JP5826086B2 - Delivery information analysis device, delivery information analysis method, delivery information analysis program - Google Patents

Description

  The present invention relates to a technique for analyzing distribution information distributed from a distribution server.

  Various distribution information is distributed via a network such as the Internet. For example, under a domain (for example, www.aaa.com) assigned to the distribution server, a plurality of URIs (Uniform Resource Identifiers) (for example, “http://www.aa.com/index.html”, “ http://www.aa.com/aa/aa.html ”, etc., and when receiving a distribution request addressed to a URI under its own domain, distribution information corresponding to the URI is distributed. According to Patent Document 1, based on whether or not the server name of a distribution server that distributes a web page as such distribution information and the router name close to the distribution server are predetermined illegal ones, It is described to determine whether a page contains harmful information or the like.

JP 2011-248500 A

  However, in the above-described method, for example, the server name and the router name are not invalid, but detection that the distribution server is distributing distribution information that has been falsified by an attack may be delayed. There is. Therefore, it is desirable to efficiently detect that such tampering has been performed.

  The present invention has been made in view of such a situation, and provides a distribution information analysis device, a distribution information analysis method, and a distribution information analysis program for detecting falsification of distribution information.

  In order to solve the above-described problem, the present invention stores a plurality of URIs indicating destinations of a distribution request, and URIs to which distribution information to be analyzed is distributed when the distribution request is transmitted with the URI as a destination. A URI information storage unit, a distribution information update determination unit for performing determination processing for determining whether or not the acquired distribution information has been updated, the distribution information distributed from the URI, and the header information of the distribution information from the URI. A plurality of URIs stored in the URI information storage unit, and a header information update determination unit that performs a determination process for determining whether or not the distribution information distributed from the URI has been updated based on the acquired header information Then, either or both of the determination process by the distribution information update determination unit and the determination process by the header information update determination unit are performed, and the result of the determination process and the determination process are performed. If it is determined that the analysis is performed by the analysis execution availability determination unit that determines whether or not to analyze the distribution information distributed from the URI, and the analysis execution availability determination unit, the determination process is performed. Based on the number of times performed, an index value calculation unit for calculating an unupdated period index value indicating the length of a period during which the distribution information distributed from the URI has not been updated, and an analysis based on the unupdated period index value A priority determining unit that determines a priority order indicating the order of analyzing distribution information distributed from a plurality of URIs that are determined to perform, and acquiring distribution information distributed from the URI based on the priority And an analysis unit that determines whether or not the information is predetermined illegal distribution information.

  In addition, the present invention provides a first header information update determination unit in which a header information update determination unit performs a determination process based on information on a plurality of defined items included in the header information, and information having a smaller number of items than the plurality of items. And a second header information update determination unit that performs determination processing based on the above.

  In addition, according to the present invention, the distribution information update determination unit determines whether or not the hash value of the distribution information distributed from the URI matches the hash value of the previously acquired distribution information, thereby updating the distribution information. It is characterized by determining whether or not there was.

  Further, according to the present invention, the analysis execution availability determination unit causes the distribution information update determination unit to perform a determination process when the distribution information distributed from the URI is text information, and the distribution information distributed from the URI is not text information. In this case, the header information update determination unit is caused to perform determination processing.

  In addition, the present invention provides a domain information storage unit in which a plurality of domain information indicating domains to which the distribution information analysis device described above distributes distribution information to be analyzed is stored, and a domain stored in the domain information storage unit A URI extraction unit that reads out information, extracts a URI of distribution information distributed from the domain indicated by the domain information, and stores the extracted URI in a URI information storage unit.

  Further, according to the present invention, the analysis execution availability determination unit performs a determination process on the distribution information update determination unit and the header information update determination unit based on the number of URIs of distribution information distributed from the domain and the URI hierarchy. The upper limit value of the number of times to perform is determined.

  The present invention also includes a URI information storage unit that stores a plurality of URIs indicating destinations of a distribution request, and stores URIs to which distribution information to be analyzed is distributed when the distribution request is transmitted with the URI as a destination. The distribution information distributed from the distribution information, a distribution information update determination unit for performing a determination process for determining whether or not the acquired distribution information has been updated, and only the header information of the distribution information is acquired from the URI, and the acquired header information A header information update determination unit that performs a determination process for determining whether or not the distribution information distributed from the URI has been updated based on the URI, and a plurality of URIs stored in the URI information storage unit. About the determination process by a delivery information update determination part and the determination process by a header information update determination part, or both are performed, the result of a determination process, and a determination process The step of determining whether to analyze the distribution information distributed from the URI based on the number of times performed, and the distribution from the URI based on the number of times the determination process is performed if it is determined to perform the analysis A step of calculating an unupdated period index value indicating the length of a period in which the distribution information to be updated has not been updated, and a distribution distributed from a plurality of URIs determined to be analyzed based on the unupdated period index value A step of determining a priority indicating the order in which information is analyzed, and based on the priority, the distribution information distributed from the URI is acquired, and it is determined whether or not the distribution information is predetermined illegal distribution information A distribution information analyzing method comprising: a step of:

  The present invention also includes a URI information storage unit that stores a plurality of URIs indicating destinations of a distribution request and stores URIs to which distribution information to be analyzed is distributed when the distribution request is transmitted with the URI as a destination. The computer of the information analysis apparatus acquires distribution information distributed from the URI, a distribution information update determination unit that performs determination processing to determine whether or not the acquired distribution information has been updated, only the header information of the distribution information from the URI A plurality of URIs stored in the header information update determination unit and the URI information storage unit that perform determination processing to determine whether or not the distribution information distributed from the URI has been acquired based on the acquired header information. Either or both of the determination process by the distribution information update determination unit and the determination process by the header information update determination unit are performed, and the result of the determination process is determined. If it is determined that the analysis is performed by the analysis execution availability determination unit and the analysis execution availability determination unit that determine whether to analyze the distribution information distributed from the URI based on the number of times the processing is performed Based on the number of times processing has been performed, an index value calculation unit that calculates an unupdated period index value indicating the length of a period during which the distribution information distributed from the URI has not been updated, based on the unupdated period index value, A priority determining unit that determines a priority order indicating the order of analyzing distribution information distributed from a plurality of URIs determined to be analyzed, acquires distribution information distributed from the URI based on the priority, and distributes the distribution information This is a program for functioning as an analysis unit that determines whether or not the information is predetermined illegal distribution information.

  As described above, according to the present invention, the distribution information analysis apparatus performs a determination process for determining whether or not the distribution information distributed from the URI to be analyzed has been updated. A header information update determination unit that performs a determination process for determining whether or not the distribution information has been updated by acquiring only the header information of the distribution information, and is one of the above two determination processes for a plurality of URIs to be analyzed Alternatively, it is determined whether or not the distribution information is to be analyzed by performing both, and if it is determined that the analysis is to be performed, an unupdated period index value indicating the length of the period in which the distribution information has not been updated is calculated and not updated A priority order indicating the order of analyzing distribution information distributed from a plurality of URIs determined to be analyzed is determined based on the period index value, and distribution information distributed from the URI is determined based on the priority order. And, since the distribution information is to determine whether an unauthorized distribution information determined in advance, it is possible to detect the alteration of the distribution information.

