Information processing device and botnet analysis method

Abstract

To accurately identify a conning-tower server in a botnet and perform detailed analysis, such as classifying the botnet.SOLUTION: An information processing device 10 detects bots that constitute a botnet by analyzing packets observed on a dark net. Based on the packets transmitted from the detected bots, the information processing device 10 classifies the bots according to their types and identifies the common communication destination of the classified bots as a conning-tower server for the bots.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a technique for analyzing a botnet. [Background technology]

[0002] Traditionally, vulnerable hosts have been placed under the control of a command center server as bots, and attacks and the expansion of botnets (networks made up of the above-mentioned bots) have been carried out by issuing commands from the command center server.

[0003] One method for detecting the above-mentioned bots is to analyze the communication relationships in network flow data, while other methods for detecting control tower servers include analyzing the communication relationships in network flow data and static and dynamic analysis of malware.

[0004] By identifying a botnet, it is possible to take measures such as blocking communications with the command center server and notifying the administrator of the host that has become a bot, as well as to analyze the attack. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 7215571 [Non-patent literature]

[0006] [Non-Patent Document 1] Bo Hu, Kazunori Kamiya, Kenji Takahashi, Akihiro Nakao, "Piper: A Unified Machine Learning Pipeline for Internet-scale Traffic Analysis," 2020 IEEE Global Communications Conference Summary of the Invention [Problem to be solved by the invention]

[0007] However, the accuracy of techniques for identifying command and control servers using network flow data is insufficient.In addition, all of the conventional techniques have difficulty in identifying the type of attack a botnet is carrying out, making countermeasures and subsequent analysis difficult.

[0008] Therefore, an object of the present invention is to solve the above-mentioned problems, to identify the command center server of a botnet with high accuracy, and to perform detailed analysis such as classification of the botnet. [Means for solving the problem]

[0009] In order to solve the above-mentioned problems, the present invention is characterized by comprising a bot detection unit that detects bots that constitute a botnet by analyzing packets observed in a darknet, a bot classification unit that outputs information indicating the classification results of classifying the detected bots into types of bots based on packets sent from the bots, and a server identification unit that identifies the common communication destination of the classified bots in network flow data as the command center server of the bots and outputs information about the identified command center server. [Effects of the Invention]

[0010] According to the present invention, it is possible to identify the command center server of a botnet with high accuracy and perform detailed analysis such as classification of the botnet. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram illustrating an overview of an information processing device. [Figure 2] FIG. 2 is a diagram illustrating an overview of the information processing device. [Figure 3] FIG. 3 is a diagram illustrating an example of the configuration of an information processing device. [Figure 4] FIG. 4 is a diagram illustrating an example of non-bot exclusion condition information. [Figure 5] FIG. 5 is a diagram illustrating an example of bot classification condition information. [Figure 6] FIG. 6 is a diagram illustrating an example of network flow data. [Figure 7] FIG. 7 is a flowchart illustrating an example of a processing procedure executed by the bot detection unit. [Figure 8] FIG. 8 is a diagram showing an example of a bot detection result. [Figure 9] FIG. 9 is a flowchart illustrating an example of a processing procedure executed by the bot classification unit. [Figure 10] FIG. 10 is a diagram showing an example of the bot classification result (bot information). [Figure 11] FIG. 11 is a flowchart illustrating an example of a processing procedure executed by the bot amplifier. [Figure 12] FIG. 12 is a flowchart illustrating an example of a processing procedure executed by the condition update unit. [Figure 13] FIG. 13 is a diagram illustrating an example of information created by the condition update unit. [Figure 14] FIG. 14 is a flowchart illustrating an example of a processing procedure executed by the control tower server detection unit. [Figure 15] FIG. 15 is a diagram illustrating an example of control tower server information. [Figure 16] FIG. 16 is a flowchart illustrating an example of a processing procedure executed by the information addition unit. [Figure 17] FIG. 17 is a diagram illustrating an example of the configuration of a computer that executes a botnet analysis program. DETAILED DESCRIPTION OF THE INVENTION

[0012] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a description will be given of an embodiment of the present invention with reference to the drawings, but the present invention is not limited to the embodiment.

[0013] [overview] First, an overview of the information processing device of this embodiment will be described with reference to Fig. 1. In the following, a bot is a computer controlled by a command and control server (C2) of a botnet. For example, a bot attacks other computers (for example, Victim shown in Fig. 1) based on the control from the command and control server.

