JP2012003463A - Supporting device, method and program for supporting signature generation - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a supporting device, method and program that are capable of efficiently generating a signature which is directed to a text format sample in an intrusion detection system.SOLUTION: A signature generation server 10 comprises a text determination unit 112 that determines whether a sample of attack data or non-attack data has a text format or not; a character class classification unit 114 that classifies characters included in the sample determined as having the text format into any of the character classes in a regular expression; a character string extraction unit 115 that extracts a character string or sequence of character strings more frequently appearing in the attack data than the non-attack data, as a candidate of the signature, among the character strings made up of continuous characters classified into an alphabet.

Description

  The present invention relates to a support apparatus, method, and program for supporting generation of a signature for detecting intrusion of unauthorized data.

  2. Description of the Related Art Conventionally, a server that provides services by publishing to the Internet, such as a Web server, may be attacked (illegal access) from the Internet. Therefore, a firewall or an intrusion detection system is generally installed. The firewall prevents attacks on unintended ports on the server by allowing only certain protocols, IP addresses and port numbers to pass through. The intrusion detection system detects an attack from the contents of a packet passing through the permitted port and notifies the operator.

  This intrusion detection system often employs a method called a signature type. The signature type is a method in which a bit string peculiar to an attack is registered in a database in advance, and it is determined that an attack has occurred when the content of communication matches this bit string. However, since the attack methods become new one after another, it is indispensable to update the signature in order to cope with the change in the attack method. This signature is generated and distributed by the community of intrusion detection system distributors and operators. Usually, experts extract bit strings specific to attacks from information on communications and vulnerabilities that occur at the time of an attack. Registered as

  In order to reduce the time and cost related to the generation of such signatures, methods for automatically generating signatures from information on communication contents and attack methods have been proposed (for example, Patent Documents 1 to 4 and Non-Patent Document 1). To 3).

  By the way, when the attack is a binary executable file, this file can be converted into a different bit string by compressing, encrypting, obfuscating, or optimizing the file in the executable format. Therefore, if the attacker performs these conversions on the attack packet, the attack detection by the signature may be avoided. An attack specimen generated by such conversion is called polymorphic malware. The polymorphic technology is applied not only to an executable file but also to attack communication.

  Therefore, a method has been proposed in which a plurality of polymorphic samples are generated for one attack sample, and a bit string common to all the samples is generated as a signature (see, for example, Non-Patent Document 4 or 5). ).

Japanese Patent No. 4265163 JP 2004-348740 A JP 2007-058514 A JP 2007-242002 A

Hyang-ah Kim, “Autograph: Towered automated, distributed worm signature detection,” Proceedings of the 13th Usage Security Symposium, 200 Sumet Singh, Christian Estan, George Vargese and Stefan Savage, “Automated Form of Stimulation, 6th Conference on Symposium.” Christian Kreibich and Jon Crowcroft, “Honeycomb-Creating Intrusion Detection Detections IIHonepots,” Proceedings of the Second Worlds. James Newsome, Brad Karp and Dawn Song, “Polygraph: Automatically Generating Signatures for Polymorphic Worms, and Proceedings of P Zhichun Li, Manan Sanghi, Yan Chen, Ming-yang Kao and Brian Chavez, "Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience," Proceedings of the 2006 IEEE Symposium on Security and Privacy, 2006

  In recent years, malware infection routes are shifting from an active route from a network to a passive route via a web browser from a web site being browsed. Therefore, the number of text format samples such as HTML and JavaScript (registered trademark) that can be interpreted by Web browsers is increasing.

  In addition, since the attack to the Web browser is a method of guiding the Web browser to the attack Web site using HTML or JavaScript (registered trademark), the intrusion detection system installed on the Web server may not be able to detect the attack. Therefore, it is desirable to efficiently generate a signature from a text sample.

  However, the above-described signature generation method for a binary sample cannot efficiently process a text sample. In other words, the script in the text format is more flexible in expression than the binary format and can be easily converted to avoid the signature. Therefore, it takes a lot of time to exhaustively search for valid signatures. For example, since HTML and JavaScript (registered trademark) ignore a continuation of a space or a line feed code, a different attack script is generated only by adding a space.