It is a block diagram which shows the structure of the communication system by one Embodiment of this invention. It is a figure which shows the data example of the domain information memorize | stored in the domain information storage part by one Embodiment of this invention. It is a figure which shows the example of data of the URI information memorize | stored in the URI information storage part by one Embodiment of this invention. It is a figure which shows the example of data of the analysis information memorize | stored in the analysis information storage part by one Embodiment of this invention. It is a figure which shows the example of data of the analysis execution time memorize | stored in the analysis execution time memory | storage part by one Embodiment of this invention. It is a figure which shows the example of data of the attack information memorize | stored in the attack information storage part by one Embodiment of this invention. It is a figure which shows the example of data of the behavior information memorize | stored in the malignant behavior memory | storage part by one Embodiment of this invention. It is a figure which shows the data example of the system operator information memorize | stored in the system operator information storage part by one Embodiment of this invention. It is a flowchart which shows the operation example of URI extraction processing by one Embodiment of this invention. It is a flowchart which shows the operation example of the advance patrol process by one Embodiment of this invention. It is a flowchart which shows the operation example of the determination process by the delivery information update determination part of one Embodiment of this invention. It is a flowchart which shows the operation example of the determination process by the 1st header information update determination part of one Embodiment of this invention. It is a flowchart which shows the operation example of the determination process by the 2nd header information update determination part of one Embodiment of this invention. It is a flowchart which shows the operation example of this cyclic scheduling process by one Embodiment of this invention. It is a flowchart which shows the operation example of this patrol process by one Embodiment of this invention.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of a communication system 1 according to the present embodiment. The communication system 1 includes a plurality of distribution servers 100 (distribution server 100-1, distribution server 100-2, distribution server 100-3,...) And distribution information connected to the plurality of distribution servers 100 via a network. And an analysis device 200. Since the distribution server 100-1, the distribution server 100-2, and the distribution server 100-3 have the same configuration, the distribution server 100 will be described unless otherwise distinguished. Although three distribution servers 100 are shown and described in the figure, an arbitrary number of distribution servers 100 may be connected via a network.

  The distribution server 100 is a computer device that has a plurality of hierarchy URIs for a defined domain and distributes distribution information corresponding to the URI when receiving a distribution request addressed to a URI under its own domain. For example, the distribution server 100 has a function of a web server, and for each set URI, a web page such as an HTML (HyperText Markup Language) file or a CSS (Cascading Style Sheets) file, an image file, an audio file, Distribution information such as a moving image file is stored in association with each other. The distribution server 100 distributes the associated distribution information in response to a distribution request whose destination is the URI.

  The distribution information analysis device 200 is a computer device that analyzes distribution information distributed from the distribution server 100 and detects falsification of the distribution information. The distribution information analysis apparatus 200 includes a storage unit 210, a URI extraction unit 220, a preliminary tour processing unit 230, a main tour scheduling unit 240, and a main tour processing unit 250. The URI extraction unit 220 extracts a URI that is a monitoring target of tampering detection. The preliminary circulation processing unit 230 performs a determination process for determining whether or not the distribution information distributed from the URI extracted by the URI extraction unit 220 has been updated. The cyclic scheduling unit 240 determines a priority order for analyzing whether or not the update of the URI determined by the preliminary cyclic processing unit 230 that the distribution information has been updated is invalid. The circulation processing unit 250 performs analysis processing for analyzing whether or not the distribution information is illegal from the URI based on the priority order determined by the circulation scheduling unit 240. Hereinafter, the configuration of the distribution information analyzing apparatus 200 will be described in detail.

  The storage unit 210 stores information that is referred to in order for the distribution information analysis apparatus 200 to operate, and includes a domain information storage unit 211, a URI information storage unit 212, an analysis information storage unit 213, and an analysis execution time storage. Unit 214, attack information storage unit 215, malignant behavior storage unit 216, and system operator information storage unit 217.

  The domain information storage unit 211 stores a plurality of pieces of domain information indicating domains to which distribution information to be analyzed is distributed. FIG. 2 is a diagram illustrating a data example of domain information stored in the domain information storage unit 211. The domain information storage unit 211 stores domain information and the number of URIs in association with item numbers that are identification information. The domain information is information input in advance by the system operator and indicates a domain to be monitored. For example, the system operator inputs in advance the domain of the distribution server 100 to be monitored and stores it in the domain information storage unit 211. The number of URIs is the number of URIs under the corresponding domain, and is stored by the URI extraction unit 220.

  The URI information storage unit 212 stores a plurality of URIs indicating destinations of distribution requests under the domain to be monitored, and URIs to which distribution information to be analyzed is distributed when the distribution request is transmitted with the URIs as destinations. Has been. FIG. 3 is a diagram illustrating a data example of URI information stored in the URI information storage unit 212. The URI information includes domain information, URI, hierarchy information, page type, basic information, unupdated counter A, unupdated counter B, and unupdated counter C for each item number that is identification information. The information on the unupdated counter A threshold, the unupdated counter B threshold, the unupdated counter C threshold, the pattern, the hash value, the update presence / absence, and the initial circulation flag are associated with each other.

  The domain information, URI, hierarchy information, and page type information are acquired by the URI extraction unit 220 and stored. The domain information is a corresponding URI domain. The URI is a URI under the corresponding domain. The hierarchy information indicates the hierarchy under the domain of the corresponding URI. For example, the hierarchy information is a value in which the value of 1 is added every time the hierarchy becomes deeper, assuming that the hierarchy of the top page directly under the domain is 1. At this time, the hierarchy of the URI “http://www.aa.com/index.html”, which is directly under the domain “www.aa.com”, is 1. The page type indicates the page type of distribution information distributed from the corresponding URI.

Basic information, unupdated counter A, unupdated counter B, unupdated counter C, unupdated counter A threshold, unupdated counter B threshold, unupdated counter C threshold, pattern, hash value, Information on whether or not there is an update is stored by the preliminary patrol processing unit 230.
The basic information is information included in the header of distribution information distributed from the corresponding URI, and here includes information of content-type, last-modified, content-length, and status code. The content-type indicates the type of distribution information. “last-modified” indicates the date and time when the distribution information is updated. The content-length indicates the data amount of distribution information. The status code indicates the meaning of a response from the distribution server 100 in response to a distribution request (HTTP (Hypertext Transfer Protocol) request) having the corresponding URI as a destination.

