JP5478390B2 - Log extraction system and program - Google Patents

Description

  The present invention relates to a log extraction system that processes a log in which processing at the time of application execution is recorded. The present invention also relates to a program for causing a computer to function as the log extraction system.

  With the widespread use of mobile terminals that use a general-purpose OS (operating system) called an open platform, many applications for mobile terminals are sold and distributed through dedicated sites and personal sites on the communication network (Internet). . Applications for mobile terminals that use a general-purpose OS can be developed and distributed more easily than applications for mobile terminals that use an existing dedicated embedded OS.

  However, along with this, there are also applications that perform behavior that may cause the user's unintentional disadvantage, such as stealing personal information of the user, guiding to a malicious site, and taking over the administrator authority of the OS. Has appeared. Therefore, verifying the safety of an application in advance and detecting an unauthorized application is effective for realizing an environment where users can use the application with peace of mind, and providing an application with verified safety. It is also possible to differentiate from other companies, which is an important technology.

  Patent Document 1 describes a technique for preventing an unauthorized application from being executed in a terminal by performing application authentication when the application is downloaded to a terminal such as a mobile phone.

JP 2008-2521021 A

  As one of methods for determining whether or not the application of interest is an unauthorized application, a method of analyzing the behavior of the application when the application is executed can be considered. There are application logs and kernel logs as logs that record application behavior. The application log is a log in which information related to the execution condition and state of the application is recorded. The kernel log is a log in which information on system calls called by processes related to application processing is recorded.

  In the application log, the timing of starting and ending the process when the application is executed is recorded, but the processing contents of the process are not recorded. On the other hand, although the process contents of the process are recorded in the kernel log, information regarding which application process each process is associated with is not recorded. For this reason, it is difficult to know the details of the behavior of a specific application from each of the application log and the kernel log.

  The application log and the kernel log also record a large amount of information related to processes other than the process corresponding to the behavior of the application of interest. This information is redundant information when analyzing the behavior of the application. Since such redundant information is included, the analysis of the application log and the kernel log becomes inefficient.

  It is desirable to reduce unnecessary messages in the log because the collected application log and kernel log may be recorded and the application log and kernel log may be visually verified as necessary. This makes it possible to reduce the disk capacity of the system, reduce the time or amount of calculation required for analysis, and efficiently perform visual verification.

  The present invention has been made in view of the problems described above, and extracts a log that can extract an effective part for automatic analysis and visual verification from a log that records the behavior of an application, thereby reducing unnecessary parts. The object is to provide a system and program.

  The present invention has been made in order to solve the above-described problem, and is a first example in which application identification information, process identification information generated during the processing of the application, and processing contents of the application are associated with each other. 1 log, a log storage unit for storing a second log in which the identification information of the process and the execution contents of the system call are associated, and identification information of a specific application from the first log A first extraction unit that extracts identification information of the process associated with the second extraction unit that extracts a portion having the identification information of the process extracted by the first extraction unit from the first log And a third extraction unit for extracting a part having identification information of the process extracted by the first extraction unit from the second log, and aggregating the logs A rule information storage unit that stores rule information indicating a rule of the first log, and a part extracted by the second extraction unit or the third extraction unit according to the rule information to delete the first log Alternatively, the log extracting system includes a log aggregating unit that aggregates the second log.

  Further, in the log extraction system of the present invention, the rule information indicates that a part with a similar processing content of the application or execution content of the system call is deleted, and the log aggregation unit includes the second extraction unit. Alternatively, a portion similar to the processing content of the application or the execution content of the system call is deleted from the portion extracted by the third extraction unit.

  Further, in the log extraction system of the present invention, the rule information indicates that a portion of the application processing content indicating garbage collection is deleted, and the log aggregation unit is extracted by the second extraction unit. A part in which the processing content of the application indicates garbage collection is deleted from the part.

  Further, in the log extraction system of the present invention, the rule information indicates that a portion in which the execution content of the system call indicates a driver operation is deleted, and the log aggregation unit is configured such that the execution content of the system call is a driver. It is characterized in that a part indicating an operation is deleted.

  In the log extraction system of the present invention, the rule information indicates that the execution content of the system call deletes a portion indicating a file operation for a directory assigned to the specific application, and the log aggregation The section deletes a portion in which the execution content of the system call indicates a file operation on a directory assigned to the specific application.

  In addition, the present invention stores a first log in which application identification information, process identification information generated during processing of the application, and processing contents of the application are associated with each other. A log storage unit that stores a second log in which the identification information and the execution content of the system call are associated; and the process identification information associated with the identification information of a specific application is extracted from the first log From the first extraction unit, the second extraction unit that extracts the process identification information extracted by the first extraction unit from the first log, and the second log, A third extraction unit for extracting a part having identification information of the process extracted by the first extraction unit, and rule information indicating a rule for collecting logs are stored. The first log or the second log is aggregated by deleting a part from a part extracted by the rule information storage unit and the second extraction unit or the third extraction unit according to the rule information A log aggregating unit for causing the computer to function.

  According to the present invention, from the part extracted by the second extraction unit or the third extraction unit, a part is deleted according to the rule information, and the first log or the second log is aggregated, thereby automatically from the log. It is possible to extract portions that are effective for analysis and visual verification, and to reduce unnecessary portions.

