JP2015106336A - Byte sequence extraction device, byte sequence extraction method, and byte sequence extraction program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect malware without fail and to decrease throughput reduction in the detection.SOLUTION: When an attack to vulnerability is detected, a byte sequence extraction device determines files acquired in relation to the attack as malware. Among the files determined as malware, a file in which malware is not detected by existent malware detection software is determined as a file of unknown malware. The byte sequence extraction device extracts a byte sequence of a predetermined length that is not present in an innocent file which is any other file than malware but is present in the file of unknown malware. The byte sequence extracted in such a manner is used as a signature of malware and matching with communication data is performed.

Description

  The present invention relates to a byte string extraction device, a byte string extraction method, and a byte string extraction program.

  In recent years, malicious programs (hereinafter referred to as “malware”) that cause threats such as information leaks and unauthorized access have become increasingly popular. The increase in the number of discovered malware is also remarkable, and it has been reported that one new malware appears every few seconds (see Non-Patent Document 1). In order to protect computers from malware threats, measures are taken to prevent infection with malware using anti-virus software (malware detection software) installed on the computer. However, recent malware is so sophisticated that it takes several days from the discovery of malware until it can be detected by malware detection software. Therefore, it is possible to determine whether it is malware by actually operating the file extracted from the communication data, extract a byte sequence unique to the file determined to be malware, create a signature, and prevent infection It has been proposed (see Non-Patent Document 2).

“McAfee Threat Report: Q1 2013”, [online], [searched September 3, 2013], Internet <http://www.mcafee.com/japan/media/mcafeeb2b/international/japan/pdf /threatreport/threatreport13q1.pdf> “Next-Generation Firewall Prevents Targeted Attacks by Modern Malware!”, [Online], [Search September 3, 2013], Internet <http://businessnetwork.jp/Portals/0/SP/1301_paloalto/? prtext>

  However, the above conventional technique has the following problems. That is, a file whose behavior when a file extracted from communication data is actually operated does not match a predefined one is not a signature creation target. For this reason, there was a problem that there was a risk of missing detection of malware. In addition, if a signature is created for all files that are determined to be malware and malware is detected from the communication data using the signature, matching with the communication data takes time and throughput is reduced. It was.

  Therefore, an object of the present invention is to solve the above-described problems, detect all malware, and reduce a decrease in throughput during detection.

  In order to solve the above-described problems, the present invention provides an attack detection unit that determines that a file acquired in association with an attack is malware when an attack on a monitored network is detected, and the attack detection unit Among the files that are determined as malware in the above, the unknown malware determination unit that determines files that are not detected as malware by the predetermined malware detection software as unknown malware files, and the benign files that are files other than malware include A byte sequence extraction unit that extracts a byte sequence of a predetermined length that does not exist but is present in the unknown malware file.

  According to the present invention, malware can be detected without omission and a reduction in throughput during detection can be reduced.

FIG. 1 is a diagram illustrating a configuration example of a byte string extraction device according to each embodiment. FIG. 2 is a flowchart showing a processing procedure of the attack detection unit of FIG. FIG. 3 is a flowchart illustrating a processing procedure of the unknown malware determination unit in FIG. FIG. 4 is a flowchart showing a processing procedure of the byte string extraction unit of FIG. FIG. 5 is a flowchart illustrating a processing procedure of the unknown malware determination unit in the second embodiment. FIG. 6 is a flowchart showing a processing procedure of the malware detection unit of FIG. FIG. 7 is a diagram illustrating a computer that executes a byte string extraction program.

  Hereinafter, embodiments of the present invention will be described by dividing the first to third embodiments with reference to the drawings. FIG. 1 is a diagram illustrating a configuration example of a byte string extraction device according to each embodiment.

