JP2011193343A - Communications network monitoring system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To detect a malignant host, using a simple method. <P>SOLUTION: A communications network monitoring system includes a receiving unit 11a for receiving from a DNS (domain name system) server 30 first information and second information specifying a terminal device; a storage section 11b for storing the received first information and second information in a database; a determining unit 13a for calculating the number of second information items corresponding to the first information, comparing the number of the second information items with a predetermined first threshold, if the number of the second information items is more than the first threshold, calculating average alive period of the second information, and comparing the average alive period with a predetermined second threshold; and a transmitting unit for transmitting a result of the determination to the terminal device that requests the determination. If the average alive period is smaller than the second threshold, the determining unit 13a determines that a host which is specified by the first information and the second information is a malignant host. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a communication network monitoring system that detects a malicious host that provides an antisocial program including malware to a terminal device connected to a communication network.

  Recently, malware infection via the Web (World wide web) has been increasing, which has become a major social problem. Malware is a general term for harmful software such as computer viruses. For example, in addition to malicious software, worms, and spyware, crimeware that was originally created for criminal purposes is also included. As a countermeasure against this problem, a promising measure is to list malicious websites that distribute malware and restrict the users from accidentally accessing the malicious websites.

  There are the following technologies for detecting malicious hosts that distribute malware. First, there is a technique for detecting malware by pattern matching. In this technique, the content downloaded from the website is subjected to pattern matching to detect malware. Then, the host where the malware is detected is determined as a malicious host. Next, there is a technology for detecting malware by behavior analysis. This technology is targeted by monitoring the behavior of content downloaded from websites with a system installed for verification and detecting the creation and modification of unauthorized files, processes, registry information, etc. Determine the host. In addition, there is a technique for patrol a Web site. In this method, a website is automatically visited, contents are collected, and a malicious host is determined using any one of the methods described above. Further, for example, Patent Document 1 discloses a system for detecting a Trojan horse program that disguises DNS (Domain Name System).

Special table 2008-532133

  However, recent malware often creates a large number of variants in a short period of time, so pattern creation often cannot keep up. For this reason, there is a limit to the method of detecting malware by pattern matching. In the method of detecting malware by behavior analysis, there are many malware that cannot be detected depending on the OS (Operating System) and software environment, and this method has its limitations. The technique of visiting Web sites uses a large amount of resources and requires a lot of time, so it is difficult to cover all Web sites. In addition, some malicious websites have an access restriction function that returns harmless content once accessed from a certain terminal device, even if accessed from the same terminal device thereafter. Therefore, it is difficult to correctly determine malignancy.

  The present invention has been made in view of such circumstances, and an object thereof is to provide a communication network monitoring system capable of detecting a malicious host by a simple method.

  (1) In order to achieve the above object, the present invention takes the following measures. That is, the communication network monitoring system of the present invention is a communication network monitoring system that detects a malicious host that provides an antisocial program including malware to a terminal device connected to a communication network, and is a DNS (Domain A receiving unit for receiving first information and second information for identifying a terminal device from a (Name System) server; a storage unit for storing the received first information and second information in a database; The number of the second information corresponding to one information is calculated, the number of the second information is compared with a predetermined first threshold value, and the number of the second information is the first threshold value. Is greater than, a determination unit that calculates an average survival time of the second information and compares the average survival time with a predetermined second threshold, and the determination result is the end of the determination request. A transmission unit that transmits a device, and the determination unit determines that the host specified by the first information and the second information is malignant when the average lifetime is smaller than the second threshold. It is characterized by determining.

  In this manner, the number of second information corresponding to the first information is calculated, the number of second information is compared with a predetermined first threshold, and the number of second information is the first information When the average survival time is greater than the threshold, the average survival time of the second information is calculated, the average survival time is compared with a predetermined second threshold, and if the average survival time is less than the second threshold, Since the host specified by the first information and the second information is determined to be malignant, the malignant host can be detected by a simple method.

  (2) Moreover, the communication network monitoring system of the present invention is a communication network monitoring system for detecting a malicious host that provides an antisocial program including malware to a terminal device connected to the communication network, A receiving unit that receives first information and second information specifying a terminal device from a DNS (Domain Name System) server; and a storage unit that stores the received first information and second information in a database; The number of the first information corresponding to the second information is calculated, the number of the first information is compared with a predetermined third threshold, and the number of the first information is When the threshold value is greater than 3, the average lifetime of the first information is calculated, the determination unit that compares the average lifetime with a predetermined fourth threshold value, the determination result, the determination request Done A transmission unit that transmits a terminal device, and when the average lifetime is smaller than the fourth threshold, the determination unit determines a host specified by the first information and the second information. It is determined to be malignant.

