JP7291919B1 - Computer program reliability determination system, computer program reliability determination method, and computer program reliability determination program - Google Patents

Abstract

A computer program reliability determination system, a computer program reliability determination method, and a computer program reliability determination program for determining the reliability of a computer program are provided. A computer program reliability determination system includes an acquisition unit that acquires a computer program, an extraction unit that extracts a plurality of identifiers from the acquired computer program, and at least one identifier based on the extracted plurality of identifiers. An obfuscation rate generator that generates an obfuscation rate, and a reliability determination section that determines reliability of the computer program based on the generated obfuscation rate. [Selection drawing] Fig. 1

Description

The present invention relates to a computer program reliability determination system, a computer program reliability determination method, and a computer program reliability determination program.

Malicious software or malicious code that is created with the intent to perform unauthorized and harmful actions is collectively referred to as malware. Malware includes specimens implemented as a script language attached to document files such as Word documents and Excel books. Here, variable names, function names, class names, procedure names, macro names, etc. used to identify variables, functions, classes, etc. in computer programs are called "identifiers". The "identifier" also includes a character string included in the source code from which the computer program was created and a character string included in debug information associated with the computer program. Some malware that uses scripting languages uses character strings that cannot be interpreted as natural language as identifiers used in computer programs written in scripting languages. This is one of the obfuscation techniques. Such identifiers can reduce the readability of the source code while preserving the behavior obtained when the source code is executed. For this reason, identifiers are sometimes used to hide the purpose of computer programs.

Identifiers in source code are usually lost at the compilation stage and are not included in the output executable file. Therefore, it is not possible to make any kind of determination using the characteristics of the identifiers included in the original source code for all executable files developed in a language adopting the compilation method. On the other hand, for a program developed in a script language that adopts the interpreter method, since the source code and the executable file are integrated, it is possible to make some kind of determination using the characteristics of the identifiers included in the source code. can.

Here, pattern matching is one of known anti-malware techniques (see Non-Patent Documents 1 to 3). Pattern matching is most typically a method of determining the reliability of a computer program based on whether or not the target computer program contains a specific byte string extracted from known malware. Pattern matching has the advantage of being less likely to falsely determine that malware is trustworthy compared to other techniques.

One of other known anti-malware techniques is behavior detection (see Non-Patent Documents 4 and 5). This is a technique of executing a target computer program and judging the reliability of the computer program from its behavior (dynamic characteristics obtained by virtually or actually operating the program). Behavior detection, unlike pattern matching, has the advantage of being able to handle known malware variants.

Bewar Neamat Taha and Cihan Varol, "Pattern Matching Based Malware Identification", International Journal of Scientific and Engineering Research 11(8):1375-1381, [online], [searched on October 11, 2021], Internet <URL: https://www.researchgate.net/publication/345141000_Pattern_Matching_Based_Malware_Identification＞ Keisuke Sugahara, Yasushi Sengoku, Hitoshi Yashima, Masashi Jige, Hiroyuki Nishikawa, Eiji Okamoto, "A Study of Unknown Computer-Virus Detection Methods ", The 2004 Symposium on Cryptography and Information Security Sendai, Japan, Jan.27-30, 2004 The Institute of Electronics, Information and Communication Engineers, [online], [searched on October 11, 2021], Internet <URL: https://www.ipa.go.jp/security/fy15/reports/uvd/documents /3B5-3.pdf＞ "Survey on Unknown Virus Detection Technology", Information-technology Promotion Agency, April 2004, [online], [searched on October 11, 2021], Internet <URL: https://www.ipa. go.jp/security/fy15/reports/uvd/documents/3B5-3.pdf＞ Jaehyeong Lee, 6 others, "An unknown malware detection method based on resource access information", 11th Information Science and Technology Forum, 2012, [online], [searched on October 11, 2021], Internet < URL : http://id.nii.ac.jp/1001/00151832/＞ Takahiro Matsuki, 3 others, "Proposal of Malware Detection and Activity Deterrence Method Using Security Disabling Attack", Transactions of Information Processing Society of Japan, (September 2009) Vol. 50, No.9, 2127-2136 [ online], [searched on October 11, 2021], Internet <URL: http://id.nii.ac.jp/1001/00066466/>

However, pattern matching has the disadvantage that it cannot correctly determine the reliability of subspecies of known malware created by modifying a part of known malware.

Also, in the case of behavior detection, the behavior itself used as a condition when judging the reliability of a computer program needs to be extracted from known malware in advance. Behavioral detection therefore has the drawback of not being able to correctly determine the trustworthiness of a computer program if the malware implements malicious behavior with unknown behavior.

In view of such problems, one object of the present invention is to provide a new technique for determining the reliability of a computer program.

According to one embodiment of the present invention, an obtaining unit for obtaining a computer program, an extracting unit for extracting at least one identifier from the obtained computer program, and based on the extracted at least one identifier, at least one A computer program reliability determination system, comprising: an obfuscation rate generation unit that generates an obfuscation rate; and a reliability determination unit that determines reliability of the computer program based on the generated at least one obfuscation rate. is provided.

