JP5655185B2 - Malware-infected terminal detection device, malware-infected terminal detection method, and malware-infected terminal detection program - Google Patents

Description

  The present invention relates to a malware-infected terminal detection device, a malware-infected terminal detection method, and a malware-infected terminal detection program.

  Conventionally, malicious and malicious computer programs (hereinafter sometimes referred to as “malware”) such as computer viruses, spyware, and bot programs that pose threats such as information leakage and unauthorized access have been blaming.

  In order to suppress the threat of malware, it is important to remove the malware from terminals infected with malware. In order to remove malware, users have dealt with terminals infected with malware by using anti-virus software as one aspect. However, there is a report that one new malware appears in 1.4 seconds (Non-Patent Document 1), and therefore, it is often impossible to catch up with detection only by anti-virus software. For this reason, it is preferable not only to cope with each terminal but also to detect and deal with a terminal infected with malware from the network side.

  Some malware communicates with a commonly used protocol such as IRC (Internet Relay Chat) and HTTP (HyperText Transfer Protocol) (Non-Patent Document 2). As a method for detecting communication of a terminal infected with malware by using such a protocol on a network, for example, a characteristic payload when a bot, which is a kind of malware, communicates with a C & C (Command And Control) server is used. Some are used as criteria.

  Specifically, the characteristic payload includes NICK (nickname) when malware and the C & C server communicate by the IRC protocol, TOPIC transmitted from the C & C server, and the like. When a payload pattern common to many malwares is included, the corresponding program is detected as malware.

  In addition, it is conceivable that communication performed on a port different from the well-known port used in the main communication protocol is used as a criterion for judging malware (Non-Patent Document 3).

“McAfee Threat Report: Third Quarter 2010”, [online], [Search April 6, 2011], Internet <http://www.macafee.com/japan/security/threateport10q3.asp> Jan Goebel, Thorsten Holz, “Rishi: Identify Bot Contaminated Hosts by IRC Nickname Evaluation”, USENIX First Workshop on Hot Topic in Understanding Botnets (HotBots '07), 2007.4.10. Holger Dreger, Anja Feldmann, Michael Mai, Vern Paxson, Robin Sommer, “Dynamic Application-Layer Protocol Analysis for Network Intrusion Detection”, 15th USENIX Security Symposium, 2006.8.4

  In the prior art, there is a problem that a malware-infected terminal cannot be detected quickly. Specifically, the conventional technology uses a characteristic payload to detect a payload pattern common to malware, but the number of new types of malware that appear is enormous, so it covers that pattern. It is difficult. In the first place, the conventional technology cannot detect a case where a payload pattern common to malware is not used. In the prior art, for example, even in a communication such as IRC or HTTP, even a user who is not infected with malware may communicate with a port different from the well-known port. It is not preferable that communication of different ports is collectively used as a judgment criterion for malware.

  Therefore, the present invention has been made in view of the above, and provides a malware-infected terminal detection device, a malware-infected terminal detection method, and a malware-infected terminal detection program capable of quickly detecting a malware-infected terminal. For the purpose.

In order to solve the above-described problems and achieve the object, the malware-infected terminal detection apparatus according to the present invention includes a specifying unit that specifies a communication protocol in network communication and a port number used in the network communication, and malware. An acquisition unit that acquires a communication protocol of communication involving the malware when operated and a port number used in communication involving the malware, and the port number specified by the specifying unit are included in the communication protocol. determined not to not be a corresponding Well-Known port, further, when judges that the communication protocol and the port number identified by the identifying unit, and the acquired communication protocols and port numbers by the acquisition unit coincides In addition, it is detected that the terminal performing the network communication is infected with malware. And a knowledge section.

  According to one aspect of the malware-infected terminal detection device, the malware-infected terminal detection method, and the malware-infected terminal detection program according to the present invention, it is possible to quickly detect a malware-infected terminal.

