JP6740184B2 - Granting device, assigning method, and assigning program - Google Patents

Description

The present invention relates to a granting device, a granting method, and a granting program.

In classification of malware by machine learning, a label may be attached to teacher data by using a detection name of antivirus software (hereinafter, referred to as AVS). Labeling using the detected name of AVS has an advantage that information can be easily obtained, but also has a problem that the ratio of undetected malware is high. For undetected malware, this is not used as teacher data, or a label “NotDetected” meaning undetected is added as teacher data.

However, if undetected malware is not used as teacher data, the number of teacher data will decrease. Furthermore, data that is likely to be a new type of malware cannot be used as teacher data. On the other hand, in the teacher data to which the label “NotDetected” is attached, there may be data that is detected by another AVS and should be attached with another label. In that case, there is a problem that the data content of the teacher data to which the label “NotDetected” is attached is different. Therefore, in either case, the accuracy of malware classification may decrease.

The detection results of malware by AVSs of about 50 companies are disclosed (see Non-Patent Document 1). Further, a technique for clustering communication logs of malware has been disclosed (see Patent Document 1). By using this technique, it is possible to attach a label to malware that has not been detected by AVS by referring to the detection name of malware that has similar characteristics and is classified into the same cluster.

International Publication No. 2016/080232

"Virustotal", [online], September 2012, Virus Total, [Search June 1, 2017], Internet <URL: https://www.virustotal.com/en/>

However, the conventional technique has a problem that a communication log is required to attach a label to undetected malware and it takes time to analyze.

The present invention has been made in view of the above, and an object thereof is to easily estimate and attach a label of undetected malware.

In order to solve the above-mentioned problems and to achieve the object, the assigning device according to the present invention obtains by the obtaining unit that obtains the hierarchical detection name of malware provided by a plurality of antivirus software, and the obtaining unit. Among the detected detection names, for the malware to which the detection name is given by the predetermined antivirus software, a hierarchical label is attached to the malware using the detection name, and the detection name is given by the predetermined antivirus software. For malware that has not been assigned, identify multiple malwares that have been given the same detection name by other antivirus software, and use the detection names given by the specified antivirus software for the identified multiple malwares. And an adding unit that adds a hierarchical label to malware by using detection names from a shallow hierarchy to a predetermined number or more in order when the total number is greater than or equal to a predetermined number. Characterize.

According to the present invention, a label of undetected malware can be easily estimated and added.

FIG. 1 is a schematic diagram illustrating a schematic configuration of a applying device according to an embodiment of the present invention. FIG. 2 is a diagram illustrating a data structure of the correspondence table. FIG. 3 is a diagram illustrating a data structure of label hierarchy information. FIG. 4 is an explanatory diagram for explaining the processing of the acquisition unit. FIG. 5 is an explanatory diagram for explaining the processing of the adding unit. FIG. 6 is an explanatory diagram for explaining the processing of the adding unit. FIG. 7 is an explanatory diagram for explaining the processing of the adding unit. FIG. 8 is an explanatory diagram for explaining the processing of the adding unit. FIG. 9 is an explanatory diagram for explaining the processing of the adding unit. FIG. 10 is a diagram illustrating a data structure of label hierarchy information. FIG. 11 is an explanatory diagram for explaining the processing of the adding unit. FIG. 12 is an explanatory diagram for explaining the processing of the adding unit. FIG. 13 is a flowchart showing the procedure of the adding process. FIG. 14 is an explanatory diagram for describing an example of utilizing the application device. FIG. 15 is a diagram exemplifying a computer that executes the giving program.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. The present invention is not limited to this embodiment. In the description of the drawings, the same parts are designated by the same reference numerals.

[Structure of application device]
FIG. 1 is a schematic view illustrating the schematic configuration of the applying device. As illustrated in FIG. 1, the application device 10 is realized by a general-purpose computer such as a personal computer, and includes an input unit 11, an output unit 12, a communication control unit 13, a storage unit 14, and a control unit 15.