  Therefore, an object of the present invention is to provide a support apparatus, method, and program capable of efficiently generating a signature for a text sample in an intrusion detection system.

  The present invention provides the following solutions.

  (1) A support device for supporting generation of a signature for detecting intrusion of attack data, a text determination unit for determining whether a specimen of attack data and non-attack data is in a text format, and the text A class classification unit that classifies the characters included in the specimen determined to be in text format by the determination unit into one of the character classes in the regular expression, and is classified into a predetermined character class by the class classification unit A character string extracting unit that extracts, as a candidate for the signature, a character string that appears more frequently in the attack data than in the non-attack data, or a string of character strings, among character strings that consist of a sequence of characters; A support device comprising:

  According to such a configuration, the support apparatus extracts a character string or a string of character strings made up of a predetermined type of character that appears more frequently in attack data than in non-attack data, from the text sample. Therefore, the support apparatus can efficiently extract signature candidates specific to text format attacks by paying attention to only predetermined types of characters. As a result, the support apparatus can reduce the processing load, and can comprehensively search for signature candidates for a large number of samples.

  (2) The support apparatus according to (1), further including a regular expression generation unit that generates a signature in a regular expression format indicating a character string or a string of character strings extracted by the character string extraction unit.

  According to such a configuration, since the support apparatus generates a signature based on a regular expression, the same signature can be made to correspond to fluctuations in text data. As a result, the support device can improve the accuracy of detecting attack data.

  (3) The regular expression generation unit, with respect to characters or character strings classified into a character class other than the predetermined character class, other characters or character strings classified into a character class other than the predetermined character class The assisting device according to (2), wherein a signature in a regular expression format that can be replaced with is generated.

  According to such a configuration, the support apparatus can make the same signature correspond to obfuscated text data such as inserting a space. As a result, the support device can improve the accuracy of detecting attack data.

  (4) An effectiveness determination unit that obtains an effectiveness index based on a predetermined criterion set in advance for each of the signatures generated by the regular expression generation unit, and selects the signature based on the effectiveness index. The support device according to (2) or (3) further provided.

  According to such a configuration, the support device selects a signature that can detect attack data with higher accuracy based on the effectiveness index. Therefore, in the intrusion detection system that uses this signature, the accuracy of detection of attack data is high. It is possible to improve the processing efficiency.

  (5) The support apparatus according to any one of (1) to (4), further including a sample collection unit configured to collect a sample of the attack data or the non-attack data.

  According to such a configuration, since the support apparatus automatically collects the specimen for extracting the signature, the workload on the operator is reduced. Furthermore, the possibility that an effective signature can be extracted increases as the number of specimens increases.

  (6) The apparatus further includes a sample determination unit that determines whether the sample is attack data or non-attack data by comparing the URL included in the sample with a predetermined list (1) to (5 ).

  According to such a configuration, the support apparatus can collate the URL to which the browser that browsed the specimen is redirected with a list that has already been identified as an attack site, so whether the specimen is attack data or non-attack data. Can be easily determined. Therefore, the support apparatus can improve the reliability of the signature generated based on the specimen.

  (7) The sample determination unit also checks whether the sample is attack data or non-attack data by checking the URL generated by executing the script included in the sample with the predetermined list. (6) The support apparatus according to (6).

  According to such a configuration, the support apparatus can detect a request that actually occurs by executing the script in the sample, and acquire the redirect destination URL. Therefore, the support apparatus can easily determine whether or not the specimen is attack data even when the URL is not clearly specified as text.

  (8) A text determination step for determining whether or not a sample of attack data and non-attack data is in a text format, wherein the computer supports generation of a signature for detecting intrusion of attack data, In the text determination step, the characters included in the specimen determined to be in the text format are classified into one of the character classes in the regular expression, and in the class classification step, the characters are classified into a predetermined character class. A character string extraction step of extracting, as a candidate for the signature, a character string that frequently appears in the attack data, or a string of character strings, out of a character string composed of a series of characters And a method comprising:

  According to such a configuration, the same effect as in (1) can be expected when the computer executes the method.