FIG. 1 is a diagram illustrating a system configuration example according to the first embodiment. FIG. 2 is a diagram illustrating a configuration example of the malware-infected terminal detection device according to the first embodiment. FIG. 3 is a diagram illustrating an example of information stored by the malware information storage unit. FIG. 4 is a flowchart illustrating an example of the flow of the malware-infected terminal detection process according to the first embodiment. FIG. 5 is a flowchart illustrating an example of a flow of malware-infected terminal detection processing according to the second embodiment. FIG. 6 is a diagram illustrating a system configuration example according to the second embodiment. FIG. 7 is a diagram showing that the malware-infected terminal detection program according to the present invention is specifically implemented using a computer.

  Embodiments of a malware-infected terminal detection device, a malware-infected terminal detection method, and a malware-infected terminal detection program according to the present invention will be described below with reference to the accompanying drawings. In addition, this invention is not limited by the following examples.

[System configuration]
A system configuration according to the first embodiment will be described with reference to FIG. FIG. 1 is a diagram illustrating a system configuration example according to the first embodiment.

  For example, as shown in FIG. 1, the malware-infected terminal detection device according to the present invention is connected to a network tap that branches a packet in an internal network and an external network. Such a network tap can perform packet branching in various networks without affecting the network. In other words, the network tap does not delay the packet on the network or give a load to the connected network device. Note that the device is not limited to the network tap because any device capable of branching a packet flowing through the network may be used.

  In the above configuration, the malware-infected terminal detection device identifies a communication protocol in network communication and a port number used in the network communication. Then, the malware-infected terminal detection device acquires a communication protocol of communication related to the malware when the malware is operated and a port number used in communication related to the malware. Subsequently, when the identified port number is not a well-known port corresponding to the communication protocol, the malware-infected terminal detection device, and the identified communication protocol and port number, the acquired communication protocol and port number, If they match, it is detected that the terminal performing network communication is infected with malware. Detailed processing by the malware-infected terminal detection device will be described later.

[Configuration of Malware Infected Device Detection Device]
Next, the configuration of the malware-infected terminal detection device according to the first embodiment will be described with reference to FIG. FIG. 2 is a diagram illustrating a configuration example of the malware-infected terminal detection device according to the first embodiment.

  For example, as illustrated in FIG. 2, the malware-infected terminal detection device 100 includes a storage unit 110 and a control unit 120. The storage unit 110 stores, for example, data required for various processes by the control unit 120 and various processing results by the control unit 120. The storage unit 110 is, for example, a semiconductor memory device such as a random access memory (RAM), a read only memory (ROM), and a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 110 includes a malware information storage unit 111.

  The control unit 120 includes, for example, a control program, a program defining various processing procedures, and an internal memory for storing required data. The control unit 120 is an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array), or an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit). The control unit 120 includes a specifying unit 121, an acquisition unit 122, and a detection unit 123.

  For example, the specifying unit 121 analyzes a payload of a packet branched by a network tap or the like, and specifies a communication protocol in network communication. Similarly, the specifying unit 121 specifies a destination port number used in network communication. The specifying unit 121 further specifies a source IP address and a destination IP address in network communication. Then, the specifying unit 121 notifies the acquisition unit 122 that the various types of information have been specified, and notifies the detection unit 123 of the specified various types of information.

  For example, when receiving the notification from the specifying unit 121, the acquiring unit 122 acquires a communication protocol of communication in which the malware is involved when the malware is operated. Similarly, the acquisition unit 122 acquires a destination port number used in communication involving malware. In addition, the acquisition unit 122 further acquires a destination IP address used for communication involving malware. Then, the acquisition unit 122 notifies the detection unit 123 of various types of acquired information. Various types of information acquired by the acquisition unit 122 are stored in the malware information storage unit 111 as one aspect. As another aspect, various information acquired by the acquisition unit 122 is stored in an external storage device connected to the malware-infected terminal detection device 100, a server device on a network, or the like.

  FIG. 3 is a diagram illustrating an example of information stored by the malware information storage unit 111. For example, as illustrated in FIG. 3, the malware information storage unit 111 associates “protocol”, “destination FQDN (Fully Qualified Domain Name)”, “destination IP address”, and “destination port number” with each other. Remember. Among these, “protocol” is, for example, a communication protocol in network communication. The network communication here includes not only the network shown in FIG. 1 but also a network in any other system.