The input unit 11 is realized by using an input device such as a keyboard and a mouse, and inputs various instruction information such as processing start to the control unit 15 in response to an input operation by an operator. The output unit 12 is realized by a display device such as a liquid crystal display and a printing device such as a printer.

The communication control unit 13 is realized by a NIC (Network Interface Card) or the like, and controls communication between an external device and a control unit 15 via a telecommunication line such as a LAN (Local Area Network) or the Internet.

The storage unit 14 is realized by a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory (Flash Memory), or a storage device such as a hard disk or an optical disk, and is a model in a normal state specified by an applying process described later. Parameters and the like are stored. The storage unit 14 may be configured to communicate with the control unit 15 via the communication control unit 13.

In the present embodiment, the storage unit 14 stores a correspondence table 14a, label hierarchy information 14b, and assignment result information 14c.

The correspondence table 14a is information representing hierarchical detection names of malware given by a plurality of AVSs. The correspondence table 14a is formed by shaping the information acquired by referring to virustotal or the like in the adding process described later.

FIG. 2 is a diagram showing an example of the data structure of the correspondence table 14a. As illustrated in FIG. 2, the correspondence table 14a includes a hash value for identifying malware and a detection name given to each malware by the AVS of each company. In the example shown in FIG. 2, SHA1HASH is a hash value of each malware by the hash function SHA-1 and means an ID for identifying the malware.

In addition, the detection name of each company is represented by a hierarchical type. In this embodiment, a shallow hierarchy X that represents a malware family name and a deep hierarchy Y that represents a child number are represented by two hierarchies such as "XY" in which dots are connected. In FIG. 2, for example, regarding the malware identified by the ID “a1b2c3... ”, the detection name by AVS of company A is “AX”, and the detection name by AVS of company B is “AY”. , C company's AVS detection name is shown to be "X.1". Note that “NotDetected” means that the malware has not been detected by the AVS of the relevant company, that is, has not been detected.

The label hierarchical information 14b is information representing the hierarchical structure of the label given by the giving device 10. The label hierarchy information 14b is generated in advance or in an attaching process described later. The label hierarchical information 14b is referred to when learning is performed using the teacher data to which the hierarchical label is added by the adding device 10.

FIG. 3 is a diagram showing an example of the data structure of the label hierarchy information 14b. FIG. 3 exemplifies A or B as a label having a shallow hierarchy with respect to a label of two hierarchies. Further, 1 or 2 is illustrated as a detailed label having a deeper hierarchy than the coarse label A.

The addition result information 14c is information indicating a processing result of an addition process described later and indicating a hierarchical label given to each piece of malware. The addition result information 14c is referred to when a hierarchical label is added to specific malware.

Returning to the description of FIG. The control unit 15 is realized by using a CPU (Central Processing Unit) or the like, and executes a processing program stored in the memory. As a result, the control unit 15 functions as the acquisition unit 15a and the addition unit 15b, as illustrated in FIG. Note that these functional units may be implemented in different hardware.

The acquisition unit 15a acquires a hierarchical detection name of malware given by a plurality of AVSs. Specifically, the acquisition unit 15a refers to virustotal or the like to acquire the AVS detection name of each company regarding malware. In addition, the acquisition unit 15a performs preprocessing described below on the acquired detection name of each company and shapes it to generate the correspondence table 14a.

