JP6063340B2 - Command source specifying device, command source specifying method, and command source specifying program - Google Patents

Description

  The present invention relates to a malware analysis technique, and more particularly to a technique for specifying a commander apparatus that gives a command to an infected apparatus infected with malware.

  In recent years, various malware (unauthorized software) has appeared. Some malware configures a botnet by waiting for commands from the commander by connecting to a C & C server (Command & Control Server) on the Internet after infection. Note that the C & C server is a server that sends a command (Command) to a computer group (botnet) infected with malware and turned into a bot, and is the center of control.

  If many such malwares are scattered, many devices will be infected and will connect to the C & C server. The commander can operate the infected apparatus by transmitting commands to these many malwares via the C & C server. As a method for preventing such remote operation, there is a method for disconnecting the connection between the infected apparatus and the C & C server.

JP 2010-015513 A

  However, when there are a plurality of C & C servers, the malware connects to the next C & C server even if the connection with one C & C server is cut off. For this reason, when there are many C & C servers, it is necessary to locate all the C & C servers and disconnect them, which is inefficient.

  The present invention has been made in view of the above points, and identifies a commander device that issues an operation command to an infected device via a C & C server, and disconnects the connection between the commander device and the C & C server. It is an object to provide a technology that makes it possible.

In order to solve the above-described problem, the present invention provides an acquisition unit that acquires information on a packet related to communication between an opposite apparatus that communicates with a predetermined server and the predetermined server;
Grouping means for grouping the opposing devices according to whether or not the communication matches a predetermined condition based on the information of the packet acquired by the acquisition means;
Of the groups obtained by the grouping by the grouping means, commands the opposing device belonging to the group having a smaller number of devices than other groups to the opposing device other than the opposing device via the predetermined server. And a specifying unit that specifies that the commander device is a candidate for the commander device to be performed.

  Of the groups obtained by grouping by the grouping means, the opposing device belonging to a group having a smaller number of devices than other groups is, for example, the opposing device grouped by the grouping means, The opposite device has the smallest number of devices belonging to the group.

  The specifying unit transmits the packet to the predetermined server based on the information on the packet acquired by the acquiring unit, and then the predetermined server is set as the candidate It may be determined whether or not to perform an operation of transmitting a packet to an opposite device other than the device, and when the operation is performed, the opposite device determined as the candidate may be determined to be the commander device.

  The predetermined condition is, for example, a condition based on the number of transmission bytes, a transmission cycle, an http header, or a port number. Further, for example, the predetermined server is a C & C server, and the opposing device other than the candidate opposing device is a malware infection device.

  When the port number of the packet transmitted from the opposite device to the predetermined server is a specific value, or the number of bytes of the packet transmitted from the opposite device, When the number of bytes of the response packet is larger than a predetermined threshold, the opposite device may be excluded from the grouping target.

  The present invention can also be configured as a command source specifying method executed by the command source specifying device and a command source specifying program for causing a computer to function as each means of the command source specifying device.

  According to the present invention, it is possible to specify the commander device that issues an operation command to the infected device via the C & C server, so that the infected device is disconnected by disconnecting the connection between the commander device and the C & C server. Can be quickly prevented from being remotely operated.

1 is an overall configuration diagram of a system according to an embodiment of the present invention. It is a functional lineblock diagram of command origin specific device 100 concerning an embodiment of the invention. 4 is a flowchart for explaining the operation of a command source identifying apparatus 100. It is a figure which shows the example of the result of grouping by the grouping process part. It is a figure which shows the example of the multistage structure of a C & C server.

  Embodiments of the present invention will be described below with reference to the drawings. The embodiment described below is only an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

  In the present embodiment, the communication between the C & C server and another device is monitored, and the C & C is based on the packet information related to the communication between the opposite device communicating with the C & C server and the C & C server. The communication pattern with the server is analyzed, and the opposing devices are grouped according to the communication pattern. In this embodiment, a group having a large number of opposing devices belonging to a communication pattern is regarded as a group of malware-infected devices, and the others are extracted as commander devices. Hereinafter, the processing content in this Embodiment is demonstrated in detail.

