Information processing device and program

Abstract

Determine the C2 server. [Solution] The information processing device comprises an acquisition means for acquiring communication data regarding communications during a processing period, and a server determination means for determining a C2 server that gives instructions to the bot based on the bot's address and the communication data.The server determination means calculates, for each destination device of communications indicated by the communication data, the ratio of the number of communications from the bot to the destination device to the total number of communications to the destination device, and determines that a destination device for which the value based on the ratio is greater than a server threshold value is the C2 server.

Description

[Technical field]

[0001] The present disclosure relates to a technology for determining a server device that issues a command to a communication device infected with malware. [Background technology]

[0002] Malware is malicious software, and a communication device infected with malware executes a distributed denial of service (DDоS) attack or the like in response to commands from a communication device (server device) used by an attacker. A communication device that issues commands to a communication device infected with malware is also called a "command and control (C&C) server" or "C2 server." In this specification, a server device that issues commands to a communication device infected with malware is referred to as a C2 server. Also, in this specification, a communication device that is infected with malware and performs operations in response to commands from a C2 server is referred to as a "bot." A bot also performs operations to infect other communication devices with malware. Patent Document 1 discloses a configuration for detecting unauthorized communication by malware. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2018-142927 A Summary of the Invention [Problem to be solved by the invention]

[0004] In order to deal with attacks by bots, it is important to identify C2 servers from the many communication devices connected to a network. For example, if information on the operation of a known C2 server can be obtained, the communication data can be analyzed to identify the communication by the known C2 server, and the C2 server can be identified. However, it is not possible to identify C2 servers whose operation information is not available, such as unknown C2 servers.

[0005] The present disclosure provides a technique for determining a C2 server. [Means for solving the problem]

[0006] According to one embodiment of the present disclosure, an information processing device includes an acquisition means for acquiring communication data regarding communications during a processing period, and a server determination means for determining a C2 server that gives instructions to the bot based on the bot's address and the communication data, and the server determination means calculates, for each destination device of communications indicated by the communication data, a ratio of the number of communications from the bot to the destination device to the total number of communications to the destination device, and determines a destination device for which a value based on the ratio is greater than a server threshold value to be the C2 server. Effect of the Invention

[0007] According to the present disclosure, the C2 server can be determined. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of an information processing device according to some embodiments. [Diagram 2] FIG. 11 is an explanatory diagram of a process performed by a scan port determination unit. [Diagram 3] FIG. 4 is an explanatory diagram of the process performed by a bot determination unit. [Figure 4] An explanatory diagram of the processing in the C2 server judgment unit. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the invention according to the claims, and not all combinations of features described in the embodiments are essential to the invention. Two or more features among the multiple features described in the embodiments may be arbitrarily combined. In addition, the same reference numbers are used for the same or similar configurations, and duplicated descriptions are omitted.

[0010] First Embodiment 1 is a diagram showing an example of the configuration of an information processing device 100 according to this embodiment. A database (DB) 4 stores communication data. The communication data is data obtained by observing Internet Protocol (IP) packets transmitted and received on the Internet, and includes information indicating the observation time, source address, destination address, source port, and destination port of the observed IP packet.

[0011] When an operator who operates a part of a network of the Internet operates the information processing device 100, the communication data stored in DB4 can be acquired by monitoring and observing IP packets in a network node that constitutes the part of the network operated by the operator. When an operator other than the operator operates the information processing device 100, the communication data stored in DB4 can be acquired from the operator who operates the part of the network of the Internet.

[0012] Each IP packet represented by the communication data stored in DB4 can be classified by communication. In this embodiment, each communication is classified by a "flow" identified by a combination of source address, destination address, source port, and destination port. IP packets that have the same source address, destination address, source port, and destination port are packets that belong to the same flow (communication). When communications are classified by flow, the communication data becomes data indicating the observation time or detection time of the IP packet for each flow.

[0013] In the following description, a communication device using the source address of a flow is also referred to as a "source device," and a communication device using the destination address of a flow is also referred to as a "destination device." In addition, a flow (communication) between a certain source address and a certain destination address is also referred to as a flow (communication) from a source device (using the source address) to a destination device (using the destination address).

