JP7796635B2 - Unauthorized access detection device, unauthorized access detection method, and unauthorized access detection program - Google Patents

Description

The present invention relates to a method for detecting unauthorized access.

Conventionally, measures to prevent online fraudulent activities have become essential when providing services via the Internet. For example, Non-Patent Document 1 introduces an authentication system that performs additional checks, such as verification by phone or email, on accounts that may be subject to fraudulent use.

Amazon Fraud Detector, Internet <https://aws.amazon.com/jp/fraud-detector/>

As damage caused by more sophisticated unauthorized access attacks increases, technology to prevent unauthorized access is needed.
Known technologies for detecting unauthorized access include those that detect large amounts of access from specific IP addresses as fraudulent use, but these are becoming less effective because detection can be evaded by methods such as changing the IP address before it is determined to be large amounts of access.
On the other hand, due to the existence of access via proxies, it was difficult to lower the threshold for the number of accesses per hour that is considered to be a large number of accesses from the same IP address, as this would result in an increase in false positives.

The present invention aims to provide an unauthorized access detection device, an unauthorized access detection method, and an unauthorized access detection program that can detect unauthorized access even when there are only a few accesses.

The unauthorized access detection device of the present invention comprises a communications information acquisition unit that acquires communications information accessed via a network to a server; a score acquisition unit that inputs the user ID in the communications information into password complexity detection software and acquires a score indicating the level of security of the password based on the complexity of the character string; an access counting unit that counts the number of accesses to the server from the same IP address, weighting the number of accesses by a relatively larger value the higher the score; and an access control unit that determines that unauthorized access has occurred and performs specified access control when the number of accesses in a specified period exceeds a threshold.

The access counting unit may further weight and count the access count in accordance with predetermined rules based on the communication information.

The score acquisition unit may acquire a relatively higher score for the ID if the similarity to words contained in the dictionary data is low and a brute force attack is more difficult.

The unauthorized access detection method of the present invention is executed by a computer, and includes the following steps: a communications information acquisition step of acquiring communications information about access to a server via a network; a score acquisition step of inputting the user ID in the communications information into password complexity detection software and acquiring a score indicating the level of security of the password based on the complexity of the character string; an access count step of counting the number of accesses to the server from the same IP address, weighting the number of accesses by a relatively larger value the higher the score; and an access control step of determining unauthorized access and implementing specified access control if the number of accesses in a specified period exceeds a threshold.

The unauthorized access detection program of the present invention causes a computer to function as the unauthorized access detection device.

This invention makes it possible to detect unauthorized access even with a small number of accesses.

FIG. 2 is a diagram illustrating a functional configuration of an unauthorized access detection device according to an embodiment. FIG. 10 is a first diagram illustrating an example of the output of password complexity detection software used by the score acquisition unit in the embodiment. FIG. 10 is a second diagram illustrating an example of the output of the password complexity detection software used by the score acquisition unit in the embodiment. FIG. 10 is a third diagram illustrating an example of the output of the password complexity detection software used by the score acquisition unit in the embodiment. 10 is a flowchart showing a processing procedure of an unauthorized access detection method according to an embodiment.

An example of an embodiment of the present invention will be described below.
In the unauthorized access detection method of this embodiment, the complexity (randomness) of IDs currently logged in or attempting to log in to the server that is the target of unauthorized access detection is used as an indicator, and access restrictions are imposed by counting the number of accesses with a higher weight given to accesses using IDs that are likely to have been automatically generated by an attacker.

FIG. 1 is a diagram showing the functional configuration of an unauthorized access detection device 1 according to this embodiment.
The unauthorized access detection device 1 is an information processing device that includes a control unit 10, a memory unit 20, and various input/output interfaces, etc., and acquires communication information for a server to be detected and detects access from an ID that is suspected of being unauthorized.
The unauthorized access detection device 1 may be incorporated as a function of the server to be detected, or may be configured as an external management server capable of collecting communication information within a predetermined network.

The control unit 10 controls the entire unauthorized access detection device 1, and realizes each function of this embodiment by appropriately reading and executing various programs stored in the memory unit 20. The control unit 10 may be a CPU.

The memory unit 20 is a storage area for various programs and data that enable the hardware group to function as the unauthorized access detection device 1, and may be ROM, RAM, flash memory, a hard disk drive (HDD), etc.

The control unit 10 includes a communication information acquisition unit 11, a score acquisition unit 12, an access count unit 13, and an access control unit 14.

The communication information acquisition unit 11 acquires communication information from accesses to the server via the network. The communication information includes at least the IP address of the access source and the ID of the user who made the access.

The score acquisition unit 12 inputs the user ID in the communication information into password complexity detection software and obtains a score indicating the level of security of the password based on the complexity of the character string.

Here, the score acquisition unit 12 uses known software such as "zxcvbn" to acquire a relatively high score for an ID, the lower the similarity to words contained in the dictionary data and the more difficult a brute force attack is.
A high score indicates that the password is complex, i.e., highly secure (strong), and when used as an ID, an ID with a high score indicates that it is highly random and likely to have been automatically generated.

The access counting unit 13 counts the number of accesses from the IP address of the access source obtained from the communication information to the detection target server, weighting the number of accesses with a relatively larger value (≧1) as the score increases.
The access counting unit 13 may further adjust the weight in accordance with a predetermined rule based on the communication information. Specifically, for example, the IP address of the access source may be evaluated according to the domain, and the number of accesses may be counted several times or several tens of times higher for accesses from a domain that is suspected of being fraudulent in advance or for accesses that are suspected of being fraudulent based on other known detection methods.

