JP2018142927A - System and method for addressing malware unauthorized communication - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a system and method for addressing malware unauthorized communication that can quickly address unauthorized communication caused by malware.SOLUTION: A system for addressing malware unauthorized communication comprises: means that fetches a file transmitted through the Internet; means that executes the fetched file under a virtual environment and determines whether the fetched file is malware on the basis of the details of the execution; means that, when the fetched file is determined to be malware, detects the address of a server from the details of the execution of the file under the virtual environment; means that detects communication with the server through the Internet on the basis of the address of the server; means that, when the communication with the server is detected, detects the address of the counterpart of the communication with the server; and means that transmits, to the Internet, a command indicating forcible termination of the communication to the address of the server and the address of the counterpart of the communication.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an unauthorized communication handling system and method for dealing with unauthorized communications caused by malware.

  Some malware infects a program in a user terminal and interferes with the operation of the program, or has a harmful effect contrary to the user's intention. When such malware is executed, it performs unauthorized communication with a C & C server (command & control server: hereinafter referred to as “C2 server”) arranged in the Internet, and a user terminal or the like from the C2 server via the Internet. A botnet that remotely controls the malware-infected device. The remote operation commander operates the commander device to transmit a command to the malware infection device via the C2 server. When a command is transmitted from the C2 server, the remotely infected malware infection apparatus attacks other terminals and servers or steals personal information regardless of the user's intention. When such malware spreads and many terminals and computer devices are infected, these many malware-infected devices connect to the C2 server and perform unauthorized communication.

  As a method for cutting off such unauthorized communication between the malware-infected device and the C2 server, a commander who issues an operation command to the infected device via the C2 server as disclosed in Patent Document 1 conventionally. There is a technology that makes it possible to identify a device and disconnect the connection between the commander device and the C2 server.

Japanese Patent Laid-Open No. 2014-219741

  However, in order to specify the commander apparatus, the monitoring apparatus is arranged exhaustively over the entire Internet, and it is not realistic to monitor the overseas network, and C2 existing in the overseas network is not practical. Monitoring and tracking servers requires cooperation and requests from overseas Internet providers, and cannot respond quickly to the threat of unauthorized communications. There was a problem of getting worse. In addition, in the case of coping with an Internet service provider (ISP) in a domestic network, there is a problem that the coping with only a user network belonging to the provider is limited.

  SUMMARY OF THE INVENTION An object of the present invention is to provide a malware fraudulent communication handling system and method that can quickly deal with fraudulent communication caused by malware.

  The anti-malware communication system of the present invention is an anti-malware communication system connected to the Internet, and is acquired by a file capturing means for capturing a file transferred via the Internet and the file capturing means. Malware determining means for executing the file under a virtual environment and determining whether the file is malware based on the execution content, and when the malware determining means determines that the file is malware Server address detecting means for detecting a server address from the execution contents of the file under the virtual environment, and server communication detecting means for detecting communication with the server via the Internet based on the server address; The server communication detecting means provides the server. A communication partner address detecting means for detecting the address of the communication partner of the server when communication with the server is detected, and a command indicating the forced termination of communication toward each of the address of the server and the address of the communication partner. And command sending means for sending out.

  The malware illegal communication countermeasure method of the present invention is a malware illegal communication countermeasure method of a network monitoring device connected to the Internet, and includes a file capturing step for capturing a file transferred via the Internet, and the file capturing step. The malware captured in the virtual environment is executed in a virtual environment, and it is determined in the malware determination step whether or not the file is malware based on the execution content, and the malware determination step determines that the file is malware A server address detecting step for detecting a server address from the execution contents of the file under the virtual environment, and a server communication for detecting communication with the server via the Internet based on the server address A detecting step and the server communication A communication partner address detection step for detecting the address of the communication partner of the server when communication with the server is detected in the detection step; and a forcible termination of communication toward each of the server address and the communication partner address A command transmission step of transmitting a command to the Internet.

