Malignant site survival period prediction system and malignant site survival period prediction method

Abstract

To enable the reduction of operational costs and personal attributes associated with the construction of a block list and a watch list by predicting a malignant site survival period.SOLUTION: A malignant site survival period prediction system 101 is configured to include: a communication device 115 for accessing a network 116; a storage device 101 for holding information on each malignant site; and an arithmetic device 104 for observing a predetermined event in each malignant site, applying the observation result to a determination rule for specifying a relationship between the tendency of the event in the malignant site and the survival period of the malignant site, predicting the survival period, selecting the malignant site according to the survival period, and generating a block list or a watch list.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a system and a method for predicting survival time of a malignant site. [Background technology]

[0002] Blocking malicious sites is effective in limiting damage, and regular monitoring of such sites is useful in clarifying attacks and detecting signs of attacks. For this reason, there are services that provide block lists of malicious sites and monitoring services. Another method for blocking communications to malicious sites is communication control using block lists. This is implemented in layers such as forward proxies, and malicious sites to which communication should be blocked are registered in advance. When communication that matches the list is detected, the communication is blocked, thereby limiting damage.

[0003] As a conventional technique for dealing with such malicious sites, for example, a technique has been proposed that makes it possible to detect access to unknown malicious sites and reduces the burden associated with the detection (see Patent Document 1).

[0004] This technology is a monitoring system having an observation device and an analysis device connected to the observation device via a communication line, and the observation device collects information about accesses to Web pages by users. and a transmission unit that transmits the information collected by the data observation unit to the analysis device. The analysis device includes a reception unit that receives the information transmitted from the observation device, a detection unit that detects a specific page transition method based on the information received by the reception unit, and a download control unit that detects a download from an access to the Web page based on the detection result of the specific page transition method. An analysis unit that judges whether the downloaded content is malicious, and only the content that is judged by the analysis unit to be suspiciously malicious is determined to be an object of analysis. and an analysis target determining unit. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2016-45887 A [Non-patent literature]

[0006] [Non-Patent Document 1] Nappa, A., Xu, Z., Rafique, MZ, Caballero, J., and Gu, G.: CyberProbe: Towards Internet-Scale Active Detection of Malicious Servers, Proc. 2014 Network and Distributed System Security Symposium (NDSS2014), pp.1-15(2014). https: / / www.google.com / url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwiGmd-D0tD8AhXbZt4KHUyqCQoQ FnoECAUQAQ&url=https%3A%2F%2Flirias.kuleuven.be%2Fretrieve%2F384185&usg=AOvVaw3rKJj5MIzX684yxfDdtlzk [Non-Patent Document 2] Soska, K. and Christin, N.: Automatically detecting vulnerable websites before they turn malicious, Proc. the 23rd USENIX conference on Security Symposium (SEC2014), pp. 625-640 (2014). https: / / www.usenix.org / conference / usenixsecurity14 / technical-sessions / presentation / soska Summary of the Invention [Problem to be solved by the invention]

[0007] However, the number of malicious websites is countless and is increasing every day, so it is unrealistic to block or monitor all of them. Therefore, it is necessary to create block lists and monitoring lists by narrowing down the items with higher priority based on the current state, etc., but such work is costly to implement and highly dependent on the skills of each individual.

[0008] In the prior art, there are methods to monitor websites and detect malicious websites from their page transition information, etc. However, there has been no proposal to provide information on the lifetime of malicious websites, which would contribute to inventorying and selecting malicious websites to be blocked or monitored.

[0009] Other techniques exist to detect active malicious sites through observation, but providing information about the nature or lifetime of the malicious sites is outside their scope.

[0010] In other words, as mentioned above, although there are many conventional technologies that focus on monitoring malicious sites, no technology has been proposed that aims to inventory / select malicious sites to be blocked / monitored. Therefore, the high operational costs and high degree of dependency on individuals involved in building block lists and monitoring lists, as mentioned above, have not been resolved.

[0011] SUMMARY OF THE PRESENT EMBODIMENT An object of the present invention is to provide a technique that can reduce the operational costs and personal dependency involved in building block lists and watch lists by predicting the survival time of malicious sites. [Means for solving the problem]

[0012] The malignant site survival time prediction system of the present invention, which solves the above-mentioned problems, is characterized by comprising a communication device that accesses a network, a storage device that holds information about each malicious site in the network, a process that accesses each of the malicious sites and observes specified events at the malicious sites, a process that predicts the survival time of the malicious sites by applying the results of the observation to a judgment rule that specifies the relationship between the tendency regarding the events at the malicious sites and the survival time of the malicious sites, and a calculation device that executes a process of selecting specified ones of the malicious sites according to the survival time and generating a block list or a monitoring list. Furthermore, the method for predicting the survival time of a malicious site of the present invention is characterized in that an information processing device is provided with a communication device for accessing a network and a storage device for retaining information of each malicious site in the network, and performs a process of accessing each of the malicious sites and observing a specified event at the malicious site, a process of predicting the survival time of the malicious site by applying the results of the observation to a judgment rule that specifies the relationship between a tendency regarding the event at the malicious site and the survival time of the malicious site, and a process of selecting a specified one of the malicious sites according to the survival time and generating a block list or a monitoring list. Effect of the Invention

