JP2009087208A - Fraudulence detection device, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a fraudulence detection device, program, and a recording medium capable of detecting fraudulent communication by computer virus. <P>SOLUTION: For each block constituting a first IP address and a second IP address indicating the relation of signal transmission and reception concerning an fraudulent communication by computer virus, an information entropy value calculation part 103 calculates the first value to represent the degree of dispersion of the address value having appeared. Another information entropy value calculation part 107 calculates the second value to represent the degree of dispersion of the address value having appeared for each block constituting a third IP address and a fourth IP address indicating the relation of signal transmission and reception concerning the communication of the object to be analyzed. An fraudulence detection part 109 determines the similarity of illegal communication and the communication of the object to be analyzed on the basis of the first and second values of each block, and if the similarity is high, determines that an fraudulence is committed. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a fraud detection device that detects unauthorized communication due to a computer virus. The present invention also relates to a program for causing a computer to function as a fraud detector and a recording medium on which the program is recorded.

Attacks by computer viruses (hereinafter referred to as viruses) are occurring in various places on the network. Under such circumstances, Non-Patent Document 1 describes a method of classifying viruses by analyzing the IP address (Destination IP) on the receiving side in IPv4 communication. In the IPv4 protocol, the IP address is expressed as, for example, 192.168.0.1 (32 bits), and is composed of four blocks of address values of 8 bits each. Therefore, in Non-Patent Document 1, Destination IP related to virus communication is divided into four blocks, and the number of appearance types of address values is quantified for each block. This operation is performed for each virus, and the viruses are classified by analyzing the similarity of the number of address types between the viruses.
Hiroshi Nakakoji, Masatoshi Terada, Seiichi Susaki, “Proposal for Quantifying Node Search Characteristics of Worm”, Information Processing Society of Japan, 38th CSEC Study Group, Information Processing Research Bulletin, Vol. 2007, No. 71, 2007 7 Moon

  However, the method described in Non-Patent Document 1 can only classify communication patterns of individual viruses, and cannot detect unauthorized communication due to viruses from various communication patterns.

  The present invention has been made in view of the above-described problems, and an object thereof is to provide a fraud detection device, a program, and a recording medium that can detect unauthorized communication due to a computer virus.

  The present invention has been made to solve the above-described problem, and the address value of each block constituting the first IP address and the second IP address indicating the transmission / reception relationship relating to the unauthorized communication by the computer virus. Storage means for storing the third IP address and the address value of each block constituting the fourth IP address indicating the transmission / reception relationship relating to the communication to be analyzed, the first IP address and the second IP address A first calculation means for calculating a first value indicating the degree of dispersion of the address value that has appeared for each block constituting the IP address, and each of the third IP address and the fourth IP address. A second calculating means for calculating a second value indicating the degree of dispersion of the address value that has occurred for the block; and determining the similarity between the unauthorized communication and the communication to be analyzed, A fraud detection device comprising fraud detection means for determining that fraud has occurred when the cost is high.

  Further, in the fraud detection device of the present invention, the first storage unit stores the first IP address based on the appearance frequency of the address value of a specific block among the blocks constituting the third IP address and the fourth IP address. Extraction means for extracting a part from the address value to be performed, wherein the second calculation means is configured to extract each of the blocks constituting the third IP address and the fourth IP address extracted by the extraction means. The second value is calculated for the address value.

  Further, the fraud detection device of the present invention includes a determination unit that determines a target block based on the second value of each block, and the first storage unit based on the appearance frequency of the address value of the target block. Extracting means for extracting a part from the address value stored in the memory, wherein the second calculating means comprises each of the third IP address and the fourth IP address extracted by the extracting means. The second value is calculated again for the address value of the block.

  In the fraud detection apparatus according to the present invention, the first value is a first entropy value based on an appearance frequency of an address value for each block constituting the first IP address and the second IP address. The second value is a second entropy value based on the frequency of appearance of the address value for each block constituting the third IP address and the fourth IP address. .

  In the fraud detection device of the present invention, the first value is a first appearance type number of address values for each block constituting the first IP address and the second IP address, The second value is a second appearance type number of address values for each block constituting the third IP address and the fourth IP address.

