JP4755658B2 - Analysis system, analysis method and analysis program - Google Patents

Description

  The present invention relates to a system, an analysis method, and an analysis program that analyze a behavior of a malicious program that runs on a computer on a virtual network that is not connected to the real Internet or that is connected only to a specific protocol. .

  In recent years, malicious computer programs such as computer viruses, spyware, and bot programs that pose threats such as information leaks and unauthorized access (hereinafter referred to as “malware”, which operates illegally) are becoming increasingly popular. .

  Some malware has its source code published on the Internet and it is possible to easily create new species and variants, and about 70 new species and variants appear each day. (Refer nonpatent literature 1.). In addition, there is malware that checks connection to the Internet network and stops its operation when communication cannot be performed normally (see Non-Patent Document 2).

  In order to take measures against such threats caused by malware, it is necessary to investigate what kind of communication the malware performs and how it affects computer internal resources. Here, the computer internal resources indicate a nonvolatile storage medium, a volatile storage medium, and data stored in them.

  As a technique for analyzing the operation of the malware, a method for disassembling the binary data of the malware or a method using a debugger is generally used (see, for example, Non-Patent Document 3). However, recent malware has a mechanism that prevents disassembly and analysis by a debugger, and thus the difficulty in analysis is increasing (see Non-Patent Document 4).

  Moreover, as an analysis method that does not rely on disassembly or a debugger, a method of actually operating malware and monitoring internal resources and communication at that time (see Non-Patent Document 5) can be considered. In order to perform analysis safely without attacking existing general user computers, it is necessary to perform analysis in an environment that is not connected to the actual Internet.

Satoshi Koyama (Telecom-ISAC Japan) “Our security depends on your security.” Black Hat Japan 2005 Briefings "Infection via the Web has increased rapidly, and malware that" disappears "before it hits. Http://internet.watch.impress.co.jp/cda/news/2007/12/19/17941.html Konstantin Rozinov “REVERSE CODE ENGINEERING: An In-Depth Analysis of the Bagle Virus” Lucent Technologies Mark Vincent Yason “The Art of Unpacking” Black Hat USA 2007 Briefings Capture BAT http://www.nz-honeynet.org/capture-standalone.html The NewZealand Honeynet Project

  However, the disassembly and debugger analysis methods described above require advanced knowledge and techniques, and the analysis requires time from several hours to several days. In addition, the disassembly method existing in malware and the analysis obstruction method using a debugger make analysis more difficult, and the required analysis time is also increasing.

  For this reason, there is a problem that the conventional method using disassembly or a debugger cannot completely cope with the current situation in which about 70 new species / subspecies appear per day. Furthermore, the method of operating malware in an environment that is not connected to the actual Internet and observing its behavior has the problem that malware that does not operate normally cannot be analyzed unless the connection to the external Internet network can be confirmed. It was.

  The present invention was made to solve the above-described problems in the prior art and to solve the problems, avoids the difficulty of analysis using disassembly and a debugger, reduces the time required for analysis, Furthermore, it aims at providing the analysis system, the analysis method, and the analysis program which collect the information regarding a behavior also about the malware which performs a network connection confirmation, and implement | achieves an exact analysis.

  In order to solve the above-described problems and achieve the object, an analysis system, an analysis method, and an analysis program according to the present invention execute an unauthorized program when analyzing the behavior of an unauthorized program that performs an unauthorized operation in a computer. Providing an environment, constructing a virtual network connected to the execution environment, allowing the unauthorized program to access the virtual network, and information regarding the operation of the unauthorized program in the execution environment and / or the virtual network and the unauthorized program And collecting information related to communication with the behavior information of the malicious program.

  Further, according to the present invention, information related to communication protocols, communication payloads, communication destinations and called system calls, API (Application Program Interface), and internal resources for communication involving unauthorized programs is collected as the behavior information.

  In addition, according to the present invention, a real network connection means for connecting to an external real network and a part of communication involving the unauthorized program are connected to the real network.

  Further, according to the present invention, a communication protocol is identified by performing pattern matching between a communication payload and a pattern registered in advance.

  According to the present invention, a pseudo server response corresponding to the identified communication protocol is generated and transmitted to the unauthorized program.

