JP2017204108A - Signature generator, signature generation method, and signature generation program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a signature generator capable of swiftly generating a signature for detecting an attack code other than an attack code used as an input value.SOLUTION: A signature generator 10 for generating a signature used for detecting an attack code includes: an input section 11 that receives inputs of plural attack codes; and a signature generation part 121 that extracts a pattern of a character string common to input plural attack codes, and generates a signature as a character string in which a pattern of a character string which is not common to the plural attack codes is replaced with a regular expression.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a signature generation device, a signature generation method, and a signature generation program.

  In recent years, cyber attacks against public servers have become a major threat. In particular, examples of exploiting vulnerabilities in commonly used software are serious problems. Although the fundamental countermeasure against software vulnerabilities is the application of patches, there are cases where the patches cannot be applied immediately for reasons such as verification of the impact on the system by applying the patches. In such a case, an unauthorized access detection product such as Web Application Firewall (WAF) is effective. An unauthorized access detection product such as WAF defines an attack pattern as a signature in advance and blocks communication matching the signature.

  By the way, when a vulnerability is discovered, there are situations in which attack codes of various patterns that exploit the vulnerability are published on the Web and the like, and attacks occur immediately around the world. For this reason, it is required to quickly create signatures that can detect various attack codes that exploit vulnerabilities. However, the number of experts who can create signatures is limited, and it is not easy to quickly create signatures that can detect various attack codes.

  Here, in order to create signatures that can detect various attack codes, for example, using the technique described in Non-Patent Document 1, a plurality of attack codes are used as input values to detect these attack codes. It is also conceivable to automatically generate a WAF signature.

Ralf Spenneberg., “Webserver-Sicherheit mit mod_security”, Datenschutz und Datensicherheit, p155-160, 3, 2009 Robert A. Wagner and Michael J. Fischer., “The String-to-String Correction Problem”, J. ACM, Vol. 21, pp.168-173, January 1974

  However, even if a WAF signature that detects these attack codes is automatically generated using a plurality of attack codes as input values by the above technique, it exploits vulnerabilities targeted for other than attack codes used as input values. Attack code cannot be detected. Therefore, an object of the present invention is to solve the above-described problem and to quickly generate a signature that can be detected for an attack code other than the attack code used as an input value.

  In order to solve the above-described problem, the present invention is a signature generation device that generates a signature used for detection of an attack code, the input unit receiving input of a plurality of attack codes, and the input of the plurality of attack codes A signature generation unit that extracts a common character string pattern and generates the signature that is a character string obtained by replacing a character string pattern that is not common to the plurality of attack codes with a regular expression. Features.

  According to the present invention, it is possible to quickly generate a signature that can be detected for an attack code other than the attack code used as an input value.

FIG. 1 is a diagram illustrating a configuration example of a signature generation apparatus. FIG. 2 is a diagram illustrating an example of morphological analysis of an attack code. FIG. 3 is a diagram illustrating an example of extraction of the longest common subsequence in a morpheme sequence of a plurality of attack codes. FIG. 4 is a diagram illustrating an example of signature generation by replacing a morpheme other than the longest common subsequence with a regular expression. FIG. 5 is a flowchart illustrating an example of a processing procedure of the signature generation apparatus. FIG. 6 is a diagram illustrating a computer that executes a signature generation program.

  Hereinafter, embodiments (embodiments) for carrying out the present invention will be described with reference to the drawings. The present invention is not limited to this embodiment.

  A signature generation apparatus 10 according to the present embodiment will be described with reference to FIG. When receiving the input of a plurality of attack codes, the signature generation apparatus 10 generates a signature using the plurality of attack codes. This signature is, for example, a pattern of a character string of the beginning of a packet or a packet group that serves as a clue to distinguish an attack in WAF or the like. The attack code is data used for an attack on the attack destination, and is, for example, a character string portion for exploiting the vulnerability of the attack destination software in the transmission packet to the attack destination.