It is a block diagram which shows the structure of the log extraction system by one Embodiment of this invention. It is a block diagram which shows the function structure of the portable terminal which the log extraction system by one Embodiment of this invention has. It is a block diagram which shows the function structure of the log analysis apparatus which the log extraction system by one Embodiment of this invention has. It is a reference figure which shows the content of the application log in one Embodiment of this invention. It is a reference figure which shows the content of the kernel log in one Embodiment of this invention. It is a block diagram which shows the function structure of the log analysis part in one Embodiment of this invention. It is a reference figure which shows the parent-child relationship of the process in one Embodiment of this invention. It is a sequence diagram which shows the procedure of operation | movement of the log extraction system by one Embodiment of this invention. It is a reference figure which shows the structure of the execution file of the application in one Embodiment of this invention. It is a flowchart which shows the procedure of operation | movement of the log extraction system by one Embodiment of this invention. It is a reference figure which shows the content of the manifest file in one Embodiment of this invention. It is a reference figure which shows the content of the application log in one Embodiment of this invention. It is a reference figure which shows the content of the kernel log in one Embodiment of this invention. It is a reference figure which shows the determination conditions set as an aggregation rule in one Embodiment of this invention. It is a flowchart which shows the procedure of operation | movement of the log extraction system by one Embodiment of this invention. It is a reference figure which shows the content of the kernel log in one Embodiment of this invention. It is a reference figure which shows the directory structure of the file memory | storage part in one Embodiment of this invention. It is a flowchart which shows the procedure of operation | movement of the log extraction system by one Embodiment of this invention. It is a reference figure which shows the content of the kernel log in one Embodiment of this invention. It is a reference figure which shows the content of the unauthorized communication other party list in one Embodiment of this invention. It is a block diagram which shows the function structure of the modification of the log extraction system by one Embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows the configuration of a log extraction system according to an embodiment of the present invention. The log extraction system according to the present embodiment includes a mobile terminal 1 such as a mobile phone terminal, a mobile information terminal, and a smartphone, and a log analysis device 2 such as a PC. The portable terminal 1 and the log analysis device 2 are connected by a cable 3 such as RS232C, and the portable terminal 1 can be operated from the log analysis device 2. The log extraction system according to this embodiment is installed in, for example, a company that manages a sales site that sells applications for mobile terminals on a communication network.

  FIG. 2 shows a functional configuration of the mobile terminal 1. The portable terminal 1 includes an application 10, an application log generation unit 11, a kernel log generation unit 12, a log generation control unit 13, an operation information control unit 14, an OS 15, a file storage unit 16, an operation unit 17, a display unit 18, and a communication unit 19. And a work area W1 (log storage unit).

  The application 10, the application log generation unit 11, the kernel log generation unit 12, the log generation control unit 13, the operation information control unit 14, and the OS 15 operate on a work area W1 configured by a device such as an SRAM. These execution files (programs) are stored in the file storage unit 16, and these execution files are activated by being read from the file storage unit 16 into the work area W1. In the work area W1, in addition to processes such as the application 10, various processes not shown are also activated. These processes notify the OS 15 of the call to the system call, and the OS 15 calls the system call, so that each process performs various processes using CPU resources (not shown).

  The application 10 calls a system call for the OS 15 and receives an execution result from the OS 15. As a result, the application 10 executes various processes defined as application processes, accesses the file storage unit 16, and the like.

  The application log generation unit 11 generates an application log (first log) in which information related to the execution condition and state of the application 10 is recorded. The generated application log is held in the work area W1.

  FIG. 4 shows an example of the application log. The application log includes a time stamp 400, a process ID 410, a process ID 420, a message type 430, a message tag, and a message body 440. The time stamp 400 includes a date and time. The behavior of the application is recorded in the application log using a set of one time stamp 400, parent process ID 410, process ID 420, message type 430, message tag and message body 440 as a recording unit. In the example shown in FIG. 4, the contents of the application log for five recording units are shown.

  A process can start another process by calling a process call system call. In the following, the starting process is called a parent process, and the process started by the parent process is called a child process. When the process ID 410 and the process ID 420 are different, the process ID 410 indicates the process ID of the parent process, and the process ID 420 indicates the process ID of the child process. When the process ID 410 and the process ID 420 are the same, the recording units having these process IDs indicate the behavior of the same process.

  The kernel log generation unit 12 generates a kernel log (second log) in which information on a system call called by a process related to the processing of the application 10 is recorded. The generated kernel log is held in the work area W1.

  FIG. 5 shows an example of the kernel log. The kernel log includes a process ID 500 and a message body 510. System call information is recorded in the kernel log using a set of one process ID 500 and message body 510 as a recording unit. In the example shown in FIG. 5, the contents of the kernel log for five recording units are shown. The application log and kernel log have different process ID management systems. For this reason, for the same process, the process ID recorded in the application log and the process ID recorded in the kernel log are different.

  The log generation control unit 13 performs processing for starting the application log generation unit 11 and the kernel log generation unit 12. Further, the log generation control unit 13 performs processing for transmitting the application log and the kernel log to the log analysis device 2.

  The operation information control unit 14 performs control related to operation information input by the operator operating the log analysis device 2. Specifically, the operation information control unit 14 communicates with the log analysis device 2, receives operation information indicating the operation content input to the log analysis device 2, interprets the content of the operation information, and notifies the OS 15 of the operation information. . The OS 15 that has received the notification executes various processes. Further, the operation information control unit 14 receives a notification of the execution result of the process from the OS 15 and transmits execution result information indicating the execution result to the log analysis device 2. In the following description of the operation, description of processing related to the execution result information is omitted.

