JP2017142744A - Information processing apparatus, virus detection method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the accuracy of detecting unknown virus.SOLUTION: An information processing apparatus 100 includes: a storage unit 110 for storing a behavior list 111 formed by associating a plurality of behaviors 112 showing a part of behaviors of virus with weighted values 113 indicating probability of virus; a detection unit 130 which detects behaviors included in the behavior list 111, out of the behaviors of a target file to be executed on a virtual machine 120; a calculation unit 140 which calculates virus probability information indicating the probability of virus of the target file, by use of the weighted values 113 associated with the detected behaviors 112; and a determination unit 150 which determines a degree of virus of the target file, on the basis of the virus probability information.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information processing device, a virus detection method, and a program, and more particularly, to an information processing device, a virus detection method, and a program for detecting a virus.

  Computer virus detection techniques include signature-based virus detection techniques (pattern matching inspection), static and dynamic heuristic inspections, and the like. The signature-based virus detection technique detects a virus by registering a collected virus sample in advance as a pattern file and matching the inspection target file with the pattern file.

  In addition, the static heuristic inspection detects a virus by comparing a behavior registered in advance with the inspection target code without executing the inspection target code. The dynamic heuristic inspection detects viruses by executing inspection target code on a sandbox or a virtual machine and monitoring a specific operation.

  Patent Document 1 discloses a technique for inspecting a virus attached to a mail received by a mail server using these inspections. In Patent Document 1, first, a pattern matching inspection is performed on an attached file. If no virus is detected, a static heuristic inspection is performed. If no virus is detected there, a dynamic heuristic inspection is further performed. In particular, when a virus is detected by dynamic heuristic inspection, a feature is extracted from the attached file, and feedback to the pattern file is performed.

Japanese Patent No. 4145582

  Here, the above-described Patent Document 1 has a problem that the detection accuracy of an unknown virus is low. First, signature-based virus detection technology needs to collect a sample of viruses in order to extract a virus signature. In recent years, with the rapid expansion of viruses and trojans, sample collection and analysis work has increased. The signature-based virus detection technique has an inherent hysteresis characteristic.

  Therefore, in Patent Document 1, heuristic inspection is used as a countermeasure against the inherent hysteresis, but the operation to be monitored in Patent Document 1 is e-mail transmission to the outside, falsification of a file, and the like. It is only detected whether it is a virus or not based on whether or not it is an operation. However, operations such as external mail transmission and file editing also include normal operations, so that individual operations alone are insufficient to determine whether or not a virus is present. In particular, in the case of an unknown virus, there is a virus that can be a virus depending on the combination, execution order, and number of times even if the operation is originally normal. For example, simply recording a password or personal information entered by a user is not a malicious operation. However, if there is an operation for sending the recorded password by e-mail after the operation for recording the password, it can be said that there is a high possibility of a malicious operation, that is, a virus.

  The present invention has been made to solve such problems, and an object thereof is to provide an information processing apparatus, a virus detection method, and a program for improving the detection accuracy of an unknown virus.

An information processing apparatus according to a first aspect of the present invention includes:
A storage unit that stores an action list in which a plurality of actions indicating a part of the action of the virus are associated with a weighting value indicating the possibility of the virus;
A detection unit for detecting an action included in the action list among the actions by the target file executed on the virtual machine;
A calculation unit that calculates virus possibility information indicating a virus possibility of the target file by using the weighting value associated with each detected action;
A determination unit for determining a virus degree of the target file based on the virus possibility information;
Is provided.

The virus detection method according to the second aspect of the present invention includes:
Run the target file on the virtual machine,
Among each action by the target file, detect what is included in the action list in which a plurality of actions indicating a part of the virus action and a weighting value indicating the possibility of the virus are associated,
Using the weighting value associated with each detected action, the virus possibility information indicating the virus possibility of the target file is calculated,
The degree of virus of the target file is determined based on the virus possibility information.

The virus detection program according to the third aspect of the present invention includes:
Processing to execute the target file on the virtual machine;
A process for detecting an action included in an action list in which a plurality of actions indicating a part of a virus action and a weighting value indicating a possibility of a virus are associated with each other according to the target file;
A process of calculating virus possibility information indicating the possibility of virus of the target file using the weighting value associated with each detected action;
A process of determining a virus level of the target file based on the virus possibility information;
Is executed on the computer.

