Information processing apparatus and program

Abstract

A C2 server is determined.SOLUTION: The server determination unit obtains a ratio of the number of communications from the bot to the transmission destination device to the total number of communications to the transmission destination device for each of the transmission destination devices of the communications indicated by the communication datum, and determines the transmission destination device in which a value based on the ratio is larger than a server value as the C2 server. The server determination unit determines the C2 server based on the address of the bot and the communication datum.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a technology for determining a server device that issues commands to a communication device infected with malware. [Background technology]

[0002] Malware is malicious software, and a communication device infected with malware executes a distributed denial of service (DOS) attack or the like in response to commands from a communication device (server device) used by an attacker. A communication device that issues commands to a communication device infected with malware is also called a "command and control (C&C) server" or "C2 server." In this specification, a server device that issues commands to a communication device infected with malware is referred to as a C2 server. Also in this specification, a communication device infected with malware and that operates in response to commands from a C2 server is referred to as a "bot." A bot also operates to infect other communication devices with malware. Patent Document 1 discloses a configuration for detecting unauthorized communications by malware. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-142927 Summary of the Invention [Problem to be solved by the invention]

[0004] To deal with bot attacks, it is important to identify C2 servers from the many communication devices connected to a network. For example, if information about the operation of a known C2 server can be obtained, it is possible to identify the communication from that known C2 server by analyzing the communication data. However, it is not possible to identify C2 servers for which information about their operation is unavailable, such as unknown C2 servers.

[0005] The present disclosure provides a technique for determining a C2 server. [Means for solving the problem]

[0006] According to one aspect of the present disclosure, an information processing device includes an acquisition means for acquiring communication data regarding communications during a processing period, and a server determination means for determining a C2 server that gives instructions to the bot based on the bot's address and the communication data, and the server determination means calculates, for each destination device of communications indicated by the communication data, the ratio of the number of communications from the bot to the destination device to the total number of communications to the destination device, and determines that the destination device whose value based on the ratio is greater than a server threshold is the C2 server. [Effects of the Invention]

[0007] According to the present disclosure, the C2 server can be determined. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of an information processing device according to some embodiments. [Figure 2] FIG. 10 is an explanatory diagram of processing in a scan port determination unit. [Figure 3] FIG. 10 is an explanatory diagram of processing in a bot determination unit. [Figure 4] An explanatory diagram of the processing performed by the C2 server determination unit. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the scope of the invention as claimed, and not all combinations of features described in the embodiments are necessarily essential to the invention. Two or more of the features described in the embodiments may be arbitrarily combined. Furthermore, the same reference numerals are used for the same or similar components, and redundant explanations will be omitted.

[0010] First Embodiment 1 is a diagram showing an example of the configuration of an information processing device 100 according to this embodiment. A database (DB) 4 stores communication data. The communication data is data obtained by observing Internet Protocol (IP) packets transmitted and received over the Internet, and includes information indicating the observation time, source address, destination address, source port, and destination port of the observed IP packet.

[0011] When the information processing device 100 is operated by an operator who operates a part of a network of the Internet, the communication data stored in DB4 can be acquired by monitoring and observing IP packets at a network node that constitutes the part of the network operated by the operator. When the information processing device 100 is operated by a business operator other than the operator, the communication data stored in DB4 can be acquired from the operator who operates the part of the network of the Internet.

[0012] Each IP packet represented by the communication data stored in DB4 can be classified by communication. In this embodiment, each communication is classified by a "flow" identified by a combination of a source address, a destination address, a source port, and a destination port. IP packets that have the same source address, destination address, source port, and destination port belong to the same flow (communication). When communications are classified by flow, the communication data becomes data indicating the observation time or detection time of the IP packet for each flow.

[0013] In the following description, a communication device using the source address of a flow will also be referred to as a "source device," and a communication device using the destination address of a flow will also be referred to as a "destination device." A flow (communication) between a certain source address and a certain destination address will also be referred to as a flow (communication) from a source device (using the source address) to a destination device (using the destination address).

[0014] The information processing device 100 repeatedly executes, for example, a determination process for determining a C2 server. As an example, the information processing device 100 may execute the C2 server determination process once a day, once every two days, once a week, or once a month. Note that the C2 server determination process does not need to be repeated at predetermined intervals, and the C2 server determination process may be configured to be executed aperiodically and repeatedly. For example, the information processing device 100 may start the C2 server determination process every time a certain condition is satisfied. Furthermore, the information processing device 100 may start the C2 server determination process in response to a user instruction to execute the C2 server determination process.

