False detection response system, false detection response method, and false detection response program

Abstract

To provide an erroneous detection countermeasure system which can easily determine whether a detection result obtained by a heuristic detection method is erroneous detection or not.SOLUTION: The erroneous detection countermeasure system is constituted by using an information processing apparatus including an arithmetic unit and a storage device and performs processing of: storing a white list including both representative points in respective feature quantity spaces of a plurality of clusters into which a plurality of normal files are classified on the basis of a prescribed feature quantity and thresholds indicative of distances from the representative points to define respective ranges of the plurality of clusters; extracting a feature quantity of a detection file detected as an abnormal file by a heuristic detection method; and determining whether the detection file detected as the abnormal file by the heuristic detection method is normal or not on the basis of distances from points indicative of the feature quantity of the detection file to respective representative points of the plurality of clusters in the feature quantity spaces and respective thresholds of the plurality of clusters.SELECTED DRAWING: Figure 17

Description

Technical Field

[0001] The present invention relates to a false detection countermeasure system, a false detection countermeasure method, and a false detection countermeasure program.

Background Art

[0002] As a method for detecting malware, a heuristic detection method is known. According to the heuristic detection method, it is possible to detect subtypes of malware and the like, but there are cases where something that is not malware is falsely detected as malware.

[0003] As a technique for dealing with such false detections, for example, Patent Document 1 discloses a technique for determining whether the detection result of the heuristic detection method is a false detection using a whitelist method after detection using the heuristic detection method.

[0004] In the whitelist method of Patent Document 1, it is determined whether it is a false detection based on the exact match or similarity between the diagnostic target file and the normal file. Here, the normal file is a file that was falsely detected as malware in the past and registered in the whitelist.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0006] However, the technology disclosed in Patent Document 1 tends to involve a huge number of parameters used for determination, such as assigning parameters like thresholds to each normal file in order to determine the degree of exact match or similarity between the file to be diagnosed and a normal file. Therefore, it may require significant costs to determine whether or not a false positive has occurred and to optimize the whitelist.

[0007] This invention has been made in view of the above-mentioned problems, and aims to provide an information processing device that can easily determine whether or not a detection result obtained by a heuristic detection method is a false detection. [Means for solving the problem]

[0008] One invention for achieving the above objective is a false positive response system configured using an information processing device having a computing device and a memory device, which stores a whitelist including a representative point in the feature space of a plurality of clusters, each of which a plurality of normal files are classified based on predetermined feature quantities, and a threshold indicating the distance from the representative point to define the range of each of the plurality of clusters, extracts the feature quantities of a detected file that has been detected as abnormal by a heuristic detection method, and performs a process to determine whether the detected file that has been detected as abnormal by a heuristic detection method is normal or not, based on the distance from the point indicating the feature quantities of the detected file to the representative point of each of the plurality of clusters and the threshold for each of the plurality of clusters. Other features of the present invention will be made clear by the description herein. [Effects of the Invention]

[0009] According to the present invention, it is possible to easily determine whether or not a detection result obtained by a heuristic detection method is a false detection. [Brief explanation of the drawing]

[0010] [Figure 1] This is a configuration diagram of a false detection response system according to one embodiment. [Figure 2]This is a functional configuration diagram of a monitored terminal according to one embodiment. [Figure 3] This is a functional configuration diagram of an integrated management server according to one embodiment. [Figure 4] This is a functional configuration diagram of a malware information distribution server according to one embodiment. [Figure 5] This is a functional configuration diagram of a client according to one embodiment. [Figure 6] This is a hardware configuration diagram of the computers that make up each device of a false detection response system according to one embodiment. [Figure 7] This figure shows a data table stored in a database according to one embodiment. [Figure 8] This diagram illustrates the configuration of the detection file information table according to one embodiment. [Figure 9] This diagram illustrates the configuration of a whitelist information table according to one embodiment. [Figure 10] This diagram illustrates the configuration of a normal file information table according to one embodiment. [Figure 11] This diagram illustrates the configuration of a malware information table according to one embodiment. [Figure 12] This diagram illustrates the configuration of a cost information table for handling issues according to one embodiment. [Figure 13] This is a flowchart illustrating a malware detection process according to one embodiment. [Figure 14] This is a flowchart illustrating the whitelist determination process according to one embodiment. [Figure 15] This is an example of a whitelist cluster according to one embodiment. [Figure 16] This is a flowchart illustrating the false detection handling process according to one embodiment. [Figure 17] This is an example of a whitelist cluster according to one embodiment. [Figure 18] This is a flowchart illustrating the whitelist cluster correction process according to one embodiment. [Figure 19] This is an example of a whitelist cluster according to one embodiment. [Figure 20] It is a flowchart diagram of malware countermeasure processing by an operator according to an embodiment. [Figure 21] It is an example of a display of a malware countermeasure screen according to an embodiment. [Figure 22] It is a flowchart diagram of malware information collection processing according to an embodiment. [Figure 23] It is a flowchart diagram of normal file collection processing according to an embodiment.