  According to the present invention, it is possible to provide an information processing apparatus, a virus detection method, and a program for improving the detection accuracy of an unknown virus.

It is a block diagram which shows the structure of the information processing apparatus concerning Embodiment 1 of this invention. It is a flowchart for demonstrating the flow of the virus detection method concerning Embodiment 1 of this invention. It is a block diagram which shows the whole structure of the information system concerning Embodiment 2 of this invention. It is a block diagram which shows the structure of the virus scan server concerning Embodiment 2 of this invention. It is a figure which shows the example of the action list | wrist concerning Embodiment 2 of this invention. It is a flowchart for demonstrating the flow of the virus detection method concerning Embodiment 2 of this invention. It is a flowchart for demonstrating the flow of the virus execution inspection concerning Embodiment 2 of this invention. It is a figure for demonstrating the concept of the virus execution inspection concerning Embodiment 2 of this invention.

  Hereinafter, specific embodiments to which the present invention is applied will be described in detail with reference to the drawings. In the drawings, the same elements are denoted by the same reference numerals, and redundant description will be omitted as necessary for the sake of clarity.

<Embodiment 1>
FIG. 1 is a block diagram showing a configuration of the information processing apparatus 100 according to the first embodiment of the present invention. The information processing apparatus 100 includes a storage unit 110, a virtual machine 120, a detection unit 130, a calculation unit 140, and a determination unit 150. The storage unit 110 stores an action list 111. The action list 111 is information in which a plurality of actions 112 are associated with a plurality of weight values 113.

  The action 112 indicates a part of the operation of the virus. The action 112 is, for example, function code executed by a program and information indicating a specific process (password recording, mail transmission) by combining them. That is, the action 112 alone cannot be said to be a computer virus. Moreover, you may use what divided | segmented the operation | movement of several past computer viruses into several individual action.

  The weight value 113 is numerical information indicating the possibility of a computer virus. For example, it may be a virus probability.

  The virtual machine 120 is a host emulator that operates in the information processing apparatus 100 and can execute a target file. The detection unit 130 detects the actions included in the action list 111 among the actions by the target file executed on the virtual machine 120. That is, the detection unit 130 monitors actions (processes and operations) in the target file executed on the virtual machine 120 and detects any included in the action list 111. The calculation unit 140 uses the weighting value 113 associated with each detected action 112 to calculate virus possibility information indicating the virus possibility of the target file. The virus possibility information is a result obtained by performing calculation such as predetermined statistical processing on the weight value 113. The determination unit 150 determines the virus level of the target file based on the virus possibility information. The degree of virus is, for example, whether or not the target file is a virus, the probability indicating the possibility of a virus, the presentation of a description (code) in the target file that may fall under the virus, etc. Good.

  FIG. 2 is a flowchart for explaining the flow of the virus detection method according to the first embodiment of the present invention. First, the information processing apparatus 100 executes the target file on the virtual machine 120 (S11). Next, the detection part 130 detects the action 112 contained in the action list 111 among each action by a target file (S12). Then, the calculation unit 140 reads a weight value associated with each detected action from the action list 111, and calculates virus possibility information indicating the possibility of a virus in the target file using the read weight value. (S13). Thereafter, the determination unit 150 determines the virus level of the target file based on the virus possibility information (S14).

  As described above, in the first embodiment, for a plurality of actions in the target file, matching is performed with actions in a pre-registered action list, and a weighting value associated with the matched action is used. The possibility of this is determined. Therefore, even if a single action in the target file does not correspond to a virus, depending on the combination of multiple actions, it is possible to detect a possible virus and improve the detection accuracy of an unknown virus. it can.

<Embodiment 2>
The second embodiment is a specific example of the first embodiment described above. FIG. 3 is a block diagram showing an overall configuration of the information system according to the second exemplary embodiment of the present invention. The information system includes a terminal group 1, a virus scan server 2, and an NW device group 3. The terminal group 1 includes a plurality of terminals 11 to 16, and each terminal is connected to the virus scan server 2 through a communication line. The NW device group 3 includes a plurality of NW devices 31 to 33, and each NW device is connected to the virus scan server 2 via a communication line. That is, the virus scan server 2 is arranged between the terminal group 1 and the NW device group 3. The virus scan server 2 performs a virus check on a file transferred from an external network (such as the Internet) to the terminal group 1 via the NW device group 3 in advance.

