UNAUTHORIZED ACCESS MONITOR PROGRAM, UNAUTHORIZED MONITOR METHOD, AND UNAUTHORIZED MONITOR SYSTEM

摘要

It is possible to provide an unauthorized operation monitoring program for calculating a modified score by reflecting a suspicious value indicated from a series of operations by a user who operates a computer in order to monitor an unauthorized operation to the computer. When a modified score that indicates probability of an unauthorized operation is calculated for an object event, a suspicious value (PSV) corresponding to the level of the calculated modified score is set. When a new event occurs next time, for the score (direct score) calculated for the new event, a modified score reflecting the PSV set for the previous event and a time difference between the previous event and the new event is calculated. When operations that the probability of the unauthorized operation is high are continuously performed, or when operations of which the suspicious value is high are repeated, a higher level of a modified score is calculated.