[0014] The information processing device analyzes packets observed on the darknet (a reachable and unused IP address space on the Internet) to detect bots.The information processing device then classifies the detected bot groups by type.The information processing device then identifies, for each classified bot group, a common communication destination of the bot group as a control tower server.

[0015] In this way, the information processing device detects bots by analyzing packets observed on the darknet, allowing for highly accurate detection of bots. Note that packets observed on the darknet contain more detailed information than packets in network flows. Therefore, the information processing device can classify detected bots in detail according to malware type and packet header values. The information processing device can also detect bots associated with each command center server and identify their association with attacks.

[0016] Next, the information processing device will be described in more detail with reference to Fig. 2. The information processing device 10 includes a bot detection unit 131, a bot classification unit 132, a bot amplification unit 133, a condition update unit 134, a control tower server detection unit 135, and an information addition unit 136.

[0017] The bot detection unit 131 refers to non-bot exclusion condition information (information indicating conditions for excluding packets other than those of bots) and detects bots from darknet traffic data.The bot detection unit 131 then outputs the bot detection result (bot detection result).

[0018] The bot classification unit 132 refers to the bot classification condition information and classifies the bot detection results output by the bot detection unit 131 into bot types. Then, it outputs the bot classification results (bot classification results). The bot classification results are accumulated in the storage unit of the information processing device 10 as bot information.

[0019] Furthermore, the bot amplification unit 133 detects a new bot from the network flow data by referring to the bot information. Then, the bot amplification unit 133 adds the detection result of the new bot to the storage unit of the information processing device 10 as bot information (bot amplification result).

[0020] The control tower server detection unit 135 refers to the bot information and detects, for each type of bot, a common communication destination of a group of bots of that type in the network flow data as the control tower server of that group of bots.The control tower server detection unit 135 then stores the detection result of the control tower server in the memory unit of the information processing device 10 as control tower server information.

[0021] In this way, the information processing device 10 can detect bots and classify the detected bots into types of bots. Also, the information processing device can accurately identify the control tower server.

[0022] Furthermore, the condition update unit 134 updates the non-bot exclusion condition information and the bot classification condition information based on the bot information stored in the storage unit. This allows the bot detection unit 131 to detect bots with even greater accuracy. Furthermore, the bot classification unit 132 can classify bots with even greater accuracy.

[0023] Furthermore, the information addition unit 136 adds related bot information of the command tower server (for example, information on bots that communicate with the command tower server) to the command tower server information of the command tower server based on the network flow data. This allows the information processing device 10 to accumulate detailed information on the command tower server, such as the relationship between the command tower server and subordinate bots.

[0024] [Configuration example] Next, an example of the configuration of the information processing device 10 will be described with reference to Fig. 3. The information processing device 10 includes, for example, an input / output unit 11, a storage unit 12, and a control unit 13.

[0025] The input / output unit 11 is an interface that controls the input and output of various data, and receives input of, for example, darknet traffic data and network flow data.

[0026] The storage unit 12 stores data, programs, etc. that are referenced when the control unit 13 executes various processes. The storage unit 12 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.

[0027] For example, the storage unit 12 stores the non-bot exclusion condition information, the bot classification condition information, the bot information output by the control unit 13, the control tower server information, and the like.

[0028] Non-bot exclusion condition information is information that indicates the conditions for excluding packets other than bots (see Figure 4). Here, packets other than bots observed on the darknet include, for example, packets generated by scan tools and packets from bots at data collection agencies, research institutes, etc. Therefore, the non-bot exclusion condition information describes, as conditions, the characteristics of packets generated by scan tools and the characteristics of packets from bots at data collection agencies, research institutes, etc.

[0029] The bot classification condition information is information that indicates the classification conditions for bots. For example, the bot classification condition information is information that indicates the conditions for classifying each malware type into a bot of that malware type (see FIG. 5). The bot classification condition information may also include, for example, conditions for further grouping the malware types of bots (for example, a list of port numbers, etc.).

[0030] Bot information is information indicating the classification result of each bot (for example, malware type, etc.) For example, as shown in Fig. 10, bot information is information indicating the source IP address of a packet from a bot (the IP address of the bot), protocol, source port number, source domain name, source CC (country code), sequence number, malware type, group name, classification conditions used, whether the data is derived from the darknet or Netflow data, etc.

[0031] 3 controls the entire information processing device 10. The functions of the control unit 13 are realized by, for example, a CPU (Central Processing Unit) executing a program stored in the storage unit 12.

