Information processing device, program, and information processing method

Abstract

This invention provides an information processing device, an information processing method, and a program capable of detecting unknown attacks. [Solution] In an information processing system in which an information processing device and a terminal are connected to communicate via a network, and the information processing device and a subsequent server are connected to communicate via another network, the information processing device comprises an acquisition unit and a degree determination unit. The acquisition unit acquires access request information input to the information processing device. The degree determination unit acquires the access request information acquired by the acquisition unit and determines the degree of possibility that attack code is included in the string of elements in the access request information that are likely to conceal attack code, such as query parameters. The degree determination unit determines that the likelihood of it being an attack code is high if there is a characteristic sequence of characters that conforms to syntactic rules, and determines that the likelihood of it being an attack code is low if there is a characteristic sequence that is unlikely to be used when creating attack code.

Description

[Technical Field]

[0001] The present invention relates to an information processing apparatus, a program, and an information processing method. [Background Art]

[0002] In recent years, various web applications have been provided via the Internet. On the other hand, with the popularization and expansion of services, cyberattacks targeting web applications have been increasing. Various cyberattack techniques are known, such as SQL (Structured Query Language) injection and OS (Operating System) command injection.

[0003] Conventionally, a method of responding to cyberattacks on these web applications by using a WAF (Web Application Firewall) is known (see, for example, Patent Document 1). As one type of WAF, there is a technology that detects attacks and blocks communication by creating a pattern file (blacklist) using data strings from cyberattacks performed in the past and performing matching. [Prior Art Documents] [Patent Documents]

[0004] [Patent Document 1] Japanese Unexamined Patent Publication No. 2005-134972 [Summary of the Invention] [Problems to be Solved by the Invention]

[0005] However, existing WAFs (Web Application Firewalls) create pattern files using data sequences from past attacks and perform matching based on this method; therefore, by their very nature, they cannot deal with unknown attacks (zero-day attacks). Furthermore, existing WAFs can be completely bypassed by using attacks that automatically generate a variety of slightly different attacks using artificial intelligence (AI).

[0006] Therefore, the present invention has been made in view of the above points, and aims to provide a technology capable of detecting unknown attacks. [Means for solving the problem]

[0007] One aspect of the present invention is an information processing device comprising: an acquisition unit that acquires access request information; and a degree determination unit that determines the degree to which an attack code is likely to be contained in a string based on a characteristic sequence of characters in the string contained in the access request information.

[0008] Furthermore, in one aspect of the present invention, the degree determination unit determines the degree to be high when there are many syntactic characters that indicate structure during processing within the string, and determines the degree to be low when there are few syntactic characters.

[0009] Furthermore, in one embodiment of the present invention, the syntactic characters include nested characters, which are pairs of two characters that create a nested structure between characters. The degree determination unit determines that the likelihood of the string containing the attack code is high when there are many nested structures, and low when there are few nested structures.

[0010] Furthermore, in one embodiment of the present invention, the degree determination unit removes the comment characters and the characters to be commented out when the string contains comment characters, which are a pair of two characters that comment out characters in between, and determines the degree to which the string after removal is likely to contain the attack code.

[0011] Furthermore, in one embodiment of the present invention, the degree determination unit determines that the likelihood of the attack code being included in the string is lower when the character following the nested character is a character that enhances the readability of the code compared to when the character following the nested character is not a character that enhances the readability of the code.

[0012] Furthermore, in one aspect of the present invention, the degree determination unit excludes a resource string from the degree determination if the string subject to degree determination contains a resource string that has the syntax character as a component and indicates a resource location.

[0013] Furthermore, in one aspect of the present invention, the information processing device further includes a feasibility determination unit that determines whether or not the access request information is normal based on the degree determined by the degree determination unit.

[0014] Furthermore, one aspect of the present invention is a program that causes a computer to perform an acquisition step of acquiring access request information, and a degree determination step of determining the degree to which an attack code is likely to be contained in a string based on a characteristic sequence of characters in the string contained in the access request information.