  (9) A text determination step for allowing a computer to generate a signature for detecting the invasion of attack data, wherein the text determination step determines whether the specimen of the attack data and the non-attack data is in a text format; In the text determination step, the characters included in the specimen determined to be in the text format are classified into one of the character classes in the regular expression, and in the class classification step, the characters are classified into a predetermined character class. A character string extraction step of extracting, as a candidate for the signature, a character string that frequently appears in the attack data, or a string of character strings, out of a character string composed of a series of characters And a program to execute.

  According to such a configuration, the same effect as in (1) can be expected by causing the computer to execute the program.

  According to the present invention, it is possible to efficiently generate a signature for a specimen in a text format in an intrusion detection system.

It is a figure which shows the whole structure of the system environment which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the signature generation server which concerns on embodiment of this invention. It is a figure which shows the character class in the regular expression which concerns on embodiment of this invention. It is a figure which shows the example of the table which memorize | stored the candidate of the signature which concerns on embodiment of this invention. It is a flowchart which shows the process of the signature generation server which concerns on embodiment of this invention.

Hereinafter, an example of an embodiment of the present invention will be described.
In the present embodiment, the signature generation server 10 will be described as an example of a support device.

  FIG. 1 is a diagram showing an overall configuration of a system environment including a signature generation server 10 and an intrusion detection system 6 according to the present embodiment.

  The hosting server group 1 publishes a website on the Internet 2 and is accessed from the site management terminal 3 or the site browsing terminal 4. The attacker 5 controls the management terminal 3 and uploads attack data (text data such as HTML and JavaScript (registered trademark)) for guiding to the attack site to the hosting server group 1. Then, the browsing terminal 4 is redirected to the attack site prepared by the attacker 5 by browsing the Web site including the attack data, and is attacked.

  The intrusion detection system 6 is a system that detects the intrusion of attack data into the hosting server group 1, and stores a signature for identifying the attack data in a database. The operator 7 of the hosting server group 1 grasps the intrusion of attack data by receiving a warning from the intrusion detection system 6. Moreover, the operator 7 responds to new attack data by appropriately updating this signature.

  The signature generation server 10 is a device that supports signature generation. Based on the instruction input from the operator 7, the signature generation server 10 generates a signature from the samples collected from the hosting server group 1 and the Internet 2 and registers them in the database of the intrusion detection system 6.

FIG. 2 is a block diagram illustrating a functional configuration of the signature generation server 10 according to the present embodiment.
The signature generation server 10 includes a control unit 11, a storage unit 12, a communication unit 13, an input unit 14, and an output unit 15.

  The control unit 11 is a part that controls the entire signature generation server 10. By appropriately reading and executing various programs stored in the storage unit 12, the control unit 11 cooperates with the hardware described above, and performs various types in the present embodiment. The function is realized. The control unit 11 may be a CPU (Central Processing Unit). In addition, the function of each part with which the control part 11 is provided is mentioned later.

  The storage unit 12 is a storage area for various programs and various data for causing the hardware group to function as the signature generation server 10, and may be a hard disk (HDD). Specifically, the storage unit 12 stores a program to be executed by the control unit 11 in order to realize various functions of the present embodiment.

  The communication unit 13 is a network adapter in the case where the signature generation server 10 transmits / receives information to / from other devices, collects samples of attack data or non-attack data via the network (Internet 2), and sends the sample to the control unit 11. provide. The communication unit 13 receives instruction data from the terminal of the operator 7 and transmits a signature to the intrusion detection system 6.

  The input unit 14 is an interface device that receives an instruction input from the user to the signature generation server 10. The input unit 14 includes, for example, a keyboard, a mouse, a touch panel, and the like.

