WO2017135249A1 - Icon diagnostic device, icon diagnostic method and program - Google Patents

Abstract

This icon diagnostic device is provided with: an icon extraction unit which extracts the icon of a file to be diagnosed; a file format determination unit which determines the format of the file to be diagnosed; and an icon comparison unit which compares the icon extracted by the icon extraction unit and a first reference icon, which is a reference icon corresponding to the format determined by the file format determination unit, and compares the aforementioned icon extracted by the icon extraction unit and a second reference icon other than the aforementioned first reference icon.

Description

Icon diagnosis apparatus, icon diagnosis method and program

The present invention relates to an icon diagnosis apparatus, an icon diagnosis method, and a program.
This application claims priority based on Japanese Patent Application No. 2016-20955 filed in Japan on February 5, 2016 and Japanese Patent Application No. 2016-116611 filed on Japan on June 10, 2016, and the contents thereof. Is hereby incorporated by reference.

In recent years, various devices have been implemented for malware to make users click. One of the devices is impersonation of icons. Specifically, in order to guide the user to click an icon of malware that is an executable file, the malware icon is disguised as a document icon or an archive icon. Examples of document icons include Microsoft Office (registered trademark) or Adobe Acrobat (registered trademark). Archive icons include, for example, the zip format or the lzh format.

Further, when the compressed file is decompressed by the user, a file in which an icon is disguised is created, and the user may be prompted to click the icon.
As another example, the user may be prompted to click an icon by entering a large amount of space in the name of the file and hiding the extension (a character string that identifies the type of file). As another example, there is a case where the user is prompted to click an icon by making it difficult to distinguish an extension using a language described from right to left such as Arabic characters.

Even if an icon is camouflaged, it is possible to determine whether it is malware or not by looking at the extension of the icon. For example, the extension is displayed in the default settings of Windows (registered trademark). In some cases, it was difficult to distinguish. Even if the extension of the icon is set to be displayed, since the icon is more visible than the extension, many people recognize only the icon and recognize the file format or content. There were cases where it was difficult to notice the child. In addition, when a lot of white space characters are inserted before the extension of the icon, the extension is misidentified, or a control character called RLO (Right-to-Left Override) is used to impersonate the extension of the icon. In many cases, it is difficult to identify malware just by visually checking the extension.

JP 2010-198565 A

Conventionally, when a malware icon is disguised, it may be difficult to diagnose that it is malware.
Note that in the malicious program detection method described in Patent Document 1, it is determined whether or not the target file is an executable file, and the file that is determined to be an executable file is a malicious program having a camouflaged icon. However, the permitted program list and the icon black list are always necessary, and other diagnostic methods have been desired.

In view of such circumstances, the embodiment of the present invention provides an icon diagnosis apparatus, an icon diagnosis method, and a program capable of diagnosing whether or not an icon is a disguised malware.

An icon diagnosis apparatus according to an embodiment of the present invention is extracted by an icon extraction unit that extracts an icon of a diagnosis target file, a file format determination unit that determines a format of the diagnosis target file, and the icon extraction unit. The icon is compared with a first reference icon that is a reference icon corresponding to the format determined by the file format determination unit, and the icon extracted by the icon extraction unit and the first reference icon An icon comparison unit that compares a second reference icon other than.
In the icon diagnosis apparatus according to one aspect of the present invention, the icon comparison unit compares the icon extracted by the icon extraction unit with the first reference icon, and acquires a degree of divergence between the icons. To do.
Further, in the icon diagnosis apparatus according to one aspect of the present invention, the icon comparison unit compares the icon extracted by the icon extraction unit with the second reference icon, and acquires the similarity between the icons. To do.
The icon diagnosis apparatus according to an aspect of the present invention further includes a risk determination unit that performs a risk determination based on a result of comparison by the icon comparison unit.
In the icon diagnosis apparatus according to one aspect of the present invention, the risk determination unit performs a determination regarding the degree of risk.
In the icon diagnostic apparatus according to one aspect of the present invention, the degree of the danger is that there is the danger or is two or more stages of the danger.
In the icon diagnosis apparatus according to one aspect of the present invention, the risk determination unit may determine the risk based on a determination result regarding the signature attached to the diagnosis target file and a comparison result by the icon comparison unit. I do.

In an icon diagnosis method according to an embodiment of the present invention, an icon diagnosis apparatus extracts an icon of a file to be diagnosed, the icon diagnosis apparatus determines a format of the diagnosis object file, and the icon diagnosis apparatus includes: The extracted icon is compared with a first reference icon that is a reference icon corresponding to the determined format, and the extracted icon and a second reference icon other than the first reference icon Compare

A program according to an embodiment of the present invention includes a step of extracting an icon of a diagnosis target file, a step of determining a format of the diagnosis target file, the extracted icon, and a criterion corresponding to the determined format A program for causing a computer to compare a first reference icon, which is an icon, and a step of comparing the extracted icon and a second reference icon other than the first reference icon. is there.

According to the icon diagnosis apparatus, the icon diagnosis method, and the program according to the embodiment of the present invention described above, it is possible to diagnose whether or not the icon is a disguised malware.

It is a figure which shows the schematic structural example of the icon processing apparatus which concerns on one Embodiment of this invention. It is a flowchart which shows an example of the icon diagnostic process performed by the icon processing apparatus which concerns on one Embodiment of this invention. It is a flowchart which shows an example of the icon display process performed by the icon processing apparatus which concerns on one Embodiment of this invention. It is a figure which shows an example of the icon display which concerns on one Embodiment of this invention. It is a figure which shows an example of the icon display which concerns on one Embodiment of this invention. It is a figure which shows an example of the icon display which concerns on one Embodiment of this invention. It is a figure which shows an example of the icon display which concerns on one Embodiment of this invention. It is a figure which shows an example of the icon display which concerns on one Embodiment of this invention. It is a figure which shows an example of the structure of the execution file which concerns on one Embodiment of this invention.

Embodiments of the present invention will be described in detail with reference to the drawings.

