WO2015114804A1 - Méthode de détection d'accès non autorisé et système de détection - Google Patents

Méthode de détection d'accès non autorisé et système de détection Download PDF

Info

Publication number
WO2015114804A1
WO2015114804A1 PCT/JP2014/052288 JP2014052288W WO2015114804A1 WO 2015114804 A1 WO2015114804 A1 WO 2015114804A1 JP 2014052288 W JP2014052288 W JP 2014052288W WO 2015114804 A1 WO2015114804 A1 WO 2015114804A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
malware
url
feature amount
regular expression
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/JP2014/052288
Other languages
English (en)
Japanese (ja)
Inventor
進 芹田
雅之 吉野
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hitachi Ltd
Original Assignee
Hitachi Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hitachi Ltd filed Critical Hitachi Ltd
Priority to PCT/JP2014/052288 priority Critical patent/WO2015114804A1/fr
Priority to JP2015559696A priority patent/JP6039826B2/ja
Publication of WO2015114804A1 publication Critical patent/WO2015114804A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures

Definitions

  • the present invention relates to technology for detecting unauthorized network access performed by malware-infected computers.
  • the URL blacklist is a list of URLs (called malignant URLs) used for accessing known malware.
  • a security device such as a firewall, IDS / IPS, or proxy server.
  • Such a technique is generally called web filtering.
  • the attacker intentionally changes the URL with which the malware communicates in order to escape detection by the blacklist. For example, a technique of incorporating a random number into a part of a URL is known. In addition, an attacker may reuse existing malware for attacks.
  • Patent Document 1 discloses a method for generating a URL regular expression from a plurality of URL samples that are candidates for regular expression generation based on frequency information of character strings.
  • Patent Document 1 it is possible to detect a changed malicious URL.
  • the method of Patent Document 1 since the method of Patent Document 1 generates a regular expression based on frequency information of character strings appearing in the sample, it requires a certain number of URL samples. When the number of samples is small, a URL regular expression effective for detection cannot be generated.
  • the present invention has been made in consideration of the above problems, and an object of the present invention is to generate a URL regular expression effective for detection and detect unauthorized access even when there are few URL samples from which a regular expression is based.
  • the present invention analyzes an unauthorized access detection method that generates a URL regular expression for detecting unauthorized access from a trace of malware access behavior obtained from a malware analysis result and updates a detection rule. That extract malware features from trace analysis of access behavior of new malware collected by a user or infected from the network, and access that is recorded by extracting access features from past access logs on the network Searching a similar URL satisfying a distance within a predetermined threshold from a feature amount storage unit using a malware feature amount as a query, and generating a URL regular expression from the connection destination URL of the malware feature amount and the searched similar URL And accessing the URL regular expression with the step Applying the pattern matching with the connection destination URL included in the group, calculating the matching rate, and setting the URL regular expression to a new detection rule when the matching rate satisfies a recommended value or less; A method for detecting unauthorized access is proposed.
  • the step of searching the access feature amount storage unit for a similar URL satisfying a distance within a predetermined threshold using a malware feature amount as a query When the distance function value defined between the feature amount other than the connection destination URL of the malware feature amount and the feature amount other than the connection destination URL of the corresponding access feature amount is smaller than a predetermined threshold, The distance function value of the difference between character strings defined between the first step of determining and the connection destination URL of the malware feature amount and the connection destination URL included in the similar access feature amount is smaller than a predetermined threshold value. In this case, it is characterized by comprising the second step of searching for a similar URL.
  • an unauthorized access detection system configured on a plurality of servers connected to a network connected to the Internet is used to virtually detect new malware that has infected or collected clients.
  • a malware analysis function that generates a trace of malware access behavior by executing it in a test environment, a malware feature extraction function that extracts malware features from the trace of malware access behavior, and a client's past access log
