JP6646494B2 - Monitoring device, monitoring method, and program - Google Patents

Description

  The present invention relates to a technology for detecting an attack on a computer.

  Examples of computer attack techniques include “Injection”, “Buffer Overflow: xBoF”, and “Target Type: APT (Advanced Persistent Threat)”. Injection systems with a relatively low level of attack technology use unexpected programming / abnormal / threat operations using a programming language such as HTML. For this reason, a secure coding method has been established and can be detected even by static analysis of the code. On the other hand, APT and Buffer Overflow systems that misrepresent code as data or secure code are difficult to deal with fundamentally even with secure coding. Hereinafter, the data / code that attacks in APT or Buffer Overflow is called malware.

  In various attack methods, malware always shows "variants" (so-called variants), and Zero-Day becomes constant. In other words, even if secure coding or static analysis is performed, an attack method that evades them always poses a threat, and it is difficult to safely execute a program.

  As a countermeasure against the above-described malware, for example, application of machine learning (Deep Learning) to log analysis of syslog or the like to detect presence or absence of a malware attack is being studied. However, it is basically very difficult to avoid an attack only by log analysis.

JP 2000-076135 A

  BACKGROUND ART Conventionally, there is a technique of ring protection for safely running an unstable program. As shown in FIG. 1, the ring protection has a ring-shaped hierarchical structure, and each layer indicates an access right provided from the OS. There is a special gate between the rings, and access from the resources of the inner ring to the resources of the outer ring is permitted, but access from the resources of the outer ring to the resources of the inner ring is prohibited in principle.

  Ring protection was originally proposed as a mechanism in which abnormalities in one process do not affect other processes, and is also effective against malware. However, ring protection is not implemented in current general computers. Even if the CPU is provided with a ring protection function, other hardware / software of the computer is not supported, so that the ring protection function cannot be used. Therefore, the existing ring protection technology cannot be used for malware countermeasures.

  The ubiquitous Neumann-type computer has an architecture that assumes that the program area and the data area are mixed on a single memory, and this is the main factor that causes malware activity (attack establishment). It has become.

  The present invention has been made in view of the above points, and has as its object to provide a technology capable of detecting an abnormality in a monitored device by determining a memory area in the monitored device. .

According to an embodiment of the present invention, an acquiring unit for acquiring status information of a CPU from a computer,
Learning means for learning area information of a memory in the computer based on the state information obtained by the obtaining means;
Based on the area information and the status information obtained by the obtaining unit, determine whether there is an abnormality in the computer, and when it is determined that there is an abnormality, an abnormality determining unit that outputs information indicating the abnormality. A monitoring device comprising :
The learning means calculates a feature based on the CPU state information obtained from a computer whose memory area information is known, and calculates the feature and the CPU state information obtained from a computer whose area information is unknown. There is provided a monitoring apparatus characterized by learning area information of a memory in a computer whose area information is unknown by comparing the calculated characteristic with the calculated characteristic .

According to an embodiment of the present invention, there is provided a monitoring method executed by a monitoring device that detects an abnormality of a computer,
An acquisition step of acquiring CPU status information from a computer;
A learning step of learning area information of a memory in the computer based on the state information acquired by the acquiring step;
An abnormality determination step of determining the presence or absence of an abnormality in the computer based on the area information and the CPU state information obtained from the computer, and outputting information indicating the abnormality when determining that there is an abnormality; a monitoring method comprises a,
In the learning step, the monitoring device calculates a feature based on CPU state information obtained from a computer whose memory area information is known, and obtains the feature and the area information from a computer whose area information is unknown. Learning the region information of the memory in the computer whose region information is unknown by comparing the feature calculated based on the state information of the CPU
A monitoring method is provided.

  According to the embodiment of the present invention, there is provided a technology that enables an abnormality of a monitored device to be detected by determining a memory area in the monitored device.