[0014] The information processing device 100 repeatedly executes, for example, a determination process for determining a C2 server. As an example, the information processing device 100 may execute the C2 server determination process once a day, once every two days, once a week, or once a month. Note that it is not necessary to repeat the C2 server determination process at a predetermined cycle, and the C2 server determination process may be repeatedly executed aperiodically. For example, the information processing device 100 may start the C2 server determination process every time some condition is satisfied. Furthermore, the information processing device 100 may start the C2 server determination process when triggered by an instruction to execute the C2 server determination process from a user.

[0015] In the determination process, the information processing device 100 uses communication data within a processing target period among the communication data stored in the DB4. The processing target period can be defined as a relative predetermined period in the past based on the execution timing of the determination process. As an example, when the determination process of the C2 server is executed every day, the processing target period can be 24 hours of the day before the day the determination process is executed, or 24 hours of two days before. For example, if the processing target period is 24 hours of the previous day, the communication data to be processed is communication data based on IP packets observed during the 24 hours of the previous day. In other words, the communication data to be processed is data indicating the detection time of IP packets on the day before the day the determination process is executed for each flow.

[0016] In addition, when the C2 server judgment process is periodically executed, the processing target period in each judgment process may have a partially overlapping period. For example, when the C2 server judgment process is executed every day, the processing target period may be a total of 48 hours from the day before the judgment process is executed and the day before yesterday. In this case, the processing target period in two consecutive judgment processes has a 24-hour overlapping period. In addition, when the C2 server judgment process is periodically executed, the processing target period in each judgment process may not be consecutive. For example, when the C2 server judgment process is executed every week, the processing target period may be the day before the judgment process is executed. In this case, the processing target period in two consecutive judgment processes is not consecutive, and there is communication data that is not a processing target. In addition, when the judgment process is started by a user's instruction to execute the C2 server judgment process, the user can specify the processing target period. The acquisition unit 5 acquires communication data within the processing target period that is a processing target of the judgment process from the DB 4, and outputs it to the scan port judgment unit 1, the bot judgment unit 2, and the C2 server judgment unit 3.

[0017] The scan port determination unit 1 determines a scan port from the destination port of a flow indicated by communication data. A bot, for example, performs a port scan attack to search for available ports to infect other communication devices with malware. A scan port is a port searched for by a bot. A port scan attack is performed, for example, on many different communication devices. Therefore, when there are flows to many destination devices with a certain port as the destination port, the port can be determined to be a target port of a port scan attack, that is, a scan port.

[0018] In order to evaluate whether the destination port of the flow indicated by the communication data is a scan port, the scan port determination unit 1 calculates a first evaluation value for each destination port of the flow indicated by the communication data. The first evaluation value of a destination port is a value for evaluating the number of destination devices that are the destinations of the flow of the destination port. In a first example, the scan port determination unit 1 groups flows having the same destination port and destination address into flow groups. Then, the scan port determination unit 1 calculates the first evaluation value of a destination port by counting the number of flow groups of a destination port. In the first example, the first evaluation value of a destination port is the number of destination devices of the flow of the destination port, or a value based on that number.

[0019] In the second example, the scan port determination unit 1 sets the first evaluation value of a destination port to the number of flows of that destination port indicated by the communication data or a value based on that number of flows. In the second example, when there are multiple flows that have the same destination port and destination address but at least one of the source port and source address is different, the first evaluation value is counted as the number of multiple flows. However, even in the second example, the first evaluation value of a destination port becomes larger the more communication devices are scanned at that destination port, and therefore can be used to evaluate whether or not it is a scanned port.

[0020] The first example does not consider both the source address and source port values, whereas the second example can be considered to consider both the source address and source port values. It is also possible to configure the system so that the source address value is considered but the source port value is not considered, or the source port value is considered but the source address value is not considered. For example, when a plurality of flows are generated from different source ports of the same source device (source address) to a certain port (destination port) of a certain destination device (destination address), if the value of the source port is considered, the first evaluation value is counted by the number of flows, but if the value of the source port is not considered, the first evaluation value is counted by 1. It is to be noted that the first evaluation value of the destination port is not limited to the above example, and a value that increases as the number of communication devices scanned at the destination port increases can be used as the first evaluation value.

[0021] Fig. 2 shows an example of the first evaluation value determined by scan port determination unit 1. In Fig. 2, the first evaluation values ​​are displayed in descending order. Scan port determination unit 1 determines, as scan ports, ports whose first evaluation values ​​are greater than a predetermined scan port threshold, or a predetermined number of ports that are at the top in descending order of first evaluation values. The scan port threshold is determined in advance and stored in scan port determination unit 1.