  According to the present invention, the communication protocol of communication involving the malicious program is identified by pattern matching between the communication payload and a pre-registered pattern, and whether or not to connect the communication to the real network based on the identification result The communication is connected to the real network, the communication is executed by proxy, and the response obtained by the proxy execution is passed to the malicious program.

  In addition, according to the present invention, when performing communication by HTTP (Hypertext Transfer Protocol) on a real network, the parameter part of the GET request URL is deleted and connected to the real network.

  The analysis system, analysis method, and analysis program according to the present invention avoid the difficulty of analysis using a disassembler or debugger by taking a method of actually executing a malicious program to be analyzed in analyzing a malicious program. The analysis system, analysis method, and analysis program can be obtained to reduce the time required for analysis and to collect accurate information on the behavior of malware that checks network connections. Play.

  Exemplary embodiments of an analysis system, an analysis method, and an analysis program according to the present invention will be described below in detail with reference to the accompanying drawings.

  FIG. 1 is a schematic configuration diagram showing a schematic configuration of an analysis system in Embodiment 1 of the present invention. As shown in the figure, in the analysis system according to the present invention, malware is executed in the dynamic analysis system 1 using a virtual network that is not connected to the real Internet, and communication data, APIs to be called, system calls, and internal resources are executed. Monitor access.

  Data obtained by analysis by actually operating malware (hereinafter referred to as “dynamic analysis”) is stored in the malware analysis result database 2. The stored data is visualized and displayed as necessary data via the analysis result analysis / output module 3. This analysis system can be similarly applied to the case of analyzing a plurality of malware continuously.

  FIG. 2 is a specific configuration example of the analysis system according to the first embodiment. In the first embodiment, analysis is performed in a short time by executing malware in a virtual network that is not connected to the real Internet and collecting its behavior and communication contents.

  As shown in FIG. 2, the analysis system according to the first embodiment includes a dynamic analysis control module 4, a dynamic analysis system 1 including a malware execution environment 10 and a virtual network unit 20, a malware analysis result database 2, and an analysis result analysis. Consists of an output module 3 A single dynamic analysis system 1 may be configured to include a plurality of malware execution environments and virtual network units.

  The dynamic analysis control module 4 initializes the dynamic analysis system 1, transmits an analysis end signal, inputs malware to be analyzed into the malware execution environment 10, receives logs from the malware execution environment 10 and the virtual network unit 20, and malware Registration in the analysis result database 2 is performed.

  The malware execution environment 10 is an environment for executing malware input from the dynamic analysis control module 4. The virtual network unit 20 receives and stores the communication from the malware execution environment 10, and simultaneously determines the communication protocol, generates data according to the protocol, and transmits the data to the malware execution environment 10 as a response. The virtual network is realized by generating a server response according to this protocol.

  The malware analysis result database 2 includes analysis target malware, analysis status (unanalyzed / analyzed / under analysis), communication data collected by dynamic analysis, API and system calls, and access results to internal resources. Saved.

  The analysis result analysis / output module 3 organizes malware communication destinations, communication protocols, API call sequences, and the like from the malware analysis result database 2 and automatically processes and displays them in a chart.

  FIG. 3 is a flowchart showing the processing operation of the dynamic analysis control module 4 of the present invention. As shown in the figure, when the analysis is started, the malware analysis result database 2 is first inquired to confirm whether or not unanalyzed malware exists (step S101).

  As a result, when there is no unanalyzed malware (step S101, No), the analysis is terminated. On the other hand, when unanalyzed malware exists (step S101, Yes), the malware execution environment 10 is initialized (step S102) and the virtual network unit 20 (step S103) is initialized.

  In the initialization of the malware execution environment 10, an operation of rolling back to a clean state before the malware execution is performed. In the initialization of the virtual network unit 20, the payload database 25 in the virtual network is initialized.

  Next, the malware to be analyzed is transmitted to the malware execution environment 10 of the initialized dynamic analysis system 1 (step S104). The malware execution module 11 receives a result indicating whether or not the execution is successful (step S105) and registers it in the malware analysis result database 2 (step S106).

  If the execution of the malware is successful (step S107, Yes), the dynamic analysis control module 4 waits until the set analysis time elapses. When the set time has elapsed (step S108, Yes), an analysis completion signal is transmitted to the dynamic analysis system 1 (step S109), and data is acquired from the payload database 25 of the virtual network unit 20 (step S110). Data is registered in the malware analysis result database 2 (step S111). This series of processing is repeated until there is no unanalyzed malware.