It is a figure for explaining the concept of ring protection. FIG. 1 is an overall configuration diagram of a system according to an embodiment of the present invention. 3 is a configuration diagram of a monitoring target device 200. FIG. FIG. 4 is a diagram illustrating an example of a VM environment. FIG. 4 is a diagram for explaining a basic operation of the monitoring target device 200. 1 is a configuration diagram of a monitoring device 100. 6 is a flowchart illustrating an operation of the monitoring device 100. FIG. 9 is a diagram for describing an example of abnormality determination.

  Hereinafter, embodiments of the present invention (the present embodiment) will be described with reference to the drawings. Note that the embodiments described below are merely examples, and embodiments to which the present invention can be applied are not limited to the following embodiments.

(Overall system configuration)
FIG. 2 shows an overall configuration diagram of a system according to the present embodiment. As shown in FIG. 2, the system according to the present embodiment includes a monitoring device 100 and a plurality of monitoring target devices 200. Data communication is possible between the monitoring device 100 and each monitoring target device 200 via a network such as the Internet.

  The monitoring target device 200 is a general computer connected to a network. The OS used for the computer is also a general OS (for example, Linux (registered trademark), Windows (registered trademark), or the like). Each monitoring target device 200 may be a device used as a server for providing a service, or may be a device used as a client terminal of a user. The monitored device 200 may be a physical computer or a computer as a virtual machine. The monitoring device 100 monitors each monitoring target device 200 and detects an abnormality.

(Configuration of Monitored Device 200)
FIG. 3 shows a configuration diagram of the monitoring target device 200. As shown in FIG. 3, the monitoring target device 200 includes a memory 201, a CPU 202, and a context storage unit 203. As shown in FIG. 3, data and programs are mixedly stored in the memory, but both data and programs are a sequence of bits, and are generally stored from the outside at each address of the memory 201. It is not possible to identify whether a bit is data or program.

  The CPU 202 has a plurality of registers such as a program counter (PC), a stack pointer (SP), and a general-purpose register. The program counter stores the address of the memory where the instruction to be read next by the CPU 202 is stored, and is basically incremented each time the instruction is executed. The CPU 202 reads out the instruction at the address indicated by the program counter from the memory 201 and executes it.

  The stack pointer is a register for holding an address of a position most recently referred to in an area called a stack. The stack is the area from which the data stored first can be retrieved last and the data stored last can be retrieved first.When new data is stored, the value of the stack pointer increases by the amount of data and the data is retrieved. When it is reduced.

  The context storage unit 203 is a functional unit that stores the state (context) of the CPU 202. The context includes a value of each register such as a program counter (PC), a stack pointer (SP), and a general-purpose register of the CPU 202. The function of acquiring a context from the CPU 202 and holding the context is a function generally provided in a computer operated by a general OS, for example, for a context switch or the like.

  In addition, the timing of holding the context may be, for example, the timing of receiving an access (information request) from the monitoring device 100 (the timing of generating any interrupt), or holding / updating the context at all times (that is, always (The same information as the state of the CPU may be held).

  FIG. 4 is a diagram illustrating an example of a VM environment when the monitoring target device 200 is a virtual machine (VM). The VM environment of this example includes a hardware 251, a hypervisor 252, and a VM as the monitored device 200. In the VM environment, each VM is managed by the hypervisor 252, and the hypervisor 252 manages the configuration illustrated in FIG. 3 for each VM. That is, when the monitored device 200 is a virtual machine (VM), the context storage unit 203 is held by the hypervisor 252, but hereinafter, the context storage unit 203 is virtually stored in the VM (that is, the monitored device 200). ). That is, the configuration shown in FIG. 3 is applied whether the monitored device 200 is a virtual machine or a physical machine.

