Monitoring device, monitoring method, and monitoring program

Abstract

To improve the accuracy of detecting the command center server. [Solution] The monitoring device 1 of the embodiment includes a detection unit 10, a passive determination unit 21, and an active determination unit 22. The detection unit 10 detects a suspected server, which is a server that sends attack commands to devices on the network, based on information about network traffic. The passive determination unit 21 determines whether the detection result by the detection unit 10 is correct or not, based on pre-prepared information about the suspected server. The active determination unit 22 determines whether the detection result by the detection unit 10 is correct or not, based on the results of communication with the suspected server.

Description

Technical Field

[0006] , ,

[0005] , , , ,

[0001] The present invention relates to a monitoring device, a monitoring method, and a monitoring program.

Background Art

[0002] In the Internet, service disruption attacks (DDoS (Distributed Denial of Service) attacks) that disrupt Internet services due to a large amount of traffic transmission or the like are a problem. An attacker issues an attack instruction to a large number of bots controlled by hijacking or the like on the Internet, and attacks are simultaneously transmitted from the bots, driving the Internet service into disruption. In addition, many vulnerable IoT (Internet of Things) devices and the like are infected and become bots.

[0003] In a DDoS attack, the attacker's attack instruction is often issued using a command tower server. As a method for early detection of the command tower server, a method of monitoring a large-scale network where bots are actually active is promising.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0007] As mentioned above, detecting the command center server based on network flow information uses only limited traffic information, which means that the detection results may include false positives.

[0008] Therefore, the objective of this invention is to determine which of the detected command center servers is truly malicious. [Means for solving the problem]

[0009] To solve the above-mentioned problems, the monitoring device of the present invention is characterized by comprising: a detection unit that detects a suspected server, which is a server that sends attack commands to devices on the network, based on information about network traffic; a first determination unit that determines whether the detection result by the detection unit is correct or not based on pre-prepared information about the suspected server; and a second determination unit that determines whether the detection result by the detection unit is correct or not based on the result of communication with the suspected server. [Effects of the Invention]

[0010] According to the present invention, it is possible to determine which of the detected command center servers is truly malicious. [Brief explanation of the drawing]

[0011] [Figure 1] Figure 1 shows an example of the configuration of the monitoring device according to the first embodiment. [Figure 2] Figure 2 shows an example of network flow data. [Figure 3] Figure 3 shows an example of the detection results. [Figure 4] Figure 4 is a diagram showing an example of a determination result. [Figure 5] Figure 5 is a diagram explaining the association of domain names. [Figure 6] Figure 6 is a flowchart showing the flow of the process for acquiring PCAP. [Figure 7] Figure 7 is a flowchart showing the flow of the inspection process. [Figure 8] Figure 8 is a diagram showing an example of dns_lookup. [Figure 9] Figure 9 is a diagram explaining the method for detecting communication ports. [Figure 10] Figure 10 is a diagram showing an example of data for inheritance of determination. [Figure 11] Figure 11 is a flowchart showing the flow of TCP Scan. [Figure 12] Figure 12 is a flowchart showing the flow of the preprocessing of active determination. [Figure 13] Figure 13 is a flowchart showing the flow of the active determination process by simulated communication. [Figure 14] Figure 14 is a diagram showing an example of the behavior of malware. [Figure 15] Figure 15 is a flowchart showing the flow of the process of the command tower communication determination unit. [Figure 16] Figure 16 is a diagram showing a configuration example of a computer that executes a monitoring program.

Embodiments for Carrying Out the Invention

[0012] Hereinafter, embodiments (embodiment forms) for carrying out the present invention will be described while referring to the drawings. The present invention is not limited to the embodiment forms. Note that the command tower server may sometimes be referred to as a C2 server (Command and Control Server), or a C&C server or the like.

[0013] The monitoring device of the embodiment monitors the network and detects the command tower server. Here, false detection may occur in the detection of the command tower server. Therefore, the monitoring device determines which of the detected devices are truly operating as command tower servers. For example, the monitoring device outputs, as the final detection result, the server determined to be truly operating as the command tower server among the detected command tower servers. This improves the detection accuracy of the command tower server and enables more reliable defense of communication with the command tower server.