  Thus, the number of first information corresponding to the second information is calculated, the number of first information is compared with a predetermined third threshold, and the number of first information is the third number. When larger than the threshold, the average survival time of the first information is calculated, the average survival time is compared with a predetermined fourth threshold, and if the average survival time is smaller than the fourth threshold, Since the host specified by the first information and the second information is determined to be malignant, the malignant host can be detected by a simple method.

  (3) In the communication network monitoring system according to the present invention, the determination unit may vary the second information corresponding to the first information, or may vary the first information corresponding to the second information. Based on the above, the determination is performed.

  As described above, since the determination is performed based on the variation of the second information corresponding to the first information or the variation of the first information corresponding to the second information, the malicious host is detected by a simple method. be able to. For example, generally, IP addresses associated with the same domain name tend to have a small variation because the address space is close, so if the variation is large, it can be determined that the malignancy is high It becomes.

  (4) In the communication network monitoring system of the present invention, the threshold value is variable.

  Thus, since the threshold value is variable, it is possible to set the threshold value according to the operation status of the system. That is, the number of IP addresses associated with the same domain name (for example, 100), the lifetime of the IP address (for example, 1 month), the number of domains associated with the same IP address (for example, 50) When the lifetime of the domain is set (for example, one month), these threshold values can be adjusted according to the operation status.

  (5) In the communication network monitoring system according to the present invention, the first information is a domain name, and the second information is an IP address.

  Thus, since the first information is a domain name and the second information is an IP address, a malicious host can be detected by a simple method.

  According to the present invention, the number of second information corresponding to the first information is calculated, the number of second information is compared with a predetermined first threshold, and the number of second information is When the average lifetime is smaller than the first threshold, the average lifetime of the second information is calculated, the average lifetime is compared with a predetermined second threshold, and the average lifetime is smaller than the second threshold. Since the host specified by the first information and the second information is determined to be malignant, the malignant host can be detected by a simple method.

It is a figure which shows the outline | summary of the malicious host determination system (communication network monitoring system) which concerns on this embodiment. It is a figure which shows the concept of operation | movement of the malicious host determination system (communication network monitoring system) which concerns on this embodiment. 4 is a flowchart showing a specific operation of the DNS information collecting apparatus 11. 3 is a flowchart showing a specific operation of a malicious host determination device 13. 3 is a flowchart showing a specific operation of a malicious host determination device 13. It is a figure which shows the example which grouped about the IP address. It is a figure which shows the example which grouped about the domain name.

  The inventors of the present invention repeatedly set up a plurality of IP addresses for the same domain name for a malicious host that repeatedly conducts surveys and verifications on the Web and distributes malware, etc. Focusing on the tendency to set names to a single IP address and change them frequently, search for the associated IP address using the domain name as a key, and associate it with a certain number of IP addresses The inventors have found that malignancy can be determined when the average survival time is not more than a certain time, and have led to the present invention.

  That is, the present invention is a communication network monitoring system for detecting a malicious host that provides an antisocial program including malware to a terminal device connected to a communication network, from a DNS (Domain Name System) server. A receiving unit for receiving first information and second information for specifying a terminal device, a storage unit for storing the received first information and second information in a database, and corresponding to the first information When the number of the second information is calculated, the number of the second information is compared with a predetermined first threshold, and the number of the second information is larger than the first threshold A determination unit that calculates an average lifetime of the second information and compares the average lifetime with a predetermined second threshold, and transmits the determination result to the terminal device that has made the determination request. And , The determination unit is configured when the average survival time is less than the second threshold value, and judging the host specified by the first information and the second information as malignant.

  Thus, the present inventors have made it possible to detect a malignant host by a simple method. Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing an overview of a malicious host determination system (communication network monitoring system) according to the present embodiment. The communication network monitoring system 10 is connected to the traffic branch device 20 and receives DNS information managed by the DNS server 30. The DNS server 30 exchanges information with the terminal devices 50 a to 50 c connected to the network 40 and the Internet 50 via the traffic branching device 20.

  A malicious host determination system 10 as a communication network monitoring system includes a DNS information collection device 11, a DB 12, and a malicious host determination device 13. In the DNS information collection device 11, the DNS information that the DNS server 30 has, that is, the domain name and IP address are acquired from the traffic branch device 20. The DB 12 stores DNS information collected by the DNS information collection device 11. In response to a request from the terminal device 50c, the malicious host determination device 13 determines whether the host is a malicious host based on the combination of the domain name and the IP address stored in the DB 12.

