WO2017068714A1

WO2017068714A1 - Illegal communication control apparatus and method

Info

Publication number: WO2017068714A1
Application number: PCT/JP2015/079966
Authority: WO
Inventors: 倫宏重本; 哲郎鬼頭; 磯部　義明; 仲小路　博史
Original assignee: 株式会社日立製作所
Priority date: 2015-10-23
Filing date: 2015-10-23
Publication date: 2017-04-27

Abstract

According to the present invention, communication by means of malware is cut off while permitting communication that affects a business by using user's feedback. The present invention is provided with: a storage unit that stores suspicious connection destinations as a gray list; an authentication unit that asks a user for connection confirmation when communication to a connection destination matching the gray list is observed; a control unit that carries out communication control on the basis of the authentication result of the authentication unit; and a list update unit that updates the gray list on the basis of the authentication result of the authentication unit.

Description

Unauthorized communication control apparatus and method

The present invention relates to a technology for blocking communication by malware while permitting communication affecting business by using feedback from a user.

In recent years, cyber attacks targeting private companies, defense-related companies, and the House of Representatives have become apparent, increasing the risk of damaging the interests and safety of individuals, companies, and the nation. In addition, attack techniques are becoming more and more sophisticated. Targeted attacks, particularly APT (Advanced Persistent Threat) attacks, are different in nature from conventional threats in that they continue secretly and persistently for a long time. Against this background, it is important to take measures on the premise that malware will invade the organization.

For example, Patent Document 1 discloses a case in which information on vulnerability is obtained for specifications of an information terminal device, a vulnerability value is acquired based on the information, and the information terminal device is connected to a server based on the vulnerability value. A system is disclosed in which a risk level indicating a security risk is calculated, and the server denies access without performing security authentication of the information terminal device when the risk level is equal to or higher than a predetermined threshold.

JP 2004-259020 A

Using the technology of Patent Document 1, it is possible to block communication from a fragile environment with a high risk of being infected with malware. However, if communication from a fragile environment is blocked, the user who is working in the fragile environment will also be blocked when communicating with the access destination related to the work. May be affected.

The present invention has been made in view of the above circumstances, and an object of the present invention is to provide an unauthorized communication control device that allows communication affecting a business and blocks communication by malware by using feedback from a user. To do.

A typical example of the present invention is as follows. That is, a storage unit that stores a suspicious connection destination as a gray list, an authentication unit that confirms connection to a user when observing communication from a terminal to a connection destination that matches the gray list, and an authentication unit A control unit that performs communication control based on the authentication result; and a list update unit that updates the gray list based on the authentication result of the authentication unit.

According to the present invention, it is possible to block communication by malware while permitting communication affecting business.

It is a figure which shows the structural example of the unauthorized communication control apparatus which concerns on Example 1 of this invention. It is a figure which shows an example of the reliability calculation rule which concerns on Example 1 of this invention. It is a figure which shows an example of the reliability data based on Example 1 of this invention. It is a figure which shows an example of the gray list which concerns on Example 1 of this invention. It is a figure which shows an example of the black list which concerns on Example 1 of this invention. It is a figure which shows an example of the white list which concerns on Example 1 of this invention. It is a flowchart which shows the communication control process which concerns on Example 1 of this invention. It is a flowchart which shows the list update process which concerns on Example 1 of this invention. It is a figure which shows an example of the additional authentication screen which concerns on Example 1 of this invention. It is a figure which shows the structural example of the unauthorized communication control apparatus which concerns on Example 2 of this invention. It is a figure which shows an example of the additional authentication screen which concerns on Example 2 of this invention.

There is a control method using a black list as a method for controlling communication. Information on dangerous connection destinations is registered in the black list, and communication to connection destinations corresponding to the black list is blocked. If the connection destination used for business is mistakenly registered in the black list, the business cannot be used. For this reason, registration of connection destination information to the black list needs to be carefully examined, and there is a problem that registration takes time.

Therefore, in this embodiment, a gray list is used. Here, the gray list is a list that indicates a connection destination with an intermediate reliability that is not required to be as alert as the black list but is not permitted as the white list. In this gray list, suspicious connection destinations are managed, and when communication to a connection destination that matches the gray list occurs, confirmation to the user is performed, and communication to the connection destination is permitted if confirmation is successful. As a result, it is not necessary to examine the information of the communication destination, and quick response is possible. In the first embodiment, paying attention to this point, communication control processing, authentication processing, list update processing, and reliability update processing will be described.

FIG. 1 is a diagram illustrating a configuration example of an unauthorized communication control apparatus according to the first embodiment of the present invention. In the unauthorized communication control apparatus 101 according to the first embodiment, a terminal 118 operated by a user 119 and the Internet 121 are connected via a network 120.

The unauthorized communication control device 101 includes a CPU (Central Processing Unit) 103, a main memory 104 for storing data necessary for the CPU 103 to execute processing, and a hard disk or flash memory having a capacity for storing a large amount of data. A storage device 105 such as, an IF (interface) 102 for performing communication with other devices, an input / output device 106 for performing input / output such as a keyboard and a display, and a communication path 107 for connecting these devices. , A computer equipped with The communication path 107 is an information transmission medium such as a bus or cable.

The CPU 103 executes suspicious communication control by executing the communication control program 108 stored in the main memory 104, authenticates the user 119 by executing the authentication program 109, and executes the additional authentication program 110 to execute the user authentication. For the additional authentication of 119, the list update program 111 is executed, the gray list 115, the black list 116, and the white list 117 are updated, and the reliability data 114 is updated by executing the reliability update program 112. The reliability indicates an index of how reliable the terminal 118 and the user 119 are.

The storage device 105 includes a reliability calculation rule table 113 including a plurality of rules for calculating the reliability of the terminal 118 and the user 119, reliability data 114 indicating the reliability of the terminal 118 and the user 119, and a suspicious communication destination. A gray list 115 indicating information, a black list 116 indicating dangerous communication destination information, and a white list 117 indicating safe communication destination information are stored.