  According to the malware unauthorized communication handling system and method of the present invention, since the unauthorized communication caused by the malware is detected and a command indicating the forced termination of communication is transmitted to each address of the unauthorized communication server and the communication partner, Unauthorized communication can be forcibly terminated. Therefore, it is possible to deal with unauthorized communication promptly.

It is a figure which shows the structure of the malware unauthorized communication countermeasure system by this invention. It is a block diagram which shows the specific structure of each apparatus in the system of FIG. It is a flowchart which shows operation | movement of the system of FIG. It is a figure which shows the sequence from the start of unauthorized communication between a user terminal and a C2 server to interruption | blocking.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 shows the configuration of a system for dealing with unauthorized malware communication according to the present invention. In this system, IX (Internet eXchange) 11, ASP (Application Service Provider) 12, and ISP (Internet Service Provider) 13, 14, 15 are connected to the Internet 10. Note that each of IX11, ASP12, and ISP13, 14, 15 is shown as a device in this embodiment.

 User networks 16, 17, and 18 are connected to the ISPs 13, 14, and 15, respectively. ISPs 13, 14, and 15 are relay devices that relay communications between the Internet 10 and user networks 16, 17, and 18 that are local networks. Various user terminals are connected to each of the user networks 16, 17, and 18.

  The IX 11 includes a sandbox device 101, a C2 server list DB (database) device 102, and a C2 server detection device 103. The sandbox device 101, the C2 server list DB device 102, and the C2 server detection device 103 are connected to the Internet 10.

  The sandbox device 101 constitutes file fetching means, malware determination means, and server address detection means, and the C2 server detection device 103 constitutes server communication detection means and communication partner address detection means.

  The sandbox device 101 takes in a file such as a program on the network, that is, the Internet 10, executes the file in a virtual environment, and determines whether the file is malware from the communication behavior being executed. The virtual environment is an isolated area that is formed in the sandbox device 101 and does not affect the Internet outside the device even if a file that is malware is executed. If the sandbox device 101 determines that the file is malware, the sandbox device 101 acquires the IP address of the destination C2 server and supplies the acquired IP address to the C2 server list DB device 102.

  The C2 server list DB device 102 stores the IP address of the C2 server supplied from the sandbox device 101. The C2 server detection device 103 monitors communication on the line from the Internet 10 to the user networks 16, 17, 18 and detects communication of the C2 server via those user networks.

  The ASP 12 includes an unauthorized communication user notification device 104, an order reception device 105, an RST transmission device 106, and a user billing device 107. The unauthorized communication user notification device 104, the order reception device 105, the RST transmission device 106, and the user billing device 107 are connected to the Internet 10.

  The unauthorized communication user notification device 104 constitutes network specifying means and unauthorized communication notification means, the order reception device 105 constitutes an order reception means, and the RST transmission device 106 constitutes a command transmission means. The user billing apparatus 107 constitutes billing means.

  The unauthorized communication user notification device 104 notifies the administrator of the user network by email of detection of unauthorized communication. The order receiving device 105 receives an unauthorized communication blocking order from an administrator of the user network by e-mail or a specific Web page. When the order reception device 105 receives an order, the RST transmission device 106 transmits an RST packet, which is a reset command, to each of the communication cutoff target C2 server and the user network terminal and blocks communication. The user billing apparatus 107 charges the administrator who has transmitted the blocking order.

  Each of the sandbox device 101, the C2 server detection device 103, the unauthorized communication user notification device 104, the order reception device 105, the RST transmission device 106, and the user billing device 107 includes, for example, a CPU (Central Processing Unit) as shown in FIG. ) 201, a memory 202, an auxiliary storage unit 203, a display unit 204, a communication IF unit 205, and an input unit 206 are composed of a computer device 200 connected to a common internal bus 207. The communication IF unit 205 is connected to the network line such as the Internet 10 described above. The CPU 201 executes the program stored in the memory 202 or the auxiliary storage unit 203 to execute the operation of each device. In addition, the user performs an input operation from the input unit 206 to instruct the CPU 201, and the CPU 201 causes the display unit 204 to display information such as an operation result. With such a configuration, each of the sandbox device 101, the C2 server list DB device 102, the C2 server detection device 103, the unauthorized communication user notification device 104, the order reception device 105, the RST transmission device 106, and the user billing device 107 is as follows. The operation shown in FIG. 5 is performed, and communication between these devices is enabled.