In the computer program reliability determination system according to one embodiment of the present invention, the obfuscation rate generator divides the identifier into substrings containing a plurality of characters, sets the divided substrings, and calculating first mismatch rate information based on the set character division, setting one rule out of a plurality of rules stored in advance, calculating second mismatch rate information based on the set rule, The obfuscation rate may be generated using the first mismatch rate information and the second mismatch rate information.

In the computer program reliability determination system according to one embodiment of the present invention, the obfuscation rate generator segments the divided character substrings based on the character segmentation, and The first non-coincidence rate information may be calculated by comparing the character divisions of the characters.

In the computer program trustworthiness determination system according to one embodiment of the present invention, the obfuscation rate generator generates the rules according to a set of characters that make up the identifier and the appearance frequency of each character in the set of characters. If set, the obfuscation rate may be high when the identifier is likely to be generated by a rule that satisfies a predetermined condition.

In one embodiment of the computer program trustworthiness determination system of the present invention, the at least one identifier includes a plurality of identifiers, and the trustworthiness determination unit determines a representative obfuscation rate corresponding to each of the plurality of identifiers. may be calculated, and the reliability of the computer program may be determined based on the relationship between the calculated representative value and a preset first threshold value.

In one embodiment of the computer program reliability determination system of the present invention, the at least one identifier includes a plurality of identifiers, and the reliability determination unit exceeds a preset first threshold among the plurality of identifiers. The reliability of the computer program may be determined based on a relationship between a ratio of identifiers having an obfuscation rate and a preset second threshold.

In one embodiment of the computer program reliability determination system of the present invention, the reliability determination unit determines the reliability of the computer program based on the difference between the obfuscation rate and a preset first threshold. may

In one embodiment of the computer program reliability determination system of the present invention, the reliability determination section may determine the reliability of the computer program based on the number of identifiers.

Also, according to an embodiment of the present invention, obtaining a computer program, extracting at least one identifier from the obtained computer program, and calculating at least one obfuscation rate based on the extracted at least one identifier. A method for determining computer program trustworthiness is provided including generating and determining trustworthiness of the computer program based on the generated obfuscation rate.

In the above computer program reliability determination method, the identifier is divided into substrings containing a plurality of characters, and the first mismatch rate information is calculated based on a set of the divided substrings and a preset character classification. setting one rule out of a plurality of pre-stored rules, calculating second mismatch rate information based on the set rule, and calculating the first mismatch rate information and the second mismatch rate information may be used to generate the obfuscation rate.

In the above computer program reliability determination method, the divided partial character strings are segmented based on the character segmentation, and the character segments of adjacent characters in the segmented partial character strings are compared to determine the first mismatch rate. Information may be calculated.

In the computer program reliability determination method described above, the rules may be set according to a set of characters forming the identifier and an appearance frequency of each character in the set of characters.

In the above computer program reliability determination method, the at least one identifier includes a plurality of identifiers, a representative value of obfuscation rates corresponding to each of the plurality of identifiers is calculated, and the calculated representative value and The reliability of the computer program may be determined based on a relationship with a set first threshold.

In the above computer program reliability determination method, the at least one identifier includes a plurality of identifiers, and a ratio of identifiers having an obfuscation rate exceeding a preset first threshold among the plurality of identifiers is preset. The trustworthiness of the computer program may be determined based on whether a second threshold is exceeded.

In the computer program reliability determination method described above, the reliability of the computer program may be determined based on a difference between the obfuscation rate and a preset first threshold.

In the computer program reliability determination method described above, the reliability of the computer program may be determined based on the number of identifiers.

Further, according to an embodiment of the present invention, a computer obtains a computer program, extracts at least one identifier from the obtained computer program, and generates at least one identifier based on the extracted at least one identifier. A computer program trustworthiness determination program is provided that causes the execution of generating an obfuscation rate and determining the trustworthiness of the computer program based on the generated obfuscation rate.

According to the present invention, it is possible to provide a new technique for determining the reliability of a computer program without depending on specific patterns or behaviors contained in the computer program.

1 is a block diagram showing the overall configuration of a computer program reliability determination system according to one embodiment of the present invention; FIG. FIG. 2 is a flow diagram showing an example of the flow of processing executed by the computer program reliability determination system according to one embodiment of the present invention; FIG. 2 is a flow diagram showing an example of the flow of processing executed by the computer program reliability determination system according to one embodiment of the present invention; FIG. 2 is a flow diagram showing an example of the flow of processing executed by the computer program reliability determination system according to one embodiment of the present invention; FIG. 2 is a flow diagram showing an example of the flow of processing executed by the computer program reliability determination system according to one embodiment of the present invention; FIG. 2 is a flow diagram showing an example of the flow of processing executed by the computer program reliability determination system according to one embodiment of the present invention; FIG. 2 is a flow diagram showing an example of the flow of processing executed by the computer program reliability determination system according to one embodiment of the present invention; FIG. 2 is a flow diagram showing an example of the flow of processing executed by the computer program reliability determination system according to one embodiment of the present invention; It is an example of the data structure of the character set of the identifier in the computer program reliability determination system according to one embodiment of the present invention. It is an example of a data structure of naming rules in the computer program reliability determination system according to one embodiment of the present invention. It is an example of a data structure of naming rules in the computer program reliability determination system according to one embodiment of the present invention. FIG. 2 is a flow diagram showing an example of the flow of processing executed by the computer program reliability determination system according to one embodiment of the present invention; FIG. 2 is a flow diagram showing an example of the flow of processing executed by the computer program reliability determination system according to one embodiment of the present invention; FIG. 2 is a flow diagram showing an example of the flow of processing executed by the computer program reliability determination system according to one embodiment of the present invention;

