Identifying device, identifying method and identifying program

Patent metadata

Field	Value
Publication number	US-10397261-B2
Application number	US-201515514748-A
Country	US
Kind code	B2
Filing date	Oct 8, 2015
Priority date	Oct 14, 2014
Publication date	Aug 27, 2019
Grant date	Aug 27, 2019

Abstract

An identifying device monitors malware to be analyzed and acquires, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data. Then, the identifying device creates, by using the acquired log data, a dependency relation graph that is a digraph in which the malware, download data, and communication destination are set as nodes and a dependency relation of each node is set as an edge. Then, the identifying device detects a malicious node by collating the respective nodes of the created dependency relation graph with the known maliciousness information, and traces an edge in a direction from a terminal point to a start point while setting the malicious node as a base point, and then identifies the traced node as a new malicious node.

First claim

The invention claimed is:

1. An identifying device comprising:
processing circuitry configured to
monitor malware to be analyzed and acquire, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data;
create, by using the log data acquired by the processing circuitry, a dependency relation graph that is a digraph in which the malware, the download data, and the communication destination are set as nodes and a dependency relation of each node is set as an edge; and
detect a malicious node by collating the respective nodes of the dependency relation graph created by the processing circuitry with known maliciousness information, and trace an edge in a direction from a terminal point to a start point while setting the malicious node as a base point, and then identify a traced node as a new malicious node, wherein

the processing circuitry performs monitoring by assigning a monitoring target tag to a file of the malware, and in the case where the malware calls an API to be monitored, the processing circuitry acquires the log data by assigning, to data related to the API, a tag that can uniquely identify a transmission source of the data and then tracking propagation of the data assigned with the tag, wherein
the processing circuitry further performs monitoring by acquiring a value of an instruction pointer register that corresponds to an instruction, and, when a memory region indicated by the instruction pointer register is assigned with the monitoring target tag, determining the instruction as the file of the malware.

2. The identifying device according to claim 1 , wherein in the case where a node identified as the malicious node is a communication destination node, the processing circuitry identifies the communication destination node as a malicious site.

3. The identifying device according to claim 2 , wherein in the case where the node identified as the malicious node is a communication destination node, the processing circuitry identifies the communication destination node as a malicious site, and additionally, in the case where a node immediately before reaching the communication destination node is a download data node, the processing circuitry detects the node identified as the malicious site as a malware download site.

4. An identifying method executed in an identifying device, comprising processes of:
monitoring, by processing circuitry of the identifying device, malware to be analyzed and acquiring, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data;
creating, by the processing circuitry, by using the log data acquired in the monitoring process, a dependency relation graph that is a digraph in which the malware, the download data, and the communication destination are set as nodes and a dependency relation of each node is set as an edge; and
detecting, by the processing circuitry, a malicious node by collating the respective nodes of the dependency relation graph created in the creating process with known maliciousness information, and tracing an edge in a direction from a terminal point to a start point while setting the malicious node as a base point, and then identifying a traced node as a new malicious node, wherein
the processes includes monitoring by assigning a monitoring target tag to a file of the malware, and in the case where the malware calls an API to be monitored, the processing circuitry acquires the log data by assigning, to data related to the API, a tag that can uniquely identify a transmission source of the data and then tracking propagation of the data assigned with the tag, wherein
the processes further includes monitoring by acquiring a value of an instruction pointer register that corresponds to an instruction, and, when a memory region indicated by the instruction pointer register is assigned with the monitoring target tag, determining the instruction as the file of the malware.

5. A non-transitory computer-readable recording medium having stored an identifying program to cause a computer to execute steps of:
monitoring malware to be analyzed and acquiring, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data;
creating, by using the log data acquired in the monitoring step, a dependency relation graph that is a digraph in which the malware, the download data, and the communication destination are set as nodes and a dependency relation of each node is set as an edge; and
detecting a malicious node by collating the respective nodes of the dependency relation graph created in the creating step with known maliciousness information, and tracing an edge in a direction from a terminal point to a start point while setting the malicious node as a base point, and then identifying a traced node as a new malicious node, wherein
the steps includes monitoring by assigning a monitoring target tag to a file of the malware, and in the case where the malware calls an API to be monitored, the processing circuitry acquires the log data by assigning, to data related to the API, a tag that can uniquely identify a transmission source of the data and then tracking propagation of the data assigned with the tag, wherein
the steps further includes monitoring by acquiring a value of an instruction pointer register that corresponds to an instruction, and, when a memory region indicated by the instruction pointer register is assigned with the monitoring target tag, determining the instruction as the file of the malware.

Assignees

• Nippon Telegraph & Telephone

Inventors

• Ikuse Tomonori
• Aoki Kazufumi
• Hariu Takeo

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L2463/144

  Detection or countermeasures against botnets · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title