Malware infected terminal detecting apparatus, malware infected terminal detecting method, and malware infected terminal detecting program

Patent metadata

Field	Value
Publication number	US-10819717-B2
Application number	US-201515522147-A
Country	US
Kind code	B2
Filing date	Nov 10, 2015
Priority date	Nov 14, 2014
Publication date	Oct 27, 2020
Grant date	Oct 27, 2020

Abstract

A detecting apparatus generates a collection of events, the collection being formed based on a predetermined condition, from events obtained for each identifier identifying a terminal in a monitoring target network or a piece of malware. The detecting apparatus then extracts, from a cluster formed of collections of events, the collections having a similarity therebetween equal to or larger than a certain similarity, events commonly appearing in the collections of events belonging to the same cluster, and extracts, according to a predetermined condition, the taken out events as a collection of detection purpose events. The detecting apparatus then detects that a malware infected terminal is present in the monitoring target network, if a generated collection of events based on communications in the monitoring target network is determined to match the extracted collection of detection purpose events.

First claim

The invention claimed is:

1. A malware infected terminal detecting apparatus, comprising:
processing circuitry configured to
generate a collection of events, the collection being formed based on a predetermined condition, from events that are phenomena matching rules characterizing communications from communications in a monitoring target network and communications caused by malware and that are obtained for each identifier identifying a terminal in the monitoring target network or a piece of malware;
for a cluster formed of collections of events that are based on the communications caused by malware, the collections having an event collection similarity therebetween equal to or larger than a certain similarity:
when plural collections of events are present in the same cluster, take out events appearing commonly in the collections of events belonging to the same cluster, and extract, according to a predetermined condition, a collection of the taken out events as a detection purpose event series candidate; or
when only a single collection of events is present in the same cluster, extract the collection of events as a detection purpose event series candidate if a predetermined condition is satisfied;
extract a collection of detection purpose events from the detection purpose event series candidate, if a rate of the number of detected hosts to the total number of hosts in the monitoring target network is equal to or less than a certain rate; and

detect that a malware infected terminal is present in the monitoring target network, if the generated collection of events based on the communications in the monitoring target network has been determined to match the extracted collection of detection purpose events, wherein
the processing circuitry collates the extracted collection of detection purpose events with the collection of events that have been obtained in advance and that are based on the communications in the monitoring target network, and
if a value, which results from division of the number of terminals corresponding to the collection of events based on the communications in the monitoring target network determined to be matching in the collation between the collections of events by the total number of terminals observable in the monitoring target network, is equal to or larger than a certain value, the processing circuitry extracts, as a new collection of detection purpose events, a collection of events, from which the collection of detection purpose events determined to be matched in the collation between the collections of events has been excluded, the collection of detection purpose events being from the extracted collections of detection purpose events, wherein
the processing circuitry determines that any collection of events confirmed in at least a threshold number of the hosts, determined based on the certain value, does not capture only characteristics of communications due to malware, extracts that collection of events, and sets the collection of events as an excluded event.

2. The malware infected terminal detecting apparatus according to claim 1 , wherein
the processing circuitry generates, as the collection of events, an event series formed in consideration of order of occurrence of the events,
for a cluster formed of event series that are based on the communications caused by malware and that have an event series similarity therebetween equal to or larger than a certain similarity:
when plural event series are present in the same cluster, the processing circuitry takes out events commonly appearing in the event series belonging to the same cluster, and extracts, as a detection purpose event series, an event series that is a combination of the taken out events in time series order and that has a length equal to or longer than a certain length; or
when only a single event series is present in the same cluster, the processing circuitry extracts that event series as a detection purpose event series if that event series has a length equal to or longer that a certain length, and

the processing circuitry detects that a malware infected terminal is present in the monitoring target network, if the generated event series based on the communications in the monitoring target network has been determined to match the extracted detection purpose event series.

3. The malware infected terminal detecting apparatus according to claim 2 , wherein the processing circuitry determines that the event series based on the communications in the monitoring target network matches the detection purpose event series, if a value, which results from division of a length of the longest part of a part common to the event series based on the communications in the monitoring target network and the detection purpose event series by a length of the detection purpose event series, is equal to or larger than a certain value.

4. The malware infected terminal detecting apparatus according to claim 2 , wherein the processing circuitry generates the event series by excluding any redundantly appearing event from events obtained for each of identifiers identifying terminals in the monitoring target network and pieces of malware.

5. The malware infected terminal detecting apparatus according to claim 1 , wherein
the processing circuitry generates, as the collection of events, an event group formed of a combination of non-redundant events,
for a cluster formed of event groups that are based on the communications caused by malware and have an event group similarity therebetween equal to or larger than a certain similarity:
when plural event groups are present in the same cluster, the processing circuitry takes out events commonly appearing in the event groups belonging to the same cluster, and extracts, as a detection purpose event group, a collection of the taken out events if the number of types of the taken out events is equal to or larger than a certain number; or
when only a single event group is present in the same cluster, the processing circuitry extracts that event group as a detection purpose event group if the number of types of events included in that event group is equal to or larger than a certain number, and

the processing circuitry detects that a malware infected terminal is present in the monitoring target network, if the generated event group based on the communications in the monitoring target network has been determined to match the extracted detection purpose event group.

6. The malware infected terminal detecting apparatus according to claim 5 , wherein the processing circuitry determines that the event group based on the communications in the monitoring target network matches the detection purpose event group, if a value, which results from division of the number of events commonly appearing in events included in the event group based on the communications in the monitoring target network and the detection purpose event group by the total number of events included in the detection purpose event group, is equal to or larger than a certain value.

7. The malware infected terminal detecting apparatus according to claim 1 , wherein if a value, which results from division of the number of terminals in the monitoring target network that have generated a predetermined event of events obtained for each terminal in the monitoring target network by the total number of terminals observable in the monitoring target network is larger than a certain value, the processing circuitry generates the collection of events with only those events excluding the predetermined event.

8. The malware infected terminal detecting apparatus according to claim 1 , wherein the processing circuitry generates a collection of events from events that are from events obtained for each identifier

Assignees

• Nippon Telegraph & Telephone

Inventors

• Aoki Kazufumi
• Kamiya Kazunori

Classifications

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title