[0015] In the determination process, the information processing device 100 uses communication data stored in DB4 that is within a processing period. The processing period can be defined as a predetermined period of time that is relative to the execution timing of the determination process and that is earlier than the execution timing. As an example, if the C2 server determination process is performed daily, the processing period can be 24 hours from the day before the execution of the determination process, or 24 hours from two days before. For example, if the processing period is 24 hours from the previous day, the communication data to be processed is communication data based on IP packets observed during the 24 hours from the previous day. In other words, the communication data to be processed is data indicating the detection time of IP packets for each flow on the day before the execution of the determination process.

[0016] When the C2 server determination process is periodically executed, the target processing periods for each determination process may partially overlap. For example, if the C2 server determination process is executed daily, the target processing period can be a total of 48 hours, including the day before the execution of the determination process and the day before yesterday. In this case, the target processing periods for two consecutive determination processes overlap by 24 hours. When the C2 server determination process is periodically executed, the target processing periods for each determination process do not have to be consecutive. For example, if the C2 server determination process is executed weekly, the target processing period can be the day before the execution of the determination process. In this case, the target processing periods for two consecutive determination processes are not consecutive, and some communication data will not be processed. When the determination process is triggered by a user's instruction to execute the C2 server determination process, the user can specify the target processing period. The acquisition unit 5 acquires communication data within the target processing period, which is the target of the determination process, from the DB 4 and outputs the data to the scanport determination unit 1, the bot determination unit 2, and the C2 server determination unit 3.

[0017] The scan port determination unit 1 determines a scan port from the destination port of the flow indicated by the communication data. A bot, for example, performs a port scan attack to search for available ports to infect other communication devices with malware. A scan port is a port searched by a bot. A port scan attack is carried out, for example, on many different communication devices. Therefore, when there are flows to many destination devices with a certain port as the destination port, the port can be determined to be a target port of a port scan attack, i.e., a scan port.

[0018] The scan port determination unit 1 calculates a first evaluation value for each destination port of the flow indicated by the communication data to evaluate whether the destination port of the flow indicated by the communication data is a scan port. The first evaluation value of a destination port is a value for evaluating the number of destination devices that are destinations of the flow of that destination port. In a first example, the scan port determination unit 1 groups flows with the same destination port and destination address into flow groups. Then, the scan port determination unit 1 calculates the first evaluation value of a destination port by counting the number of flow groups for that destination port. In the first example, the first evaluation value of a destination port is the number of destination devices of the flow of that destination port, or a value based on that number.

[0019] In the second example, the scan port determination unit 1 sets the first evaluation value of a destination port to the number of flows for that destination port indicated by the communication data or a value based on that number of flows. In the second example, if there are multiple flows that have the same destination port and destination address but at least one of the source port and source address is different, the first evaluation value is counted as the number of flows. However, even in the second example, the first evaluation value of a destination port increases as the number of communication devices scanned at that destination port increases, and therefore can be used to evaluate whether or not a port is a scan port.

[0020] The first example does not consider both the source address and the source port values, while the second example can be considered to consider both the source address and the source port values. It is also possible to configure the system so that the source address value is considered but the source port value is not, or the source port value is considered but the source address value is not. For example, if multiple flows from different source ports of the same source device (source address) are generated for a certain port (destination port) of a certain destination device (destination address), taking the source port value into consideration will count the number of flows as the first evaluation value; however, if the source port value is not considered, the first evaluation value will only count 1. It is also possible to use a value that increases as the number of communication devices scanned at the destination port increases.

[0021] 2 shows an example of the first evaluation value determined by the scan port determination unit 1. In FIG. 2, the first evaluation values ​​are displayed in descending order. The scan port determination unit 1 determines, as scan ports, ports whose first evaluation value is greater than a predetermined scan port threshold, or a predetermined number of ports that are at the top in descending order of first evaluation value. The scan port threshold is determined in advance and stored in the scan port determination unit 1.