Here, the processing of the acquisition unit 15a will be described with reference to FIG. FIG. 4 exemplifies the correspondence between the detection name of the AVS of each company acquired by referring to virustotal and the like, and the detection name shaped by the preprocessing by the acquisition unit 15a. The acquisition unit 15a performs preprocessing for shaping the acquired detection name of each company into a hierarchical type common to each company. In the present embodiment, the acquisition unit 15a performs a pre-processing to detect a detection name of two layers such as "X.Y" in which a shallow layer X representing a malware family name and a deep layer Y representing a child number are connected by a dot. Format to

In FIG. 4, the acquisition unit 15 a uses, for example, a detection name “WIN32/Confirmer.A” of an AVS of a company before shaping, using the malware family name “Conficker” and a child number “A” as “Conficker. It is shown that shaping is performed as "A". In addition, when the child number of the detection name acquired by the acquisition unit 15a is unknown, “*” is set. For example, the acquisition unit 15a performs shaping with the acquired detection name "WIN32/Confirmer" as "Confirmer.*".

Returning to the description of FIG. Of the detection names acquired by the acquisition unit 15a, the attaching unit 15b attaches a hierarchical label to the malware using the detection name for the malware to which the detection name is attached by a predetermined AVS. Further, for the malware whose detection name is not given by the predetermined AVS, the adding unit 15b identifies a plurality of malwares to which the same detection name is added by another AVS, and identifies the plurality of identified malwares. Then, the detection names given by the predetermined AVS are aggregated for each layer, and when the total number is equal to or more than a predetermined number, the hierarchical labels are detected using the detection names from the shallow layer to the predetermined number or more in order of malware. Given to.

Here, the predetermined AVS will be described with reference to FIG. The malware family name of the AVS detection name of each company is uniquely named by each company, and does not always match the general malware family name. For example, regarding a malware family name generally called Dridex, as illustrated in FIG. 5, Company A is named DrideX and Company B is named Cridex.

Therefore, first, a predetermined AVS to be the reference of the label given by the giving unit 15b is selected. The predetermined AVS may be selected from among the plurality of AVSs that has the lowest rate of undetected malware or the highest accuracy of detecting malware.

Next, with reference to FIGS. 6 to 9, the processing of the adding unit 15b will be described. First, for the malware to which the detection name is given by the predetermined AVS, the giving unit 15b gives a hierarchical label to the malware using the given detection name. In the present embodiment, as illustrated in FIG. 6, the hierarchical detection name (A.1) shaped for the company A in the correspondence table 14a is used as it is as the hierarchical label (A.1) based on the company A. Assign to each malware.

Further, for the malware not detected by the AVS of the company A, which is a predetermined AVS, the adding unit 15b identifies a plurality of malware to which the same detection name is added by another AVS, and identifies the plurality of identified malware. On the other hand, the detection names given by the predetermined AVS are totaled for each layer, and when the total number is equal to or more than a predetermined number, a hierarchical label is formed by using the detection names from the shallow layer to the predetermined number or more in order. Attach to malware.

Specifically, first, as illustrated in FIG. 7, if no detection is made in another AVS of a predetermined number s or more, a hierarchical label “NotDetected.*” that means undetected is added. Here, the predetermined number s is represented by the ratio of the undetected AVS number to the total AVS number, such as 50%.

Next, as illustrated in FIG. 8, the assigning unit 15b assigns a detection name to an AVS of a company other than A that has not been detected by the AVS of the company A and has not been attached with “NotDetected.*”. If so, each company identifies other malware that has the same detection name as the undetected malware in the AVS of the company A. It is highly probable that these pieces of malware are the same malware, and it is presumed that the same label can be given. Therefore, the adding unit 15b determines the label to be added to the undetected malware by referring to the detection names given by the company A to the identified plural pieces of malware.

In the example shown in FIG. 8, for example, regarding the malware “a1b2c3... ”Not detected in the AVS of the company A, the AVS of the company B has the detection name “X.1” and the AVS of the company D has the detection name “Y.1”. Is added. Therefore, the malware to which the AVS of the company B added the detection name “X.1” and the malware to which the AVS of the company D added the detection name “Y.1” are specified. Then, the assigning unit 15b determines the label to be attached to the undetected malware by the AVS of the company A by using the detection name excluding “NotDetected” among the detection names provided by the company A to the identified malware. Specifically, as illustrated in FIG. 9, the assigning unit 15b determines the most common malware family name A among the detection names other than “NotDetected” as a rough label to be assigned.