  The fraud detection apparatus of the present invention is further characterized by further comprising second storage means for storing the second value and the computer virus identification information in association with each other.

  Further, in the fraud detection apparatus of the present invention, the fraud detection means calculates a correlation value indicating a correlation degree by correlation analysis of the first value and the second value for each block, and the correlation value and A predetermined value is compared, and it is determined that fraud has occurred when the correlation value is equal to or greater than the predetermined value.

  Moreover, this invention is a program for functioning a computer as said fraud detection apparatus.

  The present invention is a computer-readable recording medium on which the above program is recorded.

  According to the present invention, the first value indicating the dispersion of the address value of each block of the IP address related to the communication by the computer virus and the dispersion of the address value of each block of the IP address related to the communication to be analyzed are shown. Detecting unauthorized communication due to a computer virus by determining the similarity between unauthorized communication and communication to be analyzed based on the second value, and determining that fraud has occurred when the similarity is high The effect that can be done.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows the configuration of a fraud detection device according to an embodiment of the present invention. The function of each part shown in FIG. 1 is as follows.

  The unauthorized communication data storage unit 101 stores communication data (illegal communication data) obtained by monitoring communication performed by one or more computers including at least a computer confirmed to be infected with a known virus. To do. The communication data of this embodiment is data indicating the characteristics of communication executed on the network, and is a combination of time (Start Time, End Time), communication protocol (ICMP, TCP, UDP), and IP address indicating transmission / reception relationships. (Source IP, Destination IP) and Port number (Transmission side / Reception side TCP Port, UDP Port) data are included.

  The IP address will be described using an IPv4 address in the present embodiment, but the same applies to an IPv6 address. In the following, the IPv4 address is A.I. B. C. A block having an address value A is a first block (the most significant block), a block having an address value B is a second block, a block having an address value C is a third block, and a block having an address value D Is expressed as a fourth block (lowest block).

  The types of communication include stateless communication such as ICMP and UDP and stateful communication such as TCP. In TCP, which is stateful communication, multiple packets are exchanged between two points. By paying attention to each of these packets and generating communication data from each packet individually, ICMP, UDP, TCP It is possible to obtain a stateless communication pattern for all of the above. In the case of stateful communication, two types of packets are observed: a packet from the first IP address to the second IP address and a packet from the second IP address to the first IP address. One of the first IP address and the second IP address may be fixed to the source IP of the present embodiment, and the other may be fixed to the destination IP of the present embodiment.

  The data extraction unit 102 extracts some unauthorized communication data from the unauthorized communication data stored in the unauthorized communication data storage unit 101 according to a predetermined condition. The information entropy value calculation unit 103 calculates an information entropy value indicating the degree of dispersion of the address values that appear for each of the eight blocks constituting the Source IP and Destination IP included in the unauthorized communication data extracted by the data extraction unit 102 To do. The information entropy value storage unit 104 stores the information entropy value calculated by the information entropy value calculation unit 103.

  The communication data storage unit 105 stores communication data related to a communication to be analyzed as to whether or not the communication is similar to an unauthorized communication due to a virus. The data extraction unit 106 extracts some communication data from the communication data stored in the communication data storage unit 105 according to a predetermined condition. The information entropy value calculation unit 107 calculates an information entropy value indicating the degree of dispersion of the address values that appear for each of the eight blocks constituting the Source IP and Destination IP included in the communication data extracted by the data extraction unit 106. . The information entropy value storage unit 108 stores the information entropy value calculated by the information entropy value calculation unit 107.

  Based on the information entropy value of each block stored in the information entropy value storage unit 104 and the information entropy value of each block stored in the information entropy value storage unit 108, the fraud detection unit 109 performs communication of the analysis target. The unauthorized communication is detected by determining whether or not it is similar to the unauthorized communication due to the virus. The display unit 110 displays various information. The operation unit 111 includes keys, buttons, switches, a mouse, and the like that can be operated by the user, and receives input of various types of information from the user. The control unit 112 controls each unit in the fraud detection device.

  In the present embodiment, eight storage units are provided, that is, an unauthorized communication data storage unit 101, a communication data storage unit 105, an information entropy value storage unit 104, and an information entropy value storage unit 108. May be.