Mode for Carrying Out the Invention

[0011] ==Embodiment== The embodiment will be described with reference to the drawings. Note that the embodiments described below do not limit the invention according to the claims, and not all of the elements and combinations thereof described in the embodiments are essential for the solution means of the invention.

[0012] In the following description, the “storage unit” includes one or more memories. At least one memory may be a volatile memory or a non-volatile memory. The storage unit is mainly used during processing by the processing unit.

[0013] Also, in the following description, the “processing unit” includes one or more processors. At least one processor is typically a microprocessor such as a CPU (Central Processing Unit). Each of the one or more processors may be a single core or a multi-core. The processor may include a hardware circuit that performs part or all of the processing.

[0014] <<False Detection Countermeasure System 101>> The false detection countermeasure system 101 is a system that executes countermeasure processing after software or code is detected as malware by a heuristic detection method. The false detection countermeasure system 101 also creates a whitelist (described later) used when executing the countermeasure processing. It is a system that creates and updates.

[0015] In this specification, "malware" refers to any malicious software or code created with the intention of performing unauthorized and harmful actions. In the following descriptions, malware may be referred to as an "abnormal file." Software or code that is not malware will be referred to as a "normal file." Furthermore, software and code will be collectively referred to as a "file."

[0016] Figure 1 is a diagram of the configuration of the false positive response system 101. The false positive response system 101 comprises a monitored terminal 102, an integrated management server 103, a malware information distribution server 104, a client terminal 105, a database 106, and networks 107a and 107b.

[0017] In this embodiment, the monitored terminal 102, the integrated management server 103, the client terminal 105, and the database 106 are connected via network 107a (e.g., intranet). Furthermore, the integrated management server 103 and the malware information distribution server 104 are connected via network 107b (e.g., internetwork).

[0018] The false detection response system 101 may consist of at least the integrated management server 103, or it may include one or more devices other than the integrated management server 103 as appropriate.

[0019] Furthermore, although networks 107a and 107b are exemplified as different networks in this embodiment, they may be the same network. Also, the components labeled with reference numerals in Figure 1 may be multiple as needed.

[0020] (Functional Configuration) This section outlines the functions of the false detection response system 101 of this embodiment. Further detailed explanations of the functions of the false detection response system 101 will be provided in the flowchart-based processing explanation described later.

[0021] This section describes the functions realized by each component of the false detection response system 101 executing appropriate programs stored in its main memory 603 and auxiliary memory 604 (see Figure 6, described later).

[0022] <Monitored terminal 102> The monitored terminal 102 is a device that performs malware detection. The monitored terminal 102 is a device to be protected for security purposes, such as a business client PC.

[0023] Figure 2 is a functional configuration diagram of the monitored terminal 102 in this embodiment. The monitored terminal 102 comprises a transmitting / receiving unit 201 and a computing unit 202.

[0024] The transmitting / receiving unit 201 transmits and receives information between the integrated management server 103 and the database 106 via the network 107a.

[0025] The computing unit 202 includes a malware detection unit 203, a feature extraction unit 204, a whitelist determination unit 205, a false detection response request unit 206, a malware response request unit 207, and a normal file output unit 208.

[0026] The malware detection unit 203 detects whether or not multiple files contained within the monitored terminal 102 are malware using a heuristic detection method.

[0027] In the following explanation, "detecting as malware" is synonymous with "detecting as abnormal." Similarly, "detecting as not malware" is synonymous with "detecting as normal."

[0028] Furthermore, in the following explanation, files detected by the malware detection unit 203 will be referred to as "detected files" regardless of the detection result. In other words, detected files can be malware (abnormal files) or normal files.

[0029] The feature extraction unit 204 extracts the features of the detected file that has been identified as malware by the malware detection unit 203 (described later).

[0030] The whitelist determination unit 205 determines whether the detected file, which has been identified as malware by the malware detection unit 203, is legitimate or not. At this time, the whitelist determination unit 205 makes the determination based on the whitelist, which will be described in detail later.

[0031] In other words, if the whitelist determination unit 205 determines that the detected file is normal, it means that the detection result by the malware detection unit 203 is incorrect (false positive). Conversely, if the whitelist determination unit 205 determines that the detected file is abnormal, it means that the detection result by the malware detection unit 203 is correct.

[0032] The false detection handling request unit 206 requests the integrated management server 103 to take action against the false detection if the whitelist determination unit 205 determines that the detected file is normal (details will be described later).

[0033] The malware response request unit 207 requests malware response from the integrated management server 103 if the whitelist determination unit 205 determines that the detected file is abnormal (details will be described later).

[0034] The normal file output unit 208 sends a list of normal files contained in the monitored terminal 102 to the integrated management server 103.

