Protection target identification system, protection target identification program, and protection target identification method

Abstract

An object of the present invention is to provide a novel technique that enables early action to be taken against unknown malicious objects. [Solution] In order to solve the above-mentioned problems, the present invention provides a protection target identification system that identifies targets to be protected from malicious objects, the protection target identification system comprising a database, an acquisition unit, a request analysis unit, and an identification unit, the database stores attack target information of targets that may be attacked by unknown malicious objects, the acquisition unit acquires attack request information including information about the unknown malicious objects, the request analysis unit acquires the protection target identification reference information based on the attack request information, and the identification unit identifies candidate protection targets from among the attack targets based on the attack target information and the protection target identification reference information.

Description

[Technical Field]

[0001] The present invention relates to a protection target identification system, a protection target identification program, and a protection target identification method. [Background technology]

[0002] In recent years, with the rapid spread of IoT (Internet of Things) devices, such as Wi-Fi routers and IP cameras, damage caused by cyberattacks and malware activities targeting security flaws in IoT devices has become increasingly serious. Factors that make IoT devices vulnerable to attackers include the fact that many devices are distributed without adequately implemented security features at the time of manufacture, and that they are often used for long periods of time without appropriate and ongoing maintenance or firmware updates. Furthermore, the development of attack tools leveraging AI technology has led to the risk that attacks may become easier to carry out in the future without specialized knowledge or advanced technical skills. Therefore, countermeasures against cyberattacks, which will become increasingly serious in the future, are a major social issue. Examples of systems that address this issue are proposed in Patent Documents 1 and 2, for example.

[0003] For example, Patent Document 1 discloses a system for training and using a machine learning malware classification model using dynamic and static characteristics of known malicious objects (malware samples) and known safe objects (clean objects).

[0004] Furthermore, for example, Patent Document 2 discloses a system that extracts software contained in firmware, identifies the version number of the software through static or dynamic analysis, compares the differences between the software extracted from multiple different firmware, and detects the status of fixes for known vulnerabilities. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2023-97361 [Patent Document 2] Japanese Patent Publication No. 2023-121566 Summary of the Invention [Problem to be solved by the invention]

[0006] The techniques proposed in Patent Documents 1 and 2 can deal with known malicious objects (illegal objects), but cannot deal with unknown malicious objects.

[0007] In view of the above problems, an object of the present invention is to provide a novel technique that enables early action to be taken against unknown malicious objects. [Means for solving the problem]

[0008] In order to solve the above problems, the present invention provides a protection target identification system that identifies targets to be protected from malicious objects, the protection target identification system comprising a database, an acquisition unit, a request analysis unit, and an identification unit, wherein the database stores attack target information of targets that may be attacked by unknown malicious objects, the acquisition unit acquires attack request information including information about the unknown malicious objects, the request analysis unit acquires protection target identification reference information based on the attack request information, and the identification unit identifies candidate protection targets from among the attack targets based on the attack target information and the protection target identification reference information.

[0009] In addition, in order to solve the above-mentioned problems, the present invention provides a protection target identification program that identifies targets to be protected from malicious objects, wherein the protection target identification program causes a computer to function as a database, an acquisition unit, a request analysis unit, and an identification unit, wherein the database stores attack target information of targets that may be attacked by unknown malicious objects, the acquisition unit acquires attack request information regarding the unknown malicious objects, the request analysis unit acquires protection target identification reference information based on the attack request information, and the identification unit identifies candidate protection targets from among the attack targets based on the attack target information and the protection target identification reference information.

[0010] In addition, in order to solve the above problem, the present invention provides a method for identifying a protection target from an illegal object, in which a computer performs the following processes: storing attack target information of an attack target that may be attacked by an unknown illegal object; acquiring attack request information regarding the unknown illegal object; acquiring protection target identification reference information based on the attack request information; and identifying candidate protection targets from among the attack targets based on the attack target information and the protection target identification reference information.

[0011] With this configuration, even in the case of an attack by an unknown malicious object, it is possible to identify candidates for protection, and it is possible to minimize damage caused by the unknown malicious object.

[0012] In a preferred form of the present invention, the protection target identification system further includes a collection unit, which registers character strings of the attack target information in the database, the request analysis unit extracts and obtains specific character strings as the protection target identification reference information, and the identification unit identifies the protection target candidates based on a search for a forward match, a backward match, an exact match, or a partial match of the specific character string in the protection target identification reference information and the character string in the attack target information.

[0013] This allows attack targets with matching strings to be identified as candidates for protection, thereby enabling accurate identification of candidates for protection. Furthermore, when comparing the path of the observed attack request information with the directory structure of the file system extracted from the firmware, a suffix search is often required to check whether a portion of the end of the file path matches. However, many RDBMSs (Relational Database Management Systems), including MySQL (registered trademark) and MariaDB, cannot use indexes for suffix searches of strings. Therefore, more preferably, the present invention effectively replaces suffix searches with prefix searches, thereby achieving efficient and high-speed searches. This can significantly improve search speed, particularly when handling large amounts of data, as in the present invention.