  An example of the operation of the monitoring target device 200 will be described with reference to FIG. In the state on the left, 2 is stored in the program counter (PC) and 4 is stored in the register R1. The CPU reads the instruction at address 2 of the memory according to the PC. This instruction is to copy the value of the memory address 4 stored in the register R1 to the register R2. The CPU enters the state on the right by executing this instruction. That is, as a result of the execution of the instruction, the value (100) of the address 4 is stored in R2, and the PC is incremented.

(Configuration of monitoring device 100)
FIG. 6 shows a configuration diagram of the monitoring device 100. As shown in FIG. 6, the monitoring device 100 includes a learning unit 101, a monitoring unit 102, and an abnormality determination unit 103. The operation of each functional unit will be described in detail in the following operation description. In the following description, one monitored device 200 in the plurality of monitored devices 200 is targeted unless otherwise specified. However, the same processing is actually performed on the other monitored devices 200. ing. However, it is not essential that a plurality of monitoring target devices 200 are targeted, and one monitoring target device 200 may be targeted.

  The monitoring device 100 according to the present embodiment can be realized by causing a computer to execute a program describing the processing content described in the present embodiment. That is, the functions of the monitoring device 100 can be realized by executing a program corresponding to a process performed by the device using hardware resources such as a CPU and a memory built in the computer. is there. The above-described program can be recorded on a computer-readable recording medium (a portable memory or the like) and can be stored or distributed. Further, the above program can be provided through a network such as the Internet or electronic mail.

(Operation of monitoring device 100)
Hereinafter, the operation of the monitoring apparatus 100 having the configuration shown in FIG. 6 will be described with reference to the flowchart of FIG.

  For example, the monitoring unit 102 periodically acquires the context stored in the context storage unit 203 from the monitoring target device 200 (step S101). The acquisition of the context is performed, for example, by the monitoring unit 102 transmitting a context request to the monitoring target device 200, and the monitoring target device 200 returning the context to the monitoring unit 102 as a context response. The context includes current CPU status information (register values and the like). The context acquired by the monitoring unit 102 is passed to the learning unit 101.

  The learning unit 101 learns (determines) the address range of the program area and the address range of the data area in the memory 201 of the monitoring target device 200 based on the context acquired by the monitoring unit 102 (step S102). The details are as follows. Hereinafter, the address range of the program area and the address range of the data area are referred to as “area information”. The following process is an example.

  The learning unit 101 includes a storage unit that stores a set of contexts of the monitoring target device 200 acquired periodically. The learning unit 101 has a supervised learning function. In this case, first, the correct area information is provided to the learning unit 101, and further, a context set obtained from the monitoring target device 200 from which the correct answer is obtained is provided. The monitoring target device 200 from which the correct answer has been obtained is an example of a computer whose memory area information is known.

  Then, the learning unit 101 calculates the feature of the context set. This feature includes, for example, a change pattern of a program counter value (time-series data) in a context set (eg, an address transition), a change pattern of a register value (time-series data) indicating an address of data in a context set, It is any one or any plural or all of the change patterns of the stack pointer value (time-series data) in the context set. Further, the above characteristics (change patterns) may be represented by a vector or the like, may be represented as a time-series model, or may be represented in another format.

  The learning unit 101 performs, for example, the above-described feature calculation on a plurality of “sets of the correct answer area information and the context set” in the plurality of monitoring target devices 200 to thereby obtain a plurality of “sets of the feature and area information”. Is obtained and stored in the storage unit. The feature obtained in this manner is called “feature A”, and the corresponding area information is called area information A. That is, the storage unit stores a plurality of “sets of feature A and area information A”. The process of giving a correct answer and learning a plurality of “sets of feature A and region information A” does not need to be performed frequently, and may be performed at a certain interval. Further, a process of giving a correct answer and learning a plurality of “combinations of feature A and region information A” is performed only once, and thereafter, region information B described later is regarded as a correct answer (considering region information A), A plurality of “sets of feature A and area information A” may be sequentially updated.

