FRAUD DETECTION DEVICE, FRAUD DETECTION METHOD, AND FRAUD DETECTION PROGRAM

Abstract

This unauthorized activity detection device comprises: a function extraction unit that refers to a target function list in which functions to be analyzed are described, analyzes an input program, and extracts an analysis target function therefrom; a structure extraction unit that analyzes the program to extract execution paths and condition branches; a condition branch scoring unit that refers to a score list in which probabilities of satisfying conditions of the condition branches are described, and scores each of the extracted condition branches to generate a condition branch score table; an arrival probability calculation unit that, on the basis of the condition branch score table, calculates the probability of arriving at the analysis target function from the scores of the condition branches included in the execution paths; and a backdoor determination unit that provides notification of an execution path having a small arrival probability as an execution path that has a high possibility of being a backdoor execution path.

Description

[Technical field]

[0001] The present invention relates to a fraud detection device, a fraud detection method, and a fraud detection program. [Background technology]

[0002] As one of the supply chain risk countermeasures, the detection of malicious functions in software called backdoors is becoming increasingly important. Today's computer systems are so complex that it is difficult to configure them using only products from a single company. Therefore, it is common to procure products from outside and configure a system by combining the procured products. In this case, it is assumed that the manufacturers and supply chains of the procured products are trustworthy. This is because the detection of backdoors is also required as part of this.

[0003] However, detecting backdoors in firmware without source code requires a lot of time and effort. This is because it is necessary to perform reverse engineering, analyze suspicious functions and execution paths in detail, and manually screen for backdoors. Therefore, there is a demand for computer-assisted technology for the work involved in detecting backdoors (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] International Publication No. 2021 / 028989 Summary of the Invention [Problem to be solved by the invention]

[0005] The disclosures of the above-mentioned prior art documents are incorporated herein by reference. The following analysis has been carried out by the present inventors.

[0006] Incidentally, even in the prior art, it was possible to specify, from within a program, library functions and system calls that are often used by backdoors and that should be carefully analyzed, as defined as policies, and the execution paths that call them.

[0007] However, regardless of the presence of a backdoor, the execution path of a program often includes library functions and functions that define system calls as policies. In the end, it was necessary for a human to perform manual analysis of the candidate execution paths. Therefore, there was a need for a computer-assisted extraction of execution paths that are likely to be backdoors.

[0008] In view of the above-mentioned problems, an object of the present invention is to provide a fraud detection device, a fraud detection method, and a fraud detection program that contribute to reducing the labor and time of workers. [Means for solving the problem]

[0009] In a first aspect of the present invention, there is provided an fraud detection device comprising: a function extraction unit that refers to a target function list that lists functions to be analyzed, and analyzes an input program to extract functions to be analyzed; a structure extraction unit that analyzes the program and extracts execution paths and conditional branches; a conditional branch scoring unit that refers to a score list that lists the probabilities of satisfying a conditional branch condition, and assigns a score to each of the extracted conditional branches to create a conditional branch score table; an arrival probability calculation unit that calculates the probability of reaching the function to be analyzed from the scores for conditional branches included in the execution path based on the conditional branch score table; and a backdoor determination unit that notifies an execution path with a low arrival probability as one that is likely to be a backdoor execution path.

[0010] In a second aspect of the present invention, there is provided an fraud detection method which comprises: referring to a target function list which lists functions to be analyzed, analyzing an input program to extract functions to be analyzed, analyzing the program to extract execution paths and conditional branches, referring to a score list which lists the probabilities of satisfying conditions for the conditional branches, assigning a score to each of the extracted conditional branches to create a conditional branch score table, calculating the probability of reaching the function to be analyzed from the scores for conditional branches included in the execution paths based on the conditional branch score table, and notifying execution paths with a low probability of reaching the function to be analyzed as being highly likely to be backdoor execution paths.

