Malware analysis device, malware analysis method, and malware analysis system

Abstract

To provide a malware analysis device, a malware analysis method, and a malware analysis system which, when analyzing a malware by combining dynamic analysis with static analysis, compare the cases of using and not using the configuration, so as to facilitate the analysis of the malware.SOLUTION: A malware analysis device includes: an analysis section for dynamically and statically analyzing a malware as an analysis object; a conversion section for converting an analysis result by the dynamic and static analyses into natural language so as to generate a descriptive text of the analysis result; and a generation section for generating information on behavior of the malware as an analysis object, which is obtained by comparing each descriptive text by the dynamic and static analyses.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a malware analysis device, a malware analysis method, and a malware analysis system, and more particularly to a malware analysis device and the like that are suitable for supporting an analyst in analyzing malware. [Background technology]

[0002] One malware analysis method is dynamic analysis, in which the malware is actually run, its behavior is recorded, and then analyzed. This analysis method is widely used because it can be performed semi-automatically, allowing for efficient analysis. Another malware analysis method is static analysis, in which the malware code is decoded and the behavior of the malware is revealed. Although this analysis method requires time and expertise, it is generally known to allow for more detailed analysis. Furthermore, there are attempts to analyze malware in more detail and at a higher level by combining dynamic analysis and static analysis.

[0003] Patent Document 1 describes that the observation device includes a data observation unit that collects information on user access to Web pages, and a transmission / reception unit that transmits the collected information to an analysis device. The analysis device includes a transmission / reception unit that receives the transmitted information, an analysis unit that detects a specific page transition method based on the received information and determines the maliciousness of content downloaded from access to a Web page based on the detection result of the specific page transition method, and an information request unit that determines that only content that is determined by the analysis unit to be suspected of being malicious is to be analyzed.

[0004] Non-Patent Document 1 describes a technology that supports static analysis by linking API calls to disassembled code based on the results of dynamic analysis, acquiring files and code that malware has deployed in memory, etc. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2016-45887 A [Non-patent literature]

[0006] [Non-Patent Document 1] Shota Nakajima, Hayato Otsuki, Shuhei Akeda, Eiji Takimoto, Shoichi Saito, and Koichi Mouri: A static analysis support method using dynamic analysis logs, Transactions of Information Processing Society of Japan, Vol. 59, No. 2, pp. 800-811 (2018). Summary of the Invention [Problem to be solved by the invention]

[0007] On the other hand, since static analysis and dynamic analysis use different target formats, it is not easy to combine them. Therefore, analyzing malware by combining dynamic and static analysis requires a high level of expertise and time. The present invention aims to provide a malware analysis device, a malware analysis method, and a malware analysis system that can analyze malware more easily by combining dynamic analysis and static analysis compared to a case where this configuration is not adopted. [Means for solving the problem]

[0008] In order to solve the above problems, the present invention provides a malware analysis device comprising an analysis unit that performs dynamic and static analysis of malware to be analyzed, a conversion unit that converts the analysis results from the dynamic and static analyses into natural language and generates an explanatory text for the analysis results, and a generation unit that generates information about the behavior of the malware to be analyzed, which is obtained by comparing the explanatory texts from the dynamic and static analyses.In this case, it is possible to provide a malware analysis device that can more easily analyze malware when analyzing malware by combining dynamic and static analyses, compared to a case where the present configuration is not adopted.

[0009] Here, for example, the generation unit generates information to assist the analyst in analyzing the malware as information regarding the behavior of the malware to be analyzed. In this case, more specific information can be presented to the analyst who analyzes the malware. In addition, for example, the generation unit generates, as information on the behavior of the malware to be analyzed, information on suggestions for an analyst to analyze the malware to be analyzed. In this case, analysis suggestions can be given to the analyst who analyzes the malware. Furthermore, for example, the generation unit generates information about the behavior of the malware to be analyzed based on the difference between the explanatory texts obtained by the dynamic analysis and the static analysis. In this case, information about the behavior of the malware that appears in either the dynamic analysis or the static analysis can be extracted. Furthermore, for example, the generation unit generates information regarding the behavior of the malware to be analyzed that is obtained by the difference and recommends parts of the malware to be analyzed by the analyst. In this case, it becomes easy for the analyst to identify the parts to be analyzed. Then, for example, the generation unit recommends, based on the difference, the parts whose behavior was not revealed in the dynamic analysis as the parts to be statically analyzed as information on the behavior of the malware to be analyzed. In this case, even those whose behavior was not revealed in the dynamic analysis due to conditional branching or the like can be targeted for analysis. In addition, for example, the generating unit generates information indicating that the malware to be analyzed is a candidate for evading analysis. In this case, even if the malware has a function to detect and evade analysis, the analyst can know that the malware has this function. Furthermore, for example, the generating unit generates information that recommends processes in the vicinity of the portion to be statically analyzed as processes related to preparation for analysis avoidance. In this case, the generating unit can also analyze the processes related to preparation for analysis avoidance. Furthermore, for example, when there is no information obtained from the static analysis results with respect to the dynamic analysis results, the generation unit generates information on the possibility that the code may have been obfuscated as information on the behavior of the malware to be analyzed. In this case, even if the malware has obfuscated its code, the analyst can grasp this. Then, for example, the generation unit compares the analysis results from static analysis with each other and / or the analysis results from dynamic analysis with each other to generate information about the behavior of the malware to be analyzed. In this case, it is possible to analyze the malware from different perspectives. The generation unit also detects functional extensions of the malware to be analyzed by comparing the analysis results of static analysis of different malware to be analyzed. In this case, it is possible to know that the malware has been upgraded. Furthermore, for example, the generation unit compares analysis results of the same malware by dynamic analysis when the environment is changed, and extracts environments in which the behavior is manifested as environments to be attacked and / or environments in which the behavior is not manifested as environments to be avoided. In this case, it is possible to grasp the environment in which the malware operates.