The assigning unit 15b does not detect the AVS of the company A when the same detection name including the child number is assigned to a predetermined number t or more of the malware that assigns the same rough label. It is estimated that this detection name can be given to the malware of with high accuracy. In this case, the giving unit 15b determines that the detailed label is given this child number. Here, the predetermined number t is represented by, for example, a ratio to the total number.

In the example shown in FIG. 9, the predetermined number is 50%, and the detection name of the extracted malware is {A. 1, A. 2, NotDetected, A.; 1, A. 1, B. 1, A. 1}, the shallow layers are the same, that is, there are five malwares with the malware family name A. Among them, there are four pieces of malware having the same detection name (A.1) including the child number which is a deep hierarchy, and satisfy 50% or more, that is, the predetermined number t or more. Therefore, it is determined that the detection names (A.1) from the shallow hierarchy to this deep hierarchy are assigned to the malware that has not been detected by the AVS of the company A.

On the other hand, when the malware having the same detection name including the child number is less than the predetermined number t among the malware to which the same rough label is given, the giving unit 15b determines that the child number cannot be estimated. , The detailed label to be given is "*" which means unknown.

In the example shown in FIG. 9, the predetermined number is 50%, and the detection name of the extracted malware is {A. 1, A. 2, NotDetected, A.; 1, A. 3, B. 1, A. 4}, the shallow layers are the same, that is, there are five malwares with the malware family name A. Among them, there are two pieces of malware with the same detection name (A.1) including the child numbers in the deep hierarchy, which is less than 50%. Therefore, it is decided to attach the detection name (A.*) to the shallow layer to the malware not detected by the AVS of the company A.

In this way, the assigning unit 15b assigns the predetermined AVS to a plurality of malware to which the same detection name has been assigned by another AVS for the malware to which the detection name has not been assigned by the predetermined AVS. The detection names are totaled for each layer, and when the total number is equal to or larger than a predetermined number, a hierarchical label is attached using the detection names up to the layer, and the attachment result is stored in the attachment result information 14c.

In the above embodiment, the assigning unit 15b assigns the hierarchical label using only the detection name by AVS, but the present invention is not limited to this. For example, the assigning unit 15b may further assign a hierarchical label using the malware type of malware. In this case, the label of the label hierarchy information 14b illustrated in FIG. 10 is given. That is, as illustrated in FIG. 10, the assigning unit 15b assigns a hierarchical label having a malware type as a coarse label and a malware family name as a detailed label to malware.

Here, the malware type indicates the type of influence due to infection, etc., and the information disclosed in the official HP by each company may be used. By giving a label that uses a global malware type rather than a detection name, for example, an operator with little knowledge at a security countermeasure site can quickly take appropriate initial countermeasures against malware classified by hierarchical labels. It becomes possible.

For example, in the example shown in FIG. 10, for malware to which a label (Pushdo.1) is added as a result of classification, it is necessary to investigate the behavior of Pushdo, and it takes time to take countermeasures. On the other hand, if a label (backdoor.Pushdo.1) is attached to the same malware, an initial measure can be taken immediately by roughly grasping the characteristics of the backdoor type malware, and then Pushdo can be investigated. It enables detailed analysis and countermeasures.

Therefore, with reference to FIG. 11 and FIG. 12, a process of the assigning unit 15b when assigning a hierarchical label using a malware type will be described. First, the attaching unit 15b attaches a hierarchical label to each piece of malware using the detection name and the malware type given by a predetermined AVS.

In the example shown in FIG. 11, the assigning unit 15b sets the malware family name A of the hierarchical detection name (A.1) shaped in the correspondence table 14a for the reference company A as the detailed label. Further, the assigning unit 15b sets the malware type (Type-I) corresponding to the detection name acquired by referring to the HP of Company A as a rough label. As a result, a hierarchical label (Type-IA) is given to this malware.

