JP2014211733A - Monitoring device, monitoring method, and monitoring program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To dynamically analyze a large number of malware with limited computer resources.SOLUTION: A monitoring device performs time-division dynamic analysis to malware, and records an operation record of the malware. The monitoring device refers to the operation record, and determines the malware to be subjected to consecutive dynamic analysis when the malware establishes communication with any host on a network within a predetermined period. Upon determination that the malware has not established communication with any host on the network within the predetermined period, the malware is determined to be subjected to the time-division dynamic analysis.

Description

  The present invention relates to a program monitoring apparatus, a monitoring method, and a monitoring program.

  In recent years, fraudulent programs (hereinafter referred to as “malware”) that cause threats such as information leakage and unauthorized access are gaining in popularity. Recent malware receives commands from attackers via a C & C (Command and Control) server and causes damage such as attacks on other servers and information leakage. Further, when attempting to provide a new attack function for the once infected malware, the attacker causes the infected terminal to connect to the malware download site and infect the new malware. What command is sent from the C & C server and what kind of malware is installed from the malware download site varies depending on the intention of the attacker.

  In order to quickly grasp such a threat that changes depending on the intention of the attacker, it is effective to continuously monitor the attacker site such as the C & C server and the malware download site. Through continuous monitoring, it is possible to know when and what commands have been sent, and what functions are being added to the malware.

  When continuously monitoring the attacker site, create a program that simulates malware communication, and use it to monitor communication with the attacker site (Non-patent Document 1) or to actually operate the malware. There is a technique (dynamic analysis) for monitoring communication with an attacker site (Patent Document 1). Since the method of Non-Patent Document 1 needs to completely simulate malware communication, detailed analysis of the malware itself is required. However, as described in Non-Patent Document 2, the currently confirmed malware is extremely large, and it is difficult to analyze all of them in detail. Therefore, the monitoring method using dynamic analysis is effective from the viewpoint of easy and fast analysis.

Japanese Patent No. 4755658

Catching Malware -Detecting, Tracking, and Mitigating Botnets-, Georg Wicherski and Thorsten Holz, Black Hat Japan 2006 Briefings. McAfee Threats Report: Third Quarter 2012

  However, in the above-described conventional technology, it is necessary to prepare an environment for actually operating the malware. Therefore, it is difficult to analyze a large number of malware simultaneously and continuously due to the convenience of computer resources. there were.

  Specifically, when operating a piece of malware on an OS (Operating System) installed on hardware, hardware for continuous analysis must be prepared for the number of malware to be analyzed. In addition, when multiple virtual OSs are operated on a single hardware using a virtual environment, many malwares can be analyzed simultaneously at the same time as compared to operating on an OS installed on hardware. Since the number of virtual OSs that can operate on one piece of hardware is limited, the number of malware that can be analyzed simultaneously is limited.

  Therefore, an object of the present invention is to provide an apparatus, a method, and a program that can solve the above-described problems and can operate a plurality of malware and monitor communication even when computer resources are limited.

  In order to solve the above-described problems and achieve the object, the present invention is a monitoring device that operates a program and monitors communication by the program, and refers to an operation record of the program, When it is determined that communication with any host on the network has been performed within a predetermined period, it is determined that the program is to be continuously operated, and any host on the network is within the predetermined period. When it is determined that communication has not been performed, a continuation determination unit that determines to operate at a predetermined time and a program that is determined to operate continuously are continuously operated, and the operation of the program is A continuous dynamic analysis unit for recording in the operation record, and a program determined to be operated at the predetermined time It is operated to and the monitoring apparatus characterized by comprising a dividing dynamic analysis unit when recording operation of the program in the operation recording.

  According to the present invention, even when computer resources are limited, it is possible to operate a plurality of malware and monitor communication.

