Fujitsu Corporation

Osamu Koyano

Satoru Torii

Naohiro Tamura

Mayuko Morita

Takuya Habu

Masashi Mitomo

Yoshiki Higashikado

Fumie Takizawa

An unauthorized access prevention system that includes a search unit searching the flowing-in path of the unauthorized access to the services by a Web system disclosed by a user's ISP, a determination unit determining the place to implement a countermeasure for protecting the services from the unauthorized access based on the result of the search, and a notification unit notifying, according to a determination that that the countermeasure is implemented in the flow source that makes the unauthorized access flow into the user's communication network, the determination to the flow source.

Unauthorized access prevention system

An unauthorized access prevention system includes a countermeasure method determination unit determining a method of taking countermeasures to protect a destination against unauthorized access based on a rate indicating a probability that predetermined traffic is unauthorized access. The rate is determined by calculating a number of times that the countermeasures were taken and subtracting a number of times that countermeasures were suspended, and dividing the resultant number of times that countermeasures were taken without suspension by the number of times that countermeasures were taken, for the predetermined traffic. The system also includes a storage device storing the number of times that countermeasures were taken and the number of times that countermeasures were taken without suspension. A countermeasure execution control unit controls when to take the countermeasures in the determined method. The countermeasure method determination unit selects an appropriate method of taking countermeasures by comparing the rate to predetermined threshold values.

A malicious access-detecting apparatus which is cable of grasping the whole aspect of an attack which can occur, before it actually occurs. A monitoring information-collecting section collects monitoring information including the network events detected by the monitoring devices on networks. A malicious apparatus group-deriving section retrieves a corresponding piece of the event information from an event information storage device, and derives, based on the retrieved piece of the event information, apparatuses that are involved in relevant detected network events which belong to the predetermined type of network events and of which addresses of senders or recipients are same, as a malicious apparatus group involved in the predetermined type of malicious access. A storage section stores information on each derived malicious apparatus group. An output section outputs a list of the each derived malicious apparatus group.

Malicious access-detecting apparatus, malicious access-detecting method, malicious access-detecting program, and distributed denial-of-service attack-detecting apparatus

This invention is to minimize influence to other network by preventing unauthorized accesses such as DDoS attacks and probing by worms. When the blocking apparatusesanddetect outbound packets by the DDoS attacks or by the probing by the worm, they carry out the Egress filtering for such outbound packets to prevent the packets relating to the unauthorized access from being sent to the backbone network. Moreover, because a notice to the effect that the unauthorized access is detected is sent to other blocking apparatusesandvia the management apparatus, for example, the blocking apparatusesandprecautionarily carry out the Ingress filtering to prevent the packets relating to the unauthorized access from being sent to the network C and D.

Unauthorized access blocking apparatus, method, program and system

An unauthorized access detection device capable of detecting unauthorized accesses which are made through preparation, in real time. When a packet travels on a network, a key data extractor obtains the packet and obtains key data. Next an ongoing scenario detector searches an ongoing scenario storage unit for an ongoing scenario with the key data as search keys. A check unit determines whether the execution of the process indicated by the packet after the ongoing scenario detected by the ongoing scenario detector follows an unauthorized access scenario being stored in an unauthorized access scenario storage unit. Then a report output unit outputs an unauthorized access report depending on the check result of the check unit.

Growing community of inventors

Kawasaki, Japan

Osamu Koyano