[0022] For example, a port with a port number of 80 (hereinafter, port 80) is defined as a port used by a web server. Since there are many web servers on the Internet, the first evaluation value of port 80 is large. On the other hand, it is also empirically known that port 80 is rarely used as a target of port scan attacks. Therefore, when a port that is unlikely to become a scan port, such as port 80, is empirically known, the port can be excluded from the scan ports regardless of the first evaluation value, or the first evaluation value can be not calculated.

[0023] For this reason, an exclusion list indicating one or more ports to be excluded from scan ports is stored in advance in scan port determination unit 1. Scan port determination unit 1 determines that one or more ports indicated in the exclusion list are not scan ports regardless of the first evaluation value. Alternatively, scan port determination unit 1 may be configured not to obtain a first evaluation value for one or more ports indicated in the exclusion list. By omitting the process of obtaining a first evaluation value for one or more ports indicated in the exclusion list, it is possible to prevent the processing load of information processing device 100 from becoming too high.

[0024] The scan port determination unit 1 notifies the determined scan port to the bot determination unit 2. For example, when the scan port determination unit 1 determines that ports P#1 to P#4 shown in FIG. 2 are scan ports, it notifies the bot determination unit 2 of ports P#1 to P#4 as the scan ports.

[0025] The bot determination unit 2 determines the bot, more specifically, the IP address of the bot, based on the scan port. As described above, the bot performs port scan attacks on many communication devices. Therefore, when flows occur from the same source device to many destination communication devices with the scan port as the destination port, the source device can be determined to be a bot.

[0026] For this reason, the bot determination unit 2 obtains a second evaluation value for each source device (source address) of the flow indicated by the communication data. The second evaluation value of the source device (source address) is a value for evaluating the number of destination devices from which a flow with the scan port as a destination port occurs from the source device. In a first example, the bot determination unit 2 extracts flows with the scan port as a destination port from the communication data. Then, the bot determination unit 2 groups flows with the same destination address and source address from among the extracted flows into a flow group. Then, the bot determination unit 2 obtains the second evaluation value by counting the number of flow groups for each source address. In the first example, the second evaluation value of the source device (source address) is the number of destination devices from which a flow with the scan port as a destination port occurs from the source device, or a value based on that number.

[0027] In the second example, the bot determination unit 2 extracts flows with the scan port as the destination port from the communication data. The bot determination unit 2 then finds the second evaluation value by counting the number of extracted flows for each source address. In the second example, when there are multiple flows with the same destination address and source address but at least one of the source port and destination port (scan port) being different, the second evaluation value is counted for the number of multiple flows. However, even in the second example, the second evaluation value of the source device becomes larger as the number of communication devices that the source device attacks in a port scan attack increases, and therefore can be used to evaluate whether or not it is a bot.

[0028] The first example does not consider both the destination port and source port values, whereas the second example can be considered to consider both the destination port and source port values. It is also possible to configure the configuration so that the destination port value is considered but the source port value is not considered, or the source port value is considered but the destination port value is not considered. For example, when multiple flows are generated from the same source port of the same source device (source address) to multiple scan ports (destination ports) of a certain destination device (destination address), if the destination port value is considered, the second evaluation value is counted by the number of flows, but if the destination port value is not considered, the second evaluation value is counted by 1. It is to be noted that the second evaluation value of the source device (source address) is not limited to the above example, and a value that increases as the number of communication devices targeted by the port scan attack by the source device increases can be used as the second evaluation value.

[0029] FIG. 3 shows an example of the second evaluation value calculated by the bot judgment unit 2. In FIG. 2, the second evaluation values ​​are displayed in descending order. The bot judgment unit 2 judges a source address whose second evaluation value is greater than a predetermined bot threshold to be the IP address of a bot. The bot threshold is determined in advance and stored in the bot judgment unit 2. For example, when the second threshold is 10, the bot judgment unit 2 judges that a communication device using IP#1 to IP#100 as an IP address is a bot. The bot judgment unit 2 notifies the C2 server judgment unit 3 of the bot's identifier, in this example, the IP address used by the bot.

