JP2010009187A - Information processor, information processing system, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To detect communication to be performed by a bot-infected device with a command server. <P>SOLUTION: An already known information storage part 100 stores a port number to be used for transmitting an attack packet. A communication history storage part 102 stores a communication history including a communication process started when executing communication as the object of monitoring and a port number used by communication by the communication process. A time decision part 107a decides whether or not the creation time or update time of the execution file of the communication processor is included in a prescribed period based on an attack time. A port number decision part 107b decides whether or not the port numbers are matched. A communication history extraction part 107c extracts the communication history including the communication process in which the creation time or update time of the execution file is decided to be included in the prescribed period and the port number decided not to be matched with the port number stored in the already known information storage part 100 from among the communication histories. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an information processing apparatus and an information processing system for processing information related to communication. The present invention also relates to a program for causing a computer to function as an information processing apparatus, and a recording medium on which the program is recorded.

  In recent years, damage caused by viruses called bots that cause a computer infected with a virus to perform malicious operations has been increasing. The bot is composed of malicious code having a function of establishing a communication session with an external command server and downloading a new code, a function of receiving a command for an attack, and a function of attacking according to the command. It is important to eradicate the perpetrator device that was infected by the bot and attacked as the perpetrator, and the command server mentioned above, and the IP traceback technology that traces the attack source by tracing the communication path from the victim device Is attracting attention.

  IP traceback is a technique for tracking an attack performed by spoofing a source IP address using information of an IP layer in a packet. As a typical method of IP traceback, the hash value of the passing packet is stored in a dedicated device on the communication path, and the hash value of the attack packet that reaches the victim is determined from the information left in the device. There is a hash method for tracking (see Non-Patent Documents 1 and 2).

In addition, there is an ICMP system in which a packet passing through a router is sampled, packet information and router information are placed in an ICMP packet, and sent to Destination IP (victim's IP address) (see Non-Patent Document 3). There is also a packet marking method that samples passing packets and writes router information in a header area that does not affect routing. By assembling the marking information on the victim side, the communication path can be traced (non-patented) Reference 4).
Strayer, WT Jones, CE Tchakountio, F. Snoeren, AC Schwartz, B. Clements, RC Condell, M. Partridge, “Traceback of single IP packets using SPIE,” DARPA Information Survivability Conference and Exposition, Proceedings, Vol. 2, pp 266-270, April 2003. AC Snoeren, C. Partridge, LA Sanchez, CE Jones, F. Tchakountio, ST Kent, and WT Strayer “Hash-Based IP Traceback,” Proceeding or SIGCOMM '01, August 2001. Steven Bellovin, and Marcus Leech, Tom Taylor, “ICMP Traceback Messages,” IETF, Internet Draft, draft-ietf-itrace-04.txt, Aug. 2003. D. Song and A Perrig, “Advanced and Authenticated Marking Schemes for IP Traceback,” Proc. Of IEEE Inforcom, April, 2001.

  FIG. 4 shows a model of communication by bots. In the communication by the bot, the perpetrator PCs (Personal Computers) 400 and 401 performing the attack, the victim PCs 410, 411, 412 and 413 subjected to the attack, and the command server for delivering the attack code (executable file) and the attack instruction 420 and 421 are related. The external perpetrator PC 400 embeds an initial code for downloading the bot in the perpetrator PC 401. The perpetrator PC 401 receives a new code from the command server 420 according to the initial code. Further, the perpetrator PC 401 receives a command from the command server 421 and performs various attacks on the victim PC.

  The inventors implemented a tool for monitoring a communication process and a communication destination, and monitored the communication behavior of the perpetrator PC. FIG. 5 shows this state. When the perpetrator PC starts the initial code “^ 21.tmp.exe”, the code “nbin.exe” is newly acquired (time 14:06:51). After 53 seconds, the perpetrator PC started communication with the external server using the code “nbin.exe” and acquired the code “EventLogger.exe” (time 14:07:44). After 90 seconds, the perpetrator PC started a new communication with the code “EventLogger.exe” (time 14:08:21). Communication with the above three types of codes is communication with the command server.