[0015] Furthermore, one aspect of the present invention is an information processing method comprising: an acquisition step of acquiring access request information; and a degree determination step of determining the degree to which an attack code is likely to be contained in a string based on a characteristic arrangement of characters in the string contained in the access request information. [Effects of the Invention]

[0016] According to the present invention, it is possible to detect unknown attacks. [Brief explanation of the drawing]

[0017] [Figure 1] This is a block diagram illustrating an example configuration of the information processing system 1 according to the embodiment. [Figure 2] FIG. 1 is a block diagram for explaining an example of a functional configuration of an information processing apparatus 10 according to an embodiment. [Figure 3] FIG. 2 is a diagram for explaining an example of processing for nested characters. [Figure 4] FIG. 3 is a diagram for explaining an example of preprocessing. [Figure 5] FIG. 4 is a diagram for explaining an example of processing for comment characters. [Figure 6] FIG. 5 is a diagram for explaining an example of exception processing for nested characters. [Figure 7] FIG. 6 is a flowchart for explaining an example of a processing flow of the information processing apparatus 10 according to the embodiment. [Figure 8] FIG. 7 is a diagram schematically showing an example of a hardware configuration of an information processing apparatus 90 applied to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0018] Embodiment Preferred embodiments of an information processing apparatus, a program, and an information processing method according to the present embodiment will be described in detail below with reference to the accompanying drawings. In the description of the drawings, the same or similar reference numerals are assigned to the same or similar parts. The present embodiment is not limited to these embodiments, and includes embodiments with various modifications or improvements. That is, the components described below include those that can be easily conceived by a person skilled in the art and those that are substantially the same, and the components described below can be combined as appropriate. Further, in the present embodiment, various omissions, substitutions, or modifications of components may be made without departing from the gist of the present invention.

[0019] In all the drawings for describing the embodiments, components having the same function are denoted by the same reference numerals, and repeated descriptions are omitted. In addition, the expression "based on XX" as used in the present application means "based at least on XX", and also includes cases where it is based on another element in addition to XX. Furthermore, "based on XX" is not limited to the case where XX is directly used, but also includes cases where it is based on a product obtained by performing calculation or processing on XX. "XX" is any element (e.g., any information). Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0020] [Configuration Example of Information Processing System] FIG. 1 is a block diagram for explaining a configuration example of an information processing system 1 according to an embodiment. The information processing system 1 includes an information processing apparatus 10, a terminal 20, and a downstream server 30. For explanation, an example in which one terminal 20 is connected to one information processing apparatus 10 is shown in FIG. 1, but a plurality of terminals 20 may be connected to one information processing apparatus 10. When one terminal 20 and a plurality of terminals 20 are not distinguished from each other, they may be simply referred to as the terminal 20. Similarly, a plurality of downstream servers 30 may also be connected to one information processing apparatus 10.

[0021] The information processing apparatus 10 and the terminal 20 are communicatively connected via a network N1. Further, the information processing apparatus 10 and the downstream server 30 are communicatively connected via a network N2. The network N1 and the network N2 may be networks using wireless communication, or may be networks using wired communication. The network N1 and the network N2 may be configured using, for example, the Internet, or may be configured using a local area network (LAN). The network N1 and the network N2 may be configured by combining a plurality of networks.

[0022] The information processing device 10 receives access requests from the terminal 20 to the successor server 30 and determines whether to forward the access to the successor server 30 or block it. In other words, the information processing device 10 relays access from the terminal 20 to the successor server 30. The successor server 30 comprises a control unit, a storage unit, and various input / output interfaces and communication interfaces. The control unit is equipped with a central processing unit (CPU) and operates based on programs and data stored in the storage unit, providing various functions. The storage unit is composed of, for example, a hard disk drive or semiconductor memory, and stores various information such as programs and data read by the control unit. The storage unit may be implemented by a virtual storage device such as a cloud server located outside the information processing device 10.

[0023] Terminal 20 is operated by the user. Terminal 20 is, for example, an information processing device such as a personal computer, tablet, or smartphone, and is equipped with a browser for viewing websites provided by the subsequent server 30. Terminal 20 is, for example, a user terminal that accesses a site.

[0024] The successor server 30 is an information processing device that provides a website to terminal 20 in accordance with the access request from terminal 20. The successor server 30 is the server that should ideally receive access from terminal 20.

[0025] [Functions of the information processing device] Figure 2 is a block diagram illustrating an example of the functional configuration of an information processing device 10 according to an embodiment. The information processing device 10 includes an acquisition unit 11, a degree determination unit 12, a pass / fail determination unit 13, and an output unit 14 as its functional units. Each of these functional units may be implemented using electronic circuits as needed. Furthermore, each functional unit does not have to be included in a single device, and the information processing device 10 may be configured from multiple devices.

