JP2012083849A - Malware detector, and method and program for the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce an arithmetic load and a network load on a malware analysis system.SOLUTION: A malware detector includes: a cluster construction unit for clustering false positive files found in a computer such as a user PC and having a possibility of being malware to construct a cluster including the false positive files; a transmission target sample selection unit for selecting, as a sample to be transmitted to a malware analysis system, a false positive file in the cluster including the false positive files; a sample transmission unit for transmitting the selected sample to the malware analysis system; and an analytical report analysis unit for analyzing an analytical report corresponding to the transmitted sample and obtained from the malware analysis system to classify the false positive files included in the cluster into "malware" and "non-malware".

Description

  The present invention relates to malware detection technology, and more particularly to technology for transmitting a specimen from a user PC to a malware analysis system. .

  Malware is a type of computer program that, when executed in a computer terminal, performs activities harmful to the user, such as file deletion and information leakage.

  In the past, anti-malware measures were generally performed by anti-virus software installed in the user's PC using the characteristic information (signatures) of known malware to remove malware. Today, when tens of thousands of new types of malware appear, feature information cannot be updated in time, and the detection rate is decreasing.

  In order to solve this problem, research on malware analysis systems that analyze malware behavior and determine whether it is malware or not is in progress. In malware detection using a malware analysis system, a false positive file discovery program in a user PC first inspects the user PC and extracts a file (false positive file) that may be malware. Next, a false positive file is sent as a sample from the user PC to the malware analysis system. The malware analysis system that has received the sample performs analysis, and returns a malware analysis report in which the determination result of whether the sample is malware and the behavior of the sample are recorded to the user PC. The user PC disinfects the file determined to be malware. However, when a large number of false positive files are found on the user PC, a large number of specimens are transmitted to the malware analysis system, which causes a problem that the computation load and the network load of the malware analysis system increase.

  For this reason, attempts have been made to reduce the load on the malware analysis system. Non-Patent Document 1 holds a hash value of a sample already analyzed and a database of the analysis report in the malware analysis system, and only when the hash value of a sample newly received from the user PC is not included in the database. A technique for reducing the calculation load of the analysis system by performing a new analysis is disclosed.

“Improving the Efficiency of Dynamic Malware Analysis”, Proceedings of ACM 25th Symposium on Applied Computing, 2010.

  However, in the technique disclosed in Non-Patent Document 1, since all false positive files are transmitted as samples from the user PC to the malware analysis system, the network load of the malware analysis system is not improved. In addition, since the malware analysis system performs processing such as calculation of the hash value of the sample in order to confirm whether the received sample has already been analyzed, a load associated with this is generated.

  The disclosed malware detection device, detection method, and program thereof have the following configurations. The malware detection device clusters a false positive file that may be malware, which is found in a computer such as a user PC, and constructs a cluster including a false positive file. A transmission sample selection unit that selects a false positive file as one sample to be transmitted to the analysis system, a sample transmission unit that transmits the selected sample to the malware analysis system, and an analysis acquired from the malware analysis system corresponding to the transmitted sample An analysis report analysis unit that analyzes the report and classifies false positive files included in the cluster into either “malware” or “non-malware”. The malware detection method and the program thereof execute a procedure by the malware detection device, or the computer executes the function of the malware detection device as a program.

  Furthermore, in a desirable aspect of the malware detection device, the transmission specimen selection unit sets the oldest false positive file that is included in the cluster as the generation time when the false positive file is generated as a false positive file selected as a specimen.

  According to the present invention, the transmission of the specimen from the user PC to the malware analysis system is made efficient.

It is a figure which shows the structure of the system of embodiment. It is a figure which shows the physical structure of user PC. It is a figure which shows the logical structure of user PC. It is a figure which shows the logical structure of a cluster construction part. It is a figure which shows the structural example of false positive file DB. It is a figure which shows the structural example of analysis report DB. It is a figure which shows the structural example of process execution DB. It is an example of an analysis report. It is an example of an analysis report. It is a process flowchart of a false positive file detection part. It is a process flowchart of the control part of a cluster construction part. It is a processing flowchart of cluster module A. It is a processing flowchart of cluster module B. It is a process flowchart of a transmission sample selection part. It is a process flowchart of a sample transmission part. It is a process flowchart of a report receiving part. It is a process flowchart of a report analysis part. It is a flowchart of a false positive file record determination process.