  FIG. 4 is a flowchart showing the processing operation of the malware execution module 11. The malware execution module 11 receives malware from the dynamic analysis control module 4 (step S201, Yes) and executes it (step S202). The status indicating whether or not the execution is successful is transmitted to the dynamic analysis control module (step S203).

  If the execution of the malware is successful (step S204, Yes), the malware until the analysis end signal is received (step S206, Yes) in a state where the access to the API, system call, and internal resources is monitored (step S205). Continues its execution.

  FIG. 5 is a flowchart of processing operations related to malware behavior monitoring (API, system call, internal resource access monitoring). In this processing operation, what API is called by the malware (step S301), what system call is called (step S302), and registry access depending on the OS (for example, in the case of Windows (registered trademark)) (Read / write / delete) is monitored (step S303). Furthermore, the access (read / write / delete) to the file is also monitored (step S304).

  Then, the monitoring result is logged and registered in the malware analysis result database via the dynamic analysis control module (step S305).

  FIG. 6 is a flowchart showing the processing operation in the virtual network unit 20. The virtual network unit 20 receives communication from the malware execution environment 10 and returns a response corresponding to the protocol. First, the virtual network unit 20 receives communication data from the malware execution environment 10 (step S401), and performs its protocol discrimination (step S402).

  At the same time, the received payload is saved in the payload database 25 (step S403. Examples of the payload to be saved here include the source IP address, the destination IP address, and the data part of the IP packet. Examples of data include FQDN (Full Qualified Domain Name), nickname, and C & C server connection request of the C & C server (Command and Control Server) to which the bot program tries to connect. And survey of bot-infected terminals on the network.

  Furthermore, a server response is generated according to the determined protocol (step S403), and a response to the malware execution environment 10 is performed. A virtual network is realized by a server response according to this protocol. These processes are repeated until an analysis end signal is received. When the analysis end signal is received (step S405, Yes), data in the payload database 25 is transferred to the malware analysis result database 2 via the dynamic analysis control module 4. End the analysis.

  The payload data may be stored in the malware analysis result database 2 via the dynamic analysis control module 4 at any time during the dynamic analysis.

  FIG. 7 is a flowchart showing details of the protocol discrimination process. First, it is checked whether the destination address and destination port number of the communication received by the virtual network unit 20 are included in the list of destination address and destination port number in the protocol discrimination database 23 (step S501).

  FIG. 8 shows an example of a list of transmission destination addresses and transmission destination port numbers. When these matches are confirmed in the list (step S501, Yes), it is determined that the communication is a protocol registered in the list (step S504).

  If the match between the transmission destination address and the transmission destination port number cannot be confirmed (step S501, No), the payload received by the virtual network unit 20 is compared with the signature list of the protocol discrimination database 23 (step S502). An example of the signature list is shown in FIG. Note that a protocol not illustrated in the figure can be added.

  If the signature matches (step S503), it is determined that the communication is based on the registered protocol (step S506). If the signature does not match (step S503), the protocol cannot be determined (step S505). return.

  FIG. 10 is a flowchart for explaining the details of the server response generation process. If the protocol discrimination module 21 succeeds in the protocol discrimination (step S601, Yes), it is confirmed whether a response corresponding to each protocol is defined (step S602).

  As a result, when the server response is defined (step S602, Yes), the response as defined is returned (step S603). An example of response definition is shown in FIG. As an example of DNS (Domain Name System) response, it is possible to associate an arbitrary address in the virtual network with the FQDN requested, and return the address to the malware execution environment. Depending on the definition, processing that does not return a response can also be included.

  FIG. 12 is a schematic configuration diagram illustrating a schematic configuration of the analysis system according to the second embodiment of the present invention. As shown in the figure, in the analysis system according to this embodiment, malware is executed in the dynamic analysis system 1a using a virtual network that can be connected to a real Internet network only by communication using a specific protocol, and communication data and Monitors APIs to be called, system calls, and access to internal resources.