  The communication network monitoring system configured as described above manages association between domain names and IP addresses together with their lifetimes. Then, the association is verified retroactively. The communication network monitoring system according to the present embodiment targets a network of a certain scale (for example, the number of users is 10,000 or more), and extracts information based on the contents of inquiry communication to the DNS of the network. Thereby, it becomes possible to implement this invention, without adding a modification to the existing DNS server. The information storage format in the DB 12 can be as shown in the following table, for example.

  FIG. 2 is a diagram illustrating a concept of operation of the communication network monitoring system according to the present embodiment. The traffic branching device 20 outputs a DNS inquiry request to the DNS server 30 and a DNS inquiry response from the DNS server 30 to the DNS information collecting device. When the receiving unit 11a receives a host name as a DNS request and an IP address as a DNS response, the storage unit 11b stores the host name, IP address, and time information at the time of reception in the DB 12. Also, the DNS information collection device 11 creates a new record or updates an existing record in the DB 12. Further, the malicious host determination device 13 receives a determination request (request) from the terminal device 50c by the reception unit 13b, the determination unit 13a searches the DB 12, and the transmission unit 13c transmits the determination result to the terminal device 50c. .

  Next, an operation in which the DNS information collection device 11 collects and manages DNS information will be described. The DNS information collection device 11 targets a network of a certain scale or larger, for example, a DNS server used by 10,000 or more users. The contents of the inquiry communication to the DNS server are analyzed, and the domain name, the associated IP address, and the inquiry time are collected. Information managed by the DNS information collection device 11 includes four items: domain name, IP address, initial inquiry time, and final inquiry time. When a combination of a domain name and an IP address appears for the first time, the last inquiry time is set as the first inquiry time. If the combination of domain name and IP address already exists, the time observed here is updated as the last inquiry time. The information storage format in the DB 12 can be as shown in the following table, for example.

  FIG. 3 is a flowchart showing a specific operation of the DNS information collecting apparatus 11. First, when a DNS inquiry communication is detected (step S1), a domain name and time information are acquired (step S2). Next, when DNS response communication is detected (step S3), an IP address is acquired (step S4). Then, the DB is searched based on the domain name and IP address acquired as described above (step S5). It is determined whether a combination of domain name and IP address exists in the DB (step S6). If a combination of domain name and IP address exists, the final time of the target record is updated (step S7), and step S1. Transition to. On the other hand, if the combination of domain name and IP address does not exist in step S7, a new record is created (step S8), and the acquired domain name, IP address and time information are registered in the DB (step S9). The final time is also set as the acquisition time here, and the process proceeds to step S1.

  Next, an operation in which the malicious host determination device 13 determines a malicious host will be described. Here, detection of a malicious host (malicious domain) having a plurality of frequently updated IP addresses will be described. The malicious host determination device 13 searches for an associated IP address using the domain name as a key. Here, it is determined that the IP address is associated with a certain number (for example, 50) or more of IP addresses, and the average of the lifetime is equal to or less than a certain time, it is determined as malignant.

  FIG. 4 is a flowchart showing a specific operation of the malicious host determination device 13. First, when a domain name serving as a search key is designated (step T1), the DB is searched (step T2). Next, the number of IP addresses is extracted (step T3), and the number of IP addresses is compared with a threshold (first threshold) (step T4). This threshold can be set to 50, for example. If the number of IP addresses is smaller than the threshold value as a result of this comparison, benign judgment is performed (step T5). On the other hand, if the number of IP addresses is larger than the threshold value in step T4, the average lifetime of the IP address is calculated (step T6). Then, the average survival time is compared with a threshold (second threshold) (step T7). This threshold can be, for example, one month. If the average survival time is greater than the threshold value, benign judgment is performed (step T5). On the other hand, if the average survival time is smaller than the threshold value in step T7, the malignancy is determined (step T8).

Note that variations in IP addresses can also be used as criteria. In general, since IP addresses associated with the same domain name are close to each other, variation tends to be small. For example, if three IP addresses are as follows, it is considered that the variation is small and the malignancy is small.
aaa.bbb.ccc.200
aaa.bbb.ccc.202
aaa.bbb.ccc.205

On the other hand, if the three IP addresses are as follows, the variation is large and the malignancy is considered large.
aaa.bbb.ccc.200
ddd.eee.fff.1
ggg.hhh.iii.90
It is also possible to have a white list to prevent false detection.