  FIG. 1 is a diagram illustrating a configuration of a system according to the present embodiment. The user PC 100 is a computer such as a personal computer. The malware analysis system 200 is a computer such as a personal computer or a server. The user PC 100 and the malware analysis system are connected via a network 300 such as the Internet.

  FIG. 2 is a diagram illustrating a physical configuration of the user PC 100. The user PC 100 is a computer device that includes a user PC main body 110 and an input / output device 170.

  The user PC main body 110 is a computer device including a CPU 120, a memory 130, an interface 140, an external storage device 150, and a bus 160 for connecting them. An apparatus generally called a personal computer corresponds to this.

  The CPU 120 is an arithmetic device for executing processing. The memory 130 stores a processing program executed by the CPU 120 and data used by the program.

  The memory 130 stores a malware detection program 131 as a processing program. And this malware detection program is run by CPU120, and a malware is detected. Specific processing executed by the CPU 120 will be described later.

  The interface 140 is a communication device such as a LAN card for connecting the user PC 100 to a network. The user PC 100 is connected to the network 300 through the interface 140. The interface 140 may be described as IF in the figure.

  The external storage device 150 is configured by an HDD (Hard Disk Drive) or the like, and stores a false positive file DB 151, an analysis report DB 152, and a process execution DB 153. Specific contents of these DBs will be described later.

  The input / output device 170 is a device for inputting / outputting data to / from the user PC. Examples of input / output devices include a keyboard, a mouse, and a display.

  FIG. 3 is a diagram illustrating a functional configuration of the user PC 100 and a relationship with each physical device. The CPU 120 executes a malware detection program 131 including processing of a false positive file detection unit 121, a cluster construction unit 122, a transmission sample selection unit 123, a sample transmission unit 124, a report reception unit 125, and a report analysis unit 126.

  The false positive file detection unit 121 searches for a file in the external storage device 150 and finds a false positive file that may be malware. When a false positive file is found, the file information is registered in the false positive file DB 151.

  The cluster construction unit 122 performs clustering to classify the target records into a plurality of groups for the records included in the false positive file DB 151 whose file type 506 (FIG. 5) is “undecided”. FIG. 4 shows a logical configuration of the cluster construction unit 124. The cluster construction unit 122 includes a supervision unit 401, a cluster module A402, and a cluster module B403. The cluster module A 402 and the cluster module B 403 include a program for performing clustering. Specifically, this is a function of assigning a cluster ID 505 to each record included in the false positive file DB 151. The cluster module A 402 and the cluster module B 403 are different in type and different in the clustering algorithm to be executed. In the present embodiment, two cluster modules A and B are described, but there may actually be any configuration including one or more cluster modules. The supervising unit 401 is a program for selecting and executing one of these cluster modules. Which cluster module is selected is input in advance to the malware analysis system 200 by the system user through the input / output device 170 or the like. Here, the cluster module A 402 classifies false positive files having the same hash value into the same cluster. The cluster module B403 performs clustering based on the parent-child relationship of processes. For clustering, a process execution DB 153 described later is used.

  FIG. 5 is a diagram showing the configuration of the false positive file DB 151. The ID 501 is a value (identifier) unique to each file. A file path 502 is a character string indicating a full path from the root directory of the file. The detection time 503 is the time when the file specified by the ID 501 is detected by the user PC 100 as a false positive file. The generation time 504 is the time when the file specified by the ID 501 is generated in the user PC 100. The cluster ID 505 is an ID (identifier) of the cluster to which the file specified by the ID 501 belongs. The same cluster ID 505 is assigned to files belonging to the same cluster.

  In the example of FIG. 5, a false positive file whose ID 501 is 1, 2, 3 belongs to a cluster whose cluster ID 505 is 1, a false positive file whose ID 501 is 4, 5, 6 belongs to a cluster whose cluster ID 505 is 2, The false positive file whose ID 501 is 7 belongs to the cluster whose cluster ID 505 is 3, and the false positive file whose ID 501 is 8 belongs to the cluster whose cluster ID 505 is 4.

  The file type 506 is information indicating the derivation source-derivation destination relationship of the file. Here, the derivation source-derivation destination relationship is defined as follows. When it is confirmed that a certain file is derived from another file, the generated file is called a derivation destination file. Other files that are not are called derivation source files. The relationship between a file and a file derived from another file can be expressed in a tree structure, but the file at the root of the tree structure is the source file, and the other files are in the leaf even if they are nodes. Is also called a derivation destination file.

  In the example of FIG. 5, the false positive file c: \ a1.exe whose ID 501 is 1 is a derivation source file, and the false positive files c: \ a2.exe and c: \ a3.exe whose ID 502 is 2 and 3 are It is a derivation destination file derived from c: \ a1.exe.