[0014] [First Embodiment] The configuration of the monitoring device will be described with reference to FIG. 1. FIG. 1 is a diagram showing a configuration example of the monitoring device according to the first embodiment. As shown in FIG. 1, the monitoring device 1 receives the input of network flow data 31. Then, the monitoring device 1 outputs a determination result 33. The determination result 33 is information on the command tower server determined to be a true command tower server among the command tower servers (detection result 32) detected by the monitoring device 1.

[0015] As shown in FIG. 1, the monitoring device 1 includes a detection unit 10 and a determination unit 20. The detection unit 10 detects a command tower server based on the network flow data 31 and outputs information on the detected command tower server as the detection result 32. The determination unit 20 determines whether the command tower server indicated by the detection result 32 is a true command tower server, that is, whether it is truly malicious.

[0016] FIG. 2 is a diagram showing an example of network flow data. The network flow data 31 is information on packets collected from the network at each time. The packets that are the source of the network flow data 31 may be all or part of the packets transmitted and received in the network. For example, when the network is a large-scale network such as an ISP (Internet Service Provider), the headers of some packets may be collected by sampling, and the payloads may not be collected.

[0017] As shown in Figure 2, the network flow data 31 includes the time, source IP address, destination IP address, protocol, source port number, destination port number, number of bytes, and number of packets. However, the format of the network flow data 31 is not limited to that shown in Figure 2.

[0018] For example, Figure 2 shows that at time t1, a packet was collected with source IP address SIP1, destination IP address DIP1, protocol PR1, source port number SP1, destination port number DP1, and consisting of 1 PKT and 1 byte. Note that in the table-format data shown in Figure 2 and other figures, the values ​​in each cell are examples, and each cell will actually contain specific values.

[0019] Figure 3 shows an example of the detection result. As shown in Figure 3, the detection result 32 includes the detection ID, detection time, suspected IP address, suspected port number, features related to the suspected IP address, number of bots, and features related to the bots. However, the format of the detection result 32 is not limited to that shown in Figure 3.

[0020] The detection ID is an ID that identifies the record. The suspected IP address is a single IP address, such as IPv4 or IPv6. The suspected port number is one or more port numbers.

[0021] The features related to the suspected IP address are multiple statistical features extracted from the network flow data 31 regarding the suspected IP address. The number of bots is the number of bots (per IP address) communicating with the suspected IP address. The features related to the bots are the features of the bots (per IP address) communicating with the suspected IP address.

[0022] Furthermore, information other than the detection ID, detection time, and suspected IP address in the detection result 32 may be extracted from the network flow data 31 by a process separate from the algorithm used to detect the suspected IP address.

[0023] For example, Figure 3 shows that the result detected at time "t1" is shown in the record with detection ID "V001," and its contents show that the suspected IP address is CIP1, the suspected port number is Cport1, the feature quantity related to the suspected IP address is CBCV1, the number of bots is CBotnum1, and the feature quantity related to the bots is CBCV1.

[0024] Figure 4 shows an example of a judgment result. As shown in Figure 4, the judgment result 33 includes the judgment ID, judgment time, command center IP address, command center port number, command center domain name, malware communication type, and judgment reason. However, the format of the judgment result 33 is not limited to that shown in Figure 4.

[0025] The determination ID is an ID that identifies the record. The command center IP address is a single IP address such as IPv4 or IPv6. The command center port number is one or more port numbers. The command center domain name is one or more domain names associated with the command center IP address.

[0026] The malware communication type is the type of malware used to identify the command center server during the detection process. For example, the malware communication type might be "MIRAI malware: Check-in pattern A".

[0027] The reason for the determination indicates the reason why the command center server was determined to be the command center server during the determination process. Examples of reasons for determination include "check-in count exceeds the specified number & KeepAlive count exceeds the specified number."