  The OS 15 controls the scheduling of processes of the application 10, the application log generation unit 11, the kernel log generation unit 12, the log generation control unit 13, and the operation information control unit 14, the allocation of the work area W1, and the like, and the file storage unit 16 The input / output of each device of the operation unit 17, the display unit 18, and the communication unit 19 is controlled.

  The file storage unit 16 is configured by a device such as a flash memory, and stores various files such as an execution file used in the mobile terminal 1. The operation unit 17 includes devices such as keys (buttons) and switches, and outputs a signal based on a result of an operation performed by the operator. The display unit 18 is configured by a device such as a liquid crystal display device, and displays a result of processing executed by the mobile terminal 1, a state of the mobile terminal 1, and the like. The communication unit 19 includes a device such as a communication module, and communicates with the log analysis device 2.

  FIG. 3 shows a functional configuration of the log analysis device 2. The log analysis device 2 includes a log analysis unit 20, an operation information control unit 21, an OS 22, a file storage unit 23 (rule storage unit), an operation unit 24, a display unit 25, and a communication unit 26.

  The log analysis unit 20, the operation information control unit 21, and the OS 22 operate on a work area W2 configured by a device such as SRAM. These execution files (programs) are stored in the file storage unit 23, and these execution files are activated by being read from the file storage unit 23 into the work area W2. In the work area W2, various processes (not shown) are started in addition to processes such as the log analysis unit 20 and the like. These processes notify the OS 22 of the call of the system call, and the OS 22 calls the system call, so that each process performs various processes using CPU resources (not shown).

  The log analysis unit 20 analyzes the application log and the kernel log received from the mobile terminal 1, and determines whether or not the application of interest is an unauthorized application.

  The operation information control unit 21 performs control related to operation information based on operation contents input by the operator operating the operation unit 24. Specifically, the operation information control unit 21 communicates with the mobile terminal 1, transmits operation information indicating the operation content input to the operation unit 24, and receives execution result information indicating an execution result. The OS 22 controls processing scheduling of the log analysis unit 20 and the operation information control unit 21, assignment of the work area W <b> 2, and the like, as well as the file storage unit 23, the operation unit 24, the display unit 25, and the communication unit 26. Control input and output.

  The file storage unit 23 is composed of a device such as a hard disk drive, and stores various files such as an execution file used in the log analysis device 2. The operation unit 24 is configured by a device such as a keyboard and a mouse, and outputs a signal based on a result of an operation performed by the operator. The display unit 25 includes a device such as a liquid crystal display device, and displays an execution result based on the execution result information, a processing result of the log analysis unit 20, and the like. The communication unit 26 includes a device such as a communication module, and communicates with the mobile terminal 1.

  FIG. 6 shows a functional configuration of the log analysis unit 20. The log analysis unit 20 includes a process ID extraction unit 20a (first extraction unit), an application log extraction unit 20b (second extraction unit), a kernel log extraction unit 20c (third extraction unit), a log aggregation unit 20d, It has a file operation content extraction unit 20e, a communication content extraction unit 20f, a determination unit 20g, and a control unit 20h.

  The process ID extraction unit 20a extracts the process ID of the process related to the processing of the application 10 of interest from the application log. FIG. 7 shows an example of a parent-child relationship of processes. FIG. 7 shows a state in which an init process that is started first on the system starts a child process, and the child process starts its own child process as a parent process.

  As an example, the process sshd (process ID: 2005) of the process group 700 of the application 10 of interest is started by the init process, and the process sshd (process ID: 1921) and the process sshd (process ID: 8167) are started. The process sshd (process ID: 1921) and the process sshd (process ID: 8167) also start child processes. The process ID extraction unit 20a extracts the process ID of each process having a parent-child relationship for the application 10 of interest. That is, in the example shown in FIG. 7, 2005, 1921, 1931, 2333, 2345, 8167, 8323, and 10940 are extracted as process IDs.

  The application log extraction unit 20b extracts a part having the process ID extracted by the process ID extraction unit 20a, that is, a part related to processing of the application of interest from the application log. The kernel log extraction unit 20c extracts a part having the process ID extracted by the process ID extraction unit 20a, that is, a part related to processing of the application of interest from the kernel log.

  The log aggregating unit 20d aggregates the application log and the kernel log by deleting unnecessary portions according to a predetermined aggregation rule from the portion extracted by the application log extracting unit 20b and the portion extracted by the kernel log extracting unit 20c. . The file storage unit 23 stores an aggregation rule (rule information) indicating an aggregation rule, and the log aggregation unit 20d aggregates logs based on the aggregation rule.

  The log analysis unit 20 of the present embodiment has an application determination function that determines whether or not an application is illegal as an example of automatic log analysis. The file operation content extraction unit 20e, the communication content extraction unit 20f, and the determination unit 20g perform processing related to the application determination function.

  When an application executes a process, an authority relating to use of a function of the terminal and a change in setting is set, and the application can execute the process within the scope of the authority. For example, when the general user authority is set, various processes can be executed within the range of the general user authority. In addition, when the root authority (superuser authority), which is the highest authority (administrator authority), is set, in addition to the processing that is possible within the scope of general user authority, it is possible to change important settings in the terminal, etc. Become.