[0035] In this context, the normal files contained within the monitored terminal 102 include files detected as normal by the malware detection unit 203 and files detected as abnormal by the malware detection unit 203 but determined to be normal by the whitelist determination unit 205.

[0036] <Integrated Management Server 103> The integrated management server 103 is a server device that primarily executes various processes in the false detection handling process according to this embodiment based on the information on the database 106.

[0037] Figure 3 is a functional configuration diagram of an integrated management server 103 according to one embodiment. The integrated management server 103 comprises a transmitting / receiving unit 301 and a computing unit 302.

[0038] The transmitting / receiving unit 301 transmits and receives information between the monitored terminal 102, the client terminal 105, and the database 106 via network 107a, and transmits and receives information with the malware information distribution server 104 via network 107b.

[0039] The computing unit 302 includes a false detection response request receiving unit 303, a malware response request receiving unit 304, a whitelist cluster identification unit 305, a cluster parameter calculation unit 306, and a cluster It comprises a startup parameter correction unit 307, a malware countermeasure screen generation unit 308, a malware information collection unit 309, and a normal file information receiving unit 310.

[0040] The false detection response request receiving unit 303 receives the aforementioned false detection response request from the monitored terminal 102.

[0041] The malware response request receiving unit 304 receives the aforementioned malware response request from the monitored terminal 102.

[0042] The whitelist cluster identification unit 305 identifies the whitelist cluster to which the detection file that the whitelist judgment unit 205 determined to be normal (i.e., the detection file that the malware detection unit 203 mistakenly identified as abnormal) belongs.

[0043] As will be explained in more detail later, the whitelist used by the whitelist determination unit 205 for processing contains information on each of the multiple clusters when multiple normal files are classified into multiple clusters based on predetermined features.

[0044] A whitelist cluster is a collection of clusters where information is stored in a whitelist. In the following explanation, a whitelist cluster may sometimes be simply referred to as a "cluster."

[0045] The cluster parameter calculation unit 306 calculates the representative point and threshold of the whitelist cluster from the information of the detected files that the whitelist determination unit 205 has determined to be normal.

[0046] As will be explained in more detail later, a cluster representative point is a predetermined point in the feature space that is set for each of the multiple clusters whose information is stored in the whitelist.

[0047] As will be explained in more detail later, the cluster threshold is a value that indicates the distance from a representative point, set to define the range of each of the multiple clusters in the feature space.

[0048] The cluster parameter correction unit 307 corrects the representative point and threshold of the whitelisted cluster to more appropriate values ​​based on malware information and false positive handling cost information.

[0049] The malware response screen generation unit 308 generates screens for displaying the results of the false detection response process and the malware response process.

[0050] The malware information collection unit 309 receives a list of malware information from the malware information distribution server 104 and registers it in the database 106.

[0051] The normal file information receiving unit 310 receives a list of normal files from the monitored terminal 102 and registers it in the database 106.

[0052] <Malware Information Distribution Server 104> The malware information distribution server 104 is a device that distributes information such as analysis reports on malware from external organizations, and is, for example, a public security repository.

[0053] Figure 4 is a functional configuration diagram of a malware information distribution server 104 according to one embodiment. The malware information distribution server 104 comprises a transmitting / receiving unit 401 and a computing unit 402.

[0054] The transmitting / receiving unit 401 transmits and receives information with the integrated management server 103 via the network 107b.

[0055] The computing unit 402 includes a malware information distribution unit 403. The malware information distribution unit 403 distributes a list of information about known malware to the integrated management server 103.

[0056] <Client terminal 105> The client terminal 105 is a general-purpose computer terminal directly operated by security operators, and is the primary output destination for processing results from the integrated management server 103, i.e., the results of false positive response processing.

[0057] Figure 5 is a functional configuration diagram of a client terminal 105 according to one embodiment. The client terminal 105 comprises a transmitting / receiving unit 501, an input / output unit 502, and a processing unit 503.

[0058] The transmitting / receiving unit 501 transmits and receives information with the integrated management server 103 via the network 107a.

[0059] The input / output unit 502 receives input from the security operator via an interface device such as a keyboard, and also performs screen output processing for the security operator via an interface device such as a monitor.

[0060] The computing unit 503 includes a malware response input / output processing unit 504. The malware response input / output processing unit 504 displays the results of the false positive response processing and malware response processing performed by the integrated management server 103 on the screen to the security operator, and accepts input of the response results for the detected files detected by the malware detection unit 203.

[0061] <Database 106> Database 106 is a storage device that stores information on detected files identified as malware by the monitored terminal 102, information on the whitelist generated by the false positive response process of the integrated management server 103, information on normal files obtained from the monitored terminal 102, information on malware obtained from the malware information distribution server 104, and information on the countermeasure costs calculated during the malware countermeasure process by the operator.