  FIG. 4 is a block diagram showing a configuration of the virus scan server 2 according to the second exemplary embodiment of the present invention. The virus scan server 2 is an example of the information processing apparatus 100 described above, and includes an analysis unit 21, a HASH calculation unit 22, a virus scan unit 23, a virus execution unit 24, a data processing unit 25, and a storage unit 26. Is provided. The storage unit 26 is an example of the storage unit 110 described above, and stores a black list 261, a HASH value 262, and an action list 263. The black list 261 is a file in which URLs known as distribution sources of known computer viruses (malware or the like) are recorded. That is, the black list 261 records the acquisition source of a file having a high possibility of a virus. In the black list 261, two or more URLs are normally recorded. The HASH value 262 is a hash value created from a known malware or the like. The HASH value 262 may include two or more hash values of malware. Further, the black list 261 and the HASH value 262 may be held as a pattern file. The behavior list 263 is an example of the behavior list 111 described above.

  The analysis unit 21 acquires from the NW device group 3 a virus inspection target file (hereinafter, “target file”) downloaded via the Internet. The analysis unit 21 determines whether the acquisition source of the target file is included in the black list 261. The HASH calculation unit 22 calculates the HASH value of the target file and compares it with the HASH value 262. The virus scanning unit 23 performs virus scanning on the target file. In particular, the virus scanning unit 23 performs deep inspection or quick inspection depending on conditions. That is, the virus scanning unit 23 performs deep inspection on the target file when the acquisition source of the target file is included in the black list 261, and performs quick inspection when the acquisition source is not included in the black list 261. Run.

  In the deep inspection, a detailed virus inspection is performed on the target file. On the other hand, in the quick inspection, a simple virus inspection is performed on the target file. Therefore, deep inspection has higher detection accuracy than quick inspection, but has a high processing load and a long execution time.

  The virus execution unit 24 is an example of the virtual machine 120, the detection unit 130, the calculation unit 140, and the determination unit 150 described above. The virus execution unit 24 includes a plurality of virtual machines (VM) 24-1 to 24-4. The virus execution unit 24 only needs to include at least one virtual machine. When a predetermined condition is satisfied, the virus execution unit 24 performs a virus execution inspection described later as behavior analysis for the target file, and determines the virus level of the target file.

  The data processing unit 25 processes the target file based on the results of the virus scanning unit 23 and the virus execution unit 24. That is, when the target file is normal, the data processing unit 25 transfers the target file to the original transfer destination terminal. On the other hand, when it is determined that the target file is a virus, the data processing unit 25 performs removal such as deleting the target file.

  FIG. 5 is a diagram showing an example of the action list 263 according to the second embodiment of the present invention. The action list 263 is information registered for actions (behavior that may be malicious) that are not viruses in a single action but may become a virus by a combination of a plurality of actions. Here, each action (small item) is classified into a large item, but the way of classification is not limited to this. A weight value is set for each small item.

The following describes the behavior for each major item.
(I) Hiding behavior: actions such as hiding files, hiding services, hiding registries, hiding ports, hiding processes, etc. For example, “hide a file” indicates a process of changing the attribute of a file stored in a folder and hiding it from a general user. “Hide process” refers to, for example, processing for preventing any process from being recognized on the process monitoring tool due to execution of the target file.

  (II) Contents tampering actions: actions such as creating, moving and deleting files, changing file names, modifying file contents, opening files, changing file types, and the like. “File creation etc.” is not malicious by itself, but may be a virus in combination with other actions.

  (III) Stand-up action: Actions such as restarting the system and setting for automatically starting up its own functions can be mentioned. These are actions that may cause the target host to virus implant and automatically reboot. For example, when the downloaded file is executed, settings are made so that it is automatically restarted thereafter. Examples of the setting for restarting automatically include registration in the task scheduler and addition of an application to the automatic start list when the OS is started.

  (IV) Network behavior: Behaviors such as sending mail, scanning and monitoring ports, requests and responses to a specific domain, connection to external IP, etc. These may be viruses when they are frequently accessed or when a specific destination is repeatedly accessed.

  (V) Infection behavior: Behavior that changes its own file or another file as the target file is executed. For example, when a target file with an extension of exe, bat, scr, docx, etc. is executed, the file format is changed / converted, the contents of the target file itself are updated, and the contents of other files are It detects that it is updated. This is because these actions may cause virus infection.

