JP2019016115A - Identifying device, identifying method, identifying program, model creating device, model creating method and model creating program - Google Patents

Abstract

To provide devices, methods and programs capable of efficiently identifying the kind of a domain relating to a DBD attack, and devices, methods and programs to create a model for identification.SOLUTION: A model creating device 1 includes: an obtaining unit 101 that obtains, for multiple domains to which a label is given and which include a landing domain and a distribution domain in a DBD attack, registered information on the domain; a calculating unit 102 which extracts a word contained in the registered information and which calculates an index relating to an appearance frequency of the word; and a learning unit 106 that creates an identification model in accordance with a learning with a teacher on the basis of the label with the word and the index for the word being as a first feature quantity.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an apparatus for identifying a domain type and an identification model generation apparatus.

  Conventionally, the Internet includes malicious sites created by attackers, and web security has become a very important issue for users. For example, there is a DBD (Drive-by download) attack that transitions to a page where malware is installed on a user's terminal.

  In a DBD attack, the code embedded in the “legitimate” landing page redirects the viewed page to the distribution page through multiple hop point pages, and the code on the distribution page It is installed on the user's terminal (see, for example, Non-Patent Document 1).

The level of web security is improved by detecting pages related to these attacks. In addition, by changing the restriction level according to the type of page, such as allowing access to the landing page but prohibiting page transition, prohibiting access to the distribution page, etc., it is appropriate for the user while maintaining security. Can provide web browsing. For example, Non-Patent Document 2-5 discloses a page classification technique.
Non-Patent Documents 6 and 7 disclose techniques for classifying whether a domain is a malicious domain using Whois, which is domain registration information.

N. Provos, P.M. Mavrommatis, M.M. A. Rajab, F.A. Monrose, “All Your iFRAMEs Point to Us”. In: 17th conference on Security Symposium (SS '08), pp. 1-15, 2008. J. et al. W. Stokes, R.M. Andersen, C.I. Seifert, and K.K. Chellapilla, “WebCop: locating neighborboards of malware on the web”. In: 3rd USENIX conference on Large-scale exploits and emergent threats: botnets, sponge, worms, and more (LEET '10), pp. 5-13, 2010. G. Wang, J. et al. W. Stokes, C.I. Herley, and D.H. Felstead, “Detecting Malicous Landing Pages in Malware Distribution Networks”. In: 43rd Conference on Dependable Systems and Networks (DSN '13), pp. 1-11, 2013. T.A. Nelms, R.A. Perdisci, M.M. Antonakakis, and M.A. Ahamad, “WebWitness: Investigating, Categorizing, and Mitigating Malware Download Paths”. In: 24th USENIX Security Symposium (USENIX '15), pp. 1025-1040, 2015. Google Safe Browsing version 4 (GSBv4), Internet <https://developers.google.com/safe-browsing/v4/> L. Bilge, E .; Kirda, C.I. Kruegel, and M.M. Balduzzi, “EXPOSURE: Finding Malinous Domains Using Passive DNS Analysis”, Network and Distributed System Security 11 Symposium. M.M. Kuyama, Y .; Kakizaki, and R.K. Sasaki, “Method for Detecting a Malicius Domain by using WHOIS and DNS features”, 3rd Int. Conf. on Digital Security and Forensics (DigitalSec 2016)

In the technique of Non-Patent Document 2, when a distribution page is detected, a part of the landing page is detected when reference information exists.
In the method of Non-Patent Document 3 or 4, since it is classified whether it is a landing page or a distribution page, a plurality of types cannot be identified at a time.
The black list used in Non-Patent Document 5 is provided with labels of landing page and distribution page, but cannot identify a page that is not registered in the list.

  Although the method of Non-Patent Document 6 or 7 cannot perform detailed classification such as landing or distribution, the attribute described in Whois is extracted to classify whether the domain is a malicious domain or not. However, the description format of Whois is not uniform, and attribute extraction work is not easy.

  As described above, in the conventional method, if a problem domain related to the DBD attack is not registered in a state classified in a predetermined black list, both the landing domain and the distribution domain are efficiently used. It was difficult to identify.

  An object of the present invention is to provide an apparatus, a method, and a program capable of efficiently identifying a domain type related to a DBD attack, and an apparatus, method, and program for generating a model for identification.