  The non-updated counter A, the non-updated counter B, and the non-updated counter C are not updated when the pre-circulation processing unit 230 determines whether or not the distribution information has been updated in a loop for a plurality of times. This is a variable indicating the number of times it was determined. The unupdated counter A threshold value, the unupdated counter B threshold value, and the unupdated counter C threshold value are values indicating the threshold value (upper limit value) of the corresponding unupdated counter. The pattern is a value that is referred to in the update determination process by the second header information update determination unit 234. The initial value is 0, and the value selected by the second header information update determination unit 234 is stored. The unupdated counter and the pattern will be described later together with the description of the processing. The hash value is a hash value based on the distribution information calculated and stored by the distribution information update determination unit 231. The presence / absence of update is a value indicating whether or not the distribution information distributed from the corresponding URI has been updated. When the presence / absence of update is 0, it indicates that there is no update, and when the presence / absence of update is 1, it indicates that there is an update. When the distribution information from the corresponding URI has never been acquired, a value of 2 is associated with the presence / absence of update. The initial tour flag indicates whether distribution information from the corresponding URI has never been acquired (whether it is the first tour). Here, when the distribution information from the corresponding URI has never been acquired (the first round), 1 is associated, and the distribution information from the corresponding URI has already been acquired (not the first round) Is associated with 0. The initial value is 1.

  The analysis information storage unit 213 stores analysis information referred to in the distribution information analysis process performed for each URI to be analyzed. FIG. 4 is a diagram illustrating a data example of analysis information stored in the analysis information storage unit 213. The analysis information is associated with information on domain information, URI, unupdated period index value, presence / absence of update, priority, and presence / absence of alteration for each item number which is identification information. The domain information is a URI domain to be analyzed. The URI is a URI to be analyzed. The unupdated period index value is a value calculated based on the result of the determination process performed by the preliminary circulation processing unit 230 and the number of times the determination process has been performed, and the distribution information distributed from the corresponding URI has not been updated. Indicates the length of the period. The presence / absence of update indicates whether or not the distribution information distributed from the corresponding URI has been updated. The priority order indicates the order in which the analysis processing for the corresponding URI is performed. For example, the smaller the priority value, the more preferentially the analysis processing is performed. The presence / absence of falsification indicates whether or not falsification of distribution information has been detected as a result of analyzing distribution information distributed from the corresponding URI. For example, if the presence / absence of alteration is 0, it indicates that it has been determined that no alteration has occurred, and if the presence / absence of alteration is 1, it indicates that it has been determined that there has been alteration.

The analysis execution time storage unit 214 indicates the time when the distribution information analysis processing by the circulation processing unit 250 is performed. FIG. 5 is a diagram illustrating an example of analysis execution time data stored in the analysis execution time storage unit 214. The analysis execution time is, for example, information indicating the time at which the analysis process is performed in the format “YYYY / MM / DD hh: mm: ss”.
The attack information storage unit 215 stores attack information that is referred to in the analysis processing by the circulation processing unit 250. FIG. 6 is a diagram illustrating an example of attack information data stored in the attack information storage unit 215. Here, attack information is associated with each item number that is identification information. The attack information is a character string that is highly likely to be included in the falsified distribution information when the distribution information is falsified by an attack. For example, the URI of an unauthorized web page (http://www.xx.com/index.html), a script that causes an unauthorized operation (<script> ...), or a character string (Hack ) Etc.

  The malignant behavior storage unit 216 stores behavior information referred to in the analysis processing by the cyclic processing unit 250. FIG. 7 is a diagram illustrating a data example of behavior information stored in the malignant behavior storage unit 216. Here, behavior information is associated with each item number that is identification information. The behavior information indicates the behavior of the browser that is likely to occur when the distribution information after falsification is displayed on the browser when the distribution information is falsified by an attack. For example, the redirect process is executed or there is communication that exploits the vulnerability of the client terminal. The communication that exploits the vulnerability of the client terminal is an illegal behavior that exploits the vulnerability of the application when a specific application is activated in the client terminal according to the distribution information, for example.

  The system operator information storage unit 217 stores system operator information. FIG. 8 is a diagram illustrating a data example of the system operator information stored in the system operator information storage unit 217. The system operator information is associated with the name of the system operator and the mail address of the system operator for each item number that is identification information.

Returning to FIG. 1, the URI extraction unit 220 reads the domain information stored in the domain information storage unit 211, extracts the URI of distribution information distributed from the domain indicated by the read domain information, and extracts the extracted URI as a URI. The information is stored in the information storage unit 212.
The preliminary circulation processing unit 230 determines whether or not the distribution information distributed from the determination target URI has been updated by using the URI stored in the URI information storage unit 212 as a determination target. A preliminary patrol process for storing the URI in the analysis information storage unit 213 is performed. Here, the update includes an update by an authorized administrator of the URI and an unauthorized change (falsification) by a third party. The preliminary circulation processing unit 230 includes a distribution information update determination unit 231, a header information update determination unit 232, an analysis execution availability determination unit 235, and an index value calculation unit 236.

  The distribution information update determination unit 231 reads a URI to be determined stored in the URI information storage unit 212, transmits a distribution request with the read URI as a destination, and is distributed from the destination according to the transmitted distribution request. Information is acquired, and a determination process is performed to determine whether the acquired distribution information has been updated. For example, the distribution information update determination unit 231 stores the hash value of the distribution information distributed from the determination target URI in the URI information storage unit 212, and hashes based on the distribution information newly acquired from the determination target URI. It is determined whether or not the distribution information has been updated by calculating a value and determining whether or not the hash value of the previously acquired distribution information matches the newly calculated hash value. Since the hash value is also changed when the distribution information is changed, it is possible to accurately determine whether or not the distribution information has been changed by such a determination process. Here, the distribution information update determination unit 231 communicates with the distribution server 100 indicated by the determination target URI without using a browser. Further, it is assumed that the distribution information update determination unit 231 stores a predetermined hash algorithm in its own storage area.

  The header information update determination unit 232 reads the URI to be determined stored in the URI information storage unit 212, transmits a distribution request of only header information with the read URI as a destination, and receives the distribution request from the destination according to the transmitted distribution request. The header information to be distributed is acquired, and determination processing for determining whether or not the distribution information distributed from the determination target URI has been updated based on the acquired header information is performed. The distribution request with only header information is, for example, an HTTP request message specifying a HEAD method. For example, the header information update determination unit 232 stores header information distributed from the determination target URI in the URI information storage unit 212 as basic information, calculates header information newly acquired from the determination target URI, It is determined whether or not the previously acquired header information matches the newly acquired header information. Thereby, it is determined whether or not the distribution information has been updated. The header information update determination unit 232 includes a first header information update determination unit 233 and a second header information update determination unit 234.

  The first header information update determination unit 233 performs determination processing based on basic information of a plurality of items that are defined in the header information. Here, an example will be described in which determination processing is performed based on information of four items of content-type, last-modified, content-length, and status code among items included in the header information. For example, if the type of distribution information is changed, the content-type value is changed, so that it can be detected that the distribution information has been changed. If the distribution information is updated, the last-modified value is updated, so that it can be detected that the distribution information has been changed. If the distribution information is changed and the data amount is changed, the content-length value is changed, so that it can be detected that the distribution information has been changed. If the destination is changed to be redirected, it is possible to detect that the distribution information has been changed because the status code is changed. However, the determination process may be performed using the header information of other items listed here. If the determination process based on the header information is performed in this way, it is not necessary to acquire the entity of the distribution information. Therefore, the distribution information update determination unit 231 acquires the entity of the distribution information and calculates the hash value. Determination processing can be performed at low load and high speed.