(First operation example)
Next, the operation of the fraud detection device according to the present embodiment will be described. First, a first operation example will be described. FIG. 2 shows a procedure of processing related to unauthorized communication data. When processing related to unauthorized communication data is started, a communication protocol is selected (step S100). Communication related to many attacks is often performed using ICMP, TCP, UDP, or another single communication protocol. Therefore, when quantifying the communication pattern included in the unauthorized communication data, the communication pattern is quantified by distinguishing these communication protocols. However, depending on the attack, an attack may be performed by combining a plurality of communication protocols such as ICMP and UDP, or ICMP and TCP. Therefore, the communication pattern may be digitized without distinguishing each communication protocol.

  In step S <b> 100, a signal indicating the result of communication protocol selection by the user is output from the operation unit 111 to the control unit 112. The control unit 112 recognizes the communication protocol selection result based on the signal, and notifies the data extraction unit 102 of the selection result. Alternatively, the past selection result is stored in a predetermined storage unit, and in step S100, the control unit 112 reads the past selection result from the predetermined storage unit, and notifies the data extraction unit 102 of the selection result. Also good.

  Subsequent to step S100, Destination Port is selected (step S101). Since viruses often attack specific ports, selecting a Destination Port makes it easier to detect specific viruses. In step S101, as in step S100, the destination port selection result is notified from the control unit 112 to the data extraction unit 102.

  Subsequent to step S101, the data extraction unit 102 extracts a part of the unauthorized communication data from the unauthorized communication data stored in the unauthorized communication data storage unit 101 on the condition of the selection result notified from the control unit 112. Extract and output to the information entropy value calculation unit 103. That is, the data extraction unit 102 extracts unauthorized communication data having the communication protocol and the Destination Port indicated by the selection result in the data, and outputs them to the information entropy value calculation unit 103 (step S102).

  Subsequent to step S102, the information entropy value calculation unit 103 generates an address value that appears for each of the eight blocks including the four blocks constituting the Source IP and the four blocks constituting the Destination IP included in the unauthorized communication data. An information entropy value relating to is calculated (step S103). Specifically, the information entropy value calculation unit 103 calculates the information entropy value as follows.

  First, the information entropy value calculation unit 103 calculates the appearance frequency of address values for each of the eight blocks. FIG. 3 shows the contents of the table used for calculating the appearance frequency of the address value of each block. 3 is a table for managing data related to communication A (Source IP: 192.168.0.20, Destination IP: 192.26.48.201), and table 310 is communication B (Source IP: 31.41.128.110). , Destination IP: 211.225.190.22) is a table for managing data. Hereinafter, the structure of the table will be described using the table 300 as an example.

  The table 300 is composed of partial tables 301 to 306, a source IP 307, and a destination IP 308 indicating the correspondence and frequency of address values of adjacent blocks. The partial table 301 associates address values and frequencies of the first block and the second block of the Source IP. The partial table 302 associates address values and frequencies of the second block and the third block of Source IP. The partial table 303 associates address values and frequencies of the third block and the fourth block of Source IP. The partial tables 304, 305, and 306 are similar partial tables for the Destination IP.

  In the present embodiment, in order to handle communication data related to a plurality of communications, the table shown in FIG. 4 is used, in which the tables shown in FIG. 3 are integrated. In the table 400 shown in FIG. 4, there are a plurality of partial tables showing the relationship between the address values of the third block and the fourth block and the frequency. Since there are a plurality of source IPs and destination IPs, a plurality of IP addresses are stored in the source IP 410 and the destination IP 420 of the table 400.

  Hereinafter, the processing content of the information entropy value calculation unit 103 will be described using an example in which one communication data (Source IP: 192.168.0.64, Destination IP: 192.26.48.156) is a processing target. The information entropy value calculation unit 103 compares the address value of the first block of the Source IP with the address value of the first block of the Source IP 410 of the table 400 (or the address value of the first block of the partial table 430), and communication data Is compared with the address value of the first block of the Destination IP included in the first block and the address value of the first block of the Destination IP 420 of the table 400 (or the address value of the first block of the partial table 460).

  Since both address values match, the information entropy value calculation unit 103 recognizes that the table corresponding to the communication data to be processed is the table 400. If any address value does not match, the same processing is performed for the other tables. Further, even if the same processing is performed for all the tables, if there is no table having the same address value, a new table needs to be created.