  The model generation apparatus according to the present invention includes, for a plurality of domains assigned labels including a landing domain and a distribution domain in a DBD attack, an acquisition unit that acquires registration information of the domain, and the registration information includes And generating a discrimination model by supervised learning based on the label using the calculation unit for calculating an index related to the appearance frequency of the word and the index for the word and the word as a first feature quantity. A learning unit.

  The model generation device includes a date extraction unit that extracts a registration date and an update date of the registration information, and the learning unit has a second characteristic of an elapsed day from the registration date and an elapsed day from the update date. As a quantity, the identification model may be generated.

  The model generation device includes a tag count unit that counts a first number of times a specific type of tag appears in the page document of the domain, and the learning unit uses the first number of times as a third feature amount. The identification model may be generated.

  The model generation device includes an extension count unit that counts a second number of times a specific type of file extension appears in the page document of the domain, and the learning unit sets the second number of times to a fourth number. The identification model may be generated as a feature quantity.

  The label may further include a hoppoint domain.

  The model generation method according to the present invention includes an acquisition step of acquiring registration information of a domain including a landing domain in a DBD attack and a label including a distribution domain, and the registration information includes And generating a discrimination model by supervised learning based on the label, using the calculation step of calculating an index relating to the appearance frequency of the word and the index for the word and the word as a first feature amount The computer performs the learning step.

  The model generation program according to the present invention includes an acquisition step of acquiring registration information of a domain including a landing domain in a DBD attack and a label including a distribution domain, and the registration information includes And generating a discrimination model by supervised learning based on the label, using the calculation step of calculating an index relating to the appearance frequency of the word and the index for the word and the word as a first feature amount And a learning step for causing the computer to execute the learning step.

  The identification device according to the present invention includes an acquisition unit that acquires registration information of a specified domain, a calculation unit that extracts a word included in the registration information and calculates an index related to an appearance frequency of the word, the word, And an identification unit for identifying a landing domain and a distribution domain in a DBD attack using the index for the word as a first feature amount.

  The identification method according to the present invention includes an acquisition step of acquiring registration information of a designated domain, a calculation step of extracting a word included in the registration information and calculating an index relating to an appearance frequency of the word, the word, The computer executes an identification step of identifying the landing domain and the distribution domain in the DBD attack using the index for the word as the first feature amount.

  The identification program according to the present invention includes an acquisition step of acquiring registration information of a specified domain, a calculation step of extracting an word included in the registration information and calculating an index relating to an appearance frequency of the word, the word, And an identification step for identifying a landing domain and a distribution domain in a DBD attack using the index for the word as a first feature amount.

  ADVANTAGE OF THE INVENTION According to this invention, the domain regarding a DBD attack can be identified efficiently.

It is a conceptual diagram which shows the kind of domain regarding the DBD attack which concerns on embodiment. It is a block diagram which shows the function structure of the model production | generation apparatus which concerns on embodiment. It is a block diagram which shows the function structure of the identification device which concerns on embodiment. It is a figure which shows the feature-value used as the input of the identification model which concerns on embodiment.

Hereinafter, an example of an embodiment of the present invention will be described.
FIG. 1 is a conceptual diagram showing the types of domains related to the DBD attack according to the present embodiment.
When a user accesses a landing page belonging to the landing domain, the user is redirected to the hop point page by a code embedded in the page.
Further, the hop point page allows the user to access the distribution page via redirection through a plurality of other hop point pages.
Then, malware is installed on the user's terminal using the code embedded in the distribution page.

  The model generation apparatus 1 according to the present embodiment generates a model for identifying a landing domain, a hoppoint domain, a distribution domain, and other normal domains by learning. The identification device 2 identifies unclassified domains using the model generated by the model generation device 1.

FIG. 2 is a block diagram illustrating a functional configuration of the model generation device 1 according to the present embodiment.
The model generation apparatus 1 is an information processing apparatus (computer) provided with an input / output and communication interface in addition to the control unit 10 and the storage unit 11, and the software (model generation program) stored in the storage unit 11 is controlled by the control unit. Each function of the present embodiment is realized by reading and executing 10.

  The control unit 10 of the model generation device 1 includes an acquisition unit 101, a calculation unit 102, a date extraction unit 103, a tag count unit 104, an extension count unit 105, and a learning unit 106.