  (VI) Actions to evoke: Actions that trigger specific actions and automatically execute related services or processes. For example, it can be said that the probability of a virus increases if there is a process of extracting confidential information such as a password or personal information in the background when the button is pressed. Therefore, it can be said that there is a possibility of a virus when the pressing process of a button or the like and the recording process of confidential information are combined.

  (VII) Scattering behavior: Behavior such as copying a file or transferring information to another host or another folder. Although it cannot be said that it is illegal alone, copying a file or the like as the target file is executed may be a virus.

  (VIII) Action of closing the firewall: An action of automatically closing the firewall is mentioned. This is because if the firewall process is terminated along with the execution of the target file, the possibility of a virus increases.

  (IX) Designated process termination behavior: Examples include behaviors such as automatically terminating key processes and security services. In particular, if the anti-virus software is terminated with the execution of the target file, the possibility of a virus increases.

  The above is only an example of the action list 263 according to the second embodiment, and the weighting value is only an example.

  FIG. 6 is a flowchart for explaining the flow of the virus detection method according to the second embodiment of the present invention. First, the analysis unit 21 acquires a target file (S101). Next, the analysis unit 21 determines whether the URL from which the target file is acquired exists in the black list 261 (S102). If the acquisition source URL does not exist in the black list 261 (NO in S102), the HASH calculation unit 22 calculates the HASH value of the target file (S103). Then, the HASH calculation unit 22 determines whether or not the calculated HASH value matches the HASH value 262 stored in the storage unit 26 (S104).

  If YES in step S102 or YES in step S104, the virus scanning unit 23 performs deep inspection on the target file (S105). On the other hand, if NO in step S104, the virus scanning unit 23 performs quick inspection on the target file (S106).

  After step S105 or S106, the virus scanning unit 23 determines whether or not a virus is detected (S107). If no virus is detected, the virus scanning unit 23 transfers the target file to the virus execution unit 24. Then, the virus execution unit 24 performs virus execution inspection on the target file (S108).

  FIG. 7 is a flowchart for explaining a flow of the virus execution inspection according to the second embodiment of the present invention. The virus execution unit 24 executes the target file on the VM 24-1 (S201). The virtual machines to be used may be VMs 24-2 to 24-4.

  Next, the virus execution unit 24 detects an action k in the target file (S202). For example, it is detected by monitoring an event that occurs when the target file is executed, an OS function call, or the like. Then, the virus execution unit 24 determines whether or not the detected action k exists in the action list 263 (S203). If it exists, the virus execution unit 24 calculates the weighting value Bk of the action k (S204). If a weighting value is set in advance in the action list 263 as shown in FIG. 5, the virus execution unit 24 reads the weighting value associated with the action k from the action list 263.

尚、行動リスト２６３に予めＳｋ及びＬｋを設定しておくことで、ステップＳ２０４においてＢｋを計算してもよい。または、予め全ての行動ｋについてＢｋを算出しておき、行動リスト２６３に予めＢｋを設定してもよい。 Here, how to calculate or define the weighting value Bk will be described. First, the number of small items in the action list 263 is [1, n], and the importance for the small item k is Sk. Here, Sk is a positive integer and is arbitrarily set by the user for the action. Also, let Lk be the probability that action k will hit among a plurality of sample viruses. Note that Lk is calculated in advance. Then, the weighting value Bk is calculated by the following equation (1). That is, the weighting value Bk can be said to be a value based on the degree Lk that the behavior in the behavior list is executed in a plurality of sample viruses.

Note that Bk may be calculated in step S204 by setting Sk and Lk in the action list 263 in advance. Alternatively, Bk may be calculated for all actions k in advance, and Bk may be set in the action list 263 in advance.

  After step S204, the virus execution unit 24 determines whether or not the execution of the target file has ended (S205). That is, it is determined whether or not all actions in the target file have been detected. If the target file is being executed, the virus execution unit 24 detects the next action k in the target file (S206). Thereafter, steps S203 to S206 are repeated until the execution of the target file is completed.

対象ファイルが実行終了か否かを判定する（Ｓ２０２）。尚、行動リスト２６３内の行動のうち対象ファイル内に存在しない行動における重み付け値Ｂｋを「０」として計算する。 In the case of NO in step S205, that is, when the execution of the target file is completed, the virus execution unit 24 calculates the total TB of the weights Bk of all detected actions k (S207). For example, TB is calculated by the following equation (2).

