JP2014179025A - Connection destination information extraction device, connection destination information extraction method, and connection destination information extraction program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique capable of promptly acquiring many pieces of connection destination information on malware such as a URL of a harmful server.SOLUTION: The connection destination information extraction device which has a communication function for performing communication with an external server through a network and which is disconnected from the network comprises: software execution means for executing software; communication observation means for observing connection operation to the external server by the software executed by the software execution means and acquiring communication logs associated with the connection operation; and connection destination information extraction means for extracting connection destination information on the software from the communication logs acquired by the communication observation means and storing the connection destination information in connection destination information storage means.

Description

  The present invention relates to malware analysis technology that is malicious software created with the intention of performing harmful operations, and more particularly, to technology for acquiring malware connection destination information and using the connection destination information as a blacklist. Is.

  In recent years, various malware has appeared. In particular, when it is executed, firstly, there are increasing numbers connected to C & C servers and download servers. Note that the C & C server is a server that sends a command (Command) to a computer group (botnet) infected with malware and turned into a bot, and is the center of control. In addition, URLs of harmful servers such as C & C servers and download servers are called malignant URLs.

  As an existing technology for obtaining a connection destination of malware, there is a technology for obtaining a connection destination by operating the malware in a safe virtual environment and actually connecting it to the outside. This technology is used to understand the behavior of malware and to identify malicious URLs. Such a malicious URL is stored as a black list and used for filtering or the like, thereby protecting the user.

  Note that in order to perform effective filtering, it is necessary that the black list is always kept up-to-date. For example, there is a technique described in Patent Document 1 for maintaining and managing the black list.

JP 2012-118713 A

  However, in the conventional malware analysis, the main purpose is to examine the behavior of the malware, and the acquisition of a malicious URL is incidental. For example, in conventional malware analysis, a signature that identifies malware is created from its behavior, the malware is detected using the created signature, and the malware is operated and connected to the actual attacker server. The following new malware is mainly obtained from the communication.

  For this reason, even if the technology for keeping the latest black list is used, the amount of the black list of malicious URLs is not sufficient in the first place, and the service using the black list, for example, the user When applied to a service that allows browsing safely without connecting to a malicious URL, it is insufficient to protect the user.

  The present invention has been made in view of the above points, and an object of the present invention is to provide a technique that can quickly acquire a large amount of malware connection destination information such as URLs of harmful servers.

In order to solve the above-described problem, the present invention is a connection destination information extraction device that includes a communication function for communicating with an external server via a network, and is disconnected from the network.
Software execution means for executing the software;
A communication observation means for observing a connection operation to an external server by the software executed by the software execution means, and acquiring a communication log related to the connection operation;
Connection destination information extracting means for extracting connection destination information of the software from the communication log acquired by the communication observation means and storing the connection destination information in the connection destination information storage means Configured as an information extraction device.

  In the communication log acquired by the communication observation means, for example, by analyzing in an environment where a response to the connection communication to the external server by the software does not reach, the software is reconnected to other external servers one after another. Contains a log of communications resulting from attempts.

  In addition, the connection destination information extraction device includes a pseudo response unit that receives connection communication from the software to an external server and returns a pseudo error response, or is connected to the pseudo response unit. In that case, in the communication log acquired by the communication observation unit, the software is transferred to another external server due to an error response by the pseudo response unit to the connection communication to the external server by the software. Contains a log of communication due to reconnection attempts.

  The connection destination information extraction unit may store the connection destination information extracted from the communication log in the connection destination information storage unit as connection destination information constituting a black list. The software is malware, for example.

  The connection destination information extracting unit may determine the malicious URL type of the connection destination information based on an extension of a file name described in a URL that is the connection destination information.

  The present invention can also be configured as a connection destination information extraction method that is executed by a connection destination information extraction apparatus that includes a communication function for communicating with an external server via a network and is disconnected from the network. . In addition, the present invention provides a computer having a communication function for communicating with an external server via a network and software execution means for executing software, wherein the computer disconnected from the network is connected to the connection destination information extracting device. It is also possible to configure as a connection destination information extraction program for functioning as the communication observation means and the connection destination information extraction means.

  According to the present invention, it is possible to quickly acquire a large amount of malware connection destination information such as URLs of harmful servers.