(First embodiment)
(Overview)
An outline of the byte string extraction device 10 of the first embodiment will be described. When the byte string extraction device 10 monitors the network to be monitored by the attack detection unit 13110 and detects an attack against the vulnerability, the unknown malware determination unit 132 detects a malicious program (malware) using the existing malware detection software. . Here, in the unknown malware determination unit 132, when there is a file that cannot be detected by the existing malware detection software, that is, when an unknown malware file is found, the byte string extraction unit 133 reads the file. Compare with benign files (files that are clearly not malware). Then, if there is a byte string that does not exist in the benign file, the byte string extraction unit 133 extracts the byte string from the file and stores it in the byte string information storage unit 143.

  After that, for example, the malware detection unit 134 uses the byte sequence stored in the byte sequence information storage unit 143 as a malware signature (characteristic byte sequence), and performs matching with communication data on the network to be protected. , Malware detection from communication data can be performed without omission. The byte string stored in the byte string information storage unit 143 does not include a malware byte string that can be detected by existing malware detection software. Therefore, it is possible to reduce a decrease in throughput when the malware detection unit 134 performs matching with communication data.

(Constitution)
The byte string extraction device 10 includes a communication unit 11, an input / output unit 12, an attack detection unit 131, an unknown malware determination unit 132, an unknown malware storage unit 141, a benign file storage unit 142, and a byte string extraction unit 133. And a byte string information storage unit 143. Note that the malware detection unit 134 indicated by a broken line may or may not be equipped in the byte string extraction device 10 and will be described later.

  The communication unit 11 manages an interface for communicating with an external device via a network. The input / output unit 12 controls an interface for inputting / outputting various information to / from an external device.

  The attack detection unit 131 monitors a predetermined location (for example, a location having vulnerability) on the network to be monitored via the communication unit 11 and detects an attack on the location. Then, after detecting the attack, the attack detection unit 131 determines that the file acquired in connection with the attack on the network to be monitored is malware. Note that the attack detection unit 131 may access a URL that has been confirmed to be accessed on a predetermined network with a certain machine that is operating on another network to confirm whether or not the attack is being performed, It is also possible to detect an attack by visiting a likely URL. In the above case, both the predetermined network and another network are monitored networks in the attack detection unit 131.

  The unknown malware determination unit 132 determines a file that has not been detected as malware by the existing malware detection software from among the files determined as malware by the attack detection unit 131 and extracts the file as an unknown malware file. The extracted file is stored in the unknown malware storage unit 141. As illustrated in FIG. 1, the unknown malware determination unit 132 includes one or more malware detection software, and detects malware of a file using these malware detection software. The malware detection software used in the unknown malware determination unit 132 may be a commercially available anti-virus product or software that detects that it is a known malware by matching with a uniquely defined pattern.

  Hereinafter, a case where the unknown malware determination unit 132 detects malware with a plurality of different malware detection software will be described. However, the unknown malware determination unit 132 may detect malware with a single malware detection software.

  The unknown malware storage unit 141 stores an unknown malware file extracted by the unknown malware determination unit 132.

  The benign file storage unit 142 stores files other than malware (benign files). This benign file is an obvious and harmless file that is not malware, and is collected in advance by, for example, the administrator of the byte string extraction device 10 or the like. This benign file collection method is, for example, a method of collecting the top N frequently downloaded software on a site providing free software, or an OS (such as Windows (registered trademark) or Linux (registered trademark)). There is a method of collecting files included in the Operating System) from the beginning.

  The byte string extraction unit 133 compares the byte string extracted from the unknown malware file stored in the unknown malware storage unit 141 with the byte string of each benign file stored in the benign file storage unit 142, and the benign file Extracts byte sequences that are not included in but unknown malware files. The byte string extraction unit 133 stores the extracted byte string in the byte string information storage unit 143 in association with the information (malware information) of the file from which the byte string is extracted.

  The byte string information storage unit 143 stores information (byte string information) in which the byte string extracted by the byte string extraction unit 133 is associated with the malware information of the extraction source file. The malware information is information indicating identification information (for example, a hash value of the file) of the file from which the byte string is extracted.