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention can be implemented in many different aspects and should not be construed as being limited to the description of the embodiments exemplified below. Although the drawings may be represented schematically in order to make the description clearer, they are only examples and do not limit the interpretation of the present invention. In addition, the letters "first" and "second" for each element are labels for convenience used to distinguish each element, and unless otherwise specified, have more meaning. do not have. In the drawings referred to in this embodiment, identical parts or parts having similar functions are denoted by the same reference numerals or similar reference numerals (numerals xxx plus A, B or -1, -2, etc.). , and repeated explanations may be omitted. Also, part of the configuration may be omitted from the drawing. In addition, no particular description will be given if it is something that can be recognized by a person who has ordinary knowledge in the field to which the present invention belongs.

<First embodiment>
A computer program reliability determination system according to an embodiment of the present invention will be described in detail with reference to the drawings.

(1-1. Configuration of computer program reliability determination system)
FIG. 1 shows a block diagram showing the overall configuration of a computer program reliability determination system 100. As shown in FIG. As shown in FIG. 1, the computer program reliability determination system 100 includes a control section 110, a storage section 120, and a user interface section . In this embodiment, the computer program reliability determination system 100 is implemented in one terminal (computer).

The control unit 110 includes a CPU (Central Processing Unit), ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Gate Array), or other arithmetic processing circuits, ROM (Read only Memory) and RAM (Rando). m Access Memory) memory. The control unit 110 controls functions of each unit using a computer program reliability determination program stored in the memory.

The storage unit 120 uses a semiconductor memory such as an SSD (Solid State Drive), as well as a magnetic recording medium (magnetic tape, magnetic disk, etc.), an optical recording medium, a magneto-optical recording medium, and a memory element that is a storage medium. be done. The storage unit 120 has a function as a database that stores various information used in the computer program reliability determination program. The computer program reliability determination program may be provided as long as it can be executed by a computer, and stored in the computer-readable recording medium described above.

The database for the computer program reliability determination program in the storage unit 120 includes information such as the computer program 1201, character division 1203, naming rule 1205, threshold value 1207, and the like. Each piece of information will be described later.

The user interface unit 130 inputs and outputs information with the user. User interface portion 130 includes a display portion 131 and an operation portion 133 . The display unit 131 is a display device such as a liquid crystal display or an organic EL (Electro Luminescence) display, and display contents are controlled by signals input from the control unit 110 . Operation unit 133 includes a controller, buttons, or switches. When the user uses the operation unit 133 to move, press, or rotate, information based on the operation is input to the control unit 110 . Note that the display unit 131 and the operation unit 133 of the user interface unit 130 may be arranged at the same place as long as the display device (touch panel) has a touch sensor.

In FIG. 1, the control unit 110 includes an acquisition unit 1101, an identifier extraction unit 1103, an obfuscation rate generation unit 1105, and a reliability determination unit 1107 as functional units.

Acquisition unit 1101 has a function of acquiring a computer program input by a user or a computer program stored in storage unit 120 . In this embodiment, the computer program refers to all units from which identifiers can be extracted, including executable files, source code, debug information, and the like. Computer programs are written in programming languages such as C/C++, Python, JavaScript, Java, or VBA (Visual Basic for Applications).

The identifier extraction unit 1103 has a function of extracting an identifier from the acquired computer program.

Here, when an attacker uses a character string that cannot be interpreted as a natural language as an identifier used in the source code, one of the most frequently used techniques is a set of specific characters, typically alphanumeric characters. There is a technique to select multiple characters at random from . In the present embodiment, an unreadable identifier obtained by such a method is called an "obfuscated identifier". When obfuscated identifiers are compared with identifiers used in normal software development, each character included in the identifier and the corresponding character segment tend to be different. Using this difference in tendency, an index value indicating the difficulty of interpreting an identifier as a natural language is called an "obfuscation rate." In the present embodiment, when explaining the obfuscated identifier, it is assumed that the character string "f2LPi7RZhv" is extracted as the identifier of the target computer program.

The obfuscation rate generator 1105 has a function of generating an obfuscation rate based on the extracted identifier.

The reliability determination unit 1107 has a function of determining the reliability of the computer program based on the generated obfuscation rate.

