JP6454617B2 - Malware operating environment estimation method, apparatus and system thereof - Google Patents

Description

  The present invention relates to a malware operating environment estimation method, an apparatus thereof, and a system.

  In recent years, the threat of malware such as computer viruses has increased in organizations such as corporations, and countermeasures against malware are urgently required to protect confidential information of organizations. New malware appears every day, and it is difficult to prevent the intrusion of malware at the entrance of the organization, and it is important to take measures on the premise that the malware has entered the organization. As such a measure, there is a method of clarifying the behavior of malware and taking a measure according to the behavior.

  As a technique for clarifying the behavior of malware, there is a dynamic analysis technique as described in Patent Document 1. This is a technique for clarifying the behavior of malware by actually operating it in an analysis environment and recording activities such as file access, network access, and API (Application Interface) calls. The technique described in Patent Literature 1 has a function of determining whether a program that has been subjected to dynamic analysis is malware or performing a malicious activity, and outputting it.

JP 2010-198054 A

  If the technique described in Patent Document 1 is used, it is possible to specify that malware has performed a malicious activity in a certain environment. However, it is not possible to identify information on the environment that caused malware to perform malicious activities. For this reason, in an organization having a large number of computers, it is possible to reduce the cost of malware countermeasures by narrowing down the countermeasure target computers.

  Therefore, an object of the present invention is to estimate the operating environment of malware.

  A typical malware operating environment estimation method according to the present invention acquires information on the behavior of the malware from each of a plurality of analysis systems, extracts elements of the operating environment related to the acquired information, and A combination of elements of the extracted operating environment is generated for all of the analysis systems, information on the operating status of the malware is acquired for all of the plurality of analysis systems, and a combination of the elements of the operating environment is obtained. Based on information on whether each of the plurality of analysis systems includes one of the above and information on whether the malware has been operated on each of the plurality of analysis systems, the operating environment of the malware is estimated It is characterized by doing.

  According to the present invention, the operating environment of malware can be estimated.

It is a figure which shows the example of a network system. It is a figure which shows the example of the hardware of a malware operation environment estimation apparatus. It is a figure which shows the example of a structure of the malware operating environment estimation apparatus. It is a flowchart which shows the example of a process of an environmental element extraction part. It is a figure which shows the example of environmental element extraction logic DB. It is a flowchart which shows the example of a process of an environment information generation part. It is a figure which shows the example of analysis environment information DB. It is a flowchart which shows the example of a process of an operating environment estimation process part. It is a figure which shows the example of processing module DB. It is a figure which shows the example of a display screen. It is a figure which shows the example of malware operating environment log | history DB. It is a flowchart which shows the example of a process of the environment element extraction part which acquires operation | movement environment historical information.

  DESCRIPTION OF EMBODIMENTS Hereinafter, modes (examples) for carrying out the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram illustrating an example of a network system 100. The network system 100 includes a malware operating environment estimation device 101, a client terminal 102, and a malware analysis system 104, which are connected via a network 103, respectively. A plurality of client terminals 102 may exist in the network system 100.

  The malware analysis system 104 is a system that analyzes malware in the network system 100, and transmits an analysis report to the malware operating environment estimation apparatus 101 via the network 103. There are a plurality of malware analysis systems 104, and each of the plurality of malware analysis systems 104 has an analysis environment. The analysis environment is composed of a plurality of environments, which are the types of OS (Operating System), application programs being executed, and the like, which will be described later with reference to FIG.

  Each analysis environment in the plurality of malware analysis systems 104 may have the same analysis environment or a part of the analysis environment. However, each of the analysis environments of the plurality of malware analysis systems 104 is slightly different, and the accuracy of the estimation of the malware operating environment is improved when there are more variations of the analysis environment.

  The analysis report may include malware information related to the malware itself such as the file name of the malware, information on the behavior of the malware such as calling a specific API, and information on the analysis environment of the malware analysis system 104 that generated the analysis report. The analysis report may include information that is an environment in which malware did not operate. The malware information, the analysis environment information, and the information that is the environment in which the malware did not operate represent the operation of the malware in a specific environment, and thus can be regarded as a malware operation determination result.