[0026] The acquisition unit 11 acquires access request information A. The acquisition unit 11 may also be called the input unit because it acquires access request information A that is input to the information processing device 10. Access request information A is information relating to an access request from terminal 20 to subsequent server 30. Access request information A includes multiple elements such as domain, path, query, and further subdivisions thereof. The acquisition unit 11 may, for example, acquire access request information A from terminal 20 in real time. Alternatively, the acquisition unit 11 may store the access request information A acquired from terminal 20 in a storage unit or the like.

[0027] The degree determination unit 12 obtains the access request information A obtained by the acquisition unit 11. The degree determination unit 12 determines the degree of possibility (likelihood of being an attack code) that attack code is likely to be included in the strings of elements in the access request information A that are likely to conceal attack code, such as query parameters. Attack code is an aggressive data sequence (string), such as an SQL statement that the subsequent server 30 does not expect. An attacker might, for example, disguise attack code as a comment or something similar so that the subsequent server 30 cannot detect it as an attack, and then manipulate the subsequent server 30. The degree determined by the degree determination unit 12 may be a binary expression of whether or not attack code is included, or it may be an expression method with three or more levels.

[0028] Attackers often try to hide attack code within input data (access request information A) during an attack. For example, an attacker might hide JavaScript code within access request information A, disguised as a comment, and then manipulate it by making it appear as a valid program string. In this case, the attack code must be a valid program string, that is, it must adhere to syntax rules. It is rare for strings such as query parameters to be neatly arranged and adhere to syntax rules like a program. The information processing device 10 determines whether an attack has occurred by determining whether the string resembles a program (likely attack code).

[0029] The degree determination unit 12 determines that an attack code is highly likely if it contains a characteristic sequence of characters that conforms to the syntax rules, and less likely if it contains a characteristic sequence of characters that is unlikely to be used when creating an attack code. A characteristic sequence of characters that conforms to the syntax rules is, for example, a set of parentheses used for inputting arguments or calling functions. The processing of the degree determination unit 12 will be explained with specific examples.

[0030] [Handling of nested characters] The severity determination unit 12 extracts the string to be judged (for example, query parameters) from the access request information A. Figure 3 is a diagram illustrating an example of processing for nested characters. The severity determination unit 12 determines whether or not nested characters are contained within the string to be judged. Nested characters are syntactic characters that indicate the data structure during processing, and are pairs of characters that create a nested structure between characters. Nested characters may be parentheses such as {}, [], (), and <>. Characters may or may not exist between nested characters (for example, arguments), or characters may not exist (for example, function calls). Among nested characters, the character on the left is sometimes called the forward character, and the character on the right is sometimes called the backward character. In typical attack code, parentheses are provided as a pair of forward and backward characters. If only one exists, it will result in a syntax error, and the program may not function correctly, so it is unlikely that attack code with only one exists would be adopted. Therefore, the degree determination unit 12 determines that an attack code is more likely to be an attack code if nested characters are present. Specifically, the degree determination unit 12 adds characters between nested characters to the set of characters to be judged (see "2." and "3." in Figure 3). Adding characters to the set of characters to be judged in this way is also called recursively using input values. Although it is simply written as "characters," strings also contain characters, so they may be called characters or strings. Furthermore, recursively using input values ​​may also mean, for example, providing them as arguments to a function that performs a process of decomposing nesting. Also, this process is just one example, and the set of characters to be judged and the total number K may be managed by other methods.

[0031] The likelihood of an attack code P (the number of times it was determined to be likely an attack code) is calculated, for example, by "total number of input values ​​K (number of processing steps) - subtraction number L (number of times it was determined not to be likely an attack code)". If there is a sequence of characters that resembles the syntax rules of the code, such as a hierarchical structure using parentheses, it is recursively treated as an input value, and the total number of input values ​​K is added. In addition, the presence or absence of nested characters is also judged for strings that have been recursively treated as input values. On the other hand, for things unrelated to attack code, such as the influence of data format (comment characters as described later), the subtraction number L is added, and the increase in the likelihood of an attack code P due to the increase in the total number K is canceled out.