[Description of icon processing device]
FIG. 1 is a diagram illustrating a schematic configuration example of an icon processing apparatus 11 according to an embodiment of the present invention.
The icon processing apparatus 11 according to the present embodiment includes an input unit 31, an output unit 32, a storage unit 33, and a control unit 34.

The input unit 31 inputs information from outside.
For example, the input unit 31 may include an interface for inputting information output from an external recording medium or another device.
The input unit 31 may include an operation unit that inputs information corresponding to an operation performed by the user, for example.

The output unit 32 outputs information to the outside.
The output unit 32 includes, for example, a display unit 71 that displays and outputs information. The display unit 71 is, for example, a display screen. In the present embodiment, a configuration example in which the icon processing device 11 includes the display unit 71 is shown. As another configuration example, the display unit 71 is provided separately from the icon processing device 11, and the icon processing device 11 is provided. May be communicably connected.
For example, the output unit 32 may include an interface that outputs information to an external recording medium or another device.

The storage unit 33 stores information.
The storage unit 33 stores file information 91, for example. The file information 91 includes information on one or more files.

The storage unit 33 stores a file format list 92, for example. The file format list 92 includes information on various file formats (file formats). The file format list 92 includes, for example, extension information and characteristic information in the file, and holds correspondence between such information and file formats. The file format list 92 may hold correspondences between various file information and file formats. The file format list 92 may be updated as needed, for example, by the icon processing device 11 or the user.

The storage unit 33 stores a reference icon list 93, for example. The reference icon list 93 holds correspondences between various file formats and reference icon (reference icon) information. The reference icon list 93 may be updated as needed by, for example, the icon processing device 11 or the user.

The control unit 34 controls various processes in the icon processing apparatus 11.
The control unit 34 includes an icon diagnosis unit 111 and a diagnosis result output unit 112.
The icon diagnosis unit 111 includes a file format determination unit 131, an icon extraction unit 132, an icon comparison unit 133, and a risk determination unit 134.
The diagnosis result output unit 112 includes a display control unit 151.

Here, in this embodiment, for convenience of explanation, various functions of the control unit 34 are divided into a plurality of parts, but these functions may be provided in other ways. For example, when the control unit 34 is configured by using a processor and the processor realizes various functions by executing a control program stored in the storage unit 33, the various functions are combined into one program. Or may be divided into two or more programs in any way.

[Description of icon diagnosis processing]
FIG. 2 is a flowchart showing an example of icon diagnosis processing performed by the icon processing apparatus 11 according to an embodiment of the present invention.
The process of the flowchart shown in FIG. 2 will be described. This process is a process for determining (diagnosis) a risk related to a file in which an icon is camouflaged. This process is performed by the icon diagnosis unit 111 of the control unit 34 of the icon processing apparatus 11.

(Step S1)
First, the icon diagnosis unit 111 acquires information on a diagnosis target file from the file information 91 stored in the storage unit 33. Here, for example, the icon diagnosis unit 111 may set a file specified by an operation performed by the user as a diagnosis target, or search a file corresponding to a predetermined condition according to a predetermined processing procedure as a diagnosis target. It is good.
The file format determination unit 131 refers to the contents of the file format list 92 stored in the storage unit 33. Then, the file format determination unit 131 determines the format of the file based on the contents of the file format list 92 and information on the diagnosis target file. For example, the file format determination unit 131 compares the correspondence held in the file format list 92 (correspondence between the file information and the file format) with the information on the diagnosis target file, and corresponds to the information on the file. The file format is specified, and the specified file format is acquired as a determination result.

(Step S2)
Next, the file format determination unit 131 determines whether or not the file includes icon data based on the result of determining the format of the diagnosis target file.
As a result of this determination, if it is determined that the file contains icon data (step S2: YES), the process proceeds to steps S3 to S6. On the other hand, as a result of this determination, if it is determined that the file does not contain icon data (step S2: NO), the process proceeds to step S8.

(Step S3)
When it is determined in step S2 that the diagnosis target file includes icon data, the icon extraction unit 132 extracts the icon data.

(Step S4)
Next, the icon comparison unit 133 refers to the content of the reference icon list 93 stored in the storage unit 33. Then, the icon comparison unit 133 acquires the reference icon data of the diagnosis target file based on the contents of the reference icon list 93 and the file format determined by the file format determination unit 131. For example, the icon comparison unit 133 compares the correspondence held in the reference icon list 93 (correspondence between the file format and the reference icon information) with the format of the diagnosis target file and corresponds to the format of the file. A reference icon is specified and data of the reference icon is acquired.
The icon comparison unit 133 compares the icon data extracted by the icon extraction unit 132 with the acquired reference icon data, and calculates the degree of divergence between the icon and the reference icon.

Here, the degree of divergence between the icon and the reference icon is calculated using, for example, a predetermined mathematical formula. As the degree of divergence, for example, a value indicating the magnitude of the difference between the icon image and the reference icon image is used. As the divergence degree, for example, a value based on one or more of a hash value, a color ratio, a contour shape, and the like may be used.
As the degree of divergence, for example, a value of 0 [%] or more and 100 [%] or less representing the degree of difference may be used.
Alternatively, as the degree of divergence, for example, any one of a value indicating a difference and a value indicating a difference may be used. In this case, the degree of divergence is, for example, a value indicating a difference when a value of 0 [%] or more and 100 [%] or less indicating the degree of difference exceeds a predetermined threshold, It may be a value indicating that there is no difference when a value between 0% and 100% is equal to or less than the predetermined threshold value.

(Step S5)
Further, the icon comparison unit 133 acquires data of reference icons other than the reference icon of the diagnosis target file based on the content of the reference icon list 93 and the file format determined by the file format determination unit 131. The icon comparison unit 133 compares the icon data extracted by the icon extraction unit 132 with the acquired reference icon data, and calculates the similarity between the icon and the reference icon. Here, when two or more reference icons are acquired, the icon comparison unit 133 calculates the similarity for each acquired reference icon.
Note that the order of the process of step S4 and the process of step S5 may be reversed.