  The signature generation device 10 includes an input unit 11, a control unit 12, and an output unit 13. The input unit 11 accepts input of a plurality of attack codes (for example, attack code A, attack code B, attack code C, etc.) used for signature generation. The control unit 12 controls the entire signature generation apparatus 10. Here, the signature generation unit 121 mainly generates a signature. The output unit 13 outputs the signature generated by the control unit 12.

  The signature generating unit 121 includes a character string dividing unit 122, a common partial sequence extracting unit 123, and a character string replacing unit 124.

  The character string dividing unit 122 divides each of the plurality of attack codes received by the input unit 11 into a character string of a meaningful minimum unit. For example, the character string dividing unit 122 performs a morpheme analysis of the attack code indicated by reference numeral 21 in FIG. 2 by a rule-based morpheme analyzer using a regular expression, and creates an attack code morpheme string indicated by reference numeral 22. In the morpheme string indicated by reference numeral 22, “|” indicates a boundary obtained by dividing the morpheme.

  The common partial string extraction unit 123 extracts a character string pattern (common partial character string) that is common to the plurality of attack codes, using the division result of the character strings of the plurality of attack codes. For example, the common subsequence extraction unit 123 calculates and extracts the longest common subsequence common to the plurality of attack codes using the result of the morphological analysis of the character strings of the plurality of attack codes. The calculation of the longest common subsequence is performed using the technique described in Non-Patent Document 2, for example. Note that the signature generation unit 121 uses the longest common subsequence of such a plurality of attack codes in the signature, so that other attack codes that attack the same vulnerability as the attack target vulnerability of the plurality of attack codes are also used. A signature that is easy to detect can be generated.

  For example, the common subsequence extraction unit 123 may generate a code 31 as the longest common subsequence of the attack code morpheme sequence shown in FIG. 3A and the attack code morpheme sequence shown in FIG. The character string shown in is extracted. In this example, a rule is applied in which upper and lower case letters are regarded as the same element, but the present invention is not limited to this.

  The character string replacement unit 124 generates a signature by generalizing a character string other than the common partial character string (for example, the longest common partial string) among the plurality of attack codes received by the input unit 11. For example, the character string replacement unit 124 generates a signature by replacing a character string other than the longest common subsequence among the plurality of attack codes received by the input unit 11 with a regular expression. For example, the regular expression is replaced by a technique described in Jeffrey E. F. Friedl, “Detailed Regular Expressions 3rd Edition”, O'Reilly Japan, etc.

  An example of processing for replacing a character string other than the longest common substring with a regular expression is given below. Here, the common partial sequence extracting unit 123 uses the character string indicated by reference numeral 51 as the longest common partial sequence of the attack code morpheme sequence shown in FIG. 4A and the attack code morpheme sequence shown in FIG. Consider the case of extracting. In this case, for example, as indicated by reference numeral 52, the character string replacement unit 124 converts a morpheme other than the longest common subsequence obtained from the morpheme sequence of each of the plurality of attack codes into a regular expression (for example, “¥ W +” or the like). ). Then, the character string replacement unit 124 generates a signature using the longest common substring and the morpheme replaced with the regular expression. For example, the character string replacement unit 124 integrates the morpheme string indicated by (A) of the reference numeral 52 and the morpheme string indicated by (B) to generate a signature indicated by the reference numeral 53.

  In this way, the signature generation apparatus 10 can quickly generate a signature that can be detected for an attack code other than the attack code used as the input value.

  Next, the processing procedure of the signature generation apparatus 10 will be described with reference to FIG. Here, a case will be described as an example where the signature generation apparatus 10 calculates a longest common subsequence from a plurality of attack code morpheme sequences, and generates a signature by replacing other than the longest common subsequence with a regular expression.