  Subsequently, the information entropy value calculation unit 103 compares the combination of the address values of the first block and the second block of the Source IP with the combination of the address values of the first block and the second block of the partial table 430. Since both match, the information entropy value calculation unit 103 adds 1 to the frequency of the partial table 430. If they do not match, it is necessary to add a new partial table.

  Subsequently, the information entropy value calculation unit 103 similarly compares the combination of the address values of the second block and the third block of the Source IP with the combination of the address values of the second block and the third block of the partial table 440. Since both match, the information entropy value calculation unit 103 adds 1 to the frequency of the partial table 440.

  Subsequently, the information entropy value calculation unit 103 determines the combination of the address values of the third block and the fourth block of the Source IP and the address values of the third block and the fourth block of the partial table 450 related to the third block and the fourth block. Compare with the combination. Since there are a plurality of partial tables 450 related to the third block and the fourth block, the information entropy value calculation unit 103 executes a comparison process for each partial table. As a result, the information entropy value calculation unit 103 adds 1 to the frequency of the partial table 451. Thereafter, 1 is added to the frequencies of the partial tables 460, 470, 481 in the same manner.

  As described above, after calculating the appearance frequency of the address value for each of the eight blocks, the information entropy value calculation unit 103 calculates the information entropy value of each block. The following formula (1) is used to calculate the information entropy value.

In the above equation (1), p _i represents the appearance probability of the address value i. In each block, since the address value can take an integer value of 0 to 255, p ₀ is an appearance probability of 0, p ₁ is an appearance probability of 1,..., P ₂₅₅ is an appearance probability of 255. When the address value appears concentrated on one type of value in a certain block, the information entropy value H becomes 0. On the other hand, when the address value appears scattered in various types of values, the information entropy value appears. H is a large value exceeding 0.

  FIG. 5 shows an example of the information entropy value of each block. Information entropy values of four blocks (A, B, C, D) of Source IP are shown on the left side of FIG. 5, and information entropy values of four blocks (A, B, C, D) of Destination IP are shown in FIG. Is shown on the right side. The information entropy values of the blocks A, B, and C of the Source IP and the blocks A, B, and C of the Destination IP are small values, and it can be seen that the appearance frequency of specific address values is relatively high in these blocks. On the other hand, the information entropy values of the block D of the source IP and the block D of the destination IP are large values, and it can be seen that the address values are relatively dispersed in these blocks.

  The above is the content of the processing in step S103. Subsequent to step S103, the information entropy value calculation unit 103 stores the information entropy value of each block calculated in step S103 in the information entropy value storage unit 104 (step S104). At this time, if the virus name or the like is known in advance, information such as a virus name for identifying the virus and the information entropy value are associated with each other and stored in the information entropy value storage unit 104.

  With the above processing, the processing related to unauthorized communication data is completed. It is possible to calculate an information entropy value for each virus by repeatedly performing the above-described processing using unauthorized communication data that differs for each virus.

  Next, the contents of the processing related to communication data related to the communication to be analyzed will be described. FIG. 6 shows a procedure of processing related to communication data related to communication to be analyzed. When processing related to communication data is started, a communication protocol is selected (step S200). The processing in step S200 is the same as the processing in step S100 in FIG. 2, and the control unit 112 notifies the data extraction unit 106 of the communication protocol selection result. Subsequent to step S200, Destination Port is selected (step S201). The process in step S201 is the same as the process in step S101 in FIG. 2, and the control unit 112 notifies the data extraction unit 106 of the destination port selection result.

  Subsequent to step S201, the data extraction unit 106 extracts a part of communication data from the communication data stored in the communication data storage unit 105 on the condition of the selection result notified from the control unit 112, The information is output to the information entropy value calculation unit 107. That is, the data extraction unit 106 extracts communication data having the communication protocol and Destination Port indicated by the selection result in the data, and outputs the communication data to the information entropy value calculation unit 107 (step S202).

  The communication data related to the analysis target communication may be communication data related to the communication that has been completed in the past, or may be communication data related to the ongoing communication that is currently being monitored. In any case, the communication data is temporarily stored in the communication data storage unit 105 and is read by the data extraction unit 106 as appropriate.