The second header information update determination unit 234 performs the same determination process based on the basic information having a smaller number of items than the plurality of items performed by the first header information update determination unit 233. For example, the determination process is performed using information on two items randomly selected from four items. The number of patterns for selecting two items from the four basic information items of the header information is ₄ C ₂ = 6 patterns. Therefore, the second header information update determination unit 234 randomly selects such a pattern, and stores a value for identifying the selected pattern in the URI information storage unit 212 in association with the determination target URI. Thus, by reducing the number of items to be acquired and the number of items to be compared, the determination process can be performed at a lower load and at a higher speed than the determination process by the first header information update determination unit 233.

  As described above, the preliminary circulation processing unit 230 according to the present embodiment includes a header information update determination unit 232 that performs a determination process for determining whether or not the distribution information distributed from the determination target URI has been updated by a different method. 1 header information update determination unit 233 and a second header information update determination unit 234 are provided. The determination process by the distribution information update determination unit 231 is more accurate than the determination process by the first header information update determination unit 233, and the determination process by the first header information update determination unit 233 is the second header information update determination unit 234. The accuracy is higher than the determination processing by On the other hand, the determination process by the second header information update determination unit 234 has a smaller processing load and higher speed than the determination process by the first header information update determination unit 233, and the determination process by the first header information update determination unit 233 is The processing load is smaller and faster than the determination processing by the distribution information update determination unit 231.

  The analysis execution possibility determination unit 235 distributes the determination processing of the header information update determination unit 232, the header information update determination unit 232, and the second header information update determination unit 234 from the determination target URI. By using properly according to the characteristics of the distribution information, it is accurately and efficiently determined whether or not the distribution information has been updated. That is, the analysis execution feasibility determination unit 235 performs determination processing by the distribution information update determination unit 231 and determination processing by the first header information update determination unit 233 for a plurality of URIs stored in the URI information storage unit 212. One or more of the determination processes by the second header information update determination unit 234 are performed, and the determination target URI is distributed based on the result of the determination process and the number of times the determination process has been performed. It is determined whether or not to analyze distribution information. Further, the analysis execution possibility determination unit 235 stores the URI determined to analyze the distribution information in the analysis information storage unit 213.

  When the analysis value determination unit 235 determines that the distribution information distributed from the determination target URI is to be analyzed, the index value calculation unit 236 is based on the number of times the determination processing by the preliminary circulation processing unit 230 is performed. The unupdated period index value indicating the length of the period during which the distribution information distributed from the determination target URI has not been updated is calculated. The index value calculation unit 236 stores the calculated unupdated period index value in the analysis information storage unit 213.

The cyclic scheduling unit 240 determines the order in which the cyclic processing unit 250 performs analysis processing on the URIs stored in the analysis information storage unit 213. The cyclic scheduling unit 240 includes a priority order determining unit 241.
The priority order determination unit 241 has a priority order indicating the order of analyzing distribution information distributed from a plurality of URIs determined to be analyzed based on the unupdated period index value calculated by the index value calculation unit 236. decide. For example, the priority order determination unit 241 increases the priority order as the period indicated by the unupdated period index value is longer.

The circulation processing unit 250 includes a first analysis unit 251, a second analysis unit 252, a browser 253, and an analysis control unit 254.
The first analysis unit 251 acquires distribution information distributed from the URI to be analyzed based on the priority order determined by the priority order determination unit 241, and the distribution information is predetermined unjust distribution information. It is determined whether or not there is. Specifically, the first analysis unit 251 transmits a distribution request addressed to the URI to be analyzed to the distribution server 100 without using the browser 253, and distributes from the distribution server 100 in response to the transmitted distribution request. Receive distribution information. Further, the first analysis unit 251 reads the attack information stored in the attack information storage unit 215, and whether or not the character string indicated in the read attack information is included in the distribution information received from the distribution server 100. Determine. When the first analysis unit 251 determines that the character string indicated in the attack information is included in the distribution information received from the distribution server 100, the first analysis unit 251 determines that the distribution information is illegal distribution information. On the other hand, if the first analysis unit 251 determines that the character string indicated in the attack information is not included in the distribution information received from the distribution server 100, the first analysis unit 251 determines that the distribution information is not unauthorized distribution information.

The second analysis unit 252 acquires distribution information distributed from the URI to be analyzed based on the priority order determined by the priority order determination unit 241, and the distribution information is predetermined illegal distribution information. It is determined whether or not there is. Specifically, the second analysis unit 252 operates the browser 253, causes the browser 253 to transmit a distribution request with the URI to be determined as a destination to the distribution server 100, and distributes the distribution server according to the transmitted distribution request. The distribution information distributed from 100 is read into the browser 253. The second analysis unit 252 reads the behavior information stored in the malignant behavior storage unit 216, and whether or not the operation of the browser 253 based on the received distribution information matches the behavior information read from the malignant behavior storage unit 216. Determine whether. If the second analysis unit 252 determines that the operation of the browser 253 based on the received distribution information matches the behavior information read from the malignant behavior storage unit 216, the second analysis unit 252 determines that the distribution information is illegal distribution information. On the other hand, if the second analysis unit 252 determines that the operation of the browser 253 based on the received distribution information does not match the behavior information read from the malignant behavior storage unit 216, the second analysis unit 252 determines that the distribution information is not illegal distribution information. To do.
The browser 253 is a web browser that transmits a distribution request with an input URI as a destination, and receives and outputs distribution information distributed in response to the transmitted distribution request.

  The analysis control unit 254 distributes the analysis processing performed by the first analysis unit 251 and the second analysis unit 252 as described above according to the characteristics of the distribution information distributed from the URI to be analyzed. It is efficiently determined whether or not the information has been tampered with. When the analysis control unit 254 determines that the distribution information has been tampered with, the analysis control unit 254 reads the system operator email address stored in the system operator information storage unit 217, and uses the read system operator email address as the destination, from the URI. Send an email notifying you that the delivery information may have been tampered with.

Next, an exemplary operation of the distribution information analysis apparatus 200 according to the present embodiment will be described in detail with reference to the drawings. FIG. 9 is a flowchart showing an operation example of URI extraction processing by the distribution server 100 of the present embodiment.
The URI extraction unit 220 reads a URI associated with the domain information stored in the domain information storage unit 211 (step S1), transmits a distribution request to the distribution server 100 with the read URI as a destination, and subordinates to the domain The URI embedded in the URI hierarchy information, page type, and distribution information is acquired (step S2). For example, when the HTML file is distributed in response to the distribution request transmitted to the distribution server 100, the URI extraction unit 220 analyzes the HTML file, detects a link such as an A tag embedded in the HTML file, The link destination URI is detected.