  The acquisition unit 101 acquires Whois, which is registration information of a domain including a landing domain and a distribution domain including a distribution domain in a DBD attack. The label may further include a hoppoint domain.

  Note that the domain information to which a label serving as learning teacher data is attached may be acquired from an existing black list, white list, or the like, or may be acquired by manually classifying an arbitrary domain.

The calculation unit 102 extracts words included in Whois by text analysis, and calculates an index related to the appearance frequency of these words.
The index regarding the appearance frequency is, for example, TF-IDF, and feature words that frequently appear in a specific domain are adopted as a first feature amount for identification together with the TF-IDF value.

The processing of the calculation unit 102 includes, for example, the following plurality of steps.
-Extract words included in Whois.
・ Exclude unnecessary types of words.
・ Build a dictionary of words.
-Count the number of occurrences in the document for each word and the number of documents.
Calculate a TF-IDF value for each word.

  The date extraction unit 103 extracts the registration date and update date of Whois. The number of days elapsed from these dates to the present is adopted as the second feature amount for identification.

Here, in the Whois relating to the landing domain, the hop point domain, and the distribution domain, for example, the following features are often seen, so the second feature amount contributes to the identification performance.
The Whois renewal date for the landing domain is older than the Whois renewal date for the distribution domain.
• Whois registration dates for landing domains are older than normal.
• Whois registration dates for distribution domains are newer than usual.
• Whois registration and renewal dates for hoppoint domains are older than landing domains.

The tag count unit 104 counts the first number of times a specific type of tag appears in the page document included in the domain.
The specific types of tags are, for example, eight types of <form>, <iframe>, <href>, <link>, <script>, <frame>, <object>, <embed>, and the number of occurrences of these Is used as a third feature quantity for identification.

The extension count unit 105 counts the second number of times a specific type of file extension appears in the page document included in the domain.
The specific types of extensions are, for example, three types of jar, swf, and pdf, and the total number of appearances is used as the fourth feature amount for identification.

The learning unit 106 generates an identification model by supervised learning based on the label using the word and the TF-IDF value of the word as the first feature amount.
The learning unit 106 further uses the number of days elapsed from the registration date of Whois and the number of days elapsed from the update date as the second feature amount, the first number of times the tag is counted as the third feature amount, and the extension. The second number of times counted may be used as a fourth feature amount, and learning may be performed using each as an input.

  For the learning algorithm, various methods such as a decision tree, support vector machine, naive Bayes, neural network, stochastic gradient descent method, k-nearest neighbor method, random forest, and the like may be used as appropriate.

FIG. 3 is a block diagram showing a functional configuration of the identification device 2 according to the present embodiment.
The identification device 2 is an information processing device (computer) having an input / output and communication interface in addition to the control unit 20 and the storage unit 21, and the control unit 20 stores software (identification program) stored in the storage unit 21. By executing the reading, each function of the present embodiment is realized.

  The control unit 20 of the identification device 2 includes an acquisition unit 201, a calculation unit 202, a date extraction unit 203, a tag count unit 204, an extension count unit 205, and an identification unit 206.

The acquisition unit 201 acquires Whois, which is registration information of a specified domain to be identified.
The calculation unit 202, date extraction unit 203, tag count unit 204, and extension count unit 205 are the same functions as the calculation unit 102, date extraction unit 103, tag count unit 104, and extension count unit 105 of the model generation device 1, respectively. Part. The first to fourth feature quantities are derived by these function units, and these feature quantities are input to the identification unit 206.

The discriminating unit 206 is a discriminator for discriminating the type of domain in which the discriminating model generated by the model generating device 1 is mounted.
The identification unit 206 identifies the landing domain, hop point domain, and distribution domain in the DBD attack based on the input first to fourth feature values.

FIG. 4 is a diagram illustrating feature amounts that are input to the identification model according to the present embodiment.
The feature quantity that is an input of machine learning when generating the identification model or an input of the generated classifier is acquired from the Whois information about the domain and the page information (HTML document).

From Whois, as a first feature value, a word that is the result of text analysis of the entire document and its TF-IDF value are obtained.
Furthermore, the registration date and the update date are obtained from the attribute information of Whois as the second feature amount.
Further, from the page information, the number of appearances of a specific tag as the third feature value and the number of appearances of the specific extension as the fourth feature value are obtained.