If the number of accesses counted over a specified period exceeds a threshold, the access control unit 14 determines that the access is unauthorized and performs specified access control, such as denying access from the same IP address or presenting a warning message to the user.

2 to 4 are diagrams illustrating examples of the output of the password complexity detection software used by the score acquisition unit 12 in this embodiment.
Here, we show an example of the evaluation results output when three IDs, "Tr0ub4dour&3,""jAFdeaOVZa3fnnsea7eiNR," and "s1mple," are input into the password complexity detection software "zxcvbn," instead of the password that is its intended use.

Password complexity detection software evaluates the password complexity of an input string. For example, a string that retains its visibility as an English word, such as replacing "a" with "@," will be given a low score, and the software will evaluate the string as unsuitable as a password.
In the case of values that are supposed to be shown to others as the user's own name, such as IDs, users who use values with extremely poor visibility are likely to be automatically generating IDs and are likely to be engaging in aggressive unauthorized access. Therefore, by giving a higher score, i.e., an ID that is shown to be a password that is difficult to guess and is secure, a lower score is given, and by weighting it as two or more consecutive accesses, even a small number of accesses can be determined to be unauthorized access.

For example, IDs entered into password complexity detection software are scored on a five-point scale: "Tr0ub4dour&3" receives a score of 2; "jAFdeaOVZa3fnnsea7eiNR," which is more random and difficult to guess, receives a score of 4; and "s1mple," which resembles an English word and is relatively easy to guess, receives a score of 0.
The access counting unit 13 counts a weighted number of times according to this score, for example, 1 time for a score of 0, 10 times for a score of 1, and so on.

FIG. 5 is a flowchart showing the processing steps of the unauthorized access detection method according to this embodiment.
This process is repeatedly executed at a predetermined timing, such as at a fixed cycle or when communication is detected.

In step S1, the communication information acquisition unit 11 acquires communication information regarding access to the server to be detected.

In step S2, the score acquisition unit 12 acquires the ID of the accessing user and uses password complexity detection software to acquire a score indicating the complexity of this ID.

In step S3, the access counting unit 13 determines a weight value (≧1) for the number of accesses based on the score obtained in step S2.

In step S4, the access counting unit 13 counts the number of accesses to the target server within a specified period for each IP address of the access source, in accordance with the weight value determined in step S3.

In step S5, the access control unit 14 determines whether the number of accesses counted in step S4 exceeds a preset threshold. If the determination is YES, processing proceeds to step S6; if the determination is NO, processing ends.

In step S6, for IP addresses whose access count exceeds the threshold in step S5, the access control unit 14 denies access from the IP address in question, or outputs a warning to the user (ID) in question to restrict access.

According to this embodiment, the unauthorized access detection device 1 inputs the ID of a user who has accessed the server into password complexity detection software, obtains a score indicating the level of security of the password based on the complexity of the character string, and counts the number of accesses to the server from the same IP address, weighting the number of accesses with a relatively larger value the higher the score.
As a result, when the number of accesses in a specified period exceeds a threshold, the unauthorized access detection device 1 determines that the access is unauthorized and performs specified access control, and assigns a greater weight to accesses that have an ID that is a random character string that is suspected to be automatically generated.Therefore, even if there are only a few accesses, the threshold will be exceeded before the attacker changes their IP address, and unauthorized access can be detected appropriately.

By further weighting and counting the number of accesses according to predetermined rules based on communication information, the unauthorized access detection device 1 detects unauthorized access using an index that takes other criteria into account, which is expected to improve detection accuracy.

The unauthorized access detection device 1 efficiently identifies automatically generated randomly generated attacker IDs and appropriately detects unauthorized access by using a method that obtains a relatively high score for IDs that have a low similarity to words contained in dictionary data and are more difficult to attack with through brute force.

This will enable, for example, detection of unauthorized access on the network and prevention of unauthorized logins to services, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most favorable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

The unauthorized access detection method using the unauthorized access detection device 1 is realized by software. When realized by software, the programs that make up this software are installed on an information processing device (computer). These programs may be recorded on removable media such as CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded.

REFERENCE SIGNS LIST 1 Unauthorized access detection device 10 Control unit 11 Communication information acquisition unit 12 Score acquisition unit 13 Access number count unit 14 Access control unit 20 Storage unit

Claims (5)

a communication information acquisition unit that acquires communication information accessed via a network to a server;
a score acquisition unit that inputs the user ID in the communication information into password complexity detection software and acquires a score that indicates the level of security as a password based on the complexity of a character string;
an access counting unit that counts the number of accesses to the server from the same IP address by weighting the number of accesses with a relatively larger value as the score increases;
and an access control unit that, when the number of accesses in a predetermined period exceeds a threshold, determines that the access is unauthorized and performs predetermined access control. The unauthorized access detection device according to claim 1, wherein the access counting unit further weights and counts the number of accesses in accordance with predetermined rules based on the communication information. The unauthorized access detection device described in claim 1 or claim 2, wherein the score acquisition unit acquires a relatively higher score for the ID when the similarity to words contained in the dictionary data is low and a brute force attack is more difficult. a communication information acquisition step of acquiring communication information accessed via a network to a server;
a score acquisition step of inputting the user ID in the communication information into password complexity detection software and acquiring a score indicating the level of security as a password based on the complexity of a character string;
an access counting step of counting the number of accesses from the same IP address to the server by weighting the number of accesses by a relatively larger value as the score increases;
and an access control step of determining that the access is unauthorized and performing predetermined access control when the number of accesses in a predetermined period exceeds a threshold. An unauthorized access detection program for causing a computer to function as the unauthorized access detection device described in claim 1 or 2.