  Subsequent to step S202, the information entropy value calculation unit 107 relates to the address value that appears for each of the eight blocks including the four blocks constituting the Source IP and the four blocks constituting the Destination IP included in the communication data. An information entropy value is calculated (step S203). The process in step S203 is the same as the process in step S103 in FIG. Subsequent to step S203, the information entropy value calculation unit 107 stores the information entropy value of each block calculated in step S203 in the information entropy value storage unit 108 (step S204).

  Subsequent to step S204, the fraud detection unit 109 reads the information entropy value related to the unauthorized communication from the information entropy value storage unit 104 and reads the information entropy value related to the communication to be analyzed from the information entropy value storage unit 108. Correlation analysis is performed (step S205). In step S205, a process of calculating a correlation value indicating a correlation (similarity) between a communication pattern of an illegal communication due to a virus and a communication pattern of a communication to be analyzed is performed.

Specifically, the fraud detection unit 109 performs correlation analysis as follows. The fraud detection unit 109 includes information entropy values (x ₁ , x ₂ ,..., X ₈ ) regarding 8 blocks of IP addresses related to unauthorized communication and 8 blocks of IP addresses related to communication to be analyzed. Using the information entropy values (y ₁ , y ₂ ,..., Y ₈ ) for, a correlation value r is calculated by the following equations (2) to (4).

x ₁ , x ₂ , x ₃ , and x ₄ are information entropy values of the first block, the second block, the third block, and the fourth block of Source IP related to unauthorized communication, respectively. Further, x ₅ , x ₆ , x ₇ , and x ₈ are information entropy values of the first block, the second block, the third block, and the fourth block of Destination IP related to unauthorized communication, respectively. Similarly, y ₁ , y ₂ , y ₃ , and y ₄ are information entropy values of the first block, the second block, the third block, and the fourth block of Source IP related to the communication to be analyzed. Y ₅ , y ₆ , y ₇ , and y ₈ are information entropy values of the first block, the second block, the third block, and the fourth block of the Destination IP related to the communication to be analyzed.

  Expression (2) is an expression for calculating the correlation value r. Expression (3) is an expression for calculating an average value of information entropy values for eight blocks of an IP address related to unauthorized communication. Expression (4) is an expression for calculating an average value of information entropy values for the eight blocks of the IP address related to the communication to be analyzed. The correlation value r calculated by the equation (2) is a numerical value within the range of -1.0 to 0.0 to +1.0. The degree of similarity increases as the correlation value r approaches +1.0.

  The above is the content of the process of step S205. Subsequent to step S205, the fraud detection unit 109 compares the correlation value r calculated in step S205 with a predetermined threshold, and determines whether or not the communication to be analyzed is similar to the fraudulent communication based on the comparison result. (Step S206). For example, when the threshold value is 0.9 and the correlation value r is 0.9 or more, it is determined that the communication to be analyzed is similar to the unauthorized communication. When the correlation value r is less than 0.9, the communication to be analyzed is invalid. It is determined not to be similar to communication. The fraud detection unit 109 notifies the control unit 112 of the determination result.

  When it is determined that the communication to be analyzed is similar to the unauthorized communication, the control unit 112 sets an alarm (alarm) processing or a filtering rule (a network device such as a router for the purpose of attack protection). (Automatically) is generated (step S207). The generation of the alarm may be performed by generating a sound, or may be performed by displaying a message or the like on the display unit 110. In addition, when generating a filtering rule, a filtering rule that excludes only attacks by viruses is generated.

  With the above processing, the processing related to the communication data related to the communication to be analyzed is completed. When it is determined that the communication to be analyzed is not similar to the unauthorized communication, the process related to the communication data related to the communication to be analyzed is terminated without performing the process of step S207. When performing correlation analysis between communication patterns of unauthorized communications caused by a plurality of viruses and communication patterns of communications to be analyzed, in step S205, correlation analysis is performed while changing information entropy values related to unauthorized communications for each virus. In step S206, the similarity may be determined for each virus.