Each of the above programs and data may be stored in advance in the memory 104 or the storage device 105, or installed (loaded) from the input / output device 106 or from another device via the IF 102 when necessary. Also good.

FIG. 2 is a diagram illustrating an example of the reliability calculation rule table 113. As shown in FIG. 2, the reliability calculation rule table 113 includes an ID 201, a type 202, an item 203, a determination value 204, and a score 205. Here, the information of the unit identified by the ID 201 is called a reliability calculation rule.

ID 201 represents information that can uniquely identify the reliability calculation rule.

The type 202 represents a type to which the reliability calculation rule is applied. For example, when the type 202 is “user”, the rule is for calculating the reliability of the user. When the type 202 is “terminal”, the rule is for calculating the reliability of the terminal. Represents.

An item 203 represents information on an item used when calculating the reliability, a determination value 204 represents a threshold used when calculating the reliability, and a score 205 is used when calculating the reliability. Represents a value (degree of influence). When the score 205 is “+”, the terminal 118 and the user 119 are reliable, and when the score 205 is “−”, the terminal 118 and the user 119 are unreliable.

This will be specifically described with reference to FIG. For example, the reliability calculation rule in which the ID 201 is “1”, the type 202 is “user”, the item 203 is “additional authentication success rate”, the determination value 204 is “0.8 or more”, and the score 205 is “+1” is user When the additional authentication success rate of 119 is 0.8 or more, it represents that the reliability of the user 119 is incremented by one. Although the reliability is described as +1 here, in practice, the reliability is normalized before being stored in the reliability data 114. The normalization process will be described later with reference to FIG.

The reliability calculation rule is for determining the reliability of the terminal 118 and the user 119. For example, the reliability of the user 119 is calculated by calculating the success rate of additional authentication, the authentication success rate, the number of black list matches, and training. Rules regarding mail unopened rate, communication rate within business hours, business content, number of malware infections, specific users, etc. For example, for calculating the reliability of the terminal 118, additional authentication success rate, authentication success rate, number of vulnerable software , OS (Operating System) unapplied patch number, AV (AntiVirus) installation presence / absence, AV signature update date, number of AV alerts, communication rate during business hours, etc. are stored.

Note that each piece of information in the reliability calculation rule table 113 may be input or updated as necessary by the administrator.

The reliability calculation rule table 113 is used when the reliability update program 112 executed by the CPU 103 updates the reliability of the terminal 118 or the user 119. Specific processing of the reliability update program 112 will be described later with reference to FIG.

FIG. 3 is a diagram illustrating an example of the reliability data 114. As illustrated in FIG. 3, the reliability data 114 includes an ID 301, a type 302, an item 303, and a reliability 304.

ID 301 represents information that can uniquely identify the reliability data.

The type 302 represents the type of reliability data. For example, when the type 302 is “user”, the reliability of the user 119 is stored, and when the type 302 is “terminal”, the reliability of the terminal 118 is stored.

The item 303 represents information for identifying the terminal 118 or the user 119 stored in the reliability data, and the reliability 304 represents the reliability of the terminal 118 or the user 119. The reliability 304 stores a value from “0” to “1”. When the reliability 304 is “0”, the reliability 118 indicates that the terminal 118 or the user 119 cannot be trusted. "Represents that the terminal 118 or the user 119 can be trusted, and the closer the reliability is to" 1 ", the higher the reliability of the terminal 118 or the user 119 is.

This will be specifically described with reference to FIG. For example, reliability data with ID 301 “1”, type 302 “user”, item 303 “user A”, and reliability 304 “0.9” has a reliability of “user A 119a” “0.9”. ".

The reliability data 114 is updated by a reliability update program 112 executed by the CPU 103. Specific processing of the reliability update program 112 will be described later with reference to FIG.

FIG. 4 is a diagram illustrating an example of the gray list 115. As illustrated in FIG. 4, the gray list 115 includes an ID 401, a connection destination 402, a communication count 403, an additional authentication failure rate 404, and a score 405.

ID 401 represents information that can uniquely identify the gray list.

The connection destination 402 represents suspicious connection destination information. In FIG. 4, the host name is described as the suspicious connection destination, but any information that can identify the connection destination may be used. For example, an IP (Internet Protocol) address and a URI (Uniform Resource Identifier) are stored. May be.

The communication count 403 represents the number of connections to the connection destination 402, the additional authentication failure rate 404 represents the rate at which additional authentication failed during connection to the connection destination 402, and the score 405 represents the suspicious degree ( (The degree of gray). The score 405 stores a value from “0” to “1”, and the closer the score 405 is to “1”, the higher the suspicious degree.

This will be specifically described with reference to FIG. For example, a gray list in which the ID 401 is “1”, the connection destination 402 is “example.com”, the communication count 403 is “1000”, the additional authentication failure rate 404 is “0.1”, and the score 405 is “0.4”. The unauthorized communication control apparatus 101 observes communication to “example.com” 1000 times, and additional authentication to the connection destination fails at a rate of 0.1, and the suspicious degree of the connection destination is 0.4. Represents that.

The gray list 115 is updated by the list update program 111 executed by the CPU 103. Specific processing of the list update program 111 will be described later with reference to FIG.

In addition, each information of the gray list 115 may be input or updated by the administrator as necessary.

FIG. 5 is a diagram illustrating an example of the black list 116. As shown in FIG. 5, the black list 116 includes an ID 501, a connection destination 502, a communication count 503, and a score 504.

ID 501 represents information that can uniquely identify the black list.

The connection destination 502 represents dangerous connection destination information. In FIG. 5, the host name is described as a dangerous connection destination, but any information that can identify the connection destination may be used. For example, an IP (Internet Protocol) address and a URI (Uniform Resource Identifier) are stored. May be.

The communication count 503 represents the number of connections to the connection destination 502, and the score 504 represents the danger level (the degree of black) of the connection destination 502. The score 504 stores values from “0” to “1”, and the closer the score 504 is to “1”, the higher the risk level.

