JP7102780B2 - Unauthorized communication countermeasure system and method - Google Patents

Description

The present invention relates to an unauthorized communication countermeasure system and method for dealing with unauthorized communication caused by malware.

Some malware infects a program in a user terminal and interferes with the operation of the program, or has a harmful effect contrary to the intention of the user. When such malware is executed, it illegally communicates with a malicious server such as a C & C server (command & control server) located on the Internet, and the malicious server sends a malware-infected device such as a user terminal via the Internet. Configure a remotely operated bot net. The remote-controlled commander operates the commander device to send a command to the malware-infected device via an unauthorized server. When a command is sent from a malicious server, a remotely controlled malware-infected device attacks other terminals or servers or steals personal information regardless of the user's intention. When such malware spreads and infects a large number of terminals and computer devices, the large number of malware-infected devices connect to a malicious server and perform unauthorized communication.

As a method for dealing with such unauthorized communication, conventionally, as disclosed in Patent Document 1, in a network having a plurality of LANs connected to the Internet, access from the Internet to a terminal device connected to each LAN is performed. There is a technology that warns and counterattacks against unauthorized intrusions into the network by passing through the unauthorized intrusion detection proxy server.

Japanese Unexamined Patent Publication No. 2003-1867663

However, in such a conventional technique, although the aim is to counterattack an unauthorized server to provide a deterrent, an unauthorized communication countermeasure facility such as an unauthorized intrusion detection proxy server is constructed for each network connected to the Internet. There was a problem that it was necessary and the cost was high due to the equipment for dealing with unauthorized communication and the construction of the network.

Therefore, an object of the present invention is to provide a fraudulent communication countermeasure system and method capable of swiftly dealing with fraudulent communication caused by malware without constructing a fraudulent communication countermeasure facility for each network connected to the Internet. be.

The unauthorized communication countermeasure system of the present invention executes a file importing means for importing a file transferred via the Internet and the file imported by the file importing means in a virtual environment, and based on the execution contents. A malware determining means for determining whether or not the file is malware, and an address of an unauthorized server based on the execution contents of the file under the virtual environment when the file is determined to be malware by the malware determining means. The countermeasure means is provided with a server address detecting means for detecting the file, and the countermeasure means is congested traffic that continuously sends a specific packet to the address of the malicious server in response to the unauthorized communication behavior by the malware. The transmission function unit is operated, and the countermeasure means includes a communication behavior DB (database) device that stores the unauthorized communication behavior by the malware as a log, and the communication behavior DB device is such that the file is stored by the malware determination means. When it is determined to be malware, it is determined whether or not the unauthorized communication behavior by the malware is a new method, and if it is the new method, the log of the new method is accumulated .
The unauthorized communication countermeasure system of the present invention executes a file importing means for importing a file transferred via the Internet and the file imported by the file importing means in a virtual environment, and based on the execution contents. A malware determining means for determining whether or not the file is malware, and an address of an unauthorized server based on the execution contents of the file under the virtual environment when the file is determined to be malware by the malware determining means. The countermeasure means includes a server address detecting means for detecting the file and a countermeasure means, and the countermeasure means receives a packet containing a code corresponding to a vulnerability in the software of the malicious server in response to the unauthorized communication behavior by the malware. The vulnerability code transmission function unit that transmits to the address of the unauthorized server is operated, and the countermeasure means includes a communication behavior DB (database) device that stores the unauthorized communication behavior by the malware as a log, and the communication behavior DB. When the file is determined to be malware by the malware determining means, the device determines whether or not the unauthorized communication behavior by the malware is a new method, and if it is the new method, the said new method. It is characterized by accumulating logs.
The malicious communication countermeasure system of the present invention executes a file importing means for importing a file transferred via the Internet and the file imported by the file importing means in a virtual environment, and based on the execution contents. A malware determining means for determining whether or not the file is malware, and an address of an unauthorized server based on the execution contents of the file under the virtual environment when the file is determined to be malware by the malware determining means. The countermeasure means includes a server address detecting means for detecting the above, and the countermeasure means sends a packet containing a RAT (Remote Access Tool) type program to the address of the malicious server in response to the malicious communication behavior caused by malware. The RAT type program transmission function unit that transmits to the address is operated, and the countermeasure means includes a communication behavior DB (database) device that stores the unauthorized communication behavior by the malware as a log, and the communication behavior DB device is the said. When the file is determined to be malware by the malware determining means, it is determined whether or not the unauthorized communication behavior by the malware is a new method, and if it is the new method, the log of the new method is accumulated. It is characterized by that.

