Determination method, determination device and recording medium

Patent metadata

Field	Value
Publication number	US-11797670-B2
Application number	US-201917056457-A
Country	US
Kind code	B2
Filing date	Apr 15, 2019
Priority date	May 21, 2018
Publication date	Oct 24, 2023
Grant date	Oct 24, 2023

Abstract

A determination method includes determining an attack type of an attack code included in an attack request on a server, carrying out emulation of an attack by the attack code on the server in accordance with the determined attack type, extracting a feature related to a backdoor operation appearing in an attack code on the server in a case of succeeding in an attack on the server as a result of the emulation, and determining that an attack by the attack code has succeeded in a case where a communication log of the server has the extracted feature, by a processor.

First claim

The invention claimed is:

1. A determination method comprising:
determining an attack type of an attack code included in an attack request on a server;
carrying out emulation of an attack by the attack code on the server in accordance with the determined attack type;
extracting a feature related to a backdoor operation appearing in an attack code on the server in a case of succeeding in an attack on the server as a result of the emulation; and
determining that an attack by the attack code has succeeded in a case where a communication log of the server has the extracted feature, by a processor.

2. The determination method according to claim 1 , wherein the extracting includes extracting a system call of OS, an API call of application, or a communication log as a feature related to the backdoor operation.

3. A determination device comprising:
a memory; and
processing circuitry coupled to the memory and configured to:
determine an attack type of an attack code included in an attack request on a server,
carry out emulation of an attack by the attack code on the server in accordance with the determined attack type,
extract a feature related to a backdoor operation appearing in an attack code on the server in a case of succeeding in an attack on the server as a result of the emulation, and
determine that an attack by the attack code has succeeded in a case where a communication log of the server has the extracted feature.

4. A non-transitory computer-readable recording medium storing therein a determination program that causes a computer to execute a process comprising:
determining an attack type of an attack code included in an attack request on a server,
carrying out emulation of an attack by the attack code on the server in accordance with the determined attack type,
extracting a feature related to a backdoor operation appearing in an attack code on the server in a case of succeeding in an attack on the server as a result of the emulation, and
determining that an attack by the attack code has succeeded in a case where a communication log of the server has the extracted feature.

Assignees

• Nippon Telegraph & Telephone

Inventors

• Kanemoto Yo
• Aoki Kazufumi

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/1491

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title