  The attack detection unit 131, the unknown malware determination unit 132, and the byte string extraction unit 133 are realized by a program execution process by a CPU (Central Processing Unit) included in the byte string extraction device 10 or by dedicated hardware. The unknown malware storage unit 141, the benign file storage unit 142, and the byte string information storage unit 143 are storage units (illustrated) such as an HDD (Hard Disk Drive) and a RAM (Random Access Memory) included in the byte string extraction device 10. (Omitted) in a predetermined region.

  The byte string extraction device 10 described above extracts a byte string that serves as a signature for malware (unknown malware) that cannot be detected by existing malware detection software. Therefore, by using this byte sequence as a signature to detect malware from communication data, malware that cannot be detected by existing malware detection software (for example, new malware for which definition files are not yet prepared) can be detected without omission. be able to. Further, this byte string does not include a malware byte string that can be detected by existing malware detection software. That is, since the amount of data in the byte sequence used as the signature for malware detection can be reduced, the time required for matching processing between the signature and the communication data in malware detection can be reduced. As a result, it is possible to reduce a decrease in throughput when malware is detected.

(Processing procedure)
Next, a processing procedure of the byte string extraction device 10 will be described. First, the process procedure of the attack detection part 131 is demonstrated using FIG. FIG. 2 is a flowchart showing a processing procedure of the attack detection unit of FIG.

  As shown in FIG. 2, the attack detection unit 131 monitors a place where vulnerability exists in the program code (S1). For example, the attack detection unit 131 monitors whether or not a predetermined amount or more of data is written to the buffer in the program code having a buffer overflow vulnerability.

  When the attack detection unit 131 determines that an attack against the vulnerability has occurred (Yes in S2), the series of files created when the attack against the vulnerability is performed is stored in the storage unit (not shown). Save in a predetermined area (S3). On the other hand, when the attack detection unit 131 determines that an attack against the vulnerability has not occurred (No in S2), the process returns to S1.

  If there is a file including data that causes an attack against the vulnerability in the series of files saved in S3 (Yes in S4), that is, in the series of files saved in S3, When a file that causes an attack against the vulnerability is included, the attack detection unit 131 determines that the file including the attack against the vulnerability is malware (S5). Then, the process proceeds to S6.

  The file including the attack against the vulnerability is, for example, a file in which a code that exploits the vulnerability of the PDF file reading application is embedded in the PDF (Portable Document Format) file itself. If it is determined that none of the series of files stored in S3 includes an attack against the vulnerability (No in S4), the process proceeds to S6.

  In S6, the attack detection unit 131, when the series of files stored in S3 is an executable file acquired from the outside via the network when the attack is performed, and the executable file is executed by the attack ( In S6, the execution file is determined to be malware (S7). Then, the process ends. On the other hand, if the executable file is not executed due to the attack in S6 (No in S6), the process is terminated.

  As described above, the attack detection unit 131 determines that the file causing the attack and the execution file acquired and executed as a result of the attack are determined as malware among the series of files created by the attack against the vulnerability. To do. The attack detection unit 131 stores information on the file determined as malware (malware information) in a predetermined area of a storage unit (not shown).

  Next, the processing procedure of the unknown malware determination part 132 is demonstrated using FIG. FIG. 3 is a flowchart illustrating a processing procedure of the unknown malware determination unit in FIG.

  First, the unknown malware determination unit 132 determines whether or not the file is determined as malware by the attack detection unit 131 by the malware detection software (S11). That is, the unknown malware determination unit 132 reads a file determined as malware by the attack detection unit 131 from the storage unit (not shown), and determines whether or not the existing malware detection software detects the known malware for this file. to decide. Here, the number of malware detection software that has determined that the file is known malware is equal to or less than a predetermined value (for example, when the number of malware detection software included in the unknown malware determination unit 132 is five in total, it is determined as known malware). If the number of detected malware is one or less (Yes in S12), the file is determined to be an unknown malware file (S13) and stored in the unknown malware storage unit 141 (S15). On the other hand, when the number of malware detection software that has determined that the file is known malware exceeds a predetermined value (No in S12), the unknown malware determination unit 132 determines that the file is known malware (S14). The unknown malware determination unit 132 executes the above process for each file determined as malware by the attack detection unit 131.