(1-2. Computer Programmability Determination Control Processing)
Next, computer program reliability determination processing in the computer program reliability determination system 100 will be described in detail with reference to the drawings. FIG. 2 is a flowchart showing an example of computer program reliability determination processing in the computer program reliability determination system 100. As shown in FIG.

(1-2-1. Acquisition of computer program)
First, the acquisition unit 1101 of the control unit 110 acquires a computer program whose reliability is to be determined (S110). In this embodiment, the computer program is input by the user or obtained from a database for a computer program reliability determination program stored in the storage unit 120 .

(1-2-2. Identifier extraction)
Next, the identifier extraction unit 1103 of the control unit 110 extracts the identifier 1202 included in the acquired computer program (S120). In this embodiment, if the target computer program is written in a script language, the identifier 1202 can be extracted by classifying tokens included in the source code into operators, identifiers, and the like by parsing. For example, in VBA, a variable is declared by appending an identifier to a Dim statement, so the identifier 1202 can be extracted by searching for the Dim statement in the source code. In this example, the character string "f2LPi7RZhv" is extracted as the identifier of the target computer program.

(1-2-3. Generation of obfuscation rate)
Next, the obfuscation rate generation unit 1105 of the control unit 110 generates an obfuscation rate for the identifier (S130). The method of generating the obfuscation rate is described in detail below.

FIG. 3 is a process flow S130 for generating an obfuscation rate. As shown in FIG. 3, the obfuscation rate generator 1105 generates a section mismatch rate (also referred to as first mismatch rate information) (S131), generates a reference section mismatch rate (also referred to as second mismatch rate information) (S133 ), and generating an obfuscation rate (S135). Note that the generation of the reference classification mismatch information may be performed prior to the generation of the classification mismatch, or may be performed in advance.

(1-2-3-1. Generation of segment mismatch rate)
4 to 7 are an example of the processing flow S131 for generating segment mismatch rates. A segment mismatch rate is a value associated with an arbitrary identifier and is calculated based on the character segments and the characters that make up the identifier. As shown in FIGS. 4 and 5, first, the identifier, which is a character string, is divided into partial character strings (S1311). In this embodiment, the identifier 1202 is divided into adjacent two-character substrings 1202a to obtain a set 1202ag composed of the divided substrings. Specifically, as shown in FIG. 5, the character string “f2LPi7RZhv”, which is the identifier 1202, is replaced by subcharacter strings 1202a “f2”, “2L”, “LP”, “Pi”, “i7”, “7R”. , “RZ”, “Zh”, and “hv”.

Next, as shown in FIGS. 4 and 6, the partial character strings are segmented according to character segmentation (S1313). The data structure of character segment 1203 is shown in FIG. In this example, character segments 1203 include a first character segment 1203-1 consisting of lowercase alphabetic characters, a second character segment 1203-2 consisting of uppercase alphabetic characters, and a third character segment 1203-3 consisting of digits. Substrings 1202a-1 to 1202a-9 included in substring set 1202ag are divided into corresponding character segments. Specifically, in the case of the partial character string 1202a-1 "f2", "f" is segmented into the first character segment "lowercase letters", and "2" is segmented into the third character segment "numeric". are compartmentalized into This produces a segmented substring 1202b-1. Substrings 1202a-2 to 1202a-9 are also segmented in the same manner.

Next, as shown in FIGS. 4 and 7, in the segmented partial character strings 1202b-1 to 1202b-9, comparison is made to see if the character segments of adjacent characters match (S1315). If the segmented substring consists of different character segments, such as "lowercase alphabetic" and "numeric", the segmented substring is determined to be "mismatched". If the segmented substring consists of the same character segments, such as "alphabetic uppercase" and "alphabetic uppercase", the segmented substring is determined to be "matched". According to this method, as shown in FIG. 7, the results of comparison and determination of the segmented partial character strings are determination results 1202c-1 to 1202c-9.

Finally, as shown in FIGS. 4 and 7, a segment matching rate (first non-matching rate) D is calculated based on the obtained determination results 1202c-1 to 1202c-9 (S1317). In this case, the division mismatch rate D=6/9=0.666.

文字区分全体を「Ｃ」とする。
「Ｃ」を構成する文字区分の数を「ｍ」とする。
「Ｃ」のｉ番目の文字区分を「Ｃ_ｉ」とする。

文字Ｓ_ｉと対応する文字区分を「ｆ（Ｓ_ｉ）」とする。
「Ｓ」を、隣接する２文字の文字列に分割し、分割された部分文字列から構成される集合をＰとする。

Ｐのｉ番目の文字の組をＰ_ｉとする。このとき、

である。
文字の組Ｐ_ｉのうち、１番目の要素をＰ_ｉ´，２番目の要素をＰ_ｉｉ´とする。
このとき、以下の関数ｇが用いられる。

このとき、区分不一致率Ｄは数式１のように生成される。

If the classification mismatch rate is more generalized, it is obtained as follows.
Let the number of characters constituting the character string S be “n”.
Let the i-th character of "S" be "S _i ".