[0013] According to the present invention, by predicting the survival time of a malicious site, it is possible to reduce the operational costs and personal dependency involved in constructing a block list or a watch list. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of a malignant site survival prediction system according to a first embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram showing an example of a malicious site list according to the first embodiment of the present invention. [Diagram 3] FIG. 2 is a diagram showing an example of an observation result storage area according to the first embodiment of the present invention. [Figure 4]FIG. 2 is a diagram showing an overall processing flow according to the first embodiment of the present invention. [Diagram 5] FIG. 4 is a diagram showing a process flow of malicious site monitoring according to the first embodiment of the present invention. [Figure 6] FIG. 1 is a diagram showing a process flow of survival time prediction according to the first embodiment of the present invention. [Figure 7] FIG. 2 is a diagram showing a processing flow of screen depiction according to the first embodiment of the present invention. [Figure 8] FIG. 2 is a diagram showing an example of a screen according to the first embodiment of the present invention. [Figure 9] FIG. 4 is a diagram showing a process flow of list construction according to the first embodiment of the present invention. [Figure 10] FIG. 11 is a diagram showing an example of the configuration of a malignant site survival prediction system according to a second embodiment of the present invention. [Figure 11] FIG. 11 is a diagram showing a process flow for determining an observation interval according to the second embodiment of the present invention. [Figure 12] FIG. 11 is a diagram showing a processing flow of property prediction according to the second embodiment of the present invention. [Figure 13] FIG. 11 is a diagram showing a process flow of background prediction according to the second embodiment of the present invention. [Figure 14] FIG. 11 is a diagram showing an example of the configuration of a malignant site survival prediction system according to a third embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. However, the present invention is not to be interpreted as being limited to the description of the embodiment shown below. It will be easily understood by those skilled in the art that the specific configuration can be changed without departing from the concept or purpose of the present invention. In the configurations of the invention described below, the same or similar configurations or functions are given the same reference numerals, and duplicated explanations are omitted.

[0016] In this specification, the terms "first," "second," "third," and the like are used to identify components and do not necessarily limit the number or order.

[0017] In order to facilitate understanding of the invention, the position, size, shape, range, etc. of each component shown in the drawings may not represent the actual position, size, shape, range, etc. Therefore, the present invention is not limited to the position, size, shape, range, etc. disclosed in the drawings, etc. [Example 1] In the first embodiment, the process of a system for predicting the survival period of a malicious site is described in order to reduce the operational costs and personal dependency involved in constructing a blocking list or a monitoring list by predicting the survival period of a malicious site on-premise. <Network configuration> DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described in detail below with reference to the drawings. Fig. 1 is a diagram showing a network configuration including a malignant site survival prediction system 101 according to this embodiment.

[0018] A malignant site survival time prediction system 101 shown in FIG. 1 is a computer system that can reduce the operational costs and personal dependency involved in building a blocking list or a watch list by predicting the survival time of a malignant site.

[0019] The malignant site survival prediction system 101 according to the first embodiment is connected to a user terminal 114 operated by a user via the Internet 116 and a network 115. The user terminal 114 may be considered to be included in the malignant site survival prediction system.

[0020] The malignant site survival prediction system 101 includes a CPU (Central Processing Unit) 10 3, a main memory 104, a storage device 105, an IF (interface) 102, an input / output device 106, and a communication path 107 connecting these devices.

[0021] Of these, the IF 102 is a communication device for communicating with other devices such as a user terminal 114 .

[0022] A CPU (Central Processing Unit) 103 stores a By executing the malicious site monitoring program 108, the malicious site is monitored. By executing the survival prediction program 109, the survival time of the connection destination is predicted. By executing the screen drawing program 110, the processing results of the above-mentioned programs (information on the observation results, malignancy level, priority of response, etc.) are output. By executing the list construction program 111, the functions of blocking malignant sites and generating an observation list are implemented.

[0023] The main memory 104 is configured with a volatile storage element that stores data necessary for the CPU 103 to execute the processes.

[0024] The storage device 105 is configured with a non-volatile storage element such as a hard disk or flash memory that has a capacity for storing a large amount of data.

[0025] The input / output device 106 is a device for inputting and outputting data such as a keyboard and a display.

[0026] The communication path 107 is an information transmission medium such as a bus or cable that connects these devices.

[0027] The above-mentioned storage device 105 stores a malignant site list 112 for managing malignant sites, and an observation result storage area 113 for storing observation results.

[0028] The above programs and data may be stored in advance in the main memory 104 or the storage device 105, or may be installed (loaded) when needed from the input / output device 106 or from another device via the IF 102.

[0029] The configuration of the malignant site survival prediction system described in FIG. 1 is just an example, and the present invention is not limited to this. <Data structure example> Next, a description will be given of various information used by the malignant site survival prediction system 101 of this embodiment.

[0030] As shown in FIG. 2, the list of malicious sites 112 includes, for example, a destination ID 201, a destination 202, an observation span 203, an observation date and time 204, and a predicted survival time 205.

[0031] Among these, the connection destination ID 201 is a field for storing identification information for uniquely identifying the connection destination of the observation target. In the connection destination ID 201 of the first embodiment, a number is stored as the identification information.

[0032] The connection destination 202 is a field for storing the URL of the connection destination to be observed. For example, the connection destination corresponding to the entry with the connection destination ID 201 of "0" is "search.example.com / "

[0033] The observation span 203 indicates how often the connection destination is observed. For example, an entry with a connection destination ID 201 of "0" indicates that observation is attempted every four hours.