[0062] In this embodiment, the database 106 is connected to the integrated management server 103 via the network 107a in a communicable manner. The database 106 may also be built on the auxiliary storage device 604 (see Figure 6) of the integrated management server 103.

[0063] . (Hardware configuration) Next, the hardware configuration of the device constituting the false detection response system 101 according to this embodiment will be described.

[0064] Figure 6 is a hardware configuration diagram of the computers that make up each device of the false positive detection response system 101 according to this embodiment. The monitored terminal 102, integrated management server 103, malware information distribution server 104, client terminal 105, and database 106 that make up the false positive detection response system 101 are each, for example, made up of computer devices 601.

[0065] The computer device 601 includes a processor 602, main memory 603, and auxiliary storage 60 4. It comprises a transmitting / receiving device 605, an output device 606, and an input device 607.

[0066] The processor 602 is composed of components such as a CPU (Central Processing Unit), MPU (Micro Processing Unit), GPU (Graphics Processing Unit), FPGA (Field Programmable Gate Array), ASIC (Application Specific Integrated Circuit), and AI (Artificial Intelligence) chip.

[0067] The main memory 603 is a device used by the processor 602 when executing programs, and can be, for example, ROM (Read Only Memory), RAM (Random Access Memory), or non-volatile memory (NVRAM (Non-Volatile RAM)). The various functions implemented in the false detection response system 101 are realized by each processor 602 reading programs and data stored in the auxiliary memory 604 into the main memory 603 and executing them.

[0068] The auxiliary storage device 604 is a device for storing programs and data, such as an SSD (Solid State Drive), a hard disk drive, or an optical storage device (CD (Compact Disc)). The auxiliary storage device 604 can be composed of a storage system, an IC card, a reader / writer for non-temporary recording media such as a DVD (Digital Versatile Disc), an IC card, an SD card, or an optical recording media, and a non-temporary storage area of ​​a cloud server. The auxiliary storage device 604 can read programs and data from non-temporary recording media or other information processing devices equipped with non-temporary storage devices via a recording media reader or a transceiver 605. Programs and data stored in the auxiliary storage device 604 are read into the main memory 603 as needed.

[0069] The transceiver 605 is a device that enables communication with other devices. The transceiver 605 is a wired or wireless communication interface that enables communication with other devices via a network, and is, for example, a NIC (Network Interface Card), a wireless communication module, a USB module, etc.

[0070] The output device 606 and the input device 607 constitute a user interface that enables interactive processing with the user (receiving information, providing information, etc.).

[0071] The output device 606 and the input device 607 do not need to be equipped with any of the monitored terminal 102, the integrated management server 103, the malware information distribution server 104, or the database 106.

[0072] The arithmetic units 202, 302, 402, and 503 of each device shown in Figures 2 to 5 are realized when the processor 602 loads an appropriate program stored in the auxiliary storage device 604 into the main memory device 603 and executes it.

[0073] Furthermore, the transmitting and receiving units 201, 301, 401, and 501 of each device shown in Figures 2 to 5 are composed of a transmitting and receiving device 605.

[0074] Furthermore, the input / output section 502 of the client terminal 105 shown in Figure 5 is composed of an output device 606 and an input device 607.

[0075] (Data structure) The data used in the false detection response system 101 according to one embodiment will now be described. The data used in the false detection response system 101 is stored in the database 106.

[0076] Figure 7 shows a data table stored in a database 106 according to one embodiment. The database 106 stores a detected file information table 701, a whitelist information table 702, a normal file information table 703, a malware information table 704, and a remediation cost information table 705.

[0077] Figure 8 is a diagram illustrating the configuration of a detection file information table 701 according to one embodiment. The detection file information table 701 stores one record for each detection file detected by the monitored terminal 102.

[0078] The records in the detected file information table 701 have the following data items: detected file ID 801, file attribute information 802, feature quantity 803, cluster ID 804, detection date and time 805, status 806, and other information 807.

[0079] The detection file ID 801 stores the identifier of the file that was detected by the malware detection unit 203 of the monitored terminal 102.

[0080] File attribute information 802 stores file attribute information such as the file name, file path, and any attached electronic certificates of the detected file.

[0081] Feature 803 stores the features extracted from the detection file.

[0082] Cluster ID 804 stores the identifier of the cluster to which the detected file belongs, among the multiple clusters stored in the whitelist.

[0083] The detection date and time 805 stores the date and time when the detection process for the detection file was executed by the malware detection unit 203 of the monitored terminal 102.

[0084] Status 806 stores the status of how false positives have been handled for detected files (one of three values: "Not handled / False positive / Handed over").

[0085] Other information 807 stores various pieces of information related to the detection files necessary for displaying the malware countermeasures screen described later.

[0086] Figure 9 is a diagram illustrating the configuration of a whitelist information table 702 according to one embodiment. The whitelist information table 702 corresponds to the "whitelist," and in the following description, it may also be simply referred to as the "whitelist."

