JP5121622B2 - Access destination scoring method and program - Google Patents

Description

  The present invention relates to an access destination scoring technique in a communication network.

  In order to avoid virus infection and harmful information, Internet access destinations such as websites and domain names are scored according to the possibility of infection and the degree of harm (hereinafter referred to as malignancy). Measures such as blocking access to a scored access destination are being taken.

  However, it is difficult to score all the huge access destinations, and these scoring is not always reliable. Therefore, even if not malignant, it can occur both when judged as a high score access destination (false positive) and when scored as low score despite malignancy (false negative).

  Here, there is a high possibility that an access destination accessed by another access source (such as a user terminal) for the malicious access destination is malicious. For example, it is known that a terminal that accesses a Web site in which a virus is embedded often accesses a specific site for receiving an attack instruction or the like as a behavior due to the virus.

  In Japanese Patent Application Laid-Open No. 2004-151867, based on such a concept, based on a small number of access destinations determined to be malignant, other access destinations characteristic of the user terminal group for the access destination are considered to be highly related to the original access destination. Proposed a method to determine the access destination and avoid the false negative. However, in Patent Document 1, the access source-access destination relationship is used only once, and an access destination having a high degree of association with the newly extracted malicious access destination is not extracted as a malicious access destination. There was a problem that the problem of false positives could not be avoided.

  Further, Non-Patent Document 1 proposes a technique for obtaining the degree of association between words using the relationship between words and contexts as in the relationship between access sources and access destinations. In this method, the relationship between words and context is regarded as a bipartite graph, and the degree of association between words is obtained by repeatedly calculating scores on this graph. By applying this method to the access source and the access destination, the degree of association between the access destinations can be calculated, and the access destination does not have a common access source according to the degree of association with the malicious access destination. Can also be scored. However, the problem of false positives remains. Further, as described in Non-Patent Document 1, there is a problem that the score of an access destination having a large number of access sources becomes high.

JP 2006-352395 A Mamoru Komachi, Taku Kudo, Hitoshi Shinho, Yuji Matsumoto, “Definition of Semantic Similarity Using Kernel Method and Generalization of Bootstrap”, 14th Annual Conference of Language Processing Society, March 2008.

  In view of the above problems, the present invention uses not only a diffusion score obtained by diffusing an initial score on an access source-access destination bipartite graph but also an inverted diffusion score obtained by diffusing a score obtained by inverting an initial score. Access destination scoring.

  An object of the present invention is to provide a technique for eliminating false positives and false negatives of a malignant list using a relationship between an access destination and an access source with respect to a previously given malignant list.

  Of the inventions disclosed in this specification, the outline of typical ones will be briefly described as follows.

  The present invention is an access destination scoring method in an access destination scoring device, wherein the access destination scoring device includes an access destination initial score acquisition unit, an access destination-access source access log acquisition unit, and a degree of association between access destinations. A calculation unit and an access destination scoring unit, wherein the access destination initial score acquisition unit acquires an initial score of one or more access destinations; and the access destination-access source access log acquisition unit The second step of acquiring the access log of the access source for the access destination, and the relationship between the access destinations is calculated from the access log obtained in the second step. A third step of calculating a degree, and the access destination scoring unit; A fourth step of calculating a diffusion score in which the initial score of the access destination is diffused to other access destinations according to the degree of association between the access destinations obtained in the third step, and the access destination scoring unit includes: An inverted diffusion score obtained by diffusing the score obtained by inverting the initial score of the access destination obtained in the first step to other access destinations based on the degree of association between the access destinations obtained in the third step is calculated. The fifth step and the access destination scoring unit calculates a diffusion score ratio using a ratio between the diffusion score obtained in the fourth step and the inverted diffusion score obtained in the fifth step. And a sixth step.

  According to the present invention, a malignant list given in advance with respect to an Internet access destination such as a website or a domain name is used to eliminate false positives and false negatives of the malignant list using the relationship between the access destination and the access source. Can do.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a block diagram illustrating a configuration example of an access destination scoring apparatus according to an embodiment of the present invention. Reference numeral 101 denotes an access destination initial score acquisition unit, 102 denotes an access destination-access source access log acquisition unit, 103 denotes an access destination relevance calculation unit, and 104 denotes an access destination scoring unit.