[0034] Moreover, the observation date and time 204 indicates the date and time when the connection destination was observed. For example, among the entries with the connection destination ID 201 of "0", it indicates that the most recent observation was made at 04:00:00 on Jan. 1, 2023. The present invention is not limited to the data format of the time stored in the observation date and time 204. Any data format, such as Unixtime, that allows the time to be determined may be used. It may be used.

[0035] Further, the predicted survival time 205 indicates the survival time predicted for the destination (malignant site). For example, for the destination ID 201 of "0", the latest observation result at "04:00:00 on Jan. 1, 2023" is used to indicate the predicted survival time from that point.

[0036] The list of malicious sites described in FIG. 2 is merely an example and is not limiting.

[0037] Fig. 3 is a diagram showing an example of the observation result storage area 113. As shown in Fig. 3, the observation result storage area 113 includes, for example, a connection destination ID 301, a connection destination 302, an observation date and time 303, a status code 304, and content 305.

[0038] Among these, the connection destination ID 301 is a field for storing identification information for uniquely identifying the connection destination of the observation target. In the connection destination ID 301 of the first embodiment, a number is stored as the identification information.

[0039] The connection destination 302 is a field for storing the URL of the connection destination to be observed. For example, the connection destination corresponding to the entry with the connection destination ID 301 of "0" is "search.example.com / "

[0040] Further, the observation date and time 303 indicates the date and time when the connection destination was observed. For example, among the entries with the connection destination ID 301 of "0", it indicates that the most recent observation was made at "04:00:00 on Jan. 1, 2023". The present invention is not limited to the data format of the time stored in the observation date and time 303. Any data format may be used as long as it is a data format in which the time can be determined, such as Unixtime.

[0041] Also, status code 304 is a field for storing the status code of the connection destination at the time of observation. For example, it indicates that the status code was "200" when a connection destination with a connection destination ID 301 of "0" was observed at "04:00:00 on Jan. 1, 2023." The status code is a code returned by the connection destination server as an HTTP response, and there are various types such as an information response, a success response, a redirect message, a client error response, and a server error response.

[0042] Furthermore, content 305 is a field for storing content obtained from the connection destination at the time of observation. For example, it indicates that the content obtained when a connection destination with a connection destination ID 301 of "0" was observed at "04:00:00 on Jan. 1, 2023" was "1.exe." Note that information stored as an observation result is not limited to this.

[0043] The observation result storage area described with reference to FIG. 3 is merely an example and is not limited to this. <Flow example: Overall flow> The actual procedure of the malignant site survival prediction method in this embodiment will be described below with reference to the drawings. Various operations corresponding to the malignant site survival prediction method described below are realized by a program that the malignant site survival prediction system 101 reads into a memory or the like and executes. This program is composed of codes for performing the various operations described below.

[0044] FIG. 4 is a diagram showing an example of a flow of the malignant site survival prediction method in the first embodiment. Specifically, it is a flow for explaining an outline of the process executed by the malignant site survival prediction system 101. -Chart.

[0045] Here, the malignant site survival prediction system 101 periodically executes the process described below (step 401).

[0046] First, the malignant site survival time prediction system 101 monitors malignant sites (step 402). A detailed flow of this malignant site monitoring will be described later with reference to FIG.

[0047] Next, the malignant site survival time prediction system 101 predicts the survival time of the malignant site (step 403) using the observation result in step 402. The detailed flow of this survival time prediction will be described later with reference to FIG.

[0048] The malignant site survival time prediction system 101 performs the above process for all malignant sites and ends the flow.

[0049] The process flow of the malignant site survival prediction system described in FIG. 4 is just an example, and the present invention is not limited to this. <Flow example: Malicious site observation> FIG. 5 is a flowchart for explaining an example of the malicious site observation process (the above-mentioned step 402) executed by the destination maliciousness determination system 101 according to the first embodiment.

[0050] When an execution instruction is received from the user terminal 114, for example, the malicious site monitoring program 108 executed by the CPU 103 starts the process described below.

[0051] The malicious site monitoring program 108 acquires a list of monitoring target connection destinations from the malicious site list 112 (step 501). In this case, it is assumed that a list including entries each consisting of a connection destination ID 201 is acquired.

[0052] Next, the malicious site monitoring program 108 sets an initial value of 0 to a variable i which indicates a destination ID of the malicious site list 112 (step 502).

[0053] Next, the malicious site monitoring program 108 starts processing for the destination with the destination ID of i (step 503).

[0054] Next, the malicious site observation program 108 refers to the observation date and time 204 and the observation span 203 of the most recent entry in the malicious site list 112, and calculates the elapsed time from the last observation date and time of the destination to the program execution, thereby determining whether the destination has reached the observation span (step 504).

[0055] If the result of this determination is that the destination has not reached the observation span (step 504 : No), the malicious site observation program 108 ends the processing related to the destination and proceeds to step 507 .

[0056] On the other hand, if the result of the above determination is that the connection destination has reached the observation span (step 504 : Yes), the malicious site observation program 108 proceeds to step 505 .

[0057] Next, the malicious site monitoring program 108 monitors the destination (step 505). For this monitoring, for example, the browser is used to access the destination and obtain the response result. As an example of the response result, the status code already mentioned is assumed. can.