The fraudulent communication coping method of the present invention is a fraudulent communication coping method in a fraudulent communication coping system, and the fraudulent communication coping system includes a file importing means , a malware determining means , a server address detecting means, and a countermeasure means. The countermeasure means includes a communication behavior DB (database) device, the file importing means has a step of fetching a file transferred via the Internet, and the malware determining means has the file fetching means. The file taken in by the embedding means is executed in a virtual environment, and has a step of determining whether or not the file is malware based on the execution content, and the server address detecting means is the malware determining means. When the file is determined to be malware, the file has a step of detecting the address of the unauthorized server from the execution contents of the file in the virtual environment, and the countermeasure means corresponds to the unauthorized communication behavior by the malware. Then, the congestion traffic transmission function step of continuously transmitting a specific packet to the address of the malicious server is operated, and the countermeasure means logs the unauthorized communication behavior by the malware in the communication behavior DB device. The communication behavior DB device has a first accumulation step of accumulating as, and when the file is determined to be malware by the malware determining means, whether or not the unauthorized communication behavior by the malware is a new method. It is characterized by having a second accumulation step of accumulating the log of the new method in the case of the new method.
The fraudulent communication coping method of the present invention is a fraudulent communication coping method in a fraudulent communication coping system, and the fraudulent communication coping system includes a file importing means , a malware determining means , a server address detecting means, and a countermeasure means. The countermeasure means includes a communication behavior DB (database) device, the file importing means has a step of fetching a file transferred via the Internet, and the malware determining means has the file fetching means. The file taken in by the embedding means is executed in a virtual environment, and has a step of determining whether or not the file is malware based on the execution content, and the server address detecting means is the malware determining means. When the file is determined to be malware, the file has a step of detecting the address of an unauthorized server from the execution contents of the file in the virtual environment, and the countermeasure means corresponds to the unauthorized communication behavior by the malware. Then, the vulnerability code transmission function step of transmitting a packet containing the code corresponding to the software vulnerability of the malicious server to the address of the malicious server is operated, and the countermeasure means is the communication behavior DB device. In addition, the communication behavior DB device has a first accumulation step of accumulating the unauthorized communication behavior by the malware as a log, and when the file is determined to be malware by the malware determining means, the said by the malware. It is characterized by having a second accumulation step of determining whether or not the unauthorized communication behavior is a new method and accumulating the log of the new method when the new method is used.
The fraudulent communication coping method of the present invention is a fraudulent communication coping method in a fraudulent communication coping system, and the fraudulent communication coping system includes a file importing means , a malware determining means , a server address detecting means, and a countermeasure means. The countermeasure means includes a communication behavior DB (database) device, the file fetching means has a step of fetching a file transferred via the Internet, and the malware determining means has the file fetching means. The file taken in by the embedding means is executed in a virtual environment, and has a step of determining whether or not the file is malware based on the execution content, and the server address detecting means is the malware determining means. When the file is determined to be malware, it has a step of detecting the address of an unauthorized server from the execution contents of the file in the virtual environment, and the countermeasure means corresponds to the unauthorized communication behavior by the malware. Then, the RAT type program transmission function step of transmitting a packet containing a RAT (Remote Access Tool) type program to the address of the malicious server is operated, and the countermeasure means causes the communication behavior DB device to transmit the malware. The communication behavior DB device has a first storage step of accumulating the unauthorized communication behavior by the malware as a log, and when the file is determined to be malware by the malware determining means, the unauthorized communication behavior by the malware is detected. It is characterized by having a second accumulation step of determining whether or not it is a new method and accumulating the log of the new method in the case of the new method.

According to the malicious communication countermeasure system and method of the present invention, a packet that detects malicious communication caused by malware and generates a countermeasure according to the method of malicious communication behavior by malware is transmitted to a malicious server that performs unauthorized communication. Therefore, unauthorized communication can be reliably stopped or blocked. Therefore, it is possible to quickly deal with unauthorized communication. Further, since the device using the unauthorized communication countermeasure system and method of the present invention can be arranged on the Internet, it is not necessary to particularly construct the unauthorized communication countermeasure equipment for each network.