This will be specifically described with reference to FIG. For example, a blacklist having an ID 501 of “1”, a connection destination 502 of “black.com”, a communication count 503 of “100”, and a score 504 of “0.99” is “black.com” in the unauthorized communication control device 101. This indicates that the risk of the connection destination is 0.99.

The black list 116 is updated by the list update program 111 executed by the CPU 103. Specific processing of the list update program 111 will be described later with reference to FIG.

Note that each piece of information in the black list 116 may be input or updated as necessary by the administrator.

FIG. 6 is a diagram showing an example of the white list 117. As shown in FIG. 6, the white list 117 includes an ID 601, a connection destination 602, a communication count 603, and a score 604.

ID 601 represents information that can uniquely identify the white list.

The connection destination 602 represents information on a safe connection destination. In FIG. 6, the host name is described as a secure connection destination, but any information that can identify the connection destination may be used. For example, an IP (Internet Protocol) address and a URI (Uniform Resource Identifier) are stored. May be.

The communication count 603 represents the number of connections to the connection destination 602, and the score 604 represents the safety level (the degree of white) of the connection destination 602. The score 604 stores values from “0” to “1”, and the closer the score 604 is to “1”, the higher the safety level.

This will be specifically described with reference to FIG. For example, a whitelist having an ID 601 of “1”, a connection destination 602 of “white.com”, a communication count 603 of “1000”, and a score 604 of “0.99” is “white.com” in the unauthorized communication control apparatus 101. This indicates that the security level of the connection destination is 0.99.

The white list 116 is updated by the list update program 111 executed by the CPU 103. Specific processing of the list update program 111 will be described later with reference to FIG.

In addition, each information of the white list 117 may be input or updated as necessary by the administrator.

Note that there may be other variations on the score concept described in FIGS. 3 to 5 for the gray list, black list, and white list. That is, a higher value may be set to be more dangerous consistently in the three lists. In that case, it is necessary to reverse the sign of the score 205 of the rule in FIG.

Subsequently, the communication control program 108 of the unauthorized communication control apparatus 101 receives the communication from the terminal 118, the authentication program 109 authenticates the user 119, the additional authentication program 110 performs additional authentication of the user 119, and updates the list. A process in which the program 111 updates the gray list 115, the black list 116, and the white list 117 and the reliability update program 112 updates the reliability data 114 will be described.

FIG. 7 is a flowchart showing the processing of the communication control program 108 of the unauthorized communication control apparatus 101. As shown in FIG. 7, the communication control program 108 is executed by the CPU 103, and receives communication from the terminal 118 via the IF 102a (step 701).

The communication control program 108 executes the authentication program 109 to authenticate the user 119 using the terminal 118 (step 702).

Here, for example, the authentication program 109 uses a combination of a user name and a password to check whether or not the user 119 trying to communicate has the authority to perform communication.

The communication control program 108 acquires the authentication result from the authentication program 109. If the authentication is successful, the process proceeds to step 704. If the authentication fails, the process proceeds to step 710 (step 703).

The communication control program 108 compares the communication destination information with the connection destination 502 of the black list 116, and if the corresponding connection destination 502 exists, the communication control program 108 increments the communication count 503 of the corresponding connection destination 502 by one, and then step 710 If the corresponding connection destination 502 does not exist, the process proceeds to step 705 (step 704).

The communication control program 108 compares the information of the communication destination with the connection destination 602 of the white list 117, and if there is a corresponding connection destination 602, the communication number 603 of the corresponding connection destination 602 is incremented by 1, and then step 711 is performed. If not, the process proceeds to step 706 (step 705).

The communication control program 108 compares the communication destination information with the connection destination 402 of the gray list 115, and if the corresponding connection destination 402 exists, the communication control program 108 increments the communication count 403 of the corresponding connection destination 402 by 1 and then step 708. If not, the process proceeds to step 707 (step 706).

The communication control program 108 stores communication destination information in the gray list 115 (step 707). At this time, the ID 401 does not exist in the gray list 115, the connection destination 402 has communication destination information, the communication count 403 has “1”, the authentication failure rate 404 has “0”, and the score 405. Stores “0.5”.

The communication control program 108 executes the additional authentication program 110 and performs additional authentication of the user 119 using the terminal 118 (step 708).

Here, the additional authentication program 110 is a challenge for confirming that the communication from the terminal 118 is not due to a computer (malware) such as CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart). / Use response type tests. The display screen of the additional authentication program 110 will be described later with reference to FIG.

The communication control program 108 acquires the authentication result of the additional authentication program 110. If the authentication is successful, the process proceeds to step 711. If the authentication fails, the communication control program 108 determines the additional authentication failure rate of the connection destination 402 corresponding to the communication destination information. After the update, the process proceeds to step 710 (step 709).

The communication control program 108 cuts off communication with the connection destination, and proceeds to step 712 (step 710).

The communication control program 108 permits communication to the connection destination and proceeds to step 712 (step 711).

The communication control program 108 activates the reliability update program 112 and updates the reliability data 114 of the user 119 and the terminal 118 (step 712). The reliability update program 112 sets the reliability of the user 119 using the reliability calculation rule in which the type 202 of the reliability calculation rule table 113 is “user”, and the type 202 is “terminal”. The reliability of the terminal 118 is updated using the reliability calculation rule.

Here, the case where the reliability of the user 119 is updated will be described with reference to FIG. When updating the reliability of the user 119, a reliability calculation rule whose type 202 is “user” is used. In FIG. 2, the reliability is updated using eight reliability calculation rules whose ID 201 is “1” to “8”. First, in the reliability calculation rule in which the score of the user 119 is “0”, the ID 201 is “1”, and the type 202 is “user”, the “additional authentication success rate” of the item 203 is “0.8 or more” of the determination value 204. "Is satisfied, and if it is satisfied," +1 "of the score 205 is added to the score" 0 ". Similarly, regarding the reliability calculation rules with IDs 201 from “2” to “8”, it is determined whether or not the item 203 satisfies the determination value 204, and if it satisfies, the score 205 is added. To do. After applying all the corresponding reliability calculation rules, the calculated score is normalized to a value of “0” to “1” in order to obtain the reliability. For example, the minimum and maximum score values that can be taken after applying the corresponding reliability calculation rule are calculated, the minimum score value is subtracted from the calculated score, and the minimum score value is subtracted from the maximum score value. Find by dividing by value. For example, the minimum value of the score that the type 202 in FIG. 2 can have is “−10”, and the maximum value is “+10”. Here, when the calculated score is “+5”, “0.75” is the reliability by the calculation of (+5 − (− 10)) / (+ 10 − (− 10)).