[0032] Next, we will explain the case where there are multiple nested characters. When multiple nested characters exist separately and independently, the severity determination unit 12 recursively takes each character between the multiple nested characters as an input value. When a second nested character exists between the first nested characters, the severity determination unit 12 recursively takes the characters between the first nested characters as an input value, and then recursively takes the characters between the second nested characters contained in the input characters (string) as input values ​​(from "1." to "3." in Figure 3). In other words, the total number of input values ​​K is increased by a number corresponding to the number of nested structures (nested characters) (two in Figure 3). As a result, the severity determination unit 12 can determine that the more nested structures there are, the higher the likelihood of it being an attack code, and the fewer nested structures there are, the lower the likelihood of it being an attack code. Note that in typical attack code, it is syntactically unlikely that only one of the characters preceding or following the second nested character would be included between the first nested characters. Therefore, the degree determination unit 12 identifies the longest nested string (the first nested string described above) by searching for nested strings in which all of the nested characters are interspersed, based on nested characters with few interspersed characters.

[0033] Above, we described an example of a process that enhances the appearance of attack code. Next, we will describe an example of a process that does not enhance the appearance of attack code.

[0034] [Pre-processing] The severity determination unit 12 modifies the data structure by performing preprocessing on the string to be judged. In APIs (Application Programming Interfaces) and the like, the widespread use of JSON (JavaScript Object Notation) data format has led to the frequent use of input data that resembles program code with a hierarchical structure. When a hierarchical structure exists, it may be judged that the hierarchical structure is a nesting relationship that increases the likelihood of it being attack code. However, this hierarchical structure is merely due to the data format and is unrelated to whether it is attack code. Therefore, if the input data is decodeable, it is preferable to decode it first to remove the influence of the data format before judging whether it is attack code. This allows the severity determination unit 12 to appropriately determine the possibility that the string to be judged contains attack code.

[0035] Figure 4 is a diagram illustrating an example of preprocessing. If the data description format of the access request information A is JSON, the degree determination unit 12 deconstructs the hierarchical structure and flattens it. In other cases, such as when the access request information A is "Base64" or "url-query", it decodes and flattens it. In Figure 4, "1." is an example of a string that the degree determination unit 12 is trying to determine. The degree determination unit 12 decodes "1." and recursively uses the resulting strings "2.", "3.", and "4." as input values. Furthermore, the degree determination unit 12 does not increase the likelihood of the code being an attack code P by increasing the number of subtractions L (for example, +3) to compensate for the increase in the total number K due to the recursive use of input values.

[0036] [Processing of comment characters] Figure 5 is a diagram illustrating an example of processing for comment characters. The degree determination unit 12 determines whether or not a comment character is included in the string to be judged. A comment character is a character that comments out the characters in between and temporarily excludes the commented-out string from processing. Examples of comment characters include " / / - \n (newline character)", " / * * / ",<!-- -->" and "# - \n" etc. are also acceptable. Generally, characters between comment characters are temporarily excluded from processing, so even if they are nested, it does not lead to the appearance of attack code. For this reason, the degree determination unit 12 removes the comment characters and characters that are to be commented out (characters between comment characters) from the string to be judged and uses that string as the new target for judgment. Specifically, the degree determination unit 12 recursively takes the new target as input value and adds a subtraction number L (for example, +1) as the total number K increases, so as not to increase the appearance of attack code P.

[0037] [Exception handling for nested characters] Figure 6 is a diagram illustrating an example of exception handling for nested characters. The degree determination unit 12 increases the subtraction number L if the character following the character after the nested character is a character that improves the readability of the code, thereby not increasing the likelihood of it being an attack code P. Characters that improve the readability of the code may include, for example, comments that allow for user explanations (more precisely, characters preceding comment characters), or characters that visually separate the code, such as line breaks or spaces. Ordinary users who are not attackers may add comments to record the operation and meaning of functions. On the other hand, attackers tend to avoid redundant descriptions in order to increase the success rate of their attacks, and rarely add comments that explain the operation of functions. Also, for similar reasons, attackers rarely add characters that improve the readability of the code, such as line breaks or spaces. Therefore, if the value following the character after the nested character is a character that improves the readability of the code as described above, it is assumed that the purpose is to improve the readability of the code by explaining the operation of functions or by using separators, and the subtraction number L is increased to determine that it is an attack code P (the probability that it is code written by an attacker) to be low. This allows the code to be judged as less likely to be an attack code (P) than if it lacked characters that enhance code readability. Furthermore, some programming languages ​​execute code line by line, and a newline character interrupts the process. Therefore, it is unlikely that an attacker would use newline characters to increase the success rate of an attack. Consequently, it is desirable for characters that enhance code readability to include newline characters.