[0087] As will be explained in more detail later, the whitelist is a list used to perform corrective actions after a file being diagnosed has been detected as abnormal by a heuristic detection method.

[0088] The whitelist information table 702 stores one record for each whitelist cluster used for whitelist determination. Each record in the whitelist information table 702 has the cluster ID 901, the cluster's representative point 902, and the cluster's threshold 903 as data items.

[0089] Cluster ID 901 stores an identifier used to identify multiple whitelist clusters.

[0090] The cluster's representative point 902 stores the representative point value used when performing whitelisting. It will be done.

[0091] The cluster threshold 903 stores the threshold used when performing whitelisting.

[0092] Figure 10 is a diagram illustrating the configuration of a normal file information table 703 according to one embodiment. The normal file information table 703 stores one record for each normal file acquired from the monitored terminal 102.

[0093] Each record in the normal file information table 703 has the following data items: normal file ID 1001, file attribute information 1002, feature quantity 1003, cluster ID 1004, and update date and time 1005.

[0094] The normal file ID 1001 stores the identifier of the normal file. The file attribute information 1002 stores file attribute information such as the file name, file path, and attached electronic certificate. The feature quantity 1003 stores the feature quantity extracted from the normal file. The cluster ID 1004 stores the identifier of the cluster to which the normal file belongs. The update date and time 1005 stores the date and time when the normal file was updated on the monitored terminal 102.

[0095] Furthermore, normal files, for which records are stored in the normal file information table 703, are files that the malware detection unit 203 of the monitored terminal 102 has detected as normal.

[0096] Figure 11 is a diagram illustrating the configuration of a malware information table 704 according to one embodiment. The malware information table 704 stores one record for each piece of malware information obtained from the malware information distribution server 104. Each record in the malware information table 704 has a malware ID 1101 and a feature quantity 1102 as data items.

[0097] Malware ID 1101 stores the identifier of publicly known malware. Feature 1102 stores the features extracted from the malware.

[0098] Figure 12 is a diagram illustrating the configuration of a countermeasure cost information table 705 according to one embodiment. The countermeasure cost information table 705 stores one record for each detection file in which an operator has performed a false positive countermeasure. Each record in the countermeasure cost information table 705 has a detection file ID 1201 and a countermeasure time 1202 as data items.

[0099] Detection file ID 1201 stores the identifier of the detection file for which the operator performed a false positive correction. Correction time 1202 stores the time the operator spent correcting the detection file.

[0100] In this embodiment, the detected file information table 701, the whitelist information table 702, the normal file information table 703, the malware information table 704, and the countermeasure cost information table 705 are constructed on the database 106. However, these tables may also be stored in the auxiliary storage device 604 between the monitored terminal 102 and the integrated management server 103.

[0101] Alternatively, at least one or more of the tables may be joined together to form a single table, or a more normalized table.

[0102] <Malware detection process> The processing operation of the false detection handling method in this embodiment will be explained with reference to Figure 13. Figure 13 is a flowchart of a malware detection process according to one embodiment.

[0103] The various operations in the false detection handling process described below are realized when a component of the false detection handling system 101, such as the integrated management server 103, reads a program into the main memory 603 or the like, and the processor 602 executes it. This program consists of code for performing the various operations described below.

[0104] First, in step 1301, the malware detection unit 203 of the monitored terminal 102 detects whether multiple files contained within the monitored terminal 102 are normal or abnormal using a heuristic detection method.

[0105] A heuristic detection method involves machine learning the binary data of known malware to generate binary patterns that represent the characteristics of the malware, and then performing pattern matching. In this embodiment, the program is executed periodically, but it may also be executed manually by the user, or it may be executed when a file is written after monitoring reads and writes to the file system. The malware detection unit 203 periodically executes the program and performs the process in step 1301.

[0106] Next, in step 1302, the feature extraction unit 204 of the monitored terminal 102 extracts the features of the detection file that was detected as abnormal in step 1301.

[0107] A feature is, for example, a hash value. Methods for obtaining a hash value include using a fuzzy hash algorithm or a locally sensitive hash algorithm. In this embodiment, one feature extraction method is used, but multiple features extracted by multiple feature extraction methods may be combined and used.

[0108] Next, in step 1303, the whitelist determination unit 205 of the monitored terminal 102 determines whether the detected file that was detected as abnormal in step 1301 is normal or not.

[0109] In other words, the whitelist determination unit 205 determines whether the detection result in step 1301 is a false positive or not. The details of the process in step 1303 will be explained in detail later using the flowchart in Figure 14.

[0110] If the detection file is determined to be normal in step 1303 (i.e., if the detection result in step 1301 is determined to be a false positive), the process proceeds to step 1304, where the false positive response request unit 206 of the monitored terminal 102 requests the integrated management server 103 to execute the false positive response process.