FIG. 1 is a diagram for explaining an overview of processing of the monitoring apparatus. FIG. 2 is a configuration diagram of the monitoring apparatus. FIG. 3 is a diagram illustrating an example of analysis information. FIG. 4 is a flowchart showing the time division dynamic analysis control process. FIG. 5 is a flowchart showing the time division dynamic analysis process. FIG. 6 is a flowchart showing the continuous dynamic analysis determination process. FIG. 7 is a flowchart showing the continuous dynamic analysis control process. FIG. 8 is a flowchart showing the continuous dynamic analysis process. FIG. 9 is a flowchart showing continuous dynamic analysis continuation determination processing. FIG. 10 is a diagram illustrating a computer that executes a monitoring program.

  Embodiments of the monitoring device of the present invention will be described below with reference to the drawings. The present invention is not limited to the following embodiments. In the following description, malware analysis means, for example, that a monitoring device operates malware to monitor communication with a communication destination (host computer such as an attacker site) by the malware. In addition to monitoring the communication with the communication destination by the malware, this malware analysis includes machine language executed when the malware operates on the OS, an API (Application Programming Interface) to be called, and a memory area to be read and written Monitoring may also be included. Furthermore, although the monitoring target of the monitoring device is malware here, it may be a program other than malware.

(Overview)
First, the outline of the processing of the monitoring apparatus according to the present embodiment will be described with reference to FIG. FIG. 1 is a diagram for explaining an overview of processing of the monitoring apparatus.

  The monitoring device 10 (see FIG. 2) stores a plurality of malware, and analyzes each malware based on the schedule indicated in the analysis information 112 (analyzes in a time division manner). And the monitoring apparatus 10 determines whether the said malware will be analyzed by a time division from now on, or will be analyzed continuously (continuously analyzed) based on the analysis result of each malware.

  For example, if the monitoring device 10 has not communicated with the host on the network for a predetermined time or more with respect to the malware, the monitoring device 10 determines that the malware will be analyzed in a time division manner in the future. On the other hand, when communication with a host on the network is detected for a predetermined time for the malware, the monitoring device 10 determines that the malware will be continuously analyzed in the future.

  Further, as shown in FIG. 1A, when the monitoring apparatus 10 analyzes again about the malware determined to be continuously analyzed, if there is no communication with the host on the Internet for a predetermined time or more, the malware Is determined to be analyzed in a time-sharing manner. On the other hand, as a result of the analysis being performed again, if there is communication with a host on the Internet within a predetermined time, it is determined that the malware is continuously analyzed. In other words, the monitoring device 10 also returns the malware once determined to be continuously analyzed to the time-division analysis target or based on the subsequent analysis result. In addition, as shown in FIG. 1 (b), the monitoring device 10 can continue to analyze the malware once determined to be analyzed in time division based on the subsequent analysis results. Or subject to analysis.

  As described above, the monitoring device 10 continuously analyzes the malware whose communication with the host on the network is detected as a result of the analysis of the malware, but analyzes the other malware in a time division manner. Accordingly, the monitoring device 10 can effectively use computer resources (CPU, memory, etc.) used for analyzing malware. That is, even when the computer resources of the monitoring device 10 are limited, a large number of malware can be analyzed.

(Constitution)
FIG. 2 is a configuration diagram of the monitoring apparatus. The monitoring device 10 includes a storage unit 11, a control unit 12, and a communication I / F (interface) unit 13, and is communicably connected to a host computer (host) via a network. This network is the Internet, a LAN (Local Area Network), or the like.

  The storage unit 11 includes a malware storage unit 111 and includes an area for storing analysis information 112 and an analysis result (malware operation record) 113.

  The malware storage unit 111 stores malware to be analyzed by the monitoring device 10. The analysis information 112 is information indicating an analysis schedule for each malware.

  For example, as shown in FIG. 3, the analysis information 112 indicates the malware analysis start time, the analysis end time, and the ID of the malware executed between the analysis start time and the analysis end time. This analysis information 112 is referred to when the time division dynamic analysis unit 121 described later analyzes malware. In the analysis information 112, the time for performing the analysis may be used instead of the analysis end time.