[0010] The present invention also provides a malware analysis method that performs dynamic and static analysis of malware to be analyzed by having a processor execute a program recorded in a memory, converts the analysis results from the dynamic and static analyses into natural language, generates an explanatory text for the analysis results, and generates information about the behavior of the malware to be analyzed by comparing the explanatory texts from the dynamic and static analyses. In this case, it is possible to provide a malware analysis method that allows malware analysis to be performed more easily when malware analysis is performed by combining dynamic and static analyses, compared to a case in which the present configuration is not adopted.

[0011] Furthermore, the present invention is a malware analysis system having a malware analysis device that analyzes malware to be analyzed, and a display device that displays the analysis results of the analysis of the malware to be analyzed to an analyst, the malware analysis device including an analysis unit that performs dynamic analysis and static analysis of the malware to be analyzed, a conversion unit that converts the analysis results of the dynamic analysis and static analysis into natural language and generates an explanatory text for the analysis results, and a generation unit that generates information about the behavior of the malware to be analyzed, which is obtained by comparing the explanatory texts from the dynamic analysis and the static analysis. In this case, it is possible to provide a malware analysis system that can more easily analyze malware when analyzing malware by combining dynamic analysis and static analysis, compared to a case where the present configuration is not adopted. Effect of the Invention

[0012] According to the present invention, it is possible to provide a malware analysis device, a malware analysis method, and a malware analysis system that can analyze malware more easily by combining dynamic analysis and static analysis compared to a case in which this configuration is not adopted. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of a malware analysis system according to a first embodiment. [Diagram 2] FIG. 13 is a diagram illustrating an example of a malware list. [Diagram 3] FIG. 11 is a diagram illustrating an example of an analysis result list. [Figure 4] FIG. 11 is a diagram showing an example of a list of analysis support results. [Diagram 5] 4 is a flowchart outlining the processing executed by the malware analysis support system in the first embodiment. [Figure 6] 7 is a flowchart illustrating an example of a dynamic analysis process of malware executed by the malware analysis support system in step S501 of FIG. 5. [Figure 7]7 is a flowchart illustrating an example of a malware static analysis process executed by the malware analysis support system in step S502 of FIG. 5. [Figure 8] 7 is a flowchart illustrating an example of an analysis log conversion process executed by the malware analysis support system in step S503 of FIG. 5. [Figure 9] 7 is a flowchart illustrating an example of an analysis support process executed by the malware analysis support system in step S504 of FIG. 5. [Figure 10] 11 is a flowchart illustrating an example of a screen depiction process executed by the malware analysis support system. [Figure 11] This is an example of a malware analysis support system depiction screen generated by a screen depiction program. [Figure 12] FIG. 11 is a diagram illustrating an example of the configuration of a malware analysis system according to a second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. However, the present invention is not to be interpreted as being limited to the description of the embodiment shown below. It will be easily understood by those skilled in the art that the specific configuration can be changed without departing from the concept or purpose of the present invention. In the configurations of the invention described below, the same or similar configurations or functions are given the same reference numerals, and duplicated explanations are omitted. In this specification, the terms "first," "second," "third," and the like are used to identify components and do not necessarily limit the number or order. In order to facilitate understanding of the invention, the position, size, shape, range, etc. of each component shown in the drawings, etc. may not represent the actual position, size, shape, range, etc. Therefore, the present invention is not limited to the position, size, shape, range, etc. disclosed in the drawings, etc.

