JP2011138189A - Communication device and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To early diagnose the risk of a file using a specific part of data of the file when receiving the data. <P>SOLUTION: A packet extraction part 34 extracts packets which are transmitted from a client and contain data of an HTTP request requesting acquisition of the file, out of the packets captured by a capturing part 31. A file type acquisition part 35 obtains a file extension of which acquisition is requested from a request row of the HTTP request. Then, the packet extraction part 34 extracts the packets including the data of an HTTP response corresponding to the HTTP request. The file type acquisition part 35 obtains the magic number of the file from the data head of the file included in the HTTP response. A risk determination part 36 determines, depending on whether the file extension and the magic number represent the same type or not, the existence of risks of the file. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a communication device and a program.

  Some of the computer viruses that have become popular in recent years have a function of downloading another virus from a server on the Internet prepared by an attacker and infecting a computer of a company or the like. If the virus infection spreads, companies will suffer serious damage such as leakage of confidential information such as personal information.

  Some of these viruses, for example, appear to download an image file and actually download an executable EXE file. In the file downloaded here, the extension attached to the file name and the data in the file do not match, and the extension is misrepresented. Such a file can be said to be a suspicious one that is very likely to be a virus.

  Here, as a technique described in the publication, Patent Document 1 discloses a computer virus specific information extraction apparatus that extracts computer virus specific information used for detection of a computer virus, and an executable file that is identified as a computer virus. Extracting information included in a specific area that is determined to be a storage area for information that can be regarded as unique in the execution file and the acquisition means to be acquired as computer virus specific information from the execution file acquired by the acquisition means There is described a computer virus specific information extracting device characterized in that it has an extracting means.

No. 2005-103895

  In the technique disclosed in Patent Document 1, computer virus specific information is extracted from a part of the header area of an executable file identified as a computer virus. In general, data indicating the type of file is also stored in the header area of the file, and it may be considered to use this data when diagnosing whether or not the file spoofs the above extension. It is done. However, even though the information in the header area of the file has been used to extract computer virus specific information so far, it is used for diagnosing the risk of the file, such as whether it is a suspicious file that misrepresents the extension. It wasn't.

  Therefore, an object of the present invention is to diagnose a risk of a file at an early stage by using a specific portion of the data when the data of the file is received.

  For this purpose, the present invention provides a receiving means for receiving data flowing on a network, an extension obtaining means for obtaining an extension of the file included in a character string representing a file name, and the receiving means. When receiving the data constituting the file, type data acquisition means for acquiring type data representing a type of the file different from the extension included in a specific portion of the data, and the extension acquisition means A risk determination unit that determines whether the file has a risk according to whether or not the acquired extension of the file matches the type data of the file acquired by the type data acquisition unit; Provided is a communication device characterized by comprising the above.

  Here, the receiving means in this apparatus receives a file acquisition request that the client computer transmits to the server computer via the network, and file data that the server computer transmits to the client computer in response to the file acquisition request. The extension acquiring unit may receive the file extension from the file acquisition request data received by the receiving unit.

  The apparatus further comprises file acquisition stopping means for stopping the client computer from acquiring the file from the server computer when the risk determining means determines that the file is dangerous. It may be provided.

  Furthermore, the receiving means in this apparatus receives file data from the server computer as a response to the file acquisition request sent from the own apparatus to the server computer via the network. May acquire the extension of the file from the data of the file acquisition request transmitted to the server computer.

  Further, the present invention provides a computer with a function for receiving data flowing on a network, a function for acquiring an extension of the file included in a character string representing a file name, and a function for receiving the data. A function for acquiring type data representing a type of the file different from the extension included in a specific portion of the data, and the acquired extension of the file and the file There is also provided a program for realizing a function for determining whether or not there is a risk of the file in accordance with whether or not the type data matches.

  According to the present invention, when data of a file is received, it is possible to diagnose the risk of the file at an early stage using a specific portion of the data.