It is a figure which shows the structure of the fraudulent communication coping system by this invention. It is a block diagram which shows the specific structure of each apparatus in the system of FIG. It is a block diagram which shows the functional part which the countermeasure device in the system of FIG. 1 has. It is a flowchart which shows the communication monitoring operation of the system of FIG. It is a flowchart which shows the unauthorized communication coping operation of the system of FIG.

Hereinafter, examples of the present invention will be described in detail with reference to the drawings.

FIG. 1 shows the configuration of an unauthorized communication coping system according to the present invention. In this system, IX (Internet eXchange) 11, ASP (Application Service Provider) 12, and ISP (Internet Service Provider) 13, 14, and 15 are connected to the Internet 10. In addition, IX11, ASP12, and ISP13, 14, 15 are each shown as an apparatus in this embodiment.

User networks 16, 17, and 18 are connected to ISPs 13, 14, and 15, respectively. ISPs 13, 14 and 15 are relay devices that relay communication between the Internet 10 and user networks 16, 17 and 18, which are local networks, respectively. Various user terminals are connected to each of the user networks 16, 17, and 18.

The IX 11 includes a sandbox device 101, a rogue server list DB (database) device 102, and a rogue server detection device 103. The sandbox device 101, the fraudulent server list DB device 102, and the fraudulent server detection device 103 are connected to the Internet 10.

The sandbox device 101 constitutes a file importing means, a malware determining means, and a server address detecting means, and the fraudulent server detecting device 103 constitutes a fraudulent server communication detecting means and a communication partner address detecting means.

The sandbox device 101 takes in a file such as a program to be transferred to the Internet 10 in the form of a packet, executes the file in a virtual environment, and determines whether or not the file is malware from the communication behavior during execution. The virtual environment is an isolated area formed in the sandbox device 101 and does not affect the Internet outside the device even if a file that is malware is executed. If the sandbox device 101 determines that the file is malware, it acquires the IP address of the destination malicious server and supplies the acquired IP address to the malicious server list DB device 102.

The rogue server list DB device 102 stores the IP address of the rogue server supplied from the sandbox device 101. The rogue server detection device 103 monitors the communication of the lines from the Internet 10 to the user networks 16, 17, and 18 to detect the communication of the rogue server via those user networks.

The ASP 12 includes an unauthorized communication user notification device 104, a user billing device 105, an order reception device 106, a countermeasure device 107, and a communication behavior DB device 108. Each of these devices 105-108 is connected to the Internet 10.

The unauthorized communication user notification device 104 constitutes a network identification means and an unauthorized communication notification means, and the user billing device 105 constitutes a charging means. The order receiving device 106 constitutes an order receiving means, and the countermeasure device 107 constitutes a countermeasure means.

The unauthorized communication user notification device 104 notifies the administrator of the user network of the detection of unauthorized communication by e-mail. The order receiving device 106 receives an order for countermeasures against unauthorized communication from the administrator of the user network by e-mail or a specific Web page. When the order receiving device 106 receives the order, the countermeasure device 107 sends an RST packet, which is a reset command, to each of the malicious server targeted for the countermeasure and the terminal of the user network to block the communication, and further, , Sends a packet to generate countermeasures to the malicious server targeted for countermeasures. The user charging device 105 charges the administrator who has sent the countermeasure order. Further, the communication behavior DB device 108 stores the illegal communication behavior due to malware as a log.

Each of the sandbox device 101, the fraudulent server detection device 103, the fraudulent communication user notification device 104, the user billing device 105, the order reception device 106, the countermeasure device 107, and the communication behavior DB device 108 is shown in FIG. 2, for example. The computer device 200 includes a CPU (Central Processing Unit) 201, a memory 202, an auxiliary storage unit 203, a display unit 204, a communication IF unit 205, and an input unit 206 connected to a common internal bus 207. The communication IF unit 205 is connected to the above-mentioned network line such as the Internet 10. The CPU 201 executes the operation of each device by executing the program stored in the memory 202 or the auxiliary storage unit 203. Further, the user performs an input operation from the input unit 206 to give a command to the CPU 201, and the CPU 201 causes the display unit 204 to display information such as an operation result. With such a configuration, the sandbox device 101, the fraudulent server list DB device 102, the fraudulent server detection device 103, the fraudulent communication user notification device 104, the user billing device 105, the order reception device 106, the countermeasure device 107, and the communication behavior DB. Each of the devices 108 performs the following operations and is made communicable between the devices.

