JP2013232113A - Information processing apparatus, monitoring method, and monitoring program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve accuracy for identifying whether or not a program is a monitoring target program.SOLUTION: Virtual machines operating in an information processing apparatus each hold position information that specifies a storage position on a virtual physical memory in which a monitoring target program is stored, and a taint tag that identifies being a monitoring target in association with each other. When the program stored in the virtual physical memory is executed, the virtual machines each determine whether or not the taint tag is held in association with the position information that stores the program to be executed. When it is determined that the taint tag is held in association with the program, the virtual machines each determine that the program is a monitoring target.

Description

  The present invention relates to an information processing apparatus, a monitoring method, and a monitoring program.

  Conventionally, a program that executes a monitored program in an isolated environment such as a general-purpose OS that is physically or virtually isolated, such as a guest OS (Operating System) operating on a virtual machine, and monitors the behavior of the monitored program Analytical methods are known.

  For example, an API (Application Program Interface) issued by the monitoring target program is monitored, and the behavior of the monitoring target program is grasped by an API string and an argument passed to each API. In addition, the issuing of a system call is monitored instead of the API. It is also known to collect memory addresses accessed by a monitored program and analyze the program using the collected information. In addition, a series of instructions executed by the monitoring target program is collected, and the program is analyzed using the collected information.

  As a method for identifying whether a program operating on a general-purpose OS is a monitoring target or a non-monitoring target, a method using a process ID (PID) is generally known. For example, the PID of the process that issued the API is compared with the PID of the monitoring target program stored in advance to identify whether the API is issued from the monitoring target program. In addition, a method of using the value of the CR3 register as an identifier for identifying each process instead of PID is also known.

“Toward Automated Dynamic Malware Analysis Using CWSandbox”, IEEE Security and Privacy, Vol.5, No.2, pp.32-39, 2007 “TTAnalyze: A Tool for Analyzing Malware”, 15th European Institute for Computer Antivirus Research (EICAR 2006) Annual Conference “Memory Behavior—Based Automatic Malware Unpacking in Stealth Debugging Environment”, 5th International Conference on Malicious and Unwanted Software (MALWARE 2010), 2010

  However, in the conventional method based on the value of the PID or CR3 register, there is a case that the monitoring target program may be erroneously identified, and the identification accuracy is not necessarily high.

  For example, in the method of identifying the monitoring target program by the value of the PID or CR3 register, if a malicious method such as code injection or file infection is used, detection omission and error detection occur. Code injection is a technique that injects its own code into another process and performs malicious actions within the injected process. File infection is a method in which when a file of an executable format other than itself is infected and the infected file is executed, its malicious operation is started together.

  For example, a case where an infection process in which a code is injected from a process to be monitored issues an API by code injection in a situation where the API to be monitored is specified by PID will be described. In this case, if the PID of the infected process into which the code is injected is set as a non-monitoring target, the API issued from this infected process is identified as a non-monitoring target that should originally be a monitoring target. In addition, in code injection, when an injection destination process is set as a monitoring target, an API issued by a normal operation of the process is also monitored. In other words, error detection and omission of detection occur due to code injection.

  In the case of file infection, if a program having a PID to be monitored is given an unauthorized program due to file infection, the original program and the unauthorized program operate with the same PID. Can not be identified accurately. In other words, the original program and the illegal program cannot be distinguished, and there are only two options, ie, whether all are to be monitored or all not to be monitored, so that error detection or detection omission occurs.

  The present invention has been made in view of the above, and an object thereof is to provide an information processing apparatus, a monitoring method, and a monitoring program that can improve the accuracy of identifying whether or not the program is a monitoring target program.

  In order to solve the above-described problems and achieve the object, the information processing apparatus according to the present invention identifies position information specifying a storage position on a memory in which a program to be monitored is stored, and the monitoring target. A holding unit that associates and holds an identifier to be executed, and when the program stored in the memory is executed, the identifier is held in the holding unit in association with the position information that stores the program to be executed. A determination unit that determines whether or not the identifier is held by the determination unit; and a determination unit that determines the program to be executed as a monitoring target when the determination unit determines that the identifier is held.

  The information processing apparatus, the monitoring method, and the monitoring program according to the present invention have an effect that the accuracy of identifying whether the program is a monitoring target program can be improved.

