JP2015138331A - Information terminal, execution form monitor method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information terminal capable of monitoring an execution form.SOLUTION: An information terminal comprises: a feature amount data storage part for storing respective file extension of an open object file group, each name of respective applicable execution form, and respective feature amount parameter including a feature amount of the respective applicable execution form, for every file extension; a feature amount calculation part for calculating the feature amount of an execution form which is going to be opened or accessed, when any of the open object file group is going to be opened or accessed; and an evaluation part for reading the feature amount of the applicable execution form corresponding to the file extension of the open object file which is going to be opened or accessed, from the feature amount data storage part, and evaluating similarity of the calculated feature amount and read feature amount.

Description

  The present invention relates to information security, and relates to an information terminal, an execution format monitoring method, and a program for monitoring an execution format (application).

  Conventionally, there is a method in which a user manually and statically associates a file that is opened by an arbitrary execution format (hereinafter referred to as a file to be opened) and an execution format (hereinafter also referred to as an execution format file or application) by a user. Patent Document 1). Not only the method of Non-Patent Document 1, but the correspondence between the open target file and the execution format for opening it can be easily changed by various methods. For example, a certain illegal execution format may be able to fraud information from an open target file held by the user by associating a part of the open target file held by the user with itself. In this way, fraudulent information that is obtained by impersonating an illegal execution form as a regular execution form is called so-called application spoofing. Application spoofing is expected to increase in the future.

“Change the program that starts when a file is opened”, [online], [Search January 16, 2014], Internet <URL: http://office.microsoft.com/en-us/excel- help / HA010174909.aspx>

  Conventionally, execution format monitoring has not been performed, and information in a file can be easily scammed by a malicious execution format, which has a problem from the viewpoint of information security. Therefore, an object of the present invention is to provide an information terminal that can monitor the execution format.

  The information terminal of the present invention includes a feature amount data storage unit, a feature amount calculation unit, and an evaluation unit.

  The feature data storage unit includes each file extension of an open target file group that is a file group that is a target of file opening in an arbitrary execution format, and each applicable executable format that is an executable format applicable to each file extension. And feature quantity parameters including feature quantities of each applicable executable format are stored for each file extension. The feature quantity calculation unit attempts to open or access any of the execution formats when attempting to open any of the open target file groups or when accessing any of the open target file groups. The feature value of the executed format is calculated. The evaluation unit reads the feature amount of the applicable executable format corresponding to the file extension of the open target file that has been opened or accessed from the feature amount data storage unit, and the calculated feature amount and the read feature Evaluate quantity similarity.

  According to the information terminal of the present invention, the execution format can be monitored.

The block diagram which shows the structure of the information terminal of Example 1 of this invention. The flowchart which shows operation | movement of the information terminal of Example 1 of this invention. The figure which illustrates the data memorize | stored in the feature-value data storage part of Example 1 of this invention. The figure which illustrates about the extension of an executable format file group. The figure which illustrates each feature-value in case the stored feature-value and the calculated feature-value are similar. The figure which illustrates each feature-value in case the stored feature-value and the calculated feature-value are not similar. The block diagram which shows the structure of the information terminal of Example 2 of this invention. The flowchart which shows the registration operation | movement of the information terminal of Example 2 of this invention. The figure explaining the attribute extension used in Example 2 of the present invention. The figure which illustrates the data memorize | stored in the feature-value data storage part of Example 2 of this invention. The flowchart which shows evaluation operation | movement of the information terminal of Example 2 of this invention. The block diagram which shows the structure of the information terminal of Example 3 of this invention. The figure which illustrates the data memorize | stored in the feature-value data storage part of Example 3 of this invention. The flowchart which shows the registration operation | movement of the information terminal of Example 3 of this invention. The flowchart which shows the evaluation operation | movement of the information terminal of Example 3 of this invention. The block diagram which shows the structure of the execution format control system of Example 4 of this invention. The flowchart which shows the registration operation | movement of the information terminal of Example 4 of this invention. The flowchart which shows evaluation operation | movement of the information terminal of Example 4 of this invention.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