[0032] The control unit 13 includes the above-mentioned bot detection unit 131, bot classification unit 132, bot amplification unit 133, condition update unit 134, command center server detection unit (server identification unit) 135, and information addition unit 136.

[0033] As described above, the bot detection unit 131 detects bots that constitute a botnet by analyzing packets observed on the darknet.

[0034] For example, the bot detection unit 131 refers to the non-bot exclusion condition information and, based on the values ​​of each field of the packets observed on the darknet, excludes packets other than bots (for example, packets having characteristics of packets generated by scan tools, packets having characteristics of packets from bots of data collection agencies, research institutions, etc., and other packets having characteristics that are not bots).The bot detection unit 131 then detects the excluded packets as bot packets.

[0035] As described above, the bot classification unit 132 classifies bots by type based on the packets of the bots detected by the bot detection unit 131. For example, the bot classification unit 132 refers to the header information of the packets of the detected bots and the bot classification condition information to classify the bots by malware type and group. Then, the bot classification unit 132 stores the bot classification results (bot information) in the memory unit 12.

[0036] The bot classification unit 132 may refer to the bot classification condition information and classify the bots using predetermined conditions, statistical methods, or machine learning.

[0037] As described above, the bot amplifier 133 detects new bots from the network flow data. For example, the bot amplifier 133 refers to the bot classification condition information and bot information in the memory unit 12, and for each bot classification, detects a host having characteristics similar to the bots of that classification from the network flow data as a new bot of that classification. Then, the bot amplifier 133 adds the detection result of the new bot to the memory unit 12 as bot information (bot amplification result).

[0038] When detecting a new bot, the bot amplifier 133 may refer to the bot classification condition information and perform the detection using predetermined conditions, a statistical method, or machine learning.

[0039] As described above, the condition update unit 134 updates the non-bot exclusion condition information and the bot classification condition information based on the bot information stored in the storage unit 12. For example, the condition update unit 134 extracts bot information from the storage unit 12 at predetermined intervals, and updates the non-bot exclusion condition information and the bot classification condition information based on the extracted bot information.

[0040] As described above, the control tower server detection unit 135 refers to the bot information stored in the memory unit 12, and detects, for each type of bot, a communication destination common to a group of bots of that type in the network flow data as the control tower server of that group of bots.The control tower server detection unit 135 then stores information about the detected control tower server (control tower server information) in the memory unit 12.

[0041] As described above, the information addition unit 136 adds information about the associated bots of the command tower server to the command tower server information in the memory unit 12 based on the network flow data. For example, when the information addition unit 136 acquires the command tower server information and bot information from the memory unit 12, it analyzes, based on the network flow data, the bots communicating with the command tower server, the types of bots in the bots, the confidence that the bot is the command tower server, etc. Then, the information addition unit 136 adds the above analysis results (information about the associated bots) to the command tower server information of the command tower server.

[0042] [Details of each part] Next, the processing executed by each unit of the information processing device 10 will be described in detail using a flowchart. In the following description, darknet traffic data is assumed to be communication data of packets captured on the darknet (unused IP address range). Network flow data is extracted destination IP addresses, port numbers, etc. in any network. This data is, for example, information extracted from packets collected from a network at a certain time, and includes information on each item shown in FIG. 6. In a large-scale network such as an ISP (Internet Service Provider), the information processing device 10 may collect only a portion of packets by sampling, and may not acquire the packet payload.

[0043] [Bot detection section] 7, the bot detection unit 131 receives darknet traffic data (see, for example, FIG. 6) as input and executes the following processing. First, the bot detection unit 131 extracts darknet traffic data at predetermined intervals (S11), extracts header values, makes them unique, etc. (S12). The bot detection unit 131 also acquires the country code, domain name, etc. of the traffic data extracted in S11 and adds them to the packet data after processing in S12 (S13: information enrichment by acquiring the country code, domain name, etc.).

[0044] After S13, the bot detection unit 131 refers to the non-bot exclusion condition information (see FIG. 4) and excludes packets that meet the relevant conditions (S14). For example, the bot detection unit 131 refers to the non-bot exclusion condition information (see FIG. 4) and excludes packet data of scans by tools such as ZMAP or data collection agencies such as shadow servers from the packet data after processing in S13. As a result, the bot detection unit 131 outputs a bot detection result (see FIG. 8).

