Detection device, detection method, and detection program
AssigneeNTT, Inc.
InventorsNobuhiro Chiba, Hiroyoshi Takiguchi, Takaaki Koyama, Yoshiaki Nakajima
Life of this patent
Estimating the term…
Abstract
A detection device includes processing circuitry configured to acquire position information and a file size of a falsification detection target file, and determine a change in the position information or the file size acquired, and detect falsification of the falsification detection target file in a case where there is a change in the position information or the file size.
Claims12
A detection device comprising:
- processing circuitry configured to:
- acquire position information and a file size of a falsification detection target file, wherein the position information describes a memory block storing at least a part of the falsification detection target file;
- determine a change in the position information and the file size, wherein the change in the position information comprises moving at least a part of the falsification detection target file from the memory block to another memory block;
- and
- when there is the change in the position information, detect falsification indicating overwriting update of the falsification detection target file.
A detection method executed by a detection device comprising:
- acquiring position information and a file size of a falsification detection target file, wherein the position information describes a memory block storing at least a part of the falsification detection target file;
- determining a change in the position information and the file size, wherein the change in the position information comprises moving at least a part of the falsification detection target file from the memory block to another memory block;
- and
- when there is the change in the position information, detect falsification indicating overwriting update of the falsification detection target file.
A non-transitory computer-readable recording medium storing therein a detection program that causes a computer to execute a process comprising:
- acquiring position information and a file size of a falsification detection target file, wherein the position information describes a memory block storing at least a part of the falsification detection target file;
- determining a change in the position information and the file size, wherein the change in the position information comprises moving at least a part of the falsification detection target file from the memory block to another memory block;
- and
- when there is the change in the position information, detect falsification indicating overwriting update of the falsification detection target file.
Dependencies are inferred from the claim text.