  Data obtained by the dynamic analysis is stored in the malware analysis result database 2. The stored data is visualized by a chart through the analysis result analysis / output module 3. It is good also as a structure which performs several malware continuously.

  FIG. 13 shows a specific configuration example of the analysis system according to the second embodiment. In the second embodiment, malware is executed in a virtual network in which only communication using a specific protocol can be connected to the real Internet, and its behavior and communication contents are collected, thereby realizing analysis in a short time.

  As shown in FIG. 13, in the analysis system according to the second embodiment, the dynamic analysis control module 4, the dynamic analysis system 1a including the malware execution environment 10 and the virtual network unit 20a, the malware analysis result database 2, and the analysis results It comprises an analysis / output module 3. A single dynamic analysis system 1 may be configured to include a plurality of malware execution environments and virtual network units.

  The dynamic analysis control module 4 initializes the dynamic analysis system 1a, transmits an analysis end signal, inputs malware to be analyzed into the malware execution environment 10, receives logs from the malware execution environment 10 and the virtual network unit 20a, and malwares Registration in the analysis result database 2 is performed.

  The malware execution environment 10 is an environment for executing malware input from the dynamic analysis control module 4. The virtual network unit 20a receives and stores the communication from the malware execution environment 10, and simultaneously performs protocol discrimination. Then, after determining the protocol, referring to the communication destination address, communication destination port number, protocol, and payload received from the malware execution module 11, the external connection control module 26 communicates by connecting to the real Internet, or virtual It controls whether data corresponding to the protocol is generated inside the network and sent to the malware execution environment 11 as a response.

  The malware analysis result database 2 stores analysis target malware, analysis status (unanalyzed / analyzed / under analysis), communication data collected by dynamic analysis, API and system calls, and access results to internal resources. . Here, in the communication data collected by the dynamic analysis, in addition to the communication from the malware execution module 11, the communication result with the external Internet network is also stored.

  The analysis result analysis / output module 3 organizes malware communication destinations, communication protocols, API call sequences, and the like from the malware analysis result database 2 and automatically processes and displays them in a chart.

  The specific processing operation of the dynamic analysis control module in FIG. 13 is the same as the processing operation described with reference to FIG. Further, the malware execution module 11 of FIG. 13 and the API, system call, and internal resource access performed therein are the same as the processing operations described with reference to FIGS. 4 and 5 in the first embodiment. Then, explanation is omitted.

  FIG. 14 is a flowchart showing the processing operation in the virtual network unit 20a. The virtual network unit 20a receives communication from the malware execution environment 10, and returns communication data received from the internal server response generation module 24 or the real Internet according to the communication content.

  First, the virtual network unit 20a receives communication data from the malware execution environment 10 (step S701), and the protocol is determined (step S702). At the same time, the received payload is stored in the payload database (step S703). Examples of the payload stored here include an IP packet source IP address, a destination IP address, and a data part. Specific examples of data that can be acquired at the time of analysis include the FQDN and nickname of the C & C server that the bot program attempts to connect to, and a C & C server connection request.

  Thereafter, it is determined by the external connection control module 26 whether to connect to a server existing on the real Internet or to respond by the server response generation module 24 in the virtual network (step S704). The processing of the protocol discrimination module 21 and the server response generation module 24 has been described with reference to FIG. 7 and FIG.

  These processes are repeated until an analysis end signal is received. When a signal is received (step S705, Yes), data in the payload database 25 is transferred to the malware analysis result database 2 via the dynamic analysis control module 4 (step S705). S707), the analysis is terminated.

  The payload data may be stored in the malware analysis result database 2 via the dynamic analysis control module 4 at any time during the dynamic analysis.

  FIG. 15 is a flowchart showing the processing of the external connection control module 26. The external connection control module 26 connects the communication data received from the malware execution environment 10 to a server on the real Internet based on the connection management signature database 27 or responds by the server response generation module 24 in the virtual network. To decide.

  In determining whether or not to connect to a server on the real Internet, first, it is confirmed whether or not the protocol determined in advance is included in the connection management list (step S801). If it is included (step S802, Yes), the actual connection destination address (step S803), payload (step S804), and payload length (step S805) of the communication are compared with the list pattern. The comparison of the connection destination address and the payload includes a regular expression. For example, the connection management list may be created as shown in FIG.