[0030] FIG. 4 shows an overview of flows that occur between a bot, a C2 server, and a communication device that is neither a bot nor a C2 server (hereinafter, referred to as a normal communication device). As shown in FIG. 4, flows between normal communication devices are defined as normal flows. A flow occurs from a bot toward the C2 server for the purpose of receiving commands from the C2 server (hereinafter, referred to as a C2 flow). Note that a normal flow from a bot toward a normal communication device also occurs according to the operation of a communication device that has become a bot, that is, a communication device infected with malware, by a user. Furthermore, based on commands from the C2 server, a flow for DоS attack or scan attack toward a normal communication device (hereinafter, referred to as an attack flow) also occurs from a bot. Note that for some reason, a normal communication device may send an IP packet addressed to a C2 server. In other words, a flow from a normal communication device toward a C2 server (hereinafter, referred to as a special flow) occurs. However, the number of special flows is usually small.

[0031] In this way, the source (source device) of flows heading to the C2 server is mainly a bot. Therefore, for each destination device (destination address) of the flows, the C2 server determination unit 3 calculates the total number of flows to the destination device (first number) and the number of flows from the bot to the destination device (second number). The first number is the number of flows to the destination address, and the second number is the number of flows that have the bot's IP address as the source address among the flows to the destination address. In the case of a C2 server, the ratio of the second number to the first number is generally large.

[0032] Therefore, the C2 server determination unit 3 determines that a destination device in which the ratio of the second number to the first number or a value based on the ratio is greater than a predetermined C2 server threshold is a C2 server. More specifically, the C2 server determination unit 3 determines that a destination address in which the ratio of the second number to the first number or a value based on the ratio is greater than a predetermined C2 server threshold is an IP address used by a C2 server. The C2 server threshold is determined in advance and stored in the C2 server determination unit 3. The C2 server determination unit 3 determines the IP address used by the determined C2 server as an identifier of the C2 server, and outputs this to the information processing device 100.

[0033] As described above, according to this embodiment, it is possible to determine a C2 server without prior information regarding the operation of the C2 server.

[0034] Second Embodiment Next, the second embodiment will be described, focusing on the differences from the first embodiment. The C2 server determination unit 3 of this embodiment performs additional processing in addition to the processing described in the first embodiment. As shown in Fig. 4, bots generate attack flows such as DDoS attacks and port scan attacks against normal communication devices. Therefore, if a normal communication device becomes an attack target or a scan target, and many bots generate many attack flows against this normal communication device, this normal communication device may be erroneously determined to be a C2 server.

[0035] In general, the period (communication period) of an attack flow for a DDoS attack or a port scan attack is shorter than the period of a C2 flow or a normal flow. Therefore, the C2 server determination unit 3 excludes flows based on communication data within the processing period that have a communication period shorter than a predetermined period threshold. In this embodiment, the period (communication period) of a flow is the period from the time when an IP packet is first observed to the time when an IP packet is last observed within the processing period. The period threshold is determined in advance and stored in the C2 server determination unit 3. The C2 server determination unit 3 calculates the ratio of the second number to the first number described in the first embodiment based on flows that are equal to or greater than the period threshold. The subsequent processing is the same as in the first embodiment.

[0036] As described above, according to this embodiment, when determining a C2 server, it is possible to reduce erroneous determination of the C2 server due to a bot's attack flow.

[0037] <Other forms> In the above embodiment, a combination of a source address, a destination address, a source port, and a destination port is defined as a flow. However, a combination of a source address, a destination address, and a destination port can be defined as a flow without considering the value of the source port. Also, a configuration in which each communication is identified by a combination of a source address and a destination address can be used.

[0038] In addition, in the above embodiment, DB4 is provided in the information processing device 100, but DB4 can be an external database device accessible by the information processing device 100. In this case, the acquisition unit 5 accesses the database device via a network and acquires communication data within the processing target period from the database device.

[0039] In the information processing device 100 of the above embodiment, the scan port determination unit 1 determines the scan port based on the communication data, the bot determination unit 2 determines the bot based on the communication data and the determined scan port, and the C2 server determination unit 3 determines the C2 server based on the communication data and the determined bot. However, if the bot identifier, that is, the bot's IP address, is available in advance, the scan port determination unit 1 and the bot determination unit 2 can be omitted. In this case, the DB4 stores the bot's IP address in addition to the communication data. The bot's IP address is determined in advance in another device by various known methods, for example, and stored in the DB4.

[0040] Furthermore, if the scan port is available in advance, the scan port determination unit 1 can be omitted. In this case, in addition to the communication data, information indicating the scan port is stored in DB 4. The scan port is determined in advance in another device by various known methods, for example, and stored in DB 4.