[0022] For example, a port with port number 80 (hereinafter referred to as port 80) is defined as a port used by a web server. Because there are many web servers on the Internet, the first evaluation value of port 80 is large. On the other hand, it is also known empirically that port 80 is rarely used as a target for port scan attacks. Therefore, when a port that is unlikely to become a scan port, such as port 80, is empirically known to be unlikely to become a scan port, the port can be excluded from the scan ports regardless of the first evaluation value, or the first evaluation value can be omitted.

[0023] For this reason, the scan port determination unit 1 stores in advance an exclusion list that indicates one or more ports to be excluded from scan ports. The scan port determination unit 1 determines that one or more ports listed in the exclusion list are not scan ports regardless of the first evaluation value. Alternatively, the scan port determination unit 1 may be configured not to calculate the first evaluation value for one or more ports listed in the exclusion list. By omitting the process of calculating the first evaluation value for one or more ports listed in the exclusion list, it is possible to prevent the processing load on the information processing device 100 from becoming too high.

[0024] The scan port determination unit 1 notifies the determined scan port to the bot determination unit 2. For example, if the scan port determination unit 1 determines that ports P#1 to P#4 shown in FIG. 2 are scan ports, it notifies the bot determination unit 2 of ports P#1 to P#4 as scan ports.

[0025] The bot determination unit 2 determines the bot, more specifically, the bot's IP address, based on the scan port. As described above, bots perform port scan attacks on many communication devices. Therefore, if a flow occurs from the same source device to many destination communication devices with the scan port as the destination port, the source device can be determined to be a bot.

[0026] For this reason, the bot determination unit 2 calculates a second evaluation value for each source device (source address) of a flow indicated by the communication data. The second evaluation value of the source device (source address) is a value for evaluating the number of destination devices from which flows with the scan port as a destination port have occurred from the source device. In a first example, the bot determination unit 2 extracts flows with the scan port as a destination port from the communication data. Then, the bot determination unit 2 groups flows with the same destination address and source address from the extracted flows into flow groups. Then, the bot determination unit 2 calculates the second evaluation value by counting the number of flow groups for each source address. In the first example, the second evaluation value of the source device (source address) is the number of destination devices from which flows with the scan port as a destination port have occurred from the source device, or a value based on that number.

[0027] In the second example, the bot determination unit 2 extracts flows with a scan port as the destination port from the communication data. The bot determination unit 2 then calculates the second evaluation value by counting the number of extracted flows for each source address. In the second example, if there are multiple flows that have the same destination address and source address but at least one of the source port and destination port (scan port) is different, the second evaluation value will be counted for each of the multiple flows. However, even in the second example, the second evaluation value of a source device increases as the number of communication devices that the source device attacks in port scan attacks increases, and therefore can be used to evaluate whether or not a device is a bot.

[0028] The first example does not consider both the destination port and the source port values, while the second example can be considered to consider both the destination port and the source port values. It is also possible to configure the system so that the destination port value is considered but the source port value is not, or the source port value is considered but the destination port value is not. For example, if multiple flows are generated from the same source port of the same source device (source address) to multiple scan ports (destination ports) of a certain destination device (destination address), the second evaluation value will be counted as the number of flows if the destination port value is considered. However, if the destination port value is not considered, the second evaluation value will only be counted as 1. The second evaluation value of the source device (source address) is not limited to the above example. The larger the number of communication devices targeted by the port scan attack by the source device, the larger the second evaluation value can be.

[0029] FIG. 3 shows an example of the second evaluation value calculated by the bot determination unit 2. In FIG. 2, the second evaluation values ​​are displayed in descending order. The bot determination unit 2 determines that a source address whose second evaluation value is greater than a predetermined bot threshold is the IP address of a bot. The bot threshold is determined in advance and stored in the bot determination unit 2. For example, if the second threshold is 10, the bot determination unit 2 determines that a communication device using IP addresses IP#1 to IP#100 is a bot. The bot determination unit 2 notifies the C2 server determination unit 3 of the bot's identifier, in this example, the IP address used by the bot.