[0058] Next, the malicious site observation program 108 stores the observation result obtained in the above step 505 in an entry corresponding to the destination ID of the destination in the observation result storage area 113 (step 506).

[0059] Next, the malicious site monitoring program 108 adds 1 to the variable i and proceeds to step 508 (step 507).

[0060] Next, the malicious site monitoring program 108 compares the variable i with the number of connection destinations that can be obtained by referring to the malicious site list 112 .

[0061] If the comparison result indicates that the variable i is less than the number of connection destinations (step 508 : No), the malicious site monitoring program 108 returns to step 503 .

[0062] On the other hand, if the result of the above comparison indicates that the variable i is greater than the number of connection destinations (step 508: Yes), the malicious site monitoring program 108 ends the process (step 508).

[0063] The method of malicious site monitoring processing described with reference to FIG. 5 is merely an example, and the present invention is not limited to this. <Flow example: Survival period prediction> FIG. 6 is a flowchart illustrating an example of a survival time prediction process executed by the destination malignancy assessment system 101 according to the first embodiment.

[0064] When an execution instruction is received from the user terminal 114, the survival time prediction program 109 executed by the CPU 103 starts the process described below.

[0065] The survival time prediction program 109 acquires a list of connection destinations to be observed from the malignant site list 112 (step 601). Here, it is assumed that a list including entries each consisting of a connection destination ID 201 is acquired.

[0066] Next, the survival prediction program 109 sets an initial value of 0 to a variable i which indicates a destination ID of the malignant site list 112 (step 602).

[0067] Next, the survival time prediction program 109 starts processing for the connection destination with a connection destination ID of i (step 603).

[0068] Next, the survival time prediction program 109 refers to the observation result storage area 113 to check whether there are any additional observation results for the connection destination since the previous prediction (step 604).

[0069] At this time, if there are no additional observation results (step 604 : No), the survival prediction program 109 ends the processing for that connection destination and proceeds to step 608 .

[0070] On the other hand, if there are additional observations (step 604 : Yes), the survival prediction program 109 proceeds to step 605 .

[0071] Next, the survival time prediction program 109 acquires external information related to the connection destination (step 605). As the external information, for example, WHOIS information, DNS information, certificate information, etc. are acquired.

[0072] Next, the survival prediction program 109 applies the observation results obtained from the observation result storage area 113 and the external information obtained in step 605 to a predetermined judgment rule (e.g., an engine that has machine-learned the relationship between trends regarding predetermined events at a malicious site and the survival time of the malicious site) to predict the survival time of the connection destination (step 606).

[0073] The above-mentioned events may be various, such as the type of status code in response from a malicious site, the role of the malicious site, or external information in WHOIS information.

[0074] Next, the survival prediction program 109 stores the survival prediction result obtained in step 606 in the predicted survival time 205 of the entry corresponding to the destination ID of the destination in the malignant site list 112 (step 607).

[0075] Next, the survival prediction program 109 adds 1 to the variable i and proceeds to step 609 (step 608).

[0076] Next, the survival time prediction program 109 compares the variable i with the number of connection destinations that can be obtained by referring to the list of malicious sites 112 (step 609).

[0077] As a result of the above comparison, if the variable i is less than the number of connection destinations (step 609: No), the survival time prediction program 109 returns to step 603.

[0078] Moreover, if the result of the above comparison shows that the variable i is greater than the number of connection destinations (step 609: Yes), the survival time prediction program 109 ends the process (step 609).

[0079] The survival time prediction process method described in FIG. 6 is an example, and is not limited thereto. For example, the survival time of the connection destination may be predicted using information other than that described in the above example. Furthermore, the observation span may be changed based on the predicted properties of the connection destination. For example, measures include observing at short intervals those whose properties may change in a short period of time, and observing at long intervals those whose survival time is long but whose properties do not change during that period. <Flow example: Screen depiction> The malignant site survival prediction system 101 executes a screen depiction process for displaying various information to the user, in addition to the process described in Fig. 4. Fig. 7 is a flowchart for explaining an example of the screen depiction process executed by the malignant site survival prediction system 101 of the first embodiment.

[0080] When an execution instruction is received from a user terminal 114, the screen depiction program 110 executed by the CPU 103 starts the process described below.

[0081] The screen rendering program 110 acquires a list of connection destinations to be monitored from the malicious site list 112 (step 701). Here, it is assumed that a list including entries each consisting of a connection destination ID 201 is acquired.

[0082] The screen depiction program 110 acquires the observation results of the connection destination from the observation result storage area 113 (step 702). Here, it is assumed that a list including an entry configured from the connection destination ID 301 is acquired.

[0083] The screen drawing program 110 generates screen data including information about the connection destination to be drawn, and distributes this to the user terminal 114 for display (step 703), thereby terminating the process.

[0084] It should be noted that the method of depicting the screen described with reference to FIG. 7 is merely an example and is not limiting.

[0085] FIG. 8 is an example of a malignant site survival prediction result depicting screen 800 generated by the screen depicting program 110 in the malignant site survival prediction system 101 of the first embodiment and displayed on the user terminal 114. In FIG.

[0086] The screen 800 in FIG. 8 includes a malignant site summary 801 , a predicted survival time 802 , and observations 803 .