(Second operation example)
Next, a second operation example will be described. In the second operation example, in the process related to the communication data related to the analysis target communication, the communication data related to the analysis target communication is narrowed down in order to easily find a communication pattern similar to the communication pattern due to the virus. Processing related to unauthorized communication data is the same as in the first operation example. The contents of processing related to communication data related to the communication to be analyzed will be described below. FIG. 7 shows a procedure of processing related to communication data related to communication to be analyzed.

  The processing in steps S300 to S302 after the processing related to communication data is started is the same as the processing in steps S200 to S202 in FIG. Subsequent to step S302, the information entropy value calculation unit 107 includes a block i (i is any one of 1, 2,..., 8) among eight blocks constituting the Source IP and Destination IP included in the communication data. The appearance frequency of the address value is calculated for (Step S303). The method for calculating the appearance frequency of the address value is the same as in the first operation example.

  The calculation result of the appearance frequency of the address value in step S303 is notified from the information entropy value calculation unit 107 to the control unit 112. Based on the appearance frequency of each address value for block i, the control unit 112 notifies the data extraction unit 106 of the address value whose appearance frequency is in the top N. The data extraction unit 106 selects communication data including Source IP or Destination IP having the address value notified from the control unit 112 as the address value of the block i from the communication data stored in the communication data storage unit 105. Extracted and output to the information entropy value calculator 107 (step S304).

  When communication by a virus is performed, the address value of a specific block concentrates on a specific value in the detected communication data. Therefore, by making communication data having such an address value an analysis target, it becomes easier to find a communication pattern similar to a communication pattern caused by a virus.

  Subsequent to step S304, the information entropy value calculation unit 107 has eight blocks including four blocks constituting the Source IP included in the communication data output from the data extraction unit 106 and four blocks constituting the Destination IP. For each, an information entropy value relating to the appearing address value is calculated (step S305). The process in step S305 is the same as the process in step S103 in FIG. Subsequent to step S305, the information entropy value calculation unit 107 stores the information entropy value of each block calculated in step S305 in the information entropy value storage unit 108 (step S306).

  Subsequent to step S306, the fraud detection unit 109 reads the information entropy value related to the unauthorized communication from the information entropy value storage unit 104 and reads the information entropy value related to the communication to be analyzed from the information entropy value storage unit 108. Correlation analysis is performed (step S307). The processing in step S307 is the same as the processing in step S205 in FIG.

  Processes in steps S308 to S309 subsequent to step S307 are the same as the processes in steps S206 to S207 in FIG. Subsequently, the control unit 112 determines whether or not the processing from step S303 has been performed for all eight blocks. If the processing from step S303 has already been performed for all eight blocks, the processing related to the communication data related to the communication to be analyzed ends. If there is a block that has not been processed from step S303, the process from step S303 is performed again.

  However, in step S303, the appearance frequency of the address value is calculated for a block that has not yet been calculated. When the number of executions of step S303 is the Kth (2 ≦ K ≦ 8), the communication data extracted in step S304 of the (K−1) th time may be the processing target of step S303 in the Kth time, and communication data storage is performed. All communication data stored in the unit 105 may be processed again.

(Third operation example)
Next, a third operation example will be described. In the third operation example, as in the second operation example, in the process related to the communication data related to the communication to be analyzed, the communication data related to the communication to be analyzed is made easier to find a communication pattern similar to the communication pattern due to the virus. Narrow down. Processing related to unauthorized communication data is the same as in the first operation example. The contents of processing related to communication data related to the communication to be analyzed will be described below. FIG. 8 shows a procedure of processing related to communication data related to communication to be analyzed.

  The processing in steps S400 to S403 after the processing related to communication data is started is the same as the processing in steps S200 to S203 in FIG. Subsequent to step S403, the information entropy value calculation unit 107 compares the information entropy values for each of the eight blocks constituting the source IP and destination IP included in the communication data, and the block in which the minimum information entropy value is calculated. j (j is one of 1, 2,..., 8) is determined. Further, the information entropy value calculation unit 107 calculates the appearance frequency of the address value for the block j (target block) (step S404). The method for calculating the appearance frequency of the address value is the same as in the first operation example.