  The information terminal according to the first embodiment of the present invention will be described below with reference to FIGS. FIG. 1 is a block diagram illustrating a configuration of the information terminal 1 according to the present embodiment. FIG. 2 is a flowchart showing the operation of the information terminal 1 of the present embodiment. Note that in this specification, an information terminal indicates a general device including a storage area for storing data and an operator that calculates data and reads / writes data from / to the storage area. As illustrated in FIG. 1, the information terminal 1 according to the present exemplary embodiment includes at least a feature amount calculation unit 12, an evaluation unit 13, and a feature amount data storage unit 15. In addition to this, the information terminal 1 of the present embodiment may include a file registration unit 11. Further, it is assumed that the open target file group storage unit 14 and the execution format file group storage unit 16 exist outside the information terminal 1. These storage units (14, 16) may exist as independent storage media and storage devices outside the information terminal 1 as in this embodiment, or exist as storage areas inside the information terminal. Also good. In the present embodiment and the fourth embodiment described later, these storage units (14, 16) are assumed to exist as independent storage media and storage devices outside the information terminal 1, but in the second embodiment described later, 3, these storage units (14, 16) exist as storage areas inside the information terminal. The open target file group storage unit 14 stores a file group (open target file group) that is a target of file opening in an arbitrary execution format. The execution format file group storage unit 16 stores execution format groups.

  As shown in FIG. 2, the file registration unit 11 has each file extension of an open target file group that is a file group that is a target of file opening in an arbitrary execution format, and an execution format applicable to each file extension. Each name of each applicable executable form and each feature quantity parameter including the feature quantity of each applicable executable form are stored in the feature quantity data storage unit 15 for each file extension (S11). If data to be stored in step S11 is stored in advance in the feature data storage unit 15, the registration operation in step S11 and the file registration unit 11 can be omitted. Examples of features that can be used as feature quantities in the execution format in the present invention include a hash value, an entropy value of the entire application, and a partitioned entropy value of the application. When ordering is not considered, the hash value H of the execution format can be calculated by the following formula, for example.

Note that the P _i, in executable in the file of interest, represents the probability that the value i appears. When ordering is taken into consideration, the hash value H of the execution format (hereinafter referred to as M1 entropy) can be calculated by the following equation, for example.

Further, when the similarity between two files is measured using the entropy value of the entire file, for example, it can be calculated as follows.

However, E ₁ is the entropy of the comparison source file, E ₂ is the entropy of the comparison destination file, S ₁ is the file size of the comparison source file, and S ₂ is the file size of the comparison destination file. However, when the degree of similarity is calculated by using the entropy value of the entire file according to Equation (3), there are rare cases where completely different applications accidentally take similar entropy values. In order to prevent such accidental coincidence, it is preferable to perform a piecewise entropy calculation and calculate a similarity from the difference value of the piecewise entropy. When the similarity between two files is measured using the segmented entropy value, it can be calculated as follows, for example.

However, the similarity of equation (4) is interval i = 1, 2,..., N, H1 _i is the entropy of the comparison source file in interval i, and H2 _i is the entropy of the comparison destination file in interval i It is. The denominator n means taking the average of a total of n intervals. According to the above-described feature amount calculation method (Equations (1) to (4)), it is possible to determine impersonation with redundancy rather than exact matching. By providing redundancy to the feature quantity calculation method, it is possible to reduce the management cost.

Hereinafter, an example of data stored in the feature amount data storage unit 15 will be described with reference to FIG. FIG. 3 is a diagram illustrating data stored in the feature amount data storage unit 15 of the present embodiment. FIG. 3A is a data configuration example when the feature amount is a hash value, and FIG. 3B is a feature amount. FIG. 3C is a data configuration example when the feature amount is a segmented entropy value. As shown in FIG. 3, the feature amount data storage unit 15 stores the name of the applicable executable format and the feature amount parameter as a set for each file extension. For example, when the feature value is a hash value, as shown in FIG. 3A, for example, for the file extension “.doc”, the applicable executable format name “EXE1.exe” and the hash value of this executable format EXE1.exe H ₁ is stored as a set. Similarly, for example, for the file extension “.xls”, the applicable executable format name “EXE2.exe” and the hash value H _{2 of} this executable format EXE2.exe are stored in pairs, and so on. It is. For example, when the feature amount is an overall entropy value, as shown in FIG. 3B, a threshold value used for the similarity is stored as the feature amount parameter in addition to the feature amount itself. For example, in FIG. 3B, for the file extension “.doc”, the applicable executable format name “EXE1.exe”, the overall entropy value A ₁ of this executable format EXE1.exe, the overall entropy value A ₁ and the comparison target When calculating the similarity of the overall entropy value of a file using Equation (3), the threshold value “95%” used for the similarity is stored when determining whether or not the two files are the same. . In this case, it is possible to determine that the two files are the same when the similarity calculated by Expression (3) is 95% or more (or exceeding). The same applies to FIG. 3B. Similarly, for example, when the feature quantity is a segmented entropy value, as shown in FIG. 3C, a threshold value used for the similarity is stored as the feature quantity parameter in addition to the feature quantity itself. For example, in FIG. 3C, for the file extension “.doc”, the applicable executable format name “EXE1.exe”, the partitioned entropy value S ₁ of this executable format EXE1.exe, the partitioned entropy value S ₁ and the comparison target When the similarity of the file entropy values of the files is calculated by the equation (4), a threshold value “0.20” used for the similarity is stored when determining whether or not the two files are the same. In this case, it is possible to determine that the two files are the same when the similarity calculated by Expression (4) is 0.20 or less (or less). The same applies to FIG. 3C.