1 is an overall configuration diagram of a computer system to which this exemplary embodiment is applied. It is the block diagram which showed the function structural example of the LAN analyzer in this Embodiment. It is the figure which showed the outline of the communication sequence at the time of a client and a server performing HTTP communication. It is the figure which showed the example of the data of an HTTP request and an HTTP response. It is the flowchart which showed the operation example of the LAN analyzer at the time of diagnosing the danger of the file downloaded in this Embodiment. It is a whole block diagram of the modification of the computer system to which this Embodiment is applied. It is a hardware block diagram of the computer to which this Embodiment is applied.

Embodiments of the present invention will be described below in detail with reference to the accompanying drawings.
First, a computer system to which this embodiment is applied will be described.
FIG. 1 is a diagram showing an example of the overall configuration of such a computer system. As shown in the figure, in this computer system, clients 10 a and 10 b and a server 20 are connected via a LAN (Local Area Network) 70, a router 40, and an external network 80. In addition, clients 10 a and 10 b and a LAN analyzer 30 are connected to the LAN 70. The external network 80 is exemplified by the Internet.

  In the present embodiment, TCP / IP (Transmission Control Protocol / Internet Protocol) is used as a communication protocol. In the present embodiment, the clients 10a and 10b download files from the server 20 via the LAN 70, the router 40, and the external network 80 according to HTTP (HyperText Transfer Protocol).

  The clients 10a and 10b are client computers used by the user. For example, it is realized by a personal computer, a workstation, or other computer devices. In the following description, the clients 10a and 10b may refer to Web browsers installed on client computers. In FIG. 1, the clients 10a and 10b are shown. However, when it is not necessary to distinguish between them, they may be called clients 10. Further, in FIG. 1, only two clients 10 are shown, but three or more clients 10 may be provided.

  The server 20 is a Web server that stores information such as HTML (HyperText Markup Language) documents and images. The server 20 is realized by, for example, a personal computer, a workstation, or other computer devices.

  The LAN analyzer 30 (an example of a communication device) is hardware or software that captures and records packets flowing through the LAN 70. The LAN analyzer 30 may be a device dedicated to monitoring traffic, or may be a personal computer installed with packet capture software. In the present embodiment, the LAN analyzer 30 diagnoses the risk of files downloaded by the client 10.

Next, the functional configuration of the LAN analyzer 30 will be described.
FIG. 2 is a block diagram illustrating a functional configuration example of the LAN analyzer 30. As illustrated, the LAN analyzer 30 includes a capture unit 31, a log data storage unit 32, a control information storage unit 33, a packet extraction unit 34, a file type acquisition unit 35, a risk determination unit 36, and a download. And a control unit 37.

The capture unit 31 captures a packet flowing through the LAN 70. In the present embodiment, a capture unit 31 is provided as an example of a receiving unit.
The log data storage unit 32 stores the packet captured by the capture unit 31 as log data.

The control information storage unit 33 stores a correspondence relationship between an extension and a magic number (described later), an IP address of the client 10, and the like, which are necessary when the LAN analyzer 30 diagnoses the risk of a file.
The packet extraction unit 34 refers to the IP address and the like of the client 10 stored in the control information storage unit 33, and is sent out when the client 10 downloads a file from the packets captured by the capture unit 31. An HTTP request packet and an HTTP response packet corresponding thereto are extracted. This extraction method will be described later.

The file type acquisition unit 35 acquires the extension of the file to be downloaded by the client 10 from the HTTP request data included in the packet extracted by the packet extraction unit 34. Further, the file type acquisition unit 35 uses a magic number (type data) indicating the type of the file embedded in the file data downloaded by the client 10 from the HTTP response data included in the packet extracted by the packet extraction unit 34. Example).
In the present embodiment, a packet extraction unit 34 and a file type acquisition unit 35 are provided as an example of an extension acquisition unit and a type data acquisition unit.

  The risk determination unit 36 determines that the file is safe when the file extension acquired by the file type acquisition unit 35 and the magic number of the file represent the same type (that is, match). . On the other hand, when the file extension acquired by the file type acquisition unit 35 represents a different type from the magic number of the file, the file is determined to be dangerous. In the present embodiment, a risk determination unit 36 is provided as an example of the risk determination means.

  When the risk determination unit 36 determines that the file downloaded by the client 10 is dangerous, the download control unit 37 transmits a warning to that effect to the client 10, and transmits the warning to the server 20 to the router 40. Sends an instruction to block the packet from the client to the client 10 (that is, stop the download). In the present embodiment, a download control unit 37 is provided as an example of a file acquisition stop unit.