  The output unit 15 includes a display device that displays a screen for accepting data input to the user and displays a screen of a processing result by the signature generation server 10. Further, the output unit 15 may include various output devices such as a printer in addition to a display device such as a cathode ray tube display device (CRT) or a liquid crystal display device (LCD).

Next, the function of the control unit 11 will be described in detail.
The control unit 11 includes an attack sample collection unit 111a, a non-attack sample collection unit 111b, a text determination unit 112, a sample determination unit 113, a character class classification unit 114, a character string extraction unit 115, and a regular expression generation unit. 116 and an effectiveness determination unit 117. Each unit is a functional block realized by executing a program stored in the storage unit 12.

  The attack specimen collection unit 111a collects specimens of attack data. Specifically, the attack specimen collection unit 111a receives from the operator 7 a designated input of a URL of a website that is known or highly likely to have been attacked, and is specified by this URL. Collect page data for web pages.

  The non-attack sample collection unit 111b collects samples of non-attack data. Specifically, the non-attack sample collection unit 111b receives the URL of the hosting server group 1 to be monitored by the intrusion detection system 6 and acquires page data. At this time, the non-attack sample collection unit 111b refers to the link included in the acquired page data (HTML) and repeats the process of acquiring another page data. Thereby, a non-attack sample is collected efficiently.

  The text determination unit 112 determines whether or not the collected specimen is in a text format. Specifically, when the text determination unit 112 reads the first few bytes of the sample file, if this byte string is a specific character string (for example, “<! Doctype html”), a certain type of It is determined that the file is in text format (for example, HTML format).

  The specimen determination unit 113 compares the URL included in the collected specimen (HTML file) with a predetermined list, that is, a public blacklist, so that the specimen is attack data or non-attack data. Simple judgment. The sample determination unit 113 also targets HTTP requests generated by executing the JavaScript (registered trademark) included in the sample, and the URL generated by the execution is checked against a predetermined black list. , Whether the specimen is attack data or non-attack data is simply determined.

  The character class classification unit 114 classifies the characters included in the sample determined to be in the text format by the text determination unit 112 into one of the character classes in the regular expression.

FIG. 3 is a diagram showing character classes in the regular expression according to the present embodiment.
In the present embodiment, each character is classified into one of alphabet (alphabetic character), number (digit character), or non-word character (non-word) character class. Further, the non-word characters are further classified into punctuation characters (White space characters) or control characters (Control characters).

  In the regular expression, the alphabet is represented as “[: alpha:]”, the number is represented as “[: digit:]”, the delimiter is represented as “[: punct:]”, and the space character is represented as “[: space:] "and the control character is represented as" [: cntll:] ". In the present embodiment, a regular expression “¥ w” representing a non-word character is used without distinguishing a delimiter, a space character, and a control character.

  The character string extraction unit 115 extracts a character string composed of a series of characters classified into alphabets (predetermined character classes) by the character class classification unit 114. Then, the character string extraction unit 115 extracts a character string or a character string string that appears more frequently in the attack data sample than in the non-attack data sample, as a signature candidate. Specifically, the character string extraction unit 115 extracts a character string or a character string string that appears in the attack data sample at a rate equal to or higher than a certain threshold and appears in the non-attack data sample at a rate equal to or lower than another threshold. It is good to do.

  Here, a character string having a high appearance frequency in a sample of attack data but having a low appearance frequency in a sample of non-attack data is a potential signature candidate for detecting attack data. Further, since the character string extraction unit 115 extracts only the character string of the alphabet divided by the characters other than the alphabet, the number of signature candidates can be reduced as compared to extracting the bit string from the binary sample. That is, when a bit string is extracted without specifying the division position, bit strings of various lengths are candidates, but the character string extraction unit 115 is capable of clearly dividing the alphabet characters by characters of a character class other than the alphabet. Target a column.

  The regular expression generation unit 116 generates a regular expression signature indicating the character string or character string extracted by the character string extraction unit 115 and stores the signature in the storage unit 12. At this time, the regular expression generation unit 116 can replace a character or character string classified into a character class other than alphabet with another character or character string classified into a character class other than alphabet. Generate a signature for

FIG. 4 is a diagram illustrating an example of a table storing signature candidates according to the present embodiment.
Here, the Token field is a character string or a string of character strings extracted by the character string extraction unit 115, and the RegExp Signature field is a regular expression format signature generated by the regular expression generation unit 116.