  As described above, the communication performed by the perpetrator PC infected with the bot with the command server and the communication for the attack performed by the perpetrator PC with the victim PC are separate communications, and the packets used for the communication are also different. For this reason, with the conventional IP traceback method, communication from the victim PC to the victim PC can be traced based on the information of the packet that arrived at the victim PC. Communication to the command server using different packets could not be traced.

  The present invention has been made in view of the above-described problems, and provides an information processing apparatus, an information processing system, a program, and a recording medium that can detect communication performed by a device infected with a bot with a command server. For the purpose.

  The present invention has been made in order to solve the above-described problem, and known information storage means for storing a port number used for transmission of an attack packet, and communication started when communication to be monitored is executed. A communication history storage unit that stores a communication history including a process and a port number used for communication by the communication process, and a generation time or an update time of an execution file of the communication process included in the communication history is based on an attack time Time determination means for determining whether or not a predetermined period is included, and port number determination means for determining whether or not a port number included in the communication history matches a port number stored in the known information storage means From the communication history, as a result of the determination by the time determination means, it is determined that the execution time of the execution file or the update time is included in the predetermined period. An extraction unit that includes a communication process and extracts the communication history including a port number that is determined not to match the port number stored in the known information storage unit as a result of the determination by the port number determination unit Is an information processing apparatus characterized by

  The bot has a feature of starting a communication process by acquiring new executable files one after another. In addition, the present inventor has confirmed a bot having a feature of acquiring a new executable file infested with a Web browser and then returning the Web browser to the original state. The generation time or update time of the execution file of the communication process activated by the bot having these characteristics is characterized by being close to the attack time. For this reason, there is a possibility that the communication executed by the communication process whose generation time or update time of the execution file of the communication process is included in a predetermined period based on the attack time is communication with the command server.

  However, there is a possibility that the communication includes communication used for sending attack packets with the victim's device as the destination. Therefore, by making a determination using a port number that is known to be used for transmission of attack packets, it is possible to exclude communication destined for the victim's device. That is, when the port number included in the communication history matches the port number used for sending the attack packet, it is possible to determine that the communication using the port number is the communication used for sending the attack packet. it can. Further, when the port number included in the communication history does not match the port number used for transmission of the attack packet, there is a possibility that the communication using the port number is communication with the command server.

  Therefore, by combining the determination regarding the generation time or update time of the execution file of the communication process and the determination regarding the port number used for communication, the communication used for sending the attack packet is excluded, and communication with the command server is detected. can do.

  In the information processing apparatus of the present invention, the communication history further includes identification information of a destination of communication executed by the communication process, and receives a message including identification information of the apparatus that has received the attack packet from another apparatus. Receiving means; and identification information determination means for determining whether or not the identification information included in the communication history matches the identification information included in the message, wherein the extraction means is determined by the identification information determination means. As a result of the determination, the communication history is extracted when the identification information matching the identification information included in the message is included in the communication history.

  In the present invention, it is particularly effective to set the communication history of the perpetrator device that has received the command from the command server and transmitted the attack packet to the victim device as a processing target. The communication history of the perpetrator device includes a communication history related to communication in which an attack packet is transmitted to the victim device. Therefore, when the communication history includes identification information that matches the identification information of the device that received the attack packet, the detection accuracy of communication with the command server can be improved by extracting the communication history.

  The present invention is also a program for causing a computer to function as the information processing apparatus.

  Further, the present invention is a computer-readable recording medium storing the above program.