  In addition, the learning unit 101 periodically receives a feature set (which is a feature B) from the context set (region information is unknown) received from the monitoring unit 102 and stored in the storage unit in the same manner as the method of obtaining the feature A. Is calculated). The learning unit 101 identifies the feature A closest to the feature B by comparing the feature B with each of the features A in a plurality of “sets of the feature A and the area information A”, and determines the area information corresponding to the feature A. A is learned as area information of the target monitoring target device 200 (this is referred to as area information B).

  In addition, the corresponding area information A itself among a plurality of “sets of the feature A and the area information A” may be determined as the area information B of the monitoring target device 200, or the combination of the feature B and the plurality of features A may be determined. The information obtained by changing the corresponding area information A among a plurality of “sets of the feature A and the area information A” according to the distance may be determined as the area information B of the monitoring target device 200. For example, when the feature B, the feature A1 and the feature A2 are almost the same, as the region information B of the feature B, the region information A1 of the feature A1 (eg, the program region is 0 to 100) and the region information of the feature A2 The average of A2 (example: program area is 0 to 110) (example: program area is 0 to 105) can be used.

  In the above example, the learning unit 101 obtains the area information B by supervised learning, but may obtain the area information B by unsupervised learning. In this case, for example, the area information B is obtained by classifying the memory address into a data area address and a program area address based on the register value in the context set and its change pattern. Can be.

  The area information B of the monitoring target device 200 obtained by the learning unit 101 is passed to the abnormality determination unit 103. Further, the monitoring unit 102 sequentially passes the contexts acquired periodically to the abnormality determination unit 103.

  The abnormality determining unit 103 refers to the value of a register (eg, a stack pointer) indicating the address of the data in the context passed from the monitoring unit 102, and sets the value of the register to the address of the data area indicated by the area information B. It is determined whether or not the range is exceeded (step S103). In other words, it is determined whether or not the value of the register has entered the address range of the program area.

  When detecting that the value of the register exceeds the address range of the data area indicated by the area information B, the abnormality determination unit 103 determines that an abnormality has occurred, and outputs an alarm, for example (step S104). The alarm includes information for identifying the monitoring target device 200 that has detected the abnormality. In place of the alarm, a command to stop the target monitored device 200 may be transmitted to the monitored device 200. Both the alarm and the instruction are examples of “information indicating an abnormality”.

  FIG. 8 is a diagram for explaining an example of a case where it is determined that an abnormality has occurred. In the example shown in FIG. 8, as the area information B, a program area = address 0 to 40 and a data area = address 40 to 100 are obtained. Then, when it is detected that the value of the register indicating the address of the data in the context (for example, the value of the stack pointer) is 35, it is determined to be abnormal. Note that a threshold value may be provided, and it may be determined that there is an abnormality when the value exceeds “address range of the program area + threshold value”.

  In an environment in which the same program (application) is executed in a plurality of monitored devices 200, even if the above-described abnormality is detected in one monitored device 200, a similar event occurs in another monitored device 200. If the alarm has occurred, there is a possibility that the current area information B is not sufficiently accurate, and the alarm may not be output. Further, the following processing may be performed.

  The learning unit 101 is provided with a context set of the monitoring target device that is known to be executing malware, and the learning unit 101 determines the characteristic (change in time series data) of the program counter value (time-series data) in the context set. A vector indicating a pattern, a time-series model, etc.). This feature is called feature A. A plurality of types of features A may be obtained for a plurality of types of malware. Then, the feature A is passed to the abnormality determination unit 103. The abnormality determination unit 103 sequentially receives the contexts from the computers in which the presence or absence of the execution of the malware is unknown from the monitoring unit 102, and calculates the feature of the value of the program counter (called feature B) from the obtained context set. The feature A may be compared with the feature B, and when the feature A close to the feature B (eg, equal to or less than the threshold) exists, the abnormality may be detected. It is also possible to output an alarm when an abnormality is detected in the abnormality detection (abnormality detection based on area information) described above and an abnormality is detected in this abnormality detection (malware abnormality detection based on context features). Alternatively, an alarm may be output when any abnormality is detected.