  If the detected URI of the link destination is a URI in the domain (step S3: YES), the URI extraction unit 220 displays the URI, domain information, hierarchy information, and page type as a URI information storage unit 212. (Step S4). The initial circulation flag is associated with an initial value of 1 and the other items are not stored at this time. The URI extraction unit 220 adds 1 to the number of URIs associated with the domain and stored in the domain information storage unit 211, and counts up (step S5). If the preliminary circulation processing unit 230 has not performed processing for all the URIs acquired in step S2 (step S6: NO), the process returns to step S3. If processing is performed for all URIs (step S6: YES), the URI extraction unit 220 returns to step S1 if processing is not performed for all domain information (step S7: NO). When the process is performed for all domain information (step S7: YES), the process ends. In step S3, if the detected URI of the link destination is not a URI in the domain (step S3: NO), the URI extraction unit 220 does not store the URI in the URI information storage unit 212, and proceeds to step S7. move on. This is because URIs only within the domain are targeted for determination, and alteration detection of external sites is not performed. However, in the URI extraction process, an external link destination can also be stored in the URI information storage unit 212 as a URI to be determined, and tampering detection can be performed.

FIG. 10 is a flowchart illustrating an operation example of the preliminary patrol process performed by the distribution server 100 according to the present embodiment.
The analysis execution possibility determination unit 235 of the preliminary circulation processing unit 230 reads out the URI information to be determined stored in the URI information storage unit 212 (step S10). The analysis execution availability determination unit 235 determines whether or not the initial circulation flag of the read URI information is 0 (step S11). When determining that the initial circulation flag of the URI information is 0 (step S11: YES), the analysis execution propriety determination unit 235 reads the number of URIs stored in the domain information storage unit 211 in association with the domain, It is determined whether or not the number of URIs read out is greater than or equal to α (step S12). α is a positive integer, for example, 1000. The analysis execution propriety determination unit 235 stores the value of α in advance in its own storage area.

  If the analysis execution possibility determination unit 235 determines that the number of URIs associated with the domain is greater than or equal to α (step S12: YES), the process proceeds to step S13. On the other hand, if it is determined that the number of URIs associated with the domain is not greater than or equal to α (step S12: NO), it is determined whether or not the hierarchy information corresponding to the URI to be determined is less than β (step S14). β is a positive integer, for example, 3. The analysis execution possibility determination unit 235 stores the value of β in advance in its own storage area. If the analysis execution possibility determination unit 235 determines that the hierarchical information corresponding to the determination target URI is less than β (step S14: YES), the URI information in the URI information storage unit 212 associated with the determination target URI. A higher value is stored in the unupdated counter threshold value (step S13). The higher value means that it is relatively higher than the value stored in step S15. For example, a value of 5 is stored in the update counter A threshold, 8 is stored in the update counter B threshold, and 5 is stored in the update counter C threshold.

  In step S14, when the analysis execution possibility determination unit 235 determines that the hierarchy information corresponding to the determination target URI is not less than β (step S14: NO), the URI information storage unit 212 associated with the determination target URI. A lower value is stored in the unupdated counter threshold value of the URI information in step S15. The lower value means that the value is relatively lower than the value stored in step S13, for example, 3 is stored in the update counter A threshold, 5 is stored in the update counter B threshold, and 3 is stored in the update counter C threshold. . As described above, the analysis execution propriety determination unit 235 determines the distribution information update determination unit 231 and the header information based on the number of URIs of distribution information distributed from the determination target domain and the hierarchy of the determination target URIs in the domain. An update counter threshold value that is an upper limit value of the number of times that the update determination unit 232 performs determination processing is determined.

  Here, as the number of URIs under the domain increases, the number of accesses to the domain is considered to increase. In addition, the shallower the hierarchy in the domain, the greater the number of accesses to the URI. If the number of accesses is large, it is easy to be selected as an attack target, and it is considered that there is a high possibility of being tampered by an attacker. On the other hand, as the update counter threshold is higher, more determination processes are performed by the distribution information update determination unit 231 and the header information update determination unit 232. Therefore, if the number of URIs under the domain is large or the hierarchy in the domain is shallow, a highly accurate update counter threshold value is set to perform highly accurate determination processing for URIs that are easily tampered with. be able to.

  Next, the analysis execution availability determination unit 235 determines whether the page type associated with the determination target URI is “html / css” (step S16). When the analysis execution possibility determination unit 235 determines that the page type associated with the determination target URI is “html / css” (step S16: YES), the update counter A associated with the determination target URI is calculated. It is determined whether or not it is less than the update counter A threshold (step S17). When the analysis execution possibility determination unit 235 determines that the update counter A associated with the determination target URI is less than the update counter A threshold (step S17: YES), the distribution information update determination unit 231 determines the determination target URI. A determination process is performed (step S18).

  In step S16, when the analysis execution availability determination unit 235 determines that the page type associated with the determination target URI is not “html / css” (step S16: NO), and in step S17, the analysis execution availability is determined. When the determination unit 235 determines that the update counter A associated with the determination target URI is not less than the update counter A threshold (step S17: NO), the update counter B associated with the determination target URI is the update counter. It is determined whether it is less than the B threshold (step S19). When the analysis execution possibility determination unit 235 determines that the update counter B associated with the determination target URI is less than the update counter B threshold (step S19: YES), the first header information update determination for the determination target URI. The unit 233 is caused to perform determination processing (step S20).

  In step S19, if the analysis execution possibility determination unit 235 determines that the update counter B associated with the determination target URI is not less than the update counter B threshold (step S19: NO), the second header for the determination target URI. The information update determination unit 234 performs determination processing (step S21). As described above, the analysis execution propriety determination unit 235 performs a determination process on the distribution information update determination unit 231 when the page type of the distribution information distributed from the determination target URI is “html / css” and is text information. If it is not text information, the header information update determination unit 232 performs a determination process.

  As described above, the processing load of the determination process by the distribution information update determination unit 231 is larger than the processing load of the determination process by the header information update determination unit 232. Distribution information whose page type is not “html / css” can be estimated as data having a capacity larger than text, such as a document file, a moving image file, and an audio file. When the determination process by the determination unit 231 is performed, an excessive load may be applied. Therefore, in the present embodiment, the determination process by the distribution information update determination unit 231 is performed only when the page type is “html / css” and the text information can be estimated to have a relatively small data capacity. Thereby, a processing load can be reduced and a determination process can be performed efficiently.

Here, the determination process of the distribution information update determination unit 231 in step S18, the determination process of the first header information update determination unit 233 in step S20, and the determination process of the second header information update determination unit 234 in step S21 Each will be described in detail.
FIG. 11 is a flowchart illustrating an example of determination processing performed by the distribution information update determination unit 231 according to this embodiment.
The distribution information update determination unit 231 reads a URI to be determined stored in the URI information storage unit 212, transmits a distribution request with the read URI as a destination, and is distributed from the destination according to the transmitted distribution request. Get information. The distribution information update determination unit 231 calculates a hash value based on the acquired distribution information. Also, the distribution information update determination unit 231 reads the hash value associated with the URI to be determined and stored in the URI information storage unit 212, and does the read hash value match the calculated hash value? It is determined whether or not (step S30).