Here, the similarity between the icon and the reference icon is calculated using, for example, a predetermined mathematical formula. As the similarity, for example, a value representing the size of similarity between the icon image and the reference icon image is used. As the similarity, for example, a value based on one or more of a hash value, a color ratio, a contour shape, and the like may be used.
As the similarity, for example, a value of 0 [%] to 100 [%] representing the degree of similarity may be used.
Alternatively, as the similarity, for example, any one of a value indicating similarity and a value indicating dissimilarity may be used. In this case, the similarity is, for example, a value indicating similarity when a value of 0 [%] or more and 100 [%] or less representing the degree of similarity exceeds a predetermined threshold, while the degree of similarity is It may be a value indicating that the value not less than 0% and not more than 100% is not similar when the value is equal to or less than the predetermined threshold.

In the present embodiment, for example, different formulas may be used for the mathematical formula for calculating the degree of divergence between the icon and the reference icon and the mathematical formula for calculating the similarity between the icon and the reference icon. The same formula may be used. Here, the substantially same expression is, for example, an expression in which the degree of divergence and similarity between the icon and the reference icon are added to each other to become a constant value (for example, 100 [%], etc.) It is an expression that has a relationship that becomes a constant value (for example, 1).

(Step S6)
Next, the risk determination unit 134 calculates the risk based on the calculation result of the degree of deviation between the icon of the diagnosis target file and the reference icon and the calculation result of the similarity between the icon of the file and the other reference icon. To do. Then, the risk determination unit 134 determines whether or not the calculated risk exceeds a predetermined threshold value. The predetermined threshold value may be stored in advance in the storage unit 33, or may be designated at an arbitrary timing from an external device or a user.
As a result of this determination, when it is determined that the calculated degree of risk exceeds the threshold (step S6: YES), the process proceeds to step S7. On the other hand, as a result of this determination, if it is determined that the calculated risk does not exceed the threshold (step S6: NO), the process proceeds to step S8.

Here, the risk level of the icon is calculated using, for example, a predetermined mathematical formula. In the present embodiment, a value based on the degree of deviation between the icon and the reference icon and the degree of similarity between the icon and another reference icon is used as the risk level of the icon.
In this embodiment, regarding the degree of divergence between the icon of the file to be diagnosed and the reference icon (originally expected icon) corresponding to the format of the file, the degree of risk increases when the degree of divergence is large. If is small, the degree of danger is small, and the degree of danger is used. In the present embodiment, regarding the similarity between the icon of the file to be diagnosed and a reference icon that does not correspond to the format of the file (an icon that is not originally expected), the greater the similarity, the greater the risk, and the similarity If the degree is small, the degree of danger becomes small, and the degree of danger is used. At this time, when there are two or more other reference icons, for example, the similarity for all other reference icons may be used, or the similarity for one other reference icon having the largest similarity. Degrees may be used.

(Step S7)
When it is determined that the degree of risk calculated in the process of step S6 exceeds the threshold, the risk determination unit 134 determines that there is a risk. Then, the process of this flow ends.

(Step S8)
When it is determined that the degree of risk calculated in the process of step S6 does not exceed the threshold, the risk determination unit 134 determines that there is no risk. Then, the process of this flow ends.
Even when it is determined in the process of step S2 that the diagnosis target file does not include icon data, the risk determination unit 134 determines that there is no risk. Then, the process of this flow ends.

Here, in the example of the flowchart shown in FIG. 2, the risk determination unit 134 determines the presence or absence of risk for the file to be diagnosed. As another configuration example, the risk determination unit 134 determines the file to be diagnosed. If there is a risk, a more detailed degree of risk may be determined.

<Explanation when data of multiple icons is included in one file>
In the present embodiment, there may be a case where only one icon data is included in one file, or a plurality of icon data may be included in one file.
When data of a plurality of icons is included in one file, the data of each icon may be identified based on predetermined information (hereinafter also referred to as “icon identification information”). The predetermined information may be, for example, an icon size (image size), a name attached to the icon, or a number attached to the icon. Or other information. The size of the icon may be, for example, the amount of data.

In the process of (step S2) shown in FIG. 2, the file format determination unit 131, for example, if the diagnosis target file includes one or more icon data, the file includes icon data. It is determined that

In the process of (Step S3) shown in FIG. 2, the icon extraction unit 132 extracts data of one or more predetermined icons when the diagnosis target file includes data of two or more icons. To do. Here, the predetermined one or more icon data includes at least icon data used for the comparison performed by the icon comparison unit 133. For example, when the icon comparison unit 133 uses K (K is an integer equal to or greater than 1) icon data for comparison, the icon extraction unit 132 extracts at least the K icon data.

The icon data used for the comparison performed by the icon comparison unit 133 may be identified by, for example, icon identification information.
As a specific example, the icon data used for the comparison performed by the icon comparison unit 133 may be data of K icons from the larger size. In this case, for example, the icon extraction unit 132 extracts data of K icons from a larger size from a diagnosis target file including data of K or more icons. In this case, for example, when the diagnosis target file includes data of less than K icons, the icon extraction unit 132 may extract data of all the icons less than K.

Here, an example is shown in which the icon extraction unit 132 selects (identifies) and extracts icon data used for the comparison performed by the icon comparison unit 133. As another example, the icon extraction unit 132 extracts data of all icons included in the diagnosis target file, and the icon comparison unit 133 uses the icon data used for comparison from the extracted data of all icons. May be selected (identified).

Also, here, an example is shown in which the icon comparison unit 133 uses part of the data of two or more icons included in the file to be diagnosed for comparison. As another example, the icon comparison unit 133 may be configured to use data of all icons included in the diagnosis target file for comparison regardless of the number of icon data included in the diagnosis target file. In this configuration, the icon extraction unit 132 extracts data of all icons included in the diagnosis target file.