  The analysis result 113 in FIG. 2 is information indicating the analysis result of each malware by the monitoring device 10. This analysis result 113 shows the address of the communication destination (host) by the execution of the malware, the communication time with the communication destination, the communication content, and the like. The analysis result 113 is added and updated when each unit of the control unit 12 analyzes malware.

  The control unit 12 controls the entire monitoring apparatus 10, and here, mainly determines whether to continuously analyze each malware, and continuously analyzes the malware determined to be continuously analyzed. . On the other hand, malware that is determined not to be continuously analyzed is analyzed in a time-sharing manner. The control unit 12 includes a time division dynamic analysis unit 121, a continuous dynamic analysis unit 122, and an analysis management unit 123.

  The time division dynamic analysis unit 121 performs time division dynamic analysis on the malware. That is, the time division dynamic analysis unit 121 performs analysis by operating each malware at the time specified in the analysis information 112. Then, the time division dynamic analysis unit 121 writes the result of malware analysis in the analysis result 113.

  The continuous dynamic analysis unit 122 performs continuous dynamic analysis on the malware instructed by the continuous dynamic analysis control unit 125 (described later). That is, the continuous dynamic analysis unit 122 performs analysis by continuously operating the malware instructed by the continuous dynamic analysis control unit 125. Then, the continuous dynamic analysis unit 122 writes the result of malware analysis in the analysis result 113.

  Each of the time division dynamic analysis unit 121 and the continuous dynamic analysis unit 122 performs communication control with a malware execution unit 127 that actually operates malware and a host (communication destination) on the network by the malware execution unit 127. And an external communication control unit 128.

  The analysis management unit 123 includes a time division dynamic analysis control unit 124 that controls the time division dynamic analysis unit 121, a continuous dynamic analysis control unit 125 that controls the continuous dynamic analysis unit 122, and a continuation determination unit 126. Prepare.

  When the time division dynamic analysis control unit 124 acquires the malware from the malware storage unit 111, the time division dynamic analysis control unit 124 transfers the acquired malware and the analysis information 112 to the time division dynamic analysis unit 121. As a result, the time division dynamic analysis unit 121 instructs the malware indicated in the analysis information 112 to be analyzed according to the schedule indicated in the analysis information 112.

  The continuous dynamic analysis control unit 125 causes the continuous dynamic analysis unit 122 to execute continuous dynamic analysis of malware based on an instruction from the continuation determination unit 126. When the continuous dynamic analysis control unit 125 receives an instruction from the continuation determination unit 126 to execute the continuous dynamic analysis of the malware, the continuous dynamic analysis control unit 125 deletes the malware ID from the analysis information 112. As a result, the malware is excluded from the target of the time division dynamic analysis by the time division dynamic analysis unit 121.

  The continuation determination unit 126 determines whether or not the malware is to be subjected to continuous dynamic analysis after the malware is analyzed by the continuous dynamic analysis unit 122 or the time division dynamic analysis unit 121. For example, after a predetermined time has elapsed since the analysis of malware by the continuous dynamic analysis unit 122 or the time division dynamic analysis unit 121, the continuation determination unit 126 confirms the operation record of the malware in the analysis information 112. Then, when the continuation determination unit 126 detects communication with any of the hosts from the operation record of the malware, the continuation determination unit 126 determines that the malware is a target of continuous dynamic analysis. Then, the continuation determination unit 126 instructs the continuous dynamic analysis control unit 125 to perform continuous dynamic analysis of the malware. On the other hand, after a predetermined time has elapsed since the analysis of the malware by the continuous dynamic analysis unit 122 or the time division dynamic analysis unit 121, the continuation determination unit 126 confirms the operation record of the malware in the analysis information 112, and performs communication by the malware Is not detected, it is determined that the malware is a target of time-division dynamic analysis. Then, the continuation determination unit 126 adds the malware ID to the percent analysis information 112. Thereby, the time division dynamic analysis unit 121 performs the time division dynamic analysis on the malware.