Let the entire character segment be "C".
Let "m" be the number of character segments that make up "C".
Let the i-th character segment of "C" be "C _i ".

Let the character segment corresponding to the character S _i be “f(S _i )”.
Let "S" be divided into strings of two adjacent characters, and let P be a set composed of the divided substrings.

Let P _i be the i-th character set of P. At this time,

is.
Let P _{i '} be the first element of the character set P _i and P _ii ' be the second element.
At this time, the following function g is used.

At this time, the segment mismatch rate D is generated as shown in Equation 1.

(1-2-3-2. Generation of reference segment mismatch rate information)
Generation of the reference section mismatch rate information (second mismatch rate information) shown in FIG. 8 will be described. First, a naming rule corresponding to a plurality of identifiers (also referred to as a stored identifier group) pre-stored in storage unit 120 is set (S1331). Each identifier included in the stored identifier group is restricted to obfuscated identifiers. To set the naming convention, a matching set of characters is selected from a preconfigured data structure. FIG. 9 is an example of a character set data structure 900 . Character set data structure 900 includes classification number 901 and character set classification 903 . FIG. 9 shows classification 1 (a set of characters consisting of lowercase letters), classification 2 (a set of characters consisting of uppercase letters), classification 3 (a set of characters consisting of numbers), and classification 4 (a set of letters). Category 5 (set of characters consisting of uppercase letters and numbers), Category 6 (set of characters consisting of numbers and lowercase letters), Category 7 (lowercase letters)・A set of characters consisting of uppercase letters and numbers) is included. For example, as the classification of the character set corresponding to the stored identifier group, "class 7, character set consisting of lower case alphabetic characters, upper case alphabetic characters and numerals" is set.

Next, the appearance frequency of each character used in the set of characters set above is obtained. FIG. 10 is an example of a data structure of naming rules. The character frequency data structure 910 includes a number 911, a set of characters 913, and an instance 915 of the generated identifier. All of the nomenclature rules contained in FIG. 10 randomly select characters from the corresponding set of characters 913 to generate obfuscation identifiers. At this time, for example, based on the information that the classification of the character set corresponding to the stored identifier group is "class 7, a set of characters consisting of lowercase alphabetic characters, uppercase alphabetic characters, and numbers", a naming rule corresponding to the stored identifier group Naming rule 7 is chosen as . The naming rule selected in this embodiment is called an "obfuscated naming rule".

Next, based on the obfuscated naming rule selected above, a reference classification mismatch rate (second mismatch rate) D' is generated (S1333). The reference segment mismatch rate D' refers to the convergence value of the segment mismatch rate corresponding to the identifiers included in the stored identifier group. For identifiers that conform to the obfuscated naming conventions described above, for any adjacent characters S _i and S _(i+1) , the character division f(S _i ) of S _i and the character division f(S _(i+1) ) of S _(i+1) , the standard segment mismatch rate D' is obtained. Here, there are 26 types of lowercase letters, 26 types of uppercase letters, and 10 types of numerals.

となる。
Ｓ_ｉの文字区分が英字大文字である確率は

となる。
Ｓ_ｉの文字区分が数字である確率は

となる。
Ｓ_ｉの文字区分が英字小文字であり、かつＳ_{（ｉ＋１）}の文字区分が英字小文字以外になる確率は

となる。
Ｓ_ｉの文字区分が英字大文字であり、かつＳ_{（ｉ＋１）}の文字区分が英字大文字以外になる確率は

となる。
Ｓ_ｉの文字区分が数字であり、かつＳ_{（ｉ＋１）}の文字区分が数字以外になる確率は

となる。
Ｓ_ｉの文字区分とＳ_{（ｉ＋１）}の文字区分が不一致となる確率は

となる。
以上より、難読命名規則に準拠した識別子における基準区分不一致率（第２不一致率）Ｄ´は以下となる。

The probability that the character division of S _i is a lowercase letter is

becomes.
The probability that the character division of S _i is a capital letter is

becomes.
The probability that the character division of S _i is a number is

becomes.
The probability that the character division of S _i is a lowercase alphabetic character and that the character division of S _(i+1) is other than a lowercase alphabetic character is

becomes.
The probability that the character division of S _i is an uppercase alphabetic character and that the character division of S _(i+1) is not an uppercase alphabetic character is

becomes.
The probability that the character classification of S _i is numeric and the character classification of S _(i+1) is non-numeric is

becomes.
The probability that the character division of S _i and the character division of S _(i+1) do not match is

becomes.
Based on the above, the standard classification mismatch rate (second mismatch rate) D' for identifiers conforming to the obfuscated naming rule is as follows.

数式２において、「ａｂｓ」は入力の絶対値を返す関数である。この式で定義される難読化率「Ｒ」は、対象の識別子の可読性が低いと「１」に近づき（難読化率が高く）、対象の識別子の可読性が高まるほど「０」に近づく（難読化率が低い）。また、難読化率「Ｒ」として他の式を用いてもよい。 (1-2-3-3. Generation of obfuscation rate)
Returning to FIG. 3, the obfuscation rate R is generated (S135). In this embodiment, the obfuscation rate R is defined by an arbitrary formula using the segment mismatch rate D and the reference segment mismatch rate D'. When calculating the obfuscation rate corresponding to each of the identifiers, for example, Equation 2 below is used.