In the process of (step S4) shown in FIG. 2, the icon comparison unit 133 extracts the icon data extracted by the icon extraction unit 132 for each of one or more icon data determined in advance to be used for comparison. And the obtained reference icon data are compared to calculate the degree of divergence between the icon and the reference icon.

Here, when the icon comparison unit 133 compares the data of two or more icons included in the diagnosis target file, as an example, the comparison result of all the data of the two or more icons is considered. The total value may be adopted as the final divergence. The total value may be, for example, an average value or a total value of divergence degrees calculated for each of the data of these two or more icons, or may be another value.
In addition, when the icon comparison unit 133 compares data of two or more icons included in a diagnosis target file, as another example, the data of one icon of the data of these two or more icons The calculated divergence degree may be adopted as the final divergence degree. The final divergence degree may be, for example, the divergence degree having the largest value among the divergence degrees calculated for each of the data of the two or more icons.

In the process of (step S5) shown in FIG. 2, the icon comparison unit 133 extracts the icon data extracted by the icon extraction unit 132 for each of one or more icon data that is predetermined for comparison. And the obtained reference icon data are compared to calculate the similarity between the icon and the reference icon.

Here, when the icon comparison unit 133 compares the data of two or more icons included in the diagnosis target file, as an example, the comparison result of all the data of the two or more icons is considered. The total value may be adopted as the final similarity. The total value may be, for example, an average value or total value of similarities calculated for each of the data of these two or more icons, or may be another value.
In addition, when the icon comparison unit 133 compares data of two or more icons included in a diagnosis target file, as another example, the data of one icon of the data of these two or more icons The calculated similarity may be adopted as the final similarity. The final similarity may be, for example, the similarity having the largest value among the similarities calculated for each of the data of the two or more icons.

Here, the degree of divergence calculated by the icon comparison unit 133 with respect to the data of one icon (herein referred to as “icon A1”) among the data of two or more icons included in the diagnosis target file. When the final degree of divergence is assumed and the similarity calculated for the data of one icon (herein referred to as “icon A2”) is the final similarity, the icon A1 and the icon A2 are An example that could be different is given.
As another example, the icon comparison unit 133 calculates both the degree of divergence and the degree of similarity for each of the data of two or more icons included in the diagnosis target file, and finally, based on the calculation results of both. The data of one icon to be adopted as the divergence degree and the final similarity degree may be determined. The data of the one icon may be, for example, icon data that is determined to have the highest degree of risk when the calculated degree of divergence and the calculated degree of similarity are comprehensively determined. The risk level may be calculated by the same calculation method as the risk level calculated by the risk determination unit 134, for example.

Here, the reference icon list 93 relates to a file format including data of a plurality of icons, for example, and holds information on the reference icons for each of the plurality of icons. The reference icon corresponding to each icon may be identified using, for example, the same information (for example, icon identification information) as the information for identifying the data of each icon.
When the file to be diagnosed includes two or more icon data, for example, the icon comparison unit 133 includes, for example, one icon data to be compared and one reference icon data corresponding to the icon data. And the degree of divergence is calculated.

Further, when the file to be diagnosed includes data of two or more icons, the icon comparison unit 133, for example, other than one icon data to be compared and one reference icon corresponding to the icon data The similarity is calculated by comparing with the data of the reference icon. In this case, the reference icon data other than one reference icon corresponding to the icon data includes, for example, reference icon data corresponding to other icon data included in the diagnosis target file (that is, the same file). Other reference icon data in the format) may or may not be included (that is, only the reference icon data in other file formats, except for the reference icon data in the same file format). May be included).

With this configuration, as an example, the icon comparison unit 133 can compare the data of all icons extracted by the icon extraction unit 132 and determine one or both of the divergence degree and the similarity degree as a total value. Is possible.
As another example, the icon comparison unit 133 compares the data of all icons extracted by the icon extraction unit 132, and determines one or both of the degree of deviation and the degree of similarity as the highest risk level. It is possible to judge by.
As another example, the icon comparison unit 133 may compare the data of one icon having the largest size among the data of all icons extracted by the icon extraction unit 132. In general, it is considered that an icon having a larger size (large image) has a higher accuracy of comparison and can provide an accurate result.

[Explanation of icon display processing]
FIG. 3 is a flowchart illustrating an example of icon display processing performed by the icon processing apparatus 11 according to an embodiment of the present invention.
The process of the flowchart shown in FIG. 3 will be described. This process is a process for displaying the danger associated with the file with the icon impersonated. This process is performed by the diagnosis result output unit 112 of the control unit 34 of the icon processing apparatus 11.

This flow shows a case where the risk determination unit 134 of the icon diagnosis unit 111 of the control unit 34 determines the degree of risk for a diagnosis target file. The risk determination unit 134 indicates that the file to be diagnosed has no risk, has a low risk, has a medium risk, or has a high risk. Judge one of them. For example, the danger determination unit 134 compares the degree of danger with two or more different thresholds to determine the degree of danger.
As a specific example, the risk determination unit 134 determines that there is no risk when the risk level is equal to or lower than the first threshold value, and the risk level exceeds the first threshold value and is equal to or lower than the second threshold value. Is determined to be a low risk level, and if the risk level is greater than the second threshold value and less than or equal to the third threshold value, the risk level is determined to be moderate. When the threshold value of 3 is exceeded, it is determined that the degree of risk is high. Here, the first threshold <the second threshold <the third threshold.
In this flow, when there is a low degree of danger, the same processing as when there is no danger is performed.

(Step S21)
The display control unit 151 determines whether or not there is no risk for the display target file based on the determination result regarding the risk. Here, the display control unit 151 may display, for example, a file designated by an operation performed by the user, or display a file corresponding to a predetermined condition according to a predetermined processing procedure. It is good.
As a result of this determination, if it is determined that there is no risk for the file to be displayed (step S21: YES), the processing of this flow ends. In this case, the display control unit 151 displays the reference icon of the file to be displayed based on the content of the reference icon list 93 stored in the storage unit 33 and the format of the file.
On the other hand, as a result of this determination, if it is determined that the file to be displayed is not dangerous (that is, there is a risk) (step S21: NO), the process proceeds to step S22.
In the present embodiment, information on the result of determination regarding the risk made by the risk determination unit 134 is stored in the storage unit 33. The display control unit 151 refers to the information.

