Worm infection detecting device
AssigneeFujitsu Limited
InventorJun Itoh
Life of this patent
Estimating the term…
Abstract
When a program consisting of a plurality of processes is installed in a device, its processing route in the case where the processes normally advance is built as a database, based on the knowledge of a program designer or the like. When the program is executed, routing information indicating the actual process flow along each process flow is generated. Before a new process is activated, the route till then is compared with the correct route stored in the database. If the route till then is abnormal, it is determined that the device is infected with a worm, and the communication port of a device in which the program is installed is cut off and the maintenance terminal is notified of the abnormality.
Claims15
A detection device for detecting that a device in which a program is executed is infected with a worm, comprising:
- a route storage unit to store a processing route in which the program is correctly executed, the processing route being a path of a process flow when the program is executed correctly in the device connected to a network, by which the program is executed;
- a route recording unit to record an actual processing route in the device connected to the network, by which the program is executed while the program is actually being executed;
- a worm infection determining unit to determine whether the device is infected with a worm, by determining whether the route recorded by the route recording unit, when the program is actually being executed, coincides with the route stored in the route storage unit when the program not infected by a worm is executed;
- and
- an abnormal route storage unit to store a processing route when a device is infected with a worm,
- wherein
- the worm infection determining unit determines that the device is infected with a worm when a route recorded in the route recording unit coincides with a route stored in the abnormal route storage unit.
A detection device for detecting that a device in which a program is executed is infected with a worm, comprising:
- a route storage unit to store a processing route in which the program is correctly executed, the processing route being a path of a process flow when the program is executed correctly in the device connected to a network, by which the program is executed;
- a route recording unit to record an actual processing route in the device connected to the network, by which the program is executed while the program is actually being executed;
- a worm infection determining unit to determine whether the device is infected with a worm, by determining whether the route recorded by the route recording unit coincides with the route stored in the route storage unit;
- and
- a HOP value storage unit for storing a HOP value indicating how many process units constituting a process is performed by executing the program, wherein
- when the HOP value is within a prescribed range, the worm infection determining unit determines that the device is infected with a worm.
A detection device for detecting that a device in which a program is executed is infected with a worm, comprising:
- a route storage unit to store a processing route in which the program is correctly executed, the processing route being a path of a process flow when the program is executed correctly in the device connected to a network, by which the program is executed;
- a route recording unit to record an actual processing route in the device connected to the network, by which the program is executed while the program is actually being executed;
- a worm infection determining unit to determine whether the device is infected with a worm, by determining whether the route recorded by the route recording unit coincides with the route stored in the route storage unit;
- and
- a pseudo-process request unit to issue a pseudo-process request to the program,
- wherein
- the worm infection determining unit determines that the device is infected with a worm, in response to the process request issued to the program by the pseudo-process request unit.
A detection method executed by a computer for detecting that a device in which a program is executed is infected with a worm, comprising:
- storing a processing route in which the program is correctly executed, the processing route being a path of a process flow when the program is executed correctly in the device connected to a network, by which the program is executed;
- recording an actual processing route in the device connected to the network, by which the program is executed while the program is actually being executed;
- determining whether the device is infected with a worm, by determining whether the recorded route, when the program is actually being executed, coincides with the stored route when the program not infected by a worm is executed;
- and
- storing a HOP value indicating how many process units constituting a process are performed by executing the program, wherein
- when the HOP value is within a range, determining that the device is infected with a worm.
A non-transitory computer readable storage medium storing a program for enabling a computer to realize a detection method for detecting that a device in which a program is executed is infected with a worm, the detection method comprising:
- storing a processing route in which the program is correctly executed, the processing route being a path of a process flow when the program is executed correctly in the device connected to a network, by which the program is executed
- recording an actual processing route in the device connected to the network, by which the program is executed while the program is actually being executed;
- determining whether the device is infected with a worm, by determining whether the recorded route, when the device is actually being executed, coincides with the stored route when the device not infected by a worm is executed and
- storing a HOP value indicating how many process units constituting a process are performed by executing the program, wherein
- when the HOP value is within a range, determining that the device is infected with a worm.
The method according to clam 14, further comprising:
- instructing, with the psedo-process request, an execution storage for each process unit performed by the program.
Dependencies are inferred from the claim text.