Malware analysis system, malware analysis method, and malware analysis program

Patent metadata

Field	Value
Publication number	US-10645098-B2
Application number	US-201515546201-A
Country	US
Kind code	B2
Filing date	Dec 15, 2015
Priority date	Jan 28, 2015
Publication date	May 5, 2020
Grant date	May 5, 2020

Abstract

A malware analysis system includes a preliminary analysis unit, a determination unit, and a designation unit. The preliminary analysis unit executes malware obtained as a candidate for an analyzing subject to obtain information related to communication transmitted from the malware. The determination unit determines whether the malware is handled as an analyzing subject based on information obtained by the preliminary analysis unit. The designation unit designates an analyzing order with respect to malware having been determined by the determination unit as an analyzing subject based on information obtained by the preliminary analysis unit.

First claim

The invention claimed is:

1. A malware analysis system comprising:
processing circuitry configured to
execute malware obtained as a candidate for an analyzing subject to obtain information related to communication transmitted from the obtained malware, the obtained malware being initially received from a malware collection system that collects malware from a communications network;
determine whether the obtained malware is handled as an analyzing subject based on the obtained information; and
designate an analyzing order with respect to the determined malware handled as an analyzing subject according to a number of communication counterparts related to communication generated by the obtained malware having been determined as an analyzing subject based on the obtained information and store the designated analyzing order in a database which is configured to be accessed by the processing circuitry for performing a main analysis process on the determined malware handled as an analyzing subject, according to the designated analyzing order, for creating a blacklist, wherein
when the obtained malware is executed in a closed environment that is an environment in which the obtained malware and an external communication network are disconnected from each other, the processing circuitry obtains information related to presence of a direct designation of an IP address as a communication counterpart or presence of communication where a name resolution is successful, as information related to communication transmitted from the obtained malware,
when the information obtained by the processing circuitry includes any of a direct designation of an IP address or communication where a name resolution is successful, the processing circuitry determines that the obtained malware is an analyzing subject, and the processing circuitry designates the analyzing order of the malware determined as an analyzing subject according to number of communication counterparts specified by the communication where a name resolution is successful.

2. A malware analysis system comprising:
processing circuitry configured to
execute malware obtained as a candidate for an analyzing subject to obtain information related to communication transmitted from the obtained malware, the obtained malware being initially received from a malware collection system that collects malware from a communications network;
determine whether the obtained malware is handled as an analyzing subject based on the obtained information; and
designate an analyzing order with respect to the determined malware handled as an analyzing subject according to a number of communication counterparts related to communication generated by the obtained malware having been determined as an analyzing subject based on the obtained information and store the designated analyzing order in a database which is configured to be accessed by the processing circuitry for performing a main analysis process on the determined malware handled as an analyzing subject, according to the designated analyzing order, for creating a blacklist, wherein
when the obtained malware is executed in an open environment that is an environment in which the obtained malware and an external communication network can be connected to each other, the processing circuitry obtains information related to presence of communication where a response other than errors is obtained, as information related to communication transmitted from the obtained malware,
when the information obtained by the processing circuitry includes communication where a response other than errors is obtained, the processing circuitry determines that the obtained malware is an analyzing subject, and
the processing circuitry designates the analyzing order of the malware determined as an analyzing subject according to the number of communication counterparts in which a response other than errors is obtained.

3. A malware analysis system comprising:
processing circuitry configured to
execute malware obtained as a candidate for an analyzing subject to obtain information related to communication transmitted from the obtained malware, the obtained malware being initially received from a malware collection system that collects malware from a communications network;
determine whether the obtained malware is handled as an analyzing subject based on the obtained information; and
designate an analyzing order with respect to the determined malware handled as an analyzing subject according to a number of communication counterparts related to communication generated by the obtained malware having been determined as an analyzing subject based on the obtained information and store the designated analyzing order in a database which is configured to be accessed by the processing circuitry for performing a main analysis process on the determined malware handled as an analyzing subject, according to the designated analyzing order, for creating a blacklist,
wherein
in a terminal in which the obtained malware is executed, by executing the obtained malware in a plurality of environments in which an OS, a library, and an application to be installed in the terminal are arbitrarily combined with one another, the processing circuitry obtains number of communication counterparts in communication transmitted from the obtained malware for each of the plurality of environments, and
the processing circuitry designates the analyzing order of the determined malware handled as an analyzing subject according to a largest number of communication counterparts among the number of communication counterparts obtained by the processing circuitry for each of the plurality of environments.

4. A malware analysis system comprising:
processing circuitry configured to
execute malware obtained as a candidate for an analyzing subject to obtain information related to communication transmitted from the obtained malware, the obtained malware being initially received from a malware collection system that collects malware from a communications network;
determine whether the obtained malware is handled as an analyzing subject based on the obtained information; and
designate an analyzing order with respect to the determined malware handled as an analyzing subject according to a number of communication counterparts related to communication generated by the obtained malware having been determined as an analyzing subject based on the obtained information and store the designated analyzing order in a database which is configured to be accessed by the processing circuitry for performing a main analysis process on the determined malware handled as an analyzing subject, according to the designated analyzing order, for creating a blacklist, wherein
the processing circuitry obtains, as for the determined malware handled as an analyzing subject, registration date and time that is date and time when the determined malware handled as an analyzing subject is registered for first time in a predetermined database in which pieces of the determined malware handled as an analyzing subject are stored in an integrated manner via the communication network, the processing circuitry determines whether the obtained malware is handled as an analyzing subject based on the registration date and time, and the processing circuitry designates the analyzing order of the determined malware handled as an analyzing subject having a newer one of the registration date and time higher, among pieces of malware having been determined by the determination unit as analyzing subjects.

5. A malware analysis system comprising:
processing circuitry configured to
execute malware obtained as a candidate for an analyzing subject to obtain information related to communication transmitted from the obtained malware, the obtained malware being initially recei

Assignees

• Nippon Telegraph & Telephone

Inventors

• Ikuse Tomonori
• Aoki Kazufumi
• Hariu Takeo

Classifications

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title