VIOLATION DETECTION DEVICE, VIOLATION DETECTION NETWORK SYSTEM AND VIOLATION DETECTION METHOD

摘要

To provide a technique with high accuracy which detects that malware causes an unauthorized operation to be performed.SOLUTION: A violation detection device detects that malware causes a program executable on a web browser and described in a prescribed program language, to perform an unauthorized operation, and changing a property in the program language by malware is a detection object. With respect to a syntax of the program language, a property can define at least one of a variable, a function and a constant and includes a global property which can be referred to by a program other than a program which defines the global property. The violation detection device comprises: global property change detection means which detects that definition of the global property has been changed; and detection rule storage means in which a change pattern of the definition detected by the global property change detection means or a result from the change is stored as a detection rule. A violation is detected in response to matching the detection rule.SELECTED DRAWING: Figure 2