[0041] The information processing device 100 described in the above embodiment can be realized by causing an apparatus having one or more processors and one or more memory devices to execute an appropriate program. More specifically, the one or more memory devices include a non-volatile memory device and a volatile memory device, and the program is stored in the non-volatile memory device. The one or more processors load the program stored in the non-volatile memory device into the volatile memory device and execute it, thereby realizing the above-mentioned information processing device 100. Therefore, according to the present disclosure, a program that causes an apparatus having one or more processors to function as the above-mentioned information processing device 100, and a computer-readable storage medium storing the program are provided.

[0042] Furthermore, according to the present disclosure, there is provided a method for determining a C2 server, which is a method executed by the information processing device 100, a program for causing one or more processors to execute the determination method, and a computer-readable storage medium storing the program.

[0043] The above configuration makes it possible to identify the C2 server. Therefore, it is possible to contribute to Goal 9 of the United Nations' Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization, and foster innovation."

[0044] The invention is not limited to the above-described embodiment, and various modifications and variations are possible within the scope of the gist of the invention. [Explanation of symbols]

[0045] 5: Acquisition section, 3: C2 server judgment section

Claims

1. An acquisition means for acquiring communication data regarding communications during a processing period; A server determination means for determining a C2 server that issues a command to the bot based on the address of the bot and the communication data; Equipped with The server determination means, for each destination device of communication indicated by the communication data, calculates the ratio of the number of communications from the bot to the destination device to the total number of communications to the destination device, and determines that a destination device whose value based on the ratio is greater than a server threshold value is the C2 server.

2. The information processing apparatus according to claim 1 , wherein the total number of communications and the number of communications are the number of communications excluding communications whose communication duration is shorter than a predetermined duration threshold among the communications indicated by the communication data.

3. The information processing apparatus according to claim 2 , wherein the communication period of a communication is a period from when a packet of the communication is first observed to when the packet is last observed during the processing period.

4. The method further includes a bot determination unit that determines an address of the bot based on a scan port scanned by the bot and the communication data, The information processing device described in claim 1, wherein the bot determination means calculates a second evaluation value regarding the number of destination devices from which communication is performed from the source device with the scan port as the destination port for each source device of communication indicated by the communication data, and determines that the address of a source device whose second evaluation value is greater than a bot threshold value is the address of the bot.

5. 5. The information processing device of claim 4, wherein the second evaluation value of the source device is a value based on the number of destination devices to which communication has been performed from the source device with the scan port as the destination port, or a value based on the number of communications from the source device with the scan port as the destination port.

6. a scan port determination unit that determines the scan port based on the communication data, 5. The information processing device according to claim 4, wherein the scan port determination means calculates a first evaluation value related to the number of destination devices through which communication to the destination port was performed for each destination port of the communication indicated by the communication data, and determines that the destination port is the scan port if the first evaluation value is greater than a scan port threshold value, or if there are a predetermined number of destination ports in descending order of the first evaluation value.

7. 7 . The information processing device according to claim 6 , wherein the first evaluation value of a destination port is a value based on the number of destination devices that have performed communication with the destination port, or a value based on the number of communications with the destination port.

8. 7. The information processing device according to claim 6, wherein the scan port determination means has an exclusion list indicating one or more ports, and determines that the one or more ports indicated in the exclusion list are not the scan port regardless of the first evaluation value.

9. 7. The information processing apparatus according to claim 6, wherein the scan port determination means has an exclusion list indicating one or more ports, and the first evaluation value is not obtained for the one or more ports indicated in the exclusion list.

10. the communication is a flow identified by a source address, a source port, a destination address, and a destination port, or a flow identified by a source address, a destination address, and a destination port, The information processing apparatus according to claim 1 , wherein the communication data indicates, for each of one or more flows, a time at which a packet belonging to the flow was observed.

11. The communication data is stored in a database different from the information processing device, The information processing apparatus according to claim 1 , wherein the acquiring means acquires the communication data by communicating with the database.

12. A database for storing the communication data is further provided. The information processing apparatus according to claim 1 , wherein the acquiring means acquires the communication data from the database.

13. A program that, when executed by one or more processors of an apparatus having one or more processors, causes the apparatus to function as the information processing apparatus according to any one of claims 1 to 12.

Images