  FIG. 2 is a flowchart showing the operation of the access destination scoring apparatus according to the embodiment of the present invention. 201 is a first step in which the access destination initial score acquisition unit 101 acquires initial scores of one or more access destinations. Reference numeral 202 denotes a second step in which the access destination-access source access log acquisition unit 102 acquires an access source access log for the access destination. 203 is a third step in which the inter-access-destination relevance calculation unit 103 calculates the relevance between the access destinations regarding the access source from the access log obtained in the second step. 204 is a diffusion in which the access destination scoring unit 104 spreads the initial score of the access destination obtained in the first step 201 to other access destinations according to the degree of association between the access destinations obtained in the third step 203. This is the fourth step of calculating the score. 205 is a score obtained by inverting the initial score of the access destination obtained in the first step 201 by the access destination scoring unit 104 according to the degree of association between the access destinations obtained in the third step 203. This is the fifth step of calculating the inverse diffusion score that has been diffused first. 206 is a sixth step in which the access destination scoring unit 104 calculates a diffusion score ratio using the ratio between the diffusion score obtained in the fourth step 204 and the inverted diffusion score obtained in the fifth step 205. It is.

  Hereinafter, the first to sixth steps will be described in detail.

  In the first step 201, the access destination initial score acquisition unit 101 acquires the initial score of the access destination.

  FIG. 3 is a diagram illustrating an example of a relationship between an access destination and an access source. Here, the domain name is taken as an example of the access destination, and the user host is taken as an example of the access source. Here, for example, an action such as a web access or name resolution by the user host to the domain name can be regarded as an access to the domain name. A domain name with a black background is a domain name scored with an initial score of high malignancy. Among them, the domain name “white.domain.labeled.black” is a domain erroneously determined as a malignant domain (false positive). A domain name with a white background is a domain name scored with an initial score of low malignancy. Among them, the domain name “black.domain.labeled.white” is assumed to be a domain (false negative) erroneously determined as low malignancy.

  In the first step 201, the access destination initial score acquisition unit 101 acquires initial scores for these seven domain names. Here, the initial score of the seven domain names is (1, 1, 1, 1, 0, 0, 0) in order from the top.

  At this time, in the second step 202, the access destination-access source access log acquisition unit 102 acquires the access log of the access source for the access destination. Here, the access log may be acquired from an access log on the server side, or may be acquired by observing network traffic.

  In the third step, the inter-access destination relevance calculation unit 103 calculates the relevance between domain names using the relationship between domain names and user hosts. Hereinafter, an embodiment of the relevance calculation method in the third step will be described.

(1) In relevance calculation method 1 (corresponding to claim 2), the access destination set is O, the number of elements is | O |, the access source set is D, and the number of elements is | D | -An adjacency matrix represented by Equation 1 having a size (| D | + | O |) × (| D | + | O |) represented by Equation 1 regarding a bipartite graph representing a connection relation of access destinations is represented by A = {A _ij }, when a unit matrix having the same size as A is I, the (i, j) component (1 ≦ i, j ≦ | D |) of the matrix K _N (β) expressed by Equation 2 is accessed. Assume the degree of association between the destination i and the access destination j.

  For example, a 7 × 6 matrix R indicating the relationship between 7 domain names and 6 user hosts is

And Formula 12 is an adjacency matrix representation of a connection graph of domain names and hosts. The element (i, j) is 1 when the column direction is the domain name, the row direction is the host, and the domain name i is accessed from the host j, and 0 otherwise. At this time, the adjacency matrix A between domain names and user hosts is

Where R ^t is a transpose matrix of R, 0 ₇ is a 7 × 7, 0 ₆ is a 6 × 6 zero matrix, and a 13 × 13 unit matrix of the same size as A is I and a parameter is β , The (i, j) component (1 ≦ i, j ≦ 7) of the matrix K _N (β) expressed by Equation 2 is used as the relevance between domain i and domain j. This is the degree of relevance according to the Neumann kernel described in Non-Patent Document 1. For example, when the beta = 0.01, _K domain name portion (upper left 7 × 7 submatrix) of _{N (β) K N (β} ) ' is

For example, the relevance between domain names xxx.xxx.xxx and yyy.yyy.yyy is 0.03, but the relevance between xxx.xxx.xxx and white.domain.labeled.black is 0. Become. Equation 14 is a 7 × 7 matrix indicating the degree of correlation between the seven domain names, and element (i, j) indicates the degree of association between domain name i and domain name j. xxx.xxx.xxx is the first domain name, yyy.yyy.yyy is the second domain name, and white.domain.labeled.black is the fourth domain name. , (1, 4) to see the relevance.

(2) In the relevance calculation method 2 (corresponding to claim 3), a predetermined parameter β and the adjacency matrix A = {a _ij } of the relevance calculation method 1 (corresponding to claim 2) For the matrix L = {l _ij } shown, the access destination i and the access destination are the (i, j) components (1 ≦ i, j ≦ | D |) of the matrix K _D (β) expressed by Equation 4. The degree of association between j.