  The analysis report may not include specific information such as the type of OS as the analysis environment information, and may include an analysis environment identifier that is information for identifying the analysis environment. The malware information will be described later with reference to FIG. 11, the behavior information of the malware will be described later with reference to FIG. 5, and the analysis environment information will be described later with reference to FIG. Since the plurality of malware analysis systems 104 transmit analysis reports, respectively, they are combined into an analysis report group.

  Although not shown, other computer devices or network devices in the organization that operates the malware operating environment estimation apparatus 101, computers used by an administrator who manages the malware operating environment estimation apparatus 101, and the like are connected to the network 103. Also good.

  FIG. 2 is a diagram illustrating an example of hardware of the malware operating environment estimation apparatus 101. As illustrated in FIG. The malware operating environment estimation device 101 includes a communication device 201, an input device 202, a display device 203, an arithmetic device 204, a memory 205, and a storage device 206.

  The communication device 201 is a network interface such as a network card. The communication device 201 receives data from other devices via the network 103 and sends the received data to the arithmetic device 204. Then, the communication device 201 transmits the data generated by the arithmetic device 204 to another device via the network 103.

  The input device 202 is a device such as a keyboard or a mouse, and is a device for accepting input of information by an administrator. The display device 203 is a device such as an LCD (Liquid Crystal Display), and is a device for outputting information to an administrator.

  The storage device 206 is a device such as a hard disk, and stores a program executed by the arithmetic device 204, data used by the arithmetic device 204, and the like. The memory 205 is a storage area from which data or the like is temporarily read, and a program or data stored in the storage device 206 may be read into the memory 205 or data stored in the memory 205 may be stored. It may be written to the device 206.

  The arithmetic device 204 executes a program stored in the storage device 206 or the memory 205, and controls each device provided in the malware operation environment estimation device 101. The arithmetic device 204 controls the input device 202 and the display device 203, receives data input from the input device 202, and outputs the data to the display device 203. The program stored in the storage device 206 may be read out from the storage device 206 to the memory 205 by the arithmetic device 204, stored in the memory 205, and executed.

  The arithmetic unit 204 reads the program from the storage device 206. As another example, the arithmetic unit 204 is an optical recording medium such as a CD (Compact Disc) or a DVD (Digital Versatile Disc), or a magneto-optical recording medium such as an MO (Magneto-Optical Disc). The program may be read from a recording medium such as a tape medium, a magnetic recording medium, or a semiconductor memory. As another example, a program may be read from another device via a communication medium. A communication medium refers to a network or a digital signal or carrier wave that propagates through the network.

  The hardware of the client terminal 102 shown in FIG. 1 is the same hardware as the malware operating environment estimation apparatus 101 shown in FIG. Therefore, a specific description of the hardware of the client terminal 102 is omitted.

  FIG. 3 is a diagram illustrating an example of the configuration of the malware operating environment estimation apparatus 101. The malware operation environment estimation device 101 includes an environment element extraction unit 301, an environment element extraction logic DB (Data Base) 302, an environment information generation unit 303, an analysis environment information DB 304, an operation environment estimation processing unit 305, a processing module DB 306, and an output processing unit. 307, the malware operating environment history DB 308. Each of these units may be realized by the arithmetic device 204 executing a program.

  The environment element extraction unit 301 receives a malware analysis report group including one or more malware analysis reports as input, and performs matching between the extraction logic stored in the environment element extraction logic DB 302 and the input analysis report group, When matching, according to the information in the environment element extraction logic DB 302, the element to be extracted from the information stored in the analysis environment information DB 304 is output as an extraction element.

  Here, the malware analysis report is information on the behavior of malware already described, which is obtained as a result of analyzing the malware using a technique such as that described in Patent Document 1, for example. File access (read, write, create, delete, etc.) record, registry access (read, write, add, delete, etc.) record, network access (access destination, send / receive information, etc.) record, API call record (API called) Including one or more types of information of the given parameter, return value, etc.).