  The present invention is an information processing system including a first information processing apparatus and a second information processing apparatus, and the first information processing apparatus stores a port number used for transmission of an attack packet. Communication including a known information storage means, a communication process activated when the monitored communication is executed, identification information of a communication destination by the communication process, and a port number used by communication by the communication process A communication history storage unit for storing a history, a time determination unit for determining whether a generation time or an update time of an execution file of a communication process included in the communication history is included in a predetermined period based on an attack time; A port for determining whether or not the port number included in the communication history stored in the communication history storage unit matches the port number stored in the known information storage unit And a port number determination unit including a communication process in which the execution time of the execution file is determined to be included in the predetermined period as a result of the determination by the time determination unit from the communication history determination unit As a result of determination by means, first extraction means for extracting the communication history including the port number determined not to match the port number stored in the known information storage means, and the first extraction means extracted the first extraction means Transmitting means for transmitting a communication history to the second information processing apparatus, wherein the second information processing apparatus receives the communication history from a plurality of the first information processing apparatuses; An information processing system comprising: second extraction means for extracting the communication history having common identification information from the communication history received by the means.

  The bot is characterized in that a plurality of devices functioning as perpetrators communicate with the same command server. By using this feature to extract a communication history having common identification information from communication histories extracted by a plurality of first communication devices, it is possible to improve the detection accuracy of communication with the command server. .

  According to the present invention, it is possible to obtain an effect that a device infected with a bot can detect communication performed with a command server.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows the configuration of an information processing system according to an embodiment of the present invention. The information processing system includes a terminal device 1 (for example, a PC) that is a victim or a perpetrator of a bot, and a server 2 that analyzes communication based on a communication history received from the terminal device 1. In this information processing system, a plurality of terminal devices 1 exist, but only one device is illustrated in FIG. 1 and the other terminal devices 1 are not shown.

  Hereinafter, the configuration and operation of the terminal device 1 will be described. The terminal device 1 includes a known information storage unit 100, a communication monitoring unit 101, a communication history storage unit 102, a damage report unit 103, a damage information reception unit 104, a damage information storage unit 105, an perpetrator determination unit 106, a communication analysis unit 107, A communication history report unit 108, an operation detection unit 109, and an operation time storage unit 110 are provided. Since the terminal device 1 can be a victim or a perpetrator, the terminal device 1 has a processing configuration as a victim (damage report unit 103) and a processing configuration as a perpetrator (known information storage unit 100, communication An analysis unit 107, a communication history report unit 108, an operation detection unit 109, and an operation time storage unit 110) are provided. The known information storage unit 100, the communication history storage unit 102, the damage information storage unit 105, and the operation time storage unit 110 may be configured with different recording media, or may be configured with different storage areas on the same recording medium. It may be.

  The known information storage unit 100 stores known information obtained in advance. The terminal device 1 may acquire the known information by receiving the known information from another device such as the server 2, or the terminal device 1 may read the known information from the recording medium in which the known information is stored. May be obtained. Details of the known information will be described later.

  The communication monitoring unit 101 monitors communication performed by the terminal device 1 with another device, and stores a communication result in the communication history storage unit 102 as a communication history. The function of the communication monitoring unit 101 can be realized by a tool called Port Reporter provided by Microsoft (registered trademark), for example. Alternatively, the function of the communication monitoring unit 101 can be obtained by calling the API of Windows (registered trademark) XP standard IPHLPAPI.DLL, AllocateAndGetTcpExTableFromStack () for TCP and UDP: AllocateAndGetUdpExTableFromStack () for UDP at a cycle of about 100 msec. It is possible to realize.

  The communication history storage unit 102 stores a communication history. The communication history includes identification information for identifying the destination of the communication to be monitored, information for identifying the communication process started when executing the communication to be monitored (communication process name in this embodiment), The port number used by the monitored communication and the time (communication time) at which the monitored communication was performed are included. The identification information may be an IP address and / or a domain name, and the domain name may be an FQDN (Fully Qualified Domain Name). The same applies to other identification information appearing below. To associate the IP address that constitutes the identification information with the domain name, after requesting the DNS server to resolve the name during communication, the packet returned from the DNS server must contain both the IP address and the domain name. Use it.