  If any one of the connection destination address / payload / payload length does not match (No in steps S803 to S805), a response generated in the virtual network is transmitted to the malware execution module. (Step S813).

  Further, as a result of the above comparison, even when the communication is registered in the connection management list as not permitting connection to the real Internet (step S806, No), a response is generated inside the virtual network. (Step S813).

  On the other hand, if it is determined to connect to the real Internet (step S807) and payload processing is unnecessary (step S808), the external connection control module 26 connects to a server on the real internet and receives the communication received through the virtual network. Data is transmitted (step S810).

  When payload processing is necessary (step S808, Yes), after processing the payload received by the virtual network (step S809), the data is transmitted to a server on the external Internet (step S811).

  Payload processing is a mechanism for preventing general users from attacking. When connecting to the outside with HTTP, the parameter part in the GET request URI (Uniform Resource Identifier) (the back part of “?” In the case of http://www.example.com/index.php?name=hoge?pass=fuga) By deleting the URL, it is possible to prevent attacks with vulnerabilities in HTTP server applications and spam activities on bulletin boards.

  As described above, the session from the execution environment 10 is terminated inside the virtual network, and the external connection control module 26 connects to the real Internet. Data received from the outside by the external connection control module 26 is stored in the payload database 25 and stored in the malware analysis result database 2 via the dynamic analysis control module 4 (step S812).

  An example of data included in the payload obtained via the external connection control module is the command sent by the attacker to the bot. By analyzing the behavior of the bot that received the command, the attacker It becomes possible to grasp the attacking behavior that is going to be performed using the Internet.

  As described above, according to the present invention, malware is executed on a virtual network, and the communication at that time and the access status to the API, system call, and internal resource to be called are monitored, and the characteristic seen in the malware It is possible to collect various behaviors in a short time.

  In the configuration shown in the first embodiment, since malware is executed on a virtual network that is not connected to the real Internet, the risk of performing an attack on a computer existing on the real Internet is avoided. In addition, since it is a technique that does not take techniques such as disassembly and debugging, it solves the difficulty of analysis.

  In the configuration shown in the second embodiment, malware is executed on a virtual network that can connect only to a specific protocol to the real Internet, thereby realizing behavior analysis when an attacker issues a command and controls the malware. . Perform attacks on the external Internet network by restricting some of the protocols that connect to the outside (for example, restricting connections to the outside so that commands from external attackers are taken into the virtual network) Risk can be reduced.

  Then, the data obtained by the analysis using the virtual network that is not connected to the real Internet (Example 1) or partly connected (Example 2) was obtained by the present invention in order to apply to malware threat countermeasures. Necessary data such as the communication destination address, communication content, and API call sequence are automatically extracted from the analysis result, processed into a chart, and displayed. As a result, the network operator can immediately grasp the analysis result of the malware, and it is possible to suppress the attack activity by the communication control and to identify the infected person.

  That is, the effect obtained by the present invention is that malware behavior analysis results can be collected in a short time. Previously, malware binary data was analyzed by disassembly or a debugger. However, this method requires a high level of expertise, and at the same time, the analysis requires time from several hours to several days. It was. In particular, in recent years, malware with a mechanism that makes disassembly and debugger analysis more difficult has appeared, and the difficulty of analysis and the time required for analysis have increased. On the other hand, in the present invention, it is possible to reduce the difficulty in these analyzes and to know the behavior of malware easily and safely.

  In addition, by passing only communication related to the exchange of instructions to the malware from the attacker on the Internet, the attacker issues what instructions and the behavior of the malware in response to the instructions. It became possible to grasp in real time. As a result, the network operator can quickly detect the communication of the user infected with malware.

  The system configuration shown in the first and second embodiments may be formed by connecting a plurality of computers, or may be configured as a program that operates on a single computer. Also, some or all of the components of the system can be realized by dedicated hardware.

  As described above, the analysis system, the analysis method, and the analysis program according to the present invention are useful for analyzing a malicious program, and are particularly suitable for collecting information on a malicious program that operates based on network connection.