  The environment information generation unit 303 is called with the extraction element that is the output of the environment element extraction unit 301 as an input, and the operation environment estimation process based on the information included in the extraction element and the information stored in the analysis environment information DB 304 Generates and outputs the analysis environment information for estimating the operating environment used in.

  The operating environment estimation processing unit 305 is called with the operating environment estimation analysis environment information output from the environment information generating unit 303 and the malware operation determination result as input, and is input according to the processing module stored in the processing module DB 306. Are recorded in the malware operation environment history DB 308 as the operation environment estimation result, and the operation environment estimation result is output.

  The malware operation determination result used in the operation environment estimation processing unit 305 is the operation determination result of malware in a plurality of environments among the environments in which environment information is defined in the analysis environment information DB 304. The determination of whether or not the malware is operating in a certain environment may use, for example, a determination result output as a result of the dynamic analysis of malware represented by the technique described in Patent Document 1, The resulting malware behavior report may be separately analyzed and acquired.

  The process of acquiring the malware operation determination result is not limited to these, and may be acquired directly from the analysis report received via the network 103, or may be acquired from the analysis report received via the network 103. It may be acquired via or may be acquired by other processing.

  The output processing unit 307 receives the operating environment estimation result output from the operating environment estimation processing unit 305 as an input, and displays the operating environment estimation result to the user (administrator) of the malware operating environment estimation apparatus 101. The system administrator is notified by e-mail, and the operation environment estimation result is automatically input to other systems.

  FIG. 4 is a flowchart illustrating an example of processing performed by the environment element extraction unit 301. The environment element extraction unit 301 identifies and extracts specific elements of the operating environment from information such as malware behavior included in the analysis report. First, the environmental element extraction unit 301 acquires an analysis report group as an input in step S401. Subsequently, in step S402, it is determined whether all analysis reports have been processed. If it is determined that all analysis reports have not been processed, the process proceeds to step S403, where one unprocessed analysis report is acquired, and the target Analysis report.

  In step S404, the environment element extraction unit 301 acquires a list of extraction logics from the environment element extraction logic DB 302. In step S405, it is determined whether all the extraction logics have been processed. If it is not determined that all the extraction logics have been processed, the process proceeds to step S406. In step S406, one unprocessed extraction logic is acquired and set as a target extraction logic.

  In step S407, the environment element extraction unit 301 determines whether a behavior that matches the target extraction logic condition exists in the target analysis report. If it is determined that it exists, the process proceeds to step S408, and the additional element and priority information of the target extraction logic are added to the extracted element, and the process proceeds to step S409. If no behavior matching the condition of the target extraction logic exists in the target analysis report in step S407, the process proceeds to step S409. In step S409, the target extraction logic is set as processed, and the process returns to step S405.

  If the environment element extraction unit 301 determines in step S405 that all the environment element extraction logics are set to processed, the process proceeds to step S410, sets the target analysis report as processed, and returns to step S402. If it is determined in step S402 that all analysis reports have been processed, the extracted element is output in step S411, and the process ends.

  Moreover, it is good also as a structure which sets and outputs a priority with respect to the environmental element which was not contained in the extraction element at the time of output by the process of the environmental element extraction part 301. FIG. Thereby, for example, when there is an element that affects the operation of the malware but does not appear in the analysis report, it can be set as a candidate for the operation environment. The priority at that time may be set in advance, or may be determined mechanically from the environmental elements included in the extraction elements and their priorities.

  FIG. 5 is an explanatory diagram showing an example of the environment element extraction logic DB 302. The environment element extraction logic DB 302 includes a number field 501, a condition field 502, an additional element field 503, and a priority field 504. The information in the number column 501 is an identifier for uniquely determining the extraction logic. In the example of FIG. 5, one row of the table is one extraction logic. Information in the condition column 502 indicates a condition of information included in the malware analysis report for determining whether or not to add the information in the additional element column 503 and the priority column 504 to the output of the environment element extraction unit 301.

  Here, in the information in the condition column 502, as shown in FIG. 5, whether or not a specific API is called, whether or not a specific file is accessed, whether or not a specific file is executed, network access is included. Information such as whether or not it has been performed and whether or not information related to a specific setting has been referred to is included. Information such as whether or not all of a plurality of conditions are satisfied (AND condition) and whether or not any one of the plurality of conditions is satisfied (OR condition) may be set.

