JP6870386B2 - Malware unauthorized communication countermeasure system and method - Google Patents

Description

The present invention relates to communication systems and methods .

Some malware infects a program in a user terminal and interferes with the operation of the program, or has a harmful effect contrary to the intention of the user. When such malware is executed, it performs unauthorized communication with a C & C server (command & control server: hereinafter referred to as "C2 server") located on the Internet, and from the C2 server to a user terminal or the like via the Internet. Configure a botnet to remotely control malware-infected devices. The remote-controlled commander operates the commander device to send a command to the malware-infected device via the C2 server. When a command is transmitted from the C2 server, the remotely controlled malware-infected device attacks other terminals or servers or steals personal information regardless of the user's intention. When such malware spreads and infects a large number of terminals and computer devices, the large number of malware-infected devices connect to a C2 server to perform unauthorized communication.

As a method of cutting off unauthorized communication between such a malware-infected device and a C2 server, as previously disclosed in Patent Document 1, a commander who issues an operation command to the infected device via the C2 server. There is a technique that makes it possible to identify the device and disconnect the commander device from the C2 server.

Japanese Unexamined Patent Publication No. 2014-2199741

However, in order to identify the commander device, it is necessary to comprehensively deploy the monitoring device over the entire Internet, and it is not realistic to monitor the overseas network, and C2 existing in the overseas network. In order to monitor and track the server, the cooperation and request of overseas Internet providers are required, and it is not possible to respond quickly to the threat of unauthorized communication, and in the meantime, the spread of malware progresses and the infection situation becomes There was a problem of getting worse. In addition, there is a problem that the handling by the Internet service provider (ISP) of the domestic network is limited to the handling of only the user network belonging to the provider.

Therefore, an object of the present invention is to provide a communication system and a method capable of quickly dealing with unauthorized communication caused by malware.

Communication system of the present invention performs Nde Captures files transferred via the Internet to the file under the virtual environment, determines that the file is between Hluhluwe A based on the execution contents Then, the second process of detecting a first processing unit from executing the content to detect the address of the server, when detecting the communication with the server via the Internet based on the address of the server, the address of the communication partner of the server The means , the third processing means for identifying the first local network to which the address of the communication partner of the server is assigned from among the plurality of local networks connected to the Internet via the relay device, and the Internet. A fourth processing means for notifying the administrator of the first local network of the detection of unauthorized communication by using an email or an email stating that the unauthorized communication blocking order is accepted on a specific Web page. A fifth processing means for receiving the unauthorized communication blocking order via the Internet, and a sixth processing for sending a command indicating forced termination of communication to each of the server address and the communication partner address to the Internet. It is characterized by having means and.

Communication method of the present invention is a communication method in a communication system, the communication system is Nde Captures files transferred via the Internet to perform the file under the virtual environment, the file determined to be Ma Hluhluwe a based on the execution contents Then, detect communication between the first processing step of detecting the address of the server from the execution contents, and the server via the Internet based on the address of the server When a second processing step of detecting an address of a communication partner of the server, from among a plurality of local networks connected via the relay device to the Internet, communication party of the address of the server is allocated A third processing step for identifying the first local network and an e-mail stating that an unauthorized communication blocking order is accepted by an e-mail or a specific Web page are sent to the administrator of the first local network via the Internet. The fourth processing step of notifying the detection of unauthorized communication, the fifth processing step of receiving the unauthorized communication blocking order via the Internet, and the address of the server and the address of the communication partner are directed to each of them. It is characterized by having a sixth processing step of sending a command indicating forced termination of communication to the Internet.

According to the communication system and method of the present invention, unauthorized communication caused by malware is detected and a command indicating forced termination of communication is transmitted to each address of the unauthorized communication server and its communication partner, so that unauthorized communication is performed. It can be forcibly terminated. Therefore, it is possible to quickly deal with unauthorized communication.

It is a figure which shows the structure of the communication system which copes with malware fraudulent communication by this invention. It is a block diagram which shows the specific structure of each apparatus in the system of FIG. It is a flowchart which shows the operation of the system of FIG. It is a figure which shows the sequence from the start to the cutoff of an unauthorized communication between a user terminal and a C2 server.

Hereinafter, examples of the present invention will be described in detail with reference to the drawings.

FIG. 1 shows a configuration of a communication system for dealing with malware unauthorized communication according to the present invention. In this system, IX (Internet eXchange) 11, ASP (Application Service Provider) 12, and ISP (Internet Service Provider) 13, 14, and 15 are connected to the Internet 10. In addition, IX11, ASP12, and ISP13, 14, 15 are each shown as an apparatus in this embodiment.

User networks 16, 17, and 18 are connected to ISPs 13, 14, and 15, respectively. ISPs 13, 14 and 15 are relay devices that relay communication between the Internet 10 and user networks 16, 17 and 18, which are local networks, respectively. Various user terminals are connected to each of the user networks 16, 17, and 18.