[0045] [Bot Classification Department] 9, the bot classification unit 132 receives the bot detection result as input and executes the following process: First, the bot classification unit 132 extracts values ​​(source IP address, port number, protocol, etc.) contained in the bot packet data from the bot detection result and information converted based on these (domain name, country code, etc.) (S21).

[0046] Next, the bot classification unit 132 classifies the bot into malware types according to the classification conditions of the bot classification condition information (S22). For example, the bot classification unit 132 adds a mirai label to packet data that satisfies the mirai malware classification conditions of the bot classification condition information (see FIG. 5).

[0047] The bot classification unit 132 may further classify the bot according to the classification conditions of the bot classification unit condition information (S23). For example, consider a case where a list of source port numbers of mirai.A is set in the bot classification condition information as a classification condition for the malware type "mirai.A." In this case, the bot classification unit 132 classifies packet data that uses a source port number included in the list of source port numbers of mirai.A as mirai.A. As a result, the bot classification unit 132 outputs, for example, a bot classification result (bot information, see FIG. 10).

[0048] The bot classification results shown in Figure 10 are, for example, the bot detection results (packet source IP address, protocol, source port number, source domain name, source CC (country code), sequence number) to which the classified malware type, group name, classification conditions, etc. have been added.

[0049] [Bot Amplifier] The bot amplification unit 133 receives network flow data, bot information, and bot classification condition information as input, for example, as shown in FIG. 11, and executes the following process. First, the bot amplification unit 133 extracts network flow data, bot information, and bot classification condition information for each predetermined period (S33). Then, the bot amplification unit 133 references the bot information and bot classification condition information extracted in S33 and detects, for each bot classification, a bot having characteristics similar to those of a bot indicated in the bot information from the network flow data as a new bot (S34). After that, the bot amplification unit 133 outputs information on the detected new bot (bot amplification result). For example, the bot amplification unit 133 adds bot information with ID "2" shown in FIG. 10 to the bot information in the storage unit 12.

[0050] [Condition update section] 12, the condition update unit 134 receives bot information as input and executes the following process. First, the condition update unit 134 extracts bot information for each predetermined period (S41). Then, the condition update unit 134 compiles the protocols, source port numbers, destination port numbers, domain names, and source CCs associated with the same source IP address from the bot information extracted in S41, and creates a list of such information (S42).

[0051] For example, the condition update unit 134 aggregates the bot information extracted in S41 for each source IP address, and creates information indicating, for each source IP address, a list of protocols linked to that source IP address, a list of source port numbers, a list of destination port numbers, a list of sequence numbers, etc., as shown in Figure 13.

[0052] Returning to the explanation of Figure 12, the condition update unit 134 analyzes the information listed in S42 and updates the non-bot exclusion condition information using the analysis results (S43). For example, the condition update unit 134 analyzes the information listed in S42 using statistical processing, machine learning, etc. Then, based on the analysis results, the condition update unit 134 updates the source domain name of the non-bot exclusion condition information or adds a new tool judgment condition.

[0053] The condition update unit 134 also analyzes the information listed in S42 and updates the bot classification condition information using the analysis results (S44). For example, the condition update unit 134 analyzes the information listed in S42 using statistical processing, machine learning, etc., as described above. Then, based on the analysis results, the condition update unit 134 updates the list of destination port numbers indicated in the bot classification condition information and adds new malware detection conditions.

[0054] [Control tower server detection section] 14, the command tower server detection unit 135 receives bot information and network flows as input and executes the following process. First, the command tower server detection unit 135 extracts bot information for each predetermined period (S51). Then, based on the bot information extracted in S51, the command tower server selects, for each group of bots of the same classification, hosts with which multiple bots commonly communicate in network flow data as candidates for the command tower server (S52).

[0055] After S52, the command tower server detection unit 135 confirms, for each command tower server candidate, based on network flow data, etc., that there is bidirectional communication between the bot and the command tower server candidate, that the command tower server candidate is not the target of attacks, and that the command tower server candidate receives little communication from hosts other than bots (S53). Then, the command tower server detection unit 135 detects the command tower server candidate confirmed in S53 as the command tower server for the bot group of that category. The command tower server detection unit 135 executes the above process for each bot category. As a result, the command tower server detection unit 135 detects the command tower server for each bot category (S54). Thereafter, the command tower server detection unit 135 outputs information about the detected command tower server as command tower server information (see FIG. 15). The output command tower server information is stored in the memory unit 12.