Functionally, as shown in FIG. 3, the countermeasure device 107 includes a source address selection function unit 211, an RST packet transmission function unit 212, a congestion traffic transmission function unit 213, a vulnerability code transmission function unit 214, and a RAT type. The program transmission function unit 215 is provided.

The source address selection function unit 211 randomly selects the source IP address of the packet transmitted by the countermeasure device 107 from a plurality of predetermined IP addresses. The RST packet transmission function unit 212 transmits the RST packet to each of the malicious server targeted for countermeasures and the terminal of the user network. The congested traffic transmission function unit 213 continuously transmits the SYN packet and the ICMP packet of TCP to the address of the malicious server or the network in which the unauthorized server exists. Vulnerability code transmission function unit 214 transmits a packet containing a code corresponding to a vulnerability in software such as a server OS to an unauthorized server. The RAT type program transmission function unit 215 transmits a packet containing a RAT (Remote Access Tool) type program to an unauthorized server.

The countermeasure device 107 corresponds to the malware method used when executing countermeasures against the malicious server, and has a congestion traffic transmission function unit 213, a vulnerability code transmission function unit 214, and a RAT type program transmission function. At least one of the units 215 is operated. An IP address randomly selected by the source address selection function unit 211 is used as the source address of each outgoing packet of the congestion traffic transmission function unit 213, the vulnerability code transmission function unit 214, and the RAT type program transmission function unit 215. Be done.

Next, the flow of the communication monitoring operation of the unauthorized communication coping system will be described with reference to the flowchart of FIG.

First, the sandbox device 101 receives the file to be transferred to the IX 11 (step S100). This is a file import step, for example, a script file included in an email attachment or WEB data. When the sandbox device 101 receives such a file, the sandbox device 101 executes the received file under a predetermined virtual environment (step S101), analyzes the behavior during execution, which is the execution content, and determines whether the file is malware. (Step S102). Steps S101 and S102 are malware determination steps. As a behavior, there is an unauthorized communication behavior with an unauthorized server, which is a communication that receives a remote control command and control from the unauthorized server that may be a source of spam mail or DDos attack. If it is determined to be malware, the sandbox device 101 records the unauthorized communication behavior due to the malware as a log, and notifies the communication behavior DB device 108 of the unauthorized communication behavior log (step S103).

The communication behavior DB device 108 stores the notified unauthorized communication behavior log in the internal memory (not shown) (step S201), and classifies the types of malware represented by the unauthorized communication behavior log notified this time (step S202). .. The past unauthorized communication behavior log is recorded in the internal memory, and the type of malware represented by the unauthorized communication behavior log notified this time can be determined based on the past unauthorized communication behavior log. For example, each past malicious communication behavior log is compared with the malicious communication behavior log notified this time, any one of the past malicious communication behavior logs having the highest similarity is detected, and the past malicious communication behavior log is detected. The type of malware represented by can be the type of malware represented by the unauthorized communication behavior log notified this time. On the other hand, if the similarity between each of the past unauthorized communication behavior logs and the unauthorized communication behavior log notified this time is less than the default value, the type of malware represented by the unauthorized communication behavior log notified this time is classified as a new method. (Step S203). If it is a new method, the countermeasure device 107 is notified of the unauthorized communication behavior log notified this time (step S204).

The countermeasure device 107 stores the notified unauthorized communication behavior log of the new method in the internal memory (not shown) (step S301), and the unauthorized communication behavior log, that is, the functional units 213 to 215 corresponding to the new method. (Step S302). This will determine the action of countermeasures against the new method of malware. Therefore, such a communication monitoring operation causes the countermeasure device 107 to set a countermeasure operation suitable for each type of malware.

Further, the flow of the unauthorized communication countermeasure operation of the unauthorized communication countermeasure system will be described with reference to the flowchart of FIG.