  Normally, an application is set to operate with a general user authority, and directories that can be accessed by an application with the general user authority set are limited. However, unauthorized applications can exploit OS vulnerabilities to obtain root privileges illegally, change the access privileges (permissions) set in the directory, and freely access directories on mobile devices. As a result, an illegal act such as causing a failure in the mobile terminal or leaking personal information is performed. Therefore, by analyzing the behavior of applications accessing directories and files, it is possible to determine whether or not the application of interest is an unauthorized application.

  Also, the parties with whom the application with general user authority can communicate are limited by iptables in the terminal. However, an unauthorized application can exploit the OS vulnerability to obtain root privileges illegally, remove the restrictions of iptables, and gain access to unauthorized websites. Therefore, by analyzing the behavior of the application communicating, it is possible to determine whether the application of interest is an unauthorized application.

  The file operation content extraction unit 20e extracts the execution content of the system call related to the file operation from the portion extracted by the kernel log extraction unit 20c. The communication content extraction unit 20f extracts the execution content of a system call related to communication (socket communication) from the portion extracted by the kernel log extraction unit 20c.

  The determination unit 20g determines whether or not the execution content of the system call extracted by the file operation content extraction unit 20e indicates an operation on a specific directory in the file storage unit 16, and thereby the target application 10 is illegal. It is determined whether the application is a simple application. Further, the determination unit 20g determines whether or not the execution content of the system call extracted by the communication content extraction unit 20f indicates communication with a specific IP address (or a specific IP address and port number) as a communication partner. By doing so, it is determined whether or not the application 10 of interest is an unauthorized application.

  The control unit 20h distributes processes to the process ID extraction unit 20a, application log extraction unit 20b, kernel log extraction unit 20c, log aggregation unit 20d, file operation content extraction unit 20e, communication content extraction unit 20f, and determination unit 20g. Take control.

  Next, the operation of the log extraction system according to the present embodiment will be described. FIG. 8 shows an operation procedure of the log extraction system. Before starting the operation shown in FIG. 8, the application of interest is not installed in the mobile terminal 1, and the operation information control unit 14 is activated in the mobile terminal 1, but the application log generation unit 11, kernel log generation unit 12, The log generation control unit 13 is not activated. Further, before the operation shown in FIG. 8 is started, in the log analysis device 2, it is assumed that the operation information control unit 21 is activated but the log analysis unit 20 is not activated.

  First, in the log analysis device 2, the operator operates the operation unit 24 and inputs an instruction to activate the application log generation unit 11 and the kernel log generation unit 12. When the operation unit 24 is operated, the OS 22 notifies the operation information control unit 21 of the operation content of the operation unit 24. The operation information control unit 21 generates a log generation unit activation instruction that is operation information for activating the application log generation unit 11 and the kernel log generation unit 12 based on the notified operation content. This log generation unit activation instruction is transmitted from the communication unit 26 to the portable terminal 1 (step S100).

  In the portable terminal 1, the communication unit 19 receives a log generation unit activation instruction (step S105). The OS 15 notifies the operation information control unit 14 of a log generation unit activation instruction, and the operation information control unit 14 calls a system call for activating the log generation control unit 13 based on the log generation unit activation instruction. Notify The OS 15 activates the log generation control unit 13, and the activated log generation control unit 13 activates the application log generation unit 11 and the kernel log generation unit 12 (step S110). The activated application log generation unit 11 and kernel log generation unit 12 start generating logs.

  Subsequently, in the log analysis device 2, the operator operates the operation unit 24 and inputs an instruction to install the application to be determined. When the operation unit 24 is operated, the OS 22 notifies the operation information control unit 21 of the operation content of the operation unit 24. The operation information control unit 21 reads out the compressed file of the determination target application from the file storage unit 23 based on the notified operation content. This compressed file is transmitted from the communication unit 26 to the portable terminal 1 (step S115).

  In the portable terminal 1, the communication unit 19 receives the compressed file of the application (Step S120). Subsequently, application installation is executed, and the decompressed application execution file is stored in the file storage unit 16 (step S125).

  FIG. 9 shows the configuration of the execution file of the application. As shown in FIG. 9, an execution file 900 includes an execution code 901 including an instruction sequence, a manifest file 902 including information such as an application package name and components used by the application, a library 903 referred to when the execution code 901 is executed, And a file such as a parameter 904.

  After installing the application, the operator operates the operation unit 17 and inputs an instruction to start the application. When the operation unit 17 is operated, the OS 15 activates the application 10 (step S130). The behavior of the application 10 is recorded as an application log by the application log generation unit 11 and also recorded as a kernel log by the kernel log generation unit 12.

  Subsequently, in the log analysis device 2, the operator operates the operation unit 24 and inputs an instruction to transmit a log. When the operation unit 24 is operated, the OS 22 notifies the operation information control unit 21 of the operation content of the operation unit 24. The operation information control unit 21 generates a log transmission instruction that is operation information for transmitting a log based on the notified operation content. This log transmission instruction is transmitted from the communication unit 26 to the portable terminal 1 (step S135).

  In the portable terminal 1, the communication unit 19 receives a log transmission instruction (step S140). The OS 15 notifies the operation information control unit 14 of a log transmission instruction, and the operation information control unit 14 instructs the log generation control unit 13 to transmit a log via the OS 15 based on the log transmission instruction. The log generation control unit 13 performs processing for transmitting an application log and a kernel log. The application log and the kernel log are transmitted from the communication unit 19 to the log analysis device 2 (step S145).