FIG. 1 is a diagram illustrating the overall configuration of the information processing apparatus. FIG. 2 is a functional block diagram illustrating a functional configuration example of the virtual machine. FIG. 3 is a diagram illustrating an example of information stored in the shadow memory. FIG. 4 is a diagram illustrating an example of information stored in the shadow disk. FIG. 5 is a diagram illustrating the relationship between the shadow memory and the virtual physical memory. FIG. 6 is a diagram for explaining an example of propagation of a taint tag. FIG. 7 is a flowchart showing the flow of processing when the execution target program is executed. FIG. 8 is a flowchart showing the flow of behavior analysis processing. FIG. 9 is a flowchart showing a processing flow when data writing to the memory occurs. FIG. 10 is a diagram illustrating a computer that executes a monitoring program.

  Embodiments of an information processing apparatus, a monitoring method, and a monitoring program according to the present invention will be described below in detail with reference to the drawings. In addition, this invention is not limited by this embodiment.

[First Embodiment]
[overall structure]
FIG. 1 is a diagram illustrating the overall configuration of the information processing apparatus. As illustrated in FIG. 1, the information processing apparatus includes hardware 1, host OS 2, virtual machine software 3, virtual machine 10, and virtual machine 20.

  The hardware 1 is an electronic circuit or a peripheral device constituting the information processing apparatus, and is, for example, a memory, a CPU (Central Processing Unit), or the like. The host OS 2 is an OS serving as a base for operating the virtual machine, and is executed using the hardware 1. The virtual machine software 3 is software that provides a virtual machine using the hardware 1. Here, the virtual machine 10 and the virtual machine 20 are operated. For example, the virtual machine software 3 allocates a virtual disk, virtual physical memory, virtual CPU, and the like to the guest OS to operate the virtual machine.

  The virtual machine 10 and the virtual machine 20 are virtual information processing apparatuses that execute various processes by operating a guest OS using a virtual disk, virtual physical memory, virtual CPU, or the like provided from the virtual machine software 3. .

  In such a configuration, the information processing apparatus monitors a program whose behavior is to be analyzed in the virtual machine 10 or the virtual machine 20 that is an isolated environment. Specifically, each virtual machine holds location information for specifying a storage location on the virtual physical memory in which the monitoring target program is stored and a taint tag for identifying the monitoring target in association with each other. When a program stored in the virtual physical memory is executed, each virtual machine determines whether or not a taint tag is held in association with position information storing the program to be executed. Then, when it is determined that each taint tag is held, each virtual machine determines the program to be executed as a monitoring target.

  In this way, the information processing apparatus, when analyzing the program behavior, monitors the execution of the program, if a program with a taint tag is being executed, and if it is not attached with a taint tag, It is outside. As a result, the information processing apparatus can accurately distinguish between the monitoring target program and the non-target program, and the accuracy of identifying whether the program is the monitoring target program can be improved.

Virtual machine configuration
Next, the configuration of the virtual machine that monitors the monitoring target program in the information processing apparatus shown in FIG. 1 will be described. Since the hardware 1, the host OS 2, and the virtual machine software 3 have the same configuration as a general configuration, detailed description thereof is omitted. Since the virtual machine 10 and the virtual machine 20 have the same configuration, the virtual machine 10 will be described as an example here.

  FIG. 2 is a functional block diagram illustrating a functional configuration example of the virtual machine. As shown in FIG. 2, the virtual machine 10 includes a virtual physical memory 10a, a shadow memory 10b, a virtual disk 11a, a shadow disk 11b, a virtual CPU 12, and a virtual HW controller 18.

  The virtual physical memory 10a is a virtual memory realized by allocating a predetermined area in the physical memory of the information processing apparatus as a memory used by the guest OS operating on the virtual machine 10. For example, the virtual physical memory 10a stores programs and data read from the virtual disk 11a by the virtual CPU 12.

  The shadow memory 10b is a data structure that associates and stores a taint tag indicating a monitoring target and position information that specifies a storage position on the virtual physical memory 10a in which the monitoring target program is stored. For example, the structure of the shadow memory 10b may be a simple array structure or a taint tag as a tree structure. Moreover, as the information to be stored, a value as a taint tag may be given, or as a pointer to a data structure holding taint information. The mounting form of the shadow memory 10b can be arbitrarily changed according to performance and memory consumption.

  For example, when performance is important, an area having the same size as the virtual physical memory 10a can be prepared in advance and used as a shadow memory. On the other hand, when it is desired to reduce the memory consumption, it is possible to hold only elements relating to data for which taint tags are set. The size of the taint tag depends on how many types of data you want to identify. For example, if only one type of tag is sufficient, it may be identified by 1 bit, and if 256 types are identified, an 8-bit size is used. Further, when a taint tag is provided as a pointer to the data structure, the size of the address can be used as the size. The location on the memory may be designated by a virtual address, a physical address, or any other location information that can specify the storage location.

