JP7499669B2 - Deception system, deception method, and deception program - Google Patents

Description

This disclosure relates to a deception mechanism that thwarts cyber attacks.

Attackers use various methods to get targets to open emails and infect their computers with malware. The attackers then use the malware to explore the inside of an organization and achieve their goals, such as stealing information or engaging in destructive activities. Based on the concept of defense in depth, there is a need for technology that can hinder attacker activities even after an attacker has infiltrated a system.

Non-Patent Document 1 proposes a method of incorporating a deception mechanism into a regular environment.
The deception mechanism simulates the environment of the monitored target and monitors the deployed bait information. This allows the deception mechanism to detect the activity of an attacker when the attacker falls for the bait information. The deception mechanism makes it possible to proactively detect malware activity and to disrupt attacker activity.

In the method described in Non-Patent Document 1, in order to improve convenience for legitimate users, the deception mechanism turns off the deception function on a system operated by a legitimate user.

Aochi, Y., Kamizono, M., Eto, M., Matsumoto, M., & Yoshida, N. (2019). Hiding decoy files to prevent the degradation of convenience caused by deception mechanisms. Computer Security Symposium 2019 Proceedings, 2019, 691-696.

In the technique of Non-Patent Document 1, a legitimate user is defined as a "user who uses a GUI" and an attacker is defined as a "user who uses a CUI."
Furthermore, the dummy file is not displayed while the authorized user is using the system, so convenience for the authorized user is not impaired.
However, dummy files are not displayed on the CUI when a legitimate user is using the system. Therefore, an attacker using the CUI can infer which files are legitimate by identifying the usage time of the legitimate user.
Furthermore, legitimate programs are also running on the OS used by legitimate users.
Therefore, in the case of a method such as that described in Non-Patent Document 1, in which an attacker is simply defined as a "user who uses a CUI," the operation of legitimate programs is also hindered.

The purpose of this disclosure is to make it possible to hinder the activities of attackers while maintaining convenience for legitimate users.

The deception system of the present disclosure comprises:
This is a system for dealing with cyber attacks that use a character user interface to access a legitimate directory that is accessed by a legitimate user using a graphical user interface.
The deception system comprises:
a configuration management unit that determines an internal configuration of a monitoring target directory including the regular directory and a dummy directory that is a dummy of the regular directory, and designates a regular icon image that is an icon image for the regular directory and a dummy icon image that is an icon image for the dummy directory;
The system further includes a monitoring target generation unit that generates the monitoring target directory based on an internal configuration list indicating the determined internal configuration, sets the regular icon image in the regular directory, and sets the dummy icon image in the dummy directory.

According to the present disclosure, the presence of a dummy directory hampers the activities of an attacker. Furthermore, since a legitimate user can check the icon image and distinguish between a legitimate directory and a dummy directory, convenience for the legitimate user is maintained. In other words, it is possible to hinder the activities of an attacker while maintaining convenience for the legitimate user.

FIG. 1 is a configuration diagram of a deception system 100 in embodiment 1. FIG. 2 is a configuration diagram of a file server 200 according to the first embodiment. FIG. 2 is a configuration diagram of a management device 300 according to the first embodiment. 13 is a flowchart of a deception method (preparation) in embodiment 1. 13 is a flowchart of step S120 in the first embodiment. FIG. 2 is a diagram showing an example of a monitoring target directory 220 according to the first embodiment. FIG. 2 is a diagram showing an example of a monitoring target directory 220 according to the first embodiment. 13 is a diagram showing an example of a generation code for an internal configuration list of a monitoring target directory 220 according to the first embodiment. 13 is a flowchart of step S130 in the first embodiment. 4A to 4C are diagrams showing examples of icon images according to the first embodiment. 4A to 4C are diagrams showing examples of icon images according to the first embodiment. 13 is a flowchart of a deception method (recording) in embodiment 1. 13 is a flowchart of a deception method (detection) in embodiment 1. 13 is a flowchart of a deception method (update) in embodiment 1. FIG. 11 is a configuration diagram of a management device 300 according to a second embodiment. 13 is a flowchart of a deception method (detection) in embodiment 2.

In the embodiments and drawings, the same or corresponding elements are given the same reference numerals. Explanations of elements given the same reference numerals as previously described elements are omitted or simplified as appropriate. Arrows in the drawings primarily indicate data flow or processing flow.

Embodiment 1.
The deception system 100 will be described with reference to FIGS.

***Configuration Description***
The configuration of the deception system 100 will be described with reference to FIG.
The deception system 100 is a system for dealing with cyber attacks that use a CUI to access a directory that is accessed by a legitimate user 101 using a GUI.
GUI is an abbreviation for Graphical User Interface.
CUI is an abbreviation for Character User Interface, which is also called Character-Based User Interface (CUI), Console User Interface (CUI) or Command Line Interface (CLI).