  Further, the True + field is a ratio in which the signature is included in the specimen of the attack data, and the False + field is a ratio in which the signature is included in the specimen of the non-attack data. Further, the Length field is an alphabetic character string represented by the signature or the length of the character string. These are used to determine the validity of the generated signature.

  In the regular expression, the character string delimiter is expressed as “¥ ([[: digit:]] ¥ | ¥ w ¥) ¥ +”, and an arbitrary character string composed of characters belonging to a character class other than the alphabet is represented. Show. That is, even when a number or non-word character in the attack data is converted into a character string composed of another number or non-word character (for example, when a space is inserted), it matches the signature.

  In the example of FIG. 4, when the extracted character string is 2 characters or less, there is a high possibility of erroneous detection in the intrusion detection system 6 due to, for example, a difference in variable name. expressing.

  The validity determination unit 117 obtains an effectiveness index based on a predetermined criterion set in advance for each signature generated by the regular expression generation unit 116, and selects a signature based on the validity index. Specifically, for example, as shown in FIG. 4, the ratio that the signature is included in the specimen of attack data (True +), the ratio that the signature is included in the specimen of non-attack data (False +), the character string length (Length), and the like Is the effectiveness index.

  As described above, (True +) is better as it is larger, and (False +) is better as it is smaller. Further, as (Length) is longer, false detection is less likely to occur. Therefore, the validity determination unit 117, for example, a preset priority such as one with a large (True +), one with a small (False +), one with a large (True +) − (False +), one with a large (Length), etc. Select a valid signature based on the degree.

  In addition, since there is a high possibility that a meaningful character string such as a function name is a valid signature rather than a random character string, the validity determination unit 117 may prioritize such a signature.

  FIG. 5 is a flowchart showing processing of the signature generation server 10 according to the present embodiment.

  In step S1, the control unit 11 (attack sample collection unit 111a, non-attack sample collection unit 111b) collects sample of attack data and non-attack data.

  In step S2 (text determination step), the control unit 11 (text determination unit 112) determines whether or not the sample collected in step S1 is in text format. The control unit 11 excludes the sample determined not to be in the text format, and proceeds to the next step.

  In step S3, the control unit 11 (specimen determination unit 113) performs simple determination as to whether the sample is determined to be text format in step S2 as attack data or non-attack data. The control unit 11 may exclude the sample determined to be different from the classification at the time of collection (attack data or non-attack data) by the following processing, or may replace the classification.

  In step S4 (class classification step), the control unit 11 (character class classification unit 114) classifies characters included in the sample that have not been excluded until step S3 into character classes in the regular expression.

  In step S5 (character string extraction step), the control unit 11 (character string extraction unit 115) extracts a character string or a string of character strings composed of the characters classified into alphabets in step S4. Signature candidates that appear more frequently in attack data than data are further extracted.

  In step S6, the control unit 11 (regular expression generating unit 116) generates a regular expression for detecting the character string of the signature candidate extracted in step S5 or the string of character strings.

  In step S <b> 7, the control unit 11 (validity determination unit 117) determines the validity of the regular expression signature candidate generated in step S <b> 6 and selects the one determined to be valid as the signature.

  As described above, according to the present embodiment, the signature generation server 10 extracts an alphabetic character string or a character string string that appears more frequently in attack data than in non-attack data, from the text sample. Therefore, the signature generation server 10 can efficiently extract signature candidates specific to text format attacks by paying attention only to the alphabetical sequence. As a result, the signature generation server 10 can reduce the processing load, and can comprehensively search for signature candidates for a large number of samples.

  Furthermore, since the signature generation server 10 generates a signature based on a regular expression, the same signature can be made to correspond to fluctuations in obfuscated text data such as inserting a space. As a result, the signature generation server 10 can improve the accuracy of detecting attack data.