[0030] Figure 4 shows an overview of flows that occur between a bot, a C2 server, and a communication device that is neither a bot nor a C2 server (hereinafter referred to as a normal communication device). As shown in Figure 4, flows between normal communication devices are defined as normal flows. A flow from a bot to a C2 server occurs for the purpose of receiving instructions from the C2 server (hereinafter referred to as a C2 flow). Note that normal flows from a bot to a normal communication device also occur in response to user operations on a communication device that has become a bot, i.e., a communication device infected with malware. Furthermore, based on instructions from the C2 server, a bot may also generate flows (hereinafter referred to as attack flows) for DOS attacks or scanning attacks directed toward a normal communication device. Note that for some reason, a normal communication device may send IP packets addressed to a C2 server. In other words, a flow from a normal communication device to a C2 server (hereinafter referred to as a special flow) occurs. However, the number of special flows is usually small.

[0031] As such, the sources (source devices) of flows bound for the C2 server are mainly bots. Therefore, for each destination device (destination address) of the flows, the C2 server determination unit 3 calculates the total number of flows to that destination device (first number) and the number of flows from bots to that destination device (second number). The first number is the number of flows for that destination address, and the second number is the number of flows for that destination address that have the bot's IP address as the source address. In the case of a C2 server, the ratio of the second number to the first number is generally large.

[0032] Therefore, the C2 server determination unit 3 determines a destination device where the ratio of the second number to the first number or a value based on the ratio is greater than a predetermined C2 server threshold to be a C2 server. More specifically, the C2 server determination unit 3 determines a destination address where the ratio of the second number to the first number or a value based on the ratio is greater than a predetermined C2 server threshold to be an IP address used by a C2 server. The C2 server threshold is determined in advance and stored in the C2 server determination unit 3. The C2 server determination unit 3 determines the IP address used by the determined C2 server as an identifier of the C2 server and outputs this as an identifier of the C2 server from the information processing device 100.

[0033] As described above, according to this embodiment, it is possible to determine the C2 server without prior information regarding the operation of the C2 server.

[0034] Second Embodiment Next, the second embodiment will be described, focusing on the differences from the first embodiment. The C2 server determination unit 3 of this embodiment performs additional processing in addition to the processing described in the first embodiment. As shown in Figure 4, bots generate attack flows such as DDoS attacks and port scan attacks against normal communication devices. Therefore, if a normal communication device becomes the target of attack or scan, and many bots generate many attack flows against this normal communication device, this normal communication device may be erroneously determined to be a C2 server.

[0035] Generally, the duration (communication period) of attack flows for DDoS attacks and port scan attacks is shorter than the duration of C2 flows and normal flows. Therefore, the C2 server determination unit 3 excludes flows based on communication data within the processing period that have a communication period shorter than a predetermined period threshold. In this embodiment, the flow period (communication period) refers to the period from the time the first IP packet is observed to the time the last IP packet is observed within the processing period. The period threshold is determined in advance and stored in the C2 server determination unit 3. Based on flows that are equal to or greater than the period threshold, the C2 server determination unit 3 calculates the ratio of the second number to the first number described in the first embodiment. Subsequent processing is the same as in the first embodiment.

[0036] As described above, according to this embodiment, when determining a C2 server, it is possible to reduce erroneous determination of a C2 server due to a bot attack flow.

[0037] <Other forms> In the above embodiment, a flow is defined as a combination of a source address, a destination address, a source port, and a destination port. However, a flow can also be defined as a combination of a source address, a destination address, and a destination port without considering the value of the source port. Also, a configuration may be adopted in which each communication is identified by a combination of a source address and a destination address.

[0038] Furthermore, in the above embodiment, DB4 is provided within the information processing device 100, but DB4 can be an external database device accessible by the information processing device 100. In this case, the acquisition unit 5 accesses the database device via a network and acquires communication data within the processing target period from the database device.

[0039] In the information processing device 100 of the above embodiment, the scan port determination unit 1 determines a scan port based on communication data, the bot determination unit 2 determines a bot based on the communication data and the determined scan port, and the C2 server determination unit 3 determines a C2 server based on the communication data and the determined bot. However, if the bot identifier, that is, the bot's IP address, is available in advance, the scan port determination unit 1 and the bot determination unit 2 can be omitted. In this case, the bot's IP address is stored in DB4 in addition to the communication data. The bot's IP address is determined in advance in another device using various known methods, for example, and stored in DB4.

[0040] Furthermore, if the scan port is available in advance, the scan port determination unit 1 can be omitted. In this case, information indicating the scan port is stored in addition to the communication data in DB 4. The scan port is determined in advance by another device using various known methods, for example, and stored in DB 4.