Note that the reliability may be calculated for each communication, or may be calculated every certain period (for example, one week) in order to reduce the calculation load.

The communication control program 108 starts the list update program 111, updates the gray list 115, the black list 116, and the white list 117, and ends the process (step 713). The processing of the list update program 111 will be described later with reference to FIG.

FIG. 8 is a flowchart showing the processing of the list update program 111 for updating the gray list 115, the black list 116, and the white list 117. As shown in FIG. 8, the list update program 111 is executed by the CPU 103, and starts processing when it receives information on the communication destination of the terminal 118 from the communication control program 108 (step 801).

The list update program 111 compares the communication destination information with the connection destination 402 of the gray list 115. If the corresponding connection destination 402 exists, the list update program 111 proceeds to step 803, and if the corresponding connection destination 402 does not exist. Proceed to step 808 (step 802).

The list update program 111 updates the score 405 of the gray list 115 (step 803). A predetermined process is used for updating the score 405. In the predetermined process, for example, first, a value obtained by adding the reliability 304 of the user 119 that performed the communication and the reliability 304 of the terminal that performed the communication is calculated, and this value is set to a predetermined value (for example, 200 ) Is calculated (hereinafter referred to as communication reliability). If the additional authentication is successful in step 709, the value obtained by subtracting the communication reliability from the score 405 is stored in the score 405 of the gray list 115 as the updated score. If additional authentication has failed in step 709, the value obtained by adding the communication reliability to the score 405 is stored in the score 405 of the gray list 115 as the updated score. When the score 405 is smaller than 0, the score 405 is corrected to 0, and when the score 405 is larger than 1, the score 405 is corrected to 1.

In the above process, if the additional authentication in step 709 is successful, the score 405 of the gray list 115 decreases (the degree of suspiciousness decreases), and if the additional authentication in step 709 fails, the score 405 of the gray list 115 decreases. Is increased (suspicious degree is increased), and the higher the reliability of the terminal 118 or the user 119 is, the higher the increase or decrease is, and the lower the reliability of the terminal 118 or the user 119 is, the higher or lowering is. This means that the degree of is small. With this process, the score 405 can be updated according to the reliability of the terminal 118 or the user 119.

The list update program 111 proceeds to step 806 if the communication count 403 of the gray list 115 is equal to or greater than a certain threshold (for example, 100) and the score 405 updated in step 803 is equal to or greater than a certain threshold (for example, 0.9). If the communication count 403 of the gray list 115 is less than a certain threshold value (for example, 100) or the score 405 updated in step 803 is smaller than a certain threshold value (for example, 0.9), the process proceeds to step 805 (step 804).

The list update program 111 proceeds to step 807 if the communication count 403 of the gray list 115 is equal to or greater than a certain threshold (for example, 100) and the score 405 updated in step 803 is equal to or less than the certain threshold (for example, 0.1). If the number of times of communication 403 in the gray list 115 is less than a certain threshold value (for example, 100) or the score 405 updated in step 803 is larger than a certain threshold value (for example, 0.1), the process is terminated (step 805).

The list update program 111 moves the gray list having the communication destination information and the corresponding connection destination 402 to the black list 116, and ends the processing (step 806). When moving to the black list 116, the ID 501 has an ID that does not exist in the black list 116, the connection destination 502 has communication destination information, the communication count 503 has “1”, and the score 504 has a score 504. “0.5” is stored.

The list update program 111 moves the gray list having the communication destination information and the corresponding connection destination 402 to the white list 117, and ends the processing (step 807). When moving to the white list 117, the ID 601 has an ID that does not exist in the white list 117, the connection destination 602 has communication destination information, the communication count 603 has “1”, and the score 604 has a score 604. “0.5” is stored.

The list update program 111 compares the communication destination information with the connection destination 602 of the white list 117. If the corresponding connection destination 602 exists, the list update program 111 proceeds to step 810, and if the corresponding connection destination 602 does not exist. Proceed to step 809 (step 808).

The list update program 111 updates the score 504 of the black list 116 (step 809). Note that a predetermined process is used to update the score 504. In the predetermined process, for example, first, communication reliability is calculated. If authentication is successful in step 703, a value obtained by subtracting the communication reliability from the score 504 is stored in the score 504 of the black list 116 as an updated score. If authentication fails in step 703, a value obtained by adding the communication reliability to the score 504 is stored in the score 504 of the black list 116 as an updated score. When the score 504 is smaller than 0, the score 504 is corrected to 0, and when the score 504 is larger than 1, the score 504 is corrected to 1.

In the above process, if the authentication in step 703 is successful, the score 504 of the black list 116 decreases (risk level decreases), and if the authentication in step 703 fails, the score 504 of the black list 116 increases. Furthermore, the higher the reliability of the terminal 118 or the user 119, the higher the degree of increase or decrease, and the lower the reliability of the terminal 118 or the user 119, the higher the degree of increase or decrease. Indicates that becomes smaller. With this processing, the score 504 can be updated according to the reliability of the terminal 118 or the user 119.

The list update program 111 updates the score 604 of the white list 117 (step 810). A predetermined process is used for updating the score 604. In the predetermined process, for example, first, communication reliability is calculated. If authentication is successful in step 703, a value obtained by adding the communication reliability to the score 604 is stored in the score 604 of the white list 117 as an updated score. If authentication fails in step 703, a value obtained by subtracting the communication reliability from the score 604 is stored in the score 604 of the white list 117 as an updated score. When the score 604 is smaller than 0, the score 604 is corrected to 0, and when the score 604 is larger than 1, the score 604 is corrected to 1.