  When the terminal device 1 receives an attack packet by the bot and becomes a victim, the damage report unit 103 transmits a message including a communication history related to the reception of the attack packet to the server 2, thereby damaging the server 2. Report. The communication history transmitted to the server 2 includes the identification information of the terminal device 1 and the attack packet reception time (attack time). The message including the communication history is transmitted based on, for example, an instruction input to the terminal device 1 by a user who has recognized that an attack has occurred.

  The server 2 that has received the communication history regarding the attack by the bot from each terminal device 1 generates damage information that integrates the communication history of each terminal device 1, and transmits a message including the damage information to the terminal device 1. The damage information includes identification information of the terminal device 1 that has received the attack packet and an attack time (or a time range including the attack time). The damage information receiving unit 104 receives a message from the server 2 including damage information, and stores the damage information included in the message in the damage information storage unit 105. The damage information storage unit 105 stores damage information.

  The perpetrator determination unit 106 determines whether or not the terminal device 1 is a perpetrator. For this determination, identification information and attack time included in the damage information stored in the damage information storage unit 105 and identification information and communication time included in the communication history stored in the communication history storage unit 102 are used. Specifically, the perpetrator determination unit 106 first reads the damage information from the damage information storage unit 105 and also reads the communication history from the communication history storage unit 102. Subsequently, the perpetrator determination unit 106 compares the attack time included in the damage information with the communication time included in the communication history, and obtains a communication history including communication times within a predetermined time before and after the attack time. The subsequent processing target.

  Subsequently, the perpetrator determination unit 106 includes identification information included in the damage information (identification information of the terminal device 1 that has received the attack packet), identification information included in the communication history (identification information of the communication destination device), and It is determined whether or not. When the identification information included in the damage information matches any of the identification information included in the communication history, it is possible to determine that the terminal device 1 is the perpetrator. In addition, when the identification information included in the damage information does not match any identification information included in the communication history, it is possible to determine that the terminal device 1 is not the perpetrator.

  Subsequently, the perpetrator determination unit 106 notifies the communication analysis unit 107 of the determination result and the attack time. In this embodiment, when it is determined that the terminal device 1 is the perpetrator, the communication analysis unit 107 performs the subsequent processing, and when it is determined that the terminal device 1 is not the perpetrator, the communication analysis unit 107 performs the subsequent processing. Do not perform the process.

  The communication analysis unit 107 is performed by the terminal device 1 based on the known information stored in the known information storage unit 100, the communication history stored in the communication history storage unit 102, and the operation time stored in the operation time storage unit 110. The communication history related to communication with the command server is extracted. More specific operation of the communication analysis unit 107 will be described later. The communication history report unit 108 transmits a message including the communication history extracted by the communication analysis unit 107 to the server 2.

  The operation detection unit 109 detects a user operation on the terminal device 1 and stores the detected time in the operation time storage unit 110 as an operation time. The operation time storage unit 110 stores the operation time. In addition to the above configuration, the terminal device 1 includes an input device for a user to input an operation, a storage device for storing an execution file of a communication process, and the like, but is not illustrated.

  Next, the configuration and operation of the server 2 will be described. The server 2 includes a damage information reception unit 200, a damage information storage unit 201, a damage information distribution unit 202, a communication history reception unit 203, a communication history storage unit 204, and a communication analysis unit 205. The damage information storage unit 201 and the communication history storage unit 204 may be configured with different recording media, or may be configured with different storage areas on the same recording medium.

  The damage information receiving unit 200 receives a message including damage information transmitted from each terminal device 1, integrates the damage information included in the message, and stores the integrated damage information in the damage information storage unit 201. The damage information storage unit 201 stores damage information. The damage information distribution unit 202 reads the damage information from the damage information storage unit 201 and transmits a message including the damage information to the terminal device 1 to distribute the damage information to each terminal device 1.

  The communication history receiving unit 203 receives a message including a communication history transmitted from the terminal device 1 and stores the communication history included in the message in the communication history storage unit 204. The communication history storage unit 204 stores a communication history. The communication analysis unit 205 analyzes the communication performed by each terminal device 1 based on the communication history stored in the communication history storage unit 204. More specific operation of the communication analysis unit 205 will be described later.