[0011] In a third aspect of the present invention, there is provided a program for causing a computer to execute the following process: referring to a target function list describing functions to be analyzed, analyzing an input program to extract a target function to be analyzed; analyzing the program to extract execution paths and conditional branches; referring to a score list describing the probability of satisfying a conditional branch condition, scoring each of the extracted conditional branches to create a conditional branch score table; calculating the probability of reaching the target function to be analyzed from the scores for conditional branches included in the execution path based on the conditional branch score table; and notifying an execution path with a low probability of reaching the target function as one that is likely to be a backdoor execution path. This program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product. Effect of the Invention

[0012] According to each aspect of the present invention, it is possible to provide a fraud detection device, a fraud detection method, and a fraud detection program that contribute to reducing the labor and time of workers. [Brief description of the drawings]

[0013] [Figure 1]FIG. 1 is a schematic diagram of a fraud detection device according to an embodiment. [Diagram 2] FIG. 2 is a diagram showing an example of a program tree. [Diagram 3] FIG. 3 is a diagram showing an example of an execution path of a program. [Figure 4] FIG. 4 is a diagram showing an example of a score list. [Diagram 5] FIG. 5 is a diagram showing an example of a conditional branch in which branched execution paths lead to the same analysis target function. [Figure 6] FIG. 6 is a schematic flow chart illustrating a fraud detection method according to an embodiment. [Figure 7] FIG. 7 is a diagram illustrating an example of a hardware configuration of an apparatus used in the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. However, the present invention is not limited to the embodiment described below. In addition, in each drawing, the same or corresponding elements are appropriately assigned the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationship of each element, the ratio of each element, etc. may differ from the actual ones. There may also be parts in which the dimensional relationship and ratio differ between the drawings.

[0015] 1 is a schematic diagram of a fraud detection device according to an embodiment. As shown in FIG 1, the fraud detection device 100 includes a function extraction unit 110, a structure extraction unit 120, a conditional branch scoring unit 130, a probability of arrival calculation unit 140, a backdoor determination unit 150, and a storage device 160.

[0016] The function extraction unit 110 refers to a target function list 161 which describes the functions to be analyzed, analyzes the input program, and extracts the functions to be analyzed. The target function list 161 is stored in the storage device 160, and describes the functions to be analyzed.

[0017] The target function list 161 is a list of functions to be analyzed in advance, such as functions that are recognized as requiring attention based on call sites that call functions that have a sensitive effect on the system and on advance analysis of the inside of functions. The function extraction unit 110 analyzes a program such as that shown in Fig. 2, for example, and extracts the analysis target functions listed in the target function list 161. Note that although the locations of the functions listed in the target function list 161 are not all of the execution paths, there are still many of them in the actual program.

[0018] The structure extraction unit 120 analyzes a program to extract execution paths and conditional branches. For example, as shown in FIG. 3, a list of functions and conditional branches included in execution paths path_a to path_f in the program tree is created. The list of created execution paths may look something like the following. In the example below, for example, execution path EP#1 starts from funcA and ends at funcX. [CB1, CB2] indicates the conditional branches that exist before funcA calls funcB.

[0019] EP#1: [funcA, [CB1, CB2], funcB, ..., funcX] … EP#n: [funcA, [CB3], funcC, [CB5, CB6] ..., funcX]

[0020] The conditional branch scoring unit 130 refers to a score list 162 that describes the probability of satisfying the condition of the conditional branch, and creates a conditional branch score table by assigning a score to each of the conditional branches extracted from the program. The score list 162 is stored in the storage device 160, and describes the probability of satisfying the condition of the conditional branch.

[0021] A conditional branch is a process in which subsequent processing changes depending on whether a certain condition is met, and in source code representation, the part that represents the condition of a conditional branch (such as an if statement) can take a variety of expressions and values. For example, a typical source code representation of a conditional branch is as follows:

[0022] void func_A(int param_1) { ... If (cond) { system(...); ... } ... }

[0023] In the above example, various conditional expressions are written in the "cond" section, and it is necessary to evaluate these various conditional expressions. Below are some examples of conditional expressions.

[0024] cond = (val == 5) cond = (char_c == 'a') ·cond = (strchr(header, 0x2f) != 0x0) ·cond = ((stream = fopen(“file.txt”, “r”)) == NULL) ·cond = (strcmp(username, “AAA”) == 0) ·cond = (strcmp(username, “AAA”) == 0) && (strcmp(pass, “BBB”) == 0) ·cond = ((ret = user_defined_funcA(params)) == 0)

[0025] The above definition formula cond can be generalized as follows: if (cond) { ...} cond is Boolean cond = CMP(x, y) cond stores the result of the comparison

[0026] Arguments to CMP can be of various variable types. (int) val == 5 (char) c == 'a' ((FILE *) stream = fopen(...)) != NULL (char *) username == “xxx” ((int) ret = user_defined_func(...)) > 0

[0027] As described above, there are various conditional branches depending on the type of argument. The conditional branch scoring unit 130 refers to the score list 162 that describes the probability that the condition of the conditional branch is satisfied, and assigns a score to each of these conditional branches.