  In the log analysis device 2, the communication unit 19 receives the application log and the kernel log (step S150). The received application log and kernel log are held in the work area W2. Subsequently, the operator operates the operation unit 24 and inputs an instruction to analyze the log. When the operation unit 24 is operated, the OS 22 activates the log analysis unit 20 (step S155). The log analysis unit 20 aggregates application logs and kernel logs (step S160).

  FIG. 10 shows details of the operation of the log analysis unit 20 in step S160. As described above, the file storage unit 23 stores the compressed file of the application. The process ID extraction unit 20a reads and decompresses the compressed file of the application from the file storage unit 23, and acquires a package name for identifying the application from the manifest file 902 illustrated in FIG. 9 (Step S200).

  FIG. 11 shows an example of a manifest file. A character string 1100 following “package =” indicates a package name. The process ID extraction unit 20a searches for a character string “package =” from the manifest file, and acquires a character string sandwiched between “” ”following the character string as a package name. The manifest file may be transmitted from the portable terminal 1 together with the application log and the kernel log to the log analysis device 2 and used in the log analysis device 2 for log analysis.

  Subsequently, the process ID extraction unit 20a extracts a part having a character string that matches the package name from the application log, and extracts a process ID from the extracted part (step S205). FIG. 12 shows an example of the application log. A character string 1200 following “Start Proc” indicating the start of the process indicates the package name. Further, a number 1210 following “pid =” indicates the process ID of the process started by the application 10. The process ID extraction unit 20a searches the application log for the character string “Start Proc”, and if the character string between the character string and the space between the characters matches the package name acquired in step S200, the package The character string “pid =” is searched from the part following the name, and the number following the character string is acquired as the process ID. This process ID matches the process ID in the kernel log management system.

  Subsequently, the process ID extraction unit 20a uses the process ID extracted in step S205 as the process ID of the parent process (hereinafter referred to as parent process ID), and the process ID of the child process (hereinafter referred to as child process ID) from the kernel log. ) Is extracted (step S210). In the kernel log, the parent process and the child process are also recorded in the part where the system call related to the process generation is recorded. In the present embodiment, attention is paid to fork as a system call related to process generation.

  FIG. 13 shows an example of the kernel log. In the message body of one recording unit 1300, “fork” indicating a system call related to process generation is recorded. Further, the process ID “1391” before the message body indicates the parent process ID, and the last process ID “1392” of the message body indicates the child process ID. The process ID extraction unit 20a searches the kernel log for the character string “fork”, and the parent process ID immediately before the message body including any of those character strings matches the process ID extracted in step S205. In this case, the last process ID of the message body is extracted as a child process ID. The process ID extraction unit 20a repeats the process of extracting the child process ID as described above using the extracted child process ID as the parent process ID.

  Subsequently, the application log extraction unit 20b extracts, from the application log, a portion (recording unit) where a process ID that matches the process ID extracted in steps S205 and S210 is recorded at the head of the line (step S215). Since the process ID extracted in steps S205 and S210 is the process ID of the process related to the application 10 of interest, the portion extracted in step S215 indicates the behavior of the application 10.

  Subsequently, the kernel log extraction unit 20c extracts, from the kernel log, a portion (recording unit) in which a process ID that matches the process ID extracted in steps S205 and S210 is recorded at the head of the line (step S220). Since the process ID extracted in steps S205 and S210 is the process ID of the process related to the application 10 of interest, the portion extracted in step S220 indicates the behavior of the application 10.

  Subsequently, the log aggregating unit 20d reads the aggregation rule from the file storage unit 23, and aggregates the part extracted from the application log by the application log extracting unit 20b based on the aggregation rule, and the kernel log extracting unit 20c The parts extracted from the log are aggregated (step S225). Hereinafter, the aggregation method will be described separately for application logs and kernel logs.

  FIG. 14 shows determination conditions set as an aggregation rule. FIG. 14A shows determination conditions related to the application log. The first determination condition is a determination condition for deleting similar contents. Since similar contents may be continuously recorded in the log by the processing of the same system call (function), the part in which such contents are recorded is deleted. Specifically, the recording unit type of the application log matches the type of the previous recording unit, the message tag matches the message tag of the previous recording unit, and the first 8 characters of the message body are one. If it matches the first 8 characters of the message body of the previous recording unit, the recording unit is deleted.

  The first determination condition is a determination condition for deleting a portion related to garbage collection for releasing an unnecessary memory area dynamically reserved for processing of an application. Since the garbage collection is an operation not related to the fraud determination of the application, the record related to the garbage collection is deleted. Specifically, as indicated by the judgment condition, when the type of the recording unit of the application log is “D”, the message tag is “dalvik”, and the message body starts with “GC”, The recording unit is deleted.

  FIG. 14B shows determination conditions related to the kernel log. The first determination condition is a condition for deleting similar contents. Specifically, the process ID of the recording unit of the kernel log matches the process ID of the previous recording unit, and the first 8 characters of the message body match the first 8 characters of the message body of the previous recording unit. In that case, the recording unit is deleted.

  The second to fourth determination conditions are conditions for deleting contents related to processing that can be clearly defined as safe. The second and third determination conditions are conditions for deleting a part related to operation (incorporation and removal) of a driver (device driver) which is a program for controlling peripheral devices. Specifically, in the second determination condition, when the open argument (indicating the storage location of the driver program) is “/ dev / ashmem” for the recording unit related to open, which is a system call related to driver operation, The recording unit is deleted. In the third determination condition, when the open argument includes “/ dev / binder” for the recording unit related to open, the recording unit is deleted.