  The status 507 is a flag indicating whether or not the file specified by the ID 501 is determined to be malware. The status 507 can take states such as “malware”, “non-malware”, “determination not possible”, “analyzing”, “waiting to send”, “cluster not built”.

  For a false positive file for which clustering has not yet been performed, the cluster ID is 0, and the status 507 is “cluster not constructed”. In the example of FIG. 5, the false positive file whose ID 501 is 9 is not clustered, the file type 506 is “undecided”, and the status 507 is “cluster not built”.

  Returning to FIG. 3, the transmission specimen selection unit 123 classifies the clustered false positive files into a derivation source file and a derivation destination file based on the generation time 504. The sample transmission unit 124 transmits a false positive file whose file type 506 is a derivation destination file to the malware analysis system 200. The report receiving unit 125 receives a malware analysis report from the malware analysis system 200 and stores it in the analysis report DB 152.

  FIG. 6 is a diagram showing the configuration of the analysis report DB 152. The report ID 601 is a unique value (identifier) for the malware analysis report. The reception time 602 is the time when the report specified by the report ID 601 is received. The content 603 is character string data indicating the contents of the report specified by the report ID 601, and details thereof will be described with reference to FIGS. 8 and 9. The status 604 indicates the status of the report specified by the report ID 601 and can take values such as “analyzed” and “waiting for analysis”.

  FIG. 8 and FIG. 9 are examples of analysis reports and are examples of character string data included in the content 603. In this example, line feeds are added as necessary to make the data easier to see. Data included in the content 608 is described in the XML format. The <Report> tag is a tag that includes the entire report. <Report> includes <Date> tag, <Sample> tag, and <Derived file> tag.

The <date / time> tag includes the date and time when the sample was acquired.
The <sample> tag is a tag describing information about the analyzed file. The analysis result regarding the derivation source file transmitted to the malware analysis system 200 is included in <specimen tag>. The <sample> tag includes a <file> tag and a <determination> tag. The <file> tag includes the path and file name of the file included in the <sample> tag. The <determination> tag stores a character string indicating whether or not the file described in the <file> tag is malware.

  The <derivation destination> tag includes information on a file derived from the sample file indicated by the <sample> tag. The derivation destination file includes a <hash value> tag, a <file> tag, and a <determination> tag. Only one of the <hash value> tag and the <file> tag may be included in the <derivation destination file> tag.

  The analysis report shown in Fig. 8 shows that the source file c: \ a1.exe sent as a sample on July 7, 2010 at 10:00:55 is malware, and the sample destination file c: \ This indicates that an analysis result indicating that a file with the same hash value as a1.exe is malware was output.

  The analysis report shown in FIG. 9 shows that the sample c: \ b1.exe is non-malware at 10:00:55 on July 7, 2010, and c: \ b2.exe derived from this sample is also non-malware. It shows that the analysis result that it is malware was output.

  Returning to FIG. 3, the report analysis unit 126 analyzes the received analysis report, and classifies the derivation source file and the derivation destination file included in a certain cluster into “malware”, “non-malware”, and “determination impossible”. First, the derivation source file transmitted to the malware analysis system 200 is specified by the <sample> tag. Next, the status 507 of the derivation destination file in the cluster including the derivation source file is set to “malware”, “non-malware”, or “undecidable” based on the information in the <derivation destination file> tag. .

  Of the derivation destination files in the cluster, those that are not classified as “malware” or “non-malware” are set to “undecided” for the file type 506 and “undecidable” for the status 507. Finally, the cluster construction unit 122 is called, clustering is performed again on these false positive files, and the derivation destination file is transmitted to the malware analysis system.

  FIG. 7 is a diagram illustrating a configuration of the process execution DB 153. The process 701 is a character string indicating the path of the file executing the process. The parent process 702 is a character string that indicates the path of the file that is executing the process that generated the process 701. The execution date and time 703 is a character string indicating the date and time when the process 701 was executed. For example, in the first record in Fig. 7, the process executing c: \ downloader.exe started the process executing c: \ b1.exe at 2010/07/07 10:50:00. Is shown.

  FIG. 10 is a flowchart showing the operation of the false positive file detection unit 121. The false positive file detection unit 121 selects one of the files included in the user PC 100 that has not been selected so far, and inspects the file (S1001). It is determined whether the inspected file is a false positive file (S1002). If it is a false positive file, the process branches to S1003, and if not, the process branches to S1004.