  In the example of FIG. 5, the information in the condition column 502 is expressed by text for explanation, but may be a character code string of a log file, a specific code, or the like. Any information format common to the extraction unit 301 may be used.

  The information in the additional element column 503 and the priority column 504 is information used when the behavior of the malware included in the malware analysis report satisfies the condition in the condition column 502. The information in the additional element column 503 is the environment element extraction unit. It is an environmental element to be added to the output information 301, and the information in the priority column 504 is the priority for the information in the additional component column 503. Note that the additional element field 503 may include not only one but a plurality of pieces of information. Information in the environment element extraction logic DB 302 may be set in advance.

  FIG. 6 is a flowchart illustrating an example of processing of the environment information generation unit 303. Since the operating environment extracted by the environment element extracting unit 301 is limited to the operating environment where the malware is actually recorded, the environment information generating unit 303 obtains information on the operating environment obtained by extending the limited operating environment pattern. Generate. First, in step S601, the environment information generation unit 303 acquires an extraction element that is an output of the environment element extraction unit 301. In step S602, the environment information generation unit 303 acquires analysis environment information from the analysis environment information DB 304. The acquired extracted element includes the information of the additional element column 503 as described above.

  In step S603, the environment information generation unit 303 extracts the analysis environment identifier and the information of the column that matches the acquired extraction element from the analysis environment information acquired from the analysis environment information DB 304, and uses them to analyze the analysis environment for estimating the operating environment. Generate information. The analysis environment identifier and the column will be described later with reference to FIG. Through step S603, information on the operating environment where the malware is actually recorded is generated.

  The environment in which the malware operates may be, for example, an environment having both a specific OS and a specific application, or may be an environment of either a specific OS or a specific application, or any other environment. Therefore, in the following steps S604 to S606, as much environment information as possible is generated based on the information of the operating environment where the malware is actually recorded.

  In step S604, the environment information generation unit 303 newly adds a column for which a NOT operation is performed to each column other than the analysis environment identifier of the analysis environment information for operation environment estimation as a column of analysis environment information for operation environment estimation. . In step S605, with respect to the columns other than the analysis environment identifier of the analysis environment information for estimating the operating environment, a result of performing an AND operation on all combinations of the two columns is newly added as a column of the analysis environment information for estimating the operating environment.

  Further, in step S606, the environment information generation unit 303 newly analyzes the result of OR operation of combinations of all two columns for columns other than the analysis environment identifier of the analysis environment information for operation environment estimation. Add as a column of environment information. Finally, in step S607, the generated analysis environment information for estimating the operating environment is output from the environment information generation unit 303 and the process ends.

  In the example of the processing flow of the environment information generation unit 303 shown in FIG. 6, column NOT operations, column AND operations and OR operations are performed, but the configuration is not limited to performing all these operations. Only some of these operations may be performed, or these operations may not be performed at all. Further, these calculations may not be performed on all the columns of the analysis environment information for estimating the operating environment or a combination of all the two columns, but may be performed only on some columns.

  Further, the AND operation and the OR operation are not limited to the combination of two columns, and a result obtained by performing an operation on a combination of three or more columns may be added. Further, the order in which the NOT operation, the AND operation, and the OR operation are performed is not limited to the order shown in the example of FIG. 6, and the operation may be performed in an arbitrary order. Further, these operations are not limited to being performed only once, and the same operation may be performed twice or more.

  In addition, the priority setting corresponding to the column added by the OR operation, the AND operation, and the NOT operation may be set to a specific value set in advance, or according to the priority of the target column on which the operation is performed. May be calculated and set.

  The environment information generation unit 303 may give priority to each column based on the priority included in the extraction element output from the environment element extraction unit 301, that is, the information in the priority column 504. Columns added by operations of multiple columns are given priorities calculated by applying calculations set in advance for each type of operation to the multiple priorities of the column that was the basis of the operation. May be.

  The column added by the AND operation may be given a priority higher than the priority of the column that is the basis of the AND operation. The column added by the OR operation may be given a priority lower than the priority of the column that is the basis of the OR operation. The analysis environment information for operating environment estimation may include these assigned priorities.