In this relevance calculation method, the (i, j) component (1 ≦ i, j ≦ 7) of the matrix K _D (β) expressed by Equation 4 is used as the relevance between domain i and domain j. To do. This is the degree of relevance by the diffusion kernel described in Non-Patent Document 1.

(3) In the relevance calculation method 3 (corresponding to claim 4), for the predetermined parameter β and the matrix L = {l _ij } of the relevance calculation method 2 (corresponding to claim 3), Equation 5 The (i, j) component (1 ≦ i, j ≦ | D |) of the matrix K _L (β) shown in FIG.

In this relevance calculation method, the (i, j) component (1 ≦ i, j ≦ 7) of the matrix K _L (β) expressed by Equation 5 is used as the relevance between domain i and domain j. To do. This is the degree of relevance according to the regular Laplacian kernel described in Non-Patent Document 1.

In the above relevance calculation, the relevance is calculated using the power of the adjacency matrix A expressed by Equation 1. The power of the adjacency matrix A and the (i, j) component of A ^k indicate how many paths go from the access destination i to j in k steps. For example, in adjacency matrix A that is computed by Equation 13, the ^{A 2} (1, 2) component is 3, which is the path connecting the access destination xxx.xxx.xxx and yyy.yyy.yyy in two steps, Host1 , Host 2, and Host 3. Therefore, in the relevance calculation using the adjacency matrix A, the relevance increases when the number of paths from the access destination i to the access destination j is large.

  On the other hand, a method of using the ratio of the number of paths having the access destination j as the end point in the k steps starting from the access destination i in the relevance calculation is also conceivable. In this case, it is necessary to calculate the degree of association using a matrix obtained by normalizing the values of the adjacency matrix. In the following relevance calculation methods 4 and 5 (corresponding to claims 5 and 6), the relevance calculation is performed using the normalized adjacency matrix T.

(4) In the relevance calculation method 4 (corresponding to claim 5), in the relevance calculation method 1 (corresponding to claim 2), instead of the matrix A, a matrix T = {t _ij } Is used.

(5) In the relevance calculation method 5 (corresponding to claim 6), in the relevance calculation method 2 or 3 (corresponding to claim 3 or 4), when calculating the matrix L, Equation 6 is used instead of the matrix A. Use the represented matrix T = {t _ij }.

  As described above, the degree of association between access destinations can be calculated by the above method using a matrix. However, when the number of access destinations is enormous, a large-scale matrix may not be calculated. In such a case, the relevance calculation method shown below generates a random walk on the bipartite graph of the access destination-access source as shown in FIG. 3, starting from the access destination, and appears in the random walk. The degree of association with the start point access destination is calculated using the information on the number of appearances, the appearance location, and the number of different paths to the appearance location.

  (6) In relevance calculation method 6 (corresponding to claim 7), a random walk on an access source-access destination bipartite graph is generated starting from a certain access destination i, and the access destination that appears in the random walk The degree of association with the start point access destination is calculated using information on the number of appearances, the appearance location, and the number of different paths to the appearance location.

  Hereinafter, a more specific embodiment of the relevance calculation method using a random walk will be described.

(6-1) In the degree-of-association calculation method 6-1 (corresponding to claim 8), n random walks having a predetermined length l are generated starting from the access destination i, and appearing places in the random walk Is a value that is incremented by 1 from l of the start point access destination, and the access destination i and the access destination j are jk when the number of appearances of the access destination j at the appearance location k is n _k and the number of different paths is p _k. Using the predetermined parameter β,

The value calculated by.

In this relevance calculation method, when the number of appearances of the access destination j at the appearance location k is n _k and the number of different paths is p _k , the relevance between the access destination i and the access destination j is determined by a predetermined parameter. Using β, calculation is performed according to Equation 7 .

(6-2) In the relevance calculation method 6-2 (corresponding to claim 9), when n random walks starting from the access destination i and ending with a predetermined probability p are generated, the appearance access destination When the number of appearances of the access destination j at the appearance location k in the random walk is n _k and the number of different paths is p _k , the degree of association between the access destination i and the access destination j is

And

  In this relevance calculation method, the random walk is terminated with a fixed probability p, not a fixed-length random walk. By ending with a certain probability, the appearance probability of a path with a long number of steps is reduced, so that the necessity of the β power is not necessary when calculating the degree of association.