[0028] For example, Figure 4 shows that the result determined at time "t1" is shown in the record with determination ID "V001," and its contents are that the command center IP address is VCIP1, the command center port number is VCport1, the command center domain name is VCDomain1, the malware communication type is VCType1, and the reason for determination is VCReason1.

[0029] Returning to Figure 1, the configurations of the detection unit 10 and the determination unit 20 will be described in detail. The determination unit 20 also includes a passive determination unit 21, an active determination unit 22, and a command center communication determination unit 23.

[0030] The passive determination unit 21 includes a malware search unit 211, a malware communication search unit 212, and a command center communication determination unit 213, and stores a malware database 214. The malware database 214 may be implemented using an external service. For example, the monitoring device 1 obtains information from the malware database 214 from an external server or the like.

[0031] The active determination unit 22 includes a verification model determination unit 221, a bot simulation communication execution unit 222, a command center communication determination unit 223, and an environment control unit 224.

[0032] The command tower communication determination unit 23 includes a check-in determination unit 231, an attack instruction determination unit 232, and a KeepAlive determination unit 233. The command tower communication determination unit 23 may be executed from the command tower communication determination units 213 and 223 and return a determination result.

[0033] The detection unit 10 detects a suspected server, which is a server that sends attack commands to devices on the network, based on information about network traffic (for example, network flow data 31). A suspected server is a server detected by the detection unit 10 and is suspected to be a command center server.

[0034] The passive determination unit 21 determines whether the detection result by the detection unit 10 is correct or not based on pre-prepared information about the suspected server. The active determination unit 22 determines whether the detection result by the detection unit 10 is correct or not based on the results of communication with the suspected server. A suspected server whose detection result is determined to be correct can be said to be the true command center server, or a server with a high probability of being the command center server.

[0035] Specifically, the detection unit 10 detects the IP address of the suspected server. The passive determination unit 21 then makes a determination based on the suspected server's IP address and the malware information registered in the malware DB 214 over a certain period in the past. The malware resides in a device that acts as a bot and operates based on attack commands from the command center server, carrying out DDoS attacks and the like.

[0036] As shown in Figure 5, the passive determination unit 21 may perform the determination by referring to the domain (domain name) associated with the IP address.

[0037] For example, suppose the detection unit 10 detects the IP address 51 of a suspected server. The domain "example.com" to which IP address 51 belongs has multiple resolution destinations. If the passive determination unit 21 determines that IP address 53, one of the resolution destinations for the domain "example.com," is truly malicious, then it also determines that IP address 51 is truly malicious. Furthermore, the passive determination unit 21 also determines that IP addresses 52 and 54, which are IP addresses in the same domain as IP address 53, are truly malicious.

[0038] [Examples] The following describes an embodiment of the monitoring device 1. In this embodiment, the monitoring device 1 identifies a command center server based on network traffic data collected in the ISP network. By blocking the identified command center server, attack commands to numerous bots carrying out DDoS attacks can be blocked, thereby implementing DDoS attack countermeasures.

[0039] First, it is assumed that in the malware DB214, IP addresses, the hash of the malware file, the Sandbox (dynamic analysis results of the malware), and PCAP (packet capture) are associated. That is, the passive determination unit 21 can obtain PCAP, i.e., information related to communications concerning the suspected server, from the malware DB214 by specifying the IP address of the suspected server. The malware search unit 211 and the malware communication search unit 212 obtain information by searching the malware DB214.

[0040] Figure 6 is a flowchart showing the process for obtaining PCAP. As shown in Figure 6, the malware scanning unit 211 searches for and obtains a HASH list from the suspected IP address (IP address of the suspected server) included in the detection result 32 (step S101). Note that in the figure, "IP address" may be abbreviated as "IP".

[0041] Next, the malware communication detection unit 212 retrieves a Sandbox list from each HASH (step S102). Subsequently, the malware communication detection unit 212 retrieves the PCAP size from each Sandbox list (step S103). The malware communication detection unit 212 retrieves the PCAP from the Sandbox list (step S104).

[0042] The passive determination unit 21 assumes that there are limitations on the number of queries that can be executed, such as when searching for malware DB214 using a paid API, and can perform filtering based on various conditions.