(Summary of Embodiment)
As described above, as described above, acquiring means for acquiring state information of a CPU from a computer, learning means for learning area information of a memory in the computer based on the state information acquired by the acquiring means, An abnormality determining unit configured to determine the presence or absence of an abnormality in the computer based on the state information acquired by the acquiring unit, and to output information indicating the abnormality when it is determined that there is an abnormality. Is provided.

  The learning means calculates a feature based on, for example, CPU state information obtained from a computer whose memory area information is known, and calculates the feature and a CPU state obtained from a computer whose area information is unknown. By comparing the information with the feature calculated based on the information, the area information of the memory in the computer whose area information is unknown is learned.

  The abnormality determination unit detects, for example, a storage address of data in the memory based on state information acquired by the acquisition unit, and a storage address of the data in the area information obtained by the learning unit. If it exceeds the range of the data area, it is determined that there is an abnormality.

  The learning means calculates a feature of the status information based on the status information of the CPU obtained from the computer on which the malware is executed, and the abnormality determination means does not know the feature and whether or not the malware is executed. The presence or absence of an abnormality may be determined by comparing a feature calculated based on the CPU status information obtained from the computer.

(Section 1)
Acquisition means for acquiring CPU status information from a computer;
Learning means for learning area information of a memory in the computer based on the state information obtained by the obtaining means;
An abnormality determining unit that determines whether there is an abnormality in the computer based on the area information and the state information acquired by the acquiring unit, and outputs information indicating the abnormality when it is determined that there is an abnormality;
A monitoring device comprising:
(Section 2)
The learning means calculates a feature based on the CPU state information obtained from a computer whose memory area information is known, and calculates the feature and the CPU state information obtained from a computer whose area information is unknown. Learning the region information of the memory in the computer whose region information is unknown by comparing the calculated feature with the calculated feature
2. The monitoring device according to claim 1, wherein:
(Section 3)
The abnormality determination unit detects a storage address of data in the memory based on the state information acquired by the acquisition unit, and determines a storage address of the data in the data area in the area information obtained by the learning unit. Is determined to be abnormal when the value exceeds the range
The monitoring device according to claim 1 or 2, wherein:
(Section 4)
The learning means calculates a feature of the state information based on the state information of the CPU obtained from the computer on which the malware is executed,
The abnormality determination unit determines the presence or absence of an abnormality by comparing the characteristic with a characteristic calculated based on CPU state information obtained from a computer whose execution of the malware is unknown.
The monitoring device according to any one of claims 1 to 3, characterized in that:
(Section 5)
A program for causing a computer to function as each unit in the monitoring device according to any one of the first to fourth aspects.
(Section 6)
A monitoring method performed by a monitoring device that detects abnormality of a computer, comprising:
An acquisition step of acquiring CPU status information from a computer;
A learning step of learning area information of a memory in the computer based on the state information acquired by the acquiring step;
An abnormality determination step of determining the presence or absence of an abnormality in the computer based on the area information and the CPU state information obtained from the computer, and outputting information indicating the abnormality when determining that there is an abnormality;
A monitoring method, comprising:
The present invention is not limited to the embodiments described above, and various modifications and applications are possible within the scope of the claims.

Reference Signs List 100 monitoring device 101 learning unit 102 monitoring unit 103 abnormality determination unit 200 monitored device 201 memory 202 CPU
203 Context storage unit 251 Hardware 252 Hypervisor

Claims (7)