[0014] In a preferred form of the present invention, the attack target information includes multiple individual attack target information, and the identification unit identifies the protection target candidate based on the attack target information including individual attack target information that has a string that matches part or all of the string of the protection target specific reference information, based on the string of the protection target specific reference information and the string of the individual attack target information included in the identified protection target candidate.

[0015] With this configuration, it is possible to further extract candidates for protection from the target of attack, thereby enabling more efficient identification of candidates for protection.

[0016] In a preferred embodiment of the present invention, the request analysis unit extracts network service identification information from the attack request information as the protection target identification reference information, and the identification unit obtains network service response information of the identified protection target candidates, and further narrows down the protection target candidates based on the network service identification information and the network service response information.

[0017] With this configuration, attack targets with poor response times for network services included in the attack request information can be excluded from protection target candidates, allowing for more efficient identification of protection target candidates.

[0018] In a preferred form of the present invention, the identification unit emulates the identified candidate programs to be protected on a virtual network based on the identified program to be attacked and the attack request information, and further narrows down the candidates to be protected based on the results of the emulation.

[0019] In a preferred form of the present invention, the attack request information includes payload information, and the identification unit emulates the program of the attack target and the program of the payload information on the virtual network, obtains virtual target identification information for uniquely identifying the attack target in the virtual network, and further narrows down the candidates to be protected based on virtual network service response information obtained as a result of emulating the program of the attack target corresponding to the obtained virtual target identification information.

[0020] With this configuration, it is possible to eliminate from the list of protection targets those that are not affected by unknown malicious objects as a result of emulating the attack target, thereby enabling more efficient identification of protection targets. [Effects of the Invention]

[0021] The present invention has the effect of providing a novel technique that enables early response to unknown malicious objects. [Brief explanation of the drawings]

[0022] [Figure 1] FIG. 1 is a conceptual diagram of an embodiment of the present invention. [Figure 2] 1 is a block diagram of a system configuration according to an embodiment of the present invention. [Figure 3]FIG. 1 is a block diagram of a hardware configuration according to an embodiment of the present invention. [Figure 4] FIG. 1 is a block diagram of a functional configuration according to an embodiment of the present invention. [Figure 5] 1 is an example of a processing flowchart according to the present invention. [Figure 6] 10 is an example of attack request information according to the present invention. [Figure 7] 10 is a display example of multiple attack targets identified as targets to be protected in the present invention. [Figure 8] 10 is a display example of multiple attack targets identified as targets to be protected in the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0023] The present invention will now be described more fully with reference to the accompanying drawings, in which preferred embodiments are shown, but which may be embodied in many different forms and are not limited to the embodiments set forth herein.

[0024] For example, while the present embodiment describes the configuration, operation, etc. of a protection target identification system, methods, devices, computer programs, etc. with similar configurations can also achieve similar effects. Furthermore, the program may be stored on a recording medium. Using this recording medium, the program can be installed on a computer, for example, thereby configuring a protection target identification device and a protection target identification system. Here, the recording medium storing the program may be a non-transitory recording medium, such as a CD-ROM.

[0025] <1. Overview of the present invention> The present invention relates to a system for identifying targets to be protected from malicious and unknown malicious objects. FIG. 1 is a diagram illustrating the present invention. In this system, information (hereinafter referred to as attack target information) about terminal devices (hereinafter referred to as attack targets) that may be attacked by unknown malicious objects is first collected on a large scale in advance (1). An attacker exploits vulnerabilities in the attack targets connected to the Internet to launch a zero-day attack (2). At this time, the zero-day attack is also observed by an attack detection device operated by a research institution or the like (2). The present invention then receives unknown attack request information suspected of being a zero-day attack from the attack detection device (3). Based on the attack request information, the system compares the attack request information with the analysis results of attack target information collected on a large scale in advance to identify potential protection targets from among the attack targets that may be targeted by the attack. The system then notifies the attack detection device of information about the potential protection targets (hereinafter referred to as potential protection target information) (4). Using the potential protection target information, the attack detection device reports the existence of zero-day vulnerabilities and their exploitation status to a protection target management device that manages the potential protection targets (5). Then, the administrator of the protected device (vendor, developer, etc.) will provide updates and security patches promptly to fix vulnerabilities in the attack targets (hereinafter referred to as the protected terminal devices) that are candidates for protection (6).

[0026] The target of attack in this embodiment is firmware of an IoT (Internet of Things) device, but software such as an application, middleware, or OS (Operating System), a network, etc. may also be used. In the following, firmware will be described as the target of attack.