  Here, an example of the shadow memory 10b will be described. FIG. 3 is a diagram illustrating an example of information stored in the shadow memory. As illustrated in FIG. 3, the shadow memory 10 b stores a “virtual physical memory address” and a 2-bit “taint tag” in association with each other. The “virtual physical memory address” is position information indicating the storage position on the virtual physical memory 10a, and the “taint tag” is an identifier for identifying a monitoring target. Here, when the 2-bit information of the “taint tag” is “1”, it indicates that the data to be monitored is the code of the program.

  In the case of FIG. 3, the taint tag “11” is given to the monitoring target program code stored in the addresses “0000 to 0200” of the virtual physical memory 10a. Further, it indicates that the taint tag “05” is given to the monitoring target data stored in the addresses “0310 to 0350” of the virtual physical memory 10a. Note that the numerical values and the like shown in FIG. 3 are merely examples, and the values and the like are not limited.

  The virtual disk 11a is a virtual disk realized by allocating a predetermined area in a physical disk included in the information processing apparatus as an area used by the guest OS operating in the virtual machine 10. For example, the virtual disk 11a stores a program to be executed by the virtual CPU 12, data to be processed by the program, and the like.

  The shadow disk 11b is a data structure that stores a taint tag indicating that it is a monitoring target and position information that specifies a storage position on the virtual disk 11a in which the program to be monitored is stored in association with each other. For example, the structure of the shadow disk 11b may be a simple arrangement structure, or a taint tag may be held as a tree structure. Moreover, as the information to be stored, a value as a taint tag may be given, or as a pointer to a data structure holding taint information. As with the shadow memory 10b, the mounting form of the shadow disk 11b can be arbitrarily changed depending on performance, memory consumption, and the like.

  Here, an example of the shadow disk 11b will be described. FIG. 4 is a diagram illustrating an example of information stored in the shadow disk. As shown in FIG. 4, the shadow disk 11b stores a “virtual disk address” and a 2-bit “taint tag” in association with each other. The “virtual disk address” is position information indicating the storage position on the virtual disk 11a, and the “taint tag” is an identifier for identifying the monitoring target. Here, when the 2-bit information of the “taint tag” is “1”, it indicates that the data to be monitored is the code of the program.

  In the case of FIG. 4, the taint tag “17” is given to the monitoring target program code stored in the addresses “1000 to 1200” of the virtual disk 11a. Further, it indicates that the taint tag “05” is given to the monitoring target data stored in the addresses “1410 to 1450” of the virtual disk 11a. Note that the numerical values shown in FIG. 4 are merely examples, and the values are not limited.

  The virtual CPU 12 is a virtual CPU that is realized by allocating a predetermined processing capacity of a physical CPU included in the information processing apparatus as a CPU used by a guest OS operating on the virtual machine 10. The virtual CPU 12 includes a program execution unit 13, a taint tag assignment unit 14, a determination unit 15, a write monitoring unit 16, and a behavior monitoring unit 17, and executes various processes.

  The program execution unit 13 is a processing unit that executes a program stored in the virtual disk 11a. For example, the program execution unit 13 reads a program from the virtual disk 11a and develops it in the virtual physical memory 10a. That is, the program execution unit 13 reads the execution target program from the virtual disk 11a and stores it in the virtual physical memory 10a, and then executes the execution target program stored in the virtual physical memory 10a.

  The taint tag assigning unit 14 is a processing unit that assigns a taint tag when a program developed on the virtual physical memory 10a by the program executing unit 13 is a monitoring target. For example, when the taint tag assigning unit 14 detects that the program execution unit 13 stores a program in the virtual physical memory 10a, it determines whether or not the program is a monitoring target. When the taint tag assigning unit 14 determines that the program is to be monitored, the taint tag assigning unit 14 identifies the position on the virtual physical memory 10a where the program is stored, and stores the taint tag in the entry on the shadow memory 10b corresponding to the identified position. To do.

  For example, the taint tag assigning unit 14 specifies “0150 to 0160” as an address on the virtual physical memory 10a in which a code portion, which is a set of instructions executed in the monitoring target program, is stored. Then, the taint tag assigning unit 14 assigns the taint tag “14” to the identified addresses “0150 to 0160”. Thereafter, the taint tag assigning unit 14 stores the identified address “0150 to 0160” in association with the assigned taint tag “14” in the shadow memory 10b.

  Note that various known methods can be used as a method for determining whether or not the object is a monitoring target. For example, the name of a program to be monitored can be specified in advance, and it can be determined whether or not it is a monitoring target based on whether or not the program loaded in the virtual physical memory 10a matches the program specified in advance. Further, when the program is scanned and an instruction specified as a monitoring target is included, it can be determined as a monitoring target. In addition, an arbitrary value can be set for the taint tag to be assigned.