(Step S22)
If it is determined in step S21 that the display target file is not dangerous, the display control unit 151 determines that the display target file has a medium risk (see FIG. 3 is determined as to whether or not it is “hazard (medium)”.
As a result of this determination, if it is determined that the file to be displayed has a medium risk (step S22: YES), the process proceeds to step S24. On the other hand, as a result of this determination, if it is determined that the file to be displayed is not a medium risk (step S22: NO), the process proceeds to step S23.

(Step S23)
When it is determined in the process of step S22 that the file to be displayed is not a medium risk, the display control unit 151 determines a high risk (for the display target file) based on the determination result regarding the risk ( It is determined whether or not it is “Danger (High)” in FIG.
As a result of this determination, if it is determined that the file to be displayed has a high degree of risk (step S23: YES), the process proceeds to step S25.
On the other hand, as a result of this determination, if it is determined that the file to be displayed is not at high risk (step S23: NO), the processing of this flow ends. In this case, the display control unit 151 displays the reference icon of the file to be displayed based on the content of the reference icon list 93 stored in the storage unit 33 and the format of the file. In the present embodiment, this case includes, for example, a case where there is a low degree of danger for the file to be displayed.

(Step S24)
When it is determined in the process of step S22 that the file to be displayed has a medium risk, the display control unit 151 displays the contents of the reference icon list 93 stored in the storage unit 33 and the relevant file for the display target file. Based on the file format, the reference icon of the file is displayed. Further, the display control unit 151 displays a mark indicating a medium danger for the reference icon. In the present embodiment, the display control unit 151 displays the mark so as to overlap the reference icon. Then, the process of this flow ends.

(Step S25)
When it is determined in the process of step S23 that the file to be displayed has a high degree of risk, the display control unit 151 displays the contents of the reference icon list 93 stored in the storage unit 33 and the relevant file for the display target file. Based on the file format, the reference icon of the file is displayed. Further, the display control unit 151 displays a mark indicating a high degree of danger for the reference icon. In the present embodiment, the display control unit 151 displays the mark so as to overlap the reference icon. Then, the process of this flow ends.

Here, for example, the display control unit 151 may store a correspondence between a file and information (icon information) for displaying a reference icon and a mark in a memory such as a cache memory. Then, the display control unit 151 may display icon information corresponding to the file to be displayed based on the correspondence stored in the memory. In addition, as icon information memorize | stored in the said memory, only the icon information in which the mark regarding danger is displayed may be sufficient, for example, and all the icon information may be sufficient as it.

[Explanation of icon display]
An example of icon display is shown with reference to FIGS.
4 to 8 are diagrams each showing an example of icon display according to an embodiment of the present invention.
FIG. 4 is a diagram illustrating an example of icon information (icon information 211) of a file determined to have no risk. The icon information 211 is the same as the information of the reference icon 212 of the file.

FIG. 5 is a diagram illustrating an example of icon information (icon information 221) of a file determined to have a medium risk. The icon information 221 is information in which a mark 223 indicating a medium danger is superimposed on the reference icon 222 of the file.
FIG. 6 is a diagram illustrating an example of icon information (icon information 231) of a file determined to have a medium risk. The icon information 231 is information in which a mark 233 indicating a medium danger is superimposed on the reference icon 232 of the file.
Here, the mark 223 according to the example of FIG. 5 and the mark 233 according to the example of FIG. 6 are different marks. The mark 233 according to the example of FIG. 6 includes character information that calls attention to the user (in the example of FIG. 6, “open attention!”).

FIG. 7 is a diagram illustrating an example of icon information (icon information 241) of a file determined to have a high degree of risk. The icon information 241 is information in which a mark 243 indicating a high degree of danger is superimposed on the reference icon 242 of the file.
FIG. 8 is a diagram illustrating an example of icon information (icon information 251) of a file determined to have a high degree of risk. The icon information 251 is information in which a mark 253 indicating a high degree of danger is superimposed on the reference icon 252 of the file.
Here, the mark 243 according to the example of FIG. 7 and the mark 253 according to the example of FIG. 8 are different marks. The mark 253 according to the example of FIG. 8 includes character information that calls attention to the user (“open danger” in the example of FIG. 8).

In the present embodiment, each of the marks 223, 233, 243, 253 may have any color. For example, the color of the mark may be different depending on the degree of danger. As a specific example, the marks 223 and 233 indicating a medium risk may have a yellow color in a large portion, and the marks 243 and 253 indicating a high risk may have a red color in a large portion. Good.

Here, in the present embodiment, a configuration in which a mark indicating a low level of danger is not displayed for a file having a low level of risk, but as another configuration example, a file having a low level of risk is shown. For the reference icon of the file, a configuration that displays a mark indicating a low degree of danger may be used.
3 to 8 show a configuration in which three levels of risk, low, medium, and high, are determined, and display is performed according to the determination result. However, as another configuration example, is there a risk? A configuration may be used in which a one-stage risk of “no” (presence / absence of danger) is determined and display is performed according to the determination result. As another configuration example, a configuration may be used in which a two-stage risk is determined and display is performed according to the determination result. As another configuration example, a configuration may be used in which the risk in four or more stages is determined and display is performed according to the determination result.

In the present embodiment, the display control unit 151 is configured to display the marks 223, 233, 243, and 253 so as to overlap the reference icons 222, 232, 242, and 252. Other arrangements may be used as the arrangement to be displayed.
For example, a configuration in which the display control unit 151 displays the mark at a position where a part of the reference icon and a part of the mark overlap may be used. The position may be one of up, down, left, right, or diagonal positions with respect to the reference icon.
For example, a configuration in which the display control unit 151 displays a mark at a position adjacent to and in contact with the reference icon may be used. The position may be one of up, down, left, right, or diagonal positions with respect to the reference icon.
For example, a configuration may be used in which the display control unit 151 displays a mark at a position near a predetermined distance from the reference icon. The position may be one of up, down, left, right, or diagonal positions with respect to the reference icon.
In addition, as a mark indicating danger, a mark including various figures or characters may be used. Various colors may be used as marks indicating danger.