[0027] <1.1. System Configuration> Fig. 2 is a block diagram showing a system configuration of one embodiment. As shown in Fig. 2, the protection target identification system 0 includes a protection target identification device 1, an investigator terminal device 3, an attack detection device 4, an attacker terminal device 5, a protection target terminal device 6, and a protection target management device 7, which are configured to be able to communicate via a network NW. Note that the protection target identification system 0 may appropriately allocate the processing described below among the protection target identification device 1, the investigator terminal device 3, and the attack detection device 4, and is not limited to the processing allocation described below.

[0028] The protection target identification device 1 is a device that analyzes attack request information from an attacker and identifies candidates for protection, and can be a general-purpose server computer, a personal computer, etc. Note that it may also be configured with multiple computers that are capable of sending and receiving information via a network NW or another network.

[0029] The investigator terminal device 3 is a device for confirming the behavior of the protection target candidate identified by the protection target identification device 1 in the virtual network, and can be a personal computer, smartphone, tablet terminal, wearable device, etc.

[0030] The attack detection device 4 is a device for receiving attack request information from an attacker, and can be a general-purpose server computer, a personal computer, etc. It may also be configured with multiple computers that are capable of sending and receiving information via the network NW or another network.

[0031] The attacker terminal device 5 is a device that creates an unknown malicious object and transmits attack request information, and may be a personal computer, a smartphone, a tablet terminal, a wearable device, or the like.

[0032] The terminal device 6 to be protected is a device that may be the target of attacks from unknown malicious objects, and may be a physical device that has the function of sending and receiving data via a network such as the Internet, a so-called IoT device.

[0033] The protection target management device 7 is a device that manages information related to the protection target terminal device 6, and can be a general-purpose server computer, a personal computer, etc. It may also be configured by a plurality of computers that are capable of sending and receiving information via the network NW or another network.

[0034] It should be noted that instead of the attack detection device 4, the protection target identification device 1 may directly receive attack request information from an attacker.

[0035] In this embodiment, the network NW is an IP (Internet Protocol) network, but there is no restriction on the type of communication protocol, and there is also no restriction on the type and scale of the network.

[0036] <1.2. Hardware Configuration> 3 is a block diagram showing a hardware configuration according to the present invention. As shown in FIG. 3(a), the server 100 (protection target identification device 1, attack detection device 4, protection target management device 7) includes a processing unit 101, a storage unit 102, and a communication unit 103.

[0037] The processing unit 101 has a processor such as a CPU that can execute an instruction set, and controls the overall operation and processing of each device by executing a program for starting each device, an OS, and other applications. The storage unit 102 includes a volatile memory such as a RAM capable of storing an instruction set, and a non-volatile recording medium such as an HDD or SSD capable of recording an OS and programs for starting up each device. The communication unit 103 has a communication interface device for connecting to a network, and controls communication with the network NW to input and output information.

[0038] As shown in FIG. 3(b), the terminal device 90 (investigator terminal device 3, attacker terminal device 5, protected terminal device 6) has a processing unit 901, a memory unit 902, a communication unit 903, an input unit 904, and a display unit 905.

[0039] The processing unit 901 has a processor such as a CPU that can execute an instruction set, and controls the overall operation and processing of the terminal device 90 by executing an OS and other applications. The storage unit 902 includes a volatile memory such as a RAM capable of storing an instruction set, and a non-volatile recording medium such as an HDD or SSD capable of recording an OS and the like. The communication unit 903 has a communication interface device for connecting to a network, and controls communication with the network NW to input and output information. The input unit 904 has an input device capable of input processing, such as a keyboard or a touch panel. The display unit 905 has a display device capable of display processing such as a display.

[0040] <1.3. Functional configuration of protection target identification device 1> Fig. 4 is a block diagram showing the functional configuration of the protection target identification device 1. As shown in Fig. 4, the protection target identification device 1 includes a collection unit 11, an acquisition unit 12, a request analysis unit 13, an identification unit 14, a notification unit 15, a display processing unit 16, and a database 2. This is a specific implementation of software (a protection target identification program stored in a storage unit 102) by hardware (a processing unit 101).

[0041] The protection target identification device 1 in this embodiment executes processing by receiving attack request information from an attacker via the attack detection device 4. Alternatively, a protection target identification program may be started in the investigator terminal device 3, and processing may be executed by receiving attack request information from an attacker via the attack detection device 4 (so-called standalone type). In this case, some or all of the functional components (units) of the protection target identification device 1 may be provided in the investigator terminal device 3. For example, the investigator terminal device 3 may include a collection unit 11, an acquisition unit 12, a request analysis unit 13, an identification unit 14, a notification unit 15, a display processing unit 16, etc., and the protection target identification device 1 may be cloud storage that records and manages attack target information, etc.

[0042] <1.3.1. Collection Section 11> The collection unit 11 registers the attack target information in the database 2. The collection unit 11 acquires, as the attack target information, device meta information about the device that is the target of the attack and program meta information about the program that is the target of the attack, and registers this in the database 2. Here, the device meta information uses the name of the device vendor and the model number of the device. Furthermore, the program meta information uses the program version number, the program release date, the program collection source URL, the program storage destination, and the hash value (e.g., SHA-256) of the program file, etc.