[0043] For example, the passive determination unit 21 sets an upper limit on the number of searches performed when obtaining the Sandbox list from the HASH in step S102, or on the total number of searches performed. If the number of searches reaches the upper limit, the passive determination unit 21 continues processing with the information obtained up to that point.

[0044] For example, when the passive determination unit 21 searches the HASH list in step S101, it can narrow down the results by specifying the file type of the HASH (e.g., "elf", "pe"). The default file types may be "elf", "shell", or "script".

[0045] For example, when the passive determination unit 21 searches the HASH list in step S101, it can narrow down the results by the initial registration date, etc. This allows the passive determination unit 21 to obtain information on malware registered in the malware DB 214 within a certain period in the past. By default, all registration dates are included. Also, for example, when the passive determination unit 21 searches for PCAPs in step S103, it can narrow down the results by the PCAP file size, etc. (for example, targeting only those above a certain size). This allows the passive determination unit 21 to target only PCAPs that contain a large amount of communication information. By default, all PCAPs are included in descending order of file size.

[0046] Next, the command center communication determination unit 213 performs an inspection on each acquired PCAP. Note that PCAPs include IP addresses, port numbers, etc. The command center communication determination unit 213 can also utilize information about the malware corresponding to the PCAP.

[0047] Figure 7 is a flowchart showing the flow of the inspection process. As shown in Figure 7, the command center communication determination unit 213 processes each PCAP in a loop, one IP address, one port number, and one malware. However, in the process of step S201 described later, the target IP addresses are expanded to include IP addresses within the same domain.

[0048] As shown in Figure 7, first, the command center communication determination unit 213 obtains an IP address of the same domain (step S201). For example, the command center communication determination unit 213 executes dns_lookup and obtains an IP address of the same domain as PCAP from the information included in the search results of Sandbox in Figure 6.

[0049] Figure 8 shows an example of dns_lookup. In the example in Figure 8, "10.0.0.1" is the IP address of the PCAP, and "192.168.0.1" is the IP address obtained from the DNS server.

[0050] In this case, when performing a hash search using an IP address, depending on the specifications of the malware DB214, the returned hash may include not only the specified IP address but also IP addresses within the same domain as the specified IP address. This means that the IP address of the command center server included in PCAP may be different from the specified IP address.

[0051] In other words, if the inspection is performed only on PCAPs obtained from a specified IP address, there is a possibility that the command center server may miss detections. The command center communication determination unit 213 can prevent detection misses by including IP addresses from the same domain as targets.

[0052] Returning to Figure 7, the command center communication determination unit 213 repeats the following process for each IP address in descending order of size. The command center communication determination unit 213 checks whether a port is specified for the IP address (step S202). If no port is specified for the IP address (step S202; none), the command center communication determination unit 213 detects a communication port (step S203). If a port is specified for the IP address (step S202; yes), the command center communication determination unit 213 does not detect a communication port.

[0053] The command center communication determination unit 213 extracts a list of ports bound to an IP address from the PCAP. The command center communication determination unit 213 may limit the packets (PCAPs) from which ports are extracted to those containing a payload. The command center communication determination unit 213 may also extract multiple ports bound to a single IP address.

[0054] Figure 9 illustrates the method for detecting communication ports. IP-A is an IP address included in the PCAP. IP-B is an IP address in the same domain as the IP address included in the PCAP. If the target IP address is IP-A, the command center communication determination unit 213 extracts PORT-I and PORT-II. If the target IP address is IP-B, the command center communication determination unit 213 extracts PORT-I and PORT-III.

[0055] Returning to Figure 7, the command center communication determination unit 213 performs the following processing for each port (specified port or extracted port). Here, the command center communication determination unit 213 performs the following processing for each piece of malware (HASH) associated with a port.

[0056] The command center communication determination unit 213 performs a C2 (command center server) scan of the malware (step S204). If the scan result with the C2 is True C2 (step S205; Yes), it proceeds to a TCP Scan scan (step S206). If the scan result with the C2 is not True C2 (step S205; No), the command center communication determination unit 213 repeats the processing for each malware and each port. Even if the scan result with the C2 is not True C2 (step S205; No), the command center communication determination unit 213 will ultimately proceed to a TCP Scan scan (step S206).

