance = {Σ (value of each row of the log−updated average value) ^ 2} ÷ number of log rows (ST4) The updating unit 17 updates the standard deviation of the standard deviation information from the calculated log variance value. .

  The updating unit 17 obtains the standard deviation by the following formula and updates the standard deviation of the standard deviation information.

Standard deviation value to be updated =
{(Log distribution x number of log lines + database standard deviation 2 x number of checked log lines) / (number of log lines + number of checked log lines)} ^ (1/2)
Through the processes of (ST1) to (ST4), the value of the standard deviation information stored in the standard deviation storage unit 11 is updated, and the degree of distribution of the weight value is updated.

  FIG. 8 is a diagram for explaining another example of calculating the weight value.

  The comparison processing unit 16 hierarchically classifies the command types for calculating the weight values of the command type and file importance items. For example, a write command group is defined as an upper hierarchy classification, a read command group is defined as a middle hierarchy classification, and other command groups are defined as lower hierarchy classifications.

  If the actually operated command belongs to a category n stages higher than the category of the command used in the work content of the work application, the weight is given by the expression “100 × 10 ^ (n + 1)”. The value is calculated.

  Further, when the actually operated command matches the command category used in the work content of the work application, the weight value = 100.

  Also, if the actually operated command belongs to a category n steps below the command category used in the work content of the work application, “100 × 10 ^ {1 / (n + 1)}” The weight value is calculated by the following formula.

  FIG. 9 is a diagram for explaining yet another example of calculating the weight value.

  The comparison processing unit 16 calculates the weight value of the file location based on the distance from the location of the work target file of the work application to the location of the actually operated file. Here, the distance is, for example, “weight value = distance × 100” as the number of folders separating the folders in which two files exist.

  As shown in FIG. 9, the distance between “data / section1 / wata / 01.txt” and “data / section2 / kaya / 02.txt” = 5, and the weight value = 500.

  FIG. 10 shows a hardware configuration example of the log check device 1.

  The log check device 1 includes a computing device (CPU) 101, a temporary storage device (DRAM, flash memory, etc.) 102, a persistent storage device (HDD, flash memory, etc.) 103, and a computer 100 having a network interface 104 with a network N. And an input device (keyboard, mouse, etc.) 120 and an output device (display, printer, etc.) 130.

  Further, the log check device 1 can be implemented by a program that can be executed by the computer 100. In this case, a program describing the processing contents of the functions that the log check device 1 should have is provided. When the computer 100 executes the provided program, the processing function of the log check device 1 described above is realized on the computer 100.

  That is, the user interface unit 12, the application receiving unit 13, the log information acquiring unit 14, the comparison processing unit 16, the updating unit 17, and the like of the log check device 1 can be configured by programs, and these programs are stored in the temporary storage device 102. The functions of each processing unit are realized by being loaded and executed. The weight value storage unit 10, the standard deviation storage unit 11, the log information storage unit 15, and the like are stored in the persistence storage device 103.

  The computer 100 can also read a program directly from a portable recording medium and execute processing according to the program. In addition, each time the program is transferred from the server computer, the computer 100 can sequentially execute processing according to the received program.

  Further, this program can be recorded on a recording medium readable by the computer 100.

  As described above, when the requested work is performed, the log check device 1 checks whether or not an operation that causes a security problem during the work is performed from the log information. be able to.

  The log check device 1 compares the log information of the work to be checked with the log information of the same work type whose past validity has been confirmed. Therefore, instead of simply comparing with the corresponding command set or vaguely comparing with past trends, it does not detect the problematic operation, but compares with the log information of the work type corresponding to the work to be checked . Therefore, it is possible to extract unique operations in the applied work.

  In addition, the log check device 1 does not compare the log information to be checked as a whole, but compares each row of log information, that is, each operation step, for each operation element to determine whether the operation is unique. Judgment. Therefore, it is possible to detect a specific operation that is difficult to discriminate with the prior art and is performed in a normal operation.

  Furthermore, the log check device 1 uses a standard deviation corresponding to the weight value for each item of the operation to be checked and the log information as a condition for determining whether or not the operation is unique. Therefore, the check can be performed based on the allowable range corresponding to the operation and the operation item in accordance with the actual situation that the allowable range serving as the determination condition varies for each operation and the operation item.

  In addition, the log check device 1 determines that the correct operation has been performed for those in which no alert has occurred throughout the log information, and updates the standard deviation information using the log information whose validity has been confirmed. . As a result, in the subsequent check processing, determination can be made based on a more accurate allowable range. Therefore, the accuracy of the check process can be automatically improved each time the log information check process is performed.