It is a figure for demonstrating the outline | summary of embodiment of this invention. It is a figure which shows the function structural example 1 of the black list extraction apparatus. It is a figure which shows the function structural example 2 of a black list extraction apparatus. FIG. 10 is a diagram for explaining an operation outline in a functional configuration example 2; It is a figure for demonstrating the example of analysis of URL.

  Embodiments of the present invention will be described below with reference to the drawings. The embodiment described below is only an example, and the embodiment to which the present invention is applied is not limited to the following embodiment. For example, in the present embodiment, malware connection destination information is acquired as connection destination information constituting a blacklist, but target software for extracting connection destination information is not limited to malware. For example, by using the technology of the present embodiment, connection destination information of software other than malware having the characteristic of connecting to various servers on the network may be acquired and used as a list (eg, white list, black list). .

(Outline of the embodiment)
In recent years, an increasing number of specific types of malware often have a large number of servers from which attacks start. In the present embodiment, such malware characteristics are used, the malware communication is failed, the connection destination of the malware is monitored by prompting reconnection, and the address of the connection destination server (= malignant URL) is set. We are going to extract it. Note that acquiring the URL as the address of the connection destination server is merely an example, and any information may be acquired as long as the information identifies the connection destination server. For example, an IP address may be used.

  The outline of the present embodiment will be described with reference to FIG. FIG. 1 shows a black list extraction device 10 that executes malware and a plurality of servers (for example, a C & C server and a download server) to which the black list extraction device 10 tries to connect by executing malware. However, the blacklist extraction device 10 is not connected to the network (the Internet in the present embodiment) and is blocked, and cannot communicate with the server.

  In such an environment, the black list extraction apparatus 10 executes malware. Then, the malware first tries to connect to the server 1, but since the network is not connected, this communication fails and the malware cannot receive the response from the server 1. That is, there is no response. Since the connection to the server 1 has failed, the malware tries to connect to the server 2 different from the server 1, but this connection also fails, and then tries to connect to the server 3. The blacklist extraction device 10 observes such malware communication operations, extracts connection destination URLs (URLs of servers 1, 2, and 3 in the example of FIG. 1), and stores them in storage means (memory or the like). The stored list of connection destination URLs is output to the outside as a black list, for example.

  Hereinafter, an example of a functional configuration of the black list extraction apparatus 10 will be described in more detail.

(Function configuration example 1)
FIG. 2 shows a functional configuration example 1 of the blacklist extraction apparatus 10 according to the present embodiment. The blacklist extraction apparatus 10 is realized by a computer having a communication function, and FIG. 2 shows a functional configuration related to the present embodiment inside the computer.

  As shown in FIG. 2, the blacklist extraction device 10 according to this example includes a malware execution unit 11, a communication function unit 12, a communication observation unit 13, a connection destination information extraction unit 14, a blacklist storage unit 15, and an output unit 16. Prepare.

  The malware execution unit 11 is a functional unit that executes malware (program). The malware execution unit 11 is, for example, a virtualization environment realized by virtualization software so that it can be easily returned to the original state after the execution of the malware. Further, in this virtual environment, an application having a vulnerability (for example, an old version browser) is installed so that the malware operates normally. However, the malware execution unit 11 is not limited to this, and may be a functional unit that can execute malware.

  When malware is executed in the malware execution unit 11, it tries to connect to a download server, a C & C server, etc. by the function of the malware. Since the basis of the operation is malware, the communication when the malware is executed is described below. The subject of the operation is “malware”.

  The communication function unit 12 is a function unit for performing communication with the Internet, and includes, for example, TCP / IP software, software such as a LAN driver, and hardware such as a LAN-IF. In this embodiment, a line to the Internet is not connected, but the communication function unit 12 (which may be referred to as a communication interface) is normal and can normally communicate with the Internet if the line is connected. It has become.

  The communication observation unit 13 is a functional unit that observes the connection operation of the malware executed by the malware execution unit 11 to an external server, acquires a communication log, and stores the communication log in the communication log storage unit 131 including a memory or the like. The connection destination information extraction unit 14 is a functional unit that extracts connection destination information from the communication log acquired by the communication observation unit 13 and stores the connection destination information in the black list storage unit 15 as connection destination information constituting the black list. The output unit 16 is a functional unit that outputs (eg, displays) the blacklist stored in the blacklist storage unit 15. The output unit 16 can also perform an operation of displaying the communication log observed in the communication observation unit 13 in real time.

  The operation of the blacklist extraction apparatus 10 having the above-described functional configuration is as follows.