  • An access feature value extraction function that appropriately manages and extracts an access feature value from an access log and stores it in an access feature value storage unit, and a malware feature value as a query from the access feature value storage unit within a predetermined threshold
  • a similar URL search function for searching for similar URLs that satisfy a distance;
  • a URL regular expression is generated from the connection destination URL of the malware feature amount and the searched similar URL, and the URL regular expression is applied to pattern matching with the connection destination URL included in the access log, and the matching rate is calculated.
  • a regular expression generation function for adding the URL regular expression to a new detection rule, and a detection rule updated by adding the URL regular expression are updated as URLs to be accessed.
  • a malicious URL detection function for judging whether or not unauthorized access is made.
  • an effective URL regular expression can be generated and unauthorized access can be detected even if there are a small number of unauthorized URL samples.
  • FIG. 1 is a diagram illustrating an example of a system configuration of an unauthorized access detection system 100 according to the present embodiment.
  • this system includes a proxy server 121, a log management server 122, a malware analysis server 123, and a detection rule setting server 124, and each device is configured to be connected to each other via a network 101.
  • the unauthorized access detection system 100 is connected together with a plurality of clients 125 to a local area network 120 installed in a certain organization.
  • the local area network 120 is connected to the Internet 110 via the firewall 130 and the network 101.
  • the attacker server 111 on the Internet 110 is a server used by an attacker who attacks the organization connected to the network. When the attacker succeeds in infiltrating the malware into the organization, the attacker uses the attacker server 111 to communicate with the malware infected with the client 125 of the organization. As a result, new malware is transmitted and files acquired from within the organization are received.
  • a plurality of attacker servers 111 are installed on the Internet 110.
  • the firewall 130 has a function of discarding (blocking) or permitting (passing) a packet that meets a specific condition from among packets traveling between the local area network 120 and the Internet 110. In particular, by discarding packets that do not pass through the proxy server 121, all accesses from the local area network 120 to the Internet 110 can be performed through the proxy server 121.
  • the proxy server 121 relays packet exchange between the client 125 and a server on the Internet. By registering a malicious URL in the proxy server 121, unauthorized access can be detected. When unauthorized access is detected, communication with the attacker can be blocked by canceling access.
  • the proxy server 121 has a function of recording all the history of accesses performed by the client 125. This record is called an access log. Details of the processing of the proxy server 121 will be described with reference to FIG.
  • the log management server 122 has a function of storing an access log output by the proxy server 121 and searching for a URL used for generating a regular expression URL. Details of the processing of the log management server 122 will be described with reference to FIG.
  • the malware analysis server 123 has a function of executing malware in a virtual environment and recording network access behavior.
  • the malware analysis server 123 is connected to the local area network, but may be connected to the Internet 110. Details of the processing of the malware analysis server 123 will be described with reference to FIG.
  • the detection rule setting server 124 uses the feature amount extracted from the data recorded by the malware analysis server 123 to record the network access behavior of the malware, and the URL regular expression using the feature amount extracted from the access log of the log management server 122. The function to generate. Furthermore, a function of setting the generated URL regular expression as a detection rule in the proxy server 121 is provided.
  • the client 125 has a function of accessing the Internet 110 via the network 101.
  • the client 125 may be infected with malware by executing an executable file attached to the forged mail.
  • the client 125 infected with malware communicates with an attacker without being noticed by a legitimate user.
  • each of these devices connected to the network includes at least a main storage device such as a CPU (Central Processing Unit), an auxiliary storage device such as a hard disk drive, a ROM (Read Only Memory), a RAM (Random Access Memory), An input device such as a keyboard and a mouse, an I (Input) / O (Output) interface connected to an output device such as a display, a network interface for connecting to the local area network 120 and the Internet 110 are provided.