  Hereinafter, an example of an extension of an executable file will be supplementarily described with reference to FIG. FIG. 4 is a diagram illustrating the extension of the executable format file group. In the example of FIG. 3, the extensions of the execution formats are all “.exe”, but the execution format to be monitored by the present invention is not limited to this, and “.com” “.dll” “.sys” “ .bat "," .cmd ", etc. For example, as shown in FIG. 4, an executable format file 164 (EXE4.com), an executable format file 165 (EXE5.dll), or the like may be used.

  The description will be continued with reference to FIG. Step S12 and subsequent steps are evaluation operations. The feature amount calculation unit 12 opens or attempts to access any of the open target file groups when the open target file group is opened or the open target file group is accessed. Is calculated (S12). The evaluation unit 13 reads the feature amount of the applicable executable format corresponding to the file extension of the open target file that has been opened or accessed, from the feature amount data storage unit 15, and calculates the calculated feature amount and the read feature. The amount of similarity is evaluated (S13). Hereinafter, an example in which the similarity is actually calculated will be described with reference to FIGS. FIG. 5 is a diagram illustrating each feature quantity when the stored feature quantity is similar to the calculated feature quantity. FIG. 6 is a diagram illustrating each feature amount when the stored feature amount is not similar to the calculated feature amount. Both FIG. 5 and FIG. 6 are graphs in which the vertical axis is a feature quantity (section entropy value) and the horizontal axis is a file section (in units of 10 KB), and white rhombus symbols are adaptations stored in the feature quantity data storage unit 15 Represents a feature quantity of possible executables. On the other hand, a black square symbol is a newly calculated feature value to be compared, and represents an executable feature value to be opened or accessed. FIG. 5 shows a case in which the feature quantities match well, and the average (similarity) of the difference calculated by Expression (4) is 0.021. Since this value is equal to or less than the set threshold value, the evaluation unit 13 determines that the two files are the same. When it is determined that the two files are the same as shown in FIG. 5, the evaluation unit 13 can notify, for example, permission to open the file to the execution format to be opened or accessed. On the other hand, FIG. 6 shows a case where the feature amounts are not similar, and the average (similarity) of the difference calculated by Expression (4) is 0.69. Since this value exceeds the set threshold value, the evaluation unit 13 determines that the two files are not the same. Therefore, the evaluation unit 13 can determine that the execution format to be opened or accessed is an illegal execution format, and can notify the execution format of rejection (reject) of, for example, a file.

  As described above, according to the information terminal 1 of the present embodiment, the feature amount data storage unit 15 stores the feature amount in a predetermined applicable execution format, and the feature amount calculation unit 12 performs file access / opening. In order to evaluate the similarity by newly calculating the feature quantity of the execution format to be executed and comparing the calculated feature quantity with the stored feature quantity, Access / open can always be monitored.