[0038] [Processing of resource strings] Furthermore, the severity determination unit 12 may exclude resource strings indicating resource locations from the determination of whether the code is likely to be an attack code P. A resource string is a string separated by syntactic characters such as slashes and backslashes, and may be, for example, a URL (Uniform Resource Locator) or a UnixPath. Excluding from the determination of whether the code is likely to be an attack code P may, for example, remove resource characters such as comment characters and recursively use them as input values ​​to increase the subtraction number L, or it may be any other process described later. The severity determination unit 12 may also determine whether a resource string is valid using known methods such as regular expressions. Specifically, it may determine whether a URL is valid using common regular expressions such as "https?: / / [\w.?=&#%~ / -]+" or "https?:\ / \ / (?:www\.)?[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)+(?:\:\d+)?(?:\ / [^\s]*)?".

[0039] The degree determination unit 12 determines the likelihood P of an attack code for the target string by performing the above-described process. The higher the likelihood P, the higher the probability that the target string contains an attack code.

[0040] The feasibility determination unit 13 determines whether or not an attack code is included in the string of the access request information A by comparing the attack code likelihood P determined by the degree determination unit 12 with a threshold. The threshold may be predetermined by the designer or administrator of the information processing device 10 (for example, 3), or it may be automatically determined by representative values ​​such as the maximum value or median value of the attack code likelihood P determined for access request information A acquired for a predetermined period for learning purposes.

[0041] The output unit 14 outputs to the subsequent server 30 any access request information A that does not contain attack code, i.e., access request information A that has been determined by the approval / rejection unit 13 to be a normal access. The output unit 14 also blocks any access request information A that contains attack code, i.e., access request information A that has been determined by the approval / rejection unit 13 to be an abnormal access.

[0042] In the above, we described an example in which the likelihood of an attack code P (more precisely, the total number K) is increased by nested characters. However, since nested characters are merely one example of syntactic characters that indicate data structures, this embodiment is not limited to this example. The degree determination unit 12 determines that the more syntactic characters there are, the higher the likelihood of an attack code. Syntactic characters are syntactic characters that indicate the data structure of the code during processing, and include, for example, nested characters and delimiters, but do not include comment characters that do not allow processing of characters in between. Delimiters are characters that divide a string into multiple string chunks, and include, for example, "", "'", and " / ". Two delimiters of the same type can form a nested structure (for example, "'text'"). Also, since delimiters are written according to syntactic rules, they can be used as a criterion for determining the likelihood of an attack code P. Note that delimiters may be accompanied by characters that indicate escape processing, such as "¥", as needed. In this specification, when a nested structure is formed, characters whose preceding and succeeding characters are different are referred to as nested characters, and characters whose preceding and succeeding characters are the same are referred to as delimiters.

[0043] When decomposing nested structures, delimiters can be treated similarly to nesting characters, with the characters between them being recursively used as input values, or each character separated by the delimiter can be treated recursively as an input value. For example, if a string has one delimiter, the two resulting strings can be treated recursively as input values. Furthermore, strings with a predetermined number of characters or less after decomposition are unlikely to contain attack code and therefore do not need to be treated as input values ​​again. Note that when treating delimiters like nesting characters to decompose nested structures, the delimiter used as the leading character does not necessarily have to be usable as the trailing character, and a single delimiter can be used as both the leading and trailing character. Regardless of whether the syntactic characters being processed are nesting characters, delimiters, or both, or how the delimiters are processed, the more syntactic characters there are, the higher the likelihood of it being attack code P, and the fewer syntactic characters there are, the lower the likelihood of it being attack code P.

[0044] Furthermore, when using delimiters to determine the likelihood of an attack code P, the degree determination unit 12 may exclude the number of delimiters contained in a resource string such as a URL from the determination of the likelihood of an attack code P by adding the number of delimiters to the subtraction number L. In this case, the degree determination unit 12 does not need to remove the resource string such as a URL.

[0045] [Information Processing System Processing Flow] Figure 7 is a flowchart illustrating an example of the processing flow of the information processing device 10 according to this embodiment. The processing flow performed by the information processing device 10 will be explained with reference to this figure.