First, when the sandbox device 101 receives the file to be transferred to the IX 11 (step S400), the sandbox device 101 executes the received file under a predetermined virtual environment (step S401), and analyzes the behavior during execution, which is the execution content. Then, it is determined whether or not the file is malware (step S402). Steps S400 to S402 are the same as steps S100 to S102 of the above-mentioned communication monitoring operation. Steps S401 and S402 are malware determination steps. If it is determined to be malware, the sandbox device 101 acquires the IP address of the malicious server from the communication behavior with the malicious server in the virtual environment (step S403), and transfers the acquired IP address to the malicious server list DB device 102. Supply (step S404). In step S403, which is a server address detection step, for example, when communicating with a malicious server that performs remote control, the IP address to which the transmission packet of the malware execution machine is transmitted is detected as the IP address of the malicious server. In step S404, the IP address of the unauthorized server is accumulated in the unauthorized server list DB device 102.

The rogue server detection device 103 accesses the rogue server list DB device 102 at a predetermined cycle or receives a command from the sandbox device 101, and obtains the IP address of the rogue server from the rogue server list DB device 102. Take out (step S501). Communication using the extracted IP address is monitored (step S502). Since the fraudulent server detection device 103 is connected to the communication line between the main body of the Internet 10 and the ISPs 13, 14 and 15, the monitoring receives the packet transferred through this communication line, and the received packet is used. This is done by comparing the included destination IP address with the IP address retrieved in step S201. When the communication of the unauthorized server is detected as a result of the monitoring (step S503), the source IP address (IP address of the communication partner of the unauthorized server) included in the received packet is sent to the unauthorized communication user notification device 104 (step S504). ). Steps S501 to S504 are server communication detection steps.

When the unauthorized communication user notification device 104 receives the IP address of the source from the unauthorized server detection device 103, the unauthorized communication user notification device 104 identifies the user network according to the IP address of the source (step S601). The unauthorized communication user notification device 104 holds, for example, the relationship between the IP address and the user network as a data table in advance, and if the IP address is known, it is an address assigned to which user network using the data table. Can be specified. Further, since the unauthorized communication user notification device 104 holds the email address of the administrator of each user network as data, the administrator of the specified user network is notified of the detection of unauthorized communication by email (step S602). ). In the email, for example, the detection of unauthorized communication via the user network under the control of the administrator, the provision of a paid service that blocks the unauthorized communication and takes countermeasures, and the paid service. Order, that is, countermeasure order is accepted by e-mail or a specific Web page.

The order receiving device 106 accesses the malicious server list DB device 102 at a predetermined cycle or receives a command from the sandbox device 101, and retrieves the IP address of the malicious server from the malicious server list DB device 102. (Step S701). Then, it waits until the countermeasure order is received from the administrator (step S702).

When the order receiving device 106 receives the countermeasure order (step S703), the order receiving device 106 instructs the countermeasure device 107 to take countermeasures against the unauthorized server to which the retrieved IP address is assigned (step S704).

Upon receiving the countermeasure command, the countermeasure device 107 accesses the malicious server list DB device 102 and extracts the IP address of the corresponding malicious server from the malicious server list DB device 102 (step S801). In addition, the IP address of the source that is in unauthorized communication with the malicious server, that is, the IP address of the user terminal connected to the network of the administrator who issued the countermeasure order is obtained (step S802). This can be obtained by the countermeasure device 107 communicating with the fraudulent server detection device 103 or the fraudulent communication user notification device 104. Further, the unauthorized communication information such as the IP address of each of the unauthorized communication server and the user terminal that has received the countermeasure order is shared by a storage device (not shown) in the ASP 12, and the devices 104 to 108 in the ASP 12 are appropriately used in the storage device. It may be possible to access and read unauthorized communication information.

When the countermeasure device 107 obtains the IP addresses of the unauthorized server and the user terminal of the unauthorized communication, the RST packet transmission function unit 212 uses the RST packet transmission function unit 212 to transmit the RST packet to the Internet 10 with those IP addresses as the destination addresses. (Step S803). One RST packet is transferred to the user terminal during unauthorized communication, and the other RST packet is transferred to the unauthorized server during unauthorized communication. As a result, unauthorized communication between the unauthorized server and the user terminal is forcibly blocked.

Further, the countermeasure device 107 uses the source address selection function unit 211 to randomly select and set the source address from a plurality of IP addresses (step S804). Then, countermeasures are taken by operating at least one of the congestion traffic transmission function unit 213, the vulnerability code transmission function unit 214, and the RAT type program transmission function unit 215 using the set source address (step S805). ). Which of the functional units 213 to 215 is to be operated is determined in advance according to the type of method ("virus", "worm", "Trojan horse", etc.) recorded in the unauthorized communication behavior log. Can be set.