(System configuration)
FIG. 1 shows an overall configuration diagram of a system according to an embodiment of the present invention. In the example shown in FIG. 1, the infected device 10, the C & C server 20, and the commander device 30 infected with malware are connected to a communication network 40 (for example, the Internet). Also, a command source specifying device 100 that executes analysis processing for specifying the commander device according to the present invention is connected to the communication network 40. As shown in FIG. 1, the commander device 30 sends a command to the infected device via the C & C server 20.

  In the present embodiment, it is assumed that the infected device 10 periodically transmits a KeepAlive packet indicating that the connection is valid and that it is under control to the C & C server 20. In addition, a communication device 50 through which a packet related to communication between the C & C server 20 and another device passes is present in the communication network 40. The command source specifying device 100 monitors packets transmitted and received by the communication device 50 and performs a specifying process of the commander device 30 described later.

  The communication device 50 is, for example, a router, a switch, or the like, and is not limited to one, and may be a plurality. As for the packet monitoring method described above, for example, the command source identification apparatus 100 may acquire (capture) all packets transmitted and received by the communication apparatus 50 and analyze the acquired packets. It is possible to acquire and analyze only packets that match a previously specified flow condition (for example, transmission destination IP address, transmission source IP address) using the above flow protocol. As information to be acquired, all information of the packet may be acquired, or only information (for example, header information) necessary for analysis may be acquired.

  In the example described below, it is assumed that information of all packets is acquired. In the present embodiment, acquisition and analysis of packets may be performed in real time or may not be performed in real time. The case where it is not real time is, for example, a case where a packet transmitted and received in a certain period is acquired as a sample and analyzed later.

  FIG. 2 shows a functional configuration diagram of command source identifying apparatus 100 according to the present embodiment. As shown in FIG. 2, the command source specifying device 100 includes a packet information acquisition unit 101, a target packet information extraction unit 102, a grouping processing unit 103, a commander device specifying unit 104, a communication disconnection processing unit 105, and a packet information storage unit. 106, and a C & C server information storage unit 107. The outline of these functional units is as follows. Details of the operation of the command source identifying apparatus 100 will be described in the description of the operation.

  The packet information acquisition unit 101 acquires information on packets transmitted and received in the communication device 50 and stores the acquired information in the packet information storage unit 106. In this example, packet information with the current time (time stamp) is acquired, and packet information is stored in the packet information storage unit 106 together with the time stamp. The time stamp may be regarded as the time when the packet is received or transmitted by the communication device 50.

  The C & C server information storage unit 107 stores an address specified as an address (IP address or the like) of the C & C server 20 by analysis or the like separately performed, and the target packet information extraction unit 102 stores the address Is extracted from the packet information storage unit 106 as a destination address or a source address.

  The grouping processing unit 103 groups the addresses (IP address, etc.) on the opposite device side of the packets related to communication with the C & C server 20 extracted by the target packet information extraction unit 102 in a predetermined pattern, and results of grouping Is sent to the commander apparatus specifying unit 104. The commander device identification unit 104 identifies a candidate (address) of the commander device 30 based on the grouping result by the grouping processing unit 103, and when a predetermined communication operation is detected for the candidate, the commander device identification unit 104 A candidate for the device 30 is specified as the commander device 30. The communication disconnection processing unit 105 performs processing for disconnecting the communication of the commander device 30 specified by the commander device specifying unit 104.

  The command source identifying apparatus 100 according to the present embodiment can be realized by causing a computer used as the command source identifying apparatus 100 to execute a program describing the processing contents described in the present embodiment. That is, each functional unit in the command source identifying apparatus 100 is realized by executing a program corresponding to a process performed by each unit using hardware resources such as a CPU, a memory, and a hard disk built in the computer. Is possible. The above-mentioned program can be recorded on a computer-readable recording medium (portable memory or the like), stored, or distributed. It is also possible to provide the program through a network such as the Internet or electronic mail.