It is determined whether or not the target file has been executed (S202). In addition, the weighting value Bk in the action not existing in the target file among the actions in the action list 263 is calculated as “0”.

  Then, the virus execution unit 24 determines whether or not the total TB is larger than the threshold value th (S208). If the total TB is greater than the threshold th, the virus execution unit 24 determines that the target file is a virus (S209). On the other hand, when the total TB is equal to or less than the threshold th, the virus execution unit 24 determines that the target file is not a virus (S210). Then, it progresses to step S110 of FIG.

  Subsequently, the virus execution unit 24 determines whether a virus is detected (S110). The virus execution unit 24 makes a determination based on the result of FIG. If YES in step S107 or YES in step S110, the virus execution unit 24 transfers the target file to the data processing unit 25, and the data processing unit 25 deletes the target file (S109). On the other hand, if NO in step S110, the virus execution unit 24 transfers the target file to the data processing unit 25, and the data processing unit 25 transfers the target file to the original terminal (S111).

  FIG. 8 is a diagram for explaining the concept of the virus execution inspection according to the second embodiment of the present invention.

  As described above, in the second embodiment, a virus is detected in advance by comparing the target file with a black list or HASH value for known viruses, and deep inspection is performed only when the virus is detected. It is. In this way, the known virus processing can be made more efficient by dividing the level of virus scanning by checking the black list and HASH value in advance.

  Further, the virus execution unit 24 (detection unit) executes the target file on the virtual machine when no virus is detected as a result of the deep inspection or the quick inspection. Therefore, it is possible to improve the processing efficiency with high accuracy by performing a heuristic inspection with a higher processing load only on an unknown virus.

  The virus scan server 2 preferably has a plurality of virtual machines. The virus execution unit 24 executes different target files in parallel on different virtual machines. For example, the virus execution unit 24 can be realized by cloud computing. Thereby, the virus detection process can be made efficient. In particular, as shown in FIG. 3, when virus detection is performed before a file is downloaded to the terminal group 1, communication bottlenecks can be eliminated, which is more effective.

  The total TB described above is merely an example of virus possibility information. Therefore, depending on how the action list 263 is defined, a weighting value can be defined by a combination, order, number of repetitions, and the like of small items. Thereby, detection accuracy can be improved more.

<Other embodiments>
Note that the above-described embodiment can be applied to other than cloud computing. Moreover, the flow of the process of FIG.6 and FIG.7 mentioned above is an example, and this Embodiment is not limited to these.

  Note that the present invention is not limited to the above-described embodiment, and can be changed as appropriate without departing from the spirit of the present invention.

  In the above-described embodiments, the present invention has been described as a hardware configuration, but the present invention is not limited to this. The present invention can also realize arbitrary processing by causing a CPU (Central Processing Unit) to execute a computer program.

  In the above example, the program can be stored and supplied to a computer using various types of non-transitory computer readable media. Non-transitory computer readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (for example, flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (for example, magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / W, DVD (Digital Versatile Disc), BD (Blu-ray (registered trademark) Disc), semiconductor memory (for example, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM ( Random Access Memory)). The program may also be supplied to the computer by various types of transitory computer readable media. Examples of transitory computer readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