  The communication I / F (interface) unit 13 is an interface used when each unit of the control unit 12 communicates with a host on the network, and is, for example, a network interface card.

(Processing procedure)
Next, the processing procedure of the monitoring apparatus 10 will be described. First, the processing procedure of the time division dynamic analysis control unit 124 will be described. FIG. 4 is a flowchart showing the time division dynamic analysis control process.

  The time division dynamic analysis control unit 124 acquires malware from the malware storage unit 111 (S1), and divides the acquired malware into a predetermined number of sets (S2). The divided malware set is stored in, for example, a main memory (not shown) of the storage unit 11. The time division dynamic analysis control unit 124 sets an ID for each malware when dividing the malware so that the analysis information 112 can be matched.

  Thereafter, the time division dynamic analysis control unit 124 transfers the malware set and the analysis information 112 to the time division dynamic analysis unit 121 (S3), and the time division dynamic analysis unit 121 A time-division dynamic analysis process based on the analysis information 112 is executed (S4). Thereafter, the continuation determination unit 126 determines whether or not the malware analyzed in S4 is a target of continuous dynamic analysis processing (S5: continuous dynamic analysis determination processing). Then, the continuous dynamic analysis control unit 125 instructs the continuous dynamic analysis unit 122 to analyze the malware determined to be the target of the continuous dynamic analysis process by the continuation determination unit 126 (S6: continuous dynamic analysis control process). ).

  After S6, if the analysis is complete (Yes in S7), the process is terminated. If the analysis is not yet complete (No in S7), the process returns to S4. The end of the analysis may be when an instruction to end the analysis is input to the monitoring device 10 or when a predetermined time has elapsed since the start of the analysis of the malware.

  Next, the time division dynamic analysis process (S4) of FIG. 4 will be described in detail with reference to FIG. FIG. 5 is a flowchart showing the time division dynamic analysis process.

  The time division dynamic analysis unit 121 confirms whether or not the current time is the analysis start time indicated in the analysis information 112 (S51), and confirms that the current time is the analysis start time (Yes in S51), The malware having the malware ID assigned at the analysis start time is taken out from the main memory of the storage unit 11 (S52). Then, the time division dynamic analysis unit 121 causes the malware execution unit 127 to execute the extracted malware. On the other hand, if it is not yet the analysis start time (No in S51), the process returns to S51. When using a virtual machine for the malware execution unit 127, the malware execution unit 127 operates as a virtual OS. Then, the time division dynamic analysis unit 121 causes one malware execution unit (virtual OS) 127 to execute one of the extracted malware.

  After S52, the time division dynamic analysis unit 121 checks whether or not there is a malware execution unit 127 that has executed the extracted malware in the past (S53). Here, if there is a malware execution unit 127 that executed the malware in the past (Yes in S53), the time-division dynamic analysis unit 121 starts and starts the malware execution unit 127 that executed the malware in the past. The malware execution unit 127 is caused to execute the malware (S54).

  On the other hand, when the malware execution unit 127 that executed the malware does not exist (No in S53), the time division dynamic analysis unit 121 activates one of the malware execution units 127, and the malware execution unit 127 executes the malware. And execute it (S55). Then, the time division dynamic analysis unit 121 writes the execution result (operation result) of the malware in S54 and S55 in the analysis result 113.

  After S54 and S55, when the time division dynamic analysis unit 121 determines that all of the malware assigned to the analysis start time is extracted in the analysis information 112 (Yes in S56), the analysis end time indicated by the analysis information 112 is reached. Wait (S57). On the other hand, if there is malware that has not yet been taken out of the malware assigned to the analysis start time in the analysis information 112 (No in S56), the process returns to S52.