  When the distribution information update determination unit 231 determines that the hash values match (step S31: YES), the distribution information update determination unit 231 associates 0 with the update presence / absence corresponding to the determination target URI, and sets the value of the update counter A to 1. The addition is performed and stored in the URI information storage unit 212 (step S32). In step S31, if the distribution information update determination unit 231 determines that the hash values do not match (step S31: NO), 1 is associated with the update presence / absence corresponding to the determination target URI, and the URI information storage is performed. The data is stored in the unit 212. In addition, the URI to be determined is associated with a value having an update value of 1 and stored in the analysis information storage unit 213 (step S33), and the process ends. As described above, the URI is stored in the analysis information storage unit 213, so that the cyclic processing unit 250 performs the cyclic processing.

FIG. 12 is a flowchart illustrating an operation example of determination processing by the first header information update determination unit 233 of the present embodiment.
The first header information update determination unit 233 reads the URI to be determined stored in the URI information storage unit 212, transmits a distribution request for only header information with the read URI as a destination, and responds to the transmitted distribution request. The header information distributed from the destination is acquired. The first header information update determination unit 233 reads out four items of basic information associated with the determination target URI and stored in the URI information storage unit 212, and the read basic information, distributed header information, and Are matched (step S40).

  If the first header information update determination unit 233 determines that the basic information matches (step S41: YES), the first header information update determination unit 233 associates 0 with the update presence / absence corresponding to the determination target URI, and the value of the update counter B 1 is added to and stored in the URI information storage unit 212 (step S42). In step S41, if the first header information update determination unit 233 determines that the basic information does not match (step S41: NO), 1 is associated with the update presence / absence corresponding to the determination target URI, The information is stored in the URI information storage unit 212. In addition, the URI to be determined is associated with a value having an update value of 1 and stored in the analysis information storage unit 213 (step S43), and the process ends.

FIG. 13 is a flowchart illustrating an operation example of determination processing by the second header information update determination unit 234 of the present embodiment.
The second header information update determination unit 234 reads the determination target URI information stored in the URI information storage unit 212, and determines whether or not the pattern value is 0 (step S50). If the value of the pattern is 0 (step S50: YES), the header information pattern to be compared is selected at random, and a value for identifying the selected pattern is stored in the URI information storage unit 212 (step S51). In step S50, if the value of the pattern is not 0 (step S50: NO), the header information of the two items indicated in the pattern is acquired from the URI to be determined. The second header information update determination unit 234 reads out two items corresponding to the basic information pattern stored in the URI information storage unit 212 in association with the URI to be determined, Then, it is determined whether or not the two items of the distributed header information match (step S52).

  If the second header information update determination unit 234 determines that the two items of basic information match (step S53: YES), the second header information update determination unit 234 is associated with the URI to be determined. Then, the value of the update counter C stored in the URI information storage unit 212 is read, and it is determined whether or not the value of the update counter C is less than the value of the update counter C threshold (step S54). If the second header information update determination unit 234 determines that the value of the update counter C is less than the value of the update counter C threshold (step S54: YES), the second header information update determination unit 234 handles 0 for the presence or absence of the update corresponding to the determination target URI. In addition, 1 is added to the value of the update counter C, and the result is stored in the URI information storage unit 212 (step S55).

  In step S54, when the second header information update determination unit 234 determines that the value of the update counter C is not less than the value of the update counter C threshold (step S54: NO), the second header information update determination unit 234 determines whether there is an update corresponding to the determination target URI. 0 is associated and stored in the URI information storage unit 212, and the URI to be determined is stored in the analysis information storage unit 213 (step S56). As a result, the cyclic processing unit 250 performs the cyclic processing on the URI to be determined. That is, when the update counter C is equal to or greater than the threshold value, the distribution information distributed from the URI to be determined has not been updated for a long period of time, and the cyclic processing by the cyclic processing unit 250 is performed for a long period of time. Is something that has not been done. However, since the determination processing by the second header information update determination unit 234 is determination based on only two items of header information, the values of the two items are not changed although the distribution information is updated. The case can be considered. Therefore, here, when the update counter C is equal to or greater than the threshold value, the cyclic processing by the cyclic processing unit 250 is performed.

  In step S53, when the second header information update determination unit 234 determines that the basic information of the two items does not match (step S53: NO), 1 is associated with the presence / absence of update corresponding to the URI to be determined. And stored in the URI information storage unit 212. In addition, the URI to be determined is associated with a value having an update value of 1 and stored in the analysis information storage unit 213 (step S57), and the process ends.

Returning to FIG. 10, when the determination process in any of step S18, step S20, and step S21 is performed, the index value calculation unit 236 indicates the value of the update counter that indicates the number of times the determination process by the preliminary cyclic processing unit 230 has been performed. Based on, an unupdated period index value indicating the length of the period in which the distribution information distributed from the URI to be determined has not been updated is calculated. Specifically, the index value calculation unit 236 determines (update counter A value × τ _A + update counter B value × τ _B + update counter based on the value of the update counter associated with the URI to be determined. A value of C value × τ _C ) is calculated as an unupdated period index value. Here, τ _A , τ _B , and τ _C are coefficients, and the index value calculation unit 236 stores them in its own storage area in advance. τ _A , τ _B, and τ _C are values that have a relationship of τ _A > τ _B > τ _C , for example, τ _A = 1.0, τ _B = 0.8, and τ _C = 0.5. is there.

Here, the update counter A is a value indicating the number of times that the distribution information update determination unit 231 determines that the update is not updated. The update counter B is a value indicating the number of times determined to be unupdated by the determination process by the first header information update determination unit 233. The update counter C is a value indicating the number of times that the second header information update determination unit 234 determines that the update has not been performed by the determination process. The determination process by the distribution information update determination unit 231 is more accurate than the determination process by the first header information update determination unit 233, and the determination process by the first header information update determination unit 233 is the second header information update determination unit 234. Therefore, it is considered that the reliability of the update counter A is higher than that of the update counter B, and the reliability of the update counter B is higher than that of the update counter C. Therefore, a more appropriate unupdated period index value can be calculated by multiplying coefficients (τ _A , τ _B , τ _C ) according to such reliability. The index value calculation unit 236 stores the unupdated period index value calculated in this way in the analysis information storage unit 213 in association with the determination target URI (step S22).

  If the value of the presence / absence of update associated with the determination target URI and stored in the URI information storage unit 212 is 1 (step S23: YES), the analysis execution propriety determination unit 235 corresponds to the determination target URI. The update counter A, the update counter B, and the update counter C to be reset are stored with 0 (step S24), the process returns to step S10, and the same processing is performed for other URIs to be determined. This is because the URI to be determined is stored in the analysis information storage unit 213. In step S23, if the update presence / absence value associated with the URI to be determined and stored in the URI information storage unit 212 is not 1 (step S23: NO), the update counter C is equal to or greater than the update counter C threshold. Or not (whether it matches the update counter C) or not (step S25). If the update counter C is equal to or greater than the update counter C threshold (step S25: YES), the process proceeds to step S24, and the update counter is reset. This is also because the determination target URI is stored in the analysis information storage unit 213.

