Detection device, detection method, and detection program
A collation unit checks the presence/absence of alteration of all files when an apparatus is started. A cyclic collation unit checks the presence/absence of alteration of a predetermined file at predetermined time intervals during the operation of the apparatus.
1 . A detection device, comprising:
a memory; and
a processor coupled to the memory and programmed to execute a process to:
first check presence/absence of alteration of all files when an Internet-Of-Things (IOT) hardware is started;
second check the presence/absence of alteration of a predetermined file at predetermined time intervals during an operation of the IOT hardware;
generate a list of files to be read from a nonvolatile memory of the IOT hardware during the operation of the IOT hardware by using a file read log from the nonvolatile memory of the IOT hardware in a predetermined period after the IOT hardware is started; and
monitor the file read log from the nonvolatile memory during the operation of the IOT hardware, and add a file that is not in the list, wherein
the second check includes check the presence/absence of alteration of a file described in the generated list, and
the monitor includes monitor the file read log during actual operation of the IOT hardware, and when a file not listed in the list is included in the file read log, add a file path and a hash value of the file to the list.
2 . The detection device according to claim 1 , wherein the second check preferentially checks the presence/absence of alteration of the file added to the list.
3 . The detection device according to claim 1 , wherein the first check and the second check of the presence/absence of alteration of the file is by using a hash value of the file.
4 . A detection method executed by a detection device, the detection method comprising:
a collation step of checking presence/absence of alteration of all files when an IOT hardware is started;
a cyclic collation step of checking the presence/absence of alteration of a predetermined file at predetermined time intervals during an operation of the IOT hardware;
generating a list of files to be read from a nonvolatile memory of the IOT hardware during the operation of the IOT hardware by using a file read log from the nonvolatile memory of the IOT hardware in a predetermined period after the IOT hardware is started; and
monitoring the file read log from the nonvolatile memory during the operation of the IOT hardware, and add a file that is not in the list, wherein
the cyclic collation step includes checking the presence/absence of alteration of a file described in the generated list, and
the monitoring includes monitoring the file read log during actual operation of the IOT hardware, and when a file not listed in the list is included in the file read log, adding a file path and a hash value of the file to the list.
5 . A non-transitory computer-readable recording medium having stored a detection program for causing a computer to execute:
a collation step of checking presence/absence of alteration of all files when an IOT hardware is started;
a cyclic collation step of checking the presence/absence of alteration of a predetermined file at predetermined time intervals during an operation of the IOT hardware;
generating a list of files to be read from a nonvolatile memory of the IOT hardware during the operation of the IOT hardware by using a file read log from the nonvolatile memory of the IOT hardware in a predetermined period after the IOT hardware is started; and
monitoring the file read log from the nonvolatile memory during the operation of the IOT hardware, and add a file that is not in the list, wherein
the cyclic collation step includes checking the presence/absence of alteration of a file described in the generated list, and
the monitoring includes monitoring the file read log during actual operation of the IOT hardware, and when a file not listed in the list is included in the file read log, adding a file path and a hash value of the file to the list.