  The determination unit 15 is a processing unit that determines whether the executed program is a monitoring target. Specifically, the determination unit 15 refers to the shadow memory 10b, and stores a taint tag representing a monitoring target in association with position information on the virtual physical memory 10a in which the executed program is stored. It is determined that it is a monitoring target. Then, the determination unit 15 notifies the behavior monitoring unit 17 that the executed program is a monitoring target.

  For example, when the determination unit 15 detects that the program execution unit 13 has read the program from the address “0000-0200” of the virtual physical memory 10a, the determination unit 15 specifies the address “0000-0200” as the read destination. Then, the determination unit 15 refers to the shadow memory 10b and specifies that the taint tag “11” is stored in association with the address “0000 to 0200”. Then, the determination unit 15 determines that the program read from the address “0000-0200” and executed is the monitoring target.

  The write monitoring unit 16 is a processing unit that monitors data writing to the virtual physical memory 10a and adds a taint tag to the written data when the monitoring target data is written. Specifically, when the program determined to be monitored writes data to the virtual physical memory 10a, the write monitoring unit 16 adds an entry in the shadow memory 10b corresponding to the position where the written data is stored. Stores taint tags. That is, the write monitoring unit 16 determines that the written data is a monitoring target when the command that wrote the data is an instruction included in the program code associated with the taint tag.

  For example, when the writing monitoring unit 16 detects that data has been written to the virtual physical memory 10a, the writing monitoring unit 16 identifies the program that has written the data. Then, the write monitoring unit 16 specifies an address “0000-0200” indicating the storage location of the specified program from the virtual physical memory 10a or the like. Subsequently, the write monitoring unit 16 refers to the shadow memory 10b and determines that the taint tag “11” is stored in association with the identified address “0000-0200”. In this case, the write monitoring unit 16 determines that the written data is a monitoring target because the data has been written by the program with the taint tag.

  Then, the write monitoring unit 16 refers to the virtual physical memory 10a, extracts the addresses “0010 to 0012” where the data has been written, and assigns the taint tag “04” to the extracted addresses “0010 to 0012”. Then, the write monitoring unit 16 associates the extracted address “0010 to 0012” with the assigned taint tag “04” and stores them in the shadow memory 10b. At this time, the write monitoring unit 16 may assign the same value as the taint tag of the written program as the taint tag of the written data.

  On the other hand, when the storage destination of the program to which data has been written is the address “0500 to 0600”, the write monitoring unit 16 monitors the written data because the taint tag corresponding to the shadow memory 10b is not stored. Judged out of scope. The write monitoring unit 16 determines whether or not the data newly written in the virtual physical memory 10a or the data read from the virtual disk 11a and written in the virtual physical memory 10a is a monitoring target.

  The write monitoring unit 16 writes the data read from the virtual disk 11a and the like when the data is written to the virtual physical memory 10a and the taint tag for the written data is stored in the shadow disk 11b. Are determined to be monitored. Then, the write monitoring unit 16 assigns a taint tag to the written address on the virtual physical memory 10a and stores it in the shadow memory 10b. That is, the write monitoring unit 16 propagates the taint tag from the shadow disk 11b to the shadow memory 10b. At this time, the write monitoring unit 16 may assign the same value as the taint tag originally assigned to the written data as the taint tag of the written data.

  The behavior monitoring unit 17 is a processing unit that monitors the behavior of the program to be monitored. For example, the behavior monitoring unit 17 collects the time from the execution of the monitored program to the end thereof, the accessed data and registry, the generated data and registry value, etc., and monitors the behavior of the program. For example, the behavior monitoring unit 17 monitors APIs and system calls issued by the monitoring target program, and grasps the behavior of the monitoring target program from the API string and arguments passed to each API. The behavior monitoring unit 17 collects memory addresses accessed by the monitoring target program and analyzes the program using the collected information. In addition, the instruction sequence executed by the monitoring target program is collected, and the program is analyzed using the collected information.

  The virtual HW controller 18 is a processing unit that controls data transmission / reception between the virtual disk 11a and the virtual physical memory 10a and between the shadow disk 11b and the shadow memory 10b. For example, the virtual HW controller 18 stores the program read from the virtual disk 11a by the program execution unit 13 in the virtual physical memory 10a. The virtual HW controller 18 stores data read from the virtual physical memory 10a by a program or the like in the virtual disk 11a. Such a virtual HW controller 18 includes a taint information propagation unit 18a that performs propagation of a taint tag.