In the above process, if the authentication in step 703 is successful, the score 604 of the white list 117 increases (the degree of safety increases), and if the authentication in step 703 fails, the score 604 of the white list 117 decreases. Further, the higher the reliability of the terminal 118 or the user 119, the higher the degree of increase or decrease, and the lower the reliability of the terminal 118 or the user 119, the higher the degree of increase or decrease. Indicates that becomes smaller. With this process, the score 604 can be updated according to the reliability of the terminal 118 or the user 119.

The list update program 111 proceeds to step 813 if the communication count 503 of the black list 116 is equal to or greater than a certain threshold (for example, 100) and the score 504 updated in step 809 is equal to or smaller than the certain threshold (for example, 0.3). If the number of times of communication 503 in the black list 116 is less than a certain threshold value (for example, 100) or the score 504 updated in step 809 is larger than a certain threshold value (for example, 0.3), the process ends (step 811).

The list update program 111 proceeds to step 813 if the communication count 603 of the white list 117 is equal to or greater than a certain threshold (for example, 100) and the score 604 updated in step 810 is equal to or smaller than a certain threshold (for example, 0.3). If the number of times of communication 603 in the white list 117 is less than a certain threshold value (for example, 100) or the score 604 updated in step 810 is larger than a certain threshold value (for example, 0.3), the process is terminated (step 812).

The list update program 111 shifts the information of the black list 116 or the white list 117, which corresponds in step 811 or step 812, to the gray list 115, and ends the processing (step 813). At this time, the ID 401 does not exist in the gray list 115, the connection destination 402 has communication destination information, the communication count 403 has “1”, the authentication failure rate 404 has “0”, and the score 405. Stores “0.5”.

FIG. 9 is an example of an additional authentication screen displayed by the additional authentication program 110. As shown in FIG. 9, the additional authentication screen is a text (901 in the figure) representing a warning to the user 119, information on the communication destination (902 in the figure), and an image (FIG. 9) composed of distorted characters and numbers. 903), an area (904 in the figure) for reading and inputting the character string displayed in the image (903 in the figure), and a send button (905 in the figure) for sending the input information Consists of content. A human and malware (machine) are discriminated based on whether or not such distorted characters and numbers can be read.

The flow of processing from step 701 to step 713 including step 801 to step 813 will be described using a specific example. For example, it is assumed that “user A” communicates with “example.com” using “terminal A”.

The communication control program 108 is executed by the CPU 103 and receives communication from the “terminal A” 118a via the IF 102a (step 701).

The communication control program 108 executes the authentication program 109 to authenticate the “user A” 119a using the “terminal A” 118a (step 702). Here, it is assumed that “user A” 119a has input a correct user name and password combination.

The communication control program 108 acquires the authentication result from the authentication program 109. If the authentication is successful, the process proceeds to step 704. If the authentication fails, the process proceeds to step 710 (step 703). At this time, “User A” 119 a has succeeded in authentication, and the process proceeds to Step 704.

The communication control program 108 compares the communication destination information with the connection destination 502 of the black list 116, and if the corresponding connection destination 502 exists, the communication control program 108 increments the communication count 503 of the corresponding connection destination 502 by one, and then step 710 If the corresponding connection destination 502 does not exist, the process proceeds to step 705 (step 704). At this time, since the communication destination information “example.com” does not exist in the black list 116, the process proceeds to step 705.

The communication control program 108 compares the information of the communication destination with the connection destination 602 of the white list 117, and if there is a corresponding connection destination 602, the communication number 603 of the corresponding connection destination 602 is incremented by 1, and then step 711 is performed. If not, the process proceeds to step 706 (step 705). At this time, the communication destination information “example.com” does not exist in the white list 117, and thus the process proceeds to step 706.

The communication control program 108 compares the communication destination information with the connection destination 402 of the gray list 115, and if the corresponding connection destination 402 exists, the communication control program 108 increments the communication count 403 of the corresponding connection destination 402 by 1 and then step 708. If not, the process proceeds to step 707 (step 706). At this time, the communication destination information “example.com” has an ID 401 of “1”, a connection destination 402 of “example.com”, a communication count 403 of “1000”, and an additional authentication failure rate 404 of “0.1”. Since the score 405 corresponds to the gray list of “0.4”, the communication times 403 is incremented by 1, and the process proceeds to step 708. Note that when this process is performed, the communication count 403 is “1001”. Here, for the sake of simplicity, the following process will be described with the communication count 403 being “1000”.

The communication control program 108 executes the additional authentication program 110 and performs additional authentication of the “user A” 119a using the “terminal A” 118a (step 708). At this time, the additional authentication screen displayed in FIG. 9 is displayed on the screen of “terminal A” 118a. Here, it is assumed that “user A” 119a correctly reads the distorted character string and presses the transmission button.

The communication control program 108 acquires the authentication result of the additional authentication program 110. If the authentication is successful, the process proceeds to step 711. If the authentication fails, the communication control program 108 determines the additional authentication failure rate of the connection destination 402 corresponding to the communication destination information. After the update, the process proceeds to step 710 (step 709). At this time, “User A” 119 a has succeeded in authentication, and the process proceeds to Step 711.

The communication control program 108 permits communication to the connection destination and proceeds to step 712 (step 711). At this time, the “user A” 119a communicates with the communication destination “example.com”.

The communication control program 108 activates the reliability update program 112 and updates the reliability data 114 of the “user A” 119a and the “terminal A” 118a (step 712). Here, “User A” 119a corresponds to the reliability calculation rule with ID 201 of “1”, “2”, “6”, “8”, and “Terminal A” 118a has ID 201 of “9”, “ It is assumed that the reliability calculation rule of “10” is met. At this time, the reliability of “user A” 119a is “0.9” by the calculation of ((+ 1 + 1 + 1 + 5) − (− 10)) / (+ 10 − (− 10)). The reliability of “terminal A” 118a is “0.8” by the calculation of ((+ 1 + 1) − (− 10)) / (+ 5 − (− 10)).