Therefore, when the congestion traffic transmission function unit 213 operates, specific packets such as TCP SYN packets and ICMP packets are continuously transmitted to the malicious server or the network in which the unauthorized server exists, and the network in which the unauthorized server exists. Unauthorized communication is suppressed by increasing the processing load of the line or the processor of the unauthorized server (not shown). When the vulnerability code transmission function unit 214 operates, a packet containing a code corresponding to a software vulnerability such as the server OS is transmitted to the malicious server, which causes the malicious server to hang and process the malicious server. Is stopped. If the RAT-type program transmission function unit 215 operates, a packet containing the RAT-type program is transmitted to the malicious server, and when the RAT-type program enters the malicious server, it resides as a process. When resident, the processing of the unauthorized server and the monitoring of the log are performed by remote control, the administrator and the operator of the unauthorized server are identified, and the processing of the unauthorized communication is stopped. Each functional unit 213 to 215 operates so as to stop or block unauthorized communication for each type of malware.

The user billing device 105 is notified, for example, that the counter measure order has been received from the order receiving device 106. Further, after the countermeasure device 107 processes the countermeasure, the countermeasure device 107 receives a notification of the end of the countermeasure. In response to the countermeasure end notification, the user billing device 105 executes a billing process for the administrator who has issued the countermeasure order (step S901). The billing process is performed, for example, by automatically debiting the administrator's credit card account registered in advance, or by sending an e-mail containing a bank account transfer request to the administrator's e-mail address.

As shown in FIG. 1, the user terminal 109 is a terminal connected to the user network 17 and is infected with the malware 110. The malicious server 21 is located in, for example, an overseas network 20 and is connected to the Internet 10 via the network 20. Further, the unauthorized server 21 is a server that executes unauthorized communication with the user terminal 109 by executing the malware 110 that has invaded the user terminal 109.

When the user terminal 109 starts executing the malware 110, a TCP connection is established with the malicious server 21. When the TCP connection is established, packets containing the HTTP data + ACK are alternately transferred between the user terminal 109 and the malicious server 21, and the unauthorized communication 111 shown in FIG. 1 is executed.

If the operation of the above-mentioned fraudulent communication coping system is started during the execution of the fraudulent communication 111, RST packets (112 and 113 in FIG. 1) are transmitted to each of the user terminal 109 and the fraudulent server 21. When each of the user terminal 109 and the unauthorized server 21 receives the RST packets 112 and 113, the communication between the user terminal 109 and the unauthorized server 21 is terminated and the TCP connection is forcibly disconnected. Further, the countermeasure device 107 sends a packet for generating countermeasures to the malicious server 21 along the route 113 of FIG. 1, and the packet executes a counterattack against the malicious server 21, and the user terminal 109 by the malicious server 21 executes a counterattack. It is possible to stop the attack on.

As described above, the unauthorized communication countermeasure system according to the present invention is constructed in the IX and the ASP located on the Internet, and it is not necessary to arrange the unauthorized communication countermeasure equipment in the user network, and further, in the ISP connecting the user network. As an ASP service, it is possible to detect and block unauthorized communication and take countermeasures against unauthorized servers without depending on it. Further, as described above, it is not necessary to dispose the unauthorized communication countermeasure equipment in each user network, so that the construction cost of the unauthorized communication countermeasure system can be reduced.

Furthermore, since countermeasures are taken as a paid service of ASP and the source IP address is randomly set in the countermeasures, it is possible to avoid a re-attack on the ASP from an unauthorized server.

In addition, even if an unauthorized server exists in an overseas network, it is possible to detect and block unauthorized communication and take countermeasures against the unauthorized server.

In the above embodiment, the sandbox device 101, the fraudulent server detection device 103, the fraudulent communication user notification device 104, the user billing device 105, the order reception device 106, the countermeasure device 107, and the communication connected to the Internet 10. The distributed operation is performed by the behavior DB device 108, but the present invention is not limited to this, and the distributed operation can be performed in an appropriate number of devices. In addition, all operations may be performed by a single network monitoring device connected to the Internet 10 and having the configuration shown in FIG.