  FIG. 7 is a diagram illustrating an example of the analysis environment information DB 304. The analysis environment information DB 304 includes an analysis environment identifier column 701 and an environment information column 702. The analysis environment identifier column 701 is an identifier that uniquely defines the analysis environment. Since the identifier of the analysis environment is assigned to each malware analysis system 104, the number of identifiers is the number of malware analysis systems 104.

  The environment information column 702 is information regarding each analysis environment uniquely identified in the analysis environment identifier column 701. Information included in the environment information column 702 includes information related to “Platform” of the analysis environment (physical machine or virtual machine, etc.), information related to “OS” (major version, service pack, etc.), and information related to “App” (application). (Application name, version, etc.), information about what “communication environment” (no external connection, direct external connection possible, external connection possible via proxy server, simulated environment emulating external connection, etc.), “ Information about “patches” (whether a specific patch has been applied, etc.), information about “settings” of the OS and applications (whether specific settings have been made, etc.), information about “files” (specific files exist in the analysis environment) Information, etc.).

  In the environment information column 702, “1” is stored when there is information regarding the platform of the analysis environment configuring the environment information column 702 in each analysis environment, and “0” is stored when there is no information. Specifically, as shown in FIG. 7, when the “Platform” with the analysis environment identifier “A” is a physical environment, “1” is set in the “Physical” column, and “ “0” is set. Further, when the “OS” installed in the analysis environment identifier “A” is “OS A”, “1” is displayed in the “OS A” column, and “0” is displayed in the other OS columns. Is set. Note that the information in the analysis environment information DB 304 may be set in advance.

  In the example of FIG. 7, the analysis environment information DB 304 is a table storing information of “0” and “1”. However, the configuration is not limited to such a configuration. Alternatively, the configuration may be such that information on the application is stored as a character string and converted into a table of 0 and 1 in the environment information generation unit 303.

  FIG. 8 is a flowchart illustrating an example of processing of the operating environment estimation processing unit 305. The operation environment estimation processing unit 305 narrows down the environment in which the malware operates based on the relationship between the analysis environment information for operation environment estimation and the operation determination result indicating whether the malware has operated in the plurality of malware analysis systems 104, that is, the analysis environment, presume.

  First, in step S801, the operation environment estimation processing unit 305 acquires the operation environment estimation analysis environment information output from the environment information generation unit 303 and the operation determination result of malware in a plurality of environments. In step S802, all processing modules are acquired from the processing module DB 306.

  In step S803, the operating environment estimation processing unit 305 determines whether all the processing modules have been processed. If it is not determined that all the processing modules have been processed, the process proceeds to step S804. Are obtained and set in the target processing module.

  In step S805, the operating environment estimation processing unit 305 processes the operating environment estimation analysis environment information and the operation determination result acquired in step S801 using processing logic in the target processing module, and obtains a processing result. In step S806, it is determined whether the obtained processing result satisfies an end condition in the target processing module. If it is determined that the end condition is satisfied, the process proceeds to step S807, the obtained processing result (estimation result) is output as the output of the target processing module, the target processing module is set as processed, and the process returns to step S803.

  If it is determined that the end condition is not satisfied as a result of the determination in step S806, the operating environment estimation processing unit 305 proceeds to step S808, performs the process when the condition is not reached in the target processing module, and proceeds to step S805. Returning, the processing by the processing logic in the processing module is performed again. If it is determined in step S803 that all the analysis modules have been processed, the process advances to step S809 to add the operation environment estimation result obtained by the processing module to the malware operation environment history DB 308, and in step S810, the operation environment estimation result. And exit.

  FIG. 9 is a diagram illustrating an example of the processing module DB 306. The processing module DB 306 includes a module identifier column 901, a processing logic column 902, an end condition column 903, and a condition unachieved processing column 904. A module identifier column 901 is an identifier for uniquely identifying a processing module. The processing logic 902 column is the content of the operating environment estimation processing performed by the processing module identified by the identifier.