[0046] (Step S101) The information processing device 10 obtains access request information A from the terminal 20. The information processing device 10 extracts, for example, the query parameters in the access request information A and sets them as the string to be judged.

[0047] (Step S102) If the string for judgment and handling is decodeable, the information processing device 10 decodes it to flatten the hierarchical structure. In this process, the information processing device 10 removes the nesting and recursively uses it as input value, but does not add the attack code likelihood P.

[0048] (Step S103) If the string to be judged contains URLs, UnixPaths, comments, etc., the information processing device 10 excludes them from the determination of whether the code is likely to be an attack code P. For example, the information processing device 10 removes URLs, UnixPaths, comments, etc. from the string to be judged and recursively uses the remaining string as the input value, but does not add to the likelihood of it being an attack code P.

[0049] The information processing device 10 does not determine whether the code is likely to be an attack code P in steps S102 and S103 described above. In steps S104 to S106 described later, the information processing device 10 determines whether the code is likely to be an attack code P according to a nested character, which is one of the syntactic characters.

[0050] (Step S104) The information processing device 10 determines whether or not there are nested characters in the string to be judged. The information processing device 10 also determines the longest nested character.

[0051] (Step S105) If there are nested characters in the string to be judged (Step S104; Yes), the information processing device 10 decomposes the longest nested character and recursively uses the characters in between as new input values ​​for judgment. If multiple nested characters exist separately and independently of each other, the information processing device 10 performs the above process for each nested character.

[0052] (Step S106) When the nested characters are decomposed, the information processing device 10 adds an attack code likelihood P, assuming that the leading and trailing characters of the nested characters are properly organized. The information processing device 10 repeats the process from step S104.

[0053] (Step S107) If there are no nested characters in the string to be judged (Step S104; No), the information processing device 10 determines whether the access is normal or not by comparing the attack code likelihood P with a threshold.

[0054] (Step S108) If the likelihood of an attack code P does not exceed the threshold of 3 (Step S107; No), the information processing device 10 determines that the access request information A is a normal access that does not contain an attack code, and outputs the access request information A to the subsequent server 30.

[0055] (Step S109) If the likelihood of the code being an attack code P exceeds the threshold of 3 (Step S107; Yes), the information processing device 10 determines that the access request information A is an abnormal access containing an attack code and does not output the access request information A to the subsequent server 30.

[0056] [Summary of Embodiments] According to the embodiment described above, the information processing device 10 includes an acquisition unit 11 that acquires access request information A, and a degree determination unit 12 that determines the degree of possibility (attack code likelihood P) of an attack code being contained in a string based on a characteristic sequence of characters in the string contained in the access request information A. Conventionally, the detection of malicious data has been performed by a blacklist method that searches for known attack statements and by analyzing the input format (HTML (HyperText Markup Language) or CSS (Cascading Style Sheets), etc.). However, these methods could not deal with unknown vulnerabilities such as the "Log4j" attack. The information processing device 10 according to the embodiment can detect unknown vulnerabilities by searching for attacks by searching for program-likeness. Furthermore, since the basic syntax of programming does not differ significantly from one programming language to another, the information processing device 10 can handle attack codes in various languages. In addition, even if the attack code is slightly different using AI, the information processing device 10 can appropriately determine whether an attack code is contained from a characteristic sequence that appears in a valid program. Furthermore, since it can determine the presence or absence of an attack without using a typical pattern file, there is no need to configure or update pattern files, which can significantly reduce operational costs.

[0057] Furthermore, according to the embodiment described above, the degree determination unit 12 determines that the likelihood of an attack code being contained in a string is high when there are many syntactic characters (nested characters and delimiters) that indicate the data structure during processing within the string, and low when there are few syntactic characters. In other words, the degree determination unit 12 determines the likelihood of an attack code based on the amount of syntactic characters that appear when the code is written in accordance with the syntactic rules. The information processing device 10 according to the embodiment can reduce operational costs compared to when pattern matching is performed.