  • a main storage device such as a CPU (Central Processing Unit), an auxiliary storage device such as a hard disk drive, a ROM (Read Only Memory), a RAM (Random Access Memory),
  • An input device such as a keyboard and a mouse, an I (Input) / O (Output) interface connected to an output device such as a display, a network interface for connecting to the local area network 120 and the Internet 110 are provided.
  • a main storage device such as a CPU (Central Processing Unit)
  • auxiliary storage device such as a hard disk drive
  • the malware analysis server 123 includes a malware analysis function 231.
  • the malware analysis function 231 executes malware on the malware analysis server 123 in a virtual test environment, and records file generation, registry change, access behavior via the network, and the like performed by the malware.
  • the present invention uses a record of access via a network.
  • access record accesses made by malware are recorded in chronological order.
  • Each access record includes the access time and the transmitted packet.
  • information such as a connection destination URL, a connection destination IP address, a connection destination port, a transmission source port, a protocol, and a User-Agent can be acquired.
  • Such a malware analysis function 231 can be realized by a technique generally called dynamic analysis.
  • the existing dynamic analysis technology is installed in the malware analysis server 123, the malware is executed by a debugger or an emulator, and a trace of the malware control flow is recorded.
  • malware analysis server 123 There are two main methods for preparing malware in the malware analysis server 123.
  • One is a method of manually copying (malware specimen) malware found on a computer (client 125) different from the malware analysis server 123 to the malware analysis server 123.
  • the other is a method in which the malware analysis server 123 is installed in a place where an attacker can easily aim (for example, installed on the network 101 outside the firewall 130 where access is easy from the outside), and infecting with malware. .
  • This method is generally called a honeypot.
  • the detection rule setting server 124 includes a malware feature amount 300 extraction function 241, a regular expression generation function 242, a detection rule management information storage unit 243, a detection rule setting function 244, and the like.
  • the malware feature quantity 300 extraction function 241 extracts information used for generating a URL regular expression from the analysis result of the malware output by the malware analysis function 231 (the time series of accesses made by the malware). Details of the malware feature 300 will be described with reference to FIG. 3, and details of the processing will be described with reference to FIG.
  • the regular expression generation function 242 makes an inquiry to the log management server 122 based on the information output by the malware feature quantity 300 extraction function 241 and acquires a set of similar URLs for generating a URL regular expression.
  • a regular expression candidate is generated from the acquired set of similar URLs, and a URL regular expression 502 is generated using the access log 221.
  • the generated URL regular expression 502 is stored in the detection rule management information storage unit 243. Details of the processing of the regular expression generation function 242 will be described with reference to FIG.
  • the detection rule management information storage unit 243 includes a URL regular expression generated by the regular expression generation function 242 and information on a device to which the URL regular expression is applied. Details will be described with reference to FIG.
  • the detection rule setting function 244 has a function of setting the URL regular expression generated by the regular expression generation function 242 in the proxy server 121.
  • the log management server 122 includes an access log storage unit 221, an access feature amount extraction function 222, an access feature amount storage unit 223, a similar URL search function 224, and the like.
  • the access log storage unit 221 includes a record of the access log 213 output from the proxy server 121 over, for example, one year or more.
  • the access log storage unit 221 includes the date and time when the client 125 accessed, the IP address of the client 125 that accessed, the connection destination URL that accessed, the User-Agent used for the access, the referer, the size of the transmitted packet, Includes the size of the received packet.
  • a plurality of proxy servers 121 are installed for reasons such as load distribution. For this reason, the output access log is also divided into a plurality of files.
  • the log management server 122 merges and stores these divided logs.
  • the access feature amount extraction function 222 analyzes the access log 221 and calculates an access feature amount 223 for a series of accesses. Since it takes time to calculate an access feature amount from a large amount of access log data when necessary, the access feature amount 223 is appropriately calculated when the access log 221 is recorded.