Here, the magic number of the file will be described.
The character string representing the name of the electronic file usually includes, for example, “exe” for an executable file and “jpg” for an image file in JPEG (Joint Photographic Experts Group) format. An extension indicating is added. Apart from this extension, the magic number is data representing the type of the file embedded in several bytes at the beginning of the file. For example, 2 bytes of “4D 5A” (corresponding to the character string “MZ” in the ASCII code) in hexadecimal format for executable files, and “FF D8 FF” in hexadecimal format for image files in JPEG format. "3 bytes" are embedded as a magic number.

  Among these, the extension may be misrepresented as described above, but the magic number can correctly recognize the type of the file by referring to it. Therefore, for example, if the results of examining the extension and magic number of the same file are “jpg” and “FF D8 FF”, respectively, they are consistent and it can be determined that the file is a JPEG image file. . However, for example, if the extension is “jpg” but the magic number is “4D 5A” (“MZ”), the file is actually an executable file and the extension is misrepresented. It can be judged that

Next, an outline of HTTP communication when a file is downloaded in the present embodiment will be described.
FIG. 3 is a diagram showing an outline of a communication sequence when the client and the server perform HTTP communication. FIG. 4 is a diagram showing an example of HTTP request and HTTP response data.

  As shown in FIG. 3, a TCP connection is first established between the client 10 and the server 20. This is performed by a three-way handshake in which a SYN packet (connection establishment request) and an ACK packet (acknowledgment response) are exchanged between the client 10 and the server 20.

  When the TCP connection is established, data is transmitted and received between the client 10 and the server 20, so in this embodiment, the client 10 first transmits an HTTP request to the server 20. FIG. 4A shows a part of HTTP request data. A description 151 enclosed in a frame is a request line expressed in the format of “method path name HTTP / version number”. In the example of FIG. 4A, the client 10 sends “notepad” to the server 20 by the GET method. This indicates that the acquisition of a JPEG format image file “.jpg” is requested. A URL (Uniform Resource Locator) may be specified as the path name.

Next, as a response to this, the server 20 transmits an HTTP response to the client 10. FIG. 4B shows a part of HTTP response data. A description 152 enclosed in a frame is a response line formatted as “HTTP / version number, status number, message”. In the example of FIG. 4B, the above file has been successfully acquired (“200 OK”). Represents that.
Further, the description 153 and the following enclosed in a frame is the data of the “notepad.jpg” file to be downloaded. The description 153 is the magic number “MZ” of the executable file, and it can be seen that it does not match the extension “jpg” of the requested file name.

  When one communication using HTTP is completed, a FIN packet (connection disconnection request) and an ACK packet are exchanged between the client 10 and the server 20, and the TCP connection is disconnected (see FIG. 3 again).

Below, operation | movement of the LAN analyzer 30 in this Embodiment is demonstrated.
FIG. 5 is a flowchart showing an example of the operation of the LAN analyzer 30 when diagnosing the danger of a downloaded file in the present embodiment.

  First, the packet extraction unit 34 extracts, from the packets captured by the capture unit 31, those including data of an HTTP request transmitted by the client 10 and requesting file acquisition (step 101). An HTTP request for requesting acquisition of a file means that the HTTP data included in the packet includes a request line of a method used for acquiring the file, such as a GET method or a POST method described in the description 151. It is judged by.

  When the target packet is extracted, the packet extraction unit 34 refers to the IP header of the packet and acquires the IP address of the transmission source (client 10) and the IP address of the transmission destination (server 20). Further, the packet extraction unit 34 refers to the TCP header of the packet, and acquires the source port number, the destination port number, and the TCP sequence number (step 102). The control information storage unit 33 stores the acquired IP address, port number, and sequence number. These pieces of information are referred to when an HTTP response packet in the same TCP connection as the HTTP request is extracted from the captured packets.

  Further, the file type acquisition unit 35 acquires the extension of the file requested for acquisition from the request line of the HTTP request in the packet extracted by the packet extraction unit 34 (step 103). This extension is also stored in the control information storage unit 33.