[0058] Furthermore, according to the embodiment described above, syntactic characters include nested characters, which are pairs of two characters that create a nested structure between characters. The degree determination unit 12 determines that the likelihood of attack code being contained in the string is high when there are many nested structures, and low when there are few nested structures. Valid program code uses nested characters to input arguments, call functions, etc., and therefore has a larger number of nested structures compared to typical query parameters. Also, in order to create valid code, nested characters must exist in pairs, with a forward character and a backward character. Therefore, even if AI or the like creates code that is subtly different in detail to circumvent blacklist-based detection methods, this relationship does not change, and thus, whether or not attack code is contained can be appropriately determined by the number of nested structures formed by nested characters, which are pairs of forward and backward characters. Furthermore, according to the above-described embodiment, since it does not strictly determine whether the code is valid or not, if an attacker deliberately inserts only the leading or trailing characters of nested characters to make it appear as invalid code, and then later extracts it and creates a program to run the code, the likelihood of it being an attack code P can be determined to be high.

[0059] Furthermore, according to the embodiment described above, the degree determination unit 12 removes comment characters, which are pairs of two characters that comment out characters in between, from the string, and determines the degree of possibility that the string after removal contains attack code. The commented-out characters are excluded from processing by the computer. Therefore, it is desirable to exclude comment characters and characters that are commented out from the determination of whether the string is likely to be an attack code P. This prevents the information processing device 10 from being unintentionally affected by characters in comments. In addition, even if an attacker disguises attack code in the form of a comment, the information processing device 10 according to this embodiment can determine whether or not an attack code is included from the nested structure of functions used to make the disguised attack code work effectively.

[0060] Furthermore, according to the embodiment described above, the degree determination unit 12 determines that the likelihood of a string containing attack code is lower when the character following the nested character is a character that enhances the readability of the code, compared to when the character following the nested character is not a character that enhances the readability of the code. In other words, the degree determination unit 12 does not increase the likelihood P of attack code for strings that have made efforts to enhance the readability of the code, and determines it to be low. Injection attacks that exploit system vulnerabilities are not always successful. Therefore, attackers rarely use comments, line breaks, spaces, etc., to improve the readability of the code in order to increase the success rate of the attack. On the other hand, ordinary users who are not attackers may add explanations to the code or use line breaks and spaces to make the divisions easy to understand at a glance, either for their own understanding or to explain to other users who are taking over the code. Therefore, the information processing device 10 according to the embodiment determines that the code was written by a non-attacker user and does not increase the likelihood P of attack code when a character that enhances the readability of the code is immediately after a function, etc. This avoids blocking code that is not an attack.

[0061] Furthermore, according to the embodiment described above, the degree determination unit 12 excludes resource strings (such as URLs) from the determination of the degree of possibility of containing attack code if the target string for determination of the degree of possibility of containing attack code contains a resource string (such as a URL) which has syntactic characters indicating the data structure at the time of processing as its constituent elements. Resource strings such as URLs and UnixPaths are strings with a special arrangement within the code, as their hierarchical structure is represented by slashes and backslashes. Slashes and backslashes used in resource strings are sometimes used as nesting characters or delimiters. If they are used as they are in the determination, there is a risk that the likelihood of it being an attack code P will unintentionally become high. The information processing device 10 according to the embodiment determines whether or not a resource string is valid using regular expressions, etc., and excludes valid resource strings from the strings to be determined for processing. If a resource string is determined to be invalid, there is a possibility that it is an attack code disguised as a resource string, so it is processed without being excluded from the determination. In this way, the information processing device 10 can appropriately determine the likelihood of it being an attack code P. Furthermore, since the single character "￥" is rarely used as a nesting character or delimiter, strings in which a hierarchical structure is represented by "￥" do not need to be excluded from the evaluation.

[0062] Furthermore, according to the embodiment described above, the information processing device 10 further includes a feasibility determination unit 13 that determines whether the access request information A is normal or not based on the degree of possibility that it contains attack code determined by the degree determination unit 12. The information processing device 10 further includes the feasibility determination unit 13, which can appropriately determine unauthorized access and access for attack purposes and block such access. Since the determination by the information processing device 10 does not use blacklist or whitelist pattern files, it can appropriately determine whether access is permitted in response to system updates, etc. Also, since the information processing device 10 does not strictly determine whether it is attack code, it can appropriately block access even if a string containing attack code that is subtly different in detail is input by AI, etc. According to the information processing device 10 that determines whether access is permitted based on the likelihood of it being attack code P, a wide range of pattern files to respond to updates and AI-generated attack code, and their updates, are not required, so operational costs can be significantly reduced.