Further, in the present embodiment, the configuration in which the diagnosis result output unit 112 of the control unit 34 displays the mark indicating the danger by the display control unit 151 is shown. As another configuration example, a configuration may be used in which the diagnosis result output unit 112 of the control unit 34 displays a dialog indicating information such as a warning or a warning regarding danger by the display control unit 151. As another configuration example, a configuration in which the diagnosis result output unit 112 of the control unit 34 outputs a sound (including sound) indicating danger may be used.

[Explanation of the technique to display the danger mark]
Various methods may be used as a method for the display control unit 151 to display the mark indicating the danger on the reference icon. That is, for example, any configuration may be used as long as a mark indicating danger is seen when the user visually looks at the icon.
As an example, the display control unit 151 may display a mark indicating the danger on the reference icon by rewriting (or replacing) the icon data included in the file to be displayed.

As another example, the display control unit 151 uses a configuration in which a mark indicating a danger is displayed over the reference icon without rewriting (or replacing) the icon data included in the display target file. May be.
As a specific example, instead of rewriting (or replacing) the icon data of the file itself, a configuration is used in which a mark indicating danger is displayed over the reference icon by control performed by the application displaying the icon. May be. In this case, as an example, even if the display control unit 151 provided separately from the application that displays the icon controls the application and rewrites the data of the icon by the control performed by the application (or It may be replaced). In this case, as another example, the application displaying the icon is configured to have the function of the display control unit 151, and the icon data may be rewritten (or replaced) by the control performed by the application. ) Good.

As described above, in this embodiment, instead of rewriting (or replacing) the icon data of the file itself, the icon data may be rewritten (or replaced) by the control of the application displaying the icon. Also good. Note that the application that displays the icon may be various applications, such as Explorer (registered trademark).

[Description of determination and extraction for icon data]
Here, the method for determining whether or not the file includes icon data by the file format determination unit 131 and the method for extracting icon data included in the file by the icon extraction unit 132 are not particularly limited.
As an example, when the target file is an executable file, the file format determining unit 131 can determine whether the file includes icon data based on the structure of the executable file. Further, based on the structure of the execution file, the icon extraction unit 132 can extract icon data included in the file.

FIG. 9 is a diagram showing an example of an executable file structure according to an embodiment of the present invention. The example of FIG. 9 is an example of the structure of a general execution file (EXE file). The execution file is, for example, binary information.
In the example of FIG. 9, the execution file includes a calling header structure 311 and a stub program 312, a PE header 313, and section data. Section data includes a section header 314, a text section 315, a data section 316, a resource section 317, and the like. Here, the icon data is considered to be included in, for example, the resource section 317. In this case, processing by the file format determination unit 131 and processing by the icon extraction unit 132 are performed based on the contents of the resource section 317. It may be broken.
Note that an MZ signature (a character string “MZ”) exists at the top of the executable file, and whether or not the file is an executable file may be determined according to the presence or absence of the MZ signature.

As another example, when the icon of the target file is displayed as an image, the icon extraction unit 132 may extract the icon data included in the file based on the icon image. Good. In this case, for example, the icon extraction unit 132 may perform image recognition processing to extract data corresponding to the icon image.

At present, the file holding the icon is only the executable file format, and the Windows (registered trademark) displays the icon associated with the extension of the file of the other format. However, in the future, there may be a new file format that holds icons, and the embodiment of the present invention may be applied to such a new file format.

[Explanation of diagnosis and display timing]
Arbitrary timings may be used as the timing at which the icon diagnosis unit 111 performs icon diagnosis processing.
In addition, any timing may be used as the timing for performing the icon display processing by the diagnosis result output unit 112.
As an example, the icon diagnosis process and the icon display process may be performed at independent timings.
As another example, an icon display process related to the diagnosis result may be performed at a timing when the icon diagnosis process is completed.

Here, an example of timing that can be used as timing for performing icon diagnosis processing or timing for performing icon display processing is shown.
For example, one or both of icon diagnosis processing and icon display processing may be performed at a timing when a file is opened by double-clicking or the like by an operation performed by a user in a computer. In this case, for example, the danger display may be performed before the file is opened.
For example, at a timing when a target such as a desktop or a folder is opened by an operation performed by a user in a computer, one or both of icon diagnosis processing and icon display processing may be performed on a file existing on the target. .
In this case, for example, before the target is opened, a display regarding danger may be performed. For example, a file of a program resident in the computer may be used as the file existing in the target.

For example, in a computer, when a check of a file stored in a memory is executed periodically or in a timely manner, one or both of icon diagnosis processing and icon display processing is performed for the file at the execution timing. It may be broken.
For example, in a computer, when a file attached by an e-mail is received, when a file attached by an e-mail is expanded, when a file is displayed by a web browser, or by a web browser One or both of the icon diagnosis process and the icon display process may be performed for the corresponding file at one or more timings of downloading the file.

For example, one or both of icon diagnosis processing and icon display processing may be performed on the identified file at the timing when the file is identified from communication packets transmitted over the network in the computer. In this case, for example, the control unit 34 may block transmission of a file that is determined to be dangerous or a file that is determined to have a risk exceeding a predetermined threshold.

Here, in the present embodiment, the case where the icon processing apparatus 11 is configured using a computer is shown. The computer may be, for example, a personal computer (PC) or a computer such as a router or a switch in a network.