  The “destination FQDN” is, for example, an FQDN mainly corresponding to the HTTP protocol. The “destination IP address” is, for example, an IP address of a network communication destination in each communication protocol. The “destination port number” is a port number corresponding to each destination IP address, for example.

  For example, the malware information storage unit 111 stores the protocol “IRC”, the destination IP address “abcd”, and the destination port number “10324” in association with each other. As another example, the malware information storage unit 111 includes a protocol “HTTP”, a destination FQDN “www.mal.com”, a destination IP address “ef.g.h”, and a destination port number “80”. Is stored in association with each other.

  Returning to the description of FIG. 2, for example, when the port number specified by the specifying unit 121 is not a well-known port corresponding to the communication protocol, the detecting unit 123 specifies the communication protocol and destination port specified by the specifying unit 121. It is determined whether the number matches the communication protocol and destination port number acquired by the acquisition unit 122. At this time, when these pieces of information match, the detection unit 123 detects that a terminal performing network communication is infected with malware. A terminal detected to be infected with malware can be identified by using the transmission source IP address specified by the specifying unit 121.

  Further, when the destination port number specified by the specifying unit 121 is a well-known port corresponding to the communication protocol, the detecting unit 123 specifies each of the specifying unit 121 and the acquiring unit 122 in addition to the communication protocol and the port number. Alternatively, it is also determined whether or not the acquired destination IP addresses match. At this time, when the destination IP address also matches, the detection unit 123 detects that the terminal performing network communication is infected with malware. Similarly, a terminal detected to be infected with malware can be identified by using the source IP address specified by the specifying unit 121.

  The detection unit 123 that has detected a terminal infected with malware may register the corresponding communication protocol and port number as new malware information in association with the malware information storage unit 111. At this time, the detection unit 123 may also register the destination IP address. Thereby, it can utilize for the process which concerns on the subsequent malware infection terminal detection by the malware infection terminal detection apparatus 100. FIG.

  That is, the malware information storage unit 111 stores in advance malware information detected in advance by another device that detects communication by malware or the malware-infected terminal detection device 100, and malware detected by the malware-infected terminal detection device 100. Information will be memorized.

[Malware infected device detection process flow]
Next, the malware-infected terminal detection process according to the first embodiment will be described with reference to FIG. FIG. 4 is a flowchart illustrating an example of the flow of the malware-infected terminal detection process according to the first embodiment.

  For example, as illustrated in FIG. 4, the malware-infected terminal detection device 100 specifies predetermined various information in network communication (step S101). Here, the predetermined various information is a combination of a communication protocol and a destination port number, or a combination of a communication protocol, a destination port number and a destination IP address.

  Then, the malware-infected terminal detection device 100 determines whether or not the identified destination port number is different from the well-known port corresponding to the communication protocol (step S102). At this time, if the malware-infected terminal detection device 100 is different from the well-known port (Yes in step S102), the malware-infected terminal detection device 100 determines whether the specified protocol and destination port number correspond to the malware information (step S103). That is, the malware-infected terminal detection apparatus 100 acquires a protocol and a destination port number from the malware information storage unit 111 and the like, and determines whether or not the specified protocol and destination port number match.

  At this time, when it is determined that the malware-infected terminal detection device 100 corresponds to the malware information (Yes at Step S103), the malware-infected terminal detection device 100 detects that the terminal performing network communication is infected with malware (Step S104). On the other hand, when it is determined that the malware-infected terminal detection device 100 does not correspond to the malware information (No at Step S103), the process ends.

  Further, when the malware-infected terminal detection device 100 is a well-known port (No in step S102), the malware-infected terminal detection device 100 determines whether or not the specified protocol, destination port number, and destination IP address correspond to malware information (step S105). ). That is, the malware-infected terminal detection device 100 acquires a protocol, a destination port number, and a destination IP address from the malware information storage unit 111 and the like, and determines whether or not they match the specified protocol, destination port number, and destination IP address. .