  As described above, the unknown malware determination unit 132 accumulates, in the unknown malware storage unit 141, files that cannot be determined to be known malware by the existing malware detection software for each of the files in which the attack is detected.

  In S11, when the unknown malware determination unit 132 detects a known malware by the malware detection software, a notification that the known malware has been detected via the input / output unit 12 or a known malware is determined. Information such as a classification name may be output.

  Next, the processing procedure of the byte string extraction unit 133 will be described with reference to FIG. FIG. 4 is a flowchart showing a processing procedure of the byte string extraction unit of FIG.

  The byte string extraction unit 133 checks whether there is a file that has not been processed (byte string extraction process) in the unknown malware storage unit 141 (S21). If there is no file that has not been processed (No in S21), the process ends. On the other hand, when there is a file that has not been processed yet (Yes in S21), the byte string extraction unit 133 acquires a file that has not yet been processed from the unknown malware storage unit 141 (S22). Then, the byte string extraction unit 133 extracts a byte string having a predetermined length from the acquired file (S23).

  Next, the byte string extraction unit 133 determines whether or not the byte string extracted in S23 exists in the file (benign file) of the benign file storage unit 142 (S24). If the byte sequence extracted in S23 does not exist in any file stored in the benign file storage unit 142 (No in S24), the byte sequence extraction unit 133 extracts the extracted byte sequence and the extraction source. Byte string information associated with the file information (malware information) is stored in the byte string information storage unit 143 (S25). Then, the process returns to S21.

  On the other hand, when the byte sequence extracted in S23 is present in any of the benign files stored in the benign file storage unit 142 (Yes in S24), a byte having a predetermined length is included in the file from which the byte sequence is extracted. If there is another place where the sequence can be extracted (Yes in S26), the byte sequence extraction unit 133 changes the location to be extracted (S27), and executes the processing after S23. On the other hand, if there is no other place where a byte string of a predetermined length can be extracted (No in S26), the process returns to S21.

  By doing in this way, the byte sequence extraction part 133 can extract the byte sequence which is not contained in any benign file from the file of unknown malware. Then, by using this byte string as a signature for malware detection, unknown malware can be detected.

  In S23, the byte string extracted by the byte string extraction unit 133 may be extracted from the entire target file, or may be extracted from a portion excluding the header portion of the file. Further, when the target file is a file including an execution code, the file may be extracted from an area including the execution code of the file or may be extracted from an area not including the execution code. The byte string may be extracted in order from the beginning of the extraction target area of the file, or an arbitrary location may be extracted as a start location. As an example of the arbitrary place, there is a code execution start point (Original Entry Point) in an area including the execution code of the file.

(Second Embodiment)
In the unknown malware determination unit 132 described above, the byte sequence information of malware that is no longer unknown to the malware detection software among the byte sequences stored in the byte sequence information storage unit 143 may be deleted. An embodiment in this case will be described as a second embodiment. FIG. 5 is a flowchart for explaining the processing procedure of the unknown malware determination unit in the second embodiment.

  This deletion of the byte string information is performed, for example, when there is some change in the malware detection software of the unknown malware determination unit 132. As a specific example, it is triggered by the addition of malware detection software, version upgrade, change of a malware detection definition file used for malware detection, or the like. In addition to the above, deletion of this byte string information may be performed every predetermined period, such as once a day.

  First, the unknown malware determination unit 132 acquires malware information associated with the byte sequence from the byte sequence information stored in the byte sequence information storage unit 143 (S31), and identifies a file corresponding to the malware information as an unknown malware. Obtained from the storage unit 141 (S32).