[0111] In step 1304, the false positive handling request unit 206 sends information about the detected file to the integrated management server 103 in response to the request. The information about the detected file here includes the identifier of the detected file, the file attribute information, the feature quantities extracted from the file, the date and time when the malware detection unit 203 detected it as abnormal, the result of the whitelisting judgment, the file name, and other information.

[0112] Next, in step 1305, the false detection response request receiving unit 303 of the integrated management server 103 receives a request for false detection response processing, and the integrated management server 103 executes the false detection response processing. The details of the process in step 1305 will be explained in detail later using the flowchart in Figure 16.

[0113] On the other hand, if in step 1303 the detected file is determined to be abnormal (i.e., the detection result in step 1301 is determined to be correct), the process proceeds to step 1306, where the malware response request unit 207 of the monitored terminal 102 requests the integrated management server 103 to execute malware response processing.

[0114] In step 1304, the malware response request unit 207 sends information about the detected file to the integrated management server 103 in response to the request. This information about the detected file includes the identifier of the detected file, attribute information of the detected file, feature quantities extracted from the detected file, the date and time when the malware detection unit 203 detected it as abnormal, the result of the whitelisting judgment, the file name, and other information.

[0115] Next, in step 1307, the malware countermeasure request receiving unit 304 of the integrated management server 103 receives a malware countermeasure processing request, and the integrated management server 103 stores information about the detected file in the detected file information table 701 (Figure 8).

[0116] Here, the detected file ID 801, file attribute information 802, feature quantity 803, detection date and time 805, and other information 807, along with the information corresponding to each item, are included in the malware countermeasures processing request (step 1306).

[0117] At this stage, the process of classifying the detected files into any whitelist cluster has not yet been executed, so it is not yet determined which whitelist cluster the detected files will be classified into.

[0118] In this case, cluster ID 804 shown in Figure 8 should be set to "NULL," meaning it is not included in any cluster. Similarly, status 806 should be set to "Unaddressed," meaning the malware has not yet been dealt with.

[0119] <Whitelisting process> The details of step 1303 (whitelist determination) in Figure 13 will be explained using Figure 14. Figure 14 is a flowchart of the whitelist determination process according to one embodiment.

[0120] First, in step 1401, the monitored terminal 102 retrieves a list of whitelist clusters and information related to each cluster from the whitelist information table 702 (Figure 9) on the database 106.

[0121] Next, in steps 1402 to 1403, the whitelist determination unit 205 of the monitored terminal 102 iteratively performs threshold determination processing on the acquired whitelist clusters.

[0122] In step 1403, the whitelist determination unit 205 determines whether a detected file is normal or not based on the distance from a point representing the features of a single detected file in the feature space to the representative point of each of the multiple clusters, and the threshold of each of the multiple clusters.

[0123] Specifically, the whitelist determination unit 205 determines that a detected file is normal if the distance in the feature space between a representative point of any one of the multiple clusters and a point indicating the features of the detected file is smaller than the threshold of any one of the clusters.

[0124] Here, the process by which the whitelist determination unit 205 determines whether the detected file is normal will be explained using the example shown in Figure 15. In the example in Figure 15, the feature space is projected in two dimensions. There are two clusters (Cluster 1 and Cluster 2).

[0125] Cluster 1 contains the normal files, files 1-1 through 1-3. Cluster 2 contains the normal files, files 2-1 through 2-3.

[0126] The black circles indicate the feature quantities of files 1-1 to 1-3 and files 2-1 to 2-3, respectively. The triangles indicate the feature quantities of the detected files that are subject to determination as to whether or not they are false positives.

[0127] In this example, the distance in feature space between the representative point of cluster 1 (representative point 1) and the point representing the features of the detected file is greater than the threshold for cluster 1 (threshold 1). On the other hand, the distance in feature space between the representative point of cluster 2 (representative point 2) and the point representing the features of the detected file is less than the threshold for cluster 2 (threshold 2).

[0128] Therefore, in this example, the whitelist determination unit 205 determines that the detected file is normal.

[0129] For measuring distances in a feature space, if the features are numerical vectors, methods such as Euclidean distance can be used, and if the features are strings, methods such as Levenshtein edit distance can be used.

[0130] The features of the detected file are extracted in the feature extraction process in step 1302.

[0131] In this embodiment, in step 1403, if the distance between the point representing the feature quantity of the detected file and the representative point of the cluster is smaller than the cluster threshold, the whitelist determination unit 205 determines that the detected file is normal and terminates the iterative process.

[0132] On the other hand, if the distance between the point representing the features of the detected file and the representative point of the cluster is greater than the cluster threshold, the iteration process continues. As a result of the iteration process in step 1403, if for all clusters the distance between the point representing the features of the detected file and the representative point of the cluster is greater than the cluster threshold, the whitelist determination unit 205 determines that the detected file is abnormal.