(Operation of command source specifying device 100)
Hereinafter, the operation of the command source identifying apparatus 100 will be described along the procedure of the flowchart of FIG. The command source specifying device 100 can specify command devices for various C & C servers. In the following example, processing focusing on a specific C & C server 20 is shown.

  The packet information acquisition unit 101 acquires information on packets transmitted and received in the communication device 50, and stores the acquired information in the packet information storage unit 106 together with a time stamp (step 101). This processing is performed every time a packet is transmitted and received in the communication device 50 at all times or for a predetermined period.

  Next, the target packet information extraction unit 102 extracts, from the packet information storage unit 106, packet information having the address of the C & C server 20 stored in the C & C server information storage unit 107 as a transmission destination address or a transmission source address ( Step 102).

  Then, the grouping processing unit 103 analyzes the information of the packet related to communication with the C & C server 20 extracted by the target packet information extraction unit 102, and thereby the address of the opposite device (for example: IP addresses)) are grouped, and the grouped result is passed to the commander apparatus specifying unit 104 (step 103).

  In the present embodiment, for example, the transmission cycle of packets addressed to the C & C server 20, the number of bytes transmitted of the packet addressed to the C & C server 20, the number of bytes transmitted of the packet originating from the C & C server 20, the http header of the packet addressed to the C & C server 20, The opposing device is grouped using one or more of the port number of the packet addressed to the C & C server 20 and the port number of the packet whose source is the C & C server 20.

  Regarding the transmission cycle of the packet addressed to the C & C server 20, it is assumed that the KeepAlive packet from the infected apparatus 10 described above is often transmitted at a predetermined time interval. Therefore, the transmission source of the packet transmitted at the same transmission cycle When there are a plurality of (addresses of a transmission source, representing the opposite device, the same applies hereinafter), they are grouped into the same group. Further, for example, if there is only one transmission source that does not transmit a packet with the above transmission cycle, the transmission source is classified into a group other than the above group. Such grouping processing can be realized by referring to the time stamp.

  Regarding the number of transmitted bytes of the packet, it is assumed that the number of bytes of the KeepAlive packet transmitted from the infected device 10 and the number of bytes of the response packet to the KeepAlive packet may be fixedly fixed, so the same transmission The transmission source of the packet addressed to the C & C server 20 having the number of bytes or the transmission destination of the packet having the transmission number of the C & C server 20 having the same transmission byte number is set to the same group.

  With regard to the http header, for example, transmission sources of packets having the same user agent information in the http header can be set to the same group. In addition, the infected device 10 infected with malware often communicates with the C & C server via http, and the http header attached to the http packet transmitted from the infected device 10 is a packet transmitted from a normal browser. Compared to the header, it has a feature that unnecessary information is deleted. Therefore, the transmission sources of packets having an http header whose information amount is smaller than a predetermined value may be grouped into the same group.

  Regarding the port number, for example, when the Web server is a C & C server, the destination port number of the packet addressed to the C & C server is assumed to be a predetermined value different from that of a normal Web server. The source of packets addressed to the C & C server having the same group. In addition, since it is possible that the transmission port on the malware side is fixed to a certain port, the transmission source of packets addressed to the C & C server 20 having the same transmission source port is classified into the same group, or the C & C having the same destination port. The transmission destination of the packet from the server 20 is classified into the same group.

  The grouping processing unit 103 may perform the above grouping for any one of a transmission cycle, the number of transmission bytes, an http header, a port number, or the like. The above grouping method is merely an example, and grouping may be performed using other conditions. For example, the transmission cycle and the number of transmitted bytes are focused on the regularity of the KeepAlive packet. In addition, if there is a packet in which regularity is seen in the packet transmitted and received by the infected apparatus 10, a condition based on the regularity Can be grouped.

  Next, the commander device specifying unit 104 extracts candidates for the commander device 30 using the result of grouping by the grouping processing unit 103 (step 104). Here, the commander apparatus specifying unit 104 specifies the counter apparatus belonging to the group having the smallest number of counter apparatuses (addresses) belonging to the group as a candidate of the commander apparatus 30 as a result of grouping by the grouping processing unit 103. To do. Or you may identify the opposing apparatus which belongs to groups other than the group whose number of opposing apparatuses is more than a predetermined value as a candidate of the commander apparatus 30.