  The taint information propagation unit 18a is a processing unit that monitors data writing to the virtual disk 11a and adds a taint tag to the written data when the monitoring target data is written. That is, the taint information propagation unit 18a propagates the taint tag from the shadow memory 10b to the shadow disk 11b. Specifically, when the program determined to be monitored writes data to the virtual disk 11a, the taint information propagation unit 18a sets the entry on the shadow disk 11b corresponding to the position where the written data is stored. Stores taint tags.

  Note that the content of the process executed by the taint information propagation unit 18a is the same as that of the write monitoring unit 16, and thus detailed description thereof is omitted. In brief, the taint information propagation unit 18a writes data read from the virtual physical memory 10a or the like to the virtual disk 11a, and stores a taint tag for the written data in the shadow memory 10b. The written data is determined as a monitoring target. Then, the taint information propagation unit 18a assigns a taint tag to the written address on the virtual disk 11a and stores it in the shadow disk 11b. At this time, the taint information propagation unit 18a may assign the same value as the taint tag originally assigned to the written data as the taint tag of the written data.

[Propagation of taint tag]
Next, an example of taint tag propagation will be described with reference to FIGS. Here, first, the relationship between the shadow memory 10b and the virtual physical memory 10a will be described with reference to FIG. 5, and then an example of taint tag propagation will be described with reference to FIG.

  FIG. 5 is a diagram illustrating the relationship between the shadow memory and the virtual physical memory. This figure is an example of managing taint tags in the shadow memory 10b. Further, the shadow disk 11b and the virtual disk 11a have the same relationship as the relationship described here.

  As shown in FIG. 5, it is assumed that the program execution unit 13 reads the monitoring target program A from the virtual disk 11a and develops it in the virtual physical memory 10a. Here, it is assumed that the code part of the program A is stored from 0200 to 0400 of the virtual disk 11a, the data part is stored from 0401 to 0500, and the heap part is stored from 0501 to 0600. Then, the taint tag assigning unit 14 stores the taint tag “15” at the address “address 0200 to address 0400” on the shadow memory 10b corresponding to the address “address 0200 to address 0400” where the code part of the program A is stored. In this way, program A is set as a monitoring target.

  Further, in FIG. 5, the taint tag “05” is stored in the address “address 0800 to address 0820” on the shadow memory 10b corresponding to the address “address 0800 to address 0820” of the virtual physical memory 10a in which the data X is stored. Yes. For this reason, the data X is also set as a monitoring target. On the other hand, no taint tag is stored in the address “address 0715 to address 0720” on the shadow memory 10b corresponding to the address “address 0715 to address 0720” of the virtual physical memory 10a in which the data Y is stored. For this reason, the data Y is set out of the monitoring target.

  Next, an example of taint tag propagation will be described. FIG. 6 is a diagram for explaining an example of propagation of a taint tag. As shown in FIG. 6, in the data X1 stored at the virtual disk address “addresses 4000 to 4020”, the taint tag “09” is stored at the address “addresses 4000 to 4020” on the shadow disk 11b. . For this reason, the data X1 is a monitoring target.

  In such a state, it is assumed that the data X1 is read from the virtual disk 11a and stored in addresses “addresses 0690 to 0710” on the virtual physical memory 10a. In this case, the write monitoring unit 16 determines that the data X1 written in the virtual physical memory 10a is also a monitoring target since the taint tag is given to the data X1. As a result, the write monitoring unit 16 stores the taint tag “09” at the addresses “0690 to 0710” on the shadow memory 10 b corresponding to the addresses “0690 to 0710” on the virtual physical memory 10 a.

  Thereafter, it is assumed that the data X1 stored at addresses “0690 to 0710” on the virtual physical memory 10a is updated to data X2 and stored at addresses “4000 to 4020” on the virtual disk 11a. In this case, the write monitoring unit 16 determines that the updated data X2 is also a monitoring target since the taint tag is assigned to the data X1 before the update. As a result, the write monitoring unit 16 stores the taint tag “09” at the address “4000 address to 4020 address” on the shadow disk 11 b corresponding to the address “4000 address to 4020 address” on the virtual disk 11 a. In this way, the data once determined to be monitored can be continuously monitored by propagating the taint tag.

  As another example, it is assumed that the program A to be monitored has written the data Z at addresses “0110 to 0150” on the virtual physical memory 10a. In this case, the write monitoring unit 16 determines that the written data Z is also a monitoring target because the program A into which the data Z has been written is the monitoring target. As a result, the write monitoring unit 16 sets the taint tag “03” to the address “0110 to 0150” on the shadow memory 10b corresponding to the address “0110 to 0150” on the virtual physical memory 10a to which the data Z is written. Is stored.