  • the access feature amount storage unit 223 includes information necessary for searching for similar URLs. Details will be described with reference to FIG.
  • the similar URL search function 224 searches for a set of similar URLs necessary for the regular expression generation function 242 to generate a regular expression. Details of the processing will be described with reference to FIG.
  • the proxy server 121 includes a malicious URL detection function 211 and a detection rule storage unit 212.
  • the malicious URL detection function 211 compares whether or not the URL to be accessed by the client 125 matches a URL regular expression set in advance. If the URL matches, the malicious URL detection function 211 determines that the access is unauthorized and stops the access. Do.
  • the detection rule 212 includes a rule for the proxy server 121 to determine whether to permit or block access to the client 125.
  • a URL regular expression is one of the detection rules, but also includes a detection rule 212 based on a packet size, a protocol type, and the like. For example, if the URL of the other party on the Internet that the client 125 tries to access matches the URL regular expression and the packet size is 1 MB or more, a complex rule such as stopping access can be set.
  • malware feature quantity 300 extracted from the malware analysis result (time series of accesses made by malware) output by malware analysis function 231 by malware feature quantity extraction function 241 of detection rule setting server 124.
  • the malware feature amount 300 includes a malware ID 301, a connection destination URL list 302, an average packet size 303, an access time interval 304, a User-Agent 305, a Post count 306, and the like.
  • the malware ID 301 is an identifier for uniquely identifying malware. For example, a hash value such as MD5 is used as the malware ID 301.
  • the connection destination URL list 302 is a list of URLs accessed by malware analyzed by the malware analysis function 231. These are determined to be malicious URLs.
  • the average packet size 303 is an average size of packets transmitted by malware in a series of malware accesses.
  • the access time interval 304 is an amount representing a time pattern of access of a series of malware. For example, the average time of access intervals can be used. It may be possible to extract the periodicity of the access time as an amount representing a more advanced time pattern.
  • User-Agent is an identifier for specifying the program that has accessed.
  • the number of POSTs 306 is the number of times POST is performed by a series of malware accesses.
  • These malware feature amounts are features that characterize the behavior of malware, and an access having a feature amount similar to the malware feature amount is likely to be an access by malware.
  • the access feature amount 223 includes a session ID 401, an event ID list 402, a connection destination URL list 403, an average packet size 404, an access time interval 405, a User-Agent 406, a Post count 407, and the like.
  • the session ID 401 is an identifier for specifying an access having a series of connections made by the client 125.
  • the event ID list 402 is an identifier for specifying a list of events belonging to the session identified by the session ID. Here, the event refers to one access included in the access log storage unit 221.
  • the connection destination URL list 403 is a list in which URLs accessed by the client 125 during a session are recorded.
  • the average packet size 404 is an average size of packets transmitted by the client 125 during the session.
  • the access time interval 405 is an amount representing a time pattern of access of a series of malware. An amount similar to the access time of the malware feature amount 300 can be used.
  • User-Agent 406 is an identifier for identifying the program that has accessed.
  • the POST count 407 is the number of POST accesses transmitted by the client 125 during the session.
  • each event included in the access log storage unit 221 is classified for each client 125.
  • the client 125 is specified by the source IP included in the event and user authentication information.
  • the events classified by the client 125 are classified into sessions.
  • a predetermined threshold for example, 30 minutes
  • it is determined as another session.
  • an event with a different User-Agent is determined as another session.
  • the access log 125 is decomposed into a plurality of sessions.
  • the detection rule management information storage unit 243 includes a rule ID 501, a URL regular expression 502, a target device ID 503, a countermeasure 504, a setting date 505, and the like.
  • the rule ID 501 is an identifier for uniquely specifying the detection rule 243.
  • the URL regular expression 502 represents the connection destination URL for the proxy server 121 to determine the URL to be accessed by the client 125 as unauthorized access in regular expression.
