To prevent an event analysis of IDS and warning system capable of analyzing event data when unauthorized access generation or the like occurs in a network including the case in which there exists an attacker in the network, detecting the unauthorized access quickly after the communication event, issuing an appropriate alert, treating unauthorized accesses appropriately, and suppressing secondary damage.
In the system, a processing control unit 30 analyzes event data and acquires total numerical information totaling the number of communication event occurrences common in content in one or a plurality of data entry contents of the event data, and an unauthorized access detection part 40 checks whether or not event data content or total numerical value information coincides with specified detection conditions to determine whether or not the access is unauthorized access. Thus, abnormality occurring within the network can be identified and detected on the basis of total numerical value information, unauthorized access states can be detected regardless of whether the attacker is outside or inside, and it can be notified as an appropriate alert.
ARAKANE YOSUKE
| JP2005038116A | 2005-02-10 |
竹森敬祐（外４名）: "Ｓｅｃｕｒｉｔｙ Ｏｐｅｒａｔｉｏｎ ＣｅｎｔｅｒのためのＩＤＳログ分析支援システム", 電子情報通信学会論文誌, vol. 87, no. 6, JPN6010060397, 1 June 2004 (2004-06-01), JP, pages 816 - 825, ISSN: 0001758970
Next Patent: SYSTEM FOR DISTRIBUTING TELEPHONY WORK AND ITS PROGRAM