It is a schematic block diagram which shows the schematic structure of the analysis system in Example 1 of this invention. 1 is a specific configuration diagram of an analysis system in Example 1. FIG. 4 is a flowchart showing processing operations of a dynamic analysis control module 4. 4 is a flowchart showing a processing operation of a malware execution module 11. It is a flowchart explaining the processing operation | movement of malware behavior monitoring. 3 is a flowchart showing processing operations in a virtual network unit 20. It is a flowchart showing the detail of a protocol discrimination | determination process. It is explanatory drawing explaining the list | wrist of a transmission destination address and a transmission destination port number. It is explanatory drawing explaining a signature list. It is a flowchart explaining the detail of a server response production | generation process. It is explanatory drawing explaining the definition of a server response. It is a schematic block diagram which shows the schematic structure of the analysis system in Example 2 of this invention. It is a specific block diagram of the analysis system in Example 2. It is a flowchart showing the processing operation in the virtual network part 20a. 4 is a flowchart showing processing of an external connection control module 26. It is explanatory drawing explaining a connection management list.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1,1a Dynamic analysis system 2 Malware analysis result database 3 Analysis result analysis and output module 4 Dynamic analysis control module 10 Malware execution environment 11 Malware execution module 20, 20a Virtual network part 21 Protocol discrimination module 23 Protocol discrimination database 24 Server response Generation module 25 Payload database 26 External connection control module 27 Connection management signature database

Claims (9)

An analysis system that analyzes the behavior of a malicious program that performs unauthorized operations in a computer.
Execution environment providing means for providing an execution environment for executing the malicious program;
A virtual network providing means for constructing a virtual network connected to the execution environment and allowing the unauthorized program to access the virtual network;
Information collecting means for collecting information on the operation of the malicious program in the execution environment and / or information on communication between the virtual network and the malicious program as behavior information of the malicious program;
A real network connection means for connecting to an external real network;
Connection control means for connecting a part of communication involving the unauthorized program to the real network;
Bei to give a,
The connection control means identifies a communication protocol of communication involving the malicious program by pattern matching between a communication payload and a pre-registered pattern, and determines whether to connect the communication to the real network based on the identification result When the communication connected to the real network is proxy-executed, the response obtained by the proxy execution is passed to the unauthorized program, and the HTTP (Hypertext Transfer Protocol) communication is proxy-executed to the real network. In addition, the analysis system is characterized in that the parameter part of the GET request URL is deleted and connected to the real network . The analysis system according to claim 1 , wherein the virtual network providing unit identifies a communication protocol by performing pattern matching between a communication payload and a pattern registered in advance . The analysis system according to claim 1, wherein the virtual network providing unit generates a pseudo server response corresponding to the identified communication protocol and transmits the pseudo server response to the malicious program . The analysis according to any one of claims 1 to 3, wherein the information collecting unit collects information related to a communication protocol, a communication payload, and a communication destination of communication involving the malicious program as the behavior information. system. An analysis method for analyzing the behavior of a malicious program that performs unauthorized operations in a computer,
An execution environment providing step for providing an execution environment for executing the malicious program;
A virtual network providing step of constructing a virtual network connected to the execution environment and allowing the unauthorized program to access the virtual network;
An information collecting step of collecting information on the operation of the malicious program in the execution environment and / or information on communication between the virtual network and the malicious program as behavior information of the malicious program;
A real network connection process for connecting to an external real network;
A connection control step of connecting a part of communication involving the malicious program to the real network;
Including
The connection control step identifies the communication protocol of communication involving the malicious program by pattern matching between a communication payload and a pre-registered pattern, and whether to connect the communication to the real network based on the identification result When the communication connected to the real network is proxy-executed, the response obtained by the proxy execution is passed to the unauthorized program, and the HTTP (Hypertext Transfer Protocol) communication is proxy-executed to the real network. And an analysis method characterized by deleting the parameter part of the GET request URL and connecting to the real network. The analysis method according to claim 5, wherein the virtual network providing step identifies a communication protocol by performing pattern matching between a communication payload and a previously registered pattern. The analysis method according to claim 5 or 6, wherein the virtual network providing step generates a pseudo server response according to the identified communication protocol and transmits the pseudo server response to the malicious program. The analysis according to any one of claims 5 to 7, wherein the information collecting step collects information related to a communication protocol, a communication payload, and a communication destination of communication involving the malicious program as the behavior information. Method. The analysis program for functioning a computer as an analysis system as described in any one of Claims 1-4.

Images