  Next, an operation in which the malicious host determination device 13 determines a malicious host will be described. Here, detection of an IP address having a plurality of domains that are frequently updated will be described. The malicious host determination device 13 searches for an associated domain name using the IP address as a key. If it is associated with a certain number (for example, 100) or more of domain names and the average of the lifetime is not more than a certain time, it is determined as malignant. The information storage format in the DB 12 can be as shown in the following table, for example.

  FIG. 5 is a flowchart showing a specific operation of the malicious host determination device 13. First, when an IP address serving as a search key is designated (step R1), the DB is searched (step R2). Next, the number of domains is extracted (step R3), and the number of domains is compared with a threshold (third threshold) (step R4). This threshold value can be set to 100, for example. If the number of domains is smaller than the threshold value as a result of this comparison, benign judgment is performed (step R5). On the other hand, if the number of domains is larger than the threshold value in step R4, the average survival time of the domain name is calculated (step R6). Then, the average survival time is compared with a threshold (fourth threshold) (step R7). This threshold can be, for example, one month. If the average survival time is greater than the threshold value, benign judgment is performed (step R5). On the other hand, if the average survival time is smaller than the threshold value in step R7, malignancy is determined (step R8).

Note that the similarity of domain names can also be used as a criterion. In general, the domain names associated with the same IP address are often the same, except that the upper domain name does not change and only the subdomain name is different. For example, if the three domain names are as follows, the similarity is large and the malignancy is small.
aaa.xxx.com
bbb.aaa.xxx.com
ccc.xxx.com

On the other hand, if the three domain names are as follows, the similarity is low and the malignancy is high.
aaa.xxx.com
aaa.yyy.net
ddd.zzz.co.jp

  FIG. 6A is a diagram illustrating an example of grouping IP addresses, and FIG. 6B is a diagram illustrating an example of grouping domain names. The similarity can be calculated as follows, for example. That is, when the host identifier (IP address or the like) and the host name have a hierarchical structure, those having the same part except for the terminal part are classified as the same group. For the top n groups with the largest number of elements, if the total number of elements is greater than or equal to m, it is determined that the degree of similarity is high. n is x percent of the total number of components (rounded up after the decimal point). m is y percent of the total number of components. x and y can be changed. In order to prevent erroneous detection, it is possible to have a white list.

10 Malicious host determination system (communication network monitoring system)
11 DNS information collecting device 11a receiving unit 11b storage unit 13 malicious host determining device 13a determining unit 13b receiving unit 13c transmitting unit 20 traffic branching device 30 DNS server 40 network 50 Internet 50a-50c terminal device

Claims (5)

A communication network monitoring system for detecting a malicious host that provides an antisocial program including malware to a terminal device connected to a communication network,
A receiving unit that receives first information and second information identifying a terminal device from a DNS (Domain Name System) server;
A storage unit for storing the received first information and second information in a database;
The number of the second information corresponding to the first information is calculated, the number of the second information is compared with a predetermined first threshold, and the number of the second information is the first information. A determination unit that calculates an average survival time of the second information and compares the average survival time with a predetermined second threshold;
A transmission unit that transmits the determination result to the terminal device that has made the determination request;
The determination unit determines that the host specified by the first information and the second information is malignant when the average lifetime is smaller than the second threshold. system. A communication network monitoring system for detecting a malicious host that provides an antisocial program including malware to a terminal device connected to a communication network,
A receiving unit that receives first information and second information identifying a terminal device from a DNS (Domain Name System) server;
A storage unit for storing the received first information and second information in a database;
The number of the first information corresponding to the second information is calculated, the number of the first information is compared with a predetermined third threshold, and the number of the first information is the third information A determination unit that calculates an average lifetime of the first information and compares the average lifetime with a predetermined fourth threshold;
A transmission unit that transmits the determination result to the terminal device that has made the determination request;
The determination unit determines that the host specified by the first information and the second information is malignant when the average lifetime is smaller than the fourth threshold. system.   The determination unit performs the determination based on a variation in the second information corresponding to the first information or a variation in the first information corresponding to the second information. The communication network monitoring system according to claim 1 or 2.   The communication network monitoring system according to any one of claims 1 to 3, wherein the threshold value is variable. The communication network monitoring system according to any one of claims 1 to 4, wherein the first information is a domain name, and the second information is an IP address.

Images