The deception system 100 includes a file server 200 and a management device 300 .
The file server 200 is a computer that manages directories and files.
The management device 300 is a computer for dealing with access to the file server 200 caused by cyber attacks.
The authorized user 101 is a user who is permitted to access the file server 200. For example, the authorized user 101 is a person who belongs to an organization that manages the file server 200. The authorized user 101 accesses the file server 200 using a GUI. For example, the authorized user 101 opens a directory or a file by clicking an icon image displayed on the user terminal.
The legitimate program 102 is a program that is permitted to access the file server 200. For example, the legitimate program 102 is antivirus software installed on the user terminal of the legitimate user 101. The legitimate program 102 accesses the file server 200 using a CUI.
The attacker 103 is a person who carries out a cyber attack. The attacker 103 uses a malicious program 104 to access the file server 200.
The malicious program 104 is a program for a cyber attack. For example, the malicious program 104 is malware installed on the user terminal of the authorized user 101. The malicious program 104 accesses the file server 200 by using a CUI.

The configuration of the file server 200 will be described with reference to FIG.
The file server 200 is a computer that includes hardware such as a processor 201, a memory 202, an auxiliary storage device 203, a communication device 204, and an input/output interface 205. These pieces of hardware are connected to each other via signal lines.

The processor 201 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 201 is a CPU, a DSP, or a GPU.
IC is an abbreviation for Integrated Circuit.
CPU is an abbreviation for Central Processing Unit.
DSP is an abbreviation for Digital Signal Processor.
GPU is an abbreviation for Graphics Processing Unit.

The memory 202 is a volatile or non-volatile storage device. The memory 202 is also called a primary storage device or a main memory. For example, the memory 202 is a RAM. Data stored in the memory 202 is saved in the secondary storage device 203 as necessary.
RAM is an abbreviation for Random Access Memory.

The auxiliary storage device 203 is a non-volatile storage device. For example, the auxiliary storage device 203 is a ROM, a HDD, or a flash memory. Data stored in the auxiliary storage device 203 is loaded into the memory 202 as needed.
ROM is an abbreviation for Read Only Memory.
HDD is an abbreviation for Hard Disk Drive.

The communication device 204 is a receiver and a transmitter. For example, the communication device 204 is a communication chip or a NIC.
NIC is an abbreviation for Network Interface Card.

The input/output interface 205 is a port to which an input device and an output device are connected. For example, the input/output interface 205 is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display.
USB is an abbreviation for Universal Serial Bus.

The file server 200 includes elements such as a configuration notification unit 211, a monitoring target generation unit 212, and an access log recording unit 213. These elements are realized by software.

The auxiliary storage device 203 stores a monitoring target directory 220 .
The auxiliary storage device 203 stores a file server program for causing the computer to function as a configuration notification unit 211, a monitoring target generation unit 212, and an access log recording unit 213. The file server program is loaded into the memory 202 and executed by the processor 201.
The auxiliary storage device 203 further stores an OS. At least a part of the OS is loaded into the memory 202 and executed by the processor 201.
The processor 201 executes a file server program while executing the OS.
OS is an abbreviation for Operating System.

Input and output data of the file server program is stored in the storage unit.
The memory 202 functions as a storage unit. However, a storage unit such as the auxiliary storage unit 203, a register in the processor 201, or a cache memory in the processor 201 may function as a storage unit instead of the memory 202 or together with the memory 202.

The file server 200 may have multiple processors that replace the processor 201.

The file server program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or flash memory.

The configuration of the management device 300 will be described with reference to FIG.
The management device 300 is a computer that includes hardware such as a processor 301, a memory 302, an auxiliary storage device 303, a communication device 304, and an input/output interface 305. These pieces of hardware are connected to each other via signal lines.

The processor 301 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 301 is a CPU, a DSP, or a GPU.
The memory 302 is a volatile or non-volatile storage device. The memory 302 is also called a primary storage device or a main memory. For example, the memory 302 is a RAM. Data stored in the memory 302 is saved in the secondary storage device 303 as necessary.
The auxiliary storage device 303 is a non-volatile storage device. For example, the auxiliary storage device 303 is a ROM, a HDD, or a flash memory. The data stored in the auxiliary storage device 303 is loaded into the memory 302 as needed.
The communication device 304 is a receiver and a transmitter. For example, the communication device 304 is a communication chip or a NIC.
The input/output interface 305 is a port to which an input device and an output device are connected. For example, the input/output interface 305 is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display.

The management device 300 includes elements such as a deception instruction unit 311, a configuration management unit 312, a dummy access detection unit 313, and an alert generation unit 314. These elements are realized by software.

The auxiliary storage device 303 stores a log database 320 .
The auxiliary storage device 303 stores a management program for causing the computer to function as a deception instruction unit 311, a configuration management unit 312, a dummy access detection unit 313, and an alert generation unit 314. The management program is loaded into the memory 302 and executed by the processor 301.
The auxiliary storage device 303 further stores an OS. At least a part of the OS is loaded into the memory 302 and executed by the processor 301.
The processor 301 executes the management program while executing the OS.