[0087] Among these, the malicious site summary 801 indicates basic information about the connection destination of the depiction target, such as the connection destination ID, connection destination, observation span, observation date and time, and predicted survival time.

[0088] Moreover, the predicted lifespan 802 is the result of predicting the lifespan of the connection destination.

[0089] Moreover, the observation result 803 is the result of observing the connection destination of the depiction target, and includes information such as the connection destination ID, connection destination, observation date and time, status code, content, and format, for example.

[0090] The above-mentioned content may be files provided for download by malicious sites, screen data including a status code, and so on.

[0091] As described above, by displaying the connection destination with a focus on its predicted life span, it is expected that analysts and other users will be provided with a useful support when creating watch lists and block lists.

[0092] In addition, this time, the display screen based on the execution result of each program according to the first embodiment is illustrated, but it is only an example and is not limited to this. For example, any information related to the connection destination may be displayed in any format. <Flow example: Providing a blocking list> The malignant site survival prediction system 101 executes a list construction process in addition to the process described in Fig. 4. Fig. 9 is a flowchart for explaining an example of a block list providing process executed by the malignant site survival prediction system 101 of the first embodiment.

[0093] When the list construction program 111 executed by the CPU 103 receives an execution instruction from the user terminal 114, it starts the process described below.

[0094] The list construction program 111 receives a specification of the upper limit number of lists from the user terminal 114 of the user (step 901).

[0095] The list construction program 111 acquires information on malicious sites from the list of malicious sites 112 (step 902).

[0096] Furthermore, the list construction program 111 extracts malignant sites from the malignant site list 112 in descending order of predicted survival time up to the upper limit number accepted in step 901 (step 903).

[0097] The list construction program 111 outputs the group of malicious sites extracted in step 903 as a blocking list (step 904), and ends the process. At this time, it is possible to cooperate with other devices, for example, a network device that actually blocks communication, via the IF 102.

[0098] The method of the list construction process described in Fig. 9 is an example, and is not limited to this. For example, the list may be constructed taking into consideration not only the predicted survival time, but also other factors such as the malignancy of the connection destination.

[0099] The list may also be created taking into consideration the uses of the list. For example, when monitoring malicious sites, it is desirable to obtain as many different monitoring results as possible, so a measure such as preferentially adding malicious sites that change their content to the monitoring list may be considered. In addition, although the upper limit number of the list was input by the user in the above example, a function may be provided that utilizes a predicted lifetime and maximizes the blocking performance of the blocking list and the monitoring possibility of the monitoring list while taking into consideration resources such as the capacity of the blocking list and the number of observations that can be made by the monitoring system.

[0100] While blocking and monitoring malicious sites are useful, the number of malicious sites is countless and is increasing daily, so it is unrealistic to block or monitor all of them. For this reason, it is necessary to build blocking lists and monitoring lists that focus on high-priority sites based on the current situation, etc., but there are issues with the high implementation costs and high dependency on individuals.

[0101] According to the first embodiment, the malignant site survival prediction system 101 predicts the survival time of a malignant site and automatically constructs a blocking list and a monitoring list using the result. This is expected to reduce the operational cost and personal dependency on constructing the blocking list and the monitoring list. [Example 2] In the second embodiment, the processing of a malignant site survival prediction system that is provided with a support function for monitoring and analyzing malignant sites and enables more advanced and labor-saving analysis will be described. The second embodiment will be described below, focusing on the differences from the first embodiment.

[0102] 10 is a diagram showing a configuration example of a malignant site survival prediction system 1001 according to a second embodiment of the present invention. The configuration of a computer system of the second embodiment is the same as that of the first embodiment. In addition, the hardware configuration of the malignant site survival prediction system of the second embodiment is the same as that of the first embodiment.

[0103] The program configuration of the second embodiment includes, in addition to those of the first embodiment, an observation interval planning program 1012, a property prediction program 1013, and a background prediction program 1014. Moreover, the processing of a malignant site observation program 1008, a survival time prediction program 1009, a screen drawing program 1010, and a list construction program 1011 of the second embodiment are the same as those of the first embodiment.

[0104] The data structure of the second embodiment is the same as that of the first embodiment.

[0105] The configuration of the malignant site survival prediction system according to the second embodiment described with reference to FIG. 10 is merely an example, and the present invention is not limited to this. <Flow example: Determining observation intervals> FIG. 11 is a flowchart illustrating an example of an observation interval planning process executed by the destination maliciousness determination system 1001 according to the second embodiment.

[0106] When an execution instruction is received from the user terminal 114, the observation interval planning program 1012 executed by the CPU 1003 starts the process described below.

[0107] The observation interval planning program 1012 acquires a list of connection destinations to be monitored from the malicious site list 1015 (step 1101). Here, it is assumed that a list including entries each consisting of a connection destination ID is acquired.

[0108] Next, the observation interval planning program 1012 sets an initial value of 0 to a variable i which indicates a destination ID of the malicious site list 1015 (step 1102).

[0109] Next, the observation interval planning program 1012 starts processing for the destination with a destination ID of i (step 1103).

[0110] Next, the observation interval planning program 1012 refers to the observation result storage area 1016 to check whether there have been any changes in the observation results or the items of external information for that connection destination (step 1104).

[0111] As a result of the above check, if there has been a change (step 1104 : Yes), the observation interval planning program 1012 ends the processing for that connection destination and proceeds to step 1107 .