  The calculation result of the appearance frequency of the address value in step S404 is notified from the information entropy value calculation unit 107 to the control unit 112. Based on the appearance frequency of each address value for the block j, the control unit 112 notifies the data extraction unit 106 of the address value whose appearance frequency is in the top N. The data extraction unit 106 includes communication data including Source IP or Destination IP having the address value notified from the control unit 112 as the address value of the block j from among the communication data stored in the communication data storage unit 105. Extracted and output to the information entropy value calculator 107 (step S405).

  When communication by a virus is performed, the address value of a specific block concentrates on a specific value in the detected communication data, and the information entropy value for that block becomes small. Therefore, by making communication data having such an address value an analysis target, it becomes easier to find a communication pattern similar to a communication pattern caused by a virus.

  The processing in steps S406 to S410 following step S405 is the same as the processing in steps S305 to S309 in FIG. Subsequently, the control unit 112 determines whether or not the number of executions of the process from step S403 (the number of loops) has reached a specified number (step S411). If the number of executions of the process from step S403 has already reached the specified number, the process related to the communication data related to the communication to be analyzed ends. If the number of executions of the process from step S403 has not yet reached the specified number, the process from step S403 is performed again.

  However, when the information entropy value is compared in step S404, the information entropy value of the block whose information entropy value is determined to be the smallest in the same previous step S404 is excluded from the comparison target. When the number of executions of step S403 is the Kth (2 ≦ K ≦ 8), the communication data extracted in the (K−1) th step S404 may be the processing target in the Kth step S403, or the communication data storage. All communication data stored in the unit 105 may be processed again.

(Modification)
Next, a modification of this embodiment will be described. In the above, the information entropy value is calculated as a value indicating the degree of dispersion of the appearing address value for each block constituting the IP address. However, the number of appearance types of the address value may be calculated instead of the information entropy value. . The processing when the number of appearance types of address values is used is processing in which all the information entropy values in the description of the first to third operation examples are replaced with the number of appearance types of address values.

  FIG. 9 shows an example of the number of appearance types of address values of each block. The number of appearance types of the address values of the four blocks (A, B, C, D) of the Source IP is shown on the left side of FIG. 9, and the address values of the four blocks (A, B, C, D) of the Destination IP are shown. The number of appearance types is shown on the right side of FIG. The number of types of address values in the source IP blocks A, B, C and Destination IP blocks A, B, C is small, and in these blocks the address values are relatively concentrated on specific values. I understand that. On the other hand, the number of address types in the Source IP block D and the Destination IP block D is a large value, and it can be seen that the address values are relatively dispersed among a number of values in these blocks.

  As described above, according to the present embodiment, the information entropy value (or the number of appearance types of address values) of each block of the IP address related to communication by virus and the information of each block of the IP address related to the communication to be analyzed Based on the entropy value (or the number of types of address values that appear), the similarity between unauthorized communication and the communication to be analyzed is determined, and if the similarity is high, it is determined that fraud has occurred. Communication can be detected. In particular, in communication using a virus, a bias in communication tends to occur in units of address values of blocks constituting an IP address. Therefore, this embodiment is suitable for detecting unauthorized communication due to a virus.

  Further, in the second and third operation examples, in the process related to the communication data related to the communication to be analyzed, communication data having an address value satisfying a predetermined condition is set as the analysis target, thereby comparing with the first operation example. Thus, it is possible to easily detect unauthorized communication due to a virus.

  In the above-mentioned Non-Patent Document 1, attention is paid only to the number of types of addresses, and the communication density (frequency), which is one of important features found in attacks, is not realized. On the other hand, in this embodiment, the communication density is digitized by calculating an information entropy value based on the appearance frequency of the address value.

  In Non-Patent Document 1, since only Destination IP is an analysis target, a DDos (Distributed Denial of Service) attack in which communication is performed from a multipoint Source IP to a single Destination IP cannot be handled. On the other hand, in the present embodiment, illegal communication due to a DDos attack can be detected by using a combination of Source IP and Destination IP as an analysis target.

  As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the above-described embodiments, and includes design changes and the like without departing from the gist of the present invention. . For example, a program for realizing the operation and function of the fraud detection device according to the above-described embodiment may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by the computer. Good.