  First, for example, malware (specimen) collected by a honeypot is input to the malware execution unit 11 to cause the malware execution unit 11 to execute the malware.

  As shown in FIG. 1, the malware executed in the malware execution unit 11 tries to communicate with a certain server, but the line connecting the black list extraction device 10 and the Internet is disconnected. No response from the server, no response. The malware then times out the connection and connects to the next server, which is also unresponsive.

  Such operation is repeatedly performed by the malware, the communication observation unit 13 observes the communication operation of the malware, and the communication log is stored in the communication log storage unit 131. Here, the protocol or layer observed by the communication observation unit 13 is not particularly limited as long as the connection destination can be determined. In this embodiment, for example, HTTP protocol communication, IP protocol communication, and the like are observed. And get the log. For example, a protocol such as SMTP may be observed.

  The connection destination information extraction unit 14 extracts malware connection destination information from the communication log acquired by the communication observation unit 13 and stored in the communication log storage unit 131. This extraction may be performed in real time every time the communication log is stored in the communication log storage unit 131, or may be performed after the malware reconnection operation ends. However, it is better to perform in real time from the viewpoint of shortening the analysis time.

  The information extracted by the connection destination information extraction unit 14 is information such as an address of a destination with which the malware communicates and / or information that is intended to be transmitted to the destination. Specifically, for example, an IP address, a port number, URL, URL parameter, payload, etc. Which information is extracted from these information can be changed by setting. For example, by setting (instructing) the connection destination information extraction unit 14 so as to extract a set of URL, URL parameters, and payload, the connection destination information extraction unit 14 is able to connect to the URL of the server to which the malware tried to connect. And its URL parameter and payload are extracted. The extracted information is stored in the black list storage unit 15.

  When the analysis (connection destination information extraction) is performed in real time by the connection destination information extraction unit 14 as described above, the analysis (connection destination information extraction) may be terminated when the attempt to reconnect the malware is stopped. Specifically, for example, the connection destination information extraction unit 14 determines from the communication log storage state that there is no reconnection due to malware for a certain time or more, and ends the analysis in that case. In addition, the connection destination information extraction unit 14 may include a timer, and the analysis may be terminated when a predetermined upper limit time for analysis per specimen is reached. Further, the connection destination information extraction unit 14 ends the analysis when it is determined that the connection destination has completed a cycle by analyzing the communication log (for example, when the connection destination matches the first connection destination). May be.

  The communication observation unit 13 and the connection destination information extraction unit 14 in the black list extraction device 10 of this example are connected to a computer (including the malware execution unit 11 and the communication function unit 12) used as the black list extraction device 10 according to the present embodiment. This can be realized by executing a program describing the processing contents of the communication observation unit 13 and the connection destination information extraction unit 14 described in the embodiment. That is, the communication observation unit 13 and the connection destination information extraction unit 14 execute programs corresponding to the processes executed in the respective units using hardware resources such as a CPU, a memory, and a hard disk built in the computer. It is possible to realize. The above-mentioned program can be recorded on a computer-readable recording medium (portable memory or the like), stored, or distributed. It is also possible to provide the program through a network such as the Internet or electronic mail.

  In addition, each functional unit in the black list extraction device 10 of this example may be divided into a plurality of devices.

(Function configuration example 2)
FIG. 3 shows a functional configuration example 2 of the blacklist extraction apparatus 10 according to the present embodiment. As shown in FIG. 3, the black list extraction apparatus 10 of this example is obtained by adding a pseudo response function unit 17 to the black list extraction apparatus 10 shown in FIG. The functional units other than the pseudo response functional unit 17 are the same as those shown in FIG.

  The pseudo response function unit 17 is a function unit realized by software that receives connection communication from malware and returns a response to the malware in a pseudo manner. This response is a response such as an error that prompts the malware to reconnect. As in the case of the functional configuration example 1, the pseudo response function unit 17 can cause the malware to reconnect and collect connection destination information.

  Rather than using the pseudo-response function unit 17 to perform a pseudo-response, it is easier to generate reconnection communication to another server due to malware, as in the functional configuration example 1, with no response.

  As shown in FIG. 3, the pseudo response function unit 17 is provided as software in the black list extraction device, and is also provided outside the black list extraction device 10 and connected to the black list extraction device 10 (computer). It may be.