[0112] On the other hand, if the result of the above check shows that there has been no change (step 1104 : No), the observation interval planning program 1012 proceeds to step 1105 .

[0113] Next, the observation interval planning program 1012 lengthens the observation span of the connection destination, for example, at a constant rate from the default value (step 1105).

[0114] Next, the observation interval planning program 1012 reflects the extended observation span in step 1105 in the list of malicious sites 1015 (step 1106).

[0115] Next, the observation interval planning program 1012 adds 1 to the variable i, and proceeds to step 1108 (step 1107).

[0116] Next, the observation interval planning program 1012 compares the variable i with the number of connection destinations that can be obtained by referring to the list of malicious sites 1015 (step 1108).

[0117] If the variable i is less than the number of connection destinations (step 1108 : No), the observation interval planning program 1012 returns to step 1103 .

[0118] On the other hand, if the variable i exceeds the number of connection destinations (step 1108: Yes), the observation interval planning program 1012 ends the process.

[0119] The method of determining the observation interval described in FIG. 11 is an example, and is not limited to this. For example, the observation span may be shortened when there is a change in the observation result or external information. <Flow Example: Property Prediction> FIG. 12 is a flowchart illustrating an example of a property prediction process executed by the destination maliciousness determination system 1001 according to the first embodiment.

[0120] When an execution instruction is received from the user terminal 114, the property prediction program 1013 executed by the CPU 1003 starts the process described below.

[0121] The property prediction program 1013 acquires a list of connection destinations to be observed from the malicious site list 1015 (step 1201). Here, it is assumed that a list including entries each consisting of a connection destination ID is acquired.

[0122] Next, the property prediction program 1013 sets an initial value of 0 to a variable i which indicates a destination ID of the malicious site list 1015 (step 1202).

[0123] Next, the property prediction program 1013 starts processing for the connection destination with the connection destination ID of i (step 1203).

[0124] Next, the property prediction program 1013 refers to the observation result storage area 1016 to check whether there are any additional observation results for the connection destination since the previous prediction (step 1204).

[0125] If it is determined that there is no additional observation result (step 1204 : No), the property prediction program 1013 ends the processing for that connection destination and proceeds to step 1207 .

[0126] On the other hand, if the above check reveals that there are additional observations (step 1204 : Yes), the survival prediction program 1013 proceeds to step 1205 .

[0127] Next, the property prediction program 1013 acquires external information related to the connection destination (step 1205). Such external information includes, for example, WHOIS information, DNS information, and certificate information.

[0128] Next, the property prediction program 1013 predicts the property of the destination by applying the observation results obtained so far and the external information acquired in step 1205 to a predetermined judgment rule (step 1206). The property here refers to, for example, a site whose contents change one after another in a short period of time, a site whose property does not change until the end, etc. Also, the above-mentioned judgment rule can be, for example, a judgment engine obtained by machine learning about the relationship between the values ​​of each item included in the observation results and external information and the property of a malicious site.

[0129] Next, the property prediction program 1013 adds 1 to the variable i and proceeds to step 1108 (step 1207).

[0130] Next, the property prediction program 1013 compares the variable i with the number of connection destinations that can be obtained by referring to the list of malicious sites 1015 (step 1208).

[0131] As a result of the above comparison, if the variable i is less than the number of connection destinations (step 1208 : No), the property prediction program 1013 returns to step 1203 .

[0132] On the other hand, if the result of the above check shows that the variable i is greater than the number of connection destinations (step 1208: Yes), the property prediction program 1013 ends the process (step 1208).

[0133] The method of the property prediction process described with reference to FIG. 12 is just an example, and the present invention is not limited to this. <Flow example: Background prediction> FIG. 13 is a flowchart illustrating an example of a background prediction process executed by the destination maliciousness determination system 1001 according to the first embodiment.

[0134] When an execution instruction is received from the user terminal 114, the background prediction program 1014 executed by the CPU 1003 starts the process described below.

[0135] The background prediction program 1014 acquires a list of destinations to be observed from the malicious site list 1015 (step 1301). Here, it is assumed that a list including entries each consisting of a destination ID is acquired.

[0136] Next, the background prediction program 1014 checks the connection destinations of the malicious site list 1015 An initial value of 0 is set to a variable i, which indicates an ID (step 1302).

[0137] Next, the background prediction program 1014 starts processing for the connection destination with a connection destination ID of i (step 1303).

[0138] Next, the background prediction program 1014 refers to the observation result storage area 1016 to check whether there are any additional observation results for the connection destination since the previous prediction (step 1304).

[0139] If the above check shows that there are no additional observation results (step 1304: No), the background prediction program 1014 ends the processing for that connection destination and proceeds to step 1307.

[0140] On the other hand, if the above check reveals that there are additional observations (step 1304 : Yes), the background prediction program 1014 proceeds to step 1305 .

[0141] Next, the background prediction program 1014 acquires external information related to the connection destination (step 1305). Note that, as the external information, for example, WHOIS information, DNS information, certificate information, etc. are acquired.

[0142] Next, the background prediction program 1014 predicts the background of the connection destination (step 1306) using the observation results obtained up to this point and the external information acquired in step 1305. The background here refers to, for example, an attack group or malware associated with the connection destination.