  The fourth determination condition is a condition for the application to delete the contents related to the file operation performed on the directory assigned to itself. As will be described later with reference to FIG. 17, an application can usually access only a directory assigned to the application and a directory under the directory. Therefore, in the fourth determination condition, the read or write argument is “/ home / data / app / aaa” (aaa is the package name of the application) for the recording unit related to read or write which is a system call related to file operation. In that case, the recording unit is deleted.

  Regarding the kernel log, in this embodiment, logs are aggregated by paying attention to a specific system call described below. For this reason, the log is aggregated after further extracting the part related to the specific system call from the part extracted from the kernel log by the kernel log extracting unit 20c in step S220. In the present embodiment, attention is paid to process control system calls such as fork, file operation system calls such as read, write, and open, and socket communication system calls such as connect, recv, and send. The method for extracting a part related to a specific system call is the same as the method used by the file operation content extraction unit 20e and the communication content extraction unit 20f described later.

  In step S225, the log aggregating unit 20d aggregates the part extracted from the application log by the application log extracting unit 20b and the part extracted from the kernel log by the kernel log extracting unit 20c as described above. The application log and the kernel log are stored in the file storage unit 23. At this time, additional information including the process ID extracted in steps S205 and S210 is stored in the file storage unit 23.

  The aggregated application log and kernel log are used for automatic analysis or visual verification. In the visual verification, the application log and the kernel log after aggregation are read from the file storage unit 23 and the contents are displayed on the display unit 25. The operator visually verifies the behavior of the application based on the contents of each displayed log. The application log records application error messages that are not recorded in the kernel log. The kernel log records the execution details of system calls that are not recorded in the application log. By associating and verifying logs and kernel logs, application behavior can be examined in detail. In addition, since unnecessary portions for visual verification are deleted, verification can be performed efficiently.

  In this embodiment, automatic analysis can also be performed. In the following, an example of automatic analysis based on the aggregated kernel log will be described. FIG. 15 shows a first operation example of the log analysis unit 20 in automatic analysis.

  The file operation content extraction unit 20e reads the aggregated kernel log and additional information from the file storage unit 23, and extracts the execution content of the system call related to the file operation from the read kernel log (step S300). In this embodiment, attention is focused on read, write, and open as system calls related to file operations.

  FIG. 16 shows an example of a kernel log in which “open” is recorded. In a portion 1600 corresponding to one recording unit, the process ID (695) of the process that called the system call, the system call name (open) for identifying the system call, and the execution contents of the system call are recorded. . The execution contents of the system call include the name of the directory accessed by the system call (/ data / data / xxx / yyy / zzz). The file operation content extraction unit 20e has a process ID that matches the process ID included in the additional information at the beginning of the line, and a character string that matches any of “read”, “write”, and “open”. When there is a recording unit included in the message unit, the message body (or the entire recording unit) of the recording unit is extracted as the execution content of the system call.

  Subsequently, the determination unit 20g determines whether or not the application 10 of interest is an unauthorized application based on the execution contents of the system call extracted in step S300 (step S305). For this determination, an illegal file operation rule defined in advance based on a file operation performed by an unauthorized application is used. The illegal file operation rule is stored in the file storage unit 23.

  In the open platform for mobile terminals, the directory that an application can access is limited to a specific area allocated exclusively for the application. FIG. 17 shows the directory structure of the file storage unit 16. A directory having a hierarchical structure is created in the file storage unit 16. The directory D1 stores an execution file of the installed application. The directory D2 is a directory for storing data used by each application, and directories D3a to D3c having the same name as the name of each application are arranged under the directory D2.

  An application can usually access only a directory corresponding to the application and a directory under the directory. Therefore, an application that accesses a directory dedicated to another application that is different from the directory dedicated to itself is an unauthorized application.

  In FIG. 17, an area ROM is an area where important files such as an OS are stored, and an access authority (permission) is set in the area ROM so that an application with general user authority cannot be accessed. ing. This access authority can be changed only when the user has root authority. A malicious application that has illegally acquired the root authority changes the access authority of the area ROM and accesses an important file in the area ROM. Therefore, an application that illegally acquires root authority and accesses the area ROM is an unauthorized application.

  The illegal file operation rule includes the name of the directory as described above that should not be accessed by each application. That is, the illegal file operation rule includes the names of directories dedicated to applications other than the application of interest and the names of directories included in the area ROM of FIG.

  The determination unit 20g compares the character string of the system call execution content extracted in step S300 with the character string included in the illegal file operation rule, and adds the system call execution content character string extracted in step S300. If there is a character string that matches the character string included in the illegal file operation rule, it is determined that the application of interest is an illegal application. If there is no character string that matches the character string included in the illegal file operation rule in the character string of the system call execution content extracted in step S300, the determination unit 20g determines that the application of interest is an illegal application. It is determined that it is not.

  In the above determination, an unauthorized application type may be identified based on the contents of the unauthorized file operation rule. For example, when the character string of the system call execution content extracted in step S300 includes a character string that matches the name of a directory dedicated to an application other than the application of interest, the application of interest is managed by another application. It can be identified as an information leakage type application that accesses personal information or the like. Also, if the character string of the execution contents of the system call extracted in step S300 includes a character string that matches the name of the directory included in the area ROM in FIG. It can be identified as the type of application to be acquired. Depending on the determination result, type information indicating the type of an unauthorized application may be generated and stored in the file storage unit 23 together with the determination result.