[0015] [First embodiment] In the first embodiment, we will show the processing of a malware analysis support system that converts both static analysis data and dynamic analysis data into explanations in natural language, compares the two, and cooperates with them to support malware analysis. This makes it possible to reduce the operational costs and personal dependency of malware analysis.

[0016] <Overall explanation of Malware Analysis System 1> FIG. 1 is a diagram showing an example of the configuration of a malware analysis system 1 according to the first embodiment. In the malware analysis system 1 according to this embodiment, a malware analysis support system 101 that supports malware analysis, user terminals (user terminals A to X) 117a to 117c operated by users, and the Internet 119 are connected via networks 118a and 118b. The malware analysis support system 101 is also connected to an input / output device 106 used by an analyst.

[0017] The malware analysis support system 101 is an example of a malware analysis device that analyzes malware to be analyzed. The malware analysis support system 101 is a computer device such as a server computer, a PC (Personal Computer), a smartphone, or a tablet. The malware analysis support system 101 includes a CPU (Central Processing Unit) 103, which is an example of a processor, a main memory 104 for storing data required for the CPU 103 to execute processing, a storage device 105 such as a hard disk or a flash memory having a capacity for storing a large amount of data, IFs (Interfaces) 102a and 102b for communicating with other devices, and a communication path 107 that connects these devices. The communication path 107 is, for example, an information transmission medium such as a bus or a cable.

[0018] The CPU 103 analyzes malware to be analyzed by executing a predetermined program stored in the main memory 104. In this embodiment, the main memory 104 stores a dynamic analysis program 108, a static analysis program 109, an analysis log conversion program 110, an analysis support program 111, and a screen depiction program 112. The CPU 103 executes the dynamic analysis program 108 to perform dynamic analysis of the malware to be analyzed. The CPU 103 also executes the static analysis program 109 to perform static analysis of the malware to be analyzed. The CPU 103 also executes the analysis log conversion program 110 to convert each analysis result into an explanation in natural language, and creates an analysis log of the malware. The CPU 103 also executes the analysis support program 111 to analyze the created analysis log, and generates information to support the analyst in analyzing the malware to be analyzed, as information on the behavior of the malware to be analyzed. At this time, the CPU 103 generates, for example, information on the behavior of the malware to be analyzed, suggesting the target of the analyst to analyze the malware to be analyzed. The CPU 103 then executes the screen drawing program 112 to output display information to the input / output device 106 in order to present each analysis result to the analyst.

[0019] The storage device 105 stores data used when executing the above programs and data obtained as a result of the execution. The storage device 105 stores data on a malware list 113 that manages malware information, an analysis result storage area 114 that stores dynamic analysis results and static analysis results of malware, an analysis result list 115 that manages each analysis result of malware, and an analysis support result list 116 that manages analysis support results of malware. The above programs and data may be stored in advance in the main memory 104 or the storage device 105, or may be obtained when needed from the input / output device 106, or may be installed (loaded) from other devices via IFs 102a and 102b.

[0020] The user terminals 117a to 117c are terminal devices operated by analysts who analyze malware. The user terminals 117a to 117c are also computer devices such as PCs, smartphones, and tablets, and have the same configuration as the malware analysis support system 101. That is, they are configured with a CPU, an in-memory, a storage device, an IF, a communication path, and the like.

[0021] The networks 118a and 118b are examples of communication networks used for information communication. For example, a LAN (Local Area Network), Bluetooth (registered trademark), infrared communication, etc. can be used as the networks 118a and 118b. Note that the networks 118a and 118b and the Internet 119 are not strictly distinguished from each other, and either one of them may be used. Moreover, regardless of whether the communication is wired or wireless, these may be used in combination. Furthermore, a gateway device, a router, or other relay device may be used to connect via multiple networks or communication lines.

[0022] The input / output device 106 is an input device used by the user to input characters and the like, and an output device on which images and other information are displayed. Examples of input devices include a keyboard, mouse, and touch pad. Examples of output devices include a liquid crystal display and an organic EL (Electro Luminescent) display. When the input / output device 106 is an output device, it functions as a display device that displays to the analyst the analysis results of the analysis of the malware to be analyzed. The input / output device 106 may be a touch panel that combines the functions of both an input device and an output device.

[0023] Note that the configurations of the malware analysis system 1 and the malware analysis support system 101 described in FIG. 1 are merely examples and are not limited to these.