  After S57, the time division dynamic analysis unit 121 terminates the activated malware execution unit 127 when the analysis end time is reached (S58). Then, the time division dynamic analysis process is terminated. The termination of the malware execution unit 127 may be a normal OS shutdown process, or may be a virtual OS suspend process when a virtual machine is used.

  Next, the continuous dynamic analysis determination process (S5) in FIG. 4 will be described in detail with reference to FIG. FIG. 6 is a flowchart showing the continuous dynamic analysis determination process.

  First, the continuation determination unit 126 refers to the analysis result 113 to determine whether or not there is an analysis result for a period (for example, two days) necessary for performing the determination of continuous dynamic analysis (S61). . For example, the continuation determination unit 126 determines whether or not the analysis result 113 includes two days of analysis results regarding the malware to be determined. Here, when there is an analysis result for a necessary period (Yes in S61), the continuation determination unit 126 determines whether or not each malware is a target of continuous dynamic analysis, for example, by the following processing. On the other hand, if there is no analysis result for the necessary period yet (No in S61), the process proceeds to S67.

  For example, the continuation determination unit 126 determines whether or not communication with any host on the network occurs due to malware within a specified period (for example, within a predetermined period of the above two days) (S62). Whether the host that communicated within the specified period is a host that the malware has not communicated with in the past (S63), and whether a response has been obtained from a host on the network within the specified period (S64) It is determined whether the response acquired from the host on the network within the designated period is a response that the malware has not acquired in the past (S65).

  Then, when all of S62 to S65 are Yes, the continuation determination unit 126 sets the malware as a target of continuous dynamic analysis (S66). In other words, the continuation determination unit 126 is a host in which communication to a host on the network by malware occurs within a specified period (Yes in S62), and the host has not communicated with the malware in the past. (Yes in S63), and when a response is acquired from the host (Yes in S64) and the response is a response that the malware has not acquired in the past (Yes in S65), the malware is Judged as the target of continuous dynamic analysis Then, the continuation determination unit 126 deletes from the analysis information 112 the malware ID determined to be the target of continuous dynamic analysis. As a result, the malware is excluded from the processing target of the time division dynamic analysis. Then, the process proceeds to S67.

  If the answer is No in any of S62 to S65, S66 is skipped and the process proceeds to S67. That is, the malware that is No in any of S62 to S65 is continuously subjected to time division dynamic analysis. In S67, when the continuation determination unit 126 confirms that the determinations in S62 to S65 have been performed on all malware that has been subjected to the time-division dynamic analysis (Yes in S67), the continuous dynamic analysis determination process ends. . On the other hand, if there is any malware that has not yet performed the determination of S62 to S65 (No in S67), the process returns to S61.

  The continuation determination unit 126 may perform the continuous dynamic analysis determination process by any one or a combination of the determination processes of S62 to S65. Further, in the continuous dynamic analysis determination process, an ID of malware determined to be a target of continuous dynamic analysis may be stored in the main memory or the like of the storage unit 11. And when the continuous dynamic analysis control part 125 specifies the malware which should be the object of the present continuous dynamic analysis now, you may make it refer to ID of the malware recorded on this main memory.

  By doing in this way, the monitoring apparatus 10 makes the subject of continuous dynamic analysis about the malware which communicated with the host on the network within a predetermined period, and time division dynamic analysis about the other malware. Can be the target of.

  Next, the continuous dynamic analysis control process (S6) of FIG. 4 will be described in detail with reference to FIG. FIG. 7 is a flowchart showing the continuous dynamic analysis control process.