  At this time, when it is determined that the malware-infected terminal detection device 100 corresponds to the malware information (Yes at Step S105), the malware-infected terminal detection device 100 detects that the terminal performing network communication is infected with malware (Step S104). On the other hand, when it is determined that the malware-infected terminal detection device 100 does not correspond to the malware information (No at Step S105), the process ends.

[Effects of Example 1]
As described above, since the malware-infected terminal detection device 100 detects malware based on the communication protocol and the destination port number, the malware-infected terminal detection device 100 is faster than the conventional technology that detects malware based on a characteristic payload pattern. Can detect malware-infected terminals. Moreover, since the malware-infected terminal detection apparatus 100 detects malware based on the communication protocol and the destination port number, it can also detect malware that does not use a payload pattern common to malware, and can detect malware-infected terminals. Accuracy can be improved.

  In addition, in the communication performed with the destination port number different from the well-known port, the malware-infected terminal detection device 100 performs communication from the malware-infected terminal when the combination of the protocol and the destination port number matches the malware information. Detect. As a result, the malware-infected terminal detection apparatus 100 is compared with the conventional technique in which false detections increase because the communication using the destination port number different from the well-known port is uniformly detected as the communication from the malware-infected terminal. It is possible to improve the detection accuracy of malware-infected terminals.

  The embodiments of the malware-infected terminal detection device 100 according to the present invention have been described so far, but may be implemented in various different forms other than the embodiments described above. Therefore, different embodiments will be described in (1) bandwidth control or communication cut-off, (2) processing order, (3) determination relating to malware-infected terminal detection, (4) configuration, and (5) program.

(1) Bandwidth control or communication blocking In the first embodiment, the case where it is detected that a terminal performing network communication is infected with malware has been described. On the other hand, band control or communication cutoff may be further executed. Thereby, expansion of the network communication regarding malware can be suppressed. In addition, the detected malware information may be used not only for bandwidth control or communication interruption for network communication but also for notification to other devices such as a monitoring device for monitoring the network.

(2) Processing order In the first embodiment, the case where it is determined whether or not the destination port number is a well-known port when detecting a malware-infected terminal has been described. The processing order is not limited. FIG. 5 is a flowchart illustrating an example of a flow of malware-infected terminal detection processing according to the second embodiment.

  For example, as illustrated in FIG. 5, the malware-infected terminal detection device 100 specifies predetermined various information in network communication (step S201). Here, the predetermined various information is a combination of a communication protocol and a destination port number, or a combination of a communication protocol, a destination port number and a destination IP address.

  Then, the malware-infected terminal detection device 100 determines whether or not the identified protocol corresponds to malware information (step S202). That is, the malware-infected terminal detection apparatus 100 acquires a protocol from the malware information storage unit 111 or the like, and determines whether or not it matches the specified protocol. At this time, if the malware-infected terminal detection device 100 corresponds to the malware information (Yes at Step S202), the malware-infected terminal detection device 100 determines whether or not the specified destination IP address and destination port number correspond to the malware information (Step S203). That is, the malware-infected terminal detection device 100 acquires a destination IP address and a destination port number corresponding to the protocol acquired from the malware information storage unit 111 and the like, and determines whether or not the specified destination IP address and destination port number match. judge.

  At this time, if the malware-infected terminal detection apparatus 100 corresponds to the malware information (Yes at Step S203), the malware-infected terminal detection apparatus 100 detects that the terminal performing network communication is infected with malware (Step S206). On the other hand, if the malware-infected terminal detection device 100 does not correspond to the malware information (No at Step S203), the malware-infected terminal detection device 100 determines whether or not the specified destination port number is different from the Well-Knowed port (Step S204). Here, the case where the information does not correspond to malware information (No in step S203) means that at least one of the destination IP address and the destination port number does not match.