  In the file path 502, the file path of the file checked in S1001, the current time at the detection time 503, the file creation time at the creation time 504, 0 for the cluster ID 505, “undecided” for the file type 506, and the status 507 The record in which “cluster not constructed” is set is stored in the false positive file DB 151 (S1003), and the process proceeds to S1005.

  It is determined whether inspection of all files included in the user PC 100 has been completed (S1004). If not completed, the process proceeds to S1001, and if it has been completed, the process proceeds to S1005.

  The false positive file detection unit 121 calls the cluster construction unit 122 (S1005).

  FIG. 11 is a flowchart showing the operation of the overall unit 401 of the cluster construction unit 122. The supervising unit 401 acquires all the records whose file type 506 is “undecided” from the false positive file DB 151 (S1101). A module used for clustering is selected (S1102). A record of the acquired false positive file is given to the selected cluster module and executed (S1103). The overall unit 401 calls the transmission sample selection unit 123 (S1104).

  FIG. 12 is a flowchart showing the operation of the cluster module A402. The cluster module A402 stores the maximum value +1 of the cluster ID 505 of the false positive file DB 151 in the variable Newid (S1201).

  One of the sets of false positive file records given as input that has not been selected so far is selected (S1202), and the hash value of the file indicated by the file path 502 of the selected false positive file record is calculated (S1202). S1203).

  Among the set of false positive file records given as input, there is a file having a hash value equal to the calculated hash value, indicated by the file path 502, and a cluster ID 505 other than 0. If it exists, the process branches to S1205, and if it does not exist, the process branches to S1206.

  The cluster ID 505 of the record with the matched hash value is set to the cluster ID 505 of the selected false positive file record (S1205).

  The value of the variable Newid is set to the cluster ID 505 of the selected false positive file record (S1206). The value of New is incremented by 1 (S1207).

  The cluster module A 402 determines whether all false positive file records have been selected (S1208). If there is no unselected file record, the process ends. If there is no unselected file record, the process branches to S1202.

  In the example of FIG. 5 and FIG. 8, c: \ a1.exe, c: \ a2.exe, and c: \ a3.exe have the same hash value, and thus a cluster having a cluster ID 506 of 1 is constructed.

  FIG. 13 is a flowchart showing the operation of the cluster module B403. The cluster module B403 stores the maximum value +1 of the cluster ID 505 of the false positive file DB 151 in the variable Newid (S1301).

  With reference to the process execution DB 153, an unselected false positive file record is selected that has the oldest execution date 703 of the false positive file indicated by the file path 502 (S1302).

  There is a process execution record in which the file indicated by the file path 502 of the selected false positive file record is the process 701, and among the set of false positive file records, the file path 502 indicates the parent process 702 of the process execution record. It is determined whether it exists (S1303). If it exists, the process branches to S1304. If it does not exist, the process branches to S1305.

  The cluster ID 505 of the false positive file record indicating the existing parent process 702 is set in the cluster ID 505 of the selected false positive file record (S1304).

  A variable Newid is set to the cluster ID of the selected record (S1305). The value of the variable NewId is incremented by 1 (S1306).

  The cluster module B 403 determines whether all false positive file records have been selected (S1307). If there is no unselected one, the process ends. If there is no unselected one, the process branches to S1302.

  In the example of FIGS. 5, 7, and 9, the process that executes c: \ b1.exe executes c: \ b2.exe and c: \ b3.exe. Therefore, these three files construct a cluster with a cluster ID of 2.

  FIG. 14 is a flowchart showing the operation of the transmission sample selection unit 123. The transmission specimen selection unit 123 acquires a set of false positive file records whose file type 506 is “undecided” from the false positive file DB 151 (S1401). The acquired record set is grouped for each cluster ID 505 (S1402).

  One of the groups not yet selected is selected (S1403), and the file type 506 having the oldest generation time 504 among the false positive file records in the selected group is set as the “derived file”, and the other records. The file type 506 is set to “derived file” (S1404). The status 507 of all records in the group is set to “waiting for transmission” (S1405).

  It is determined whether there is a group that has not yet been selected (S1406). If it exists, the process branches to S1403, and if it does not exist, the process branches to S1407. In process S1407, the sample transmitter 124 is called and the process ends (S1407).

  In the example of FIG. 5, c: \ a1.exe is a derivation source file in a cluster with a cluster ID of 1, c: \ b1.exe is a derivation source file in a cluster with a cluster ID of 2, and other files are derivation destination files. Become.