[0043] <1.3.2. Acquisition part 12> The acquisition unit 12 acquires attack request information from the attack detection device 4, the attack request information including information about an unknown malicious object.

[0044] <1.3.3. Request Analysis Unit 13> The request analysis unit 13 acquires protection target specific reference information based on the attack request information. The request analysis unit 13 extracts and acquires protection target specific reference information based on a specific reference character string included in the attack request information.

[0045] <1.3.4. Specific part 14> The identification unit 14 identifies candidates for protection targets to be protected from unknown malicious objects based on the attack target information and the attack request information. The identification unit 14 includes a static identification unit 141 and a dynamic identification unit 142.

[0046] <1.3.4.1. Static identification part 141> The static identification unit 141 identifies protection target candidates from among the attack targets based on the attack target information and the protection target identification reference information. The static identification unit 141 identifies protection target candidates based on character strings in the attack target information and character strings in the protection target identification reference information. Furthermore, the static identification unit 141 acquires information (hereinafter referred to as network service response information) related to the response operation status of the network service targeted by the attack based on the protection target identification reference information, and identifies protection target candidates based on the network service response information.

[0047] Here, the network service response information includes the operating status, response status, response string, etc. of each network service targeted by an attack. Furthermore, network services refer to various network services that are widely running on actual IoT devices, such as the http(s) service, Telnet, SSH, and VNC (Virtual Network Computing) for remote access, and IPP (Internet Printing Protocol), a protocol for communicating printer print information and control information.

[0048] <1.3.4.2.Dynamic identification part 142> The dynamic identification unit 142 emulates the identified candidates for protection on a virtual network to further narrow down the candidates for protection. Based on the programs targeted by attack identified as candidates for protection and attack request information, the dynamic identification unit 142 emulates the candidate programs for protection on a virtual network, and further narrows down the candidates for protection based on the results of the emulation.

[0049] <1.3.5. Notification section 15> The notification unit 15 notifies the identified protection target candidate and the protection target candidate information corresponding to the identified protection target candidate.

[0050] <1.3.6. Display Processing Unit 16> The display processing unit 16 performs display processing on the emulation results by the dynamic identification unit 142 and causes the surveyor terminal device 3 to display the display processing results.

[0051] <2. Processing flow> The protection target identification method of the present invention will be described below with reference to Figures 5 to 8. Figure 5(a) is a flowchart showing the process in which the protection target identification device 1 collects attack target information, identifies protection target candidates, and notifies and displays information about the protection target candidates.

[0052] <2.1. Registering attack target information> First, in step S1 (hereinafter, "step SX" will be referred to as "SX"), the collection unit 11 registers attack target information. In this embodiment, the collection unit 11 acquires attack target information from a web page that publishes information about the protected terminal device 6 managed by the protected target management device 7 (such as a download page for the program being attacked or a list page of sold devices being attacked), and registers the attack target information in the database 2. Note that the collection unit 11 may also acquire attack target information directly from the protected target manager via a well-known information sharing tool or the like.

[0053] The collection unit 11 also extracts multiple pieces of individual attack target information and directory structure information included in each piece of collected attack target information, and registers them in the database 2. Here, the individual attack target information is multiple pieces of data that constitute the attack target program, and examples of the individual attack target information include files, binary code, hardware setting information (power management information, clock setting data, calibration data, etc.), fixed table data (ACPI tables, PCI resource tables, UEFI setting data, etc.), built-in scripts (devices that use OpenFirmware or Lua scripts, etc.), and security-related data (Secure Boot (UEFI) public keys, firmware signatures, SHA-256 / 512 hash values, etc.). The directory structure information is information about the directory structure of the multiple pieces of individual attack target information, and includes the hierarchical structure (parent-child relationship arrangement) of the multiple pieces of individual attack target information, the directory name of each piece of individual attack target information, the path to each piece of individual attack target information, etc.

[0054] Furthermore, the collection unit 11 registers the extracted multiple pieces of individual attack target information and directory structure information in association with the attack target information. In this embodiment, the collection unit 11 registers character strings of the attack target information. Specifically, the collection unit 11 registers the character strings of the attack target information in a predetermined order. More specifically, the collection unit 11 rearranges and registers the character strings of the multiple pieces of individual attack target information included in the attack target information in the reverse order of the predetermined order. For example, the collection unit 11 rearranges the character strings of the storage destination (program storage destination) of the attack target information and the character strings of the storage destination (path based on the directory structure information) of the individual attack target information in the database 2 in the reverse order. Note that the predetermined order may be forward order or any other order.

[0055] <2.2. Acquiring attack request information> In S2, the acquisition unit 12 acquires attack request information. In this embodiment, the acquisition unit 12 acquires attack request information including payload information for downloading and executing an unknown malicious object and protection target identification reference information for identifying protection target candidates that are targets of attack by the unknown malicious object.