  Hereinafter, the information terminal 2 according to the second embodiment will be described in which the execution format is monitored by triggering the time when the file is opened by managing the data stored in the feature amount data storage unit with an attribute extension. To do. First, the registration operation will be described with reference to FIGS. FIG. 7 is a block diagram showing the configuration of the information terminal 2 of the present embodiment. FIG. 8 is a flowchart showing the registration operation of the information terminal 2 of the present embodiment. As shown in FIG. 7, the information terminal 2 of the present embodiment includes a file registration unit 21, a feature amount calculation unit 22, an evaluation unit 23, an open target file group storage unit 14, and a feature amount data storage unit 25. The execution format file group storage unit 16 is included. The open target file group storage unit 14 and the execution format file group storage unit 16 may exist as an independent storage medium or storage device outside the information terminal 2. The difference between the information terminal 2 of the present embodiment and the information terminal 1 of the first embodiment is that the file registration unit 21, the feature amount calculation unit 22, the operation of the evaluation unit 23, and the data stored in the feature amount data storage unit 25. It is.

  As shown in FIG. 8, the feature quantity calculation unit 22 calculates the feature quantity of each adaptable execution format (S22A). The file registration unit 21 includes each attribute extension corresponding to each file extension, each file extension, each name of each applicable executable format of each file extension, and each feature parameter of each applicable executable format Are stored in the feature data storage unit 25 for each file extension (S21). The above is the registration operation. As described above, in this embodiment, the attribute extension is added. The attribute extension will be described with reference to FIGS. FIG. 9 is a diagram for explaining attribute extensions used in this embodiment. FIG. 10 is a diagram illustrating data stored in the feature amount data storage unit 25 of the present embodiment. As shown in FIG. 9, one attribute extension is assigned to a group of open target files having a common file extension. The attribute extension can be realized by a container extension, for example. In the example of FIG. 9, for example, the attribute extension “XXX” is given to the file extension “.doc”. The executable format EXE1.exe is associated with the file extension “.doc”. Similarly, the attribute extension “YYY” is assigned to the file extension “.xls”, and the applicable executable format EXE2.exe is associated with the file extension “.xls”. The same applies hereinafter. As shown in FIG. 10, in the feature value data storage unit 25 of the present embodiment, in addition to the data set of the first embodiment, each file extension is given an attribute extension and stored. As described above, when the open target file is managed with the attribute extension, the evaluation unit 23 can expand the attribute extension of the open target file when any execution format attempts to open any of the open target files. Since the child is read and the evaluation is performed, the evaluation can be performed with an execution format file open operation as a trigger.

  Details of the evaluation operation will be described with reference to FIG. FIG. 11 is a flowchart showing the evaluation operation of the information terminal 2 of the present embodiment. As shown in FIG. 11, when any execution format is to open any of the open target file groups, the feature amount calculation unit 22 calculates the feature amount of the execution format to be opened ( S22B). The evaluation unit 23 extracts the attribute extension of the open target file that is to be opened, and stores the feature quantity of the applicable executable format corresponding to the file extension determined based on the extracted attribute extension in the feature quantity data storage It reads out from the unit 25, evaluates the similarity between the calculated feature quantity and the read out feature quantity, and determines whether or not to open any execution format based on the similarity degree (S23).

  As described above, according to the information terminal 2 of the present embodiment, by adding the attribute extension to the data stored in the feature data storage unit 25, in addition to the effects of the first embodiment, the evaluation unit 23 has an execution format. The implementation can be implemented with the file open operation as a trigger.

  Hereinafter, with reference to FIG. 12 and FIG. 13, the implementation is implemented including the white execution format which is an execution format in which safety is ensured as an applicable execution format, and the black execution format which is an execution format suspected of being illegal. An information terminal according to Example 3 will be described. FIG. 12 is a block diagram illustrating a configuration of the information terminal 3 according to the present embodiment. FIG. 13 is a diagram illustrating data stored in the feature amount data storage unit 35 of the present embodiment.

  As shown in FIG. 12, the information terminal 3 of the present embodiment includes a file registration unit 31, a feature amount calculation unit 32, an evaluation unit 33, an open target file group storage unit 14, and a feature amount data storage unit 35. The execution format file group storage unit 16 is included. The open target file group storage unit 14 and the execution format file group storage unit 16 may exist as an independent storage medium or storage device outside the information terminal 3. The difference between the information terminal 3 of the present embodiment and the information terminal 1 of the first embodiment is that the file registration unit 31, the feature amount calculation unit 32, the operation of the evaluation unit 33, and the data stored in the feature amount data storage unit 35. It is.