[0024] FIG. 2 is a diagram showing an example of the malware list 113. As shown in FIG. As shown in FIG. 2, the malware list 113 includes, for example, a malware ID 201, a registration date and time 202, a file name 203, and a hash value 204. The malware ID 201 is a field for storing identification information for uniquely identifying malware to be analyzed. In the malware ID 201 of the first embodiment, numbers such as "0" and "1" are stored as identification information. The registration date and time 202 indicates the date and time when the malware was registered in the system. For example, the malware corresponding to an entry with the malware ID 201 of "0" indicates that it was registered at 10:00:00 on Jan. 1, 2023. Note that in this embodiment, the data format of the time stored in the registration date and time 202 is not particularly limited. For example, any data format such as Unixtime may be used as the registration date and time 202 as long as it is a data format in which the time can be determined.

[0025] The file name 203 is a field for storing the file name of the malware to be analyzed. For example, the file name of the malware corresponding to the entry with the malware ID 201 of "0" is "example.exe". The hash value 204 is a field for storing the hash value of the malware to be analyzed. For example, the hash value of the malware corresponding to the entry with the malware ID 201 of "0" is "44D88612FEA8A8F36DE82E1278ABB02F." Note that the malware list 113 described in FIG. 2 is just an example and is not limited to this.

[0026] FIG. 3 is a diagram showing an example of the analysis result list 115. As shown in FIG. As shown in FIG. 3, the analysis result list 115 includes, for example, a malware ID 301, an analysis date and time 302, a dynamic analysis result path 303, a dynamic analysis explanation 304, a static analysis result path 305, and a static analysis explanation 306. The malware ID 301 is a field for storing identification information for uniquely identifying the malware to be analyzed. In the malware ID 301 of the first embodiment, numbers such as "0" and "1" are stored as identification information. The analysis date and time 302 indicates the date and time when the malware was analyzed by the system. For example, the malware corresponding to the entry with the malware ID 301 of "0" was analyzed at 10:00:00 on Jan. 1, 2023. Note that in this embodiment, the data format of the time stored in the analysis date and time 302 is not particularly limited. For example, any data format such as Unixtime may be used as the analysis date and time 302 as long as the data format allows the time to be determined.

[0027] The dynamic analysis result path 303 indicates a path in the analysis result storage area 114 in which the results of dynamic analysis of malware are stored. For example, it indicates that the results of dynamic analysis of malware with the malware ID 301 of "0" are stored in " / dynamic_analysis / 0 / result.json". The dynamic analysis explanation 304 indicates the content explaining the result of dynamic analysis of the malware. For example, the explanation obtained from the result of dynamic analysis of the malware with the malware ID 301 of "0" indicates that "This malware first connects to example[.]com. Then it terminates processing."

[0028] The static analysis result path 305 indicates a path in the analysis result storage area 114 in which the results of static analysis of malware are stored. For example, it indicates that the results of static analysis of malware with the malware ID 301 of "0" are stored in " / static_analysis / 0 / result.txt." The static analysis explanation 306 indicates the content explaining the result of static analysis of the malware. For example, the explanation obtained from the result of static analysis of the malware with the malware ID 301 of "0" indicates that "This malware first connects to example[.]com. Then it creates a file called hoge.dat and executes it by WMIC. Then it terminates the process." The analysis result list 115 described in FIG. 3 is just an example, and the present invention is not limited to this.

[0029] FIG. 4 is a diagram showing an example of the analysis support result list 116. As shown in FIG. As shown in FIG. 4, the analysis support result list 116 includes, for example, a malware ID 401, an analysis date and time 402, and a support result 403. The malware ID 401 is a field for storing identification information for uniquely identifying malware to be analyzed. In the malware ID 401 of the first embodiment, numbers such as "0" and "1" are stored as identification information. Analysis date and time 402 indicates the date and time when the malware was analyzed by the system. For example, malware corresponding to an entry with malware ID 401 of "0" was analyzed at 12:00:00 on Jan. 1, 2023. Note that in this embodiment, the data format of the time stored in analysis date and time 402 is not particularly limited. For example, any data format such as Unixtime may be used for analysis date and time 402 as long as it is a data format in which the time can be determined.

[0030] Support result 403 is a field that stores support content that contributes to analysis by performing analysis based on the results of dynamic analysis and static analysis of the malware to be analyzed. For example, one of the support contents for the malware corresponding to the entry with malware ID 401 of "0" is "The following is only in static analysis and may be malicious behavior that has not been manifested. After that, a file called hoge.dat will be generated and executed by WMIC." It also indicates that the support content includes "There is a large difference between static analysis and dynamic analysis, and the behavior may not be manifested due to an analysis prevention function, etc." These support results are generated by the analysis support program 111, which will be described later. The analysis support result list 116 described in FIG. 4 is just an example, and the present invention is not limited to this.