[0056] 6 is a diagram showing an example of the acquired attack request information (HTTP request). In the illustrated example, the character string underlined with a solid line indicates payload information that downloads and executes a malicious script file (malware), and the character string underlined with a dotted line indicates protection target specific reference information.

[0057] <2.3. Analysis of Attack Request Information> In S3, the request analysis unit 13 analyzes the attack request information. In this embodiment, the request analysis unit 13 uses a well-known text analysis technique on the attack request information acquired in S2 to acquire payload information and protection target identification reference information from the attack request information. Specifically, the request analysis unit 13 uses a specific reference character string in the text of the attack request information to acquire some or all of the character strings, such as network service identification information, the destination file path of the request, parameter names (data items targeted by the attack), and data in the request header (cookies and authentication information), as protection target identification reference information. The request analysis unit 13 also acquires payload information using a specific reference character string in the text of the attack request information. Here, the network service identification information is information for uniquely identifying a network service, and may be, for example, a port number, a protocol name, or the like.

[0058] In the attack request information in Figure 6, for example, character strings such as "wget" and "sh" (possibly payload information), absolute path syntax starting with " / " (possibly destination file path), etc. are used as reference strings to obtain protection target specific reference information and payload information.

[0059] <2.4. Identification of potential protection targets> In S4, the identification unit 14 identifies candidates for protection targets. In this embodiment, the identification unit 14 identifies candidates for protection targets based on the attack target information registered in S1 and the protection target identification reference information acquired in S3. Details of the process for identifying candidates for protection targets will be described later.

[0060] <2.5. Notification of potential information to be protected> In S5, the notification unit 15 notifies the protection target candidate information. In this embodiment, the notification unit 15 notifies the attack detection device 4 of the protection target candidate information including information for displaying the emulation result of the protection target candidate, which will be described later, and device meta information and program meta information of the protection target candidate, for the protection target candidate identified in S4. Note that if the contact information of the protection target manager has been acquired as attack target information in S1, the notification unit 15 may notify the protection target candidate information to the protection target management device 7.

[0061] <2.6. Displaying emulation results> In S6, the display processing unit 16 processes the display of the emulation results. In this embodiment, the investigator terminal device 3 accepts input of virtual target identification information (described below) from the user (investigator) acquired as information for displaying the emulation results of the protection target candidate notified in S5. Then, based on the virtual target identification information, the display processing unit 16 processes the display of network service response information (such as the operating status of ports) of the attack target on the virtual network corresponding to the virtual target identification information, and displays it on the investigator terminal device 3. The display processing unit 16 also processes the display of device meta information and program meta information of the protection target candidate identified in S5, and displays the display processing results on the investigator terminal device 3. This allows the investigator to grasp the vulnerability of the terminal device 6 to be protected.

[0062] <3. Identification of candidates for protection> Hereinafter, with reference to Fig. 5(b), a specific process for identifying candidates to be protected in S4 of Fig. 5(a) will be described. In the following process, multiple identification processes are performed on the attack target to identify candidates to be protected.

[0063] <3.1. Identifying protection candidates based on character matching of attack target information> In S41, the static identification unit 141 identifies a protection target candidate based on the character string of the attack request information and the character string of the attack target information. In this embodiment, the static identification unit 141 identifies a protection target candidate based on the character string of the protection target identification reference information acquired in S3 and the character string of the attack target information registered in S1.

[0064] Specifically, the static identification unit 141 identifies, as a protection target candidate, an attack target corresponding to attack target information (e.g., a program storage location) having a character string that matches part or all of the character string in the protection target identification reference information (e.g., a file path) among multiple attack targets. More specifically, the static identification unit 141 searches for a forward match, a backward match, an exact match, or a partial match between the character string in the attack target information registered in S1 and the character string in the protection target identification reference information, and identifies, as a protection target candidate, an attack target corresponding to attack target information having a character string that matches part or all of the character string in the protection target identification reference information. Even more specifically, the static identification unit 141 performs a forward match search on the character string in the attack target information rearranged in reverse order in S1, and a backward match search on the character string in the protection target identification reference information, and identifies, as a protection target candidate, an attack target corresponding to attack target information having a character string that matches part or all of the character string in the protection target identification reference information.

[0065] 7 is a display example of the candidate protection target information identified in S41, displayed on the investigator terminal device 3. In the illustrated example, a list is displayed in which each line contains attack target information having a program storage location that matches the file path portion " / cgi-bin / admin / setparam.cgi" of the URL of the attack request information in FIG.

[0066] <3.2. Identifying protection targets based on character matching of individual attack target information> In S42, the static identification unit 141 identifies protection target candidates based on character strings of multiple pieces of individual attack target information included in the attack target information and character strings of protection target identification reference information. In this embodiment, the static identification unit 141 uses individual attack target information included in the attack target information corresponding to the attack target identified as the protection target candidate in S41 from among the individual attack target information, to identify protection target candidates based on character strings of the individual attack target information and character strings of the protection target identification reference information.