The communication control program 108 activates the list update program 111 and updates the gray list 115, the black list 116, and the white list 117 (step 713).

The list update program 111 is executed by the CPU 103 and receives the communication destination information “example.com” of the “terminal A” 118a from the communication control program 108 (step 801).

The list update program 111 compares the communication destination information with the connection destination 402 of the gray list 115. If the corresponding connection destination 402 exists, the list update program 111 proceeds to step 803, and if the corresponding connection destination 402 does not exist. Proceed to step 808 (step 802). At this time, the communication destination information “example.com” has an ID 401 “1”, a connection destination 402 “example.com”, a communication count 403 “1000”, and an additional authentication failure rate 404 “0. 1 ”and the score 405 corresponds to the gray list of“ 0.4 ”, so the process proceeds to step 803.

The list update program 111 updates the score 405 of the gray list 115 (step 803). At this time, the communication reliability is “0.0085” by the calculation of (0.9 + 0.8) / 200. Therefore, the score becomes “0.4085” by the calculation of 0.4 + 0.0085.

The list update program 111 proceeds to step 806 if the communication count 403 of the gray list 115 is equal to or greater than a certain threshold (for example, 100) and the score 405 updated in step 803 is equal to or greater than a certain threshold (for example, 0.9). If the communication count 403 of the gray list 115 is less than a certain threshold value (for example, 100) or the score 405 updated in step 803 is smaller than a certain threshold value (for example, 0.9), the process proceeds to step 805 (step 804). At this time, since the communication count 403 is “1000” and the updated score 405 is “0.4085”, the process proceeds to step 805.

The list update program 111 proceeds to step 807 if the communication count 403 of the gray list 115 is equal to or greater than a certain threshold (for example, 100) and the score 405 updated in step 803 is equal to or less than the certain threshold (for example, 0.1). If the number of times of communication 403 in the gray list 115 is less than a certain threshold value (for example, 100) or the score 405 updated in step 803 is larger than a certain threshold value (for example, 0.1), the process is terminated (step 805). At this time, since the communication count 403 is “1000” and the updated score 405 is “0.4085”, the processing ends.

Subsequently, it is assumed that “malware” infected with “terminal B” communicates with “malware.com”. This “malware” is assumed to be the malware that steals the authentication information of user B stored in “terminal B” and breaks the authentication.

The communication control program 108 is executed by the CPU 103 and receives communication from the “terminal B” 118b via the IF 102a (step 701).

The communication control program 108 executes the authentication program 109 to authenticate “malware” using the “terminal B” 118b (step 702). Here, it is assumed that “malware” steals and inputs a combination of a correct user name and password of “user B” 119b.

The communication control program 108 acquires the authentication result from the authentication program 109. If the authentication is successful, the process proceeds to step 704. If the authentication fails, the process proceeds to step 710 (step 703). At this time, “malware” has been successfully authenticated, and the process proceeds to step 704.

The communication control program 108 compares the communication destination information with the connection destination 502 of the black list 116, and if the corresponding connection destination 502 exists, the communication control program 108 increments the communication count 503 of the corresponding connection destination 502 by one, and then step 710 If the corresponding connection destination 502 does not exist, the process proceeds to step 705 (step 704). At this time, since the communication destination information “malware.com” does not exist in the black list 116, the process proceeds to step 705.

The communication control program 108 compares the information of the communication destination with the connection destination 602 of the white list 117, and if there is a corresponding connection destination 602, the communication number 603 of the corresponding connection destination 602 is incremented by 1, and then step 711 is performed. If not, the process proceeds to step 706 (step 705). At this time, since the communication destination information “malware.com” does not exist in the white list 117, the process proceeds to step 706.

The communication control program 108 compares the communication destination information with the connection destination 402 of the gray list 115, and if the corresponding connection destination 402 exists, the communication control program 108 increments the communication count 403 of the corresponding connection destination 402 by 1 and then step 708. If not, the process proceeds to step 707 (step 706). At this time, the communication destination information “malware.com” has an ID 401 “2”, a connection destination 402 “malware.com”, a communication count 403 “50”, and an additional authentication failure rate 404 “0.9”. Since the score 405 corresponds to the gray list of “0.895”, the communication count 403 is incremented by 1, and the process proceeds to step 708. Note that when this processing is performed, the communication count 403 is “51”. Here, for the sake of simplicity, the following processing will be described with the communication count 403 being “50”.

The communication control program 108 executes the additional authentication program 110 to perform additional authentication of “malware” using the “terminal B” 118b (step 708). At this time, the additional authentication screen displayed in FIG. 9 is displayed on the screen of “terminal B” 118b. Here, it is assumed that “malware” cannot read a distorted character string and fails in additional authentication.

The communication control program 108 acquires the authentication result of the additional authentication program 110. If the authentication is successful, the process proceeds to step 711, and if the authentication fails, the additional authentication failure rate 404 of the connection destination 402 corresponding to the communication destination information. Then, the process proceeds to step 710 (step 709). At this time, “malware” has failed in authentication, and after updating the additional authentication failure rate 404, the process proceeds to step 710.

The communication control program 108 cuts off communication with the connection destination, and proceeds to step 712 (step 710). At this time, “malware” fails to communicate with the communication destination “malware.com”.

The communication control program 108 activates the reliability update program 112 and updates the reliability data 114 of “user B” 119b and “terminal b” 118b (step 712). At this time, although it is “malware” that is actually performing communication, the communication control program 108 updates the reliability of the user (in this case, the user B 119 b) input by the authentication program 109. Here, “User B” 119b corresponds to the reliability calculation rule with ID 201 of “3”, “4”, “5”, “6”, and “Terminal B” 118b has ID 201 of “11”, “ It is assumed that the reliability calculation rules of “13” and “16” are met. At this time, the reliability of “user B” 119b is “0.4” by the calculation of ((−5 + 1 + 1 + 1) − (− 10)) / (+ 10 − (− 10)). Further, the reliability of “terminal B” 118b is “0.67” by the calculation of ((−3 + 2 + 1) − (− 10)) / (+ 5 − (− 10)).