  Further, it is assumed that data Z stored at addresses “0110 to 0150” on the virtual physical memory 10a is stored at addresses “2280 to 2320” on the virtual disk 11a. In this case, since the taint tag is originally added to the data Z, the write monitoring unit 16 determines that the data Z written to the virtual disk 11a is also a monitoring target. As a result, the write monitoring unit 16 stores the taint tag “03” at the addresses “2280 to 2320” on the shadow disk 11 b corresponding to the addresses “2280 to 2320” on the virtual disk 11 a.

[Process flow]
Next, a description will be given of each of processing when a program to be executed is loaded from the virtual disk 11a to the virtual physical memory 10a, behavior analysis processing, and processing when data writing occurs.

(Processing when loading)
FIG. 7 is a flowchart showing the flow of processing when the execution target program is executed. As shown in FIG. 7, the program execution unit 13 of the virtual machine 10 loads the execution target program from the virtual disk 11a to the virtual physical memory 10a (S101).

  Then, the taint tag assigning unit 14 determines whether or not the loaded program is a program to be monitored (S102). If the taint tag assigning unit 14 determines that the loaded program is not a program to be monitored (No in S102), the process ends.

  On the other hand, when it is determined that the loaded program is a monitoring target program (Yes in S102), the taint tag assigning unit 14 specifies position information on the virtual physical memory 10a loaded with the monitoring target program (S103).

  Subsequently, the taint tag assigning unit 14 assigns a taint tag to the specified position information (S104), and associates the position information with the taint tag and stores them in the shadow memory 10b (S105). Then, the behavior monitoring unit 17 sets the program stored in the shadow memory 10b as a monitoring target (S106), and the program execution unit 13 executes the program loaded in the virtual physical memory 10a (S107).

(Behavior analysis processing)
FIG. 8 is a flowchart showing the flow of behavior analysis processing. In this example, when data access to the memory occurs, an example is described in which the behavior analysis is performed by determining whether the access source is a monitoring target. be able to.

  As shown in FIG. 8, when the access to the data stored in the virtual physical memory 10a occurs (S201 Yes), the determination unit 15 of the virtual machine 10 specifies the location information of the data access source (S202).

  Subsequently, the determination unit 15 refers to the shadow memory 10b and determines whether a taint tag is associated with the specified position information (S203). That is, the determination unit 15 determines whether or not a taint tag is given to an instruction that accesses data. When the determination unit 15 determines that the taint tag is associated with the position information (Yes in S204), the behavior monitoring unit 17 generates and holds a log indicating that the instruction to be monitored has accessed the data ( S205). For example, the behavior monitoring unit 17 extracts the access date and time, the instruction accessing the data, the storage position of the instruction, the data accessed by the instruction, the storage position of the data, and the like as a log. The log extracted in this way is used for behavior analysis by the behavior monitoring unit 17.

  On the other hand, when it is determined that the taint tag is not associated with the position information (No in S204), the determination unit 15 determines that the access source is not monitored and ends the process.

(Process when data writing occurs)
FIG. 9 is a flowchart showing a processing flow when data writing to the memory occurs. In this example, data access to the memory is described as an example, but data on the disk can be processed in the same manner.

  As shown in FIG. 9, when the data writing to the virtual physical memory 10a occurs (S301 Yes), the write monitoring unit 16 of the virtual machine 10 stores the positional information on the virtual physical memory 10a in which the program that wrote the data is stored. Is identified (S302).

  Subsequently, the write monitoring unit 16 refers to the shadow memory 10b and determines whether the taint tag is associated with the position information in which the program in which the data is written is stored (S303). Note that if the write monitoring unit 16 determines that the taint tag is not associated with the position information of the program (No in S304), the process ends.

  On the other hand, when it is determined that the taint tag is associated with the position information of the program (Yes in S304), the write monitoring unit 16 specifies the position information of the written data on the virtual physical memory 10a (S305).

  Subsequently, the write monitoring unit 16 adds a taint tag to the specified position information (S306), and associates the position information with the taint tag and stores them in the shadow memory 10b (S307). Then, the behavior monitoring unit 17 sets the program stored in the shadow memory 10b as a monitoring target (S308).

[effect]
As described above, the information processing apparatus can accurately distinguish between the monitoring target program and the non-target program, and can improve the accuracy of identifying whether the program is the monitoring target program. For example, even when program code is injected into another process by code injection, the injected code and the original code of the process can be distinguished from each other by looking at the taint tag. Even when a program code is assigned to another program file due to file infection, the assigned code portion and the code portion originally possessed by the file can be distinguished based on the value of the taint tag.