  At this time, when it is determined that the malware-infected terminal detection device 100 is different from the well-known port (Yes in step S204), the malware-infected terminal detection device 100 determines whether the specified destination port number corresponds to the malware information (step S205). . That is, the malware-infected terminal detection device 100 determines whether or not the acquired port number matches the specified destination port number that is not a well-known port. At this time, if the malware-infected terminal detection device 100 corresponds to the malware information (Yes at Step S205), the malware-infected terminal detection device 100 detects that the terminal performing network communication is infected with malware (Step S206).

  In addition, the malware-infected terminal detection device 100 performs the process when it does not correspond to the malware information (No at Step S202, No at Step S205) or when the specified destination port number is a Well-Knowed port (No at Step S204). finish. Note that the processes of step S202 to step S205 may be executed by changing the order as appropriate.

(3) Determination related to detection of malware-infected terminal In the above embodiment, the case where a malware-infected terminal is detected based on whether the combination of the communication protocol and the destination port number corresponds to malware information has been described. Malware infected terminals may be detected based on whether the combination of the protocol and the destination IP address corresponds to malware information.

  At this time, the communication protocol, the destination IP address, and the destination port number are associated with each other and registered in the malware information storage unit 111 and the like, and then the combination of the communication protocol and the destination port number corresponds to the malware information. Malware-infected terminals may be detected depending on whether or not to do so.

  Further, the communication protocol, the destination IP address, and the destination port number registered in the malware information storage unit 111 in this way are used as malware information in the subsequent malware-infected terminal detection process. That is, the malware information registered in the malware information storage unit 111 is a combination of a communication protocol and a destination port number, a combination of a communication protocol and a destination IP address, and a combination of a communication protocol, a destination port number and a destination IP address. Used for determination related to detection of malware-infected terminals.

  Moreover, the malware-infected terminal detection process described above may be executed not only when the destination port number corresponding to the communication protocol is not a well-known port, but also when the destination port number is a well-known port.

(4) Configuration In addition, information (eg, information stored in the malware information storage unit 111) including the processing procedure, control procedure, specific name, various data, parameters, and the like shown in the document and drawings Can be arbitrarily changed unless otherwise specified.

  Each component of the malware-infected terminal detection device 100 shown in the figure is functionally conceptual and does not necessarily need to be physically configured as shown. In other words, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various burdens or usage conditions. Can be integrated.

  FIG. 6 is a diagram illustrating a system configuration example according to the second embodiment. For example, as illustrated in FIG. 6, the malware-infected terminal detection device according to the second embodiment may be arranged inline between the internal network and the external network. At this time, each component and function of the malware-infected terminal detection device according to the second embodiment are the same as those in the first embodiment. That is, the malware-infected terminal detection apparatus according to the second embodiment identifies various types of information from the payload of a packet on the network without going through a network tap or the like, and determines whether the malware information corresponds to the malware information. Will be detected.

  Each processing function performed by the malware-infected terminal detection device 100 is realized in part or in part by a CPU and a program that is analyzed and executed by the CPU, or as hardware by wired logic. Can be realized.

(5) Program FIG. 7 is a diagram showing that the malware-infected terminal detection program according to the present invention is specifically realized using a computer. As illustrated in FIG. 7, the computer 1000 includes, for example, a memory 1001, a CPU 1002, a hard disk drive interface 1003, a disk drive interface 1004, a serial port interface 1005, a video adapter 1006, and a network interface 1007. These units are connected by a bus 1008.

  As illustrated in FIG. 7, the memory 1001 includes a ROM 1001a and a RAM 1001b. The ROM 1001a stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1003 is connected to the hard disk drive 1009 as illustrated in FIG. The disk drive interface 1004 is connected to the disk drive 1010 as illustrated in FIG. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1010. The serial port interface 1005 is connected to, for example, a mouse 1011 and a keyboard 1012 as illustrated in FIG. The video adapter 1006 is connected to a display 1013, for example, as illustrated in FIG.