The list update program 111 is executed by the CPU 103 and receives the communication destination information “malware.com” of the “terminal B” 118b from the communication control program 108 (step 801).

The list update program 111 compares the communication destination information with the connection destination 402 of the gray list 115. If the corresponding connection destination 402 exists, the list update program 111 proceeds to step 803, and if the corresponding connection destination 402 does not exist. Proceed to step 808 (step 802). At this time, the communication destination information “malware.com” has an ID 401 “2”, a connection destination 402 “malware.com”, a communication count 403 “50”, and an additional authentication failure rate 404 “0.9”. Since the score 405 corresponds to the gray list of “0.895”, the process proceeds to step 803.

The list update program 111 updates the score 405 of the gray list 115 (step 803). At this time, the communication reliability is “0.00545” by the calculation of (0.4 + 0.67) / 200. Therefore, the score is “0.90045” by calculation of 0.895 + 0.00545.

The list update program 111 proceeds to step 806 if the communication count 403 of the gray list 115 is equal to or greater than a certain threshold (for example, 100) and the score 405 updated in step 803 is equal to or greater than a certain threshold (for example, 0.9). If the communication count 403 of the gray list 115 is less than a certain threshold value (for example, 100) or the score 405 updated in step 803 is smaller than a certain threshold value (for example, 0.9), the process proceeds to step 805 (step 804). At this time, since the communication count 403 is “100” and the updated score 405 is “0.90045”, the process proceeds to step 806.

The list update program 111 moves the gray list having the communication destination information and the corresponding connection destination 402 to the black list 116, and ends the processing (step 806). At this time, since the communication destination information “malware.com” corresponds to “2” for the ID 401 and “malware.com” for the connection destination 402, the gray list with the ID 401 of “2” is deleted and the black list 116 is displayed. When the ID 501 is “3”, “malware.com” is stored in the connection destination 502, “1” is stored in the communication count 503, and “0.5” is stored in the score 504, and the processing ends.

As described above, in this embodiment, by using feedback from the user, it is possible to perform unauthorized communication control that blocks communication by malware while permitting communication affecting business.

It should be noted that a part of this embodiment may be changed and implemented as follows. User-Agent information may be used instead of the connection destinations of the gray list 115, the black list 116, and the white list 117. Malware may use a special User-Agent. By controlling communication from a suspicious User-Agent, it becomes possible to control communication of the malware.

Further, connection destinations that are not observed for a predetermined period (for example, one month) may be deleted from the gray list 115, the black list 116, and the white list 117. Thereby, the enlargement of the list can be prevented.

In addition, the gray list 115 may store a list of suspicious connection destinations disclosed by an external organization. The list of suspicious connection destinations disclosed by external organizations may include safe connection destinations, and if communication is stopped immediately, there is a possibility that business will be affected. For this reason, by using the gray list 115, it is possible to control malware communication while permitting communication related to business. Further, as information to be stored in the gray list 115, information on connection destinations observed when the malware is dynamically analyzed and information on connection destinations determined to be dangerous at the URL reputation site may be stored.

Moreover, you may use other than CAPTCHA as additional authentication. For example, pressing of a button displayed on the confirmation screen, input of a character string displayed in a moving image, input of a character string read by voice, or a password different from the password used at the time of authentication may be used.

Also, the additional authentication method may be changed according to the score 405 of the gray list 115. Furthermore, when the score 405 is high, a plurality of additional authentications may be used. Thereby, although the burden on a user increases, it becomes possible to reduce the possibility that malware communicates.

Further, the communication registered in the black list 116 may be controlled by a security product such as FW.

Also, connection destination information may be used to update the score 405 of the gray list 115. For example, information on the URL reputation site at the connection destination, the elapsed time after the accident when an accident occurs at the connection destination, the number of executable files existing at the connection destination, and the like may be used.

Alternatively, an agent may be introduced into the terminal 118 to acquire information on processes that perform communication, and a gray list of processes may be created. As a result, communication control from a suspicious process can be performed.

Also, the time required for additional authentication may be used to update the score 405 of the gray list 115. There is also an algorithm for solving CAPTCHA in the world, and when malware implements the algorithm, there is a possibility that additional authentication will succeed even if it is malware. For example, if the time required for additional authentication of CAPTCHA is less than 1 second, even if the additional authentication is successful, it is considered that CAPTCHA has been broken by malware, and the suspicious degree of the greylist is increased. Thereby, the accuracy of the gray list 115 can be improved.

Further, additional authentication may be performed on the terminal 118 or the user 119 with low reliability. In the present embodiment, the reliability of the terminal 118 and the user 119 can be evaluated from the success or failure of the additional authentication. By using this evaluation result, it becomes possible to control the communication of the terminal 118 with low reliability and the user 119.

The present embodiment is an unauthorized communication control apparatus that includes the unauthorized communication control apparatus 101 according to the first embodiment, further acquires and analyzes connection destination information, and provides it as auxiliary information at the time of additional authentication.

In the first embodiment, when the additional authentication screen illustrated in FIG. 9 is displayed, only the connection destination information is displayed. Therefore, the user 119 may have difficulty determining whether to permit the connection. Thus, in the second embodiment, an unauthorized communication control device that supports the determination of the user 119 by displaying the detailed information of the connection destination will be described. Thereby, the gray list can be updated based on an appropriate determination.

FIG. 10 is an example of the hardware configuration of the malware communication control device in this embodiment. The same components as those in the first embodiment are denoted by the same reference numerals, and the description thereof will be omitted. Hereinafter, differences from the first embodiment will be mainly described.