  The continuous dynamic analysis control unit 125, when there is malware that performs continuous dynamic analysis (malware determined as a continuous dynamic analysis target by the continuous determination unit 126) (Yes in S71), the continuous dynamic analysis unit 122. The continuous dynamic analysis process of the malware is executed (S72). On the other hand, if there is no malware determined to perform the continuous dynamic analysis (No in S71), the continuous dynamic analysis control unit 125 ends the continuous dynamic analysis control process. If the analysis is finished after S72 (Yes in S73), the continuous dynamic analysis control process is finished. If the analysis is not finished yet (No in S73), the process returns to S72.

  Next, the continuous dynamic analysis process (S72) of FIG. 7 will be described in detail with reference to FIG. FIG. 8 is a flowchart showing the continuous dynamic analysis process.

  When the continuous dynamic analysis unit 122 acquires malware to be subjected to continuous dynamic analysis (S81), it confirms whether or not there is a malware execution unit 127 that executed the malware in the past (S81). S82).

  Here, if there is no malware execution unit 127 that executed the malware (No in S82), the continuous dynamic analysis unit 122 transfers the malware to the malware execution unit 127 for execution (S84). On the other hand, if the malware execution unit 127 that executed the malware exists (Yes in S82) and the malware execution unit 127 that executed the malware has already been started (Yes in S83), the process proceeds to S86. If the malware execution unit 127 that executed the malware has not yet started (No in S83), the continuous dynamic analysis unit 122 starts the malware execution unit 127 that executed the malware and causes the malware to be executed. (S85). Then, the time division dynamic analysis unit 121 writes the execution result (operation result) of the malware in S84 and S85 in the analysis result 113.

  After S84 and S85, if the continuous dynamic analysis unit 122 determines that all of the malware subject to continuous dynamic analysis has been executed (Yes in S86), after waiting for a predetermined time (S87), the continuous determination unit 126 performs continuous dynamic analysis. An analysis continuation determination process is performed (S88), and the continuous dynamic analysis process is terminated. On the other hand, if there is unexecuted malware among the malware subject to continuous dynamic analysis (No in S86), the process returns to S81.

  Next, the continuous dynamic analysis continuation determination process (S88) of FIG. 8 will be described in detail with reference to FIG. FIG. 9 is a flowchart showing continuous dynamic analysis continuation determination processing.

  First, the continuation determination unit 126 refers to the analysis result 113 in the same manner as S61 in FIG. 6, and the analysis result for a period (for example, two days) necessary for performing the determination of the continuous dynamic analysis of the malware is obtained. It is determined whether or not there is (S91). If there is an analysis result for a necessary period (Yes in S91), the process proceeds to S92. The continuation determination unit 126 determines whether or not each malware is continuously subjected to continuous dynamic analysis, for example, through the processing from S92. On the other hand, if there is no analysis result for the required period yet (No in S91), the process proceeds to S98.

  When the answer is YES in S91, the continuation determination unit 126 determines whether or not a predetermined period or more has elapsed since the last communication with the host on the network for the malware (S92), for example, within the specified period. The host that communicated is the host that the malware has not communicated with in the past (S93), and whether or not a response has been obtained from the host on the network within the specified period (S94). It is determined whether or not the response acquired from the host on the network within the period is a response that the malware has not acquired in the past (S95).

  When the answer is No in any of S92 to S95, the continuation determination unit 126 sets the malware out of the continuous dynamic analysis target (S96). That is, if the predetermined period has not yet elapsed since the last communication with the host on the network for the malware (No in S92), the continuation determination unit 126 determines that the host that communicated within the specified period is If the malware is a host that has communicated in the past (No in S93), or if a response has not been acquired from a host on the network within the specified period (No in S94), the network within the specified period If the response acquired from the upper host is a response that the malware has acquired in the past (No in S95), the malware is determined not to be subject to continuous dynamic analysis. That is, the continuation determination unit 126 determines the malware as a target of time-division dynamic analysis, and adds the malware ID to the analysis information 112. Thereby, the malware that was No in any of S92 to S95 becomes a target of time-division dynamic analysis. The continuation determination unit 126 terminates the malware execution unit 127b that was activated by the continuous dynamic analysis of the malware (S97). On the other hand, when all of S92 to S95 are YES, S96 and S97 are not executed, and the process proceeds to S98. That is, the continuation determination unit 126 continues the malware currently under continuous dynamic analysis as a target of continuous dynamic analysis.