[0143] Next, the background prediction program 1014 adds 1 to the variable i and proceeds to step 1108 (step 1307).

[0144] Next, the background prediction program 1014 compares the variable i with the number of connection destinations that can be obtained by referring to the list of malicious sites 1015 (step 1308).

[0145] As a result of the above comparison, if the variable i is less than the number of connection destinations (step 1308 : No), the background prediction program 1014 returns to step 1303 .

[0146] On the other hand, if the variable i exceeds the number of connection destinations (step 1308: Yes), the background prediction program 1014 ends the process (step 1308).

[0147] It should be noted that the method of background prediction processing described with reference to FIG. 13 is merely an example and is not limiting.

[0148] According to the embodiment 2, the malignant site survival prediction system 1001 has an observation interval planning function, a property prediction function, and a background prediction function as support functions in addition to the malignant site survival prediction function similar to that of the embodiment 1. This enables more advanced and labor-saving implementation of malignant site survival prediction and related list construction. [Example 3] In the third embodiment, in addition to on-premise malignant site survival prediction, the process of the malignant site survival prediction system that enables cloud-based service provision by sharing the judgment result with the outside via the network is described. The second embodiment will be described below, focusing on the difference from the first embodiment.

[0149] 14 is a diagram showing an example of the configuration of a malignant site survival prediction system 1401 according to a third embodiment of the present invention. The configuration of the computer system of the third embodiment is the same as that of the first embodiment.

[0150] The hardware configuration of the malignant site survival prediction system 1401 in the third embodiment may include an external user terminal 1420 in addition to the configuration in the second embodiment.

[0151] In the third embodiment, each program executes processing in response to a request from not only a user terminal 1417 in the network but also an external user terminal 1420, and returns the result to the external user terminal 1420 via the Internet 1419. This enables services to be provided in the cloud.

[0152] The programs of the embodiment 3 are the same as those of the embodiment 2. Moreover, the processes executed by the malignant site observation program 1408, the survival time prediction program 1409, the screen drawing program 1410, the list construction program 1411, the observation interval formulation program 1412, the property prediction program 1413, and the background prediction program 1414 of the embodiment 3 are the same as those of the embodiment 2. Moreover, the data structure of the embodiment 3 is the same as that of the embodiment 2.

[0153] The configuration of the malignant site survival prediction system 1401 according to the third embodiment described in FIG. 14 is merely an example, and the present invention is not limited to this.

[0154] According to the third embodiment, the malignant site survival prediction system 1401, like the first and second embodiments, can provide a survival prediction function of a malignant site to an internal user on-premise, and can also provide similar information to an external user via the Internet 1419. This makes it possible to provide services in the cloud.

[0155] Although the best mode for carrying out the present invention has been specifically described above, the present invention is not limited to this, and various modifications are possible without departing from the spirit and scope of the present invention.

[0156] According to this embodiment, by predicting the survival time of a malicious site, it is possible to reduce the operational costs and personal dependency involved in constructing a block list or a watch list.

[0157] The description of this specification makes clear at least the following: That is, in the malignant site survival prediction system of this embodiment, the arithmetic device may further execute a process of outputting at least one of the result of the observation, the result of the prediction, and the block list or the watch list to a predetermined device.

[0158] This enables a person in charge of dealing with malicious sites to efficiently recognize various information about the malicious sites, including their survival time, and improves the timeliness of the dealing with the malicious sites.

[0159] In addition, in the malignant site survival time prediction system of this embodiment, the calculation device may predict the survival time by applying external information regarding the malignant site that is published on the network to the judgment rule in addition to the results of the observation.

[0160] This makes it possible to apply various information, such as WHOIS information and DNS information, such as the domain, country, and owner of the malicious site, to the survival prediction algorithm, effectively improving the accuracy of survival predictions.

[0161] In the malignant site survival time prediction system of this embodiment, the arithmetic device estimates the properties of the malignant site, including its role, based on the results of the observation and the external information, and The result of the estimation may also be applied to the judgment rule to predict the survival time.

[0162] This makes it possible to accurately predict survival periods by accurately taking into account the tendency for survival periods to differ depending on the role of the site, such as a site responsible for distributing malware or a management and command site that issues instructions to such malware over a certain period of time.

[0163] In addition, in the malicious site survival prediction system of this embodiment, the computing device may apply the results of the observation and the external information to a predetermined algorithm to predict an attack group or malware associated with the malicious site, and apply the results of the prediction to the judgment rule to predict the survival period.

[0164] This makes it possible to predict the attack group and malware used by a malicious site based on the origin and country of the site's operation, the systems and services it targets, and past trends in the type of malware that is likely to be used, and thus further improves the accuracy of survival period predictions.

[0165] In addition, in the malignant site survival time prediction system of this embodiment, the computing device may generate a list of sites to be monitored or blocked depending on the role of the malignant site indicated by the survival time prediction result.

[0166] This makes it possible to generate accurate lists based on, for example, the fact that sites that play a role in distributing malware should be blocked quickly, and that sites that provide instructions to malware distribution sites should be continuously monitored.

[0167] In addition, in the malicious site survival prediction system of this embodiment, the computing device may further perform a process of maximizing the blocking list or the monitoring list based on the predicted survival time and the resource performance that can deal with blocking or monitoring of the malicious site.