[0067] Specifically, the static identification unit 141 searches for a forward match, a backward match, an exact match, or a partial match between the character strings of the individual attack target information of the attack target identified as the protection target candidate in S41 and the character strings of the protection target identification reference information, and identifies the attack target corresponding to the attack target information as the protection target candidate based on the attack target information including the individual attack target information having a character string that matches part or all of the character string of the protection target identification reference information, thereby further narrowing down the protection target candidates identified in S41. More specifically, the static identification unit 141 performs a forward match search on the character strings of the individual attack target information rearranged in reverse order in S1, and a backward match search on the character strings of the protection target identification reference information, and identifies the attack target corresponding to the attack target information as the protection target candidate based on the attack target information including the individual attack target information having a character string that matches part or all of the character string of the protection target identification reference information, thereby further narrowing down the protection target candidates identified in S41.

[0068] Fig. 8 is a display example of the protection target candidate information identified in S42, displayed on the investigator terminal device 3. In the illustrated example, of the protection target candidates displayed in Fig. 7, the attack targets identified as protection target candidates in S42 are displayed on a line-by-line basis, and the content of the individual attack target information of each protection target candidate is displayed in a keyword field.

[0069] <3.3. Identifying Protection Candidates Based on Network Service Response Information> In S43, the static identification unit 141 identifies protection target candidates based on the network service response information. In this embodiment, the static identification unit 141 acquires network service response information for each network service that is the target of attack based on the network service identification information and attack target information acquired from the protection target identification reference information of the attack request information in S3. Then, the static identification unit 141 identifies protection target candidates based on the network service response information.

[0070] Specifically, the static identification unit 141 acquires network service response information for each attack target identified as a protection target candidate in S42 among the attack targets, and identifies the protection target candidate based on the network service response information. More specifically, the static identification unit 141 identifies the network service on which the attack target is running from the character string of the network service identification information acquired as the protection target identification reference information, and acquires network service response information for the network service of each attack target identified as a protection target candidate. Then, the static identification unit 141 identifies as a protection target candidate any attack target whose operation status in the acquired network service response information is equal to or greater than a predetermined value and / or whose response status is "yes," etc., and further narrows down the protection target candidates identified in S42.

[0071] In this embodiment, the operational status of the network service response information is the ratio (startup ratio) of the number of attack targets using the network service to the total number of attack targets, but is not limited to this.

[0072] <3.4. Identifying candidates for protection based on emulation results> In S44, the dynamic identification unit 142 emulates the attack target and identifies a candidate for protection based on the emulation result. In this embodiment, the dynamic identification unit 142 emulates the attack target program identified as a candidate for protection in S43 on a virtual network based on the attack target program and payload information acquired from the attack request information in S3. Then, the dynamic identification unit 142 identifies a candidate for protection based on the emulation result.

[0073] Specifically, the dynamic identification unit 142 constructs a virtual network, and when emulation of the attack target program and payload program identified as a protection target candidate in the virtual network is successful, acquires virtual target identification information for uniquely identifying the attack target in the virtual network. Then, the dynamic identification unit 142 acquires virtual network service response information obtained as a result of emulating the attack target program corresponding to the acquired virtual target identification information, identifies as a protection target candidate an attack target for which the virtual network service response information (e.g., the operating status of a virtual network service) indicates an abnormal value, and further narrows down the protection target candidates identified in S43. In other words, by assigning a virtual machine corresponding to the target of attack and a virtual machine corresponding to the payload to nodes on the constructed virtual network, the behavior of the target of attack in the network attacked by the payload is obtained, and candidates for protection are identified based on that behavior.

[0074] In a preferred embodiment of the present invention, the dynamic identification unit 142 emulates, in each of a plurality of virtual networks, the plurality of attack targets identified as protection target candidates in S43, and acquires virtual target identification information for each attack target in each virtual network. Then, the dynamic identification unit 142 acquires virtual network service response information obtained as a result of emulating the attack target program corresponding to each acquired virtual target identification information.

[0075] In addition, in a preferred embodiment of the present invention, if the program to be protected lacks dependencies or kernel modules necessary for its operation, the dynamic identification unit 142 automatically supplements these or dynamically generates pseudo-alternative modules to maintain the execution environment and emulates the program to be attacked. This reduces the number of critical errors that occur when emulating firmware, improving the success rate of emulation.

[0076] In a preferred embodiment of the present invention, virtual target identification information is automatically assigned to an attack target that is emulated for the first time on a virtual network. Also, virtual setting information, which is setting information on a virtual network, may be automatically assigned to an attack target that is emulated for the first time on a virtual network. Note that the virtual target identification information and virtual setting information may be assigned each time an attack target is emulated on a virtual network.