  FIG. 4 shows an operation example in this example. In FIG. 4, the pseudo response unit 17 is shown outside the blacklist extraction apparatus 10, but this is for convenience in explaining the operation. As shown in FIG. 4, the malware connects to the server 1, but the malware responds to the pseudo response unit 17 so that the malware connects to another server 2. Again, by returning an error, the malware connects to another server 3. As in the case of the apparatus configuration example 1, such communication operation is observed by the communication observation unit 13 to acquire a communication log, and the connection destination information extraction unit 14 extracts connection destination information from the communication log.

  Note that the pseudo response unit 17 may perform an operation of searching for an optimal response (whether no response is made or a pseudo error response is returned). For example, the pseudo-response unit 17 has a time (X seconds) from connection to reconnection when there is no response at the initial stage of malware operation, and a time (Y seconds) from connection to error response to reconnection. ), And if X> Y, the analysis can be speeded up by sending an error response to the malware. A response may be used.

  The communication observation unit 13, the connection destination information extraction unit 14, and the pseudo response function unit 17 in the black list extraction device 10 of this example include a computer (including the malware execution unit 11 and the communication function unit 12) used as the black list extraction device 10. ) Can be realized by executing a program describing the processing contents of the communication observation unit 13, the connection destination information extraction unit 14, and the pseudo response function unit 17 described in this embodiment. That is, the communication observation unit 13, the connection destination information extraction unit 14, and the pseudo response function unit 17 correspond to processing performed in each unit using hardware resources such as a CPU, a memory, and a hard disk built in the computer. It can be realized by executing a program. The above-mentioned program can be recorded on a computer-readable recording medium (portable memory or the like), stored, or distributed. It is also possible to provide the program through a network such as the Internet or electronic mail.

  In addition, each functional unit in the black list extraction device 10 of this example may be divided into a plurality of devices.

(Example of analysis by connection destination information extraction unit 14)
The connection destination information extraction unit 14 includes not only a function of extracting designated connection destination information from the communication log but also an analysis function related to determining whether a URL is a malicious URL as follows. Good.

  In the present embodiment, the connection destination information extraction unit 14 is based on the communication log (URL, URL parameter, payload, etc.), and connects to the connection destination information (URL character string) at a plurality of connection destinations (communication to a plurality of domains) by malware. And the like, the similarity between the types of malicious URLs (malignant types) and the connection destination information is determined, and the determination results are stored in the blacklist storage unit 15.

  For example, it is assumed that the URL (+ URL parameter) shown in FIG. 5A exists in the URL extracted from the communication log. At this time, the connection destination information extraction unit 14 identifies “hoge.pl?action=1” in these URL character strings. Then, the connection destination information extraction unit 14 determines that the URL specifying the script in this way is an attack URL that causes the server to perform some action (attack). Since there are two “hoge.pl?action=1”, the number of similarities between these URLs is calculated as 2, for example, for each of the URLs shown in FIG. 2 ”is output to the black list storage unit 15.

  Further, for example, it is assumed that the URL shown in FIG. 5B exists in the URL extracted from the communication log. At this time, the connection destination information extraction unit 14 identifies “xxx.exe” in these URL character strings. Then, the connection destination information extraction unit 14 determines that the URL in which the exe file name is described in this way is a malware distribution URL for distributing malware. Also, since there are two “xxx.exe”, the number of similarities is calculated to be 2, for example, for each of the URLs shown in FIG. 5B, the URL and “malware distribution URL, number of similarities 2” are output. To do.

  In this example, the URL attribute is determined by the extension of the file name described in the URL. If exe, zip, etc., it is determined as a malware distribution URL, and if a script or argument is specified, it is an attack URL Although it is determined, this is only an example, and the determination method is not limited to this.

  Further, the number of similarities may be output as it is, or only URLs corresponding to the number of similarities equal to or greater than a predetermined threshold may be output to the blacklist storage unit 15 as malignant URLs. Further, URLs having a similarity number equal to or less than a predetermined value or having a similarity number of 1 may be excluded from malignant URLs (not stored in the blacklist storage unit 15).

  When there is a white list or the like (stored in the storage means in the connection destination information extraction unit 14), the connection destination information extraction unit 14 compares the extracted URL with the list, excludes the normal site, URLs not corresponding to the above may be stored in the blacklist storage unit 15. For example, normal sites that are generally accessed frequently may be registered in a list (white list), and URLs in the list may be excluded from malicious URLs.