[0133] <False detection handling process> The details of step 1305 (false detection handling) in Figure 13 will be explained using Figure 16. Figure 16 is a flowchart of the false detection handling process according to one embodiment.

[0134] First, in step 1501, the integrated management server 103 retrieves a list of detected files and a record for each detected file from the detected file information table 701 (Figure 8) on the database 106.

[0135] Next, in steps 1502 to 1503, the whitelist cluster identification unit 305 of the integrated management server 103 performs whitelist cluster identification processing on the acquired detection files.

[0136] In the whitelist cluster identification process, the whitelist cluster identification unit 305 identifies the whitelist cluster to which the detected file, which was incorrectly detected as abnormal in step 1301 (Figure 13), should belong.

[0137] Specifically, the whitelist cluster identification unit 305 extracts one whitelist cluster and determines whether the detected file belongs to the extracted whitelist cluster (step 1503). The whitelist cluster identification unit 305 repeats this process for other whitelist clusters (step 1502).

[0138] There are several methods for determining whether a detected file belongs to an extracted whitelist cluster. For example, one method is to evaluate the degree of matching based on file attribute information 802 (Figure 8), such as the file path, file creator name, and issuer name of the digital certificate embedded in the file.

[0139] In this embodiment, the method for identifying whitelist clusters uses file attribute information 802. However, a method similar to the threshold determination process of the whitelist determination process (step 1403 in Figure 14) may be used to identify the cluster to which the file belongs, based on the smallest distance between the points representing the features of the detected file and the representative point of the cluster.

[0140] If a cluster to which the file should belong cannot be identified in step 1503, the process proceeds to step 1504, where the whitelist cluster identification unit 305 generates a new cluster. The new cluster is issued a new cluster ID that does not overlap with the identifier of an existing cluster, the representative point of the cluster is set to the feature value of the falsely detected file, and the cluster threshold is set to a predefined initial value.

[0141] On the other hand, if a cluster to which the device should belong is identified in step 1503, the process proceeds to step 1505, where the whitelist cluster identification unit 305 retrieves information on each detection file belonging to the identified cluster from the detection file information table 701.

[0142] Next, in step 1506, the cluster parameter calculation unit 306 of the integrated management server 103 calculates cluster parameters consisting of a representative point of the cluster and a cluster threshold.

[0143] The process performed by the cluster parameter calculation unit 306 will now be explained using the example shown in Figure 17. In the example in Figure 17, there are two clusters (cluster 1 and cluster 2) in the two-dimensional projected feature space.

[0144] Cluster 1 contains files 1-1 to 1-3, which are normal files. As shown in the figure, the dates and times when files 1-1, 1-2, and 1-3 were detected as abnormal by the malware detection unit 203 in step 1301 (Figure 13) were March 3, 2022, March 4, 2022, and March 5, 2022, respectively. Cluster 2 contains files 2-1 to 2-3, which are normal files.

[0145] The cluster parameter calculation unit 306 determines a representative point of the cluster based on the point that represents the feature quantity of the file that was most recently detected as abnormal in step 1301 (Figure 13) among the multiple detection files (multiple normal files) belonging to the cluster.

[0146] In the example shown in Figure 17, the cluster parameter calculation unit 306 uses the point representing the feature quantity of file 1-3, which has the most recent detection date and time among files 1-1 to 1-3 belonging to the same cluster (cluster 1), as the representative point of cluster 1.

[0147] Furthermore, the cluster parameter calculation unit 306 determines the characteristic quantity of any one of the normal files belonging to the cluster, and the normal files that were detected as abnormal following this normal file. A threshold is determined based on the distance between a point representing a feature and the feature space.

[0148] Of the two normal files presented here, the one detected as abnormal first corresponds to "File 1." The point representing the features of File 1 corresponds to "Point 1." The normal file detected as abnormal later corresponds to "File 2." The point representing the features of File 2 corresponds to "Point 2."

[0149] In the example in Figure 17, the second file corresponds to file 1-3, which is the most recent file to be detected among the normal files belonging to cluster 1 (detection date and time: March 6, 2022). The first file corresponds to file 1-2, which is the second most recent file to be detected among the normal files belonging to cluster 1 (detection date and time: March 5, 2022).

[0150] In this embodiment, the cluster parameter calculation unit 306 arranges the detection files belonging to the cluster in chronological order based on the date and time when multiple detection files were detected as abnormal in step 1301 (Figure 13), calculates the amount of change in the time series of points representing feature quantities, and uses the weighted average of the amount of change as the threshold for the cluster.

[0151] In the example shown in Figure 17, the cluster parameter calculation unit 306 calculates the threshold for cluster 1 by taking a weighted average of the change L1-1 between the point representing the features of file 1-1 and the point representing the features of file 1-2, and the change L1-2 between the point representing the features of file 1-2 and the point representing the features of file 1-3.