In Equation 2, "abs" is a function that returns the absolute value of the input. The obfuscation rate “R” defined by this formula approaches “1” when the readability of the target identifier is low (high obfuscation rate), and approaches “0” as the readability of the target identifier increases (obfuscation conversion rate is low). Other formulas may also be used for the obfuscation rate "R".

Here, in order to verify the obfuscation rate, (1) the obfuscation rate when the readable identifier is extracted as the identifier, and (2) the obfuscation rate when the obfuscation identifier is extracted will be described.

(1-2-3-4. Obfuscation rate when readable identifier is extracted)
Human readable identifiers are generated based on naming conventions used in normal software development. FIG. 11 is an example of a human readable naming convention data structure 920 . As shown in FIG. 11, the human readable naming convention data structure includes a number 921, a human readable naming convention name 923, an identifier configuration 925, and a human readable identifier instance 927 to be generated. Human readable naming rule 1 (Upper Camel Case) is a naming rule in which the first letter of each word is capitalized and the other alphabetic characters are capitalized. Human readable naming rule 2 (Lower Camel Case) is a naming rule in which the first letter of each word is capitalized and the other alphabetic characters are capitalized. However, it is a naming rule that only the initial letter of the whole is lowercase. Human readable naming rule 3 (Upper Snake Case) is a naming rule in which words are separated by underscores (_) and other alphabetic characters are capitalized. Human readable naming rule 4 (Lower Snake Case) is a naming rule in which words are separated by underscores (_) and other alphabetic characters are in lower case. Human readable naming rule 5 (Upper Case) is a naming rule in which all alphabetic characters are capitalized and word breaks are not changed. Human readable naming rule 6 (Lower Case) is a naming rule in which all alphabetic characters are lower case and no word separators are changed.

In the case of readable identifiers conforming to readable naming rule 3 (Upper Snake Case) and readable naming rule 5 (Upper Case), all alphabetic characters are expressed as uppercase alphabetic characters, so the segment mismatch rate D tends to be relatively low. In addition, in the case of human readable identifiers conforming to human readable naming rule 4 (Lower Snake Case) and human readable naming rule 6 (Lower Case), since all alphabetic characters are expressed as lower case alphabetic characters, the classification mismatch rate D is relatively low as well. There is a tendency. In addition, in the case of human readable identifiers conforming to human readable naming rule 1 (Upper Camel Case) and human readable naming rule 2 (Lower Camel Case), at least the second letter from the beginning of each word is all represented as lower case letters. , and similarly the segment mismatch rate D tends to be relatively low. From the above, it can be said that the classification mismatch rate D tends to be relatively low in readable identifiers conforming to any of the readable naming conventions used in normal software development. As the segment mismatch rate D decreases, the difference from the standard segment mismatch rate D' based on the obfuscated naming rule increases. Therefore, it can be said that a readable identifier conforming to any of the readable naming conventions used in normal software development exhibits a low obfuscation rate (a value close to "0") in Equation 2.

(1-2-3-5. Obfuscation rate when obfuscated identifier is extracted)
Obfuscated identifiers are generated based on the obfuscated naming conventions described above. For obfuscated identifiers, at any point in the generated string, each character has an equal probability of being selected. For this reason, obfuscated identifiers do not necessarily have a fixed number of consecutive lowercase or uppercase alphabetic characters, and it can be said that the classification mismatch rate of obfuscated identifiers tends to be relatively high. As the segment mismatch rate D increases, the difference from the standard segment mismatch rate D' based on the obfuscated naming rule becomes smaller. Therefore, in the case of an obfuscated identifier, it can be said that Equation 2 exhibits a high obfuscation rate (a value close to "1").

(1-2-4. Reliability determination)
Returning to FIG. 2, the reliability determination unit 1107 of the control unit 110 determines the reliability of the computer program using the calculated obfuscation rate (S140). FIG. 12 is an example of a processing flow S140 for determining reliability. As shown in FIG. 12, first, the generated obfuscation rate is compared with a preset first threshold (S141). The first threshold can be appropriately set according to the identifier. At this time, if the obfuscation rate exceeds the first threshold (S145; Yes), reliability information 1 indicating that the computer program is highly reliable is generated (S147). On the other hand, if the obfuscation rate does not exceed the first threshold (S145; No), reliability information 2 is generated indicating that the computer program has low reliability (S149). The above completes the computer program reliability determination processing method.

Therefore, by using the present embodiment, any identifier included in the computer program can be used to determine the reliability of the computer program. In this case, the reliability of the computer program can be accurately determined without depending on specific patterns or behaviors contained in the computer program.

Note that the control unit 110 may perform processing such as stopping, deleting, or quarantining a computer program that has been determined to have low reliability. Alternatively, information on the computer program determined to be unreliable may be displayed on the display unit 131 .