[0168] This makes it possible to efficiently generate block lists and watch lists within the resources available for maintaining and managing the lists, and then to create a situation in which the lists can be utilized.

[0169] In addition, in the malicious site survival prediction method of this embodiment, the information processing device may further perform a process of outputting the results of the observation, the results of the prediction, and at least one of the block list or the monitoring list to a specified device.

[0170] In addition, in the method for predicting the survival time of a malicious site of this embodiment, the information processing device may predict the survival time by applying, in addition to the results of the observation, external information regarding the malicious site that is published on the network to the judgment rule.

[0171] In addition, in the method for predicting the survival time of a malignant site of this embodiment, the information processing device may estimate the properties, including the role, of the malignant site based on the results of the observation and the external information, and apply the results of the estimation to the judgment rule to predict the survival time.

[0172] In addition, in the malicious site survival time prediction method of this embodiment, the information processing device may apply the observation results and the external information to a predetermined algorithm to predict an attack group or malware associated with the malicious site, and apply the result of the prediction to the judgment rule to predict the survival time.

[0173] In addition, in the method for predicting the survival time of a malicious site of this embodiment, the information processing device may generate a list of sites to be monitored or blocked depending on the role of the malicious site indicated by the prediction result of the survival time.

[0174] In addition, in the malicious site survival time prediction method of this embodiment, the information processing device may further perform a process of maximizing the blocking list or the monitoring list based on the predicted survival time and the resource performance that can deal with blocking or monitoring of the malicious site. [Explanation of symbols]

[0175] 101 Malignant site survival prediction system 102 IF (communication equipment) 103 CPU (computing unit) 104 Main memory 105 Storage device 106 I / O Devices 107 Communication Channel 108 Malicious Site Monitoring Program 109 Survival Prediction Program 110 Screen Drawing Programs 111 List Building Programs 112 List of malicious sites 113 Observation results storage area 114 User terminal 115 Network 116 Internet

Claims

1. A communication device for accessing a network; a storage device for storing information on each malicious site in the network; a computing device which executes a process of accessing each of the malicious sites and observing a predetermined event at the malicious site, a process of predicting the survival time of the malicious site by applying a result of the observation to a judgment rule which specifies a relationship between a tendency of the event at the malicious site and the survival time of the malicious site, and a process of selecting a predetermined one of the malicious sites according to the survival time and generating a blocking list or a monitoring list; A malignant site survival prediction system comprising:

2. The computing device includes: and further executing a process of outputting at least one of the observation result, the prediction result, and the blocking list or the monitoring list to a predetermined device.

2. The malignant site survival prediction system according to claim 1.

3. The computing device includes: In addition to the results of the observation, external information regarding the malicious site that is published on the network is applied to the judgment rule to predict the survival time.

3. The malignant site survival prediction system according to claim 2.

4. The computing device includes: Based on the result of the observation and the external information, a property including a role of the malignant site is estimated, and the result of the estimation is also applied to the judgment rule to predict the survival time.

4. The malignant site survival prediction system according to claim 3.

5. The computing device includes: applying the results of the observation and the external information to a predetermined algorithm to predict an attack group or malware associated with the malicious site, and applying the results of the prediction to the judgment rule to predict the survival period.

5. The malignant site survival prediction system according to claim 4.

6. The computing device includes: A list of sites to be monitored or blocked is generated according to the role of the malicious sites as indicated by the predicted survival time.

6. The malignant site survival prediction system according to claim 5.

7. The computing device includes: and further performing a process of maximizing the blocking list or the monitoring list based on the predicted survival time and the available resource capacity for blocking or monitoring the malicious site.

7. The malignant site survival prediction system according to claim 6.

8. An information processing device, The present invention comprises a communication device for accessing a network, and a storage device for storing information on each malicious site in the network, a process of accessing each of the malignant sites and observing a predetermined event at the malignant site, a process of predicting the survival time of the malignant site by applying the result of the observation to a judgment rule that specifies a relationship between a tendency regarding the event at the malignant site and the survival time of the malignant site, and a process of selecting a predetermined one of the malignant sites according to the survival time, Executing a process to generate a block list or a watch list; A method for predicting survival time of a malignant site.

9. The information processing device, and further executing a process of outputting at least one of the observation result, the prediction result, and the blocking list or the monitoring list to a predetermined device.

9. The method for predicting malignant site survival time according to claim 8.

10. The information processing device, applying external information published on the network regarding the malicious site in addition to the result of the observation to the judgment rule to predict the survival time; 10. The method for predicting malignant site survival time according to claim 9.

11. The information processing device, based on the result of the observation and the external information, estimating the nature of the malignant site including its role, and applying the result of the estimation to the judgment rule to predict the survival time; The method for predicting malignant site survival time according to claim 10.

12. The information processing device, applying the result of the observation and the external information to a predetermined algorithm to predict an attack group or malware associated with the malicious site, and applying the result of the prediction to the judgment rule to predict the survival period. The method for predicting malignant site survival time according to claim 11.

13. The information processing device, A list of sites to be monitored or blocked is generated according to the role of the malicious sites as indicated by the predicted survival time. The method for predicting malignant site survival time according to claim 12.

14. The information processing device, and maximizing the blocking list or the monitoring list based on the predicted survival time and available resource capacity for blocking or monitoring malicious sites. The method for predicting malignant site survival time according to claim 13.

Images