As illustrated in FIG. 10, the communication control apparatus 1001 according to the second embodiment includes a communication control program 1002, an additional authentication program 1003, a connection destination acquisition program 1004, and the malware communication control apparatus 101 according to the first embodiment described above. , And a connection destination confirmation program 1005. The communication control program 108 and the additional authentication program 110 also exist in the first embodiment. However, since some processes are different from the communication control program 1002 and the additional authentication program 1003 in the second embodiment, a new code is used here. It was attached.

The CPU 103 executes the connection destination acquisition program 1004 stored in the main memory 104 to acquire the connection destination content information, and executes the connection destination analysis program 1005 to analyze the connection destination.

Each of the above programs may be stored in the main memory 104 or the storage device 105 in advance, or may be installed (loaded) from the input / output device 106 or from another device via the IF 102 when necessary. Good.

In addition to the flow shown in FIG. 7, the communication control program 1002 executes the connection destination acquisition program 1004 when receiving a connection request from the user. Specifically, in step 702, the authentication program 109 is executed and the connection destination acquisition program 1004 is executed.

The connection destination acquisition program 1004 connects to the connection destination acquired in step 701 via the network 120b and acquires the content of the connection destination. At this time, the connection destination content is also stored as image information.

Subsequently, the connection destination acquisition program 1004 executes the connection destination analysis program 1005. The connection destination analysis program 1005 is a program for analyzing connection destination information. For example, information on the country in which the connection destination server exists, URL reputation result of the connection destination, the number of people connected to the connection destination so far, connection destination Analyzes behavior information etc. that occurs in the accessed terminal when accessing.

FIG. 11 illustrates an additional authentication screen that the additional authentication program 1003 presents to the user.

As shown in FIG. 11, in addition to the information of FIG. 9, connection destination information (1101) is displayed on the additional authentication screen. Specifically, the connection destination image information (1102) acquired by the connection destination acquisition program 1004 and the connection destination information (1103) analyzed by the connection destination analysis program 1005 are displayed. With this information, the user 118 can appropriately determine whether or not to connect to the connection destination.

Also, as shown in FIG. 11, a notification button (1104) is displayed on the additional authentication screen. When the user 118 confirms the connection destination information 1101 and determines that the connection destination is dangerous, the user 118 presses the report button 1104. By utilizing the behavior of whether or not the report button (1104) has been pressed when updating the gray list, it is possible to improve the accuracy of the gray list.

It should be noted that a part of this embodiment may be changed and implemented as follows. The connection destination acquisition program and the connection destination analysis program are executed on a terminal different from the unauthorized communication control device. Since the connection destination acquisition program accesses an unauthorized site, the possibility of being infected with malware increases. For this reason, it is possible to limit the damage range at the time of malware infection by executing these programs on another terminal.

Further, the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Moreover, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, the constituent elements over different embodiments may be appropriately combined.

DESCRIPTION OF SYMBOLS 101 ... Unauthorized communication control apparatus, 108 ... Communication control program, 109 ... Authentication program, 110 ... Additional authentication program, 111 ... List update program, 112 ... Reliability update program, 113 ... Reliability calculation rule, 114 ... Reliability data, 115 ... Gray list, 116 ... Black list, 117 ... White list, 118 ... Terminal, 119 ... User, 121 ... Internet

Claims

A terminal operated by a user via a network, and an unauthorized communication control device connected to the Internet and controlling communication from the terminal to the Internet,
A storage unit for storing a suspicious connection destination as a gray list;
When detecting communication from the terminal to the connection destination that matches the greylist, an authentication unit that notifies the terminal of connection confirmation;
A control unit that performs communication control based on an authentication result of the authentication unit;
A list update unit that updates the gray list based on an authentication result of the authentication unit;
An unauthorized communication control device comprising:
The unauthorized communication control device according to claim 1,
A reliability update unit that updates the reliability of the user and the reliability of the terminal based on the authentication result of the authentication unit;
The said list update part updates the said gray list based on the authentication result of the said authentication part, the said reliability of the said user, and the said reliability of the said terminal, The unauthorized communication control apparatus characterized by the above-mentioned.
The unauthorized communication control device according to claim 2,
In the gray list, the suspicious connection destination and the suspicious degree of the suspicious connection destination are stored together,
The list update unit updates the suspicious degree of the gray list based on an authentication result of the authentication unit, the reliability of the user, and the reliability of the terminal. apparatus.
The unauthorized communication control device according to claim 3,
The list update unit manages as a black list when the suspicious degree of the gray list is larger than a predetermined value, and manages as a white list when the suspicious degree of the gray list is smaller than a predetermined value. An unauthorized communication control device characterized by the above.
The unauthorized communication control device according to claim 4,
The authentication unit uses an authentication method for determining whether communication by a person or communication by a machine.
An unauthorized communication control device characterized by the above.
Memorize suspicious connections as a gray list,
When communication from the terminal to the connection destination that matches the gray list is detected, a connection check is performed on the terminal,
Perform communication control based on the result of the connection confirmation,
The illegal communication control method, wherein the gray list is updated based on the connection confirmation.
The unauthorized communication control method according to claim 6,
Based on the connection confirmation result, update the reliability of the user and the reliability of the terminal,
An unauthorized communication control method, wherein the gray list is updated based on the connection confirmation result, the reliability of the user, and the reliability of the terminal.
The unauthorized communication control method according to claim 7,
In the gray list, the suspicious connection destination and the suspicious degree of the suspicious connection destination are stored together in advance,
An unauthorized communication control method, comprising: updating the suspicious degree of the gray list based on the connection confirmation result, the reliability of the user, and the reliability of the terminal.
The unauthorized communication control method according to claim 8,
The fraud is managed as a black list when the suspicious degree of the gray list is larger than a predetermined value, and is managed as a white list when the suspicious degree of the gray list is smaller than a predetermined value. Communication control method.
An unauthorized communication control method according to claim 9,
The connection confirmation uses an authentication method for determining whether communication by a person or communication by a machine.
An unauthorized communication control method characterized by the above.