10 Internet 11 IX
12 ASP
13, 14, 15 ISP
20 Overseas network 21 Unauthorized server 101 Sandbox device 102 Unauthorized server list DB device 103 Unauthorized server detection device 104 Unauthorized communication user notification device 105 User billing device 106 Order reception device 107 Countermeasure device 108 Communication behavior DB device 109 User terminal 110 Malware

Claims (13)

A file import method for importing files transferred via the Internet,
A malware determining means that executes the file captured by the file importing means in a virtual environment and determines whether or not the file is malware based on the execution contents.
When the file is determined to be malware by the malware determining means, the server address detecting means for detecting the address of the malicious server from the execution contents of the file in the virtual environment, and the server address detecting means.
Equipped with countermeasures
The countermeasure means operates a congestion traffic transmission function unit that continuously transmits a specific packet to the address of the malicious server in response to the malicious communication behavior caused by malware.
The countermeasure means includes a communication behavior DB (database) device that stores the unauthorized communication behavior caused by the malware as a log.
When the file is determined to be malware by the malware determination means, the communication behavior DB device determines whether or not the unauthorized communication behavior by the malware is a new method, and if it is the new method, the communication behavior DB device determines. An unauthorized communication countermeasure system characterized by accumulating the log of the new method. A file import method for importing files transferred via the Internet,
A malware determining means that executes the file captured by the file importing means in a virtual environment and determines whether or not the file is malware based on the execution contents.
When the file is determined to be malware by the malware determining means, a server address detecting means for detecting the address of an unauthorized server from the execution contents of the file in the virtual environment, and a server address detecting means.
Equipped with countermeasures
The countermeasure means operates a vulnerability code transmission function unit that transmits a packet containing a code corresponding to a software vulnerability of the malicious server to the address of the malicious server in response to the malicious communication behavior caused by malware. Let me
The countermeasure means includes a communication behavior DB (database) device that stores the unauthorized communication behavior caused by the malware as a log.
When the file is determined to be malware by the malware determination means, the communication behavior DB device determines whether or not the unauthorized communication behavior by the malware is a new method, and if it is the new method, the communication behavior DB device determines. An unauthorized communication countermeasure system characterized by accumulating the log of the new method. A file import method for importing files transferred via the Internet,
A malware determining means that executes the file captured by the file importing means in a virtual environment and determines whether or not the file is malware based on the execution contents.
When the file is determined to be malware by the malware determining means, the server address detecting means for detecting the address of the malicious server from the execution contents of the file in the virtual environment, and the server address detecting means.
Equipped with countermeasures
The countermeasure means operates a RAT type program transmission function unit that transmits a packet containing a RAT (Remote Access Tool) type program to the address of the unauthorized server in response to the unauthorized communication behavior caused by malware.
The countermeasure means includes a communication behavior DB (database) device that stores the unauthorized communication behavior caused by the malware as a log.
When the file is determined to be malware by the malware determination means, the communication behavior DB device determines whether or not the unauthorized communication behavior by the malware is a new method, and if it is the new method, the communication behavior DB device determines. An unauthorized communication countermeasure system characterized by accumulating the log of the new method. A rogue server communication detection means that detects communication with the rogue server via the Internet based on the address of the rogue server, and
When communication with the malicious server is detected by the unauthorized server communication detecting means, the communication partner address detecting means for detecting the address of the communication partner of the unauthorized server, and the communication partner address detecting means.
A network identification means for identifying a local network to which the address of the communication partner of the malicious server is assigned, and
An unauthorized communication notification means for notifying the administrator of the local network of the detection of unauthorized communication via the Internet,
A countermeasure receiving means for receiving a countermeasure order for the detection notification of unauthorized communication via the Internet, and the like.
The local network is connected to the Internet via a relay device, and the local network is connected to the Internet via a relay device.
When the countermeasure means receives the countermeasure order, it sends a packet including a communication forced termination command to each of the address of the malicious server and the address of the communication partner in addition to the packet to the Internet. The unauthorized communication countermeasure system according to any one of claims 1 to 3, which is characterized. The unauthorized communication countermeasure system according to claim 4, further comprising a packet including the communication forced termination command by the countermeasure means and a charging means for performing a charging process for the administrator after sending the packet. The local network is a network under the control of an Internet provider.