A part or all of the above embodiments can be described as in the following supplementary notes, but is not limited thereto.
(Appendix 1)
A storage unit that stores an action list in which a plurality of actions indicating a part of the action of the virus are associated with a weighting value indicating the possibility of the virus;
A detection unit for detecting an action included in the action list among the actions by the target file executed on the virtual machine;
A calculation unit that calculates virus possibility information indicating a virus possibility of the target file by using the weighting value associated with each detected action;
A determination unit for determining a virus degree of the target file based on the virus possibility information;
An information processing apparatus comprising:
(Appendix 2)
The information processing apparatus according to claim 1, wherein the calculation unit calculates the virus possibility information by adding the weighting values to all the detected actions for the target file.
(Appendix 3)
The storage unit further stores a black list that records an acquisition source of a file having a high possibility of a virus,
A virus scanning unit that performs deep inspection on the target file when the acquisition source of the target file is included in the black list, and that performs quick inspection when the acquisition source is not included in the black list; Prepare
The information processing apparatus according to appendix 1 or 2.
(Appendix 4)
The detector is
The information processing apparatus according to appendix 3, wherein when the virus is not detected as a result of the deep inspection or the quick inspection, the target file is executed on the virtual machine.
(Appendix 5)
The information processing apparatus includes a plurality of the virtual machines,
The information processing apparatus according to any one of claims 1 to 4, wherein the detection unit executes the different target files in parallel on the different virtual machines.
(Appendix 6)
The information processing apparatus according to any one of claims 1 to 5, wherein the weighting value is a value based on a degree of execution of an action in the action list in a plurality of sample viruses.
(Appendix 7)
The determination unit
The information processing apparatus according to claim 2, wherein the target file is determined as a virus when the virus possibility information exceeds a predetermined threshold.
(Appendix 8)
Run the target file on the virtual machine,
Among each action by the target file, detect what is included in the action list in which a plurality of actions indicating a part of the virus action and a weighting value indicating the possibility of the virus are associated,
Using the weighting value associated with each detected action, the virus possibility information indicating the virus possibility of the target file is calculated,
A virus detection method for determining a virus level of the target file based on the virus possibility information.
(Appendix 9)
Processing to execute the target file on the virtual machine;
A process for detecting an action included in an action list in which a plurality of actions indicating a part of a virus action and a weighting value indicating a possibility of a virus are associated with each other according to the target file;
A process of calculating virus possibility information indicating the possibility of virus of the target file using the weighting value associated with each detected action;
A process of determining a virus level of the target file based on the virus possibility information;
Virus detection program for causing the computer to execute

DESCRIPTION OF SYMBOLS 100 Information processing apparatus 110 Storage part 111 Action list 112 Action 113 Weighted value 120 Virtual machine 130 Detection part 140 Calculation part 150 Judgment part 1 Terminal group 11-16 Terminal 2 Virus scan server 3 NW equipment group 31-33 NW equipment 21 Analysis part 22 HASH calculation unit 23 Virus scanning unit 24 Virus execution unit 25 Data processing unit 26 Storage unit 261 Black list 262 HASH value 263 Action list

Claims (9)

A storage unit that stores an action list in which a plurality of actions indicating a part of the action of the virus are associated with a weighting value indicating the possibility of the virus;
A detection unit for detecting an action included in the action list among the actions by the target file executed on the virtual machine;
A calculation unit that calculates virus possibility information indicating a virus possibility of the target file by using the weighting value associated with each detected action;
A determination unit for determining a virus degree of the target file based on the virus possibility information;
An information processing apparatus comprising: The information processing apparatus according to claim 1, wherein the calculation unit calculates the virus possibility information by adding the weighting values to all the detected actions for the target file. The storage unit further stores a black list that records an acquisition source of a file having a high possibility of a virus,
A virus scanning unit that performs deep inspection on the target file when the acquisition source of the target file is included in the black list, and that performs quick inspection when the acquisition source is not included in the black list; Prepare
The information processing apparatus according to claim 1 or 2. The detector is
The information processing apparatus according to claim 3, wherein when the virus is not detected as a result of the deep inspection or the quick inspection, the target file is executed on the virtual machine. The information processing apparatus includes a plurality of the virtual machines,
The information processing apparatus according to any one of claims 1 to 4, wherein the detection unit executes the different target files in parallel on different virtual machines. The information processing apparatus according to any one of claims 1 to 5, wherein the weighting value is a value based on a degree to which an action in the action list is executed in a plurality of sample viruses. The determination unit
The information processing apparatus according to claim 2, wherein when the virus possibility information exceeds a predetermined threshold, the target file is determined as a virus. Run the target file on the virtual machine,
Among each action by the target file, detect what is included in the action list in which a plurality of actions indicating a part of the virus action and a weighting value indicating the possibility of the virus are associated,
Using the weighting value associated with each detected action, the virus possibility information indicating the virus possibility of the target file is calculated,
A virus detection method for determining a virus level of the target file based on the virus possibility information. Processing to execute the target file on the virtual machine;
A process for detecting an action included in an action list in which a plurality of actions indicating a part of a virus action and a weighting value indicating a possibility of a virus are associated with each other according to the target file;
A process of calculating virus possibility information indicating the possibility of virus of the target file using the weighting value associated with each detected action;
A process of determining a virus level of the target file based on the virus possibility information;
Virus detection program for causing the computer to execute

Images