  Next, the operation flow of the malware unauthorized communication countermeasure system will be described with reference to the flowchart of FIG.

  First, the sandbox device 101 receives a file transferred to the IX 11 (step S100). This is a file fetching step, for example, a script file included in a mail attachment file or WEB data. When the sandbox device 101 receives such a file, the sandbox device 101 executes the received file under a predetermined virtual environment (step S101), analyzes the behavior being executed as the execution content, and determines whether the file is malware. Is determined (step S102). Steps S101 and S102 are malware determination steps. The behavior includes a communication behavior with the C2 server, and is a communication that receives a remote operation command and control from the C2 server, which is a source of spam mail or a DDos attack. If it is determined as malware, the sandbox device 101 acquires the IP address of the C2 server from the communication behavior with the C2 server in the virtual environment (step S103), and uses the acquired IP address as the C2 server list DB device 102. (Step S104). In step S103, which is a server address detection step, for example, the IP address that is the transmission destination of the transmission packet of the malware execution machine is detected as the IP address of the C2 server when communicating with the C2 server that performs remote operation. In step S104, the IP address of the C2 server is stored in the C2 server list DB apparatus 102.

  For example, the C2 server detection device 103 accesses the C2 server list DB device 102 in response to an instruction from the sandbox device 101 at a predetermined cycle or receives the IP address of the C2 server from the C2 server list DB device 102. Take out (step S201). Communication using the extracted IP address is monitored (step S202). Since the C2 server detection device 103 is connected to a communication line between the main body of the Internet 10 and the ISPs 13, 14, and 15, the monitoring receives a packet transferred through this communication line, and the received packet This is done by comparing the included destination IP address with the IP address extracted in step S201. As a result of monitoring, when communication of the C2 server is detected (step S203), the IP address of the transmission source (IP address of the communication partner of the C2 server) included in the received packet is sent to the unauthorized communication user notification device 104 (step S204). ). Steps S201 to S204 are server communication detection steps.

  Upon receiving the transmission source IP address from the C2 server detection device 103, the unauthorized communication user notification device 104 specifies the user network according to the transmission source IP address (step S301). The unauthorized communication user notification device 104 holds, for example, the relationship between the IP address and the user network in advance as a data table, and if the IP address is known, it is an address assigned to which user network using the data table. Can be identified. Further, since the unauthorized communication user notification device 104 holds the email address of the administrator of each user network as data, the unauthorized communication user notification device 104 notifies the identified user network administrator of the detection of unauthorized communication by email (step S302). ). The email includes, for example, detection of unauthorized communication via a user network managed by the administrator, provision of a paid service for blocking the unauthorized communication, and order of the paid service, that is, unauthorized communication. It is described that the blocking order is received by e-mail or a specific Web page.

  For example, the order receiving apparatus 105 accesses the C2 server list DB apparatus 102 and retrieves the IP address of the C2 server from the C2 server list DB apparatus 102 at a predetermined cycle or in response to a command from the sandbox apparatus 101. (Step S401). And it waits until it receives the unauthorized communication blocking order from the administrator (step S402).

  Upon receiving the unauthorized communication blocking order (step S403), the order receiving apparatus 105 instructs the RST transmitting apparatus 106 to block unauthorized communication with the C2 server to which the extracted IP address is assigned (step S404).

