FALSIFICATION DETECTION DEVICE, FALSIFICATION DETECTION METHOD, AND FALSIFICATION DETECTION PROGRAM
A tampering detection device includes tampering detection circuitry configured to acquire an access pattern of a monitoring target file, extract a time-series pattern of access for each monitoring target file from the access pattern acquired, and determine a scan pattern on a basis of the time-series pattern of access extracted.
1 . A tampering detection device comprising: tampering detection circuitry configured to:
acquire an access pattern of a monitoring target file;
extract a time-series pattern of access for each monitoring target file from the access pattern acquired; and
determine a scan pattern on a basis of the time-series pattern of access extracted.
2 . The tampering detection device according to claim 1 , wherein the tampering detection circuitry configured to:
further acquire a file size of the monitoring target file and a set time of the scan pattern;
extract an access frequency for each monitoring target file from the access pattern; and
determine the scan pattern using a genetic algorithm.
3 . The tampering detection device according to claim 2 , wherein the tampering detection circuitry configured to
determine a scan pattern in which all monitoring target files are included at least once by adding a predetermined penalty.
4 . The tampering detection device according to claim 1 , wherein the tampering detection circuitry configured to
the determination unit determines the scan pattern that minimizes an average time from scanning of the monitoring target file to a latest access.
5 . The tampering detection device according to claim 1 , wherein the tampering detection circuitry configured to
acquire the access pattern from a monitoring target device that stores the monitoring target file, and
the tampering detection device further comprises: tampering detection circuit configured to:
transmit the scan pattern to the monitoring target device; and
verify whether or not the file has been tampered by using a digest of a file generated on a basis of the scan pattern by the monitoring target device.
6 . A tampering detection method executed by a tampering detection device, the method comprising:
acquiring an access pattern of a monitoring target file;
extracting a time-series pattern of access for each monitoring target file from the access pattern acquired; and
determining a scan pattern on a basis of the time-series pattern of access extracted.
7 . A non-transitory computer-readable recording medium storing therein a tampering detection program causing a computer to execute a process comprising:
acquiring an access pattern of a monitoring target file;
extracting a time-series pattern of access for each monitoring target file from the access pattern acquired; and
determining a scan pattern on a basis of the time-series pattern of access extracted.