[Description of diagnostic process using signature]
In the example of the flowchart shown in FIG. 2 and FIG. 3, diagnosis processing using an icon is shown, but a configuration in which the icon diagnosis unit 111 performs diagnosis processing using a signature may be used.
For example, the icon diagnosis unit 111 verifies the signature attached to the file to be diagnosed, and determines whether or not the certificate related to the signature is issued by a legitimate organization. If the icon diagnosis unit 111 determines that the certificate is issued by a legitimate organization, the icon diagnosis unit 111 determines that there is no risk of the file with respect to the signature. On the other hand, when the icon diagnosis unit 111 determines that the certificate is not issued from a legitimate organization, the icon diagnosis unit 111 determines that the file has a risk regarding the signature. Note that, for example, information for identifying a legitimate institution may be stored in the storage unit 33 in advance or at any time, and the icon diagnosis unit 111 may make a determination with reference to the information.

Further, the icon diagnosis unit 111 may determine the degree of risk when there is a risk of the file to be diagnosed. For example, if the icon diagnosis unit 111 determines that a certificate is not given to the file, the icon diagnosis unit 111 may determine that there is a high degree of risk regarding the signature. For example, when the icon diagnosis unit 111 determines that a self-certificate is given to the file, the icon diagnosis unit 111 may determine that there is a medium risk regarding the signature. In addition, the degree of these dangers is an example, and arbitrary degrees of danger may be used.

In the present embodiment, the icon diagnosis unit 111 performs a diagnosis process using a signature together with a diagnosis process using an icon for a diagnosis target file, and based on the result of each diagnosis process, Alternatively, the overall risk level may be determined. Note that, for example, the correspondence between each diagnosis processing result and the overall risk level or the overall risk level is stored in the storage unit 33 in advance or at any time, and the icon diagnosis unit 111 refers to the correspondence. A determination may be made.

[Description of diagnostic processing using whitelist]
In the example of the flowchart shown in FIG. 2 and FIG. 3, diagnosis processing using icons is shown, but the icon diagnosis unit 111 may be configured to perform diagnosis processing using a white list.
The white list is stored in the storage unit 33. The white list includes information regarding a file to be determined as having no risk. The information related to the file may include, for example, one or more information of the file name, the file size, the file icon, and the like.
Even when the icon diagnosis unit 111 determines that the file to be diagnosed is dangerous in the result of the diagnosis process using the icon, if the information on the file is included in the white list, the risk is Judge that there is no.

[Summary of the above embodiments]
As described above, the icon processing apparatus 11 according to the present embodiment can detect malware in which an icon is camouflaged by performing icon diagnosis processing on a diagnosis target file. Thereby, in the icon processing apparatus 11, for example, it is possible to easily find malware that is difficult for a user to identify as malware.
Thus, in the icon processing apparatus 11 according to the present embodiment, it is possible to accurately diagnose whether or not the icon is a disguised malware.

Further, in the icon processing apparatus 11 according to the present embodiment, there is a danger or a more detailed degree of danger by performing an icon display process using a mark indicating danger on the display target file. Can be shown in the icon. Thereby, in the icon processing apparatus 11, it can be recognized that there is a danger at a glance by the user by the appearance of the icon. For example, even if the user has little knowledge of computers or malware, the user can grasp the presence or absence of the displayed icon file or the more detailed degree of danger, and do not open the dangerous file. Measures such as making it possible are possible.
Thus, in the icon processing apparatus 11 according to the present embodiment, it is possible to display that the icon is a camouflaged malware in a manner that is easy for the user to distinguish.

As one configuration example, a file format determination unit (file format determination unit 131 in the example of FIG. 1) that determines the format of a diagnosis target file, and an icon extraction unit (example of FIG. 1) that extracts an icon of the diagnosis target file. Then, the icon extraction unit 132) compares the icon extracted by the icon extraction unit with the reference icon corresponding to the format determined by the file format determination unit, the icon extracted by the icon extraction unit, and the file Based on the result of the comparison by the icon comparison unit (icon comparison unit 133 in the example of FIG. 1) that compares a reference icon other than the reference icon corresponding to the format determined by the format determination unit, and the comparison result by the icon comparison unit. An icon diagnosis device (example in FIG. 1), and a risk determination unit (in the example in FIG. 1, risk determination unit 134) Is an icon processor 11).
As an example of the configuration, in the icon diagnosis apparatus, the icon comparison unit compares the icon extracted by the icon extraction unit with the reference icon corresponding to the format determined by the file format determination unit, and determines the degree of divergence between the two. get.
As an example of the configuration, in the icon diagnosis apparatus, the icon comparison unit compares the icon extracted by the icon extraction unit with a reference icon other than the reference icon corresponding to the format determined by the file format determination unit. Get the similarity of.
As an example of the configuration, in the icon diagnosis apparatus, the risk determination unit performs determination regarding the degree of risk.
As an example of the configuration, in the icon diagnosis apparatus, the degree of risk is that there is a risk, or the degree of risk is two or more stages.
As an example of the configuration, in the icon diagnosis apparatus, the risk determination unit performs the risk determination based on the determination result regarding the signature attached to the diagnosis target file and the comparison result by the icon comparison unit.