  For example, it is assumed that the grouping processing unit 103 performs grouping under certain conditions, and as a result, a result as shown in FIG. 4 is obtained. That is, it is assumed that a group A including 10 opposing devices, a group B including 5 opposing devices, and a group C and a group D including 1 opposing device are obtained. At this time, the commander apparatus specifying unit 104 determines the counter apparatus C1 of group C and the counter apparatus D1 of group D as candidates for the commander apparatus 30. Here, if there is only one candidate, it may be specified as the commander device 30, and if there is only one, the commander device specifying process described later may be performed.

  In addition, when the grouping processing unit 103 performs grouping based on a plurality of conditions such as a transmission cycle and the number of transmission bytes, for example, a command is obtained by ANDing the candidates of the commander device 30 obtained for each of them. The candidate device 30 can be a candidate. For example, as a result of grouping by the transmission cycle, the opposing devices X1 and X2 are specified as candidates, and as a result of grouping by the number of transmission bytes, the opposing devices X1 and Y1 are specified as candidates, taking these ANDs, The opposing device X1 is a candidate for the commander device 30.

  Next, the commander device specifying unit 104 determines whether or not the commander device 30 is the commander device 30 by examining whether or not the commander device candidate obtained in step 104 exhibits a predetermined behavior.

  In the present embodiment, by analyzing the packet information stored in the packet information storage unit 106, after the commander apparatus candidate transmits the packet to the C & C server 20, one of the following (1) and (2) When the pattern is transmitted, the commander device candidate is identified as the commander device 30.

  (1) Immediately after the C & C server 20 receives a packet from the commander device candidate, the packet is transmitted to the infected device 10. This operation corresponds to a command transmission operation via the C & C server 20.

  (2) After receiving the packet from the commander device candidate, the C & C server 20 transmits the packet to the infected device 10 at the timing of receiving the packet from the infected device 10 (a packet that can be estimated to be keepalive sent periodically). To do. This operation can be presumed to be an operation in which the C & C server 20 once holds the command and sends the command in response to access from the infected apparatus 10. Since the send packet here may be different from the KeepAlive response in the number of bytes, etc., it can be confirmed in (2) that the number of bytes of the packet to the infected device 10 is different from the KeepAlive response It can be estimated that a packet related to a command from the commander has been sent more reliably.

  In the above operation, the address of the infecting device 10 for identifying the packet to or from the infecting device 10 is estimated as the commander device candidate as a result of the grouping in step 103. It can be identified by whether it corresponds to one of the addresses of the opposing device included in the group other than the group.

  Note that the C & C server 20 may be used as a normal Web server having the same IP address as that of the C & C server 20. In this case, as a result of grouping in step 103, a counter device belonging to a certain group may become an infected device 10. Alternatively, it may be a general terminal that accesses the Web server instead of the commander device 30. Therefore, it is desirable that the grouping processing unit 103 identifies a general terminal that accesses the Web server, and excludes this to perform grouping.

  Whether the access is to a normal Web server can be determined, for example, based on whether the destination port number in the packet is 80 (normal Web server port number). It is also possible to determine whether or not the number of transmission bytes from the server is considerably large (larger than a predetermined threshold) with respect to the number of transmission bytes of the packet transmitted from the transmission source.

  When the address (eg, IP address) of the commander device 30 is specified in step 105, the communication disconnection processing unit 105 subsequently continues so that the commander device 30 cannot communicate with the C & C server 20. Processing for disconnecting communication between the commander apparatus 30 and the C & C server 20 is performed (step 106). This process is not limited to a specific method. For example, the communication device 50 may be instructed not to transfer a packet from the commander device 30 to the C & C server 20, or an instruction for equipment closer to the subscriber side. For example, an instruction not to perform communication from the commander device 30 to the C & C server 20 may be issued to the access line facility of the commander device 30. In addition, it is not essential that the command source identifying apparatus 100 includes the communication disconnection processing unit 105, and the communication disconnection processing unit 105 may not be included. In this case, for example, the operator performs a process for disconnecting communication or some warning to the commander apparatus 30.