[0077] In a preferred embodiment of the present invention, the collection unit 11 may register the virtual network service response information in the database 2 in association with the target of the attack.

[0078] In a more preferred embodiment, the identification unit 14 identifies a protection target candidate based on the virtual network service response information and the network service response information. Specifically, the identification unit 14 compares the virtual network service response information acquired from the first attack target and registered with the network service response information acquired from the second attack target, and identifies the second attack target having network service response information that is the same as or similar to the virtual network service response information (e.g., operation status) as a protection target candidate. This allows us to regard the collected response information in the virtual network as a device fingerprint and compare it with the response information in the real network of the device when performing a wide-area scan of the Internet, thereby accurately understanding the public exposure status of the device on the Internet and the distribution of the public exposure status of the device, and estimating the impact of vulnerabilities against the acquired attack requests.In addition, in use cases where public institutions or ISP operators directly issue warnings to owners of vulnerable IoT devices, this allows us to more accurately and efficiently identify targets for warning.

[0079] In a preferred embodiment of the present invention, the protection target identification system 0 includes a construction unit (not shown), which generates a virtual network based on the acquired virtual network service response information and virtual target identification information. Specifically, the construction unit generates a virtual machine that has the acquired virtual target identification information and outputs the virtual network service response information, thereby generating a virtual network including the virtual machine. This makes it possible to operate honeypots that can mimic a wider range of IoT devices at low cost and with low risk.

[0080] By executing the above steps S1 to S6, it is possible to prevent zero-day attacks against the collected attack targets. In addition, by identifying candidates for protection based on the character strings of attack request information and attack target information, identifying candidates for protection based on network service response information of the attack target, and identifying candidates for protection based on the emulation results on a virtual network, it is possible to significantly improve the speed and scope of identifying candidates for protection.

[0081] In this embodiment, the display processing refers to a process in which the display processing unit 16 executes a process of generating information necessary for display, transmits the generated information to the terminal device 90, and causes the terminal device 90 to display the generated information. On the other hand, the display processing may also be a process in which the display processing unit 16 transmits a processing command to the terminal device 90 to generate information necessary for display, and causes the terminal device 90 to generate information necessary for display and display the generated information. Furthermore, when the display processing unit 16 is provided in the terminal device 90 (in the case of a stand-alone type), the display processing may also be a process in which the display processing unit 16 executes a process of generating necessary information, transmits the generated information to the display unit 905 of the terminal device 90, and causes the display unit 905 to display the generated information. [Explanation of symbols]

[0082] 0: Protected target identification system 1: Specific device to be protected 2: Database 3: Investigator terminal device 4: Attack detection device 5: Attacker's terminal device 6: Terminal device to be protected 7: Protected management device 100: Server 101: Processing section 102: Storage section 103: Communications Department 901: Processing section 902: Storage section 903: Communications Department 904: Input section 905: Display section 11: Collection Department 12: Acquisition part 13: Request analysis part 14: Specific part 141:Static specific part 142:Dynamic specification part 15:Notification section 16: Display processing section

Claims

1. A protection target identification system for identifying a protection target from an illegal object, the protection target identification system includes a database, an acquisition unit, a request analysis unit, and an identification unit; The database stores attack target information of attack targets that can be attacked by unknown malicious objects; The attack target information includes a plurality of pieces of individual attack target information, the acquisition unit acquires attack request information including information about the unknown malicious object; the request analysis unit acquires protection target identification reference information based on the attack request information, The identification unit identifies protection target candidates from among the attack targets based on the attack target information and the protection target identification reference information, and further compares a character string in the protection target identification reference information with a character string in the individual attack target information included in the identified protection target candidate, and identifies the protection target candidates from among the attack targets based on the attack target information including the individual attack target information having a character string that matches part or all of the character string in the protection target identification reference information. Protected target identification system.

2. A protection target identification system for identifying a protection target from an illegal object, the protection target identification system includes a database, an acquisition unit, a request analysis unit, and an identification unit; The database stores attack target information of attack targets that can be attacked by unknown malicious objects; the acquisition unit acquires attack request information including information about the unknown malicious object; the request analysis unit acquires protection target identification reference information based on the attack request information, the identification unit identifies protection target candidates from among attack targets based on the attack target information and the protection target identification reference information; the request analysis unit extracts network service identification information from the attack request information as the protection target identification reference information; The specifying unit acquires network service response information of the specified protection target candidates, and further narrows down the protection target candidates based on the network service identification information and the network service response information. Protected target identification system.

3. A protection target identification system for identifying a protection target from an illegal object, the protection target identification system includes a database, an acquisition unit, a request analysis unit, and an identification unit; The database stores attack target information of attack targets that can be attacked by unknown malicious objects; the acquisition unit acquires attack request information including information about the unknown malicious object; the request analysis unit acquires protection target identification reference information based on the attack request information, the identification unit identifies protection target candidates from among attack targets based on the attack target information and the protection target identification reference information; Based on the identified program targeted by the attack and the attack request information, the identified candidate programs to be protected are emulated on a virtual network, and the candidates to be protected are further narrowed down based on the results of the emulation. Protected target identification system.