  FIG. 18 shows a second operation example of the log analysis unit 20 in automatic analysis. The communication content extraction unit 20f reads the aggregated kernel log and additional information from the file storage unit 23, and extracts the execution content of the system call related to communication (socket communication) from the read kernel log (step S400). In the present embodiment, attention is paid to recv, connect, and send as system calls related to communication.

  FIG. 19 shows an example of a kernel log in which “connect” is recorded. In a portion 1900 corresponding to one recording unit, the process ID (5205) of the process that called the system call, the system call name (connect) for identifying the system call, and the execution contents of the system call are recorded. . The execution contents of the system call include the IP address (aaa.bbb.ccc.ddd) and port number (xx) of the communication partner executed by the system call. The communication content extraction unit 20f has a process ID that matches the process ID included in the additional information at the head of the line, and a character string that matches any of “recv”, “connect”, and “send” in the message body. When there is a recording unit having, the message body (or the entire recording unit) of the recording unit is extracted as the execution content of the system call.

  Subsequently, the determination unit 20g determines whether or not the application 10 of interest is an unauthorized application based on the execution contents of the system call extracted in step S400 (step S405). For this determination, an unauthorized communication partner list defined in advance based on communication performed by an unauthorized application is used. The unauthorized communication partner list is stored in the file storage unit 23.

  On the Internet, there are websites that publish information on malignant websites such as phishing sites and virus-infected sites as a blacklist. From this website, it is possible to obtain the IP address of an unauthorized communication partner. Further, by analyzing the behavior when a known unauthorized application communicates, it is possible to acquire the IP address of the communication partner when the application communicates. The IP address obtained as described above is recorded in the unauthorized communication partner list.

  FIG. 20 shows an example of the unauthorized communication partner list. The unauthorized communication partner list includes an IP address, a port number, an FQDN (Fully Qualified Domain Name), and a type. The IP address, port number, and FQDN are information on a communication partner (destination) of communication performed by an unauthorized application. When two IP addresses are connected by “˜”, it indicates a range of IP addresses having the two IP addresses as a starting point and an ending point. The type indicates the type of communication.

  The determination unit 20g searches for the character string “sin_addr = inet_addr” from the execution contents of the system call extracted in step S400, and from the part following the character string, the number string between “” ”is the IP address of the communication partner. Get as an address. Further, the determination unit 20g searches for the character string “sin_port = htons” from the execution contents of the system call extracted in step S400, and sets the number between “(” and “)” following the character string to the port number. Get as.

  Furthermore, the determination unit 20g compares the combination of the IP address and the port number acquired from the execution contents of the system call with the combination of the IP address and the port number included in the unauthorized communication partner list. When the combination of the IP address and the port number acquired from the execution content of the system call matches one of the combinations of the IP address and the port number included in the unauthorized communication partner list, the determination unit 20g determines that the application of interest is illegal. It is determined that the application is a simple application. If the combination of the IP address and the port number acquired from the execution contents of the system call does not match any of the combinations of the IP address and the port number included in the unauthorized communication partner list, the determination unit 20g It is determined that the application to be executed is not an unauthorized application. When the IP address is recorded in the unauthorized communication partner list but the port number is not recorded, the same determination as described above is performed only for the IP address.

  In the above determination, the type of the unauthorized application may be identified based on the type of the communication partner included in the unauthorized communication partner list. For example, when the execution content of the system call extracted in step S400 is recorded in the unauthorized communication partner list as communication with the advertisement site, the application of interest is the type of application that performs communication that leads to the advertisement site. Can be identified. When the execution contents of the system call extracted in step S400 are recorded in the unauthorized communication partner list as botnet communication, the application of interest is a type of application that communicates with a botnet that attempts to infect malware. Can be identified. Depending on the determination result, type information indicating the type of an unauthorized application may be generated and stored in the file storage unit 23 together with the determination result.

  Next, a modification of this embodiment will be described. The mobile terminal 1 may have a log analysis function in the log analysis device 2. FIG. 21 shows a functional configuration of a mobile terminal in which a log analysis function is implemented. A mobile terminal 1a illustrated in FIG. 21 includes a log analysis unit 20 included in the log analysis device 2 illustrated in FIG. 3 in addition to the configuration of the mobile terminal 1 illustrated in FIG. After the application 10 is started, the log analysis unit 20 performs the process shown in FIG. 10 based on the application log and kernel log held in the work area W1. The manifest file is acquired from an application execution file stored in the file storage unit 16. The file storage unit 16 stores an aggregation rule, an unauthorized file operation rule, and an unauthorized communication partner list.

  The log analysis device 2 has a log collection function and a log analysis function, but the log collection function may be provided in a device different from the log analysis device 2. For example, a terminal having a function of collecting logs from the portable terminal 1 is prepared, and the log analysis device 2 receives the log from the terminal and performs analysis.

  Each function of the portable terminals 1 and 1a and the log analysis device 2 described above records a program for realizing the operation and function of each device on a computer-readable recording medium, and the program recorded on the recording medium. This is realized by causing the computer to read and execute the program. Here, the “computer” includes a homepage providing environment (or display environment) if the WWW system is used. The “computer-readable recording medium” refers to a storage device such as a portable medium such as a flexible disk, a magneto-optical disk, a ROM, and a CD-ROM, and a hard disk built in the computer. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program described above may be transmitted from a computer storing the program in a storage device or the like to another computer via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the above-described program may be for realizing a part of the above-described function. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer, what is called a difference file (difference program) may be sufficient.