  In addition, since a taint tag is added when a program to be monitored is developed in the virtual physical memory 10a, omission of monitoring can be suppressed. Furthermore, since the monitoring target program can set the data written in the virtual physical memory 10a and the virtual disk 11a as the monitoring target, the behavior can be accurately monitored. Therefore, a taint tag is assigned to data handled by the program, and when the data is used or operated, the taint tag is propagated to analyze the data flow.

  Also, when analyzing a plug-in format program, the behavior of the plug-in and the behavior of the framework that executes the plug-in can be distinguished, and the plug-in format program can be analyzed accurately.

[Second Embodiment]
Although the embodiments of the present invention have been described so far, the present invention may be implemented in various different forms other than the above-described embodiments. Therefore, different embodiments will be described below.

(Analysis environment)
In the first embodiment, the program to be monitored is executed on the virtual machine, and the same processing can be performed even on the physical machine. For example, an emulator can be used instead of a virtual machine.

(Analytical method)
As a specific example of using the present invention for specifying a monitoring target program, API monitoring will be described as an example. When an API call is captured by some method, the API caller (stacked on the stack) is used. Whether the API is to be monitored can be determined by whether or not the return address has a taint tag to be monitored. Further, it may be determined whether or not the API call is to be monitored from whether or not an address having a taint tag to be monitored is included in the call stack when the API is called. It is also possible to acquire an API call from a monitoring target program from execution of a control transition instruction (call, jmp, etc.) with a monitoring target taint tag.

(Virtual machine execution mode)
In the first embodiment, the example in which the virtual machine 10 or the like is operated by the virtual machine software 3 executed by the host OS 2 has been described, but the execution form of the virtual machine is not limited to this. For example, a process level virtual machine may be used. Furthermore, without using a virtual machine, each processing unit described in FIG. 2 may be mounted as a module and operated in the OS.

  When a virtual machine or an emulator is used, the write monitoring unit 16 described with reference to FIG. 2 can be operated in a virtualized CPU. In addition, when installing as a module in the OS, the write monitoring unit 16 or the like drops the Present Bit of all process address spaces of the monitoring target program, for example, in order to acquire all memory accesses of the monitoring target program. Every memory access can be obtained in such a way as to generate a page fault each time. The processing units described in the above embodiments can be implemented by hardware.

(Move between virtual machines)
In the first embodiment, the case where the taint tag is changed between virtual machines has been described. However, the present invention is not limited to this, and the taint tag can be changed between virtual machines.

  For example, it is assumed that the virtual machine 10 stores data with a taint tag in the virtual disk of the virtual machine 20. In this case, the virtual machine 20 inquires of the virtual machine 10 whether or not a taint tag is given to the stored data. When notified that the taint tag has been assigned, the virtual machine 20 sets the taint tag in the entry of the shadow disk corresponding to the stored location information of the virtual disk.

(System configuration etc.)
Each component of each illustrated device is functionally conceptual, and does not necessarily need to be the same as the physically illustrated component. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the write monitoring unit 16 and the behavior monitoring unit 17 illustrated in FIG. 2 may be integrated. Further, the shadow memory 10b and the shadow disk 11b can be managed as one data structure by further using information for distinguishing between the memory address and the disk address. The shadow memory 10b and the shadow disk 11b may be realized by hardware when used on a physical machine, and may be realized by software when used on a virtual machine.

  In addition, all or some of the processes described as being automatically performed among the processes described in the present embodiment can be manually performed. Further, all or any part of each processing function performed in each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic.

(program)
It is also possible to create a monitoring program in which processing executed by the information processing apparatus according to the first embodiment is described in a language that can be executed by a computer. In this case, when the computer executes the monitoring program, the same effect as in the above embodiment can be obtained. Further, the monitoring program may be recorded on a computer-readable recording medium, and the monitoring program recorded on the recording medium may be read by the computer and executed to execute the same processing as in the above embodiment. An example of a computer that executes a monitoring program that implements the same function as the information processing apparatus shown in FIG.

  FIG. 10 is a diagram illustrating a computer that executes a monitoring program. As shown in FIG. 10, the computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100, for example. For example, a mouse 1100 and a keyboard 1120 are connected to the serial port interface 1050. For example, a display 1130 is connected to the video adapter 1060.

  Here, as shown in FIG. 10, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. The monitoring target program described in the above embodiment is stored in, for example, the hard disk drive 1090 or the memory 1010.