  • the target device ID 503 is information for identifying a device to which the detection rule is applied. For example, the IP address of the proxy server 121 can be used.
  • the countermeasure 504 is the content of control performed by the malicious URL detection function 211 of the target device (proxy server) when the connection destination URL of the client 125 matches the URL regular expression. For example, it can be used as a countermeasure such as blocking communication or notifying the administrator.
  • the setting date represents the date and time when the detection rule is set. By using the set date, it is possible to operate such as deleting a rule that has passed for a certain period after setting.
  • step S601 the malware feature amount extraction function 241 reads the malware analysis result (the time series of accesses made by the malware) output by the malware analysis function 231.
  • the malware analysis result the time series of accesses made by the malware
  • the malware feature quantity extraction function 241 extracts the malware feature quantity 300 shown in FIG. 3 from the malware analysis result output by the malware analysis function 231.
  • the malware analysis result includes an OS API call and a network access log.
  • the malware feature 300 is used for searching the access log output by the proxy server 121. For this reason, information such as an API call of the OS that is not included in the access log is excluded and a log related to network access is selected. Thereafter, the selected log is analyzed, and information included in FIG. 3 is extracted.
  • the malware feature amount extraction function 241 excludes the duplicate malware feature amount 300.
  • the malware analysis function 231 analyzes a plurality of malware, a plurality of malware feature quantities 300 are extracted in step S602.
  • the malware hash values (malware ID 301) are different, there is a possibility that the same malware exists in the other malware feature amount 300. In that case, only one malware feature 300 is selected.
  • the malware feature amount extraction function 241 transmits the malware feature amount 300 from which duplication is excluded in step S603 to the regular expression generation function 242.
  • step S ⁇ b> 701 the regular expression generation function 242 acquires the malware feature quantity 300 output by the malware feature quantity extraction function 241.
  • the regular expression generation function 242 acquires the malware feature quantity 300 output by the malware feature quantity extraction function 241.
  • a plurality of malwares are analyzed, a plurality of malware feature quantities 300 are acquired.
  • step S ⁇ b> 702 the regular expression generation function 242 transmits the malware feature quantity 300 acquired in step S ⁇ b> 701 to the similar URL search function 224 of the log management server 122.
  • the similar URL search function 224 that has received the malware feature quantity 300 searches the access feature quantity storage unit 223 for a similar URL using the malware feature quantity 300 as a query.
  • the regular expression generation function 242 receives the similar URL transmitted by the similar URL search function 224.
  • step S704 the regular expression generation function 242 generates a URL regular expression from a set of similar URLs.
  • a method for generating a regular expression from a plurality of character strings the method described in Patent Document 1 is adopted.
  • a regular expression can be generated from a set of similar URLs.
  • a regular expression that expresses a plurality of general character strings including the above method is not uniquely determined. For example, http://www.sample.com/path[a-zA-Z] ⁇ 5,10 ⁇ .exe and http://www.sample.com/[a-zA-Z]*.exe Comparing two regular expressions, all URLs expressed in the former can be expressed in the latter.
  • step S ⁇ b> 705 the regular expression generation function 242 uses the access log 221 to check the regular expression granularity.
  • the URL regular expression generated in step S704 is applied to pattern matching with the URL of the access log 221 other than the similar URL received in step S703, and the matching rate is calculated.
  • a recommended value for example, 3%) of the matching rate is determined in advance. If the calculated match rate is larger than the recommended value, the regular expression granularity is too rough, and the corresponding regular expression generated in step S704 is discarded.
  • step S706 the regular expression generation function 242 detects only the URL regular expression whose matching rate with the URL of the access log 221 is equal to or less than the recommended value among the URL regular expressions whose granularity is confirmed in step S705. Save to 243.
  • the target device ID, countermeasure, set date, etc. are added to the URL regular expression.
  • a predetermined value may be registered, or an administrator who has confirmed the regular expression generation result may manually register the value.