Acquisition means for acquiring CPU status information from a computer;
Learning means for learning area information of a memory in the computer based on the state information obtained by the obtaining means;
Based on the area information and the status information obtained by the obtaining unit, determine whether there is an abnormality in the computer, and when it is determined that there is an abnormality, an abnormality determining unit that outputs information indicating the abnormality. A monitoring device comprising:
The learning means calculates a feature based on the CPU state information obtained from a computer whose memory area information is known, and calculates the feature and the CPU state information obtained from a computer whose area information is unknown. A monitoring device characterized by learning area information of a memory in a computer whose area information is unknown by comparing the calculated characteristic with a characteristic calculated based on the calculated characteristic. Acquisition means for acquiring CPU status information from a computer;
Learning means for learning area information of a memory in the computer based on the state information obtained by the obtaining means;
Based on the area information and the status information obtained by the obtaining unit, determine whether there is an abnormality in the computer, and when it is determined that there is an abnormality, an abnormality determining unit that outputs information indicating the abnormality. A monitoring device comprising:
The abnormality determination unit detects a storage address of data in the memory based on the state information acquired by the acquisition unit, and determines a storage address of the data in the data area in the area information obtained by the learning unit. A monitoring device that determines that there is an abnormality when the value exceeds the range. Acquisition means for acquiring CPU status information from a computer;
Learning means for learning area information of a memory in the computer based on the state information obtained by the obtaining means;
Based on the area information and the status information obtained by the obtaining unit, determine whether there is an abnormality in the computer, and when it is determined that there is an abnormality, an abnormality determining unit that outputs information indicating the abnormality. A monitoring device comprising:
The learning means calculates a feature of the state information based on the state information of the CPU obtained from the computer on which the malware is executed,
The abnormality determination unit determines the presence or absence of an abnormality by comparing the characteristic with a characteristic calculated based on CPU state information obtained from a computer whose execution of the malware is unknown. Monitoring device. A program for causing a computer to function as each unit in the monitoring device according to any one of claims 1 to 3 . A monitoring method performed by a monitoring device that detects abnormality of a computer, comprising:
An acquisition step of acquiring CPU status information from a computer;
A learning step of learning area information of a memory in the computer based on the state information acquired by the acquiring step;
An abnormality determination step of determining the presence or absence of an abnormality in the computer based on the area information and the CPU state information obtained from the computer, and outputting information indicating the abnormality when determining that there is an abnormality; a monitoring method comprises a,
In the learning step, the monitoring device calculates a feature based on CPU state information obtained from a computer whose memory area information is known, and obtains the feature and the area information from a computer whose area information is unknown. Learning the region information of the memory in the computer whose region information is unknown by comparing the feature calculated based on the state information of the CPU
A monitoring method characterized in that:   A monitoring method performed by a monitoring device that detects abnormality of a computer, comprising:
  An acquisition step of acquiring CPU status information from a computer;
  A learning step of learning area information of a memory in the computer based on the state information acquired by the acquiring step;
  An abnormality determination step of determining the presence or absence of an abnormality in the computer based on the area information and the CPU state information obtained from the computer, and outputting information indicating the abnormality when determining that there is an abnormality; It is a monitoring method comprising
  In the abnormality determination step, the monitoring device detects a storage address of data in the memory based on the state information acquired in the acquisition step, and the storage address of the data is obtained in the learning step. If it exceeds the range of the data area in the area information, it is determined that there is an abnormality
  A monitoring method characterized in that:   A monitoring method performed by a monitoring device that detects abnormality of a computer, comprising:
  An acquisition step of acquiring CPU status information from a computer;
  A learning step of learning area information of a memory in the computer based on the state information acquired by the acquiring step;
  An abnormality determination step of determining the presence or absence of an abnormality in the computer based on the area information and the CPU state information obtained from the computer, and outputting information indicating the abnormality when determining that there is an abnormality; It is a monitoring method comprising
  In the learning step, the monitoring device calculates a feature of the state information based on the state information of the CPU obtained from the computer on which the malware is executed,
  In the abnormality determining step, the monitoring device determines whether there is an abnormality by comparing the characteristic with a characteristic calculated based on state information of the CPU obtained from a computer whose execution of the malware is unknown. Do
  A monitoring method characterized in that:

Images