  In S98, when the continuation determination unit 126 confirms that the determinations in S92 to S95 have been performed on all the malware under continuous dynamic analysis (Yes in S98), the continuous dynamic analysis continuation determination process ends. On the other hand, if there is any malware that has not yet performed the determination of S92 to S95 (No in S98), the process returns to S91.

  In addition, the continuation determination unit 126 may perform the continuous dynamic analysis continuation determination process by any one or a combination of the determination processes in S92 to S95.

  By doing in this way, the monitoring apparatus 10 can also return the malware once targeted for continuous dynamic analysis to the target of time-division dynamic analysis based on the analysis result of the subsequent malware. Therefore, the monitoring apparatus 10 can analyze malware by effectively using limited computer resources.

  In this embodiment, the malware set and the analysis information 112 are transferred from the time division dynamic analysis control unit 124 to the time division dynamic analysis unit 121. However, the present invention is not limited to this. For example, the time division dynamic analysis control unit 124 may control the execution of individual malware in the malware execution environment of the time division dynamic analysis unit 121 based on the analysis information 112.

  In the present embodiment, in the time division dynamic analysis process (see FIG. 5), if the time division dynamic analysis unit 121 has a malware execution unit 127 that executed the malware extracted in S52 in the past (S53). Yes), the malware execution unit 127 is caused to execute the malware. However, the present invention is not limited to this. For example, after the time division S52, the time division dynamic analysis unit 121 may restore the virtual OS image in the malware execution unit 127 to a state before the malware installation, and then execute the malware extracted in S52. .

  Also in the continuous dynamic analysis process (see FIG. 8), if there is a malware execution unit 127 in which the continuous dynamic analysis unit 122 has executed the malware acquired in S81 in the past (Yes in S82), the malware execution Although the malware extracted by the unit 127 is executed, the present invention is not limited to this. For example, after S81, the continuous dynamic analysis unit 122 may restore the virtual OS image in the malware execution unit 127 to a state before the malware installation, and then execute the malware acquired in S81.

  In this way, when analyzing the malware, the monitoring device 10 returns the malware execution unit 127 to the state before the malware infection and then infects the malware to analyze the malware. It is possible to analyze the behavior when infected with.

  It is also possible to create a program in which the processing executed by the monitoring apparatus 10 described in the above-described embodiment is described in a language that can be executed by a computer. For example, a monitoring program in which processing executed by the monitoring device 10 is described in a language that can be executed by a computer can be created. In this case, when the computer executes the monitoring program, the same effect as in the above embodiment can be obtained. Further, by recording such a monitoring program on a computer-readable recording medium, and reading and executing the monitoring program recorded on this recording medium, the same processing as in the above-described embodiment may be realized. Good. Hereinafter, an example of a computer that executes a monitoring program that implements the same function as the monitoring device 10 illustrated in FIG. 2 will be described.

  FIG. 10 is a diagram illustrating a computer 1000 that executes a monitoring program. As illustrated in FIG. 10, the computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012 as illustrated in FIG. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031 as illustrated in FIG. The disk drive interface 1040 is connected to the disk drive 1041 as illustrated in FIG. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052 as illustrated in FIG. The video adapter 1060 is connected to a display 1061, for example, as illustrated in FIG.

  Here, as illustrated in FIG. 10, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the above monitoring program is stored in, for example, the hard disk drive 1031 as a program module in which a command to be executed by the computer 1000 is described.

  The various data described in the above embodiment is stored as program data, for example, in the memory 1010 or the hard disk drive 1031. Then, the CPU 1020 implements the function of the control unit 12 of the monitoring apparatus 10 by reading the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1031 into the RAM 1012 as necessary.