[0057] The command center communication determination unit 213 performs a C2 malware scan (step S204), for example, scanning for malware A and malware B. If a C2 scan result is obtained for a certain IP address, the determination reason is passed on to other IP addresses in the same domain. Specifically, the command center communication determination unit 213 creates data in CSV (Comma Separated Values) format as shown in Figure 10.

[0058] Figure 10 shows an example of data for carrying over a determination. Figure 10 shows that when the target IP address is IP-B and the test result is C2 (true C2), the result is carried over to IP-A, which is an IP address in the same domain. In that case, the reason for determining that it is an IP address in the same domain will be "detected c2 on same domain ip".

[0059] Figure 11 illustrates the flow of the TCP Scan inspection (step S206 in Figure 7). Figure 11 is a flowchart showing the TCP Scan process. A TCP Scan is a scan to discover available ports and may be performed by malware. Malware (especially IoT malware) tends to perform TCP scans to spread infection across the internet. On the other hand, communication that is not a TCP scan by malware is likely to be C2 communication. Therefore, C2 communication is extracted as an effect of performing a TCP Scan inspection. Note that the TCP Scan is performed regardless of whether or not a C2 result (True C2) is obtained in step S205 of Figure 7, but it is more effective when a C2 result (True C2) is not obtained. For example, if a C2 result (True C2) is obtained in step S205 of Figure 7, this result will not be overwritten by the TCP Scan inspection result.

[0060] As shown in Figure 11, first, the command center communication determination unit 213 checks whether a TCP scan operation has occurred on the client side based on the PCAP obtained from the malware DB 214, i.e., the PCAP of the malware sample (step S301). Here, the IP address of the target of the inspection is irrelevant. If there is no TCP scan operation in the PCAP (step S302; none), the command center communication determination unit 213 sets the result to C2 not detected (step S303). In this case, the determination unit 20 has determined that the detection result of the detection unit 10 is incorrect.

[0061] If the PCAP is performing a TCP scan (step S302; yes), it checks whether there is communication with the IP address being inspected (step S304). If there is no communication with the target IP address (step S304; no), the command center communication determination unit 213 sets the result to C2 not detected (step S305).

[0062] If there is communication to the target IP address (step S304; yes), the command center communication determination unit 213 checks the number of transmissions and receptions for each corresponding port (step S306). If there is transmission or reception on any port (step S307; yes), the command center communication determination unit 213 sets the result to Possibly C2 (high C2 probability) (step S308). In this case, the determination unit 20 has determined that the detection result of the detection unit 10 is correct. If there is no transmission or reception on any port (step S307; no), the command center communication determination unit 213 sets the result to C2 not detected (step S309).

[0063] The transmission and reception count check in step S306 will be explained in more detail. For example, the passive determination unit 21 determines that transmission and reception occurred (step S307; yes) if the amount of communication between the malware sample and IP addresses other than the suspected server is above a threshold, and the communication between the malware sample and the suspected server's IP address cannot be decoded by the specified network protocol. This is the case when the command center servers are communicating with each other using a network protocol that cannot be decoded from the outside.

[0064] Next, the processing of the active determination unit 22 will be explained. The active determination unit 22 causes the virtual machine to communicate with the suspected server and makes a determination based on the response from the suspected server during the communication.

[0065] Active detection processing involves actually sending scan packets over the network. Therefore, to reduce costs and risks, the pre-processing determines whether or not active detection processing is truly necessary, and if so, which malware-like communication should be executed.

[0066] Figure 12 is a flowchart showing the pre-processing flow for active determination. The verification model determination unit 221 performs the processing shown in Figure 12 for each suspected IP address.

[0067] First, the verification model determination unit 221 determines whether an active determination has been performed on the suspected IP address in the past (step S401). If an active determination has been performed in the past (step S401; yes), the verification model determination unit 221 determines that no active determination should be performed (step S402).