[0063] [Example Hardware Configuration] Figure 8 is a schematic diagram of an example hardware configuration of an information processing device 90 applied to an embodiment. The information processing device 90 comprises a processor 91, main memory 92, communication interface 93, auxiliary storage device 94, input / output interface 95, and internal bus 96. The processor 91, main memory 92, communication interface 93, auxiliary storage device 94, and input / output interface 95 are connected to each other via the internal bus 96 so as to be able to communicate with each other. The information processing device 90 may be applied to, for example, an information processing device 10 or a subsequent server 30. In this case, for example, the acquisition unit 11 and the output unit 14 may be configured using the communication interface 93 and the input / output interface 95. For example, the storage unit (not shown) may be configured using the auxiliary storage device 94. In addition, the degree determination unit 12 and the feasibility determination unit 13 may be configured using the processor 91 and the main memory 92.

[0064] The information processing device 10 may be implemented using multiple information processing devices. For example, the information processing device 10 may be implemented using a device such as a cloud. For example, in the information processing device 10, the storage unit 22 and the control unit 23 may be implemented in different information processing devices. For example, the storage unit 22 of the information processing device 10 may be distributed and implemented in multiple information processing devices. Furthermore, the entirety or part of the functions of each part of the information processing device 10 in the above-described embodiment may be realized by recording a program for realizing these functions on a computer-readable recording medium, having a computer system read the program recorded on this recording medium, and executing it. Here, "computer system" includes hardware such as an OS and peripheral devices.

[0065] Furthermore, "computer-readable recording media" refers to portable media such as flexible disks, magneto-optical disks, ROMs, and CD-ROMs, as well as recording units such as hard disks built into computer systems. In addition, "computer-readable recording media" may include those that dynamically hold programs for a short period of time, such as communication lines used when transmitting programs over networks such as the Internet or communication lines such as telephone lines, and those that hold programs for a certain period of time, such as volatile memory inside computer systems that act as servers or clients in such cases. Moreover, the above-mentioned program may be for the purpose of realizing some of the functions described above, and may also be able to realize the above-mentioned functions in combination with programs already recorded in the computer system.

[0066] Although one embodiment of this invention has been described in detail above with reference to the drawings, the specific configuration is not limited to that described above, and various design changes can be made without departing from the spirit of this invention. Furthermore, the configurations described in each embodiment and example above may be combined. [Explanation of symbols]

[0067] 1... Information processing system, 10... Information processing device, 20... Terminal, 30... Successor server, 11... Acquisition unit, 12... Degree determination unit, 13... Feasibility determination unit, 14... Output unit, A... Access request information, K... Total number, L... Subtraction number, P... Likelihood of attack code

Claims

1. An acquisition unit that acquires access request information, A degree determination unit that determines the degree to which an attack code is likely to be contained in a string based on a characteristic sequence of characters in the string contained in the access request information, An information processing device equipped with the following features.

2. The degree determination unit determines the degree to be high when there are many syntactic characters that indicate structure during processing within the string, and determines the degree to be low when there are few syntactic characters. The information processing apparatus according to claim 1.

3. The aforementioned syntactic characters include nesting characters, which are pairs of characters that create a nested structure between characters. The degree determination unit determines that the likelihood of the attack code being included in the string is high when there are many nested structures, and low when there are few nested structures. The information processing apparatus according to claim 2.

4. The degree determination unit, when it finds that the string contains comment characters, which are a pair of two characters that comment out characters in between, removes the comment characters and the characters to be commented out, and determines the degree to which the string after removal is likely to contain the attack code. The information processing apparatus according to claim 1.

5. The degree determination unit determines that the likelihood of the attack code being included in the string is lower when the character following the nested character is a character that enhances the readability of the code compared to when the character following the nested character is not a character that enhances the readability of the code. The information processing apparatus according to claim 3.

6. The degree determination unit excludes a resource string from the degree determination if the string subject to the degree determination includes a resource string that has the syntax character as a component and indicates a resource location. The information processing apparatus according to claim 2.

7. Based on the degree determined by the degree determination unit, a feasibility determination unit determines whether the access request information is normal or not. The information processing apparatus according to any one of claims 1 to 6, further comprising

8. On the computer, The acquisition step to obtain access request information, A degree determination step that determines the degree to which an attack code is likely to be contained in a string based on a characteristic sequence of characters in the string contained in the access request information, A program that executes the command.

9. The acquisition step to obtain access request information, A degree determination step that determines the degree to which an attack code is likely to be contained in a string based on a characteristic sequence of characters in the string contained in the access request information, An information processing method having

Images