  In step S25, when the analysis execution possibility determination unit 235 determines that the update counter C is not equal to or greater than the update counter C threshold (step S25: NO), the process returns to step S10. In step S11, when the analysis execution possibility determination unit 235 determines that the initial circulation flag of the URI information is not 0 (step S11: NO), 2 is associated with the update presence / absence corresponding to the URI to be determined, and the initial flag is set. 0 is associated and stored in the URI information storage unit 212. In addition, the URI to be determined is associated with a value having an update value of 2 in the analysis information storage unit 213 (step S26), and the process returns to step S10.

FIG. 14 is a flowchart showing an operation example of the regular scheduling process by the distribution server 100 of the present embodiment.
The priority order determination unit 241 of the cyclic scheduling unit 240 reads the analysis execution time stored in the analysis information storage unit 213 and determines whether or not the current time has passed X hours from the read analysis execution time ( Step S60). Here, X is a positive number, for example, 1. The priority order determination unit 241 stores the value of X in advance in its own storage area.

  If the priority determination unit 241 determines that the current time has passed X hours from the analysis execution time (step S60: YES), the plurality of URIs stored in the analysis information storage unit 213 are read out and associated with the URIs. Sorting is performed so that the updated presence / absence values are arranged in the order of 2, 0, 1 (step S61). Here, since the URI with the update presence / absence value of 2 has not been analyzed by the cyclic processing unit 250, it is more than the other URIs that have been analyzed by the cyclic processing unit 250. Increase priority. A URI having an update presence / absence value of 0 has not been analyzed by the cyclic processing unit 250 for a long period of time, and therefore has a higher priority than a URI having an update presence / absence value of 1. Then, the URIs having the same update presence / absence value are sorted in descending order of the unupdated period index value, and the sorted order is associated as a priority order and stored in the analysis information storage unit 213 (step S62). That is, the priority is increased as the analysis processing by the cyclic processing unit 250 is not performed for a long period of time. In step S60, if the priority determining unit 241 determines that the current time has not passed X hours from the analysis execution time (step S60: NO), the process is terminated without performing the priority determining process.

FIG. 15 is a flowchart illustrating an operation example of the patrol process by the distribution server 100 according to the present embodiment.
The analysis control unit 254 reads the URI to be analyzed from the analysis information storage unit 213 according to the priority order (step S70). Then, the analysis control unit 254 determines whether or not the page type associated with the URI to be analyzed is “html / css” (step S71). If the analysis control unit 254 determines that the page type associated with the URI to be analyzed is “html / css” (step S71: YES), the analysis control unit 254 determines whether the number of URIs in the domain is α or more. (Step S72). α is a positive integer, for example, 1000. The analysis control unit 254 stores the value of α in advance in its own storage area.

  When the analysis control unit 254 determines that the number of URIs of the domain to be analyzed is α or more (step S72: YES), the analysis unit 254 causes the first analysis unit 251 to perform analysis processing. The first analysis unit 251 transmits a distribution request addressed to the URI to be analyzed to the distribution server 100 without using the browser 253, and distributes distribution information distributed from the distribution server 100 in response to the transmitted distribution request. Receive. Then, the first analysis unit 251 reads the attack information stored in the attack information storage unit 215, and compares the character string indicated in the read attack information with the received distribution information (step S73). When the first analysis unit 251 determines that the character string indicated in the attack information is included in the distribution information received from the distribution server 100 (step S74: YES), the analysis information storage unit associates 1 with the presence or absence of falsification. It is stored in 213. In addition, the analysis control unit 254 reads the mail address stored in the system operator information storage unit 217, and notifies that the delivery information from the URI may be falsified with the read mail address as the destination. A mail to be sent is transmitted (step S75).

  In step S74, if the first analysis unit 251 determines that the character string indicated in the attack information is not included in the distribution information received from the distribution server 100 (step S74: NO), whether or not the URI to be analyzed has been falsified. 0 is associated and stored in the analysis information storage unit 213 (step S76). If the value of update presence / absence stored in the analysis information storage unit 213 in association with the URI to be analyzed is 2 (YES in step S77), the analysis control unit 254 acquires the distribution information acquired in step S73. Is calculated and stored in the URI information storage unit 212 (step S78). This is the case of the first round in which the analysis processing for the URI to be analyzed is performed for the first time, and the hash value is not stored in the URI information storage unit 212. If the analysis control unit 254 determines in step S77 that the update presence / absence value is not 2 (step S77: NO), the process returns to step S70.

  When the analysis control unit 254 determines in step S71 that the page type associated with the URI to be analyzed is not “html / css” (step S71: NO), and in step S72, the analysis control unit 254 If it is determined that the number of URIs of the domain to be analyzed is not greater than or equal to α (step S72: NO), the analysis control unit 254 causes the second analysis unit 252 to perform analysis processing. Using the browser 253, the second analysis unit 252 transmits a distribution request addressed to the URI to be analyzed to the distribution server 100, and receives distribution information distributed from the distribution server 100 in response to the transmitted distribution request. To do. Then, the second analysis unit 252 reads the behavior information stored in the malignant behavior storage unit 216, and compares the operation of the browser 253 with the behavior indicated by the read behavior information (step S79). If the second analysis unit 252 determines that the operation of the browser 253 based on the received distribution information matches the behavior information read from the malignant behavior storage unit 216 (step S80: YES), the second analysis unit 252 associates 1 with the presence or absence of falsification. The data is stored in the analysis information storage unit 213. In addition, the analysis control unit 254 reads the mail address stored in the system operator information storage unit 217, and notifies that the delivery information from the URI may be falsified with the read mail address as the destination. A mail to be transmitted is transmitted (step S81).

  If the second analysis unit 252 determines in step S80 that the operation of the browser 253 based on the received distribution information does not match the behavior information read from the malignant behavior storage unit 216 (step S80: NO), 0 is associated with the presence / absence of falsification of the URI and stored in the analysis information storage unit 213 (step S82). If the value of update presence / absence stored in the analysis information storage unit 213 in association with the URI to be analyzed is 2 (YES in step S83), the analysis control unit 254 acquires the distribution information acquired in step S79. The basic information included in the header information is stored in the URI information storage unit 212 (step S84). In this case, the analysis processing for the URI to be analyzed is performed for the first time, and basic information is not stored in the URI information storage unit 212. In step S83, if the analysis control unit 254 determines that the update presence / absence value is not 2 (step S83: NO), the process returns to step S70.

  As described above, according to the present embodiment, the determination target is first determined by the different determination processes of the distribution information update determination unit 231, the first header information update determination unit 233, and the second header information update determination unit 234. A preliminary tour is performed to determine whether or not the distribution information distributed from the URI has been updated. In this determination process, if the number of URIs in the domain is large (α or more), or if the URI hierarchy is shallow (less than β), the value of the unupdated counter is set to a higher value, and a more accurate determination process is performed. A lot was done. Distribution information from a URI included in a domain having a large number of URIs and distribution information from a URI having a shallow hierarchy are considered to have more accesses. For this reason, it is considered highly likely to become a target of attack. Therefore, for such a URI, it is possible to easily detect falsification by performing a more accurate determination process.

  In addition, it is considered that there is a high possibility that a URI having a high update frequency of distribution information has more accesses and becomes a target of an attack. Therefore, when the values of the update counter A and the update counter B are small (when the non-update period is a short period), more accurate determination processing is performed. As a result, it is possible to easily detect falsification of a URI having a high update frequency of distribution information.