In this embodiment, for each of the white execution format in which safety is ensured as the applicable execution format and the black execution format suspected of being illegal, the file extension in the first embodiment—the name of the applicable execution format—the feature parameter A data set consisting of A data set corresponding to the white execution format is called a white list, and a data set corresponding to the black execution format is called a black list. Hereinafter, data stored in the feature amount data storage unit 35 of this embodiment will be described with reference to FIG. FIG. 13 is a diagram illustrating data stored in the feature amount data storage unit 35 of the present embodiment, where FIG. 13A is a white list and FIG. 13B is a diagram illustrating a black list (feature values are hash values). Example). As shown in FIGS. 13A and 13B, in this embodiment, a data set is generated for each of the white execution format and the black execution format. Specifically, for example, EXE1.exe is listed as an executable format (white executable format) that guarantees safe behavior for the file extension “.doc”, and a hash value as its feature value (feature parameter) H ₁ is associated and stored. On the other hand, EXE91.exe is cited as an executable format (black executable format) that is suspected of executing an illegal operation for the file extension “.doc”, and a hash value H ₉₁ is associated with the feature amount. Is remembered. In this embodiment, the evaluation unit 33 compares the execution format to be evaluated with both the white execution format and the black execution format, and evaluates the similarity with the white execution format and the similarity with the black execution format, respectively. Hereinafter, the registration operation and evaluation operation of the information terminal 3 according to the present embodiment will be described with reference to FIGS. 14 and 15. FIG. 14 is a flowchart showing the registration operation of the information terminal 3 of this embodiment. FIG. 15 is a flowchart showing the evaluation operation of the information terminal 3 of this embodiment.

  As shown in FIG. 14, the feature amount calculation unit 32 calculates the feature amount of each white / black execution format (S32A). The file registration unit 31 stores, as a white list, a list of file extensions, names of white execution formats and feature parameters, each set of file extensions, and includes file extensions, black execution formats, and feature parameters. A list consisting of sets for each file extension is stored as a black list (S31A). The above is the registration operation.

  As shown in FIG. 15, the evaluation unit 33 determines whether the name of the execution format to be controlled matches the name of any execution format registered in the white / black list. (S33AY), the process proceeds to the next step S32B. If they do not match (S33AN), the process ends (F5 end). Although step S33A can be omitted as appropriate, execution of step S33A can exclude execution forms having names different from any of the white / black execution forms from the evaluation target, thereby reducing the processing cost for evaluation. Can do. Next, when any execution format opens any one of the open target file groups or attempts to access any one of the open target file groups, the feature amount calculating unit 32 attempts to open or access the open target file group. The feature amount of the executed format is calculated (S32B). The evaluation unit 33 reads the feature amount of the white / black execution format corresponding to the file extension of the open target file that has been opened or accessed from the feature amount data storage unit 35, and reads the calculated feature amount. The degree of similarity of the determined feature quantity is evaluated, and it is determined from the similarity whether the execution format of the control target is the white execution format, the black execution format, or neither, and according to the determination result Then, each predetermined operation is executed (S33B). For example, the evaluation unit 33 permits the access / open operation to the file when the execution format to be opened or accessed is determined to be the white execution format, and conversely if the execution format is determined to be the black execution format. The file access / open operation can be rejected.

  As described above, according to the information terminal 3 of the present embodiment, the applicable execution format includes the white execution format, the black execution format, and the like, and these feature amounts are converted into a white list and a black list in the feature amount data storage unit 35. Since the evaluation unit 33 executes each predetermined operation depending on whether the execution format of the control target is white, black, or neither, the evaluation unit 33 enters the white / black list. It is possible to realize detailed execution type monitoring.

  Hereinafter, referring to FIG. 16, when an open target file can be acquired via a file system, an evaluation is performed using I / O to the information terminal of the open target file as a trigger (trigger). An execution format control system according to the fourth embodiment will be described. FIG. 16 is a block diagram showing the configuration of the execution format control system 400 of this embodiment. As shown in FIG. 16, the execution format control system 400 according to the present embodiment includes the information terminal 4, the file system 47, the open target file group storage unit 14, and the execution format file group storage unit 16. . In this embodiment, the open target file group storage unit 14 and the execution format file group storage unit 16 are outside the information terminal 4 and are realized by independent storage media, storage devices, and the like. The information terminal 4 can input / output an open target file from the open target file group storage unit 14 via the file system 47. The information terminal 4 includes a file registration unit 41, a feature amount calculation unit 42, an evaluation unit 43, and a feature amount data storage unit 45.