[0028] At this time, the conditional branch scoring unit 130 scores the conditional branch with a heuristic probability in order to quantitatively differentiate between a conditional branch based on a system requirement check or the like and a conditional branch based on a special external input value.

[0029] Conditional branching based on system requirement checks, etc., is assumed to be checking the existence of a file, the length of a structure element, etc. For example, in such conditional branching based on system requirement checks, the condition expression is defined as a pointer to a file, an integer type, etc.

[0030] On the other hand, conditional branching based on special external input values ​​refers to special character strings or continuous comparison of specific byte values, which are often used as backdoor triggers. In such conditional branching based on special external input values, the condition expression is defined as a character type or a string type.

[0031] The table shown in FIG. 4 heuristically defines the probabilities of satisfying the conditions of various conditional branches according to the above principles, and provides an example of a score list 162.

[0032] 4, the probability listed in the score list 162 is set to 1 or a value close to 1 for the probability that a conditional branch for a pointer to a file or an integer type will be true. As described above, this is because checking the existence of a file or the length of a structure element is rarely used as a trigger for a backdoor.

[0033] In the case of an integer type conditional expression, when considering the static match probability for random input, the probability that the condition will be true is 1:A when the range of M bytes possible is A, and the probability that the conditional expression will be true is very small. Therefore, as a heuristic match probability, a value A' that is much smaller than A is used to set the probability that the conditional expression will be true to a value close to 1. Also, in the case of a pointer conditional expression, when considering the static match probability for random input, the probability is 1:X when the range of values ​​that the pointer can take is X, but the heuristic match probability is set to a value close to 1.

[0034] On the other hand, as can be seen from the table shown in Fig. 4, the probability listed in the score list 162 is set to a small probability that the condition branch for a match of the character type or character string type will be true. As described above, this is because special character strings or continuous comparisons of specific byte values ​​are often used as backdoor triggers.

[0035] In the case of a character-type conditional expression, if we consider the static matching probability for random input, where the possible range of 1 byte is B, then it is 1:B, and the probability that the conditional expression will be true is very small. Also, in the case of a string-type conditional expression, if we consider the static matching probability for random input, the probability that the conditional expression will be true is very small. Special character strings and continuous comparisons of specific byte values ​​are often used as backdoor triggers, so the heuristic matching probability is set to a value that is not significantly different from the static matching probability for random input.

[0036] The reason for quantitatively differentiating the heuristic probabilities for a conditional branch on a pointer to a file or an integer type and a conditional branch on a match of a character type or string type, as described above, is as follows.

[0037] A backdoor is triggered by input information known only to the attacker, and follows a path of execution specific to the backdoor. In other words, the probability that a random input will trigger a backdoor's path of execution is extremely low. To reflect this knowledge, the probability that a conditional branch for a character or string type match will be true is set to be smaller than the static probability of a match for a random input.

[0038] Below are some examples of the probability that a conditional branch will be true:

[0039] Example 1: The probability of satisfying the following condition branch is high (1 / 2). if ((stream = fopen("myfile.dat", "r")) != NULL) {...}

[0040] Example 2: The probability of satisfying the following conditional branch is relatively high. int index = 0; while (1) { if (index == 100) {...} }

[0041] Example 3: The probability of satisfying the following conditional branch is relatively low. if (c == '0x3f') {...}

[0042] Example 4: The probability of satisfying the following condition branch is low. if (strcmp(name, “xxx”) == 0) {...}

[0043] When the condition expression of a conditional branch contains AND, the heuristic probability is calculated by multiplying each probability, and when the condition expression contains OR, the heuristic probability is calculated by adding each probability.

[0044] Example 5: if ((strcmp(user, “AAA”) == 0) && (strcmp(pass, “BBB”) == 0)) { iVar5 = funcA(...); } In this case, if the probability of (strcmp(user, “AAA”) == 0) is P(CB1) and the probability of (strcmp(pass, “BBB”) == 0) is P(CB2), then the overall probability is P(CB1)*P(CB2).

[0045] Example 6: if ((char_a == '0x3f) || (char_b == '0x6d')) { iVar5 = funcA(...); } In this case, if the probability of (char_a == '0x3f) is P(CB1) and the probability of (char_b == '0x6d') is P(CB2), then the overall probability is P(CB1) + P(CB2).

[0046] The conditional branch scoring unit 130 assigns a score to each conditional branch made by the program as described above. As a result, a conditional branch score table is created. The following table is an example of a conditional branch score table.