[0056] For example, as shown in Figure 15, the command tower server information is information that correlates the IP address of the detected command tower server, the subordinate bots of the command tower server, the malware type of the subordinate bots, a list of destination port numbers and a list of sequence numbers used by the subordinate bots, the detection method of the command tower server (whether it was detected based on DN (darknet) data or NF (netflow) data), the timestamp when the command tower server was detected, etc.

[0057] [Information Addition Section] 16, the information addition unit 136 receives network flow data, command center server information, and bot information as input and executes the following process. First, the information addition unit 136 extracts bot information for each predetermined period (S61). Then, the information addition unit 136 extracts bots that satisfy predetermined conditions for each command center server indicated in the command center server information extracted in S61 (S62). For example, the information addition unit 136 extracts bots that have two-way communication with the command center server from among bots that have attributes indicated in the bot information on the network flow.

[0058] After S62, the information addition unit 136 analyzes, for each command tower server, the number of bots in that command tower server, the degree of certainty that it is a command tower server, the type of botnet, etc., from the bot information extracted in S62 (S63). Then, the information addition unit 136 outputs the above analysis results as related bot information for that command tower server. For example, the information addition unit 136 adds the above related bot information to the command tower server information for that command tower server in the memory unit 12.

[0059] For example, by checking the command tower server information including the above-mentioned related bot information, a user of the information processing device 10 can find out which server is the command tower server of the botnet, which bots are subordinate to the command tower server, detailed classification of the subordinate bots (malware type, etc.), how certain it is that the command tower server is the command tower server, and what the relationship is between the command tower server and the subordinate bots.

[0060] [Use Case] A use case of the information processing device 10 will be described below.

[0061] The non-bot exclusion condition information uses information that lists the source IP addresses of scan packets based on information such as the IP addresses of research scanners compiled by the SANS Internet Storm Center, IP addresses determined to be benign by GreyNoise, IP addresses determined to be scan tools based on header values, and IP addresses that use destination port numbers that have not been confirmed to be used by malware.

[0062] As described above, bot classification condition information is a condition for classifying bots, and is information indicating conditions for, for example, classifying bots into malware types, or further grouping malware types based on a list of values ​​such as port numbers. Bot classification condition information has, for example, a condition that the destination IP address is equal to the TCP sequence number, a classification name of "mirai," a list of destination port numbers, and classification "DPL1."

[0063] The bot detection unit 131 receives, for example, darknet traffic data, references non-bot exclusion condition information, and excludes traffic data determined to be sent from bots of data collection agencies, research institutions, etc. The bot detection unit 131 then extracts header and payload values ​​for each packet from the remaining traffic data, and outputs the extraction results to the bot classification unit 132 as bot detection results (see FIG. 8).

[0064] The bot classification unit 132 obtains the bot detection result from the bot detection unit 131 and classifies the bot using the bot classification condition information. For example, the condition that the destination IP address of the packet is equal to the TCP sequence number is a condition that the mirai malware has. Therefore, the bot classification unit 132 classifies the packet as mirai. Furthermore, if the destination port number of the packet is included in the list of destination port numbers for "DPL1" above, the bot classification unit 132 classifies the packet as DPL1.

[0065] The bot amplification unit 133 extracts bot information for a predetermined period from the memory unit 12 and, for each bot classification, detects nodes having characteristics similar to bots detected from the network flow as new bots. The bot amplification unit 133 then stores information about the detected new bots (bot amplification results) in the memory unit 12 as bot information.

[0066] The condition update unit 134 updates the non-bot exclusion condition information and the bot classification condition information based on the bot information stored in the storage unit 12. For example, for the data of each packet indicated in the bot information, the condition update unit 134 classifies data having the same destination IP address and TCP initial sequence number as data of the Mirai malware and its variants, and classifies data having a value of "0" in the upper 16 bits or the lower 16 bits of the TCP initial sequence number as data of the Hajime malware.

[0067] The condition update unit 134 then classifies the source IP addresses of the bot information using the classified malware type data. For example, the condition update unit 134 aggregates data for each protocol and each source IP address, and creates a list of destination port numbers used by the source IP addresses for each protocol. The condition update unit 134 then lists source IP addresses that have similarities, such as the same list of destination port numbers. Note that the condition update unit 134 may classify the source IP addresses of the bot information using machine learning or other methods in addition to the statistical methods described above.