  Further, since the signature generation server 10 selects a signature that can detect attack data with higher accuracy based on the validity index such as the appearance frequency and the character string length, the intrusion detection system 6 that uses this signature performs an attack. Data detection accuracy can be improved and processing efficiency can be expected.

  In addition, since the signature generation server 10 automatically collects the specimen for extracting the signature, the workload of the operator is reduced. Furthermore, the possibility that an effective signature can be extracted increases as the number of specimens increases.

  In addition, since the signature generation server 10 can collate the URL to which the browser that browsed the sample is redirected with a blacklist that has already been identified as an attack site, whether the sample is attack data or non-attack data Simple judgment can be made. Furthermore, the signature generation server 10 can detect a request that actually occurs by executing a script in the sample, and acquire a redirect destination URL. Therefore, the support apparatus can easily determine whether or not the specimen is attack data even when the URL is not clearly specified as text. As a result, the signature generation server 10 can improve the reliability of the signature generated based on the specimen.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. Further, the effects described in the present embodiment are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the present embodiment.

10 Signature generation server (support device)
DESCRIPTION OF SYMBOLS 11 Control part 12 Memory | storage part 13 Communication part 14 Input part 15 Output part 111a Attack sample collection part 111b Non-attack sample collection part 112 Text determination part 113 Sample determination part 114 Character class classification part 115 Character string extraction part 116 Regular expression production | generation part 117 Effectiveness determination unit

Claims (9)

A support device that supports generation of a signature for detecting intrusion of attack data,
A text determination unit that determines whether or not a sample of attack data and non-attack data is in a text format;
A class classification unit that classifies characters included in the specimen determined to be in text format by the text determination unit into any of the character classes in a regular expression;
Among character strings consisting of a series of characters classified into a predetermined character class by the class classification unit, a character string that appears more frequently in the attack data than in the non-attack data, or a string of character strings A character string extraction unit that extracts the candidate signature.   The support apparatus according to claim 1, further comprising a regular expression generation unit that generates a signature in a regular expression format indicating a character string or a string of character strings extracted by the character string extraction unit.   The regular expression generator can replace a character or character string classified into a character class other than the predetermined character class with another character or character string classified into a character class other than the predetermined character class. The support apparatus according to claim 2, wherein the regular expression format signature is generated.   The system further comprises an effectiveness determination unit that obtains an effectiveness index based on a predetermined criterion set in advance for each signature generated by the regular expression generation unit and selects the signature based on the effectiveness index. The support device according to claim 2 or claim 3.   The support device according to any one of claims 1 to 4, further comprising a sample collection unit that collects the sample of the attack data or the non-attack data.   The sample determination unit according to any one of claims 1 to 5, further comprising a sample determination unit that determines whether the sample is attack data or non-attack data by comparing a URL included in the sample with a predetermined list. The support apparatus according to the above.   Whether the sample is attack data or non-attack data by collating the URL generated by executing the script included in the sample with the predetermined list. The support device according to claim 6, wherein the determination is made. A method for a computer to support generation of a signature for detecting intrusion of attack data,
A text determination step for determining whether or not a sample of attack data and non-attack data is in a text format;
A class classification step for classifying the characters included in the specimen determined to be in the text format in the text determination step into one of the character classes in a regular expression;
Among character strings consisting of a series of characters classified into a predetermined character class in the class classification step, a character string that appears more frequently in the attack data than in the non-attack data, or a string of character strings And a character string extracting step of extracting as a candidate for the signature. A program for assisting a computer in generating a signature for detecting intrusion of attack data,
A text determination step for determining whether or not a sample of attack data and non-attack data is in a text format;
A class classification step for classifying the characters included in the specimen determined to be in the text format in the text determination step into one of the character classes in a regular expression;
Among character strings consisting of a series of characters classified into a predetermined character class in the class classification step, a character string that appears more frequently in the attack data than in the non-attack data, or a string of character strings And a character string extraction step of extracting as a signature candidate.

Images