  • step S801 the similar URL search function 224 receives the malware feature quantity 300 transmitted by the regular expression generation function 242.
  • step S ⁇ b> 802 the similar URL search function 224 searches the access feature amount stored in the access feature amount storage unit 223 using a feature amount other than the connection destination URL of the malware feature amount 300 as a search key,
  • the distance function d (Cm, Ca) (Equation 1) defined between the malware feature quantity Cm and the access feature quantity Ca is a weighting factor wf for each feature quantity in the absolute value of the corresponding feature quantity difference other than the connection destination URL. And use their linear sum as the distance.
  • a non-numerical feature quantity such as User-Agent uses a discrete distance of 0 if the values match and 1 if the values do not match.
  • the similar URL search function 224 acquires a connection destination URL included in the similar access feature amount (session) acquired in step S802.
  • the similar URL search function 224 acquires a connection destination URL similar to the connection destination URL included in the malware feature amount acquired in step S801 from the connection destination URLs acquired in step S803.
  • a distance function is defined for the connection destination URL included in the malware feature quantity and the connection destination URL included in the similar access feature quantity (session), and a pair whose distance is smaller than a preset threshold is similar. It is considered.
  • “edit distance (also called Levenshtein distance)” that makes a character string close can be used.
  • the edit distance (Levenstein distance) is a numerical value indicating how different two character strings are. Specifically, it is given as the minimum number of steps required to transform one character string into another character string by inserting, deleting, or replacing characters.
  • the similar URL search function 224 transmits the similar URL searched in step S804 to the regular expression generation function 242.
  • the unauthorized access detection system 100 allows the user to insert a malware copy (malware sample) into the malware analysis server 123, or the malware analysis server 123 is connected to the network.
  • a process for creating a new URL regular expression detection rule is started.
  • the malware analysis server 123 analyzes the access behavior of the input or infected malware, and accumulates access records.
  • the detection rule setting server 124 extracts the malware feature amount from the malware analysis result (the time series of the access performed by the malware), and the past access of the client 125 on the local area network managed by the log management server 122. Instruct to search similar access feature quantity from log.
  • the log management server 122 appropriately extracts and stores the access feature amount from the past access log, and the access feature amount similar to the connection destination URL included in the malware feature amount from the access feature amount similar to the malware feature amount.
  • the included connection destination URL is extracted and reported to the detection rule setting server 124 as a similar URL.
  • the detection rule setting server 124 creates a new URL regular expression based on the connection destination URL and the similar URL included in the malware feature, and determines whether or not the new URL regular expression is appropriate as the detection rule. Judgment is made by calculating the matching rate with the URL included in the access log.
  • a new URL regular expression is stored in the detection rule management information storage unit 243, and the URL regular expression is set in the detection rule storage unit 212 of the proxy server 121. , Used for the subsequent malicious URL detection function.
  • the unauthorized access detection system 100 is divided into a proxy server 121, a log management server 122, a malware analysis server 123, and a detection rule setting server 124.
  • a proxy server 121 an example in which any one of these servers is configured on the same server is also conceivable.
  • the proxy server 121 or the like is configured by distributed processing of a plurality of servers can be considered.
  • An example in which all servers are configured on the same server is also conceivable.
  • Unauthorized access detection system 101: Network 110: Internet 111: Attacker server 120: Local area network 121: Proxy server 122: Log management server 123: Malware analysis server 124: Detection rule setting server , 125: client, 130: firewall, 211: malicious URL detection function, 212: detection rule, 213: access log, 221: access log, 222: access feature amount extraction function, 233: access feature amount, 224: similar URL search Function, 231: malware analysis function, 241: malware feature extraction function, 242: regular expression generation function, 243: detection rule management information, 244: detection rule setting function, 300: malware feature