[0031] <Description of the process performed by the malware analysis support system 101> Next, the processing executed by the malware analysis support system 101 will be described. FIG. 5 is a flowchart outlining the processing executed by the malware analysis support system 101 in the first embodiment. First, the malware analysis support system 101 performs dynamic analysis of the malware (step S501). Details of step S501 will be described with reference to FIG. Next, the malware analysis support system 101 performs a static analysis of the malware (step S502). Details of step S502 will be described with reference to FIG. Next, the malware analysis support system 101 converts the results of the dynamic analysis and the static analysis into an analysis log in natural language (step S503). Details of step S503 will be described with reference to FIG. Finally, the malware analysis support system 101 performs analysis support based on the explanation converted in the previous step S503 (step S504). Details of step S504 will be described with reference to FIG. Note that the processing flow of the malware analysis support system 101 described in FIG. 5 is just an example and is not limited to this.

[0032] FIG. 6 is a flowchart illustrating an example of dynamic malware analysis processing executed by the malware analysis support system 101 in step S501 of FIG. When the dynamic analysis program 108 executed by the CPU 103 receives an execution instruction, it starts the process described below. The dynamic analysis program 108 receives malware to be analyzed from a user (step S601). Next, the dynamic analysis program 108 performs dynamic analysis of the malware received in step S601 (step S602). For example, the dynamic analysis program 108 actually runs the malware for a certain period of time and obtains information on the malware's connection destinations, running processes, generated files, and the like. Next, the dynamic analysis program 108 stores the dynamic analysis result of the malware obtained in step S602 in the analysis result storage area 114 (step S603). Next, the dynamic analysis program 108 records the storage path of the dynamic analysis results of the malware stored in step S603 in the dynamic analysis result path 303 of the analysis result list 115, and ends the process (step S604). The method of dynamic analysis processing described in Fig. 6 is an example, and is not limited to this. Furthermore, the dynamic analysis result of the malware may be obtained and recorded from a source other than the dynamic analysis program 108. For example, the result may be obtained from an external malware analysis system or malware analysis service.

[0033] FIG. 7 is a flowchart illustrating an example of the malware static analysis process executed by the malware analysis support system 101 in step S502 of FIG. When the static analysis program 109 executed by the CPU 103 receives an execution instruction, it starts the process described below. The static analysis program 109 receives malware to be analyzed from a user (step S701). Next, the static analysis program 109 performs a static analysis of the malware received in step S701 (step S702). The static analysis program 109, for example, disassembles or decompiles the malware binary to obtain information such as an assembler or source code.

[0034] Next, the static analysis program 109 stores the static analysis result of the malware obtained in step S702 in the analysis result storage area 114 (step S703). Next, the static analysis program 109 records the storage path of the static analysis results of the malware stored in step S703 in the static analysis result path 305 of the analysis result list 115, and ends the process (step S704). 7 is an example of the static analysis process, and is not limited thereto. The static analysis result of the malware may be obtained and recorded from a source other than the static analysis program 109. For example, the result may be obtained from an external malware analysis system or malware analysis service.

[0035] FIG. 8 is a flowchart illustrating an example of the analysis log conversion process executed by the malware analysis support system 101 in step S503 of FIG. When an execution instruction is received, the analysis log conversion program 110 executed by the CPU 103 starts the process described below. The analysis log conversion program 110 acquires the analysis results of the dynamic analysis and the static analysis from the analysis result list 115 (step S801). Next, the analysis log conversion program 110 generates an explanatory text based on the dynamic analysis result of the malware acquired in step S801 (step S802). The analysis log conversion program 110 receives, for example, the malware dynamic analysis log as input, and generates an explanatory text in natural language using a large-scale language model or the like.

[0036] Next, the analysis log conversion program 110 generates an explanatory text based on the static analysis result of the malware acquired in step S801 (step S803). The analysis log conversion program 110 receives, for example, an assembler obtained by disassembling the malware or a source code obtained by decompiling the malware as input, and generates an explanatory text in natural language using a large-scale language model or the like. Next, analysis log conversion program 110 records the dynamic analysis-based explanation generated in step S802 in dynamic analysis explanation 304 of analysis result list 115. In addition, analysis log conversion program 110 records the static analysis-based explanation generated in step S803 in static analysis explanation 306 of analysis result list 115, and ends the process (step S804). The method of analysis log conversion processing described with reference to FIG. 8 is just an example, and the present invention is not limited to this.

[0037] FIG. 9 is a flowchart illustrating an example of the analysis support process executed by the malware analysis support system 101 in step S504 of FIG. When an execution instruction is received, the analysis support program 111 executed by the CPU 103 starts the process described below. The analysis support program 111 acquires a dynamic analysis-based explanation from the dynamic analysis explanation 304 of the analysis result list 115. In addition, the analysis support program 111 acquires a static analysis-based explanation from the static analysis explanation 306 of the analysis result list 115 (step S901). Next, the analysis support program 111 compares the results of the dynamic analysis and static analysis obtained in step S901 (step S902). For example, the analysis support program 111 finds the difference between the two and extracts behaviors included only in the dynamic analysis results and operations included only in the static analysis results.