[0047] [Table 1]

[0048] The reaching probability calculation unit 140 calculates the reaching probability to the analysis target function from the score of each conditional branch included in the execution path based on the above-mentioned conditional branch score table.

[0049] The list of execution paths is created as follows by the structure extraction unit 120. The achievement probability calculation unit 140 assigns scores (heuristic probabilities) listed in the condition branch score table as described above to the condition branches included in the execution paths, and calculates the achievement probability by accumulating them.

[0050] List of execution paths: EP#1: [funcA, [CB1, CB2], funcB, ..., funcX] … EP#n: [funcA, [CB3], funcC, [CB5, CB6] ..., funcX]

[0051] In the case of the above execution path EP#1, since it contains conditional branches CB1 and CB2, the probability of it being reached is P(CB1)*P(CB2).In addition, in the case of the above execution path EP#n, since it contains conditional branches CB3, CB5, and CB6, the probability of it being reached is P(CB3)*P(CB5)*P(CB6).

[0052] In addition, the arrival probability is calculated excluding conditional branches included in the execution path whose branched execution paths lead to the same analysis target function. Here, the conditional branch whose branched execution paths lead to the same analysis target function is, for example, a conditional branch as shown in FIG. 5. In the conditional branch CB shown in FIG. 5, the function Func_A or the function Func_B is executed according to the truth or falsehood of the conditional expression, but both execution paths eventually lead to the same analysis target function Func_target. In such a case, the arrival probability is calculated excluding the conditional branch CB. If the probability that the conditional branch CB becomes true is P(CB), the probability that it becomes false is 1-P(CB), and since both true and false lead to the analysis target function, this is the same as considering the probability of scoring the conditional branch CB as P(CB)+(1-P(CB))=1.

[0053] The backdoor determination unit 150 notifies an execution path with a low arrival probability calculated as above as being highly likely to be a backdoor execution path. The notification destination can be, for example, a worker who performs the backdoor detection work, but it is also possible to output the information to another device or program.

[0054] As described above, the reason why an execution path with a low probability of arrival is highly likely to be a backdoor execution path is because, as already mentioned, a backdoor is triggered by input information known only to an attacker, and the probability that a backdoor execution path is triggered by a random input is extremely low. Note that, in the calculation of the probability of arrival, the probability that a conditional branch for a match of a character type or character string type becomes true is set to be smaller than the static match probability for a random input, so that the backdoor execution path can be estimated more effectively than an estimation assuming a random input.

[0055] The backdoor determination unit 150 determines that an execution path whose arrival probability is equal to or less than a threshold is likely to be a backdoor execution path. At this time, it is preferable to determine the threshold according to the number of conditional branches included in the program. This is because the arrival probability of each execution path decreases as the number of conditional branches included in the program increases.

[0056] (Fraud detection method) 6 is a schematic flowchart showing a fraud detection method according to an embodiment. As shown in FIG. 6, the fraud detection method includes a function extraction step (step S1), a structure extraction step (step S2), a conditional branch scoring step (step S3), a probability of arrival calculation step (step S4), and a backdoor determination step (step S5).

[0057] In the function extraction step (step S1), the input program is analyzed with reference to a target function list that lists functions to be analyzed, and functions to be analyzed are extracted. As already explained, the target function list is a list that lists functions to be analyzed in advance, such as functions that have been recognized as requiring attention based on call sites that call functions that have a sensitive effect on the system and on prior analysis of the internal structure of functions. In the function extraction step (step S1), the input program is analyzed to extract functions to be analyzed that are listed in the target function list.

[0058] In the structure extraction step (step S2), the program is analyzed to extract execution paths and conditional branches. In the structure extraction step (step S2), a list of functions and conditional branches included in execution paths in the program tree is created.

[0059] In the conditional branch scoring step (step S3), a score list is referenced, which describes the probability of satisfying the condition of the conditional branch, and each of the conditional branches extracted from the program is scored to create a conditional branch score table. The score list describes the probability of satisfying the condition of the conditional branch.

[0060] In the arrival probability calculation step (step S4), the arrival probability to the analysis target function is calculated from the score of each conditional branch included in the execution path based on the conditional branch score table. The list of execution paths is created in the structure extraction step (step S2). In the arrival probability calculation step (step S4), the scores (heuristic probabilities) listed in the conditional branch score table are assigned to the conditional branches included in the execution path, and the arrival probability is calculated by accumulating them.