Input and output data for the management program is stored in memory unit 390 .
The memory 302 functions as the storage unit 390. However, a storage device such as the auxiliary storage device 303, a register in the processor 301, or a cache memory in the processor 301 may function as the storage unit 390 instead of the memory 302 or together with the memory 302.

The management device 300 may have multiple processors that replace the processor 301.

The management program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or flash memory.

*** Operation Description ***
The operation procedure of the deception system 100 corresponds to a deception method. The operation procedure of the deception system 100 corresponds to a processing procedure by a deception program. The deception program includes a file server program and a management program.

The preparatory steps of the deception method will now be described with reference to FIG.
In step S110, the deception instruction unit 311 transmits a generation instruction.
The creation instruction is data indicating an instruction to create the monitoring target directory 220 .

In step S<b>120 , the monitoring target generation unit 212 replaces the regular directory with the monitoring target directory 220 .
The regular directory is a directory for which a dummy directory is to be generated, and exists in advance in the file server 200 .
A directory that is a dummy of a regular directory is called a "dummy directory".
The monitored directories 220 are a group of directories including regular directories and dummy directories.
Step S120 will be described in detail later.

In step S 130 , the monitoring target creation unit 212 changes the icon image of each directory in the monitoring target directory 220 .
That is, the monitoring target generation unit 212 changes the icon images of the regular directory and the dummy directory.
Step S130 will be described in detail later.

The procedure of step S120 will be described with reference to FIG.
In step S121, the configuration notification unit 211 receives a generation instruction.
Then, the configuration notification unit 211 obtains configuration information of the regular directory. The configuration information of the directory is information that indicates the internal configuration of the directory. For example, the configuration notification unit 211 obtains the configuration information of the regular directory from the OS.

In step S122, the configuration notification unit 211 transmits a normal configuration notification.
The formal configuration notification is data that indicates the configuration information of a formal directory.

In step S123, the configuration management unit 312 receives the normal configuration notification.
Next, the configuration management unit 312 determines the internal configuration of the monitoring target directory 220 based on the internal configuration of the regular directory indicated in the regular configuration notification.
Then, the configuration management unit 312 generates an internal configuration list. The internal configuration list indicates the internal configuration of the monitoring target directory 220. For example, the internal configuration list indicates the name and path of each directory in the monitoring target directory 220.
Furthermore, the configuration management unit 312 stores the internal configuration list in the storage unit 390. This allows the file server 200 to refer to the internal configuration list and identify whether each directory is a regular directory or a dummy directory.

In step S124, the configuration management unit 312 sends the internal configuration list.

In step S125, the monitoring target generation unit 212 receives the internal configuration list.
Then, the monitoring target generation unit 212 generates a directory having the internal structure shown in the internal structure list. The generated directory is the monitoring target directory 220. At this time, the regular directory is integrated into the monitoring target directory 220.
Thereafter, the monitoring target generation unit 212 erases the internal configuration list, so that it is not possible to specify in the file server 200 whether each directory is a regular directory or a dummy directory.

FIG. 6 shows an example of the configuration of each of the regular directory 221 and the monitored directory 220. In FIG.
The regular directory 221 is made up of a directory A, a directory B, and a directory C. The directories A, B, and C are arranged under the root directory. The directories A, B, and C form a hierarchy.
The monitored directory 220 includes a regular directory 221 and a dummy directory for the regular directory 221 .
The directory A1 corresponds to the directory A which is the regular directory 221 .
Under the directory A1, the directory B1 corresponds to the directory B which is a regular directory 221, and under the directory B1, the directory C1 corresponds to the directory C which is a regular directory 221.

In the monitored directory 220, all other directories are dummy directories.
Under directory A1, directory C2 under directory B1 is a dummy directory for directory C1 under directory B1.
Under the directory A1, the directory B2 is a dummy directory for the directory B1, and has the same structure as the directory B1.
Directory A2 is a dummy directory for directory A1 and has the same structure as directory A1.
In this way, the monitored directory 220 includes dummy directories having the same configuration as each of the regular directories 221. This increases the effort required for the attacker 103 to access the regular directory 221, thereby increasing the attacking cost of the attacker 103.

FIG. 7 shows an example of the configuration of each of the regular directory 221 and the monitored directory 220. In FIG.
The regular directory 221 is made up of a directory A, a directory B, a directory C, and a directory D.
In the monitoring target directory 220, a directory D1 under a directory A1 corresponds to the directory D which is a regular directory 221. A directory D2 is a dummy directory for the directory D1.
In order to access the regular directory 221 in the monitored directory 220, the attacker 103 is always forced to make two choices.

The configuration of the monitored directory 220 is not limited to the configuration shown in FIG. 6 or FIG. 7. For example, the monitored directory 220 may include two or more dummy directories for each regular directory 221.