  FIG. 15 is a flowchart showing the operation of the sample transmitter 124. The sample transmission unit 124 acquires a set of false positive file records whose status 507 is “waiting for transmission” from the false positive file DB 151 (S1501).

  When one of the records that have not yet been selected is selected (S1502), it is determined whether or not the type 506 of the selected record is a “derived file” (S1503). Branches to S1504, and if it is a “derived file”, branches to S1505.

  The false positive file indicated by the file path 502 of the record is transmitted to the malware analysis system 200 (S1504).

  The record status 507 is set to “analyzing” (S1505), and it is determined whether there is a record that has not been selected (S1506). If it exists, the process branches to S1502, and if not, the process ends. .

  FIG. 16 is a flowchart showing the operation of the report receiving unit 125. The report receiving unit 125 receives a malware analysis report from the malware analysis system 200 (S1601). An analysis report record in which the current time is set to the reception time 602, the malware analysis report body is set to the content 603, and “waiting for analysis” is set to the status 604 is stored in the analysis report DB 152 (S1602). The report receiving unit 125 calls the report analysis unit and ends the processing (S1603).

  FIG. 17 is a flowchart showing the operation of the report analysis unit 126. The report analysis unit 126 acquires a set of analysis report records whose status 604 is “waiting for analysis” from the analysis report DB 152 (S1701).

  One analysis report record that has not been selected is selected (S1702), and the <sample> element is acquired from the content 603 of the selected analysis report record (S1703). A false positive file record is obtained from the false positive file DB 151 such that the file path 502 indicates a file corresponding to the <sample> element (S1704). The cluster ID 505 of the false positive file record acquired in S1704 is set in the variable Target (S1705). A set of false positive file records in which the cluster ID 505 is equal to the variable Target is acquired from the false positive file DB 151 (S1706).

  From the acquired set of false positive file records, one of unselected ones is selected (S1707), and the analysis report record and the selected false positive file record are input to execute a false positive file record determination process (FIG. 18) (FIG. 18). S1708).

  It is determined whether all false positive file records have been selected (S1709). If there is an unselected record, the process branches to S1707, and if all records are selected, the process branches to S1710. It is determined whether all analysis report records have been selected (S1710). If there is an unselected record, the process branches to S1702, and if all records are selected, the process branches to S1711.

  The status 507 of all analysis report records acquired in S1701 is set to “analysis completed” (S1711). The report analysis unit 126 calls the cluster construction unit 122 and ends the processing (S1712). The cluster construction unit 122 clusters the false positive files determined to be neither “malware” nor “non-malware” in the false positive file record determination process, and uses the reconstructed cluster derivation source file as the malware analysis system 200. Send to.

  FIG. 18 is a flowchart showing a false positive file record determination process, which is a part of the process of the report analysis unit 126 (S1708). The false positive file record determination process determines whether or not the file indicated by the file path 502 of the false positive file record given as input is determined as “malware” in the content 603 of the analysis report record given as input ( S1801), if “malware” is determined, the process branches to S1802, and if “malware” is not determined, the process branches to S1804.

  The status 507 of the false positive file record is set to “malware” (S1802), and the file determined to be malware is removed from the user PC 100 (S1803).

  It is determined whether or not the file indicated by the file path 502 of the false positive file record is determined as “non-malware” in the content 603 of the analysis report record (S1804). If it is determined as “non-malware”, the process proceeds to S1805. If it is determined that it is not determined as “non-malware”, the process branches to S1806.

  The status 507 of the false positive file record is set to “non-malware” (S1805), and the process ends. The status 507 of the false positive file record is set to “undecidable” and the file type is set to “undecided” (step S1806), and the processing is terminated.

  In the example of FIG. 8, the derivation source file c: \ a1.exe, the derivation destination files c: \ a2.exe, and c: \ a3.exe are both determined as “malware” and removed. In the example of FIG. 9, the derivation source file c: \ b1.exe and the derivation destination file c: \ b2.exe are determined to be “non-malware”. On the other hand, the derivation destination c: \ b3.exe, which is the same cluster (cluster ID 505 = 2) as c: \ b1.exe, is not determined as “malware” or “non-malware” in the analysis report. 506 is “undecided” status 507 is “determination impossible”.

  According to this embodiment, false positive files are classified into a derivation source file and a derivation destination file, and only the derivation source file is transmitted to the malware analysis system, thereby reducing the computation load and network load of the malware analysis system.

  A part of the present embodiment may be modified and implemented as follows.