  Hereinafter, the registration operation and evaluation operation of the information terminal 4 according to the present embodiment will be described with reference to FIGS. 17 and 18. FIG. 17 is a flowchart showing the registration operation of the information terminal 4 of this embodiment. FIG. 18 is a flowchart showing the evaluation operation of the information terminal 4 of this embodiment.

  As shown in FIG. 17, the feature amount calculation unit 42 calculates the feature amount of each adaptable execution format (S42A). The file registration unit 41 includes each file extension, each name of each applicable executable format of each file extension, and each feature parameter of each applicable executable format for each file extension. 45 (S41). The above is the registration operation.

  As shown in FIG. 18, when any execution format tries to access any of the open target file groups, the feature amount calculation unit 42 calculates the feature amount of the execution format to be accessed ( S42B). The evaluation unit 43 reads the feature amount of the applicable executable format corresponding to the file extension of the open target file that is the access target from the feature amount data storage unit 45, and the similarity between the calculated feature amount and the read feature amount The degree of access is evaluated, and whether or not to allow access to any execution format is determined based on the similarity (S43). The above is the evaluation operation.

  As described above, according to the execution format control system 400 and the information terminal 4 of the present embodiment, in addition to the effects of the first embodiment, the evaluation is executed using the I / O to the information terminal of the open target file as a trigger (trigger). can do.

  The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (7)

Each file extension of a file group to be opened, which is a file group that is a target of file opening in an arbitrary execution format, each name of each applicable executable format that is an executable format applicable to each file extension, and A feature amount data storage unit that stores each feature amount parameter including a feature amount of each applicable executable format for each file extension;
If any execution format tries to open any of the open target file groups or accesses any of the open target file groups, the execution format of the open or access target A feature amount calculation unit for calculating a feature amount;
The feature quantity of the applicable executable format corresponding to the file extension of the open target file that has been opened or accessed is read from the feature quantity data storage unit, and the calculated feature quantity and the read An evaluation unit that evaluates the similarity of the feature amount
Information terminal including. The information terminal according to claim 1,
An information terminal in which the feature amount is a value related to any one of a hash value, an entropy value of the entire application, and a partitioned entropy value of the application. The information terminal according to claim 1 or 2,
An information terminal in which the evaluator determines whether to open or access the open target file that is the target of execution or the open target of the execution format based on the evaluated similarity. An information terminal according to any one of claims 1 to 3,
The feature data storage unit stores an attribute extension corresponding to each file extension,
The evaluation unit extracts the attribute extension of the open target file that is the open target, and the feature amount of the applicable executable format corresponding to the file extension determined based on the extracted attribute extension Is read from the feature quantity data storage unit, and the information terminal evaluates the similarity between the calculated feature quantity and the read feature quantity. An information terminal according to any one of claims 1 to 4,
A white execution form that is an execution form that is guaranteed safe as the applicable execution form, and a black execution form that is an execution form suspected of fraud,
The feature amount data storage unit stores a list including a set of the file extension, the name of the white execution format, and the feature amount parameter for each file extension as a white list, and the file extension and the black A list consisting of a set of an executable format name and the feature parameter for each file extension is stored as a black list,
The evaluation unit reads out the feature quantity of the white execution format and the black execution format corresponding to the file extension of the open target file that has been opened or accessed from the feature quantity data storage unit, and An information terminal for evaluating the similarity between the calculated feature quantity and the read feature quantity. Each file extension of a file group to be opened, which is a file group that is a target of file opening in an arbitrary execution format, each name of each applicable executable format that is an executable format applicable to each file extension, and A registration step of storing each feature parameter including a feature value of each applicable executable format in a predetermined storage unit for each file extension;
If any execution format tries to open any of the open target file groups or accesses any of the open target file groups, the execution format of the open or access target A feature amount calculating step for calculating a feature amount;
The feature quantity of the applicable executable format corresponding to the file extension of the open target file that has been opened or accessed is read from a predetermined storage unit, and the calculated feature quantity and the read An evaluation step for evaluating the similarity of the feature quantity;
Execution format monitoring method including   A program for instructing a computer to execute the execution format monitoring method according to claim 6.

Images