Further, regarding the malware that has not been detected by the AVS of the company A, the adding unit 15b first indicates that the malware has not been detected by another AVS of a predetermined number s or more, similarly to the procedure illustrated in FIG. A hierarchical label “NotDetected.*” is added.

Further, in the same manner as the procedure illustrated in FIG. 8, the assigning unit 15b assigns a detection name to an AVS of a company other than A that has not been detected by the AVS of the company A and has not been attached with “NotDetected.*”. If so, each company extracts other malware that has the same detection name as this.

Next, as illustrated in FIG. 12, the assigning unit 15b uses the malware family name as a detailed label and the corresponding malware type for detection names other than “NotDetected” among the detection names assigned by Company A to the extracted malware. To a coarse label. Further, the assigning unit 15b determines the most common malware type Type-I among them as a rough label to be assigned.

Further, when the malware family name of a predetermined number or more of the malwares to which the same rough label is given is the same, the assigning unit 15b highly accurately identifies this malware family name as the undetected malware by the AVS of Company A. Estimate what can be given as a detailed label. In the example shown in FIG. 12, the predetermined number t is 50%, and the label converted from the extracted malware detection name is {Type-I. A, Type-I. A, Type-I. A, Type-I. A, Type-II. B, Type-I. If it is C}, the assignment of (Type-IA) is determined.

On the other hand, the assigning unit 15b determines that the malware family name cannot be estimated and the detailed label to be assigned is unknown when the malware having the same malware family name is less than the predetermined number t among the malware to which the same coarse label is assigned. It means "*".

Further, in the above embodiment, the label of two layers is given, but the label of three layers can also be given. For example, it is possible to give a hierarchical label including a malware type, a malware family name, and a child number by the same procedure.

[Granting process]
Next, with reference to FIG. 13, the imparting process by the imparting apparatus 10 according to the present embodiment will be described. FIG. 13 is a flowchart showing the procedure of the adding process. The flowchart of FIG. 13 is started, for example, at the timing when there is an operation input for instructing the start of the giving process.

First, the acquisition unit 15a acquires the hierarchical detection names of malware provided by a plurality of AVSs, and creates a correspondence table 14a between the malwares and the AVS detection names (step S1).

Next, the giving unit 15b selects a reference AVS (step S2). Further, the adding unit 15b refers to the correspondence table 14a, selects a hash value of malware (step S3), and confirms whether the detection name is attached to the reference AVS (step S4). When the detection name is attached to the reference AVS (step S4, Yes), the attaching unit 15b attaches the hierarchical label to the malware by using the detection name attached to the reference AVS as it is (step S4). S5). Moreover, the provision part 15b advances a process to step S14.

On the other hand, when the detection name is not attached to the reference AVS (step S4, No), the giving unit 15b confirms whether or not the detection is not performed at a ratio of a predetermined s or more in the AVS (step). S6). When not detected at a rate of s or more (step S6, Yes), the assigning unit 15b assigns the hierarchical label “NotDetected.*” (step S7). Moreover, the provision part 15b advances a process to step S14.

On the other hand, when undetected at a rate of less than s (step S6, No), the assigning unit 15b determines that the malware having the same detection name is detected for each of the other AVSs that have detected the undetected malware by the reference AVS. , All the detection names in the reference AVS are listed (step S8). Further, the giving unit 15b sets the largest number of the rough labels of the listed detection names as the rough label to be given to the malware (step S9).

Next, the assigning unit 15b extracts, from the enumerated detection names, a detection name having the same rough label as the assigned rough label (step S10). Further, the assigning unit 15b confirms whether or not the extracted detection names have the same detailed label at a rate of a predetermined t or more (step S11).

When it has the same detailed label at a rate of t or more (step S11, Yes), the same detailed label is given to the malware as a detailed label (step S12), and the process proceeds to step S14. On the other hand, when the ratio having the same detailed label is less than t (No in step S11), the detailed label given to the malware is set to "*" (step S13), and the process proceeds to step S14.