[0061] In the backdoor determination step (step S5), an execution path with a low arrival probability calculated in the arrival probability calculation step (step S4) is notified as being likely to be a backdoor execution path. In the backdoor determination step (step S5), an execution path with an arrival probability equal to or less than a threshold is determined as being likely to be a backdoor execution path. At this time, it is preferable to determine the threshold according to the number of conditional branches included in the program.

[0062] As mentioned above, the present invention may also be embodied as a fraud detection method.

[0063] (Hardware configuration example) Fig. 7 is a diagram showing an example of a hardware configuration of a device used in the embodiment. That is, the fraud detection device 100 makes it possible to realize each function of the fraud detection device 100 by executing the fraud detection method described above as a program in an information processing device (computer) 10 employing the hardware configuration shown in Fig. 7. However, the hardware configuration example shown in Fig. 7 is an example of a hardware configuration that realizes each function of the fraud detection device 100, and is not intended to limit the hardware configuration of the fraud detection device 100. The fraud detection device 100 may include hardware not shown in Fig. 7.

[0064] As shown in FIG. 7, a hardware configuration 10 that may be adopted by the fraud detection device 100 includes a CPU (Central Processing Unit) 11, a main memory device 12, an auxiliary memory device 13, and an IF (Interface) section 14, which are interconnected by, for example, an internal bus.

[0065] The CPU 11 executes each command included in the fraud detection program executed by the information processing device (computer) 10. The main storage device 12 is, for example, a RAM (Random Access Memory), and temporarily stores various programs, such as the fraud detection program executed by the information processing device (computer) 10, for processing by the CPU 11.

[0066] The auxiliary storage device 13 is, for example, a hard disk drive (HDD), and is capable of storing various programs, such as a fraud detection program, executed by the information processing device (computer) 10, for a medium to long term. Various programs, such as a fraud detection program, can be provided as a program product recorded on a non-transitory computer-readable storage medium.

[0067] The IF unit 14 provides an interface related to input and output of the fraud detection device 100, for example.

[0068] The information processing device (computer) 10 employing the above-mentioned hardware configuration realizes each function of the fraud detection device 100 by executing the fraud detection method described above as a program.

[0069] A part or all of the above-described embodiments may be described as, but is not limited to, the following supplementary notes. [Appendix 1] a function extraction unit that refers to a target function list that describes functions to be analyzed, analyzes an input program, and extracts functions to be analyzed; a structure extraction unit that analyzes the program to extract execution paths and conditional branches; a conditional branch scoring unit that refers to a score list that describes the probability of satisfying a condition of a conditional branch, and creates a conditional branch score table by assigning a score to each of the extracted conditional branches; a reaching probability calculation unit that calculates a reaching probability to the analysis target function from the score of a conditional branch included in the execution path based on the conditional branch score table; a backdoor determination unit that notifies the execution path with a low arrival probability as one that is likely to be a backdoor execution path; A fraud detection device comprising: [Appendix 2] A fraud detection device as described in Appendix 1, wherein the probabilities listed in the score list are heuristic probabilities that quantitatively differentiate conditional branching based on special external input values. [Appendix 3] The fraud detection device according to claim 2, wherein the probability listed in the score list is set to a small value to indicate a true condition in a condition branch regarding a match of a character type or a character string type. [Appendix 4] The fraud detection device of claim 2 or 3, wherein the probability listed in the score list is set to 1 or a value close to 1 for a conditional branch for a pointer to a file or an integer type that is true. [Appendix 5] 5. The fraud detection device according to claim 1, wherein the probability of reaching the analysis target function is calculated by accumulating the scores for conditional branches included in the execution path. [Appendix 6] The fraud detection device according to claim 5, wherein the probability of reaching the analysis target function is calculated excluding, from among the conditional branches included in the execution path, conditional branches whose branched execution paths lead to the same analysis target function. [Appendix 7] 7. The fraud detection device according to claim 1, wherein the backdoor determination unit notifies an execution path whose arrival probability is equal to or less than a threshold. [Appendix 8] The fraud detection device according to claim 7, wherein the threshold value is determined according to the number of conditional branches included in the program. [Appendix 9] A target function list is referred to, which lists the functions to be analyzed, and the input program is analyzed to extract the target functions. Analyzing the program to extract execution paths and conditional branches; creating a conditional branch score table by scoring each of the extracted conditional branches with reference to a score list indicating the probability of satisfying the condition of the conditional branch; calculating a probability of reaching the analysis target function from the score of a conditional branch included in the execution path based on the conditional branch score table; The fraud detection method notifies the execution path with a low probability of arrival as one that is likely to be a backdoor execution path. [Appendix 10] A target function list is referred to, which lists the functions to be analyzed, and the input program is analyzed to extract the target functions. Analyzing the program to extract execution paths and conditional branches; creating a conditional branch score table by scoring each of the extracted conditional branches with reference to a score list indicating the probability of satisfying the condition of the conditional branch; calculating a probability of reaching the analysis target function from the score of a conditional branch included in the execution path based on the conditional branch score table; The program causes a computer to execute a process of notifying an execution path having a low probability of arrival as one that is likely to be a backdoor execution path.