(6-3) In the relevance calculation method 6-3 (corresponding to claim 10), n random walks having a predetermined length l are generated starting from the access destination i, and appearing places in the random walk When the number of appearances of the access destination j at the appearance location k is n _k , where the relevance degree between the access destination i and the access destination j is Using the defined parameter β

And

(6-4) In the relevance calculation method 6-4 (corresponding to claim 11), when n random walks starting from the access destination i and ending with a predetermined probability p are generated, When the number of appearances of the access destination j at the appearance location k is n _k when the appearance location is set to a value that increases by 1 from 1 of the start point access destination, the degree of association between the access destination i and the access destination j is , Using a predetermined parameter β,

And

  In the relevance calculation methods 6-3 and 6-3, the number of appearances is used instead of the number of appearance paths. This is the ratio of the number of paths having the access destination j as the end point of all the k-step paths starting from the access destination i described in the relevance calculation methods 4 and 5 (corresponding to claims 5 and 6). The method used for the calculation is implemented by random walk simulation.

In the fourth step 204, the access destination scoring unit 104 assigns the initial score of the access destination obtained in the first step 201 to other access destinations according to the degree of association between the access destinations obtained in the second step 202. Calculate the diffuse diffusion score. In FIG. 3, the initial score vector (1, 1, 1, 1, 0, 0, 0) ^t
In this case, for example, the diffusion score calculated using the relevance expressed by Equation 2 calculated by the relevance calculation method 1 (corresponding to claim 2) is:
(0.09, 0.09, 0.09, 0.02, 0.09, 0.02, 0.02) ^t
It becomes.

In the fifth step 205, the score obtained by inverting the initial score of the access destination obtained in the first step 201 by the access destination scoring unit 104 is determined according to the degree of association between the access destinations obtained in the second step 202. The inverse diffusion score diffused to other access destinations is calculated. In FIG. 1, the initial score vector (1,1,1,1,0,0,0) ^t
, The inverted score vector is (0,0,0,0,1,1,1) ^t
It becomes. For example, the inversion diffusion score calculated using the relevance represented by Formula 2 calculated by the relevance calculation method 1 (corresponding to claim 2) is:
(0.03, 0.03, 0.03, 0.04, 0.03, 0.06, 0.06) ^t
It becomes.

In the sixth step 206, a diffusion score ratio using the ratio between the diffusion score obtained in the fourth step 204 and the inverted diffusion score obtained in the fifth step 205 is calculated. In FIG. 1, the initial score vector is (1,1,1,1,0,0,0) ^t
And the diffusion score ratio calculated by the relevance calculation method 4-1 (corresponding to claim 8) of the diffusion score and the inverted diffusion score calculated by the relevance calculation method 1 (corresponding to claim 2) is:
(0.75,0.75,0.75,0.33,0.75,0.25,0.25) ^t
It becomes. Thus, the domain name “xxx.xxx.xxx” remains high in spreading score ratio while the domain name “white.domain.labeled.black” has a spreading score ratio even though the initial score is 1. Is as low as 0.33. The domain name “aaa.aaa.aaa” has a low diffusion score ratio, whereas the domain name “black.domain.labeled.white” has an initial score of 0, but the diffusion score ratio is It is as high as 0.75.

  That is, since the diffusion score ratio of the domain name “white.domain.labeled.black” that is false positive is low, it can be estimated that the domain name “black.domain.labeled.white” is false. Since the diffusion score ratio of “is high, it can be estimated to be positive. In this way, by using the relationship between the access destination and the access source with respect to the malignant list given in advance with respect to the Internet access destination such as the website and the domain name, by obtaining the diffusion score ratio, False positives and false negatives can be excluded.

  The access destination scoring apparatus described above can be composed of a computer and a program. Moreover, you may comprise a part or all of the program with a hardware.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Of course.

It is a block diagram which shows the structural example of the access destination scoring apparatus in the Example of this invention. It is a flowchart which shows operation | movement of the access destination scoring apparatus of the Example of this invention. It is the figure which showed the relationship of an access destination-access source by taking a domain name as an access destination and a user host as an access source.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 ... Access destination initial score acquisition part, 102 ... Access destination-access source access log acquisition part, 103 ... Access destination relevance calculation part, 104 ... Access destination scoring part, 201 ... First step, 202 ... First 2 steps, 203 ... 3rd step, 204 ... 4th step, 205 ... 5th step, 206 ... 6th step

Claims (13)