The IX 11 includes a sandbox device 101, a C2 server list DB (database) device 102, and a C2 server detection device 103. The sandbox device 101, the C2 server list DB device 102, and the C2 server detection device 103 are connected to the Internet 10.

The sandbox device 101 constitutes a file importing means, a malware determining means, and a server address detecting means, and the C2 server detecting device 103 constitutes a server communication detecting means and a communication partner address detecting means.

The sandbox device 101 takes in a file such as a program on the network, that is, the Internet 10, executes the file in a virtual environment, and determines whether or not the file is malware from the communication behavior during execution. The virtual environment is an isolated area formed in the sandbox device 101 and does not affect the Internet outside the device even if a file that is malware is executed. If the sandbox device 101 determines that the file is malware, it acquires the IP address of the destination C2 server and supplies the acquired IP address to the C2 server list DB device 102.

The C2 server list DB device 102 stores the IP address of the C2 server supplied from the sandbox device 101. The C2 server detection device 103 monitors the communication of the lines from the Internet 10 to the user networks 16, 17, and 18 to detect the communication of the C2 server via those user networks.

The ASP 12 includes an unauthorized communication user notification device 104, an order reception device 105, an RST transmission device 106, and a user billing device 107. The unauthorized communication user notification device 104, the order reception device 105, the RST transmission device 106, and the user billing device 107 are connected to the Internet 10.

The unauthorized communication user notification device 104 constitutes a network identification means and an unauthorized communication notification means, an order reception device 105 constitutes an order reception means, and an RST transmission device 106 constitutes a command transmission means. Further, the user billing device 107 constitutes a billing means.

The unauthorized communication user notification device 104 notifies the administrator of the user network of the detection of unauthorized communication by e-mail. The order receiving device 105 receives an order for blocking unauthorized communication from the administrator of the user network by e-mail or a specific Web page. When the order receiving device 105 receives the order, the RST transmitting device 106 transmits an RST packet, which is a reset command, to each of the C2 server to be blocked for communication and the terminal of the user network to block the communication. The user billing device 107 charges the administrator who has sent the cutoff order.

Each of the sandbox device 101, the C2 server detection device 103, the unauthorized communication user notification device 104, the order reception device 105, the RST transmission device 106, and the user billing device 107 is a CPU (Central Processing Unit), for example, as shown in FIG. ) 201, memory 202, auxiliary storage unit 203, display unit 204, communication IF unit 205, and input unit 206 are connected to a common internal bus 207. The communication IF unit 205 is connected to the network line such as the Internet 10 described above. The CPU 201 executes the operation of each device by executing the program stored in the memory 202 or the auxiliary storage unit 203. Further, the user performs an input operation from the input unit 206 to give a command to the CPU 201, and the CPU 201 causes the display unit 204 to display information such as an operation result. With such a configuration, the sandbox device 101, the C2 server list DB device 102, the C2 server detection device 103, the unauthorized communication user notification device 104, the order reception device 105, the RST transmission device 106, and the user billing device 107 are described below. The operations shown in (1) are performed, and communication is enabled between these devices.

Next, the operation flow of the communication system for dealing with such malware unauthorized communication will be described with reference to the flowchart of FIG.

First, the sandbox device 101 receives the file to be transferred to the IX 11 (step S100). This is a file import step, for example, a script file included in an email attachment or WEB data. When the sandbox device 101 receives such a file, it executes the received file under a predetermined virtual environment (step S101), analyzes the behavior during execution, which is the execution content, and determines whether the file is malware. (Step S102). Steps S101 and S102 are malware determination steps. The behavior includes communication behavior with the C2 server, which is communication that receives commands and controls for remote control that are sources of spam mails and DDos attacks from the C2 server. If it is determined to be malware, the sandbox device 101 acquires the IP address of the C2 server from the communication behavior with the C2 server in the virtual environment (step S103), and obtains the acquired IP address as the C2 server list DB device 102. (Step S104). In step S103, which is a server address detection step, for example, the IP address to which the transmission packet of the malware execution machine is transmitted is detected as the IP address of the C2 server when communicating with the C2 server that performs remote control. In step S104, the IP address of the C2 server is accumulated in the C2 server list DB device 102.

The C2 server detection device 103 accesses the C2 server list DB device 102 at a predetermined cycle or receives a command from the sandbox device 101, and obtains the IP address of the C2 server from the C2 server list DB device 102. Take out (step S201). Communication using the extracted IP address is monitored (step S202). Since the C2 server detection device 103 is connected to the communication line between the main body of the Internet 10 and the ISPs 13, 14 and 15, the monitoring receives the packet transferred through this communication line, and the received packet is used. This is done by comparing the included destination IP address with the IP address retrieved in step S201. When the communication of the C2 server is detected as a result of the monitoring (step S203), the source IP address (IP address of the communication partner of the C2 server) included in the received packet is sent to the unauthorized communication user notification device 104 (step S204). ). Steps S201 to S204 are server communication detection steps.