[0070] The disclosures of the above cited patent documents are incorporated herein by reference. Within the scope of the entire disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical ideas. Furthermore, within the scope of the entire disclosure of the present invention, various combinations or selections (including partial deletions) of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure including the scope of claims and the technical ideas. In particular, with regard to the numerical ranges described in this specification, any numerical value or small range included in the range should be construed as being specifically described even if not otherwise specified. Furthermore, the disclosures of the above cited documents, if necessary, in accordance with the spirit of the present invention, may be used in part or in whole in combination with the disclosures of this specification as part of the disclosure of the present invention, and are deemed to be included in the disclosures of this application. [Explanation of symbols]

[0071] 100 Fraud detection device 110 Function Extraction Unit 120 Structure extraction part 130 Conditional Branch Scoring 140 Arrival Probability Calculation Unit 150 Backdoor Detection Unit 10 Information processing equipment (computers) 11 CPU 12 Main storage 13 Auxiliary storage device 14 IF Section

Claims

1. a function extraction unit that refers to a target function list that describes functions to be analyzed, analyzes an input program, and extracts functions to be analyzed; a structure extraction unit that analyzes the program to extract execution paths and conditional branches; a conditional branch scoring unit that refers to a score list that describes the probability of satisfying a condition of a conditional branch, and creates a conditional branch score table by assigning a score to each of the extracted conditional branches; a reaching probability calculation unit that calculates a reaching probability to the analysis target function from the score of a conditional branch included in the execution path based on the conditional branch score table; a backdoor determination unit that notifies the execution path with a low arrival probability as one that is likely to be a backdoor execution path; A fraud detection device comprising:

2. The fraud detection device of claim 1, wherein the probabilities listed in the score list are probabilities assigned to conditional branches so as to quantitatively differentiate between conditional branches for verifying data format, verifying whether the data is within an appropriate value range, data neutralization processing, and error processing, and conditional branches based on special external input values.

3. The fraud detection device according to claim 2 , wherein the probability recorded in the score list is set to a small value for a condition branch regarding a match of a character type or a character string type that becomes true.

4. 4. The fraud detection device according to claim 2, wherein the probability recorded in the score list is set to 1 or a value close to 1 for the probability that a conditional branch regarding a pointer to a file or an integer type will be true.

5. The fraud detection device according to claim 1 , wherein the probability of reaching the analysis target function is calculated by accumulating the scores for conditional branches included in the execution path.

6. 6. The fraud detection device according to claim 5, wherein the probability of reaching the analysis target function is calculated excluding, from among conditional branches included in the execution path, conditional branches whose branched execution paths lead to the same analysis target function.

7. The fraud detection device according to claim 1 , wherein the backdoor determination unit notifies an execution path whose arrival probability is equal to or less than a threshold.

8. The fraud detection device according to claim 7 , wherein the threshold value is determined according to the number of conditional branches included in the program.

9. A target function list is referred to, which lists the functions to be analyzed, and the input program is analyzed to extract the target functions. Analyzing the program to extract execution paths and conditional branches; creating a conditional branch score table by scoring each of the extracted conditional branches with reference to a score list indicating the probability of satisfying the condition of the conditional branch; calculating a probability of reaching the analysis target function from the score of a conditional branch included in the execution path based on the conditional branch score table; The fraud detection method notifies the execution path with a low probability of arrival as one that is likely to be a backdoor execution path.

10. A target function list is referred to, which lists the functions to be analyzed, and the input program is analyzed to extract the target functions. Analyzing the program to extract execution paths and conditional branches; creating a conditional branch score table by scoring each of the extracted conditional branches with reference to a score list indicating the probability of satisfying the condition of the conditional branch; calculating a probability of reaching the analysis target function from the score of a conditional branch included in the execution path based on the conditional branch score table; The program causes a computer to execute a process of notifying an execution path having a low probability of arrival as one that is likely to be a backdoor execution path.

Images