[0068] If no active determination has been performed in the past (step S401; none), the test model determination unit 221 refers to the result of the passive determination process for the suspected IP address and checks whether it is malicious (Possibly C2 (high C2 probability)) or not (step S403). If it is malicious (step S403; yes), the test model determination unit 221 decides to perform an active determination using the result of the passive determination (step S404). That is, a simulated communication is performed using the malware modeled after the suspected IP address identified in the passive determination process.

[0069] If the result is not malignant (step S403; none), the test model determination unit 221 checks whether there are any ActiveScan results (step S405). If there are ActiveScan results (step S405; yes), the test model determination unit 221 checks whether the ActiveScan results are due to a known protocol (step S406). If the ActiveScan results are due to a known protocol (step S406; Yes), the test model determination unit 221 determines that no active determination is to be performed (step S407). ActiveScan sends scan packets to IP addresses on the internet to identify open ports and the services running on those ports. Known services that use ActiveScan include Shodan and Censys.

[0070] If there are no ActiveScan results (step S405; none), or if the ActiveScan results are not from a known protocol (step S406; No), the verification model determination unit 221 determines whether the port number corresponding to the suspected IP address has been determined to be malicious in the past (step S408).

[0071] If the port number has been previously determined to be malicious (Step S408; Yes), the verification model determination unit 221 determines to perform an active determination using the communication model of malware that has been previously determined to be malicious (Step S409).

[0072] If the port number has not been previously determined to be malicious (Step S408; No), the test model determination unit 221 determines to perform an active determination by trying all models (communication mimicking all malware) or by making a fixed decision on a specific model (communication mimicking a specific malware) (Step S410).

[0073] Figure 13 is a flowchart showing the flow of the active determination process based on simulated communication. The bot simulated communication unit 222 and the environment control unit 224 perform the following processing on the suspected IP address that was determined to require active determination in the pre-processing stage.

[0074] First, the environment control unit 224 generates a simulated communication environment (step S501). Next, the bot simulated communication unit 222 sends the suspected IP address and target model (malware) to the simulated communication environment (step S502).

[0075] Next, the bot simulation communication unit 222 performs a simulated communication on the simulated communication environment (step S503). Then, the bot simulation communication unit 222 determines whether or not the suspected IP address is a command center server (step S504). The bot simulation communication unit 222 performs steps S503 and S504 for each of the suspected IP addresses.

[0076] Furthermore, the bot simulation communication execution unit 222 collects the judgment results (step S505). Subsequently, the environment control unit 224 deletes the simulation communication execution environment (step S506).

[0077] The processing of the command center communication determination unit 23 will now be explained. The command center communication determination unit 23 determines whether the detection result by the detection unit 10 is correct or not, based on the attack command sent from the suspected server to the device (bot), the check-in from the suspected server to the device, and the KeepAlive behavior between the suspected server and the device.

[0078] As shown in Figure 14, the behavior of each piece of malware is assumed to be predefined. Figure 14 is a diagram illustrating examples of malware behavior. For example, the behaviors of check-in, KeepAlive, and attack commands are defined.

[0079] Each value in Figure 14 represents the presence, number, and frequency of each behavior. For example, if a certain behavior occurs, the value will be 1; if it does not occur, the value will be 0 or no value will be set (not applicable). Assume that A_KA_1, A_KA_2, ..., A_KA_3 in Figure 14 are all 1. In this case, malware A always performs KeepAlive. Malware B does not perform KeepAlive because its KeepAlive value is "not applicable".

[0080] Figure 15 shows an example of a determination method by the command center communication determination unit 23 based on the behavior of malware. Figure 15 is a flowchart showing the processing flow of the command center communication determination unit. The command center communication determination unit 23 may perform determination processing based on instructions from the command center communication determination unit 213 or the command center communication determination unit 223. For example, the processing of the command center communication determination unit 23 may be called at S204 in Figure 7 and S504 in Figure 13.

[0081] The attack command determination unit 232 determines that the suspected server is the command center server if an attack command has been issued from the suspected IP address (step S601; present).