  The unknown malware determination unit 132 determines whether or not the file acquired in S31 is unknown malware by each malware detection software (S33). Here, when it is determined that the file is a known malware, that is, it is not an unknown malware (No in S34), byte sequence information regarding the byte sequence extracted by the file is obtained from the byte sequence information storage unit 143. Delete (S35). The unknown malware determination unit 132 deletes the file from the unknown malware storage unit 141 (S36). Then, the process ends. On the other hand, when the unknown malware determination unit 132 determines that the file acquired in S31 is unknown malware by each malware detection software (Yes in S34), the process ends.

  As described above, the byte string extraction device 10 of the second exemplary embodiment deletes byte string information of a file that is no longer unknown malware from the byte string information storage unit 143 by updating the malware detection definition file or the like. As a result, the data amount of the byte string information stored in the byte string information storage unit 143 can be reduced. Therefore, it is possible to reduce the time when matching with communication data using the byte string of the byte string information stored in the byte string information storage unit 143 as a signature.

(Third embodiment)
The byte string extraction device 10 may further include a malware detection unit 134 indicated by a broken line in FIG. The malware detection unit 134 refers to the byte string stored in the byte string information storage unit 143 to detect unknown malware. That is, the malware detection unit 134 detects unknown malware by using the byte sequence stored in the byte sequence information storage unit 143 as a signature.

  The processing procedure of the malware detection unit 134 will be described with reference to FIG. FIG. 6 is a flowchart showing a processing procedure of the malware detection unit of FIG. For example, when the malware detection unit 134 acquires communication data (for example, communication data on the network to be protected) from the external device via the communication unit 11 (S41), the byte data information storage unit is added to the acquired communication data. It is determined whether or not the byte string indicated by the byte string information 143 is included (S42). Here, when the acquired communication data includes the byte string indicated by the byte string information (Yes in S42), the malware detection unit 134 determines that an unknown malware has been detected (S43), and the determination The result is output (S44). Then, the process returns to S41. For example, when the malware detection unit 134 detects unknown malware from the communication data, the malware detection unit 134 outputs a determination result indicating that the unknown malware is detected from the communication data.

  Further, when the malware detection unit 134 outputs the determination result in S44, the malware information of the file (unknown malware file) associated with the byte sequence in the byte sequence information is transmitted via the input / output unit 12. You may output to the outside. When the communication data acquired in S41 does not include the byte string indicated by the byte string information in the byte string information storage unit 143 (No in S42), the process returns to S41.

  By doing in this way, byte sequence extraction device 10 can detect unknown malware using the extracted byte sequence. Of course, the malware detection unit 134 may be realized by a device external to the byte string extraction device 10.

  Note that the malware detection software used by the unknown malware determination unit 132 can be set as appropriate by the administrator of the byte string extraction device 10 or the like. For example, when the malware detection software A is used on the network that is the protection target in the attack detection unit 131, the malware detection software used by the unknown malware determination unit 132 is also set as the malware detection software A.

  By doing in this way, the byte sequence extraction apparatus 10 can extract the byte sequence used as the malware signature which cannot be detected by the malware detection software used in the monitored network. After that, the malware detection unit 134 performs matching with the communication data in the protection target network using the extracted byte string, so that the malware detection in the protection target network can be performed without omission.

(program)
It is also possible to create a program in which the processing executed by the byte string extraction device 10 according to the above embodiment is described in a language that can be executed by a computer. In this case, the same effect as the above-described embodiment can be obtained by the computer executing the program. Further, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read by a computer and executed to execute the same processing as in the above embodiment. An example of a computer that executes a byte string extraction program that implements the same function as the byte string extraction device 10 will be described below.