In the process of step S14, the adding unit 15b confirms whether or not all hash values have been investigated. If all hash values have not been investigated (step S14, No), the assigning unit 15b selects the hash value of the next malware (step S15) and returns the process to step S4. On the other hand, when all the hash values have been investigated (step S14, Yes), the adding unit 15b ends the series of adding processes.

As described above, in the assigning device 10 of the present exemplary embodiment, the acquisition unit 15a acquires the hierarchical detection name of malware provided by a plurality of AVSs. Further, the attaching unit 15b attaches a hierarchical label to the malware using the detection name for the malware to which the detection name is attached by the predetermined AVS among the detection names obtained by the obtaining unit 15a. Further, for the malware whose detection name is not given by the predetermined AVS, the adding unit 15b identifies a plurality of malwares to which the same detection name is added by another AVS, and identifies the plurality of identified malwares. Then, the detection names given by the predetermined AVS are aggregated for each layer, and when the total number is equal to or more than a predetermined number, the hierarchical labels are detected using the detection names from the shallow layer to the predetermined number or more in order of malware. Given to.

As a result, a hierarchical label can be attached to the malware using the detection name by the standard AVS. Further, a hierarchical label that reflects the accuracy according to the detection status in another AVS can be attached to malware that has not been detected in the reference AVS. As described above, according to the assigning device 10 of the present embodiment, it is possible to easily estimate and attach the label of the undetected malware.

Further, an example of utilizing the applying device 10 will be described with reference to FIG. 14. As shown in FIG. 14, the adding device 10 refers to virustotal or the like to list the AVS hierarchical detection names of each company regarding malware, generates a correspondence table 14a, and uses this to add to the malware. Calculate a hierarchical label. Further, the assigning apparatus 10 manages the assignment result information 14c, which is a correspondence table between the malware and the calculated hierarchical label, and the label hierarchy information 14b, which indicates the hierarchical structure of the assigned label.

When the hash value {ID} of the malware to be classified is input, the assigning apparatus 10 refers to the assignment result information 14c and assigns the malware a hierarchical type such as (X.Y) or (X.*). The label is added and output. For example, it is output in a format such as {ID, (X.Y)} or {ID, (X.*)}.

Here, the data output by the assigning device 10 is used as teacher data for a deep learning device having a hierarchical structure. For example, by using a communication log such as a malware proxy log, teacher data including a combination of a feature vector of the malware communication log and a hierarchical label is input to the deep learning device. The hierarchical deep learning device generates and combines deep classifiers according to the number of layers of hierarchical labeled teacher data. Such a deep learning device having a hierarchical structure learns hierarchical labels and classifies the deepest detailed labels. With this, when a new suspicious communication is observed, it is possible to determine what kind of malware characteristics the communication log has by using the generated deep classifier.

[program]
It is also possible to create a program in which the processing executed by the application device 10 according to the above-described embodiment is described in a computer-executable language. As one embodiment, the granting device 10 can be implemented by installing a granting program that executes the above-described granting process as package software or online software in a desired computer. For example, by causing the information processing apparatus to execute the above-mentioned addition program, the information processing apparatus can be caused to function as the addition apparatus 10. The information processing apparatus referred to here includes a desktop or notebook personal computer. Further, in addition to the above, the information processing apparatus includes a mobile communication terminal such as a smartphone, a mobile phone or a PHS (Personal Handyphone System), and a slate terminal such as a PDA (Personal Digital Assistants) in its category.

Further, the granting device 10 can also be implemented as a terminal device used by a user as a client and as a server device that provides the client with the service related to the granting process. For example, the assigning device 10 is implemented as a server device that provides an assigning processing service that inputs malware and outputs a hierarchical label. In this case, the granting device 10 may be implemented as a Web server, or may be implemented as a cloud that provides a service related to the above granting process by outsourcing. Hereinafter, an example of a computer that executes a granting program that realizes a function similar to that of the granting device 10 will be described.