When the unauthorized communication user notification device 104 receives the source IP address from the C2 server detection device 103, the unauthorized communication user notification device 104 identifies the user network according to the source IP address (step S301). The unauthorized communication user notification device 104 holds, for example, the relationship between the IP address and the user network as a data table in advance, and if the IP address is known, it is an address assigned to which user network using the data table. Can be specified. Further, since the unauthorized communication user notification device 104 holds the email address of the administrator of each user network as data, the administrator of the specified user network is notified of the detection of unauthorized communication by email (step S302). ). In the email, for example, the detection of unauthorized communication via the user network under the control of the administrator, the provision of a paid service that blocks the unauthorized communication, and the order of the paid service, that is, the unauthorized communication It is stated that the blocking order is accepted by e-mail or a specific Web page.

The order receiving device 105 accesses the C2 server list DB device 102 and extracts the IP address of the C2 server from the C2 server list DB device 102, for example, at a predetermined cycle or in response to a command from the sandbox device 101. (Step S401). Then, it waits until it receives an unauthorized communication blocking order from the administrator (step S402).

When the order receiving device 105 receives the unauthorized communication blocking order (step S403), the order receiving device 105 instructs the RST transmitting device 106 to block the unauthorized communication with the C2 server to which the extracted IP address is assigned (step S404).

When the RST transmission device 106 receives the unauthorized communication cutoff command, it accesses the C2 server list DB device 102 and extracts the IP address of the corresponding C2 server from the C2 server list DB device 102 (step S501). Further, the IP address of the transmission source during unauthorized communication with the corresponding C2 server, that is, the IP address of the user terminal connected to the network of the administrator who issued the unauthorized communication blocking order is obtained (step S502). This can be obtained by the RST transmission device 106 communicating with the C2 server detection device 103 or the unauthorized communication user notification device 104. Further, the unauthorized communication information such as the IP address of each of the C2 server and the user terminal of the unauthorized communication received the order of blocking unauthorized communication is shared by a storage device (not shown) in the ASP 12, and the devices 104 to 107 in the ASP 12 are used in the storage device. It may be possible to access appropriately and read the unauthorized communication information.

When the RST transmitting device 106 obtains the IP addresses of the C2 server and the user terminal of the unauthorized communication that have received the unauthorized communication blocking order, the RST transmitting device 106 transmits the RST packet with those IP addresses as the destination addresses to the Internet 10 (step). S503). Step S503 is a command transmission step. One RST packet is transferred to the user terminal during unauthorized communication, and the other RST packet is transferred to the C2 server during unauthorized communication. As a result, unauthorized communication between the C2 server and the user terminal is forcibly blocked.

The user billing device 107 is notified, for example, that an unauthorized communication blocking order has been received from the order receiving device 105. Further, after the RST transmission device 106 transmits the RST packet, the RST packet transmission end notification is received from the RST transmission device 106. In response to the RST packet transmission end notification, the user billing device 107 executes a billing process for the administrator who has issued the unauthorized communication blocking order (step S601). The billing process is performed, for example, by automatically debiting the administrator's credit card account registered in advance, or by sending an e-mail containing a bank account transfer request to the administrator's e-mail address.

FIG. 4 shows a sequence from the start of unauthorized communication between the user terminal 108 and the C2 server 109 to the forced interruption. As shown in FIG. 1, it is assumed that the user terminal 108 is a terminal connected to the user network 17 and malware is executed there. For example, the C2 server 109 is arranged in an overseas network 20 and is connected to the Internet 10 via the network 20. Further, the C2 server 109 is a server that executes unauthorized communication with the user terminal 108 by executing the malware 110 that has invaded the user terminal 108.

When the user terminal 108 starts executing the malware 110, first, a request for establishing a TCP connection is made with the C2 server 109. As shown in FIG. 4, the user terminal 108 transmits a SYN packet toward the C2 server 109 (step S701), and in response to this, the C2 server 109 transmits a SYN + ACK packet toward the user terminal 108 (step S702). ). In response to the SYN + ACK packet, the user terminal 108 transmits the ACK packet to the C2 server 109 (step S703). This establishes a TCP connection (TCP connection open).

When the TCP connection is established, packets containing the HTTP data + ACK are alternately transferred between the user terminal 108 and the C2 server 109 (for example, steps S704 and S705), whereby the unauthorized communication 111 shown in FIG. 1 is executed. To.