  FIG. 7 is a diagram illustrating a computer that executes a byte string extraction program. As illustrated in FIG. 7, the computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100, for example. For example, a mouse 1110 and a keyboard 1120 are connected to the serial port interface 1050. For example, a display 1130 is connected to the video adapter 1060.

  Here, as shown in FIG. 7, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each table described in the above embodiment is stored in, for example, the hard disk drive 1090 or the memory 1010.

  Further, the byte string extraction program is stored in the hard disk drive 1090 as a program module in which a command executed by the computer 1000 is described, for example. Specifically, a program module describing each process executed by the byte string extraction device 10 described in the above embodiment is stored in the hard disk drive 1090.

  Data used for information processing by the byte string extraction program is stored as program data in, for example, the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the hard disk drive 1090 to the RAM 1012 as necessary, and executes the above-described procedures.

  Note that the program module 1093 and the program data 1094 related to the byte string extraction program are not limited to being stored in the hard disk drive 1090. For example, the program module 1093 and the program data 1094 are stored in a removable storage medium, and the CPU 1020 via the disk drive 1100 or the like It may be read out. Alternatively, the program module 1093 and the program data 1094 related to the byte string extraction program are stored in another computer connected via a network such as a LAN (Local Area Network) or a WAN (Wide Area Network), and the network interface 1070 is stored. Via the CPU 1020.

DESCRIPTION OF SYMBOLS 10 Byte string extraction apparatus 11 Communication part 12 Input / output part 131 Attack detection part 132 Unknown malware determination part 133 Byte string extraction part 134 Malware detection part 141 Unknown malware storage part 142 Benign file storage part 143 Byte string information storage part

Claims (8)

An attack detection unit that determines that a file acquired in connection with the attack is malware when an attack on the monitored network is detected;
Of the files determined to be malware by the attack detection unit, an unknown malware determination unit that determines a file that is not detected as malware by predetermined malware detection software as an unknown malware file;
A byte string extraction device comprising: a byte string extraction unit that extracts a byte string of a predetermined length that does not exist in a benign file that is a file other than malware, but exists in the unknown malware file. The predetermined malware detection software is a plurality of different malware detection software,
The unknown malware determination unit determines, among the files determined to be malware by the attack detection unit, files whose number of the malware detection software that detected the malware is less than a predetermined number as files of the unknown malware The byte string extraction device according to claim 1, wherein:   The byte string extraction device according to claim 1 or 2, wherein the predetermined malware detection software is the same malware detection software as the malware detection software used in a predetermined network to be protected. .   4. The attack detection unit according to claim 1, wherein when detecting the attack, the attack detection unit determines that the file executed due to the attack is malware. Byte string extractor.   The said attack detection part determines that the file which caused the said attack is malware when the said attack is detected, The Claim 1 thru | or 3 characterized by the above-mentioned. Byte string extractor. The byte string extraction device further includes:
An unknown malware storage unit for storing a file determined to be the unknown malware;
A byte string information storage unit that stores a byte string extracted from the file determined to be the unknown malware,
The unknown malware determination unit further detects the malware again for each file stored in the unknown malware storage unit, and as a result, when there is a file determined to be a known malware, the byte string 6. The byte string extraction apparatus according to claim 1, wherein a byte string extracted from the file is deleted from the byte string in the information storage unit. Determining that the file obtained in connection with the attack is malware when an attack on the monitored network is detected;
Determining a file in which malware is not detected by predetermined malware detection software among files determined to be malware as an unknown malware file;
A byte sequence extraction method, wherein a computer executes a step of extracting a predetermined length byte sequence that does not exist in a benign file that is a file other than malware but exists in the unknown malware file. Determining that the file obtained in connection with the attack is malware when an attack on the monitored network is detected;
Determining a file in which malware is not detected by predetermined malware detection software among files determined to be malware as an unknown malware file;
A byte string extraction program which causes a computer to execute a step of extracting a predetermined length byte string which is not present in a benign file which is a file other than malware but is present in the unknown malware file.

Images