<Second embodiment>
In this embodiment, a computer program reliability determination method different from that in the first embodiment will be described. Specifically, a method of determining reliability using a representative obfuscation rate corresponding to a plurality of identifiers will be described. Note that the method of extracting a plurality of identifiers and the method of generating an obfuscation rate for each of the plurality of identifiers are the same as those in the first embodiment, so description thereof will be omitted.

FIG. 13 is an example of a processing flow S140A for determining reliability. As shown in FIG. 13, in this embodiment, a representative value may be calculated from the obfuscation rate corresponding to each of a plurality of identifiers (S142). Representative values in this case include, for example, mean values or median values. Next, the representative value of the obfuscation rate is compared with the threshold value (S144). At this time, if the representative value of the obfuscation rate exceeds the first threshold (S145A; Yes), reliability information 1 is generated indicating that the computer program is highly reliable (S147). On the other hand, if the representative value of the obfuscation rate does not exceed the first threshold (S145A; No), reliability information 2 is generated indicating that the reliability of the computer program is low (S149).

By using this embodiment, the reliability of a computer program can be determined using a plurality of identifiers included in the computer program. This allows a more accurate determination of the trustworthiness of the computer program.

In this embodiment, the average value or the median value is used as the representative value, but the present invention is not limited to this. A maximum value or a minimum value may be appropriately set for the representative value.

<Third Embodiment>
In this embodiment, a computer program reliability determination method different from that in the first embodiment will be described. Specifically, a method of determining reliability using obfuscation rates corresponding to a plurality of identifiers will be described.

FIG. 14 is an example of a processing flow S140B for determining reliability. As shown in FIG. 14, the obfuscation rate corresponding to each of the plurality of identifiers is compared with a preset first threshold (S141). Next, out of all the obfuscation rates, the ratio of obfuscation rates exceeding the first threshold is calculated (S143). Next, the reliability of the computer program is calculated based on the above ratio (S146). At this time, if the ratio exceeds the second threshold (S146; Yes), reliability information 1 indicating that the computer program is highly reliable is generated (S147). On the other hand, if the ratio does not exceed the second threshold (S146; No), reliability information 2 is generated indicating that the reliability of the computer program is low (S149).

By using this embodiment, the reliability of a computer program can be determined using a plurality of identifiers included in the computer program. This allows a more accurate determination of the trustworthiness of the computer program.

(Modification)
Within the scope of the idea of the present invention, those skilled in the art can come up with various modifications and modifications, and it is understood that these modifications and modifications also belong to the scope of the present invention. For example, those skilled in the art appropriately added, deleted, or changed the design of components, or added, omitted, or changed the conditions of the above-described embodiments, and the configuration of each embodiment. Combinations are also included in the scope of the present invention as long as they have the gist of the present invention.

ここで、「ｈ」は代表値を返す任意の関数である。典型的には、「ｈ」として平均値や中央値等を返す関数を使用する。また、Ｄ_１，Ｄ_２，・・・，Ｄ_Ｎ－１，Ｄ_Ｎは、Ｎ個の識別子の各々と対応する区分不一致率である。 Although the first embodiment of the present invention shows an example of generating one obfuscation rate from one identifier, the present invention is not limited to this. A single obfuscation rate may be generated from multiple identifiers. When calculating one obfuscation rate corresponding to a set of identifiers, for example, Equation 3 may be used.

where 'h' is an arbitrary function that returns a representative value. Typically, we use a function that returns the mean, median, etc. as 'h'. D ₁ , D ₂ , . . . , D _N−1 , D _N are the discriminant mismatch rates corresponding to each of the N identifiers.

In addition, in the first embodiment of the present invention, an example of determining whether the reliability of the computer program is high or low is determined by whether the obfuscation rate exceeds the threshold information, but the present invention is not limited to this. . Further, reliability may be determined according to the difference between the obfuscation rate and the first threshold information. In this case, if the difference between the obfuscation rate and the first threshold information is large, it may be determined that the reliability of the computer program is higher. This makes it possible to determine the reliability of the computer program more accurately.

Also, in the first embodiment of the present invention, an example in which the computer program reliability determination system 100 is implemented in one terminal has been described, but the present invention is not limited to this. For example, the computer program trustworthiness determination system may be networked using a plurality of terminals, clients or servers.

Also, in the second and third embodiments of the present invention, an example using a plurality of identifiers has been shown, but reliability may be determined based on the number of acquired identifiers. For example, if the number of identifiers obtained from a computer program is less than or equal to a predetermined threshold, the program's credibility may be determined to a certain numerical or character degree.