[0068] After classifying the source IP addresses of the bot information as described above, the condition update unit 134 determines the malware type and group name for each classified source IP address based on the bot classification condition information. Based on the results of the determination, the condition update unit 134 creates bot classification condition information that associates the source IP address, header, and payload with the malware type and group name. The condition update unit 134 then updates the bot classification condition information in the storage unit 12 using the created bot classification condition information.

[0069] Furthermore, for example, if the domain name corresponding to the sender IP address described in the bot information is the domain name of a data collection organization, research organization, or the like, and the domain name is not described in the non-bot exclusion condition information, the condition update unit 134 creates non-bot exclusion condition information including the domain name.The condition update unit 134 then updates the non-bot exclusion condition information in the storage unit 12 using the created non-bot exclusion condition information.

[0070] The command tower server detection unit 135, for example, acquires the latest bot information (bot classification results) from the memory unit 12. Then, using traffic data such as network flow, the command tower server detection unit 135 extracts the IP addresses of hosts with which multiple bots commonly communicate, for each bot of the same malware type and the same group. Then, the command tower server detection unit 135 excludes IP addresses on a whitelist prepared in advance from the extracted IP addresses, and sets the IP addresses as candidates for the IP address of the command tower server.

[0071] Thereafter, if the command tower server detection unit 135 can confirm, using the network traffic data, that there is two-way communication between the bot and the candidate command tower server, that the candidate command tower server is not the target of attacks, and that the candidate command tower server receives little communication from hosts other than bots, then it detects the candidate command tower server as the command tower server for the bot group of the malware type and group.The command tower server detection unit 135 then stores information about the detected command tower server (command tower server information) in the memory unit 12.

[0072] The information addition unit 136 receives command tower server information, network flow data, and bot information as inputs and analyzes whether the command tower server is communicating bidirectionally with the bots in the bot information on the network flow, whether the port numbers used match those in the bot information, etc. Then, based on the analysis results, the information addition unit 136 calculates the certainty that the command tower server is the command tower server, etc. After that, the information addition unit 136 adds information such as the calculated certainty and the type of botnet of the command tower server to the command tower server information of the command tower server in the memory unit 12.

[0073] [System configuration, etc.] Furthermore, the components of each unit shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program executed by the CPU, or can be realized as hardware using wired logic.

[0074] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0075] [program] The information processing device 10 can be implemented by installing a program (botnet analysis program) as package software or online software on a desired computer. For example, by running the program on a computer in which the program is installed, the computer can function as the information processing device 10. The term "computer" as used herein includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as terminals such as PDAs (Personal Digital Assistants).

[0076] 17 is a diagram showing an example of the configuration of a computer that executes a botnet analysis program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0077] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0078] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define the processes executed by the information processing device 10 are implemented as program modules 1093 in which computer-executable code is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to those of the functional configuration of the information processing device 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0079] Data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as needed and executes them.

[0080] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a LAN (Local Area Network) or WAN (Wide Area Network)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070. [Explanation of symbols]

[0081] 10. Information processing equipment 11 Input / output section 12 Storage section 13 Control Unit 131 Bot detection unit 132 Bot Classification Department 133 Bot Amplifier 134 Condition update section 135 Control Tower Server Detection Unit 136 Information Addition Section

Claims

1. a bot detection unit that detects bots that make up a botnet by analyzing packets observed on the darknet; a bot classification unit that outputs information indicating a classification result of classifying the bot into types of bots based on packets transmitted from the detected bots; a server identification unit that identifies a common communication destination of the classified bots in the network flow data as a control tower server of the bots and outputs information about the identified control tower server; An information processing device comprising:

2. The bot detection unit Among the packets observed on the darknet, packets generated by scanning tools and packets sent from data collection agencies are excluded, and the remaining packets are detected as packets sent from the bot.

2. The information processing apparatus according to claim 1, wherein:

3. The information adding unit adds information indicating the bots under the control of the control tower server and the types of the bots under the control of the control tower server to the information of the control tower server.

2. The information processing apparatus according to claim 1, wherein:

4. A botnet analysis method executed by an information processing device, comprising: A step of detecting bots constituting a botnet by analyzing packets observed on the darknet; a step of outputting information indicating a classification result of the bots according to the type of the bots based on the packets transmitted from the detected bots; a step of identifying a common communication destination of the classified bots in the network flow data as a control tower server of the bots, and outputting information about the identified control tower server; A botnet analysis method comprising:

Images