  Furthermore, even for a URI for which no update of distribution information is detected, the distribution information is analyzed by the analysis control unit 254 when the value of the update counter C exceeds a threshold value. As a result, for example, even when an attack is performed such that the header information is not rewritten, the alteration can be detected.

  Thus, according to the present embodiment, based on characteristics such as the number of URIs under the domain, the hierarchy of URIs, and the update frequency of distribution information, more accurate determination processing is performed for URIs that are likely to be attacked, Analysis processing is performed, and a URI that is less likely to be attacked can be subjected to high-speed determination processing and analysis processing. Thereby, it is possible to monitor the alteration of the distribution information corresponding to a large amount of URIs with high accuracy and efficiency.

  The program for realizing the function of the processing unit in the present invention is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into the computer system and executed to analyze the distribution information. May be performed. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer system” includes a WWW system having a homepage providing environment (or display environment). The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

DESCRIPTION OF SYMBOLS 1 Communication system 100 Distribution server 200 Distribution information analysis apparatus 210 Storage part 211 Domain information storage part 212 URI information storage part 213 Analysis information storage part 214 Analysis execution time storage part 215 Attack information storage part 216 Malignant behavior storage part 217 System operator information Storage unit 220 URI extraction unit 230 Preliminary circulation processing unit 231 Delivery information update determination unit 232 Header information update determination unit 233 First header information update determination unit 234 Second header information update determination unit 235 Analysis execution availability determination unit 236 Index value Calculation unit 240 Cyclic scheduling unit 241 Priority determination unit 250 Cyclic processing unit 251 First analysis unit 252 Second analysis unit 253 Browser 254 Analysis control unit

Claims (8)

A plurality of URIs indicating destinations of the distribution request, and a URI information storage unit storing URIs to which distribution information to be analyzed is distributed when the distribution request is transmitted with the URIs as destinations;
A distribution information update determination unit that acquires distribution information distributed from the URI and performs a determination process to determine whether the acquired distribution information has been updated;
A header information update determination unit that performs a determination process of acquiring only the header information of the distribution information from the URI and determining whether the distribution information distributed from the URI has been updated based on the acquired header information;
For a plurality of URIs stored in the URI information storage unit, one or both of the determination process by the distribution information update determination unit and the determination process by the header information update determination unit is performed, and the result of the determination process And an analysis execution feasibility determination unit that determines whether or not to analyze distribution information distributed from the URI based on the number of times the determination process is performed,
When it is determined that the analysis is performed by the analysis execution determination unit, an unupdated period indicating the length of a period during which the distribution information distributed from the URI has not been updated based on the number of times the determination process has been performed An index value calculation unit for calculating an index value;
A priority order determining unit that determines a priority order indicating an order of analyzing distribution information distributed from the plurality of URIs determined to be analyzed based on the unupdated period index value;
An analysis unit that acquires distribution information distributed from the URI based on the priority and determines whether the distribution information is predetermined illegal distribution information;
A distribution information analyzing apparatus comprising: The header information update determination unit is based on a first header information update determination unit that performs the determination process based on information on a plurality of items included in the header information, and information on the number of items smaller than the plurality of items. The distribution information analysis apparatus according to claim 1, further comprising: a second header information update determination unit that performs the determination process. The distribution information update determination unit determines whether or not the distribution information has been updated by determining whether or not the hash value of the distribution information distributed from the URI matches the hash value of the previously acquired distribution information. The distribution information analyzing apparatus according to claim 1, wherein the distribution information analyzing apparatus is determined. The analysis execution availability determination unit causes the distribution information update determination unit to perform a determination process when the distribution information distributed from the URI is text information, and when the distribution information distributed from the URI is not text information. The distribution information analysis apparatus according to any one of claims 1 to 3, wherein the header information update determination unit performs a determination process. A domain information storage unit storing a plurality of domain information indicating domains to which distribution information to be analyzed is distributed;
A URI extraction unit that reads the domain information stored in the domain information storage unit, extracts a URI of distribution information distributed from the domain indicated by the domain information, and stores the extracted URI in the URI information storage unit When,
The distribution information analyzing apparatus according to claim 1, further comprising: The analysis execution availability determination unit performs the determination process on the distribution information update determination unit and the header information update determination unit based on the number of URIs of distribution information distributed from the domain and the hierarchy of the URIs. The distribution information analysis apparatus according to claim 5, wherein an upper limit value of the number of times to be performed is determined. A plurality of URIs indicating destinations of the distribution request, and a URI information storage unit storing URIs to which distribution information to be analyzed is distributed when the distribution request is transmitted to the URIs, and distributed from the URIs A distribution information update determination unit that performs a determination process for determining whether or not the acquired distribution information has been updated, acquires distribution information, acquires only the header information of the distribution information from the URI, and based on the acquired header information A distribution information analysis apparatus comprising: a header information update determination unit that performs a determination process for determining whether or not the distribution information distributed from the URI has been updated;
For a plurality of URIs stored in the URI information storage unit, one or both of the determination process by the distribution information update determination unit and the determination process by the header information update determination unit is performed, and the result of the determination process And determining whether or not to analyze distribution information distributed from the URI based on the number of times the determination process has been performed;
When it is determined that analysis is performed, a step of calculating an unupdated period index value indicating a length of a period in which the distribution information distributed from the URI has not been updated based on the number of times the determination process has been performed;
Determining a priority indicating an order of analyzing distribution information distributed from the plurality of URIs determined to be analyzed based on the unupdated period index value;
Obtaining distribution information distributed from the URI based on the priority, and determining whether the distribution information is predetermined illegal distribution information;
A distribution information analysis method comprising: A computer of a distribution information analysis apparatus including a plurality of URIs indicating destinations of a distribution request, and a URI information storage unit storing URIs to which distribution information to be analyzed is distributed when the distribution request is transmitted to the URIs. The
A distribution information update determination unit that performs determination processing for determining whether or not the acquired distribution information has been updated, by acquiring distribution information distributed from the URI;
A header information update determination unit that performs a determination process of acquiring only the header information of the distribution information from the URI and determining whether or not the distribution information distributed from the URI has been updated based on the acquired header information;
For a plurality of URIs stored in the URI information storage unit, one or both of the determination process by the distribution information update determination unit and the determination process by the header information update determination unit is performed, and the result of the determination process And an analysis execution availability determination unit that determines whether or not to analyze distribution information distributed from the URI, based on the number of times the determination process is performed,
When it is determined that the analysis is performed by the analysis execution determination unit, an unupdated period indicating the length of a period during which the distribution information distributed from the URI has not been updated based on the number of times the determination process has been performed An index value calculation unit for calculating an index value,
A priority determining unit that determines a priority indicating an order of analyzing distribution information distributed from the plurality of URIs determined to be analyzed based on the unupdated period index value;
An analysis unit that acquires distribution information distributed from the URI based on the priority, and determines whether the distribution information is predetermined illegal distribution information;
Program to function as.

Images