FIG. 8 shows an example of program code for generating the internal configuration list of the monitored directory 220. In FIG.
"dir" represents an input of a program code. The input dir is given in a dictionary format, for example. Specifically, the input dir is a hash table.

In the case of FIG. 7, the input dir is expressed as follows:
dir = {"root":["A"], "A":["B", "D"], "B":["C"], "C":[], "D":[]}
The X in "X" represents a directory name.
"X":["Y"] means that directory Y is a directory below directory X.

By executing the program code on the above input dir, the following output is obtained:
{'root':['A1','A2'],'A1:['B1','B2','D1','D2'],'A2':['B1','B2','D1','D2'],'B1':['C1','C2'],'B2':['C1','C2'],'C1':[],'C2':[],'D1':[],'D2':[]}
The X in 'X' represents a directory name.
A directory whose name ends with "1" is a regular directory 221. That is, A1/B1/C1 and A1/D1 are regular directories 221. X/Y represents directory X and directory Y below directory X.

It should be noted that if a file exists in the regular directory 221, a dummy file is generated in the dummy directory. A file in the regular directory 221 is called a "regular file".
The name and icon image of the dummy file are the same as the name and icon image of the regular file.
The contents of a dummy file are different from the contents of a regular file. Specifically, information that identifies the dummy file is written in the dummy file. For example, the word "dummy" is written in the dummy file. This allows the regular user 101 to realize that he or she has opened the dummy file by mistake when the regular user 101 opens the dummy file.
The size of the dummy file is set to be the same as the size of the legitimate file, so that the attacker 103 cannot distinguish between legitimate files and dummy files by referring to the file size information.

The procedure of step S130 will be described with reference to FIG.
In step S 131 , the configuration manager 312 obtains an icon image for each directory in the monitored directory 220 .
That is, the configuration management unit 312 obtains an icon image for the regular directory and an icon image for the dummy directory.
The icon image for a canonical directory is referred to as a "canonical icon image." The canonical icon image represents a canonical directory.
The icon image for the dummy directory is referred to as a “dummy icon image.” The dummy icon image represents the dummy directory.

FIG. 10 shows examples of the regular icon image 223 and the dummy icon image 224.
A circle is marked on the regular icon image 223. By using an icon image such as the regular icon image 223, the regular user 101 can identify the regular directory at a glance.
A cross is marked on the dummy icon image 224. By using an icon image such as the dummy icon image 224, the authorized user 101 can identify the dummy directory at a glance.
The regular icon image 223 and the dummy icon image 224 are stored in advance in the storage unit 390 .
The configuration management unit 312 copies the regular icon images 223 the same number as the number of regular directories.
The configuration management unit 312 copies the dummy icon images 224 the same number as the number of dummy directories.

Returning to FIG. 9, the description will continue from step S132.
In step S132, the configuration management unit 312 generates names for each icon image. That is, the configuration management unit 312 generates names for the regular icon images and names for the dummy icon images.
The name of the genuine icon image is called the "genuine icon name."
The name of the dummy icon image is called a "dummy icon name."

The regular icon names and dummy icon names are generated as follows.
First, the configuration management unit 312 randomly generates an identifier for a regular icon image and an identifier for a dummy icon image.
An identifier for a genuine icon image is referred to as a "genuine identifier", and an identifier for a dummy icon image is referred to as a "dummy identifier".
Specifically, the configuration management unit 312 randomly generates a character string. The generated character string is referred to as a “random character string.” The configuration management unit 312 then adds a symbol for a regular directory to the random character string to generate a regular identifier, and adds a symbol for a dummy directory to the random character string to generate a dummy identifier.
For example, if "g" is the symbol for a regular directory and "d" is the symbol for a dummy directory, then "g_random character string" is the regular identifier and "d_random character string" is the dummy identifier.
Then, the configuration management unit 312 encrypts the regular identifier to generate an encrypted regular identifier. The encrypted regular identifier is used as a regular icon name. Also, the configuration management unit 312 encrypts the dummy identifier to generate an encrypted dummy identifier. The encrypted dummy identifier is used as a dummy icon name.
A key (encryption key) used for encryption or decryption is registered in advance in the storage unit 390. For example, a common key is used as the encryption key. Then, the regular identifier and the dummy identifier are each encrypted by the common key encryption. In addition, the regular icon name is decrypted into the regular identifier, and the dummy icon name is decrypted into the dummy identifier.

In step S133, the configuration management unit 312 generates a target configuration list using the internal configuration list, the regular icon images, the regular icon names, the dummy icon images, and the dummy icon names.
The target configuration list indicates the contents of the internal configuration list, and indicates an icon image and a name in association with each directory in the monitoring target directory 220. For example, the target configuration list is generated in a table format.

Furthermore, the configuration management unit 312 stores the target configuration list in the storage unit 390. This allows the management device 300 to refer to the target configuration list and identify whether each directory in the monitoring target directory 220 is a regular directory or a dummy directory.
Both the target configuration list and the internal configuration list may be managed, or the internal configuration list may be integrated into the target configuration list.