  Here, the “computer” includes a homepage providing environment (or display environment) if the WWW system is used. The “computer-readable recording medium” refers to a storage device such as a portable medium such as a flexible disk, a magneto-optical disk, a ROM, and a CD-ROM, and a hard disk built in the computer. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program described above may be transmitted from a computer storing the program in a storage device or the like to another computer via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the above-described program may be for realizing a part of the above-described function. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer, what is called a difference file (difference program) may be sufficient.

It is a block diagram which shows the structure of the fraud detection apparatus by one Embodiment of this invention. It is a flowchart (1st operation example) which shows the procedure of operation | movement of the fraud detection apparatus by one Embodiment of this invention. In one Embodiment of this invention, it is a reference figure which shows the content of the table which an information entropy value calculation part uses for a process. It is a reference figure which shows the content of the table which the information entropy value calculation part with which the fraud detection apparatus by one Embodiment of this invention is provided uses for a process. In one Embodiment of this invention, it is a reference figure which shows the information entropy value of each block. It is a flowchart (1st operation example) which shows the procedure of operation | movement of the fraud detection apparatus by one Embodiment of this invention. It is a flowchart (2nd operation example) which shows the procedure of operation | movement of the fraud detection apparatus by one Embodiment of this invention. It is a flowchart (3rd operation example) which shows the procedure of operation | movement of the fraud detection apparatus by one Embodiment of this invention. In one Embodiment of this invention, it is a reference figure which shows the number of appearance types of the address value of each block.

Explanation of symbols

  101 ... Unauthorized communication data storage unit (first storage unit), 102, 106 ... Data extraction unit (extraction unit), 103, 107 ... Information entropy value calculation unit (first calculation unit, first calculation unit) 2), 104, 108... Information entropy value storage unit (second storage unit), 105... Communication data storage unit (first storage unit), 109. Detecting means), 110... Display part, 111... Operating part, 112.

Claims (9)

The first IP address indicating the transmission / reception relationship related to the unauthorized communication due to the computer virus and the address value of each block constituting the second IP address, and the third IP address indicating the transmission / reception relationship related to the communication to be analyzed And first storage means for storing the address value of each block constituting the fourth IP address;
First calculation means for calculating a first value indicating a degree of dispersion of the address value that has appeared for each block constituting the first IP address and the second IP address;
Second calculation means for calculating a second value indicating a degree of dispersion of the address value that has appeared for each block constituting the third IP address and the fourth IP address;
An injustice that determines the similarity between the unauthorized communication and the communication to be analyzed based on the first value and the second value of each block, and determines that an injustice has occurred when the similarity is high Detection means;
A fraud detection device characterized by comprising: Extraction that extracts a part from the address value stored in the first storage means based on the appearance frequency of the address value of a specific block among the blocks constituting the third IP address and the fourth IP address Further comprising means,
The second calculating means calculates the second value for the address value of each block constituting the third IP address and the fourth IP address extracted by the extracting means. The fraud detection apparatus according to claim 1. Determining means for determining a block of interest based on the second value of each block;
Extracting means for extracting a part from the address value stored in the first storage means based on the appearance frequency of the address value of the block of interest;
The second calculating means recalculates the second value for the address value of each block constituting the third IP address and the fourth IP address extracted by the extracting means. The fraud detection apparatus according to claim 1.   The first value is a first entropy value based on an appearance frequency of an address value for each block constituting the first IP address and the second IP address, and the second value is 4. The second entropy value based on an appearance frequency of an address value for each block constituting the third IP address and the fourth IP address. The fraud detector described in 1.   The first value is a first appearance type number of address values for each block constituting the first IP address and the second IP address, and the second value is the third value. The fraud detection device according to any one of claims 1 to 4, wherein the fraud detection device is a second appearance type number of an address value for each block constituting the IP address and the fourth IP address.   6. The fraud detection apparatus according to claim 1, further comprising second storage means for storing the second value and the identification information of the computer virus in association with each other.   The fraud detection means calculates a correlation value indicating a degree of correlation by correlation analysis of the first value and the second value for each block, compares the correlation value with a predetermined value, and the correlation value is The fraud detection apparatus according to claim 1, wherein fraud is determined to occur when the value is equal to or greater than a predetermined value.   The program for functioning a computer as a fraud detection apparatus in any one of Claims 1-7.   A computer-readable recording medium on which the program according to claim 8 is recorded.

Images