  The program module 1093 and the program data 1094 related to the monitoring program are not limited to being stored in the hard disk drive 1031, but are stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive 1041 or the like. Also good. Alternatively, the program module 1093 and the program data 1094 related to the monitoring program are stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.), and via the network interface 1070. May be read by the CPU 1020.

DESCRIPTION OF SYMBOLS 10 Monitoring apparatus 11 Memory | storage part 12 Control part 13 Communication I / F part 111 Malware storage part 112 Analysis information 113 Analysis result 121 Time division dynamic analysis part 122 Continuous dynamic analysis part 123 Analysis management part 124 Time division dynamic analysis control part 125 Continuous dynamic analysis control unit 126 Continuation determination unit 127 Malware execution unit 128 External communication control unit

Claims (5)

A monitoring device that operates a program and monitors communication by the program,
Referring to the operation record of the program, when it is determined by the program that communication with any host on the network has been performed within a predetermined period, it is determined that the program is continuously operated. A continuation determining unit that determines to operate at a predetermined time when it is determined that communication with any host on the network is not performed within the predetermined period;
A continuous dynamic analysis unit that continuously operates the program determined to be continuously operated and records the operation of the program in the operation record;
A time-division dynamic analysis unit that operates the program determined to operate at the predetermined time at the predetermined time and records the operation of the program in the operation record;
A monitoring device comprising: The continuation determination unit
After the operation of the program by the time-division dynamic analysis unit, with reference to the operation record of the program, the program has performed (1) communication with any of the hosts within a predetermined period. 2) Communication with a host that has not been confirmed in the past, (3) A response has been received from any host, and (4) A response that has not been confirmed in the past from any host. The monitoring apparatus according to claim 1, wherein when it is confirmed that any one of the received information or a combination thereof is received, the program is determined to be continuously operated. The continuation determination unit
After the operation of the program by the continuous dynamic analysis unit, referring to the operation record of the program, the program (1) has passed a predetermined period of time since the last communication with any host. (2) communication with a host that has not been confirmed in the past within a predetermined period, (3) no response has been received from any host within a predetermined period, and (4) When a response that has not been confirmed in the past has not been received from any host within a predetermined period, or any combination thereof has been confirmed, the program is determined in advance The monitoring device according to claim 1, wherein the monitoring device is determined to be operated at a time. A monitoring method for operating a program and monitoring communication by the program,
Computer
A continuation determination step for determining whether or not communication with any host on the network is performed within a predetermined period by the program with reference to the operation record of the program;
In the continuation determination step, when it is determined by the program that communication has been performed with any host on the network within a predetermined period, the step of determining that the program is continuously operated;
In the continuation determination step, when it is determined by the program that communication has not been performed with any host on the network within a predetermined period, it is determined to operate at a predetermined time;
A continuous dynamic analysis step of continuously operating the program determined to be continuously operated and recording the operation of the program in the operation record;
A time-division dynamic analysis step of operating the program determined to be operated at the predetermined time at the predetermined time and recording the operation of the program in the operation record;
The monitoring method characterized by performing. A monitoring program for operating a program and monitoring communication by the program,
On the computer,
A continuation determination step for determining whether or not communication with any host on the network is performed within a predetermined period by the program with reference to the operation record of the program;
In the continuation determination step, when it is determined by the program that communication has been performed with any host on the network within a predetermined period, the step of determining that the program is continuously operated;
In the continuation determination step, when it is determined by the program that communication has not been performed with any host on the network within a predetermined period, it is determined to operate at a predetermined time;
A continuous dynamic analysis step of continuously operating the program determined to be continuously operated and recording the operation of the program in the operation record;
A time-division dynamic analysis step of operating the program determined to be operated at the predetermined time at the predetermined time and recording the operation of the program in the operation record;
Monitoring program to execute.

Images