The unauthorized communication countermeasure system according to claim 4, wherein the relay device is an Internet service provider device. The unauthorized communication countermeasure system according to claim 1, wherein the operation of the congestion traffic transmission function unit is set based on the log stored in the communication behavior DB device. The unauthorized communication countermeasure system according to claim 2, wherein the operation of the vulnerability code transmission function unit is set based on the log stored in the communication behavior DB device. The unauthorized communication countermeasure system according to claim 3, wherein the operation of the RAT type program transmission function unit is set based on the log stored in the communication behavior DB device. The network identifying means and the unauthorized communication notification means are configured by an unauthorized communication user notification device, the order receiving means is configured by an order receiving device, the countermeasure means is configured by a countermeasure device, and the billing means is user-charged. Consists of equipment,
The unauthorized communication countermeasure system according to claim 5 , wherein the unauthorized communication user notification device, the order reception device, the countermeasure device, and the user billing device are included in an ASP (application service provider). It is a method of dealing with fraudulent communication in a fraudulent communication coping system.
The fraudulent communication countermeasure system includes a file importing means , a malware determining means , a server address detecting means, and a countermeasure means.
The countermeasure means includes a communication behavior DB (database) device.
The file importing means has a step of importing a file transferred via the Internet.
The malware determining means has a step of executing the file captured by the file importing means in a virtual environment and determining whether or not the file is malware based on the execution content.
The server address detecting means has a step of detecting the address of an unauthorized server from the execution contents of the file under the virtual environment when the file is determined to be malware by the malware determining means.
The countermeasure means operates a congestion traffic transmission function step that continuously transmits a specific packet to the address of the malicious server in response to the malicious communication behavior caused by malware.
The countermeasure means has a first accumulation step of accumulating the unauthorized communication behavior by the malware as a log in the communication behavior DB device.
When the file is determined to be malware by the malware determination means, the communication behavior DB device determines whether or not the unauthorized communication behavior by the malware is a new method, and if it is the new method, the communication behavior DB device determines. A method for dealing with malicious communication, which comprises a second accumulation step of accumulating the log of the new method. It is a method of dealing with fraudulent communication in a fraudulent communication coping system.
The fraudulent communication countermeasure system includes a file importing means , a malware determining means , a server address detecting means, and a countermeasure means.
The countermeasure means includes a communication behavior DB (database) device.
The file importing means has a step of importing a file transferred via the Internet.
The malware determining means has a step of executing the file captured by the file importing means in a virtual environment and determining whether or not the file is malware based on the execution content.
The server address detecting means has a step of detecting the address of an unauthorized server from the execution contents of the file under the virtual environment when the file is determined to be malware by the malware determining means.
The countermeasure means operates a vulnerability code transmission function step of transmitting a packet containing a code corresponding to a software vulnerability of the malicious server to the address of the malicious server in response to the malicious communication behavior caused by malware. Let me
The countermeasure means has a first accumulation step of accumulating the unauthorized communication behavior by the malware as a log in the communication behavior DB device.
When the file is determined to be malware by the malware determination means, the communication behavior DB device determines whether or not the unauthorized communication behavior by the malware is a new method, and if it is the new method, the communication behavior DB device determines. A method for dealing with malicious communication, which comprises a second accumulation step of accumulating the log of the new method. It is a method of dealing with fraudulent communication in a fraudulent communication coping system.
The fraudulent communication countermeasure system includes a file importing means , a malware determining means , a server address detecting means, and a countermeasure means.
The countermeasure means includes a communication behavior DB (database) device.
The file importing means has a step of importing a file transferred via the Internet.
The malware determining means has a step of executing the file captured by the file importing means in a virtual environment and determining whether or not the file is malware based on the execution content.
The server address detecting means has a step of detecting the address of an unauthorized server from the execution contents of the file under the virtual environment when the file is determined to be malware by the malware determining means.
The countermeasure means operates a RAT-type program transmission function step that transmits a packet containing a RAT (Remote Access Tool) type program to the address of the malicious server in response to the unauthorized communication behavior caused by malware.
The countermeasure means has a first accumulation step of accumulating the unauthorized communication behavior by the malware as a log in the communication behavior DB device.
When the file is determined to be malware by the malware determination means, the communication behavior DB device determines whether or not the unauthorized communication behavior by the malware is a new method, and if it is the new method, the communication behavior DB device determines. A method for dealing with malicious communication, which comprises a second accumulation step of accumulating the log of the new method.

Images