As one configuration example, the icon diagnosis apparatus determines the format of the diagnosis target file, the icon diagnosis apparatus extracts the icon of the diagnosis target file, and the icon diagnosis apparatus determines the extracted icon and the determined format. The icon diagnosis device compares the extracted icon with a reference icon other than the reference icon corresponding to the determined format, and the icon diagnosis device determines the risk based on the comparison result. Is an icon diagnosis method (in the example of FIG. 1, a method of processing performed by the icon processing device 11).
As one configuration example, the step of determining the format of the file to be diagnosed, the step of extracting the icon of the file to be diagnosed, comparing the extracted icon with a reference icon corresponding to the determined format, A program for causing a computer to execute a step of comparing an extracted icon with a reference icon other than the reference icon corresponding to the determined format, and a step of making a determination regarding danger based on a result of the comparison ( In the example of FIG. 1, the program is executed by the icon processing device 11.
As one configuration example, an icon extraction unit that extracts an icon of a diagnosis target file, an icon extracted by the icon extraction unit, and a first reference icon are compared, and an icon extracted by the icon extraction unit; An icon diagnostic apparatus comprising: an icon comparison unit that compares a second reference icon other than the first reference icon.
As an example of the configuration, the icon diagnosis apparatus includes a risk determination unit that performs a risk determination based on a result of comparison by the icon comparison unit.
As an example of the configuration, the icon diagnosis apparatus includes a file format determination unit that determines the format of a file to be diagnosed, and the icon comparison unit includes an icon extracted by the icon extraction unit and a format determined by the file format determination unit Is compared with the first reference icon corresponding to the icon, and the icon extracted by the icon extraction unit is compared with the second reference icon.
As an example of the configuration, the icon diagnosis device extracts an icon of a file to be diagnosed, the icon diagnosis device compares the extracted icon with the first reference icon, and extracts the extracted icon and the first This is an icon diagnosis method for comparing with a second reference icon other than the reference icon.
As one configuration example, a step of extracting an icon of a file to be diagnosed, comparing the extracted icon and the first reference icon, and extracting the extracted icon and a second other than the first reference icon A program for causing a computer to execute a step of comparing with a reference icon.

As one configuration example, an icon extraction unit that extracts an icon of a diagnosis target file, a file format determination unit that determines the format of the diagnosis target file, an icon extracted by the icon extraction unit, and a file format determination unit An icon comparison unit that compares a first reference icon that is a reference icon corresponding to the format that has been created, and that compares an icon extracted by the icon extraction unit with a second reference icon other than the first reference icon And an icon diagnostic device.
As one configuration example, the icon diagnosis device extracts an icon of a diagnosis target file, the icon diagnosis device determines the format of the diagnosis target file, and the icon diagnosis device determines the extracted icon and the determined format. Is compared with the first reference icon corresponding to the icon, and the extracted icon is compared with a second reference icon other than the first reference icon.
As one configuration example, a step of extracting an icon of a diagnosis target file, a step of determining a format of the diagnosis target file, an extracted icon, and a first reference that is a reference icon corresponding to the determined format A program for causing a computer to execute a step of comparing an icon and comparing an extracted icon with a second reference icon other than the first reference icon.

As in this embodiment, a program for realizing the function of the device (for example, the icon processing device 11) according to the above-described embodiment is recorded (stored) in a computer-readable recording medium (storage medium). The processing may be performed by causing the computer system to read and execute the program recorded on the recording medium.
Here, the “computer system” may include an operating system (OS) or hardware such as a peripheral device.
The “computer-readable recording medium” means a flexible disk, a magneto-optical disk, a ROM (Read Only Memory), a writable nonvolatile memory such as a flash memory, a portable medium such as a DVD (Digital Versatile Disk), A storage device such as a hard disk built in a computer system.
Further, the “computer-readable recording medium” refers to a volatile memory (for example, DRAM (DRAM)) inside a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. And a program that holds a program for a certain period of time, such as Dynamic Random Access Memory)).
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
Further, the above program may be for realizing a part of the functions described above. Further, the above program may be a so-called difference file (difference program) that can realize the above-described functions in combination with a program already recorded in the computer system.

Although the present invention has been described using the embodiment, the technical scope of the present invention is not limited to the above embodiment. It will be apparent to those skilled in the art that various modifications and alternative embodiments can be made without departing from the spirit and scope of the invention.

DESCRIPTION OF SYMBOLS 11 ... Icon processing apparatus 31 ... Input part 32 ... Output part 33 ... Storage part 34 ... Control part 71 ... Display part 91 ... File information 92 ... File format list 93 ... Standard icon list 111 ... Icon diagnosis part 112 ... Diagnosis result output part 131 ... File format determination unit 132 ... Icon extraction unit 133 ... Icon comparison unit 134 ... Risk determination unit 151 ... Display control unit 211, 221, 231, 241, 251 ... Icon information 212, 222, 232, 242, 252 ... Reference icon 223, 233, 243, 253 ... mark

Claims (9)

1. An icon extractor for extracting an icon of a file to be diagnosed;
   A file format determination unit for determining the format of the diagnosis target file;
   The icon extracted by the icon extraction unit is compared with the first reference icon which is a reference icon corresponding to the format determined by the file format determination unit, and the icon extracted by the icon extraction unit And an icon comparison unit that compares a second reference icon other than the first reference icon;
   An icon diagnostic apparatus comprising:
2. The icon comparison unit compares the icon extracted by the icon extraction unit with the first reference icon and acquires a degree of divergence between the icons.
   The icon diagnosis apparatus according to claim 1.
3. The icon comparison unit compares the icon extracted by the icon extraction unit with the second reference icon, and obtains a similarity between them.
   The icon diagnostic apparatus of any one of Claim 1 or Claim 2.
4. Based on the result of comparison by the icon comparison unit, a risk determination unit that performs a risk determination is provided.
   The icon diagnostic apparatus of any one of Claims 1-3.
5. The risk determination unit performs a determination regarding the degree of risk,
   The icon diagnosis apparatus according to claim 4.
6. The degree of the danger is that there is the danger, or is a degree of two or more stages of the danger,
   The icon diagnosis apparatus according to claim 5.
7. The risk determination unit performs a risk determination based on a determination result regarding a signature given to the diagnosis target file and a comparison result by the icon comparison unit.
   The icon diagnostic apparatus of any one of Claims 4-6.
8. The icon diagnostic device extracts the icon of the file to be diagnosed,
   The icon diagnostic device determines the format of the file to be diagnosed,
   The icon diagnostic device compares the extracted icon with a first reference icon that is a reference icon corresponding to the determined format, and the extracted icon and the other than the first reference icon Compare with the second reference icon,
   Icon diagnostic method.
9. Extracting a file icon to be diagnosed;
   Determining the format of the file to be diagnosed;
   The extracted icon is compared with a first reference icon that is a reference icon corresponding to the determined format, and the extracted icon and a second reference icon other than the first reference icon A step of comparing
   A program that causes a computer to execute.

Images