DESCRIPTION OF SYMBOLS 100... Computer program reliability determination system, 110... Control part, 120... Storage part, 130... User interface part, 131... Display part, 133... Operation part, 900... Data structure 901 Classification number 903 Set classification 910 Data structure 911 Number 913 Set of characters 915 Concrete example 920 Data structure 921 Number 923 Rule name 925 Structure of identifier 927 Concrete example 1101 Acquisition unit 1103 Identifier extraction unit 1105 Obfuscation rate generation unit 1107 Reliability determination unit 1201 Computer program 1202 Identifier 1202a Substring 1202ag Set 1203 Character division 1203 -1 First character division 1203-2 Second character division 1203-3 Third character division 1205 Naming rule 1207 Threshold

Claims (15)

an acquisition unit for acquiring a computer program;
an extraction unit for extracting at least one identifier from the obtained computer program;
an obfuscation rate generator that generates at least one obfuscation rate based on the extracted at least one identifier;
a reliability determination unit that determines the reliability of the computer program based on the generated at least one obfuscation rate ;
The obfuscation rate generator,
dividing the identifier into substrings containing a plurality of characters, calculating first mismatch rate information based on a set of the divided substrings and a preset character division;
setting one rule out of a plurality of pre-stored rules, calculating second mismatch rate information based on the set rule;
generating the obfuscation rate using the first mismatch rate information and the second mismatch rate information;
A computer program reliability determination system. The obfuscation rate generation unit segments the divided partial character string based on the character segmentation, compares the character segmentation of adjacent characters in the segmented partial character string, and generates the first mismatch rate information. to calculate
The computer program reliability determination system according to claim 1 . The obfuscation rate generation unit sets the rule according to a set of characters constituting the identifier and the appearance frequency of each character in the set of characters,
The obfuscation rate is high when the identifier is likely to be generated by a rule that satisfies a predetermined condition.
The computer program reliability determination system according to claim 1 . the at least one identifier comprises a plurality of identifiers;
The reliability determination unit calculates a representative value of an obfuscation rate corresponding to each of the plurality of identifiers, and the computer program based on the relationship between the calculated representative value and a preset first threshold determining the reliability of
4. The computer program reliability determination system according to any one of claims 1 to 3 . the at least one identifier comprises a plurality of identifiers;
The reliability determination unit determines the ratio of identifiers having an obfuscation rate exceeding a preset first threshold among the plurality of identifiers and the relationship between a preset second threshold and the computer program. determine reliability,
4. The computer program reliability determination system according to any one of claims 1 to 3 . The reliability determination unit determines the reliability of the computer program based on a difference between the obfuscation rate and a preset first threshold.
4. The computer program reliability determination system according to any one of claims 1 to 3 . The reliability determination unit determines the reliability of the computer program based on the number of identifiers.
The computer program reliability determination system according to any one of claims 1 to 6 . The control part of the computer
obtaining a computer program entered by a user or stored in a storage unit ;
extracting at least one identifier from the obtained computer program;
generating at least one obfuscation rate based on the extracted at least one identifier;
determining the trustworthiness of the computer program based on the generated obfuscation rate ;
The control unit divides the identifier into partial character strings containing a plurality of characters, calculates first mismatch rate information based on a set of the divided partial character strings and a preset character classification,
setting one rule out of a plurality of rules stored in advance in the storage unit, calculating second mismatch rate information based on the set rule;
generating the obfuscation rate using the first mismatch rate information and the second mismatch rate information;
Computer program reliability determination method. segmenting the divided partial character string based on the character segmentation, and comparing character segmentation of adjacent characters in the segmented partial character string to calculate the first mismatch rate information;
9. The computer program reliability determination method according to claim 8 . setting the rule according to a set of characters that make up the identifier and the appearance frequency of each character in the set of characters;
The obfuscation rate is high when the identifier is likely to be generated by a rule that satisfies a predetermined condition.
9. The computer program reliability determination method according to claim 8 . the at least one identifier comprises a plurality of identifiers;
calculating a representative value of the obfuscation rate corresponding to each of the plurality of identifiers, and determining the reliability of the computer program based on the relationship between the calculated representative value and a preset first threshold ,
11. The computer program reliability determination method according to any one of claims 8 to 10 . the at least one identifier comprises a plurality of identifiers;
Determining the reliability of the computer program based on whether a ratio of identifiers having an obfuscation rate exceeding a preset first threshold among the plurality of identifiers exceeds a preset second threshold;
11. The computer program reliability determination method according to any one of claims 8 to 10 . Determining the reliability of the computer program based on the difference between the obfuscation rate and a preset first threshold;
11. The computer program reliability determination method according to any one of claims 8 to 10 . determining the trustworthiness of the computer program based on the number of identifiers;
14. The computer program reliability determination method according to any one of claims 8 to 13 . to the computer,
get a computer program
extracting at least one identifier from the obtained computer program;
generating at least one obfuscation rate based on the extracted at least one identifier;
causing determining the trustworthiness of the computer program based on the generated obfuscation rate ;
dividing the identifier into substrings containing a plurality of characters, calculating first mismatch rate information based on a set of the divided substrings and a preset character division;
setting one rule out of a plurality of pre-stored rules, calculating second mismatch rate information based on the set rule;
generating the obfuscation rate using the first mismatch rate information and the second mismatch rate information;
Computer program reliability determination program.

Images