  First, the malware analysis system 200 may be included in the user PC 100. The malware analysis system 200 is one program that operates in the user PC. In this modification, since communication is not performed between the user PC 100 and the malware analysis system 200, there is an advantage that the communication load is eliminated.

  Secondly, the cluster module A 402 and the cluster module B 403 are not included in the user PC 100 and may exist on other terminals. The false positive file and information necessary for clustering are transmitted from the user PC 100 to a terminal including the cluster module A 402 and the cluster module 403, and the result of clustering is received. In this modification, the user PC 100 can use cluster modules on various terminals.

  DESCRIPTION OF SYMBOLS 100 ... User PC, 110 ... User PC main body, 120 ... CPU, 121 ... False positive file detection part, 122 ... Cluster construction part, 123 ... Transmission specimen selection part, 124 ... Sample transmission part, 125 ... Report reception part, 126 ... Report Analyzing unit, 130 ... memory, 131 ... malware detection program, 140 ... IF, 150 ... external storage device, 151 ... false positive file DB, 152 ... analysis report DB, 153 ... process execution DB, 160 ... bus, 170 ... input / output device , 200 ... Malware analysis system, 300 ... Network, 401 ... Supervision unit, 402 ... Cluster module A, 403 ... Cluster module B.

Claims (13)

A cluster construction unit for clustering false positive files that may be malware detected in a computer and constructing a cluster including the false positive files;
A transmission sample selection unit that selects the false positive file as one sample to be transmitted to the malware analysis system from the cluster including the false positive file;
A sample transmission unit for transmitting the selected sample to the malware analysis system; and
Analysis report analysis for analyzing the analysis report obtained from the malware analysis system corresponding to the transmitted sample and classifying the false positive file included in the cluster as either “malware” or “non-malware” Malware detection device characterized by having a section. 2. The transmission sample selection unit, wherein the generation time when the false positive file is generated includes the oldest false positive file included in the cluster as the false positive file selected as the sample. The malware detection device described. A method of detecting a false positive file that may be malware by a computer, the computer clustering the false positive files found in the computer, constructing a cluster including the false positive files,
From the cluster including the false positive file, the false positive file is selected as one specimen to be transmitted to the malware analysis system,
Send the selected sample to the malware analysis system,
The analysis report acquired from the malware analysis system is analyzed corresponding to the transmitted sample, and the false positive file included in the cluster is classified as either “malware” or “non-malware”. Malware detection method. The malware detection method according to claim 5, wherein the generation time when the false positive file is generated is the false positive file that selects the oldest false positive file included in the cluster as the sample. A cluster construction function for clustering false positive files discovered in a computer that may be malware and constructing a cluster including the false positive files;
A transmission sample selection function for selecting the false positive file as one sample to be transmitted to the malware analysis system from the cluster including the false positive file;
A sample transmission function for transmitting the selected sample to the malware analysis system; and
Analysis report analysis for analyzing the analysis report obtained from the malware analysis system corresponding to the transmitted sample and classifying the false positive file included in the cluster as either “malware” or “non-malware” A malware detection program for causing a function to be realized by the computer. 6. The computer according to claim 5, wherein the computer is configured to realize the transmission sample selection function in which the generation time at which the false positive file is generated is the false positive file selected as the sample with the oldest false positive file included in the cluster. The described malware detection program. The generation time when the false positive file was generated is the oldest false positive file included in the cluster as a derivation source file, another false positive file included in the cluster is a derivation destination file, and the derivation source file is the sample. The malware detection program according to claim 6, for causing the computer to realize the transmission specimen selection function that sets the false positive file selected as. The malware detection program according to claim 6 for causing the computer to realize the cluster construction function for selectively executing a plurality of cluster construction modules of different types. The malware detection program according to claim 8 for causing the computer to realize the cluster construction function for selectively executing the cluster construction module that uses the false positive files having the same hash value as one cluster. The malware detection program according to claim 8 for causing the computer to realize the cluster construction function for selectively executing the cluster construction module in which the executed process has a parent-child relationship with the false positive file as one cluster. The malware detection program according to claim 6, wherein the computer is configured to realize the cluster construction function for clustering the false positive file that is determined as “indeterminate” in the analysis report analysis procedure. Further, a request for causing the computer to realize a false positive file detection function for inspecting a file stored in the external storage device of the computer and finding the false positive file that may be malware from the file. Item 7. The malware detection program according to item 6. The malware detection program according to claim 5 for causing the computer to realize the analysis report analysis function for removing the false positive file classified as "malware" from the computer.

Images