According to the present embodiment, the model generation apparatus 1 performs text analysis on the Whois for each domain, extracts an index relating to the appearance frequency of words as a feature quantity, and sets a landing domain and a distribution domain related to a DBD attack. A model for identifying the type of domain to be included is generated by learning.
As a result, the identification device 2 can more easily extract feature amounts for a high-cost and low-accuracy process of extracting attribute information from Whois whose description format and terms are not unified, and a DBD attack Can efficiently identify the type of domain.

  As a result, network administrators can allow access to the landing domain for user browsing, but restrict redirects and prohibit access to the distribution domain. Appropriate access control can be realized efficiently.

The identification model is described in the second feature amount based on the registration date and update date of Whois, the third feature amount including the number of appearances of a specific tag described in the page document in the domain, and the page document. A fourth feature amount consisting of the number of appearances of the specific extension is used.
As a result, the domain type identification accuracy is improved, and it can be expected that the hop point domain can be accurately identified in addition to the landing domain and the distribution domain.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. Further, the effects described in the present embodiment are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the present embodiment.

  The model generation method by the model generation device 1 and the identification method by the identification device 2 are realized by software. When realized by software, a program constituting the software is installed in an information processing apparatus (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded.

DESCRIPTION OF SYMBOLS 1 Model generation apparatus 2 Identification apparatus 10 Control part 11 Storage part 20 Control part 21 Storage part 101 Acquisition part 102 Calculation part 103 Date extraction part 104 Tag count part 105 Extension count part 106 Learning part 201 Acquisition part 202 Calculation part 203 Date extraction Section 204 Tag count section 205 Extension count section 206 Identification section

Claims (10)

An acquisition unit for acquiring registration information of a domain including a landing domain in a DBD (Drive-by download) attack and a label including a distribution domain;
A calculation unit that extracts a word included in the registration information and calculates an index related to the appearance frequency of the word;
A model generation apparatus comprising: a learning unit that generates an identification model by supervised learning based on the label using the word and the index for the word as a first feature amount. A date extraction unit for extracting a registration date and an update date of the registration information;
The model generation device according to claim 1, wherein the learning unit generates the identification model using the elapsed days from the registration date and the elapsed days from the update date as a second feature amount. In the page document of the domain, the tag counting unit that counts the first number of times that a specific type of tag appears,
The model generation device according to claim 1, wherein the learning unit generates the identification model using the first number of times as a third feature amount. An extension count unit that counts a second number of times a specific type of file extension appears in the page document of the domain;
4. The model generation apparatus according to claim 1, wherein the learning unit generates the identification model using the second number of times as a fourth feature amount. 5.   The model generation apparatus according to claim 1, wherein the label further includes a hoppoint domain. An acquisition step of acquiring registration information of a domain including a landing domain in a DBD (Drive-by download) attack and a label including a distribution domain;
A calculation step of extracting a word included in the registration information and calculating an index related to the appearance frequency of the word;
A model generation method in which a computer executes a learning step of generating an identification model by supervised learning based on the label using the word and the index for the word as a first feature amount. An acquisition step of acquiring registration information of a domain including a landing domain in a DBD (Drive-by download) attack and a label including a distribution domain;
A calculation step of extracting a word included in the registration information and calculating an index related to the appearance frequency of the word;
A model generation program for causing a computer to execute a learning step of generating an identification model by supervised learning based on the label using the word and the index for the word as a first feature amount. An acquisition unit for acquiring registration information of a specified domain;
A calculation unit that extracts a word included in the registration information and calculates an index related to the appearance frequency of the word;
An identification apparatus comprising: an identification unit that identifies a landing domain and a distribution domain in a DBD (Drive-by download) attack using the word and the index for the word as a first feature amount. An acquisition step for acquiring registration information of a specified domain;
A calculation step of extracting a word included in the registration information and calculating an index related to the appearance frequency of the word;
An identification method in which a computer executes an identification step of identifying a landing domain and a distribution domain in a DBD (Drive-by download) attack using the word and the index for the word as a first feature amount. An acquisition step for acquiring registration information of a specified domain;
A calculation step of extracting a word included in the registration information and calculating an index related to the appearance frequency of the word;
Identification for causing a computer to execute a step of identifying a landing domain and a distribution domain in a DBD (Drive-by download) attack using the word and the index for the word as a first feature amount program.

Images