  The end condition column 903 is information indicating the end condition of the operating environment estimation process by the processing module identified by the identifier. The condition unachieved processing column 904 indicates processing performed when the end condition in the end condition column 903 is not satisfied in the operation environment estimation processing by the processing module identified by the identifier. If the end condition is not satisfied, the process shown in the condition unachieved processing column 904 is performed, and the process shown in the processing logic 902 column is performed again.

  In the example of FIG. 9, the information in each column is expressed by text for explanation. However, a specific code indicating the content of each text may be used, and the executable program of the operating environment estimation processing unit 305 It may be a macro or the like. Information in the processing module DB 306 may be set in advance.

  FIG. 10 is a diagram illustrating an example of a display screen by the output processing unit 307. FIG. 10 is a display example of the operating environment estimation result of a certain malware. The operating environment estimation result of the malware to be displayed is acquired from the malware operating environment history DB 308 and displayed, or the output of the operating environment estimation processing unit 305 is displayed. To do. The information for identifying the malware may be some identification information for identifying the malware, or the name of the malware identified by the anti-virus software scan result described with reference to FIG.

  A display 1001 is operation environment information included in the operation environment estimation result of malware, and a display 1002 is a link to an external system for confirming whether an environment that satisfies the estimated operation environment condition exists in the organization. It is. A display 1003 is a detailed operation environment estimation result, and displays a processing module that has performed the operation environment estimation processing and information obtained as a result of the processing. The operating environment information and the operating environment estimation result may be an estimation processing result and an operating environment described with reference to FIG.

  FIG. 11 is a diagram illustrating an example of the malware operating environment history DB 308. The malware operating environment history DB 308 includes a malware identifier column 1101, a hash value column 1102, a malware information column 1103, an estimation processing result column 1104, and an operating environment column 1105. The malware identifier column 1101 is an identifier for uniquely identifying malware targeted for the operation environment estimation by the malware operation environment estimation apparatus 101.

  The hash value column 1102 is an output value obtained from the malware file identified by the malware identifier 1101 as an input of the cryptographic hash function. Here, the cryptographic hash function is MD5, SHA1, SHA256, or the like, but the information in the hash value column 1102 is not limited to these cryptographic hash functions.

  The malware information column 1103 is information regarding the malware identified in the malware identifier column 1101. The information included in the malware information column 1103 is, for example, a malware file name, a file size, and a scan result with anti-virus software. The name of the malware may be included in the scan result of the anti-virus software. The information of the malware information 1103 is not limited to these pieces of information, and may include character string information extracted from the malware main body, results of inputting the malware into a specific tool, and the like.

  The estimation process result column 1104 and the operation environment column 1105 hold the operation environment obtained by estimating the malware operation environment identified by the malware identifier 1101 in the malware operation environment estimation device 101. The information in the operating environment column 1105 is not limited to the results of estimating the operating environment in the past, but the operating environment information found by detailed analysis of the malware identified by the malware identifier 1101 and external information provision Further, it may be stored.

  The above is the operation of the malware operation environment estimation apparatus 101. The above-described operation is merely an example, and does not limit the embodiment of the present invention.

  An example of the configuration of the malware operating environment estimation apparatus 101 is as shown in FIG. 3, but the configuration is not limited to this, and the environment element extraction unit 301, environment element extraction logic DB 302, environment element generation unit 303, analysis A network in which the environment information DB 304, the operation environment estimation processing unit 305, the processing module DB 306, the output processing unit 307, and the malware operation environment history DB 308 operate on different devices, and the units and DBs are connected by a network. It may be configured as a system, or may be configured such that a plurality of those units and DBs operate on one apparatus.

  As described above, the operating environment of malware can be estimated. As a result, it is possible to identify a computer for anti-malware and efficiently take measures.

  In addition, the elements that make up the dynamic environment of malware vary widely, including the presence of platforms, OSs, applications, patches, settings, and files, and changes depending on the OS and application minor versions, the presence of numerous patches, and the values of setting items. When expressed in detail, the number of elements becomes very large.