  When receiving the unauthorized communication cutoff command, the RST transmission device 106 accesses the C2 server list DB device 102 and takes out the IP address of the corresponding C2 server from the C2 server list DB device 102 (step S501). In addition, the IP address of the transmission source during illegal communication with the corresponding C2 server, that is, the IP address of the user terminal connected to the network of the administrator who issued the unauthorized communication blocking order is obtained (step S502). This can be obtained by the RST transmission device 106 communicating with the C2 server detection device 103 or the unauthorized communication user notification device 104. Further, unauthorized communication information such as the IP address of each of the C2 server and user terminal for unauthorized communication that has received an unauthorized communication blocking order is shared by a storage device (not shown) in the ASP 12, and the devices 104 to 107 in the ASP 12 are stored in the storage device. The unauthorized communication information may be read by appropriately accessing.

  Upon obtaining the IP addresses of the unauthorized communication C2 server and the user terminal that have received the unauthorized communication blocking order, the RST transmission device 106 transmits RST packets having these IP addresses as transmission destination addresses to the Internet 10 (steps). S503). Step S503 is a command transmission step. One RST packet is transferred to the user terminal during illegal communication, and the other RST packet is transferred to the C2 server during illegal communication. This forcibly blocks unauthorized communication between the C2 server and the user terminal.

  For example, the user billing apparatus 107 is notified from the order receiving apparatus 105 that an unauthorized communication blocking order has been received. In addition, after the RST transmission device 106 transmits the RST packet, the RST transmission device 106 receives an RST packet transmission end notification. In response to the RST packet transmission end notification, the user billing apparatus 107 performs billing processing for the administrator who has issued the unauthorized communication blocking order (step S601). The billing process is performed, for example, by automatically debiting from a pre-registered administrator's credit card account or by sending an e-mail with a bank account transfer request to the administrator's e-mail address.

  FIG. 4 shows a sequence from the start of unauthorized communication between the user terminal 108 and the C2 server 109 until it is forcibly blocked. As shown in FIG. 1, it is assumed that the user terminal 108 is a terminal connected to the user network 17, where malware is executed. For example, the C2 server 109 is arranged in an overseas network 20 and is connected to the Internet 10 via the network 20. The C2 server 109 is a server that executes unauthorized communication with the user terminal 108 by executing the malware 110 that has entered the user terminal 108.

  When the user terminal 108 starts executing the malware 110, first, a request for establishing a TCP connection with the C2 server 109 is made. As shown in FIG. 4, the user terminal 108 transmits a SYN packet to the C2 server 109 (step S701), and in response, the C2 server 109 transmits a SYN + ACK packet to the user terminal 108 (step S702). ). In response to the SYN + ACK packet, the user terminal 108 transmits an ACK packet to the C2 server 109 (step S703). Thereby, a TCP connection is established (TCP connection open).

  When the TCP connection is established, packets including HTTP data + ACK are alternately transferred between the user terminal 108 and the C2 server 109 (for example, steps S704 and S705), thereby executing the unauthorized communication 111 shown in FIG. The

  When the operation of the above-described unauthorized communication countermeasure system is started during the execution of the unauthorized communication 111, an RST packet (112 and 113 in FIG. 1) is transmitted to each of the user terminal 108 and the C2 server 109 (step S706). , S707). This corresponds to the operation in step S503 of the RST transmitter 106 described above. When each of the user terminal 108 and the C2 server 109 receives the RST packets 112 and 113, the communication between the user terminal 108 and the C2 server 109 is terminated and the TCP connection is forcibly disconnected (TCP connection close).

  As described above, in the unauthorized communication countermeasure system according to the present invention, it is possible to quickly detect and block unauthorized communication by executing malware in the user terminal without monitoring and tracking the C2 server existing in the overseas network. It becomes possible.

  Further, it is possible to detect and block unauthorized communication of malware as an ASP service without arranging a malware countermeasure device in the user network and without depending on the ISP connecting the user network.

  Normally, unauthorized communication is blocked by a firewall device arranged between the user network and the Internet. However, in the unauthorized communication countermeasure system according to the present invention, a file wall device is not required because communication is blocked by transmission of an RST packet. Thus, it is possible to suppress deterioration in communication quality of normal communication. Further, since it is not necessary to use a firewall device, complicated work such as rule setting when there is a user terminal that is desired to be excluded from blocking is not required.