In step S134, the configuration management unit 312 transmits the target configuration list.
The target configuration list specifies an icon image and a name for each directory in monitored directory 220 .

In step S135, the monitoring target generation unit 212 receives the target configuration list.
The monitoring target generation unit 212 then refers to the target configuration list and sets an icon image shown in the target configuration list to each directory in the monitoring target directory 220 .
That is, the monitoring target generation unit 212 sets a regular icon image in the regular directory, and sets a dummy icon image in the dummy directory.

In step S136, the monitoring target generation unit 212 refers to the target configuration list and sets the names shown in the target configuration list to each icon image.
That is, the monitoring target generation unit 212 sets a regular icon name to the regular icon image, and sets a dummy icon name to the dummy icon image.
Thereafter, the monitoring target generation unit 212 deletes the target configuration list. As a result, in the file server 200, it is not possible to specify whether each icon image is a regular icon image or a dummy icon image by referring to the name of each icon image.

FIG. 11 shows an example of a group of icon images.
Each of the regular icon images 223 has a regular icon name set thereto.
A dummy icon name is set for each of the dummy icon images 224.
The regular icon name and the dummy icon name are each an encrypted identifier, so even if you refer to the name of the icon image, it is not possible to determine whether the icon image is in a regular directory or a dummy directory.
This prevents the malicious program 104 from distinguishing between a regular directory and a dummy directory.

On the other hand, the regular program 102 can use the encryption key to decrypt the directory identifier from the name of the icon image, and distinguish between a regular directory and a dummy directory by referring to the directory identifier. The encryption key is held by the dummy access detection unit 313.

In the following, the operational stages of the deception method will be described.
The recording of an access log in the deception method will be described with reference to FIG.
In step S 141 , the access log recording unit 213 monitors access to the monitoring target directory 220 .
For example, the access log recording unit 213 refers to the event log of the OS.

In step S142, the access log recording unit 213 obtains the monitoring target log.
The monitoring target log is an access log that indicates access to the monitoring target directory 220. The access log indicates the name of the access source and the name of the access destination, etc.
For example, the access log recording unit 213 extracts the monitoring target log from the OS event log.

In step S143, the access log recording unit 213 records the monitored log in the log database 320 by communicating with the management device 300.

Detection of unauthorized access in the deception method will be described with reference to FIG.
In step S151, the dummy access detection unit 313 refers to the log database 320 and detects access to the dummy directory.
Specifically, the dummy access detection unit 313 determines whether an access log indicating an access to the dummy directory is recorded in the log database 320 .
When the access destination name shown in the access log matches the dummy directory name or dummy icon name shown in the target configuration list (or the internal configuration list), the access log indicates an access to the dummy directory.

In step S152, the dummy access detection unit 313 determines whether the access to the dummy directory is an access by the regular program 102 or not.
Specifically, the dummy access detection unit 313 determines whether the name of the access source indicated in the access log is written in the whitelist.
The whitelist is a list of legitimate programs 102, and is stored in advance in the storage unit 390. The legitimate programs 102 run on the OS used by the legitimate user 101. In other words, the whitelist lists the legitimate programs 102 running on the OS used by the legitimate user 101. The whitelist is used to distinguish between the legitimate programs 102 and the malicious programs 104.
If the access to the dummy directory is an access by the legitimate program 102, the access to the dummy directory by the malicious program 104 is not detected and the process ends.
If the access to the dummy directory is not made by the legitimate program 102, access to the dummy directory by the malicious program 104 is detected, and the process proceeds to step S153.

In step S153, the alert generating unit 314 generates an alert.
For example, the alert generating unit 314 displays an alert on a display.

The update of the monitoring target directory 220 in the deception method will be described with reference to FIG.
In step S161, the deception instruction unit 311 periodically transmits an update instruction. For example, the deception instruction unit 311 transmits an update instruction once a day.
The update instruction is data indicating an instruction to update the monitoring target directory 220 .

In step S162, the configuration notification unit 211 receives the update instruction.
Then, the configuration notification unit 211 obtains the configuration information of the monitoring target directory 220. For example, the configuration notification unit 211 obtains the configuration information of the monitoring target directory 220 from the OS.

In step S163, the configuration notification unit 211 transmits a target configuration notification.
The target configuration notification is data indicating the configuration information of the monitoring target directory 220 .

In step S164, the configuration management unit 312 receives the target configuration notification.
Then, the configuration management unit 312 updates the target configuration list based on the internal configuration of the monitoring target directory 220 indicated in the target configuration notification.
Specifically, the configuration management unit 312 adds a dummy directory for a regular directory that is not multiplexed, that is, a dummy directory for a regular directory in which no dummy directory exists, to the monitoring target directory 220. The configuration management unit 312 also associates a dummy icon image and a dummy icon name with the added dummy directory.
The regular directory that is not multiplexed is identified by referring to the configuration information of the monitoring target directory 220. The regular directory that is not multiplexed may be identified by the configuration notification unit 211 in step S162, or may be identified by the configuration management unit 312 in step S164.