  Next, the packet extraction unit 34 extracts packets including HTTP response data corresponding to the HTTP request from the packets captured by the capture unit 31 (step 104). An HTTP response is determined by the fact that HTTP data included in the packet includes a response line such as description 152. Whether or not the request corresponds to the HTTP request is determined based on whether or not the request is in the same TCP connection as the HTTP request. Whether or not the TCP connection is the same, whether or not the packet of the HTTP response captured by the capture unit 31 is the same as in step 102, the packet extraction unit 34 is the transmission source IP address, the transmission destination IP address, and the transmission source port. Number, transmission destination port number and sequence number are acquired, and whether or not they are the same as those stored in the control information storage unit 33 (except that the transmission source and transmission destination are reversed) Judged by examining.

  When the target packet is extracted, the file type acquisition unit 35 acquires the magic number of the file from the head of the file data included in the HTTP response in the packet (step 105).

  Then, the risk determination unit 36 indicates whether the extension of the file stored in the control information storage unit 33 and the magic number of the file acquired by the file type acquisition unit 35 represent the same type (match). It is determined whether or not (step 106). If the extension and the magic number represent the same type, the risk determination unit 36 determines that the file is safe and ends the process.

Conversely, if the extension and the magic number represent different types, the risk determination unit 36 determines that the file is dangerous. In the example of FIG. 4, since the extension “jpg” of the file “notepad.jpg” and the magic number “MZ” represent different types, the risk determination unit 36 determines that the file is dangerous. . At this time, the download control unit 37 transmits a warning to that effect to the client 10 (step 107), and instructs the router 40 to block the packet from the server 20 to the client 10 (stop the download). Transmit (step 108).
Thus, the process when the LAN analyzer 30 diagnoses the risk of the file ends.

Note that the warning given by the download control unit 37 may be performed by sending an email from the LAN analyzer 30 to the client 10, or in a management screen displayed on the display unit of the LAN analyzer 30. A warning may be issued.
Furthermore, the determination result by the risk determination unit 36 may be stored in the log data storage unit 32. If the capture unit 31 captures the packet date, download source and download destination IP addresses, extension, magic number, etc. as a log, it analyzes later whether or not a suspicious file has been downloaded. It can also be used as an audit trail for system audits and security audits.

  Further, in the operation example of the LAN analyzer 30 described above, the process of stopping the download of the file determined to be dangerous by the risk determination unit 36 is performed (see step 108 in FIG. 5). There is a possibility that the download of a necessary file may be interrupted due to an erroneous determination by the unit 36, and the user may feel troublesome. In such a case, the process for canceling the download may not be performed.

  FIG. 6 is an overall configuration diagram of a modified example of the computer system to which this exemplary embodiment is applied. Also in this modified example, the client 10 and the server 20 are connected via the LAN 70, the router 40, and the external network 80 as described above. However, here, the LAN analyzer 30 is connected inline at the boundary between the LAN 70 and the external network 80 as shown. In the case of this modification, the LAN analyzer 30 itself can stop the download of the file determined to be dangerous in step 108 of FIG.

  By the way, in the above description, the LAN analyzer 30 performs the diagnosis on the risk of the file, but the client 10 may perform the diagnosis process by itself. The client 10 in that case needs to have the same configuration as the LAN analyzer 30 as shown in FIG. However, the client 10 includes a reception unit (not shown) that receives data via the LAN 70 instead of the capture unit 31. This receiving unit is an example of a receiving unit.

  In step 101 of FIG. 5, the packet extraction unit 34 extracts a packet including HTTP request data for requesting file acquisition from the packet output by the own apparatus. In step 107, the download control unit 37 displays a warning on a display unit (not shown) of the own apparatus. In step 108, the download control unit 37 instructs the receiving unit to block reception of packets from the server 20 to the client 10.

  In the case of the modification described with reference to FIG. 6, an IPS (Intrusion Prevention System) is provided at the same position on the LAN 70 in place of the LAN analyzer 30, and the LAN analyzer according to the present embodiment is provided in the IPS. You may give the function similar to 30.