  Among these elements, there are many elements that are unrelated to the operation of the malware. Even if an attempt is made to identify an element that has caused the malware to operate by statistical processing or the like, the unrelated element may become noise and cannot be correctly identified. In addition, there is a problem that when the number of elements is large, the amount of calculation for analysis processing increases.

  On the other hand, the elements of the environment information column 702 of the analysis environment information DB 304 can be narrowed down to the information of the additional element column 503 that matches the condition column 502 of the environment element extraction logic DB 302. Since the analysis environment information column can be narrowed down, the amount of calculation can be reduced.

  In the malware operating environment estimation apparatus 101 according to the first embodiment, the malware operating environment estimation result is recorded in the malware operating environment history DB 308 and used when the output processing unit 307 displays the result. In order to enable estimation without omission by feeding back the history information of the estimation result, in the second embodiment, the environment element extraction unit 301 can access the malware operation environment history DB 308 (not shown), and the environment element extraction unit The processing flow 301 is changed so that the information in the malware operating environment history DB 308 is used.

  FIG. 12 is a flowchart illustrating an example of processing of the environment element extraction unit 301 that acquires operating environment history information. In FIG. 12, the same reference numerals are assigned to steps S402 to S411 of the process common to FIG. 4, and the description thereof is omitted. First, in step S1201, the environment element extraction unit 301 acquires a malware analysis report group and target malware information. Here, the information on the target malware may be information included in the analysis report, or information on the malware analyzed by the malware analysis system 104 may be obtained from others.

  If it is determined in step S402 that all analysis reports have been processed, the environment element extraction unit 301 proceeds to step S1202 and acquires malware operation environment history information from the malware operation environment history DB 308. In step S1203, similarity determination is performed between the target malware information acquired in step S1201 and the malware information (information in the malware information column 1103) of each history included in the operation environment history information of the malware acquired in step S1202. Determine if there is a history with malware information similar to the information.

  If it is determined that the history exists, the environment element extraction unit 301 proceeds to step S1204, and the history operation environment (operation environment including the malware information determined to be similar to the extraction element output from the environment element extraction unit 301). Information in the column 1105) is added, and the process proceeds to step S411. If it is determined in step S1203 that there is no similar history, the process proceeds to step S411.

  Note that the similarity determination in step S1203 may be performed based on, for example, whether the file names match or have similar file names, and whether the file sizes match or are close to each other. It may be determined by whether or not, and whether or not the anti-virus software scan result is a similar character string. However, the similarity determination in step S1203 is not limited to these.

  If similar operating environment information of malware can be obtained from the past history, that is, if the determination in step S1203 is Yes, the extraction element generated in steps S402 to S410 is discarded, and the output of the environment element extraction unit 301 is output. As an alternative, only the operating environment acquired from the history may be output as the extraction element.

  As explained above, more efficient malware can be used to estimate the operating environment of the malware with higher accuracy by effectively using the past malware operating environment estimation results or the malware operating environment information obtained from the outside. Can be implemented.

101 Malware Operating Environment Estimation Device 301 Environmental Element Extraction Unit 302 Environmental Element Extraction Logic DB
303 Environment information generation unit 304 Analysis environment information DB
305 Operating environment estimation processing unit 306 Processing module DB
307 Output processing unit 308 Malware operating environment history DB

Claims (15)