  Further, the monitoring program is stored in, for example, the hard disk drive 1090 as a program module in which a command to be executed by the computer 1000 is described. Specifically, the program execution procedure for executing the same information processing as the program execution unit 13 described in the above embodiment, the taint tag assignment procedure for executing the same information processing as the taint tag assignment unit 14, and the determination unit 15 are the same. A program module describing a determination procedure for executing the information processing, a write monitoring procedure for executing information processing similar to that of the write monitoring unit 16, and a behavior monitoring procedure for executing information processing similar to that of the behavior monitoring unit 17 And stored in the hard disk drive 1090.

  In addition, data used for information processing by the monitoring program is stored in the hard disk drive 1090 as program data, for example. Then, the CPU 1020 reads out the program module and program data stored in the hard disk drive 1090 to the RAM 1012 as necessary, and executes each procedure described above.

  Note that the program module and program data related to the monitoring program are not limited to being stored in the hard disk drive 1090, but are stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive 1100 or the like. Also good. Alternatively, the program module and program data related to the monitoring program are stored in another computer connected via a network such as a LAN (Local Area Network) or a WAN (Wide Area Network), and the CPU 1020 via the network interface 1070. It may be read out.

1 Hardware 2 Host OS
3 Virtual Machine Software 10 Virtual Machine 10a Virtual Physical Memory 10b Shadow Memory 11a Virtual Disk 11b Shadow Disk 12 Virtual CPU
DESCRIPTION OF SYMBOLS 13 Program execution part 14 Taint tag provision part 15 Judgment part 16 Write monitoring part 17 Behavior monitoring part 18 Virtual HW controller 18a Taint information propagation part 20 Virtual machine 1010 Memory 1011 ROM
1012 RAM
1020 CPU
1030 Hard disk drive interface 1040 Disk drive interface 1050 Serial port interface 1051 Mouse 1052 Keyboard 1060 Video adapter 1061 Display 1070 Network interface 1080 Bus 1090 Hard disk drive 1091 OS
1092 Application Program 1093 Program Module 1094 Program Data 1100 Disk Drive 1110 Mouse 1120 Keyboard 1130 Display

Claims (7)

A holding unit that associates and holds position information that specifies a storage position on a memory in which a program to be monitored is stored and an identifier that identifies the monitoring target;
A determination unit that determines whether or not the identifier is held in the holding unit in association with the position information storing the program to be executed when the program stored in the memory is executed;
An information processing apparatus comprising: a determination unit that determines that the program to be executed is a monitoring target when the determination unit determines that the identifier is held.   The holding unit assigns an identifier to the position information in which a code portion of the monitoring target program is stored when the monitoring target program is expanded in the memory, and associates the position information with the identifier. The information processing apparatus according to claim 1, wherein the information processing apparatus is held. When the program determined to be monitored by the determination unit writes data to the memory, the holding unit assigns an identifier to the position information in which the written data is stored, and the position information and the identifier Are further associated with each other,
The information processing apparatus according to claim 1, wherein the determination unit determines the data in which the position information and the identifier are associated and stored by the storage unit as a monitoring target. The holding unit assigns an identifier to position information indicating a storage position on the disk where the written data is stored when the program determined to be monitored by the determination unit writes data to the disk, Further storing the position information and the identifier in association with each other,
The information processing apparatus according to claim 1, wherein the determination unit determines the data in which the position information and the identifier are held by the holding unit as a monitoring target. The information processing apparatus is an apparatus for operating a plurality of virtual machines,
Each virtual machine has the holding unit, the determination unit, and the determination unit,
When the monitoring target data stored in another virtual machine is written to the own virtual machine, the holding unit is position information indicating a storage position on the virtual disk or virtual physical memory in which the written data is stored The information processing apparatus according to claim 1, wherein an identifier is assigned to the information, and the position information and the identifier are further associated with each other and retained. A monitoring method executed by an information processing apparatus,
A holding step of associating and holding position information for specifying a storage position on a memory in which a monitoring target program is stored and an identifier for identifying the monitoring target;
A determination step of determining whether or not the identifier is held in the holding step in association with the position information storing the program to be executed when the program stored in the memory is executed;
And a determination step of determining the program to be executed as a monitoring target when it is determined by the determination step that the identifier is held. Holding information associating position information for specifying a storage position on a memory in which a program to be monitored is stored with an identifier for identifying that the program is to be monitored;
When executing the program stored in the memory, determining whether the identifier is held in association with the position information in which the program to be executed is stored;
When determining that the identifier is stored, a monitoring program causing a computer to execute the step of determining the program to be executed as a monitoring target.

Images