  As described above, according to the present embodiment, a portion effective for automatic analysis or visual verification can be extracted from the application log and kernel log in which the behavior of the application is recorded, and unnecessary portions can be reduced. For this reason, it is possible to reduce the disk capacity of the log analysis device 2, reduce the time or amount of calculation required for analysis, and efficiently perform visual verification.

  Further, according to the present embodiment, it can be determined whether or not the application of interest is illegal. In particular, since it is possible to exclude a large amount of redundant information related to processes other than the process corresponding to the behavior of the application of interest from the analysis target, it is possible to efficiently analyze the application log and kernel log. It is possible to improve the determination accuracy when determining whether or not the application to be performed is illegal.

  In addition, by extracting the child process ID associated with the parent process ID from the kernel log and using it for log analysis, the behavior of the application can be analyzed in more detail, and whether or not the application of interest is illegal It is possible to improve the determination accuracy when determining whether or not.

  Whether or not the execution content of the system call recorded in the kernel log indicates an operation on a directory (a directory in the area ROM in FIG. 17) that can be operated when the user has root authority, or file storage An application for depriving the root authority of the mobile terminal or an application for leaking personal information by determining whether or not an operation on a directory (directory D3a to D3c in FIG. 17) assigned to a specific application is indicated in the unit 16 Can be detected.

  In addition, whether the system call execution contents recorded in the kernel log indicate communication with the IP address of a known malicious website as the communication partner, or IP obtained by analyzing the behavior of a known malicious application Detecting unauthorized applications such as an application that communicates with an advertising site or an application that communicates with a botnet that attempts to infect malware by determining whether communication with an address is a communication partner Can do.

  In addition, the IP address and port number are extracted from the execution contents of the system call recorded in the kernel log, and communication is determined by determining whether or not the combination of the IP address and port number included in the unauthorized communication partner list is matched. It is possible to make a detailed determination by distinguishing the communication partner for each protocol.

  As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the above-described embodiments, and includes design changes and the like without departing from the gist of the present invention. .

  DESCRIPTION OF SYMBOLS 1, 1a ... Portable terminal, 2 ... Log analysis apparatus, 3 ... Cable, 10 ... Application, 11 ... Application log production | generation part, 12 ... Kernel log production | generation part, 13 ... Log generation control unit, 14, 21 ... operation information control unit, 15, 22 ... OS, 16, 23 ... file storage unit, 17, 24 ... operation unit, 18, 25 ... Display unit 19, 26 ... Communication unit, 20 ... Log analysis unit, 20a ... Process ID extraction unit, 20b ... Application log extraction unit, 20c ... Kernel log extraction unit, 20d ... Log aggregation unit, 20e ... file operation content extraction unit, 20f ... communication content extraction unit, 20g ... determination unit, 20h ... control unit, W1, W2 ... work area

Claims (6)

A first log in which application identification information, process identification information generated during processing of the application, and processing contents of the application are associated with each other is stored, the process identification information, and a system call A log storage unit for storing a second log associated with the execution content of
A first extraction unit that extracts identification information of the process associated with identification information of a specific application from the first log;
A second extraction unit that extracts a part having identification information of the process extracted by the first extraction unit from the first log;
A third extraction unit for extracting a part having identification information of the process extracted by the first extraction unit from the second log;
A rule information storage unit for storing rule information indicating a rule for collecting logs;
A log aggregating unit that aggregates the first log or the second log by deleting a part from the portion extracted by the second extracting unit or the third extracting unit according to the rule information;
A log extraction system characterized by comprising: The rule information indicates that a part similar to the processing content of the application or the execution content of the system call is deleted,
The log aggregating unit deletes a part similar to the processing content of the application or the execution content of the system call from the part extracted by the second extraction unit or the third extraction unit. Item 2. The log extraction system according to Item 1. The rule information indicates that the processing content of the application deletes a portion indicating garbage collection,
The log extraction system according to claim 1, wherein the log aggregating unit deletes a part where the processing content of the application indicates garbage collection from the part extracted by the second extracting unit. The rule information indicates that a part in which the execution content of the system call indicates a driver operation is deleted,
The log extraction system according to claim 1, wherein the log aggregating unit deletes a portion where the execution content of the system call indicates a driver operation. The rule information indicates that the execution content of the system call deletes a portion indicating a file operation on a directory assigned to the specific application,
The log extraction system according to claim 1, wherein the log aggregating unit deletes a portion in which the execution contents of the system call indicate a file operation for a directory assigned to the specific application. A first log in which application identification information, process identification information generated during processing of the application, and processing contents of the application are associated with each other is stored, the process identification information, and a system call A log storage unit for storing a second log associated with the execution content of
A first extraction unit that extracts identification information of the process associated with identification information of a specific application from the first log;
A second extraction unit that extracts a part having identification information of the process extracted by the first extraction unit from the first log;
A third extraction unit for extracting a part having identification information of the process extracted by the first extraction unit from the second log;
A rule information storage unit for storing rule information indicating a rule for collecting logs;
A log aggregating unit that aggregates the first log or the second log by deleting a part from the portion extracted by the second extracting unit or the third extracting unit according to the rule information;
As a program to make the computer function as.

Images