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Selon l'invention, les techniques existantes de détection d'accès au réseau non autorisé par des ordinateurs infectés par des logiciels malveillants ou similaires ne peuvent pas produire d'expressions rationnelles d'URL efficaces à partir de petits échantillons d'URL malveillantes. En fonction de quantités de caractéristiques pour des accès au réseau passés et d'URL malveillantes obtenues à partir de résultats d'analyse de logiciel malveillant, l'invention agrandit l'échantillon d'URL malveillantes en recherchant dans un journal d'accès des URL similaires auxdites URL malveillantes et produit une expression rationnelle d'URL. Ladite expression rationnelle d'URL est ajoutée à des règles de détection pour détecter un accès non autorisé.
PCT/JP2014/052288 2014-01-31 2014-01-31 Méthode de détection d'accès non autorisé et système de détection Ceased WO2015114804A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/JP2014/052288 WO2015114804A1 (fr) 2014-01-31 2014-01-31 Méthode de détection d'accès non autorisé et système de détection
JP2015559696A JP6039826B2 (ja) 2014-01-31 2014-01-31 不正アクセスの検知方法および検知システム

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2014/052288 WO2015114804A1 (fr) 2014-01-31 2014-01-31 Méthode de détection d'accès non autorisé et système de détection

Publications (1)

Publication Number Publication Date
WO2015114804A1 true WO2015114804A1 (fr) 2015-08-06

Family

ID=53756416

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2014/052288 Ceased WO2015114804A1 (fr) 2014-01-31 2014-01-31 Méthode de détection d'accès non autorisé et système de détection

Country Status (2)

Country Link
JP (1) JP6039826B2 (fr)
WO (1) WO2015114804A1 (fr)

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2017146670A (ja) * 2016-02-15 2017-08-24 Ｎｅｃプラットフォームズ株式会社 ルータ装置及びルータ装置のフィルタリング方法
JP2018132787A (ja) * 2017-02-13 2018-08-23 株式会社日立ソリューションズ ログ分析支援装置およびログ分析支援方法
JP2018525717A (ja) * 2016-01-12 2018-09-06 ▲騰▼▲訊▼科技（深▲セン▼）有限公司 探索処理方法およびデバイス
WO2018159337A1 (fr) * 2017-03-03 2018-09-07 日本電信電話株式会社 Dispositif de génération de profil, appareil de détection d'attaque, procédé de génération de profil et programme de génération de profil
JP2018142927A (ja) * 2017-02-28 2018-09-13 沖電気工業株式会社 マルウェア不正通信対処システム及び方法
JP2019047335A (ja) * 2017-09-01 2019-03-22 日本電信電話株式会社 検知装置、検知方法、および、検知プログラム
WO2019225251A1 (fr) * 2018-05-21 2019-11-28 日本電信電話株式会社 Méthode d'apprentissage, dispositif d'apprentissage et programme d'apprentissage
JPWO2021106172A1 (fr) * 2019-11-28 2021-06-03

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090265786A1 (en) * 2008-04-17 2009-10-22 Microsoft Corporation Automatic botnet spam signature generation
JP2012118713A (ja) * 2010-11-30 2012-06-21 Nippon Telegr & Teleph Corp <Ntt> リスト生成方法、リスト生成装置及びリスト生成プログラム

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CA2638205C (fr) * 2007-07-26 2015-06-16 Magna International Inc. Caisse de camion avec cadre structurel d'entreposage externe

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090265786A1 (en) * 2008-04-17 2009-10-22 Microsoft Corporation Automatic botnet spam signature generation
JP2012118713A (ja) * 2010-11-30 2012-06-21 Nippon Telegr & Teleph Corp <Ntt> リスト生成方法、リスト生成装置及びリスト生成プログラム

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
TAKEO HARIU: "Shinka suru Kyoi to Korekara no Cyber Security", NTT GIJUTSU JOURNAL, vol. 24, no. 8, 1 August 2012 (2012-08-01), pages 13 - 17 *