In step S165, the configuration management unit 312 sends the updated target configuration list.

In step S166, the monitoring target generation unit 212 receives the updated target configuration list.
Then, the monitoring target creation unit 212 updates the monitoring target directory 220 according to the updated target configuration list. In other words, the monitoring target creation unit 212 adds a dummy directory to a regular directory where no dummy directory exists,
Thereafter, the monitoring target generation unit 212 erases the target configuration list, so that it is not possible to specify whether each directory in the file server 200 is a regular directory or a dummy directory.

***Advantages of First Embodiment***
According to the first embodiment, the presence of the dummy directory hinders the activities of the attacker 103. Furthermore, since the authorized user 101 can distinguish between the authorized directory and the dummy directory by checking the icon images, convenience for the authorized user 101 is maintained. In other words, it is possible to hinder the activities of the attacker 103 while maintaining convenience for the authorized user 101.

The icon image of each directory can be changed by using, for example, the functions of the OS.
When an icon image is changed, the path of the specified icon image is identified by referring to the property information. Therefore, if only two types of icon images, an icon image for a regular directory and an icon image for a dummy directory, are prepared, the following concerns arise. Once an attacker 103 finds any one of the dummy directories, he or she can identify the icon image by referring to the property information of the dummy directory and determine that all directories using the identified icon image are dummy directories. Therefore, even when a CUI is used, it is possible to confirm which directories are regular directories.
Therefore, the deception system 100 prepares individual icon images for each directory. Here, all the icon images used by the regular directories have the same design. Similarly, all the icon images used by the dummy directories have the same design. The names of the icon images of the regular directories and the dummy directories are both encrypted identifiers, and all the names of the icon images are different.
The regular user 101 uses a GUI. Therefore, the regular user 101 can distinguish between a regular directory and a dummy directory by looking at the icon images. On the other hand, the attacker 103 uses a CUI. However, the attacker 103 cannot distinguish between a regular directory and a dummy directory by looking at the names of the icon images.

In the deception system 100, all directories and files are multiplexed. Therefore, there are two or more options, including a dummy, for each directory hierarchy. Furthermore, the attacker 103 is not notified when a dummy directory is accessed. Therefore, the attacker 103 does not realize that he or she is searching a dummy directory until he or she opens the dummy file. Furthermore, even if a search tool is used, multiple directories with the same name are found, and the directory cannot be narrowed down. Therefore, the search tool is not an effective means for the attacker 103. Furthermore, access to a dummy directory triggers the output of an attack detection alert. Therefore, even if the attacker 103 searches for a single file, he or she must do so while avoiding access to the dummy directory. This places a burden on the attacker.

Consider that the authorized user 101 performs file browsing on a directory structure that includes a dummy directory. At this time, even the authorized user 101 may mistakenly select a dummy directory. However, if a dummy directory other than the lowest level is selected, all the directories displayed are dummy directories, and therefore all icon images are marked with a cross. And since all the icon images displayed are icon images of dummy directories, the authorized user 101 can realize that he has mistakenly selected the dummy directory. Also, if the lowest level dummy directory is selected, only files exist in the dummy directory, and therefore no icon image of the dummy directory is displayed. In this case, the authorized user 101 opens a file (dummy file) in the dummy directory. However, the dummy file contains information that identifies the dummy file. Therefore, the authorized user 101 can realize that he has mistakenly selected the dummy directory at the time of opening the dummy file.

Regarding access to the dummy directory by the legitimate program 102, an alert can be prevented from being generated by excluding access by the legitimate program 102 using a whitelist. Specifically, it is possible to prevent an alert from being generated if the program that has accessed the dummy directory is a program (legitimate program 102) that is listed on the whitelist. In this way, by using the whitelist, it is possible to distinguish between the legitimate program 102 and the malicious program 104.

For the reasons described above, the deception system 100 can reduce false positives of access by malicious programs 104 while maintaining convenience for legitimate users 101 and legitimate programs 102 .
Furthermore, after a cyber attack is discovered, it is possible to grasp the access status to the dummy directory, thereby making it possible to grasp the activities of the attacker 103 and implement an incident response.

Embodiment 2.
The embodiment for reducing false detection of unauthorized access will be described with reference to Figs. 15 and 16, focusing mainly on the differences from the first embodiment.

***Configuration Description***
The configuration of the deception system 100 is the same as that in the first embodiment (see FIG. 1). However, part of the configuration of the management device 300 is different from that in the first embodiment.

The configuration of the management device 300 will be described with reference to FIG.
The management device 300 further includes elements such as an access confirmation unit 315 and an access confirmation log recording unit 316 .
The management program further causes the computer to function as an access confirmation unit 315 and an access confirmation log recording unit 316 .