  First, when the input unit 11 of the signature generation device 10 receives input of a plurality of attack codes (S1), the common subsequence extraction unit 123 performs morphological analysis of each attack code (S2). Thereafter, the common partial sequence extraction unit 123 calculates the longest common partial sequence from the morpheme sequences of each of the plurality of attack codes subjected to morphological analysis (S3). Then, the character string replacement unit 124 normalizes (replaces with a regular expression) morphemes other than the longest common subsequence of the plurality of attack codes (S4). As a result, the character string replacement unit 124 generates a signature using the longest common substring and the morpheme after replacement with the regular expression. Thereafter, the output unit 13 outputs the generated signature (S5).

  In this way, the signature generation device 10 can generate a detectable signature for an attack code other than the attack code used as the input value.

  The signature generation device 10 may be realized by dedicated hardware for executing the above processing, or by installing a signature generation program for executing the above processing in a desired information processing device (computer). May be. For example, the information processing apparatus can function as the signature generation apparatus 10 by causing the information processing apparatus to execute the signature generation program provided as package software or online software. The information processing apparatus referred to here includes a desktop or notebook personal computer. In addition, the information processing apparatus includes mobile communication terminals such as smartphones, mobile phones and PHS (Personal Handyphone System), and slate terminals such as PDA (Personal Digital Assistants). Further, the signature generation apparatus 10 may be implemented as a Web server or a cloud, and the signature may be generated via a network.

(program)
FIG. 6 is a diagram illustrating a computer that executes a signature generation program. As shown in FIG. 6, a computer 1000 includes, for example, a memory 1010, a CPU (Central Processing Unit) 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, a network Interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100, for example. For example, a mouse 1110 and a keyboard 1120 are connected to the serial port interface 1050. For example, a display 1130 is connected to the video adapter 1060.

  Here, as shown in FIG. 6, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each information and data described in the above embodiment is stored in, for example, the hard disk drive 1090 or the memory 1010.

  The signature generation program is stored in the hard disk drive 1090 as a program module in which a command executed by the computer 1000 is described, for example. Specifically, a program module describing each process executed by the signature generation apparatus 10 described in the above embodiment is stored in the hard disk drive 1090.

  In addition, data used for information processing by the signature generation program is stored in the hard disk drive 1090 as program data, for example. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the hard disk drive 1090 to the RAM 1012 as necessary, and executes the above-described procedures.

  The program module 1093 and the program data 1094 related to the signature generation program are not limited to being stored in the hard disk drive 1090. For example, the program module 1093 and the program data 1094 are stored in a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. May be issued. Alternatively, the program module 1093 and the program data 1094 related to the signature generation program are stored in another computer connected via a network such as a LAN (Local Area Network) or a WAN (Wide Area Network), and are transmitted via the network interface 1070. May be read by the CPU 1020.

DESCRIPTION OF SYMBOLS 10 Signature production | generation apparatus 11 Input part 12 Control part 13 Output part 121 Signature production | generation part 122 Character string division | segmentation part 123 Common partial sequence extraction part 124 Character string replacement part

Claims (4)

A signature generation device that generates a signature used to detect an attack code,
An input unit for receiving input of a plurality of attack codes;
Extracts a character string pattern common to the plurality of input attack codes, and generates a signature that is a character string obtained by replacing a character string pattern not common to the plurality of attack codes with a regular expression. And a signature generating unit.   The signature generation unit performs morphological analysis of the plurality of attack codes, and extracts a longest common partial sequence in the morpheme sequence obtained by the morpheme analysis as a character string pattern common to the plurality of attack codes. The signature generation device according to claim 1. A signature generation method for generating a signature used to detect an attack code,
Receiving a plurality of attack codes,
Extracts a character string pattern common to the plurality of input attack codes, and generates a signature that is a character string obtained by replacing a character string pattern not common to the plurality of attack codes with a regular expression. And a signature generating method comprising the steps of: A signature generation program for causing a computer that generates a signature to be used for detecting attack codes to execute the program,
Receiving a plurality of attack codes,
Extracts a character string pattern common to the plurality of input attack codes, and generates a signature that is a character string obtained by replacing a character string pattern not common to the plurality of attack codes with a regular expression. And a step of causing the computer to execute the step of:

Images