4. The protection target identification system further includes a collection unit, The collection unit registers the character string of the attack target information in the database, the request analysis unit extracts and acquires a specific character string as the protection target identification reference information, The identification unit identifies the protection target candidate based on a search for a prefix match, a suffix match, an exact match, or a partial match of a specific character string in the protection target identification reference information and a character string in the attack target information. The protection target identification system according to any one of claims 1 to 3.

5. The attack request information includes payload information, the identification unit emulates the program targeted by the attack and the program of the payload information on the virtual network; Acquire virtual target identification information for uniquely identifying the attack target in the virtual network; Further narrowing down the candidates to be protected based on virtual network service response information obtained as a result of emulating the program to be attacked that corresponds to the acquired virtual target identification information. The protection target identification system according to claim 3 .

6. A protection target identification program for identifying a protection target from an illegal object, the protection target identification program causes a computer to function as a database, an acquisition unit, a request analysis unit, and an identification unit; The database stores attack target information of attack targets that can be attacked by unknown malicious objects; The attack target information includes a plurality of pieces of individual attack target information, the acquisition unit acquires attack request information related to the unknown malicious object; the request analysis unit acquires protection target identification reference information based on the attack request information, The identification unit identifies protection target candidates from among the attack targets based on the attack target information and the protection target identification reference information, and further compares a character string in the protection target identification reference information with a character string in the individual attack target information included in the identified protection target candidate, and identifies the protection target candidates from among the attack targets based on the attack target information including the individual attack target information having a character string that matches part or all of the character string in the protection target identification reference information. Protected Identification Program.

7. A method for identifying a protection target from an illegal object, comprising: The computer A process of storing attack target information that includes a plurality of individual attack target information pieces, the attack target information being information on attack targets that may be attacked by unknown malicious objects; obtaining attack request information regarding the unknown malicious object; A process of acquiring protection target specific reference information based on the attack request information; a process of identifying protection target candidates from among the attack targets based on the attack target information and the protection target identification reference information, and further comparing the character strings of the protection target identification reference information with the character strings of the individual attack target information included in the identified protection target candidates, and identifying protection target candidates from among the attack targets based on the attack target information including the individual attack target information having character strings that match part or all of the character strings of the protection target identification reference information; A method for identifying protected objects.

8. A protection target identification program for identifying a protection target from an illegal object, the protection target identification program causes a computer to function as a database, an acquisition unit, a request analysis unit, and an identification unit; The database stores attack target information of attack targets that can be attacked by unknown malicious objects; the acquisition unit acquires attack request information related to the unknown malicious object; the request analysis unit acquires protection target identification reference information based on the attack request information, the identification unit identifies protection target candidates from among attack targets based on the attack target information and the protection target identification reference information; the request analysis unit extracts network service identification information from the attack request information as the protection target identification reference information; The specifying unit acquires network service response information of the specified protection target candidates, and further narrows down the protection target candidates based on the network service identification information and the network service response information. Protected Identification Program.

9. A method for identifying a protection target from an illegal object, comprising: The computer A process of storing attack target information of attack targets that can be attacked by unknown malicious objects; obtaining attack request information regarding the unknown malicious object; A process of acquiring protection target specific reference information based on the attack request information; A process of identifying protection target candidates from among attack targets based on the attack target information and the protection target identification reference information; A process of extracting network service identification information from the attack request information as the protection target specific reference information; a process of acquiring network service response information of the identified protection target candidates, and further narrowing down the protection target candidates based on the network service identification information and the network service response information; A method for identifying protected objects.

10. A protection target identification program for identifying a protection target from an illegal object, the protection target identification program causes a computer to function as a database, an acquisition unit, a request analysis unit, and an identification unit; The database stores attack target information of attack targets that can be attacked by unknown malicious objects; the acquisition unit acquires attack request information related to the unknown malicious object; the request analysis unit acquires protection target identification reference information based on the attack request information, the identification unit identifies protection target candidates from among attack targets based on the attack target information and the protection target identification reference information; Based on the identified program targeted by the attack and the attack request information, the identified candidate programs to be protected are emulated on a virtual network, and the candidates to be protected are further narrowed down based on the results of the emulation. Protected Identification Program.

11. A method for identifying a protection target from an illegal object, comprising: The computer A process of storing attack target information of attack targets that can be attacked by unknown malicious objects; obtaining attack request information regarding the unknown malicious object; A process of acquiring protection target specific reference information based on the attack request information; A process of identifying protection target candidates from among attack targets based on the attack target information and the protection target identification reference information; a process of emulating the identified candidate programs to be protected on a virtual network based on the identified program to be attacked and the attack request information, and further narrowing down the candidates to be protected based on the results of the emulation; A method for identifying protected objects.

Images