*** Operation Description ***
The preparation stage of the deception method is the same as the operation in the first embodiment (see FIG. 4).
During the operation phase of the deception method, the operations for recording and updating are the same as those in embodiment 1 (see Figures 12 and 14).

Based on Figure 16, we will explain how to detect unauthorized access using the deception method.

In step S251, the dummy access detection unit 313 refers to the log database 320 and detects access to the dummy directory.
Step S251 is the same as step S151 in the first embodiment.

In step S252, the dummy access detection unit 313 determines whether the access to the dummy directory is an access by the regular program 102 or not.
Step S252 is the same as step S152 in the first embodiment.
If the access to the dummy directory is made by the regular program 102, the process ends.
If the access to the dummy directory is not made by the regular program 102, the process proceeds to step S253.

In step S253, the access confirmation unit 315 communicates with the user terminal of the authorized user 101 to cause the user terminal of the authorized user 101 to display an access confirmation screen.
The access confirmation screen is a screen for confirming whether or not access to the dummy directory is the result of an operation by the authorized user 101. The access confirmation screen presents information necessary for the authorized user 101 to judge whether or not access to the dummy directory has been made, such as the directory name, path information, and access time.
The specific form of the access confirmation screen is a "pop-up."

In step S254, the access confirmation log recording unit 316 accepts responses to the access confirmation screen for a certain period of time.

In step S255, the access confirmation log recording unit 316 generates an access confirmation log including the response to the access confirmation screen.
The response to the access confirmation screen indicates the following information: No response was received within a certain period of time (no response). Authorized user 101 accessed a dummy directory. Authorized user 101 did not access the dummy directory. The response to the access confirmation screen was not the result of a human operation. Whether or not the response to the access confirmation screen was the result of a human operation can be determined using a tool called CAPCHA.
Then, the access confirmation log recording unit 316 records the access confirmation log in the log database 320 .

In step S256, the alert generating unit 314 refers to the access confirmation log in the log database 320, and determines whether or not an alert is necessary based on the response to the access confirmation screen.
When the attacker 103 or the malicious program 104 accesses the dummy directory, an alert must be issued.
For example, if no response is received on the access confirmation screen, the alert generating unit 314 determines that an alert is necessary. If a response is received that the authorized user 101 is not accessing the dummy directory, the alert generating unit 314 determines that an alert is necessary. If the response on the access confirmation screen is not the result of a human operation, the alert generating unit 314 determines that an alert is necessary.
If an alert is required, processing proceeds to step S257.
If no alert is required, the process ends.

In step S257, the alert generating unit 314 generates an alert.
Step S257 is the same as step S153 in the first embodiment.

***Advantages of the Second Embodiment***
When the deception system 100 detects access to the dummy directory, it displays a pop-up (an example of an access confirmation screen) to the authorized user 101. Since the authorized user 101 uses a GUI, the authorized user 101 can respond to the pop-up. Therefore, it is possible to determine whether the access to the dummy directory is made by the authorized user 101 or by an attacker 103 using a CUI. This makes it possible to reduce false positives of unauthorized access.

In other words, the deception system 100 can perform pop-up approval for access to the dummy directory. If the user is a legitimate user 101 using a GUI, approval can be performed correctly. This makes it possible to exclude logs of access to the dummy directory due to incorrect operation by the legitimate user 101, thereby reducing false positives of unauthorized access. On the other hand, an attacker 103 using a CUI cannot pass the pop-up approval. The legitimate user 101 can quickly become aware of a cyber attack because a pop-up approval is required for an access that the legitimate user 101 does not remember making.

***Additional Information on the Implementation ***
Each embodiment is an example of a preferred embodiment, and is not intended to limit the technical scope of the present disclosure. Each embodiment may be implemented in part or in combination with other embodiments. The procedures described using flow charts, etc. may be modified as appropriate.

The deception system 100 may be realized by one device (computer) or three or more devices. Each of the file server 200 and the management device 300 may be realized by two or more devices.
The elements of the deception system 100, that is, the "units", may be realized as software, hardware, firmware or a combination of these.
The "part" which is an element of the deception system 100 may be read as a "process" or a "step."

100 Deception system, 101 Regular user, 102 Regular program, 103 Attacker, 104 Malicious program, 200 File server, 201 Processor, 202
Memory, 203, auxiliary storage device, 204, communication device, 205, input/output interface, 211, configuration notification unit, 212, monitoring target generation unit, 213, access log recording unit, 220, monitoring target directory, 221, regular directory, 223, regular icon image, 224, dummy icon image, 300, management device, 301, processor, 302, memory, 303, auxiliary storage device, 304, communication device, 305, input/output interface, 311, deception instruction unit, 312, configuration management unit, 313, dummy access detection unit, 314, alert generation unit, 315, access confirmation unit, 316, access confirmation log recording unit, 320, log database, 390, storage unit.