FIG. 15 is a diagram illustrating an example of a computer that executes the adding program. The computer 1000 has, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. A mouse 1051 and a keyboard 1052 are connected to the serial port interface 1050, for example. A display 1061 is connected to the video adapter 1060, for example.

Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each table described in the above embodiment is stored in, for example, the hard disk drive 1031 or the memory 1010.

Further, the giving program is stored in the hard disk drive 1031 as a program module 1093 in which a command executed by the computer 1000 is described, for example. Specifically, the program module 1093 in which each process executed by the assigning device 10 described in the above embodiment is described is stored in the hard disk drive 1031.

Further, data used for information processing by the adding program is stored in the hard disk drive 1031 as the program data 1094, for example. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes the above-described procedures.

The program module 1093 and the program data 1094 related to the imparting program are not limited to being stored in the hard disk drive 1031 and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1041 or the like. May be done. Alternatively, the program module 1093 and the program data 1094 related to the giving program are stored in another computer connected via a network such as LAN or WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070. May be.

Although the embodiments to which the invention made by the present inventor has been applied have been described above, the present invention is not limited to the description and the drawings that form part of the disclosure of the present invention according to the present embodiment. That is, all other embodiments, examples, operation techniques, and the like made by those skilled in the art based on this embodiment are included in the scope of the present invention.

DESCRIPTION OF SYMBOLS 10 Granting device 11 Input part 12 Output part 13 Communication control part 14 Storage part 14a Correspondence table 14b Label hierarchy information 14c Granting result information 15 Control part 15a Acquisition part 15b Granting part

Claims (5)

An acquisition unit that acquires the hierarchical detection name of malware given by multiple antivirus software,
Among the detection names acquired by the acquisition unit, for the malware to which the detection name is given by a predetermined antivirus software, a hierarchical label is attached to the malware using the detection name, and the predetermined antivirus is added. For malware that has not been given a detection name by software, specify multiple malwares that have been given the same detection name by other anti-virus software, and if the specified anti-virus software When the number of collected detection names is aggregated for each layer and the number of aggregations is a predetermined number or more, the layered label is attached to malware by using the detection names from the shallow layer to the predetermined number or more layers in order. ,
An application device, comprising: The predetermined anti-virus software is one of the plurality of anti-virus software that has the lowest ratio of undetected malware or has the highest accuracy of detecting malware. The application device described. The assigning apparatus according to claim 1, wherein the assigning unit further assigns the hierarchical label using a malware type of malware. An application method executed by an application device,
An acquisition process that acquires the hierarchical detection name of malware given by multiple antivirus software,
Among the detection names acquired in the acquisition step, for the malware to which the detection name is given by a predetermined antivirus software, a hierarchical label is attached to the malware using the detection name, and the predetermined antivirus is added. For malware that has not been given a detection name by software, specify multiple malwares that have been given the same detection name by other anti-virus software, and if the specified anti-virus software An aggregating step of aggregating the assigned detection names for each layer, and assigning a hierarchical label to malware by using detection names from a shallow layer up to a predetermined number or more in the case where the total number is a predetermined number or more. ,
An application method characterized in that An acquisition step of acquiring a hierarchical detection name of malware given by multiple anti-virus software,
Among the detection names acquired in the acquisition step, for the malware to which the detection name is given by a predetermined antivirus software, a hierarchical label is attached to the malware using the detection name, and the predetermined antivirus is added. For malware that has not been given a detection name by software, specify multiple malwares that have been given the same detection name by other anti-virus software, and if the specified anti-virus software An affixing step of aggregating the assigned detection names for each layer, and attaching a hierarchical label to malware by using detection names from a shallow layer up to a predetermined number or more in order when the total number is a predetermined number or more. ,
A program for causing a computer to execute.

Images