[0038] Next, the analysis support program 111 generates an analysis support result based on the comparison result in step S902 (step S903). This can also be said that the analysis support program 111 generates information for supporting an analyst in analyzing the malware to be analyzed as information on the behavior of the malware to be analyzed. It can also be said that the analysis support program 111 generates information on the behavior of the malware to be analyzed based on the difference between the explanatory texts obtained by the dynamic analysis and the static analysis. The analysis support program 111 generates information on the behavior of the malware to be analyzed, which is obtained from the difference, and recommends a part of the malware to be analyzed by the analyst as information on the behavior of the malware to be analyzed. Specifically, the analysis support program 111 recommends, for example, a behavior included only in the static analysis result as a part to be statically analyzed, assuming that the behavior was not manifested in the dynamic analysis due to conditional branching or the like. In addition, the analysis support program 111 extracts a specimen having such a difference as a candidate for an analysis evasion specimen (a specimen that does not operate by detecting the analysis environment, or a specimen that operates only under a specific environment or situation). In this case, it can be said that the analysis support program 111 generates information indicating that the malware to be analyzed is a candidate for evasion behavior. The analysis support program 111 then recommends the surrounding processing as processing related to preparation for evasion. In addition, the analysis support program 111 extracts and presents behaviors included only in the results of dynamic analysis as code not included in the sample (e.g., code that is additionally downloaded from an attacker's server and executed). When statically analyzing such code, it is necessary to separately extract the code from a memory dump or the like at the time of dynamic analysis, but the analysis support program 111 suggests whether or not such code is extracted and the range of the code that is included. In addition, if there is no information obtained from the static analysis results for the dynamic analysis results, support such as suggesting the possibility that the static analysis has failed due to code obfuscation can be considered. Next, the analytical support program 111 records the analytical support result generated in step S903 in the analytical support result list 116, and ends the process (step S904).

[0039] The method of analysis support processing described in Fig. 9 is an example, and is not limited to this. For example, in addition to static analysis and dynamic analysis, it is possible to perform more advanced analysis by combining other actors such as analysis articles for the same sample. Also, comparative analysis is possible not only between different actors, but also within the same actor (between static analysis results or dynamic analysis results). That is, the analysis support program 111 compares the analysis results by static analysis or the analysis results by dynamic analysis to generate information about the behavior of the malware to be analyzed. For example, the analysis support program 111 compares the static analysis results for different specimens of the same malware family, and if there is a difference, suggests the possibility that an upgrade has been made and presents the difference in function. In this case, the analysis support program 111 detects functional extensions of the malware to be analyzed by comparing the analysis results by static analysis for different malware to be analyzed. Furthermore, when dynamic analysis results obtained by running the same malware sample in multiple different environments are compared and there is a large difference, the environment in which the behavior was manifested is extracted as the environment to be attacked, and the environment in which the behavior was not manifested is extracted as the environment to be avoided. In this case, the analysis support program 111 extracts the environment in which the behavior was manifested as the environment to be attacked, and the environment in which the behavior was not manifested as the environment to be avoided, by comparing the analysis results of dynamic analysis of the same malware to be analyzed when the environment is changed. Furthermore, this method can be applied not only to malware analysis, but also to similar security tasks such as memory forensics (analyzing evidence and operation logs left in memory) and software analysis (for example, analyzing the binaries and operation logs of a program whose specifications have been lost).

[0040] <Explanation of screen depiction process> Following the processing described in FIG. 5, the malware analysis support system 101 executes a screen rendering process for displaying various information to the user. FIG. 10 is a flowchart illustrating an example of a screen depiction process executed by the malware analysis support system 101. When an execution instruction is received, the screen rendering program 112 executed by the CPU 103 starts the process described below. The screen drawing program 112 acquires information related to the malware to be drawn from the malware list 113 (step S1001). Here, it is assumed that a list including an entry configured from the malware ID 201 is acquired. The screen rendering program 112 acquires information related to the malware to be rendered from the analysis result list 115 (step S1002). Here, it is assumed that a list including an entry configured from the malware ID 301 is acquired. The screen rendering program 112 acquires information related to the malware to be rendered from the analysis support result list 116 (step S1003). Here, it is assumed that a list including an entry configured from the malware ID 401 is acquired. The screen drawing program 112 draws the information about the malware to be drawn on the screen (step S1004), and ends the process. It should be noted that the method of depicting the screen described with reference to FIG. 10 is merely an example and is not limiting.