Claims (9)

A deception system for dealing with a cyber attack in which a regular directory accessed by a regular user using a graphical user interface is accessed using a character user interface , comprising:
a configuration management unit that determines an internal configuration of a monitoring target directory including the regular directory and a dummy directory that is a dummy of the regular directory, and designates a regular icon image that is an icon image for the regular directory and a dummy icon image that is an icon image for the dummy directory;
a monitoring target generating unit that generates the monitoring target directory based on an internal configuration list indicating the determined internal configuration, sets the regular icon image in the regular directory, and sets the dummy icon image in the dummy directory;
A deception system comprising: the configuration management unit generates a regular identifier that is an identifier for the regular icon image, encrypts the regular identifier to generate an encrypted regular identifier, generates a dummy identifier that is an identifier for the dummy icon image, and encrypts the dummy identifier to generate an encrypted dummy identifier;
The deception system of claim 1 , wherein the monitoring target generation unit sets the encrypted regular identifier to the regular icon image as the name of the regular icon image, and sets the encrypted dummy identifier to the dummy icon image as the name of the dummy icon image. an access log recording unit that monitors access to the monitoring target directory and records the access log in a log database;
a dummy access detection unit that detects an access to the dummy directory by referring to the log database and the internal configuration list, and detects an access to the dummy directory by a malicious program by referring to a whitelist that is a list of legitimate programs;
an alert generating unit that generates an alert when access to the dummy directory by the malicious program is detected;
The deception system according to claim 1 or 2, comprising: an access log recording unit that monitors access to the monitoring target directory and records the access log in a log database;
a dummy access detection unit that detects an access to the dummy directory by referring to the log database and the internal configuration list, and determines whether the access to the dummy directory is an access made by a legitimate program by referring to a whitelist that is a list of legitimate programs;
an access confirmation unit that, when an access to the dummy directory is not an access made by a legitimate program, displays an access confirmation screen on a user terminal of the legitimate user for confirming whether or not the access to the dummy directory is made by an operation of the legitimate user;
an alert generating unit that determines whether an alert is necessary based on a response result to the access confirmation screen, and generates an alert when it is determined that an alert is necessary;
The deception system according to claim 1 or 2, comprising: The deception system comprises:
a deception instruction unit that transmits a generation instruction for instructing the generation of the monitoring target directory;
a configuration notification unit that receives the generation instruction and transmits a regular configuration notification indicating an internal configuration of the regular directory;
Equipped with
the configuration management unit receives the normal configuration notification, determines the internal configuration of the monitoring target directory based on the internal configuration of the normal directory indicated in the normal configuration notification, and transmits the internal configuration list;
The deception system according to claim 1 , wherein the monitoring target generation unit receives the internal configuration list and generates the monitoring target directory based on the internal configuration list. the configuration management unit generates a target configuration list indicating the internal configuration of the monitoring target directory, indicating the regular icon image in association with the regular directory, and indicating the dummy icon image in association with the dummy directory, and transmits the target configuration list;
The deception system described in claim 5, wherein the monitoring target generation unit receives the target configuration list, refers to the target configuration list, sets the regular icon image in the regular directory, and sets the dummy icon image in the dummy directory. The deception instruction unit periodically transmits an update instruction to instruct updating of the monitoring target directory,
the configuration notification unit receives the update instruction and transmits a target configuration notification indicating an internal configuration of the monitoring target directory;
The configuration management unit receives the target configuration notification, updates the target configuration list based on the internal configuration of the monitoring target directory indicated in the target configuration notification, and transmits the updated target configuration list;
The deception system of claim 6 , wherein the monitoring target generation unit receives the updated target configuration list and updates the monitoring target directory in accordance with the updated target configuration list. A deception method for dealing with a cyber attack in which a legitimate directory accessed by a legitimate user using a graphical user interface is accessed using a character user interface , comprising:
a configuration management unit determines an internal configuration of a monitoring target directory including the regular directory and a dummy directory that is a dummy of the regular directory, and specifies a regular icon image that is an icon image for the regular directory and a dummy icon image that is an icon image for the dummy directory;
A deception method in which a monitoring target generation unit generates the monitoring target directory based on an internal configuration list indicating a determined internal configuration, sets the regular icon image in the regular directory, and sets the dummy icon image in the dummy directory. A deception program for dealing with a cyber attack in which a regular directory accessed by a regular user using a graphical user interface is accessed using a character user interface , comprising:
a configuration management process for determining an internal configuration of a monitoring target directory including the regular directory and a dummy directory that is a dummy of the regular directory, and for designating a regular icon image that is an icon image for the regular directory and a dummy icon image that is an icon image for the dummy directory;
a monitoring target generating process for generating the monitoring target directory based on an internal configuration list indicating the determined internal configuration, setting the regular icon image in the regular directory, and setting the dummy icon image in the dummy directory;
A deceptive program that causes a computer to execute the following.

Images