  The processing example based on the configuration of FIG. 1 has been described above, but the present invention can be applied without being limited to the configuration shown in FIG. For example, as shown in FIG. 5, the present invention can also be applied when the C & C server has a multi-stage configuration. When a very large number of infected devices are under control, the C & C server may be configured in multiple stages as shown in FIG. In such a case, by using the grouping technique described so far, first, communication between the infection apparatus 10 and the C & C server 20-1, and communication between the C & C server 20-1 and the C & C server 20-2 are performed. The C & C server 20-2 is identified by determining the communication, and then the communication between the C & C server 20-1 and the C & C server 20-2 and the communication between the C & C server 20-2 and the C & C server 20-3 are determined. By identifying the C & C server 20-3, and finally determining the communication between the C & C server 20-2 and the C & C server 20-3 and the communication between the C & C server 20-3 and the commander apparatus 30 The commander device 30 is specified.

(Summary of the embodiment, effects)
As described above, in the present embodiment, the communication between the C & C server 20 and the opposite device is monitored, and the C & C server 20 and the information on the packet related to the communication between the opposite device and the C & C server 20 are The commander device 30 is extracted by grouping the opposing devices according to the communication pattern, and the connection between the commander device 30 and the C & C server 20 is cut off. This makes it possible to quickly stop the infected device 10 from being damaged by remote operation.

  The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

10 Infection Device 20 C & C Server 30 Commander Device 30
40 communication network 100 command source identification device 101 packet information acquisition unit 102 target packet information extraction unit 103 grouping processing unit 104 commander device identification unit 105 communication disconnection processing unit 106 packet information storage unit 107 C & C server information storage unit

Claims (7)

An acquisition unit that acquires information on a packet related to communication between the opposite device that communicates with the predetermined server and the predetermined server;
Grouping means for grouping the opposing devices according to whether or not the communication matches a predetermined condition based on the information of the packet acquired by the acquisition means;
Of the groups obtained by the grouping by the grouping means, commands the opposing device belonging to the group having a smaller number of devices than other groups to the opposing device other than the opposing device via the predetermined server. A specifying means for specifying that the commander device is a candidate to perform;
A command source specifying device comprising: The specifying unit transmits the packet to the predetermined server based on the information on the packet acquired by the acquiring unit, and then the predetermined server is set as the candidate It is determined whether or not to perform an operation of transmitting a packet to an opposite device other than the device, and when the operation is performed, the opposite device determined as the candidate is determined to be the commander device. The command source specifying device according to 1. The command source specifying device according to claim 1, wherein the predetermined condition is a condition based on a transmission byte count, a transmission cycle, an http header, or a port number. The command source according to any one of claims 1 to 3, wherein the predetermined server is a C & C server, and the opposing device other than the candidate opposing device is a malware infection device. Specific device. The grouping means includes
When the port number of the packet transmitted from the opposite device to the predetermined server is a specific value or the number of bytes of the response packet from the predetermined server with respect to the number of bytes of the packet transmitted from the opposite device The command source identification device according to any one of claims 1 to 4, wherein the counter device is excluded from the grouping target when the value is larger than a predetermined threshold value. A command source identification method executed by the command source identification device,
An acquisition step of acquiring information on a packet relating to communication between the opposite device that communicates with the predetermined server and the predetermined server;
A grouping step of grouping the opposing devices according to whether or not the communication matches a predetermined condition based on the information of the packet acquired by the acquiring step;
Among the groups obtained by grouping in the grouping step, a command is sent to the opposing device other than the opposing device to the opposing device belonging to the group having a smaller number of devices belonging to the other group via the predetermined server. A specific step that identifies the commander device as a candidate to perform;
A command source specifying method comprising:   A command source identification program for causing a computer to function as each unit of the command source identification device according to any one of claims 1 to 5.

Images