  Note that it is also possible to directly determine whether or not the extracted URL is malicious using existing technology. As such an existing technology, for example, a technology that determines whether a URL is malicious by using a client-type honeypot technology and observing the behavior by accessing the URL with a weak browser in a virtual environment. There is.

(Blacklist operation example)
By applying the blacklist acquired using the technology according to the present embodiment to, for example, a device between the user terminal and the server, the communication between the user terminal and the server is monitored in real time, and a warning or blocking is performed. It becomes possible.

  Further, the user terminal may be provided with a black list, and the communication between the user terminal and the server may be monitored in real time at the user terminal, and a warning or interruption may be performed.

  In the black list, attribute information may be added in addition to the malicious URL. The attribute information includes, for example, the date and time when it was last determined to be malignant, and the type of malignant URL (eg, origin URL, attack URL, malware distribution URL, C & C server URL, etc.). Moreover, it is good also as changing a black list according to a use, such as for users and for companies. Further, the black list may be updated as appropriate so as to keep the latest state.

(Summary of the embodiment, effects, etc.)
As described so far, in this embodiment, in the environment where there is no connection to the Internet, malware is executed in the blacklist extraction device, communication generated by the malware is observed, connection destinations are extracted, and the blacklist is output. It is said. Some malware has many entrance C & C servers and download servers that are the starting points of attacks, and by observing communication to the next server by failing communication by the malware as in this embodiment, Potential malicious URLs (malicious addresses) on the Internet can be collected, and the black list of malicious URLs can be expanded.

  The number of types of malware has become enormous, and using static analysis that performs analysis by reverse engineering, etc., and conventional dynamic analysis that focuses on the behavior of malware, it is sufficient for each malware quickly. It is difficult to create a black list consisting of a large amount of malicious URLs. On the other hand, by using the technique according to the present embodiment, it is possible to quickly create a black list including a large number of malicious URLs.

  In other words, according to the present embodiment, the amount of malicious URLs in the black list can be increased, and the accuracy of commercial services using the black list can be improved.

  The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

10 Blacklist extraction device 11 Malware execution unit,
12 Communication Function Unit 13 Communication Observation Unit 131 Communication Log Storage Unit 14 Connection Destination Information Extraction Unit 15 Black List Storage Unit 16 Output Unit 17 Pseudo Response Function Unit

Claims (8)

A connection destination information extraction device having a communication function for communicating with an external server via a network, and being disconnected from the network,
Software execution means for executing the software;
A communication observation means for observing a connection operation to an external server by the software executed by the software execution means, and acquiring a communication log related to the connection operation;
Connection destination information extracting means for extracting the connection destination information of the software from the communication log acquired by the communication observation means and storing the connection destination information in the connection destination information storage means Information extraction device. The communication log acquired by the communication observing means includes a communication log when the software tries to reconnect to another external server due to no response to the connection communication to the external server by the software. The connection destination information extracting device according to claim 1, wherein: The connection destination information extracting device includes a pseudo response unit that receives connection communication from the software to an external server and returns a pseudo error response, or is connected to the pseudo response unit,
In the communication log acquired by the communication observation unit, communication caused by the software attempting to reconnect to another external server due to an error response by the pseudo response unit with respect to connection communication to the external server by the software The connection destination information extracting device according to claim 1, wherein: 4. The connection destination information extracting unit stores the connection destination information extracted from the communication log in the connection destination information storage unit as connection destination information constituting a black list. The connection destination information extraction device according to claim 1.   The connection information extracting apparatus according to claim 1, wherein the software is malware. The connection destination information extraction unit determines a malignant type of the connection destination information based on an extension of a file name described in a URL that is the connection destination information. Connection destination information extraction device. A connection destination information extraction method executed by a connection destination information extraction device having a communication function for communicating with an external server via a network, and being disconnected from the network,
A software execution step for executing the software;
A communication observation step of observing a connection operation to an external server by the software executed by the software execution step, and acquiring a communication log related to the connection operation;
A connection destination information extracting step of extracting connection destination information of the software from the communication log acquired in the communication observation step, and storing the connection destination information in a connection destination information storage unit; Information extraction method.   7. A computer comprising a communication function for communicating with an external server via a network and software execution means for executing software, the computer being disconnected from the network, according to any one of claims 1 to 6. A connection destination information extracting program for causing the communication observing means and the connection destination information extracting means to function in the connection destination information extracting apparatus.

Images