[0041] The information processing device 100 described in the above embodiment can be realized by causing an apparatus having one or more processors and one or more memory devices to execute an appropriate program. More specifically, the one or more memory devices include a non-volatile memory device and a volatile memory device, and the program is stored in the non-volatile memory device. The one or more processors load the program stored in the non-volatile memory device into the volatile memory device and execute it, thereby realizing the above-mentioned information processing device 100. Therefore, according to the present disclosure, there is provided a program that causes an apparatus having one or more processors to function as the above-mentioned information processing device 100, and a computer-readable storage medium storing the program.

[0042] Furthermore, according to the present disclosure, there is provided a method for determining a C2 server, which is a method executed by the information processing device 100, a program for causing one or more processors to execute the determination method, and a computer-readable storage medium storing the program.

[0043] The above configuration makes it possible to identify the C2 server, thereby contributing to Goal 9 of the United Nations' Sustainable Development Goals (SDGs), which is to "Build resilient infrastructure, promote sustainable industrialization, and foster innovation."

[0044] The invention is not limited to the above-described embodiment, and various modifications and variations are possible within the scope of the gist of the invention. [Explanation of symbols]

[0045] 5: Acquisition unit, 3: C2 server determination unit

Claims

1. acquisition means for acquiring communication data regarding communications during a processing period; a server determination means for determining a C2 server that issues a command to the bot based on the bot's address and the communication data; Equipped with The server determination means calculates, for each destination device of the communication indicated by the communication data, the ratio of the number of communications from the bot to the destination device to the total number of communications to the destination device, and determines that the destination device whose value based on the ratio is greater than a server threshold is the C2 server.

2. The information processing apparatus according to claim 1 , wherein the total number of communications and the number of communications are the number of communications excluding communications whose communication duration is shorter than a predetermined threshold value among the communications indicated by the communication data.

3. The information processing apparatus according to claim 2 , wherein the communication period of a communication is a period from when a packet of the communication is first observed to when the packet is last observed in the processing period.

4. The computer further includes a bot determination means for determining the address of the bot based on the scan port scanned by the bot and the communication data, The information processing device described in claim 1, wherein the bot determination means calculates a second evaluation value for each source device of communication indicated by the communication data regarding the number of destination devices to which communication from the source device has been made using the scan port as the destination port, and determines that the address of a source device whose second evaluation value is greater than a bot threshold is the address of the bot.

5. 5. The information processing device of claim 4, wherein the second evaluation value of the source device is a value based on the number of destination devices to which communication from the source device has been made using the scan port as a destination port, or a value based on the number of communications from the source device using the scan port as a destination port.

6. further comprising a scan port determination means for determining the scan port based on the communication data; 5. The information processing device according to claim 4, wherein the scan port determination means calculates a first evaluation value for each destination port of communication indicated by the communication data, related to the number of destination devices through which communication to the destination port was performed, and determines that the destination port has a first evaluation value greater than a scan port threshold, or a predetermined number of destination ports in descending order of the first evaluation value, is the scan port.

7. The information processing device according to claim 6 , wherein the first evaluation value of a destination port is a value based on the number of destination devices that have communicated with the destination port, or a value based on the number of communications to the destination port.

8. 7. The information processing device according to claim 6, wherein the scan port determination means has an exclusion list indicating one or more ports, and determines that the one or more ports indicated in the exclusion list are not the scan port regardless of the first evaluation value.

9. 7. The information processing apparatus according to claim 6, wherein the scan port determination means has an exclusion list indicating one or more ports, and the first evaluation value is not calculated for the one or more ports indicated in the exclusion list.

10. the communication is a flow identified by a source address, a source port, a destination address, and a destination port, or a flow identified by a source address, a destination address, and a destination port, The information processing device according to claim 1 , wherein the communication data indicates, for each of one or more flows, a time at which a packet belonging to the flow was observed.

11. the communication data is stored in a database different from the information processing device; The information processing apparatus according to claim 1 , wherein the acquiring means acquires the communication data by communicating with the database.

12. further comprising a database for storing the communication data; The information processing apparatus according to claim 1 , wherein the acquiring means acquires the communication data from the database.

13. A program that, when executed by one or more processors of an apparatus having one or more processors, causes the apparatus to function as the information processing apparatus according to any one of claims 1 to 12.

Images