Falsification detection device, falsification detection method, and falsification detection program
A tampering detection device includes tampering detection circuitry configured to acquire an access frequency of a monitoring target file, calculate a number of times of scanning in a scan pattern for each monitoring target file on a basis of the access frequency acquired, and determine the scan pattern on a basis of the number of times of scanning calculated.
1. A tampering detection device comprising: tampering detection circuitry configured to:
acquire information on resources of a monitoring target device, an access frequency and a file size of a monitoring target file in the monitoring target device, and a scan pattern set time;
calculate a time required for hash calculation using the information on resources and the file size acquired by the acquisition step, and calculate a number of times of scanning in a scan pattern for each monitoring target file on a basis of the time required for hash calculation and the access frequency; and
determine the scan pattern on a basis of the number of times of scanning calculated.
2. The tampering detection device according to claim 1 , wherein the tampering detection circuitry configured to
calculate the number of times of scanning thereby minimizing an average time lapse between an occurrence of scanning the monitoring target file and a first-time occurrence of an access to the monitoring target file subsequent to the occurrence.
3. The tampering detection device according to claim 1 , wherein the tampering detection circuitry configured to
randomly determine a scan pattern in which all the monitoring target files are included at least once on a basis of the number of times of scanning.
4. The tampering detection device according to claim 1 , wherein the tampering detection circuitry configured to
acquire the access frequency from a monitoring target device that stores the monitoring target file, and
the tampering detection device further comprises: tampering detection circuitry configured to:
transmit the scan pattern to the monitoring target device; and
verify whether or not the file has been tampered by using a digest of a file generated on a basis of the scan pattern by the monitoring target device.
5. A tampering detection method executed by a tampering detection device, the method comprising:
acquiring information on resources of a monitoring target device, an access frequency and a file size of a monitoring target file in the monitoring target device, and a scan pattern set time;
calculating a time required for hash calculation using the information on resources and the file size acquired by the acquiring process, and calculating a number of times of scanning in a scan pattern for each monitoring target file on a basis of the time required for hash calculation and the access frequency; and
determining the scan pattern on a basis of the number of times of scanning calculated.
6. A non-transitory computer-readable recording medium storing therein a tampering detection program causing a computer to execute a process comprising:
acquiring information on resources of a monitoring target device, an access frequency and a file size of a monitoring target file in the monitoring target device, and a scan pattern set time;
calculating a time required for hash calculation using the information on resources and the file size acquired by the acquisition step, and calculating a number of times of scanning in a scan pattern for each monitoring target file on a basis of the time required for hash calculation and the access frequency; and
determining the scan pattern on a basis of the number of times of scanning calculated.