[0041] FIG. 11 is an example of a malware analysis support system depiction screen generated by the screen depiction program 112. The screen in FIG. 11 includes a malware summary 1101 and a malware analysis support result 1102 . The malware summary 1101 is basic information about the malware to be depicted, including, for example, the malware ID, the registration date and time, the file name, the hash value, a dynamic analysis description, and a static analysis description. The malware analysis support result 1102 is the support result regarding the analysis of the malware. For example, it includes the malware ID, the analysis date and time, and the support result. In addition, it is also possible to provide support such as displaying a dynamic analysis explanation and a static analysis result, and visually showing the common parts of both. As described above, by displaying the analysis support results for the malware in question, it is expected that the display will provide support to analysts and other users when analyzing malware. Note that, although the display screen based on the execution results of each program according to the first embodiment is illustrated here, it is merely an example and is not limited thereto. For example, any information related to malware analysis may be displayed in any format.

[0042] While malware analysis is an important part of security work, it is generally performed manually, resulting in high operational costs and dependency on the skills of the individual. Furthermore, while efficient and advanced analysis can be achieved by combining static analysis and dynamic analysis, the two methods use different target formats, making it difficult to coordinate them and requiring a high level of expertise and time to implement. According to the first embodiment, the malware analysis support system 101 converts both static analysis data and dynamic analysis data into explanatory text in natural language, compares the two, and cooperates with each other to support malware analysis. In this case, problems due to differences in format as described above do not occur. Then, based on the explanatory text converted into natural language, information is generated for the analyst to support malware analysis, and information is generated that suggests the target to be analyzed by the analyst. Therefore, more specific information can be presented to the analyst, and the analyst can obtain more useful information when analyzing malware. This is expected to reduce the operational costs and personal dependency of malware analysis. In addition, malware analysis can be performed more easily.

[0043] In addition, it is expected that the support results of this embodiment can be applied to system recovery and automated countermeasures. For example, it is possible to automatically execute countermeasures to prevent malware infection based on the analysis avoidance function extracted by this technology, specifically, when it is determined that the analysis avoidance function in the virtual environment detects a specific key in the registry, the value of the key can be set to avoid infection.

[0044] [Second embodiment] In the second embodiment, the processing of a malware analysis system that enables the provision of services in the cloud by making the support function available externally via a network in addition to on-premise malware analysis support is described. The second embodiment will be described below, focusing on the differences from the first embodiment.

[0045] FIG. 12 is a diagram illustrating an example of the configuration of a malware analysis system 1 according to the second embodiment. The hardware configuration of the illustrated malware analysis system 1 is similar to that of the malware analysis system 1 illustrated in Fig. 1 except that it includes external user terminals (external user terminals A to X) 120a to 120c in addition to the malware analysis system 1 illustrated in Fig. 1. In the second embodiment, each program executes processing in response to requests from not only user terminals 117a to 117c in the network but also external user terminals 120a to 120c, and returns the results to the external user terminals 120a to 120c via networks 118a, 118b and the Internet 119. This enables services to be provided in the cloud. The programs of the second embodiment are the same as those of the first embodiment, and include a dynamic analysis program 108, a static analysis program 109, an analysis log conversion program 110, an analysis support program 111, and a screen depiction program 112. The processes executed by these programs are the same as those of the first embodiment. The data structure of the second embodiment is the same as that of the first embodiment, and the storage device 105 stores a malware list 113, an analysis result storage area 114, an analysis result list 115, and an analysis support result list 116. Note that the configuration of the malware analysis system according to the second embodiment described in FIG. 12 is just an example and is not limited to this.

[0046] According to the second embodiment, the malware analysis support system 101 provides a malware analysis support function to internal users on-premise as in the first embodiment, and also provides similar information to external users via the networks 118a, 118b and the Internet 119. This enables the provision of services in the cloud.

[0047] In the above-described first and second embodiments, the analysis results are displayed to the analyst on the input / output device 106, but the results may be displayed on a display device provided in the user terminals 117a to 117c or the external user terminals 120a to 120c.

[0048] <Explanation of malware analysis method> The processing performed by the malware analysis support system 101 in this embodiment described above is realized by cooperation between software and hardware resources. That is, as shown in Fig. 1, a processor such as a CPU 103 provided in the malware analysis support system 101 loads a dynamic analysis program 108, a static analysis program 109, an analysis log conversion program 110, an analysis support program 111, and a screen depiction program 112 as programs for realizing each function of the malware analysis support system 101 into a main memory 104 and executes them to realize each of these functions.