If the operation of the communication system for dealing with unauthorized communication is started during the execution of the unauthorized communication 111, RST packets (112 and 113 in FIG. 1) are transmitted to each of the user terminal 108 and the C2 server 109 ( Steps S706, S707). This corresponds to the operation of step S503 of the RST transmitter 106 described above. When each of the user terminal 108 and the C2 server 109 receives the RST packets 112 and 113, the communication between the user terminal 108 and the C2 server 109 is terminated and the TCP connection is forcibly disconnected (TCP connection close).

As described above, in the communication system for dealing with unauthorized communication according to the present invention, unauthorized communication is quickly detected and blocked by executing malware on the user terminal without monitoring and tracking the C2 server existing in the overseas network. It becomes possible.

Further, it is possible to detect and block unauthorized communication of malware as an ASP service without arranging an anti-malware device in the user network and without depending on the ISP connecting the user network.

Normally, the blocking of unauthorized communication is blocked by a firewall device arranged between the user network and the Internet, but in the communication system for dealing with unauthorized communication according to the present invention, the file wall device is blocked by transmitting an RST packet. Is unnecessary, and it is possible to suppress deterioration of communication quality of normal communication. In addition, by eliminating the need to use a firewall device, complicated work such as rule setting when there is a user terminal whose blocking is desired to be excluded becomes unnecessary.

In the above embodiment, the sandbox device 101 connected to the Internet 10, the C2 server detection device 103, the unauthorized communication user notification device 104, the order reception device 105, the RST transmission device 106, and the user billing device 107 are distributed. The operation is performed, but the operation is not limited to this, and it can be distributed to an appropriate number of devices. In addition, all operations may be performed by a single network monitoring device connected to the Internet 10 and having the configuration shown in FIG.

10 Internet 11 IX
12 ASP
13, 14, 15 ISP
20 Overseas network 101 Sandbox device 102 C2 server list DB device 103 C2 server detection device 104 Unauthorized communication user notification device 105 Order reception device 106 RST transmission device 107 User billing device 108 User terminal 109 C2 server

Claims (8)

Running in a virtual operating environment the file Nde Captures files transferred via the Internet, determines that the file is between Hluhluwe A based on the execution contents Then, the address of the server from the execution content The first processing means to detect and
When the communication with the server via the Internet is detected based on the address of the server, the second processing means for detecting the address of the communication partner of the server and the second processing means.
A third processing means for identifying a first local network to which the address of the communication partner of the server is assigned from among a plurality of local networks connected to the Internet via a relay device.
The fourth process of notifying the administrator of the first local network via the Internet of the detection of unauthorized communication by using an email or an email stating that the unauthorized communication blocking order is accepted on a specific Web page. Means and
A fifth processing means for receiving the unauthorized communication blocking order via the Internet, and
A sixth processing means for sending a command indicating forced termination of communication to the address of the server and the address of the communication partner to the Internet.
Communication system comprising: a. After sending commands specifying the communication abort communication system according to claim 1, characterized in that it comprises a seventh processing means for performing accounting processing for the administrator. Claim 1 or 2 communication system according commands specifying the communication abort is characterized in that it is a RST packet. The local network is a network under the Internet provider management, communication system of claim 1, wherein the relay device is the Internet service provider equipment. The server of any one communication system according to claim 1 to 4, characterized in that a command and control server. The first processing means is configured by a sandbox device, and the second processing means is configured by a C2 server detection device.
The sandbox apparatus and C2 server sensing device IX any one communication system according to claim 1 to 5, characterized in that included in the (Internet Exchanges). The third processing means and the fourth processing means are configured by an unauthorized communication user notification device, the fifth processing means is configured by an order receiving device, the sixth processing means is configured by an RST transmission device, and the seventh processing means. The processing means is composed of a user billing device.
The unauthorized communication user notification device, the order accepting apparatus, the RST transmitter, and claim 2 Symbol placement of communication systems the user charging apparatus is characterized in that included in the ASP (application service provider). A communication method in a communication system,
Wherein the communication system is
Running in a virtual operating environment the file Nde Captures files transferred via the Internet, determines that the file is between Hluhluwe A based on the execution contents Then, the address of the server from the execution content The first processing step to detect and
Upon detecting the communication with the server via the Internet based on the address of the server, a second processing step of detecting an address of a communication partner of the server,
A third processing step of identifying a first local network to which the address of the communication partner of the server is assigned from among a plurality of local networks connected to the Internet via a relay device .
The fourth process of notifying the administrator of the first local network via the Internet of the detection of unauthorized communication by using an email or an email stating that the unauthorized communication blocking order is accepted on a specific Web page. Steps and
The fifth processing step of receiving the unauthorized communication blocking order via the Internet, and
A sixth processing step of sending a command indicating forced termination of communication to the address of the server and the address of the communication partner to the Internet, and
Communication how to, comprising a.

Images