  Next, a more specific configuration and operation of the communication analysis unit 107 included in the terminal device 1 will be described. FIG. 2 shows the configuration of the communication analysis unit 107. The communication analysis unit 107 includes a time determination unit 107a, a port number determination unit 107b, and a communication history extraction unit 107c. The communication analysis performed by the communication analysis unit 107 includes known information stored in the known information storage unit 100, a communication history stored in the communication history storage unit 102, and an operation stored in the operation time storage unit 110. Time is used.

  The known information storage unit 100 stores a port number list as known information referred to by the communication analysis unit 107. The port number list is a list of port numbers used for sending attack packets. The port number list includes TCP-Port 25, TCP-Port 135-139, and UDP-Port 53 that are frequently used for attacks.

  The time determination unit 107a reads the communication history from the communication history storage unit 102, and acquires the communication process name included in the communication history. Subsequently, the time determination unit 107a acquires the generation time or update time of the execution file of the communication process having the acquired communication process name. The bot has the feature of acquiring new executable files one after another and starting the communication process, and acquiring the new executable file by parasitizing the web browser and then returning the web browser to its original state. is doing. The creation time or update time of the execution file of the communication process activated by the bot having these characteristics is new and close to the attack time.

  Therefore, the time determination unit 107a sets a predetermined period (such as one hour before the attack time) based on the attack time notified from the perpetrator determination unit 106, and the generation time or update time is set to the predetermined period. It is determined whether or not it is included. When the generation time or the update time is not included in the predetermined period, it can be determined that the execution file is normally generated or updated. On the other hand, when the generation time or the update time is included in the predetermined period, the communication performed by the corresponding communication process may be communication with the command server. Therefore, it is possible to specify communication history candidates related to communication with the command server from the result of determination by the time determination unit 107a.

  However, immediately before the bot is infected, there is a possibility that the terminal device 1 may properly generate or update the executable file by a function such as Windows (registered trademark) Update. More desirable. Since regular generation or update of an executable file is performed based on a user operation, if the generation time or update time of the execution file is within a predetermined period based on the user operation time, the generation or update of the execution file is performed. The update shall be normal.

  Based on the above, the time determination unit 107a reads the operation time from the operation time storage unit 110, and sets a predetermined period (such as a few minutes after the operation time) based on the operation time. The time determination unit 107a performs the above determination after setting a predetermined period based on the attack time so as not to include the predetermined period based on the operation time. As a result, it is possible to exclude communication histories related to normal generation or update of executable files based on user operations, and specify communication history candidates related to communication with the command server.

  The time determination unit 107a notifies the communication history extraction unit 107c of a communication process name included in a predetermined period in which the execution time or update time of the execution file is based on the attack time as a determination result. The communication history including the communication process name is a communication history candidate related to the communication with the command server, but since the bot also attacks the victim in addition to the communication with the command server, It is necessary to exclude communication history related to attacks on victims. The port number determination unit 107b performs determination for this purpose.

  The port number determination unit 107 b reads the port number list from the known information storage unit 100 and reads the communication history from the communication history storage unit 102. Subsequently, the port number determination unit 107b determines whether or not the port number included in the communication history matches the port number in the port number list. When the port number included in the communication history matches one of the port numbers in the port number list, it can be determined that the communication using this port number is the communication used for sending the attack packet. If the port number included in the communication history does not match any port number in the port number list, there is a possibility that communication using this port number is communication with the command server. Therefore, it is possible to exclude communication destined for the victim from the result of determination by the port number determination unit 107b, and specify communication history candidates related to communication with the command server. The port number determination unit 107b notifies the communication history extraction unit 107c of a port number that does not match any port number in the port number list as a determination result.