An access destination scoring method in an access destination scoring device,
The access destination scoring device includes an access destination initial score acquisition unit, an access destination-access source access log acquisition unit, an access destination relevance calculation unit, and an access destination scoring unit.
A first step in which the access destination initial score acquisition unit acquires initial scores of one or more access destinations;
A second step in which the access destination-access source access log acquisition unit acquires an access log of an access source for the access destination;
A third step in which the inter-access-destination relevance calculating unit calculates a relevance between the access destinations regarding the access source from the access log obtained in the second step;
The access destination scoring unit spreads the diffusion score obtained by diffusing the initial score of the access destination obtained in the first step to other access destinations according to the degree of association between the access destinations obtained in the third step. A fourth step of calculating;
The access destination scoring unit assigns a score obtained by inverting the initial score of the access destination obtained in the first step to another access destination according to the degree of association between the access destinations obtained in the third step. A fifth step of calculating a diffuse inverted diffusion score;
A sixth step in which the access destination scoring unit calculates a diffusion score ratio using a ratio between the diffusion score obtained in the fourth step and the inverted diffusion score obtained in the fifth step;
An access destination scoring method comprising: The access destination scoring method according to claim 1,
In the third step, the access destination set is O, the number of elements is | O |, the access source set is D, and the number of elements is | D |. For the subgraph, the adjacency matrix represented by Equation 1 of the size (| D | + | O |) × (| D | + | O |) represented by Equation 1 is A = {a _ij }, which has the same size as A When the unit matrix is I, the degree of association between the access destination i and the access destination j is the (i, j) component (1 ≦ i, j ≦ | D |) of the matrix K _N (β) expressed by Equation 2 And an access destination scoring method.

The access destination scoring method according to claim 1,
In the third step, the matrix L = {l _ij } represented by Equation 3 using the predetermined parameter β and the adjacency matrix A = {a _ij } according to claim 2 is expressed by Equation 4. Access destination scoring method, wherein the (i, j) component (1 ≦ i, j ≦ | D |) of the matrix K _D (β) to be processed is used as the degree of association between the access destination i and the access destination j .

The access destination scoring method according to claim 1,
In the third step, the (i, j) component (1) of the matrix K _L (β) expressed by Equation 5 with respect to the predetermined parameter β and the matrix L = {l _ij } according to claim 3. ≦ i, j ≦ | D |) is defined as the degree of association between the access destination i and the access destination j.

The access destination scoring method according to claim 2,
Instead of the matrix A, a matrix T = {t _ij } expressed by Equation 6 is used.

The access destination scoring method according to claim 3 or 4,
6. The access destination scoring method according to claim 5, wherein a matrix T = {t _ij } according to claim 5 is used instead of the matrix A when calculating the matrix L. The access destination scoring method according to claim 1,
In the third step, a random walk on an access source-access destination bipartite graph is generated with a certain access destination i as a starting point, and the number of appearances and appearance locations for the access destinations that appear during the random walk. An access destination scoring method, wherein the degree of association with the start point access destination is calculated using information on the number of different paths to the appearance location. The access destination scoring method according to claim 7,
When n random walks having a predetermined length l are generated starting from the access destination i, and the appearance location in the random walk is set to a value that increases by 1 from l of the start access destination, the appearance location k When the number of appearances of the access destination j is n _k and the number of different paths is p _k , the degree of association between the access destination i and the access destination j is determined using a predetermined parameter β,

The access destination scoring method, wherein the scoring method is a value calculated by (1). The access destination scoring method according to claim 7,
When n random walks starting from the access destination i and ending with a predetermined probability p are generated, the number m of appearance access destinations, the number of appearances of the access destination j at the appearance location k in the random walk is n _k , When the number of different paths is _pk , the degree of association between the access destination i and the access destination j is

And an access destination scoring method. The access destination scoring method according to claim 7,
When n random walks having a predetermined length l are generated starting from the access destination i, and the appearance location in the random walk is set to a value that increases by 1 from l of the start access destination, the appearance location k When the number of appearances of the access destination j is n _k , the degree of association between the access destination i and the access destination j is determined using a predetermined parameter β,

And an access destination scoring method. The access destination scoring method according to claim 7,
When n random walks starting at the access destination i and ending with a predetermined probability p are generated, the appearance location when the appearance location in the random walk is set to a value that is incremented by 1 from the start access destination l When the number of appearances of the access destination j of _k is n _k , the degree of association between the access destination i and the access destination j is determined using a predetermined parameter β,

And an access destination scoring method. The access destination scoring method according to claim 1,
In the sixth step, when the diffusion score is b and the inverted diffusion score is w, the diffusion score ratio is

A scoring method for access destinations, characterized in that it is calculated by: It claims 1 to order the program to execute the access destination scoring method according to the computer in one of claims any one of 12.

Images