DESCRIPTION OF SYMBOLS 1 Log check apparatus 10 Weight value memory | storage part 11 Standard deviation memory | storage part 12 User interface part 13 Application acceptance part 14 Log information acquisition part 15 Log information memory | storage part 16 Comparison processing part 17 Update part 5 Work system

Claims (7)

A log check device for checking log information indicating operation contents for a computer system,
For each work type, a first storage unit for storing with that weight value information corresponding to and the weight value each one or more operation contents executed in another work the acting industry,
The performed on a computer system, a work type of work, and a second storage unit that stores log information indicating one or more operations of each operation content of the working,
Based on said log information and said weight value information stored in the first storage unit stored in the second storage unit, for each of the work type, one or more of the operations performed in the different tasks the acting industry A third storage for storing weight values calculated for each ;
An application accepting department that obtains work application information indicating the application contents of work to be executed;
The calculated weight value for one or more operations that are included in the work of the log information when the work is performed before the SL execution schedule is, stored in said third storage unit, identified based on the work application information operation either included within a predetermined allowable range determined based on the weighted value whether to determine the content, the log of the previous SL when work execution schedule is performed tasks corresponding to the work type of work to be log check the calculated weight value for one or more operations that are included in the information, characterized in that the and a processing unit that to output the alert information when it is determined not to fall within the allowable range apparatus. The operation content includes items that are elements of the operation,
Each of the first storage unit and the third storage unit stores the weight information for each item of the operation content,
The processing unit outputs different alert information according to the number of items determined that the weight value is not included in the allowable range.
The log check apparatus according to claim 1, wherein: The third storage unit stores, for each work type, an average value and a standard deviation of the weight values calculated for one or more operation details executed in the work of the work type.
The log check apparatus according to claim 1, wherein: Using the calculated the weighting value for each item of the one or more operation contents or operation contents included in the alert information is issued not said working application consuming process log information by the front Kisho processing section, the work An update unit that updates an average value and a standard deviation of the weight values stored in the third storage unit for a work type of work according to application information ;
The log check device according to claim 3 . Before Kisho processing section, the alert level was determined according to the number of deviations of tolerance the weight values is determined that not listed in the range, and outputs the alert information including the alert level,
Log checking apparatus according to claim 3 or claim 4, wherein the. In order to check the log information indicating the contents of operations on the computer system,
A computer having a first storage unit, a second storage unit, and a third storage unit,
Stored in said first storage unit, for each work type, a process for obtaining weight information that associates a and the weighting values each one or more operation contents executed in another work the acting industry,
Stored in said second storage unit, performed on the computer system, the work type of work, the process of acquiring the log information indicating one or more operating each operation contents of the working,
Based on the log information acquired from the second storage unit and the weight value information acquired from the first storage unit , stored in the third storage unit , for each work type, executed in the work of the work type 1 and more operations to get the calculated weight value for each process that is,
Processing to acquire work application information indicating the application details of work scheduled to be executed;
The calculated weight value for one or more operations that are included in the work of the log information when working of the execution schedule is executed, obtained from the third storage unit, it is identified based on the work application information It is determined whether it is included within a predetermined allowable range determined based on the weight value of the operation content corresponding to the work type of the work to be performed, and is included in the work log information when the scheduled work is executed And a process for outputting alert information when it is determined that a weight value calculated for one or more operation details is not included in the allowable range. A processing method in which a computer checks log information indicating operations performed on a computer system,
A computer including a first storage unit, a second storage unit, and a third storage unit ,
The first stored in the storage unit, for each work type, acquires one or more operation content weight information that associates a and weight values respectively performed in separate operations the acting industry,
Stored in said second storage section, the performed on the computer system, and acquires the work type of work, the log information indicating one or more operating each operation contents of the working,
Based on the log information acquired from the second storage unit and the weight value information acquired from the first storage unit , stored in the third storage unit , for each work type, executed in the work of the work type get the calculated weight value for each of one or more operations which are,
Obtain work application information indicating the application details of the work scheduled to be executed,
The calculated weight value for one or more operations that are included in the work of the log information when working of the execution schedule is executed, obtained from the third storage unit, it is identified based on the work application information It is determined whether it is included within a predetermined allowable range determined based on the weight value of the operation content corresponding to the work type of the work to be performed, and is included in the work log information when the scheduled work is executed A process of outputting alert information when it is determined that a weight value calculated for one or more operation details is not included in the allowable range ;
A log check method characterized by that.

Images