  The communication history extraction unit 107c reads the communication history from the communication history storage unit 102, and performs communication related to communication with the command server based on the determination result by the time determination unit 107a and the determination result by the port number determination unit 107b. Extract history. Specifically, the communication history extraction unit 107c includes a communication process name determined as a result of determination by the time determination unit 107a that the execution time or update time of the execution file is included in a predetermined period based on the attack time, and As a result of the determination by the port number determination unit 107b, a communication history including a port number determined not to match any port number in the port number list is extracted. The communication history extracted as described above is specified as the communication history related to communication with the command server. Also, the identification information included in the extracted communication history becomes the identification information of the command server. When the communication history is extracted, a communication history including communication times within a predetermined time before and after the attack time included in the damage information may be set as a processing target.

  Next, a more specific operation of the communication analysis unit 205 provided in the server 2 will be described. The communication history storage unit 204 of the server 2 stores a communication history extracted by each terminal device 1 as a communication history related to communication with the command server. Each communication history can be distinguished for each terminal device 1. The communication analysis unit 205 reads communication histories for a plurality of terminal devices 1 from the communication history storage unit 204, and determines whether there is identification information common to them.

  More specifically, the communication analysis unit 205 first extracts one or a plurality of different identification information from the communication history for one terminal device 1, and stores each pair of identification information and appearance frequency in the storage device. . Here, “different from each other” is described when the communication history for one terminal device 1 is composed of a plurality of records, and the same identification information is set to 1 when the same identification information is recorded in the plurality of records. This is to clearly indicate that extraction is performed only once (as a result, all the extracted identification information is different). When the communication history for the first terminal device 1 is processed, the appearance frequency of each identification information is set to 1.

  Subsequently, the communication analysis unit 205 extracts one or a plurality of pieces of identification information that are different from each other from the communication history of the other terminal device 1 and compares the extracted identification information with each piece of identification information stored in the storage device. When the identification information extracted from the communication history matches any identification information stored in the storage device, 1 is added to the appearance frequency of the identification information. When the identification information extracted from the communication history does not match any identification information stored in the storage device, a pair of new identification information and appearance frequency (value is 1) is stored in the storage device. The communication analysis unit 205 repeats the above processing until the communication history for all the terminal devices 1 is processed. When the above processing ends, the communication analysis unit 205 reads the appearance frequency from the storage device, and when the appearance frequency is a predetermined value N (N is 2 or more), the identification information paired with the appearance frequency From the storage device. This identification information has high reliability as the identification information of the command server.

  The bot is characterized in that a plurality of terminal devices 1 functioning as perpetrators communicate with the same command server. Therefore, by extracting the communication history having common identification information from the communication histories extracted by the plurality of terminal devices 1, it is possible to improve the accuracy of extracting the communication history related to the communication with the command server.

  FIG. 3 shows how communication histories having common identification information are extracted. The communication history is reported to the server 2 from the terminal devices 1a, 1b, 1c, and 1d that are the perpetrators. Of the communication histories of the four terminal devices, the communication histories from the terminal devices 1b and 1c have common identification information. This identification information has higher reliability as the identification information of the command server. When the communication process name (“nbin.exe” in FIG. 3) is also acquired, the communication history having the common communication process name is extracted, thereby improving the communication history extraction accuracy related to communication with the command server. Can be increased.

  As described above, according to the present embodiment, the known normal communication and the attack packet are combined by combining the determination on the generation time or update time of the execution file of the communication process and the determination on the port number used for communication. Communication with the command server can be detected.

  Also, as a result of determination by the perpetrator determination unit 106, when the terminal device 1 is determined to be the perpetrator, the communication history is extracted, so that the detection accuracy of communication with the command server can be improved. Furthermore, the terminal device 1 determined to be the perpetrator reports only the communication history related to communication with the command server 2 to the server 2, thereby preventing the normal communication history of the terminal device 1 from being leaked. it can.

  Further, by extracting a communication history having common identification information from the communication histories extracted by the plurality of terminal devices 1, it is possible to improve the detection accuracy of communication with the command server.

  As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the above-described embodiments, and includes design changes and the like without departing from the gist of the present invention. . For example, a program for realizing the operation and function of the terminal device 1 according to the above-described embodiment may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by the computer. Good.

