Back to results
US 12,608,472 B2Granted
Detection device, detection method, and detection program
AssigneeNTT, Inc.
InventorsKimihiro Yamakoshi, Nobuhiro Chiba, Hiroyoshi Takiguchi, Yoshiaki Nakajima
Life of this patent
Estimating the term…
Abstract
A collation unit checks the presence/absence of alteration of all files when an apparatus is started. A cyclic collation unit checks the presence/absence of alteration of a predetermined file at predetermined time intervals during the operation of the apparatus.
Claims5
A detection device, comprising:
- a memory;
- and
- a processor coupled to the memory and programmed to execute a process to:
- first check presence/absence of alteration of all files when an Internet-Of-Things (IOT) hardware is started;
- second check the presence/absence of alteration of a predetermined file at predetermined time intervals during an operation of the IOT hardware;
- generate a list of files to be read from a nonvolatile memory of the IOT hardware during the operation of the IOT hardware by using a file read log from the nonvolatile memory of the IOT hardware in a predetermined period after the IOT hardware is started;
- and
- monitor the file read log from the nonvolatile memory during the operation of the IOT hardware, and add a file that is not in the list, wherein
- the second check includes check the presence/absence of alteration of a file described in the generated list, and
- the monitor includes monitor the file read log during actual operation of the IOT hardware, and when a file not listed in the list is included in the file read log, add a file path and a hash value of the file to the list.
7 more elements
A detection method executed by a detection device, the detection method comprising:
- a collation step of checking presence/absence of alteration of all files when an IOT hardware is started;
- a cyclic collation step of checking the presence/absence of alteration of a predetermined file at predetermined time intervals during an operation of the IOT hardware;
- generating a list of files to be read from a nonvolatile memory of the IOT hardware during the operation of the IOT hardware by using a file read log from the nonvolatile memory of the IOT hardware in a predetermined period after the IOT hardware is started;
- and
- monitoring the file read log from the nonvolatile memory during the operation of the IOT hardware, and add a file that is not in the list, wherein
- the cyclic collation step includes checking the presence/absence of alteration of a file described in the generated list, and
- the monitoring includes monitoring the file read log during actual operation of the IOT hardware, and when a file not listed in the list is included in the file read log, adding a file path and a hash value of the file to the list.
4 more elements
A non-transitory computer-readable recording medium having stored a detection program for causing a computer to execute:
- a collation step of checking presence/absence of alteration of all files when an IOT hardware is started;
- a cyclic collation step of checking the presence/absence of alteration of a predetermined file at predetermined time intervals during an operation of the IOT hardware;
- generating a list of files to be read from a nonvolatile memory of the IOT hardware during the operation of the IOT hardware by using a file read log from the nonvolatile memory of the IOT hardware in a predetermined period after the IOT hardware is started;
- and
- monitoring the file read log from the nonvolatile memory during the operation of the IOT hardware, and add a file that is not in the list, wherein
- the cyclic collation step includes checking the presence/absence of alteration of a file described in the generated list, and
- the monitoring includes monitoring the file read log during actual operation of the IOT hardware, and when a file not listed in the list is included in the file read log, adding a file path and a hash value of the file to the list.
4 more elements
Dependencies are inferred from the claim text.