[0049] Therefore, the processing performed by the above-mentioned malware analysis support system 101 can be considered to be a malware analysis method in which a processor executes a program recorded in memory, thereby performing dynamic and static analysis of the malware to be analyzed, converting the analysis results from the dynamic and static analyses into natural language, generating an explanatory text about the analysis results, and generating information about the behavior of the malware to be analyzed by comparing the explanatory texts from the dynamic and static analyses.

[0050] In this case, CPU 103 functions as an analysis unit that performs dynamic and static analysis of the malware to be analyzed. CPU 103 also functions as a conversion unit that converts the analysis results from the dynamic and static analyses into natural language and generates an explanatory text for the analysis results. CPU 103 also functions as a generation unit that generates information about the behavior of the malware to be analyzed, which is obtained by comparing the explanatory texts from the dynamic and static analyses.

[0051] The program for implementing the present embodiment can be provided not only by communication means but also by being stored in a recording medium such as a CD-ROM.

[0052] Although the present embodiment has been described above, the technical scope of the present invention is not limited to the scope described in the above embodiment. It is clear from the claims that various modifications and improvements to the above embodiment are also included in the technical scope of the present invention. [Explanation of symbols]

[0053] 1... malware analysis system, 101... malware analysis support system, 103... CPU, 104... main memory, 105... storage device, 106... input / output device, 108... dynamic analysis program, 109... static analysis program, 110... analysis log conversion program, 111... analysis support program, 112... screen drawing program

Claims

1. an analysis unit that performs dynamic and static analysis of malware to be analyzed; a conversion unit that converts analysis results from the dynamic analysis and the static analysis into a natural language and generates an explanation of the analysis results; a generation unit that generates information regarding the behavior of malware to be analyzed by comparing the explanatory texts obtained by the dynamic analysis and the static analysis; A malware analysis device comprising:

2. The malware analysis device according to claim 1 , wherein the generation unit generates, as information regarding the behavior of the malware to be analyzed, information that assists an analyst in analyzing the malware to be analyzed.

3. The malware analysis device according to claim 2 , wherein the generation unit generates, as information regarding the behavior of the malware to be analyzed, information indicating a suggestion for an analyst to analyze the malware to be analyzed.

4. The malware analysis device according to claim 1 , wherein the generation unit generates information regarding the behavior of the malware to be analyzed based on a difference between the explanatory texts obtained by the dynamic analysis and the static analysis.

5. The malware analysis device according to claim 4 , wherein the generation unit generates information regarding the behavior of the malware to be analyzed, the information being obtained from the difference and recommending parts of the malware to be analyzed by an analyst.

6. The malware analysis device according to claim 5 , wherein the generation unit uses the difference to recommend locations where behavior was not revealed in dynamic analysis as locations for static analysis as information regarding the behavior of the malware to be analyzed.

7. The malware analysis device according to claim 6 , wherein the generation unit generates information indicating that the malware to be analyzed is a candidate for performing evasive analysis operations.

8. The malware analysis device according to claim 7 , wherein the generation unit generates information that recommends processes in the vicinity of the location to be statically analyzed as processes related to preparation for evading analysis.

9. The malware analysis device of claim 4, wherein when there is no information obtained from the static analysis results compared to the dynamic analysis results, the generation unit generates information regarding the possibility that code has been obfuscated as information regarding the behavior of the malware being analyzed.

10. The malware analysis device according to claim 1 , wherein the generation unit compares analysis results obtained by static analysis with each other and / or analysis results obtained by dynamic analysis with each other to generate information regarding the behavior of the malware to be analyzed.

11. The malware analysis device according to claim 10 , wherein the generation unit detects functional extensions of the analysis target by comparing analysis results obtained by static analysis of malware of different analysis targets.

12. The malware analysis device of claim 10, wherein the generation unit extracts environments in which behavior is manifested as environments to be attacked and / or environments in which behavior is not manifested as environments to be avoided by comparing analysis results obtained by dynamic analysis of the same malware to be analyzed when the environment is changed.

13. The processor executes the program stored in the memory, Conduct dynamic and static analysis of the malware to be analyzed. converting the analysis results from the dynamic analysis and the static analysis into natural language to generate an explanation of the analysis results; generating information about the behavior of the malware being analyzed by comparing the descriptions from the dynamic analysis and the static analysis; Malware analysis methodology.

14. a malware analysis device that analyzes malware to be analyzed; a display device that displays to an analyst an analysis result of the analysis of the malware to be analyzed; having The malware analysis device includes: an analysis unit that performs dynamic and static analysis of malware to be analyzed; a conversion unit that converts analysis results from the dynamic analysis and the static analysis into a natural language and generates an explanation of the analysis results; a generation unit that generates information regarding the behavior of malware to be analyzed by comparing the explanatory texts obtained by the dynamic analysis and the static analysis; A malware analysis system comprising:

Images