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2018525717A (ja) * 2016-01-12 2018-09-06 ▲騰▼▲訊▼科技（深▲セン▼）有限公司 探索処理方法およびデバイス
JP2017146670A (ja) * 2016-02-15 2017-08-24 Ｎｅｃプラットフォームズ株式会社 ルータ装置及びルータ装置のフィルタリング方法
JP2018132787A (ja) * 2017-02-13 2018-08-23 株式会社日立ソリューションズ ログ分析支援装置およびログ分析支援方法
JP2018142927A (ja) * 2017-02-28 2018-09-13 沖電気工業株式会社 マルウェア不正通信対処システム及び方法
JPWO2018159337A1 (ja) * 2017-03-03 2019-06-27 日本電信電話株式会社 プロファイル生成装置、攻撃検知装置、プロファイル生成方法、および、プロファイル生成プログラム
WO2018159337A1 (fr) * 2017-03-03 2018-09-07 日本電信電話株式会社 Dispositif de génération de profil, appareil de détection d'attaque, procédé de génération de profil et programme de génération de profil
US11470097B2 (en) 2017-03-03 2022-10-11 Nippon Telegraph And Telephone Corporation Profile generation device, attack detection device, profile generation method, and profile generation computer program
JP2019047335A (ja) * 2017-09-01 2019-03-22 日本電信電話株式会社 検知装置、検知方法、および、検知プログラム
WO2019225251A1 (fr) * 2018-05-21 2019-11-28 日本電信電話株式会社 Méthode d'apprentissage, dispositif d'apprentissage et programme d'apprentissage
JPWO2019225251A1 (ja) * 2018-05-21 2020-12-10 日本電信電話株式会社 学習方法、学習装置及び学習プログラム
JPWO2021106172A1 (fr) * 2019-11-28 2021-06-03
JP7315023B2 (ja) 2019-11-28 2023-07-26 日本電信電話株式会社 ルール生成装置およびルール生成プログラム
US12282550B2 (en) 2019-11-28 2025-04-22 Nippon Telegraph And Telephone Corporation Rule generating device and rule generating program

Also Published As

Publication number Publication date
JPWO2015114804A1 (ja) 2017-03-23
JP6039826B2 (ja) 2016-12-07

Similar Documents

Publication Publication Date Title
JP6039826B2 (ja) 不正アクセスの検知方法および検知システム
Song et al. Advanced evasion attacks and mitigations on practical ML‐based phishing website classifiers
US9300682B2 (en) Composite analysis of executable content across enterprise network
US9462009B1 (en) Detecting risky domains
CN107645503B (zh) 一种基于规则的恶意域名所属dga家族的检测方法
US11030311B1 (en) Detecting and protecting against computing breaches based on lateral movement of a computer file within an enterprise
US8375450B1 (en) Zero day malware scanner
US10516671B2 (en) Black list generating device, black list generating system, method of generating black list, and program of generating black list
Wang et al. Machine learning based cross-site scripting detection in online social network
CN105491053A (zh) 一种Web恶意代码检测方法及系统
KR101080953B1 (ko) 실시간 웹쉘 탐지 및 방어 시스템 및 방법
CN108156131A (zh) Webshell检测方法、电子设备和计算机存储介质
CN107547490B (zh) 一种扫描器识别方法、装置及系统
JP6717206B2 (ja) マルウェア対策装置、マルウェア対策システム、マルウェア対策方法、及び、マルウェア対策プログラム
CN108337269B (zh) 一种WebShell检测方法
Stock et al. Kizzle: A signature compiler for detecting exploit kits
US20170318037A1 (en) Distributed anomaly management
CN107209834A (zh) 恶意通信模式提取装置、恶意通信模式提取系统、恶意通信模式提取方法及恶意通信模式提取程序
Lamprakis et al. Unsupervised detection of APT C&C channels using web request graphs
JP5656266B2 (ja) ブラックリスト抽出装置、抽出方法および抽出プログラム
CN111183620B (zh) 入侵调查
Stock et al. Kizzle: A signature compiler for exploit kits
Munir et al. {PURL}: Safe and Effective Sanitization of Link Decoration
Wang et al. Improved N-gram approach for cross-site scripting detection in Online Social Network
US11321453B2 (en) Method and system for detecting and classifying malware based on families

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14880557

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2015559696

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14880557

Country of ref document: EP

Kind code of ref document: A1