  Here, as illustrated in FIG. 7, the hard disk drive 1009 stores, for example, an OS (Operating System) 1009a, an application program 1009b, a program module 1009c, and program data 1009d. That is, the malware-infected terminal detection program according to the present invention is stored in, for example, the hard disk drive 1009 as a program module 1009c in which a command executed by the computer 1000 is described. Specifically, a specific procedure for executing processing similar to that of the specifying unit 121 described in the above embodiment, an acquisition procedure for executing processing similar to that of the acquisition unit 122, and detection for executing processing similar to that of the detection unit 123 A program module 1009c describing the procedure is stored in the hard disk drive 1009. Further, like data stored in the malware information storage unit 111 described in the above embodiment, data used for processing by the malware-infected terminal detection program is stored as, for example, the hard disk drive 1009 as program data 1009d. Then, the CPU 1002 reads the program module 1009c and program data 1009d stored in the hard disk drive 1009 to the RAM 1001b as necessary, and executes a specific procedure, an acquisition procedure, and a detection procedure.

  Note that the program module 1009c and the program data 1009d related to the malware-infected terminal detection program are not limited to being stored in the hard disk drive 1009, but are stored in, for example, a removable storage medium and read by the CPU 1002 via the disk drive 1010 or the like. May be issued. Alternatively, the program module 1009c and the program data 1009d related to the malware-infected terminal detection program are stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.), and the network interface The data may be read out by the CPU 1002 via 1007.

100 Malware Infected Terminal Detection Device 110 Storage Unit 111 Malware Information Storage Unit 120 Control Unit 121 Identification Unit 122 Acquisition Unit 123 Detection Unit

Claims (6)

A specifying unit for specifying a communication protocol in network communication and a port number used in the network communication;
An acquisition unit that acquires a communication protocol of communication involving the malware when the malware is operated and a port number used in communication involving the malware;
It is determined that the port number specified by the specifying unit is not a well -known port corresponding to the communication protocol, and the communication protocol and port number specified by the specifying unit and the communication acquired by the acquiring unit A malware-infected terminal detection apparatus, comprising: a detection unit that detects that a terminal performing network communication is infected with malware when it is determined that a protocol and a port number match. The specifying unit further specifies a destination IP address in the network communication;
The acquisition unit further acquires a destination IP address in communication involving the malware,
When the port number specified by the specifying unit is a well-known port corresponding to the communication protocol, and the communication unit, the port number and the destination IP address specified by the specifying unit, The method according to claim 1, wherein when the communication protocol, the port number, and the destination IP address acquired by the acquisition unit match, it is detected that the terminal performing the network communication is infected with malware. The malware-infected terminal detection device described. The detection unit associates, as malware information, a communication protocol in the network communication detected as communication by a terminal infected with malware, a port number used in the network communication, and a destination IP address in the network communication. Registered in the storage unit,
The specifying unit further specifies a destination IP address in the network communication;
The acquisition unit further acquires malware information including a destination IP address registered in the storage unit by the detection unit,
The detection unit performs the network communication when the communication protocol, port number and destination IP address specified by the specifying unit match the communication protocol, port number and destination IP address acquired by the acquisition unit. The malware-infected terminal detection device according to claim 1, wherein the terminal that is performing detection of malware infection is detected. The communication control part which performs control of a zone | band, or interruption | blocking of communication with respect to the said network communication detected as communication by the terminal infected with the malware by the said detection part is characterized by the above-mentioned. The malware-infected terminal detection device according to any one of the above. A malware-infected terminal detection method executed by a malware-infected terminal detection device,
A specifying step of specifying a communication protocol in network communication and a port number used in the network communication;
An acquisition step of acquiring a communication protocol of communication involving the malware when operating the malware and a port number used in communication involving the malware;
It is determined that the port number specified in the specifying step is not a well -known port corresponding to the communication protocol, and the communication protocol and port number specified in the specifying step and the communication acquired in the acquiring step And a detection step of detecting that the terminal performing the network communication is infected with malware when it is determined that the protocol and the port number match.   The malware infection terminal detection program for functioning a computer as a malware infection terminal detection apparatus of Claims 1-4.

Images