A malware operation environment estimation method for estimating an operation environment of malware by an apparatus having an extraction unit, a generation unit, and an estimation unit ,
Obtaining information on the behavior of the malware from each of a plurality of analysis systems by the extraction unit, and extracting elements of the operating environment related to the obtained information,
Generate a combination of elements of the extracted operating environment for all of the plurality of analysis systems by the generation unit ,
Whether or not each of the plurality of analysis systems includes one of the combinations of elements of the operation environment, by acquiring information on the operation status of the malware for all of the plurality of analysis systems by the first-term estimation unit A malware operating environment estimation method that estimates the operating environment of the malware based on information and information on whether or not the malware has been operated in each of the plurality of analysis systems. The malware operating environment estimation method according to claim 1,
By the extraction unit ,
A method for estimating a malware operating environment, comprising: extracting an element of the operating environment from information stored by associating information related to the behavior of the malware and an element of the operating environment. The malware operating environment estimation method according to claim 2,
By the generation unit ,
Information on whether or not the plurality of analysis systems include either the first element in the extracted operating environment element or the second element in the extracted operating environment element, or the first A malware operating environment estimation characterized in that a combination of the extracted operating environment elements is generated by generating information as to whether or not the plurality of analysis systems include both of the second element and the second element Method. The malware operating environment estimation method according to claim 3,
By the estimation unit ,
A malware operating environment estimation method, wherein one or more estimation results are output by one or more estimations. The malware operating environment estimation method according to claim 4,
By the estimation unit ,
Malware that performs estimation, executes a process when the condition is not met if it is determined that the termination condition is not satisfied, repeats estimation until the termination condition is satisfied, and outputs an estimation result when the termination condition is satisfied Operating environment estimation method. A device for estimating the operating environment of malware,
An extraction unit that acquires information on the behavior of the malware from each of a plurality of analysis systems, and extracts elements of the operating environment related to the acquired information;
For all of the plurality of analysis systems, a generation unit that generates a combination of elements of the extracted operating environment;
For all of the plurality of analysis systems, obtain information on the operating status of the malware, information on whether each of the plurality of analysis systems includes one of the combinations of elements of the operating environment, and A malware operating environment estimation apparatus comprising: an estimation unit configured to estimate an operating environment of the malware based on information indicating whether or not the malware has been operated in each of a plurality of analysis systems. The malware operation environment estimation device according to claim 6, wherein the extraction unit includes:
A malware operating environment estimation device that extracts elements of the operating environment from information stored by associating information related to the behavior of the malware and elements of the operating environment. The malware operation environment estimation device according to claim 7,
The generator is
Information on whether or not the plurality of analysis systems include either the first element in the extracted operating environment element or the second element in the extracted operating environment element, or the first A malware operating environment estimation characterized in that a combination of the extracted operating environment elements is generated by generating information as to whether or not the plurality of analysis systems include both of the second element and the second element apparatus. The malware operation environment estimation device according to claim 8,
The estimation unit includes
A malware operating environment estimation device that outputs one or more estimation results by one or more estimations. The malware operation environment estimation device according to claim 9,
The estimation unit includes
Malware that performs estimation, executes a process when the condition is not met if it is determined that the termination condition is not satisfied, repeats estimation until the termination condition is satisfied, and outputs an estimation result when the termination condition is satisfied Operating environment estimation device. A system that includes a plurality of devices and estimates the operating environment of malware,
One of the plurality of devices is
Obtaining information on the behavior of the malware from each of a plurality of analysis systems, and having an extraction unit that extracts elements of the operating environment related to the obtained information,
One of the plurality of devices is
A generator that generates a combination of elements of the extracted operating environment for all of the plurality of analysis systems;
One of the plurality of devices is
For all of the plurality of analysis systems, obtain information on the operating status of the malware, information on whether each of the plurality of analysis systems includes one of the combinations of elements of the operating environment, and A malware operating environment estimation system comprising an estimation unit configured to estimate an operating environment of the malware based on information indicating whether or not the malware has been operated in each of a plurality of analysis systems. The malware operating environment estimation system according to claim 11,
The extraction unit includes:
A malware operating environment estimation system that extracts elements of the operating environment from information stored by associating information related to the behavior of the malware and elements of the operating environment. The malware operating environment estimation system according to claim 12,
The generator is
Information on whether or not the plurality of analysis systems include either the first element in the extracted operating environment element or the second element in the extracted operating environment element, or the first A malware operating environment estimation characterized in that a combination of the extracted operating environment elements is generated by generating information as to whether or not the plurality of analysis systems include both of the second element and the second element system. The malware operation environment estimation system according to claim 13,
The estimation unit includes
A malware operating environment estimation system, wherein one or more estimation results are output by one or more estimations. The malware operation environment estimation system according to claim 14,
The estimation unit includes
Malware that performs estimation, executes a process when the condition is not met if it is determined that the termination condition is not satisfied, repeats estimation until the termination condition is satisfied, and outputs an estimation result when the termination condition is satisfied Operating environment estimation system.

Images