  As described above, in the present embodiment, the extension of the file to be downloaded is obtained from the data of the HTTP request transmitted by the client 10, and the magic number of the file is obtained from the file included in the HTTP response to the HTTP request. Obtained from the data, it was determined whether the extension and the magic number match. Since the magic number is embedded at the beginning of the file, it is possible to diagnose the risk of the file even before the data of the entire file is received. For this reason, with the above configuration, when file data is received, it becomes possible to diagnose the risk of the file at an early stage by using a specific portion of the data.

  Finally, the hardware configuration of the client 10 and the LAN analyzer 30 in the present embodiment will be described. FIG. 7 is a diagram showing an example of the hardware configuration of such a computer. As shown in the figure, the computer includes a CPU (Central Processing Unit) 90 which is a calculation means, a main memory 92 connected to the CPU 90 via an M / B (motherboard) chip set 91, and an M / B chip set 91. And a display mechanism 93 connected to the CPU 90 via Further, a network interface 95, a magnetic disk device (HDD) 96, an audio mechanism 97, a keyboard / mouse 98, and a flexible disk drive 99 are connected to the M / B chipset 91 via a bridge circuit 94. Has been.

  In FIG. 7, each component is connected through a bus. For example, the CPU 90 and the M / B chip set 91 and the M / B chip set 91 and the main memory 92 are connected via a CPU bus. Further, the M / B chipset 91 and the display mechanism 93 may be connected via an AGP (Accelerated Graphics Port), but if the display mechanism 93 includes a PCI Express compatible video card, the M / B The chip set 91 and the video card are connected via a PCI Express (PCIe) bus. When connecting to the bridge circuit 94, for example, PCI Express can be used for the network interface 95. For the magnetic disk device 96, for example, serial ATA (AT Attachment), parallel transfer ATA, and PCI (Peripheral Components Interconnect) can be used. Furthermore, USB (Universal Serial Bus) can be used for the keyboard / mouse 98 and the flexible disk drive 99.

  The functions of the client 10 and the LAN analyzer 30 are realized by cooperation of software and hardware resources. Specifically, the CPU 90 executes a program for realizing the functions of the capture unit 31 (reception unit), the packet extraction unit 34, the file type acquisition unit 35, the risk determination unit 36, and the download control unit 37. For example, the program is read from the magnetic disk device 96 into the main memory 92 and processed. Further, the log data storage unit 32 and the control information storage unit 33 are realized by a magnetic disk device 96, for example.

DESCRIPTION OF SYMBOLS 10 ... Client, 20 ... Server, 30 ... LAN analyzer, 31 ... Capture part, 32 ... Log data storage part, 33 ... Control information storage part, 34 ... Packet extraction part, 35 ... File type acquisition part, 36 ... Risk determination Part, 37 ... download control part, 40 ... router

Claims (5)

Receiving means for receiving data flowing on the network;
An extension acquisition means for acquiring the extension of the file included in the character string representing the name of the file;
A type data obtaining unit for obtaining type data representing a type of the file different from the extension included in a specific part of the data when the receiving unit receives data constituting the file;
The presence / absence of the file is determined based on whether the extension of the file acquired by the extension acquisition unit matches the type data of the file acquired by the type data acquisition unit. A communication apparatus comprising: a risk determination unit. The receiving means receives a file acquisition request that the client computer transmits to the server computer via the network, and file data that the server computer transmits to the client computer in response to the file acquisition request,
The communication apparatus according to claim 1, wherein the extension acquisition unit acquires the extension of the file from the data of the file acquisition request received by the reception unit.   When the risk determination means determines that the file is dangerous, the client computer further comprises file acquisition stop means for stopping acquisition of the file from the server computer by the client computer. The communication device according to claim 2. The receiving means receives data of a file from the server computer as a response to the file acquisition request transmitted from the own device to the server computer via the network;
2. The communication apparatus according to claim 1, wherein the extension acquisition unit acquires an extension of the file from data of the file acquisition request transmitted from the own apparatus to the server computer. On the computer,
The ability to receive data flowing over the network;
A function for acquiring the extension of the file included in the character string representing the name of the file;
A function of receiving the data constituting the file when the function of receiving the data receives the type data representing the type of the file different from the extension included in the specific part of the data;
A program for realizing a function for determining whether or not a file has a risk according to whether or not the obtained extension of the file matches the type data of the file.

Images