[0082] The check-in determination unit 231 determines that the suspected server is not a command center server if no attack orders have been issued from the suspected IP address (step S601; none) and no check-ins have been made from the suspected IP address (step S603; none).

[0083] The KeepAlive determination unit 233 determines that the suspected server is not a command center server (step S606) if a check-in has been made from the suspected IP address (step S603; present) and a KeepAlive has not been made with the suspected IP address (step S605; absent).

[0084] The KeepAlive determination unit 233 determines that if KeepAlive is being performed with the suspected IP address (step S605; Yes) and the number of KeepAlive calls is not equal to or greater than a predetermined number (step S607; No), then the suspected server is likely to be a command center server (step S608).

[0085] The KeepAlive determination unit 233 determines the suspected server to be the command center server (step S609) if KeepAlive has been performed with the suspected IP address (step S605; Yes) and the number of KeepAlive calls is greater than or equal to a predetermined number (step S607; Yes).

[0086] [Effects of the first embodiment] The monitoring device 1 includes a detection unit 10, a passive determination unit 21, and an active determination unit 22. The detection unit 10 detects a suspected server, which is a server that sends attack commands to devices on the network, based on information about network traffic. The passive determination unit 21 determines whether the detection result by the detection unit 10 is correct or not, based on pre-prepared information about the suspected server. The active determination unit 22 determines whether the detection result by the detection unit 10 is correct or not, based on the results of communication with the suspected server.

[0087] In this way, the monitoring device 1 performs passive and active judgments on the detection results of the command tower server. This allows the monitoring device 1 to determine which of the detected command tower servers is truly malicious.

[0088] The detection unit 10 detects the IP address of the suspected server. The passive determination unit 21 makes a determination based on the IP address of the suspected server and the malware information registered in the malware DB 214 over a certain period in the past. As a result, the monitoring device 1 can make a determination at low cost using existing information.

[0089] For example, suppose the detection unit 10 detects a first IP address as the IP address of a suspected server. The domain to which the first IP address belongs has multiple resolution destinations. If the passive determination unit 21 determines that a second IP address, which is one of the resolution destinations of that domain, is truly malicious, it will also determine that the first IP address is truly malicious. Furthermore, the passive determination unit 21 will also determine that IP addresses in the same domain as the second IP address are truly malicious. This allows the monitoring device 1 to efficiently determine whether an IP address belongs to the same domain as a suspected IP address.

[0090] The passive determination unit 21 determines that the detection result of the detection unit 10 is correct if the malware sample performs a TCP scan, the amount of communication between the malware sample and IP addresses other than the suspected server exceeds a threshold, and the communication between the malware sample and the suspected server's IP address cannot be decoded using the specified network protocol. This makes it possible to detect a command center server that uses a protocol that cannot be decoded from the outside. Note that communication between the malware sample and IP addresses other than the suspected server is considered a TCP scan. In other words, if communication that is not a TCP scan cannot be decoded using a common protocol, it is judged that there is a high possibility that the communication is C2 communication.

[0091] The active determination unit 22 causes the virtual machine to communicate with the suspected server and makes a determination based on the response from the suspected server during the communication. In this way, the monitoring device 1 can obtain more accurate information about the command center server not only by using existing information but also by actually initiating communication.

[0092] The command center communication determination unit 23 determines whether the detection result by the detection unit 10 is correct based on the attack commands sent from the suspected server to the device, the check-in from the suspected server to the device, and the KeepAlive behavior between the suspected server and the device. This makes it possible to make a determination that is in line with the actual behavior of the malware and the command center server.

[0093] [System configuration, etc.] Furthermore, the components of each part shown in the diagram are functional concepts and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown in the diagram, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions. Moreover, all or any part of the processing functions performed by each device can be realized by a CPU and the program executed on that CPU, or by hardware using wired logic.