  In the above-described embodiment, distributed by the sandbox device 101, the C2 server detection device 103, the unauthorized communication user notification device 104, the order reception device 105, the RST transmission device 106, and the user billing device 107 connected to the Internet 10. Although the operation is performed, the present invention is not limited to this, and can be distributed to an appropriate number of apparatuses. Further, all the operations may be executed by a single network monitoring apparatus connected to the Internet 10 and having the configuration shown in FIG.

10 Internet 11 IX
12 ASP
13, 14, 15 ISP
20 Overseas network 101 Sandbox device 102 C2 server list DB device 103 C2 server detection device 104 Unauthorized communication user notification device 105 Order reception device 106 RST transmission device 107 User billing device 108 User terminal 109 C2 server

Claims (9)

An anti-malware communication system connected to the Internet,
File capturing means for capturing a file transferred via the Internet;
Malware determination means for executing the file captured by the file capture means in a virtual environment and determining whether the file is malware based on the execution content;
Server address detection means for detecting a server address from the execution content of the file under the virtual environment when the malware determination means determines that the file is malware;
Server communication detecting means for detecting communication with the server via the Internet based on the address of the server;
A communication partner address detection unit that detects a communication partner address of the server when communication with the server is detected by the server communication detection unit;
Command transmission means for sending a command indicating the forced termination of communication to each of the address of the server and the address of the communication partner, to the Internet. Network specifying means for specifying a local network to which an address of a communication partner of the server is assigned;
Unauthorized communication notification means for notifying the local network administrator of the detection of unauthorized communication via the Internet;
Order receiving means for receiving the unauthorized communication blocking order for the unauthorized communication detection notification via the Internet, and
The local network is connected to the Internet via a relay device;
2. The malware unauthorized communication countermeasure system according to claim 1, wherein the packet transmitting means transmits a packet indicating the forced termination of communication when the unauthorized communication blocking order is received.   3. The system for dealing with illegal malware communication according to claim 2, further comprising billing means for performing billing processing for the administrator after sending the command indicating forced termination of communication.   4. The system for dealing with unauthorized malware communication according to claim 1, wherein the command indicating forced termination of communication is an RST packet.   4. The system for dealing with unauthorized malware communication according to claim 2, wherein the local network is a network managed by an Internet provider, and the relay device is an Internet service provider device.   6. The malware unauthorized communication countermeasure system according to claim 1, wherein the server is a command & control server. The file capture means, the malware determination means, and the server address detection means are configured by a sandbox device, and the server communication detection means and the communication partner address detection means are configured by a C2 server detection device,
The anti-malware communication system according to any one of claims 1 to 6, wherein the sandbox device and the C2 server detection device are included in IX (Internet Exchange). The network specifying unit and the unauthorized communication notification unit are configured by an unauthorized communication user notification device, the order reception unit is configured by an order reception device, the command transmission unit is configured by an RST transmission device, and the charging unit is user charging. Composed by the device,
6. The unauthorized communication user notification device, the order reception device, the RST transmission device, and the user billing device are included in an ASP (Application Service Provider). Malware unauthorized communication countermeasure system. An anti-malware communication method for a network monitoring device connected to the Internet,
A file capture step for capturing a file transferred via the Internet;
A malware determination step of executing the file captured in the file capture step in a virtual environment and determining whether the file is malware based on the execution content;
A server address detection step of detecting a server address from the execution content of the file under the virtual environment when the file is determined to be malware in the malware determination step;
A server communication detection step of detecting communication with the server via the Internet based on the address of the server;
A communication partner address detection step of detecting a communication partner address of the server when communication with the server is detected in the server communication detection step;
And a command transmission step of sending a command indicating forced termination of communication to each of the address of the server and the address of the communication partner to the Internet.

Images