  Here, the “computer” includes a homepage providing environment (or display environment) if the WWW system is used. The “computer-readable recording medium” refers to a storage device such as a portable medium such as a flexible disk, a magneto-optical disk, a ROM, and a CD-ROM, and a hard disk built in the computer. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program described above may be transmitted from a computer storing the program in a storage device or the like to another computer via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the above-described program may be for realizing a part of the above-described function. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer, what is called a difference file (difference program) may be sufficient.

It is a block diagram which shows the structure of the information processing system by one Embodiment of this invention. It is a block diagram which shows the structure of the communication analysis part with which the terminal device by one Embodiment of this invention is provided. It is a reference figure for demonstrating operation | movement of the communication analysis part with which the server by one Embodiment of this invention is provided. It is a reference figure which shows the model of the communication by a bot. It is a reference figure showing the result of having monitored communication by a bot.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Terminal device (1st information processing apparatus), 2 ... Server (2nd information processing apparatus), 100 ... Known information storage part (known information storage means), 101 ... Communication monitoring , 102, 204 ... communication history storage (communication history storage means), 103 ... damage report part (transmission means), 104, 200 ... damage information reception part (reception means), 105, 201 ..Damage information storage unit, 106 ... Perpetrator determination unit, 107, 205 ... Communication analysis unit (first extraction means, second extraction unit), 107a ... Time determination unit (time determination unit) 107b ... Port number determination unit (port number determination unit), 107c ... Communication history extraction unit (extraction unit), 108 ... Communication history report unit, 109 ... Operation detection unit, 110 ... Operation time storage unit, 202 ... Damage information distribution unit, 2 3 ... the communication history receiving unit (receiving means)

Claims (5)

Known information storage means for storing a port number used for transmission of an attack packet;
A communication history storage means for storing a communication history including a communication process started when executing the communication to be monitored and a port number used by communication by the communication process;
Time determination means for determining whether the generation time or update time of the execution file of the communication process included in the communication history is included in a predetermined period based on the attack time;
Port number determination means for determining whether a port number included in the communication history matches a port number stored in the known information storage means;
The communication history includes a communication process in which the execution file generation time or update time is determined to be included in the predetermined period as a result of the determination by the time determination unit, and the determination result by the port number determination unit Extracting means for extracting the communication history including the port number determined not to match the port number stored in the known information storage unit;
An information processing apparatus comprising: The communication history further includes identification information of a destination of communication executed by the communication process,
Receiving means for receiving a message including identification information of the device that received the attack packet from another device;
Identification information determination means for determining whether or not the identification information included in the communication history matches the identification information included in the message;
The extraction means extracts the communication history when the identification information matching the identification information included in the message is included in the communication history as a result of the determination by the identification information determination means. The information processing apparatus according to 1.   A program for causing a computer to function as the information processing apparatus according to claim 1.   A computer-readable recording medium storing the program according to claim 3. An information processing system comprising a first information processing device and a second information processing device,
The first information processing apparatus includes:
Known information storage means for storing a port number used for transmission of an attack packet;
A communication history storage that stores a communication history including a communication process started when the monitored communication is executed, communication destination identification information by the communication process, and a port number used by communication by the communication process. Means,
Time determination means for determining whether the generation time or update time of the execution file of the communication process included in the communication history is included in a predetermined period based on the attack time;
Port number determination means for determining whether a port number included in the communication history stored in the communication history storage means matches a port number stored in the known information storage means;
The communication history includes a communication process in which the execution file generation time or update time is determined to be included in the predetermined period as a result of the determination by the time determination unit, and the determination result by the port number determination unit First extraction means for extracting the communication history including the port number determined not to match the port number stored in the known information storage means;
Transmission means for transmitting the communication history extracted by the first extraction means to the second information processing apparatus,
The second information processing apparatus
Receiving means for receiving the communication history from a plurality of the first information processing devices;
An information processing system comprising: a second extraction unit that extracts the communication history having common identification information from the communication history received by the reception unit.

Images