[0094] Furthermore, among the processes described in the embodiments described above, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[0095] [program] The aforementioned monitoring device 1 can be implemented by installing a program (monitoring program) as packaged software or online software on a desired computer. For example, by having the monitoring device execute the above program, the monitoring device can be made to function as monitoring device 1. The term "monitoring device" here includes mobile communication terminals such as smartphones, mobile phones and PHS (Personal Handyphone System), as well as terminals such as PDA (Personal Digital Assistant).

[0096] Figure 16 shows an example of a computer running a monitoring program. Computer 1000 has, for example, memory 1010 and a CPU 1020. Computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0097] Memory 1010 includes ROM (Read Only Memory) 1011 and RAM (Random Access Memory) 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0098] The hard disk drive 1090 stores, for example, the OS 1091, application program 1092, program module 1093, and program data 1094. That is, the program that defines each process executed by the monitoring device 1 is implemented as a program module 1093 in which executable code for a computer is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to the functional configuration in the monitoring device 1 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0099] Furthermore, the data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, memory 1010 or hard disk drive 1090. The CPU 1020 then reads the program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as needed and executes them.

[0100] Furthermore, the program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090; for example, they may be stored in a removable storage medium and read by the CPU 1020 via a disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via a network interface 1070. [Explanation of symbols]

[0101] 1 Monitoring device 10 Detection unit 20 Judgment section 21 Passive determination unit 22 Active judgment part 23 Command Tower Communication Judgment Department 31 Network Flow Data 32 Detection Results 33 Judgment result 211 Malware Search Department 212 Malware Communication Search Unit 213 Command Tower Communication Judgment Department 214 Malware DB 221 Test Model Judgment Unit 222 Bot Simulation Communication Implementation Unit 223 Command Tower Communication Judgment Department 224 Environmental Control Unit 231 Check-in determination unit 232 Attack Order Determination Unit 233 KeepAlive Judgment Section

Claims

1. A detection unit detects a suspected server, which is a server that sends attack commands to devices on the network, based on information about network traffic. A first determination unit determines whether the detection result by the detection unit is correct or not, based on pre-prepared information regarding the suspected server. A second determination unit determines whether the detection result by the detection unit is correct or not based on the result of communication with the suspected server, A monitoring device characterized by having the following features.

2. The detection unit detects the IP address of the suspected server, The first determination unit makes a determination based on the IP address of the suspected server and the malware information registered in the database over a certain period in the past. The monitoring device according to feature 1.

3. The detection unit detects a first IP address as the IP address of the suspected server, The first determination unit determines that the detection result of the detection unit is correct for the first IP address if it determines that the detection result of the detection unit is correct for the second IP address, which is one of the domain resolution destinations associated with the first IP address. The monitoring device according to feature 2.

4. The first determination unit determines that the detection result of the detection unit is correct if a TCP scan operation is performed from the malware sample, the amount of communication between the malware sample and IP addresses other than the suspected server is above a threshold, and the communication between the malware sample and the suspected server's IP address cannot be decoded using the specified network protocol. The monitoring device according to feature 2.

5. The second determination unit causes the virtual machine to communicate with the suspected server and makes a determination based on the response from the suspected server in the communication. The monitoring device according to feature 1.

6. A third determination unit determines whether the detection result by the detection unit is correct, based on the attack command sent from the suspected server to the device, the check-in from the suspected server to the device, and the KeepAlive behavior between the suspected server and the device. The monitoring device according to claim 1, further comprising the following:

7. A detection step that detects a suspected server, which is a server that sends attack commands to devices on the network, based on information about network traffic, A first determination step, which determines whether the detection result obtained in the detection step is correct or not, based on pre-prepared information regarding the suspected server, A second determination step, which determines whether the detection result from the detection step is correct or not based on the result of communication with the suspected server, A monitoring method characterized by including the following.

8. A detection step that detects a suspected server, which is a server that sends attack commands to devices on the network, based on information about network traffic, A first determination step that determines whether the detection result obtained in the detection step is correct or not, based on pre-prepared information regarding the suspected server, A second determination step, which determines whether the detection result from the detection step is correct or not based on the result of communication with the suspected server, A monitoring program characterized by causing a computer to execute a command.

Images