[0152] Next, in step 1507, the cluster parameter correction unit 307 of the integrated management server 103 corrects the cluster parameters after step 1504 or step 1506. Details of the cluster parameter correction process will be explained later using the flowchart in Figure 18.

[0153] Note that the cluster parameter correction process in step 1507 is not mandatory, and the cluster parameters calculated in the cluster parameter calculation process in step 1506 may be used as is.

[0154] Next, in step 1508, the integrated management server 103 stores information about the detection files that were determined to be normal (i.e., false positives) in step 1303 (Figure 13) in the detection file information table 701 (Figure 8).

[0155] The information corresponding to each item shown in Figure 8—the detected file ID 801, file attribute information 802, feature quantity 803, detection date and time 805, and other information 807—is included in the malware countermeasures request (step 1306 in Figure 13) received from the monitored terminal 102.

[0156] Cluster ID 804 is either identified by the whitelist cluster identification process in step 1503 or newly generated by the new cluster creation process in step 1504. Status 806 (Figure 8) should be set to "False positive," indicating that it is a false positive.

[0157] Next, in step 1509, the integrated management server 103 updates the whitelist information table 702 (Figure 9) by storing the information regarding the whitelist clusters determined in the above process in a predetermined item in the whitelist information table 702.

[0158] Here, the confirmed information regarding the whitelisted cluster includes the cluster ID 901, the cluster's representative point 902, and the cluster's threshold 903, as shown in Figure 9.

[0159] Cluster ID 901 is either identified by the whitelist cluster identification process in step 1503, or newly created by the new cluster creation process in step 1504.

[0160] The cluster representative point 902 and the cluster threshold 903 are calculated by the cluster parameter calculation process in step 1506 and the cluster parameter correction process in step 1507.

[0161] <Details of cluster parameter correction process> The details of the cluster parameter correction process in step 1507 (Figure 16) will be explained using Figures 18 and 19. Figure 18 is a flowchart of the cluster parameter correction process according to one embodiment.

[0162] First, in step 1701, the integrated management server 103 retrieves information about malware near the cluster's representative point from the malware information table 704 (Figure 11). As mentioned above, malware is also referred to as an "abnormal file."

[0163] Here, the integrated management server 103 obtains information about malware close to the cluster's representative point, based on the distance between the cluster's representative point and the point representing the malware's features in the given whitelist cluster. The number of malware information points obtained here can be any predetermined value.

[0164] Here, the number of malware information points may be, for example, 1 for each whitelist cluster (i.e., the total number of whitelist clusters). In this case, the integrated management server 103 only needs to obtain the malware information for the point that best represents the feature for each representative point of multiple whitelist clusters in the feature space.

[0165] Alternatively, the number of malware information entries may not be limited to one per whitelist cluster, for example, but could be multiple. In this case, the integrated management server 103 only needs to acquire a predetermined number of malware information entries for each representative point of multiple whitelist clusters in the feature space, in order of proximity of the points indicating features.

[0166] In the example shown in Figure 19, there are two clusters (Cluster 1 and Cluster 2) in the two-dimensional projected feature space.

[0167] Cluster 1 shows the latest file, File 1, which is a normal file. Cluster 2 shows the latest file, File 2, which is also a normal file. Note that for each of the two clusters, the illustrations of files other than the latest file have been omitted.

[0168] The black circles indicate the characteristic features of File 1 and File 2, respectively. Furthermore, the white circles indicate the characteristic features of malware.

[0169] This example shows that three pieces of malware information were retrieved for cluster 1, and one piece of malware information was retrieved for cluster 2.

[0170] Next, in step 1702, the cluster parameter correction unit 307 of the integrated management server 103 extracts malware features and corrects the threshold based on the distance between a point representing the malware features in the feature space and a representative point of the cluster.

[0171] Specifically, the cluster parameter correction unit 307 adjusts the representative point of the cluster and the neighboring marweh A correction value, determined by the distance to the point representing feature A, is subtracted from the cluster threshold. Possible correction values ​​include, for example, the reciprocal of the average inter-feature distance between the cluster's representative point and neighboring malware features, multiplied by a predetermined constant.

[0172] In other words, the correction value may be set to a value that increases as the distance between the feature vectors between the representative point of the cluster and the feature vectors of neighboring malware decreases.

[0173] Note that the method for correcting the threshold is not limited to this. For example, the threshold may be corrected so that it is smaller than the distance between a point representing a malware feature in the feature space and the representative point of the cluster.

[0174] In the example in Figure 19, before adjusting the cluster thresholds, within the range of threshold 1 from representative point 1 of cluster 1, there are points representing the features of three malware entities (malware 1-3). Similarly, within the range of threshold 2 from representative point 2 of cluster 2, there are points representing the features of one malware entity (malware 4).

[0175] In response to this, the above correction is applied to the cluster thresholds, subtracting a correction value of 1 from the threshold of cluster 1 and a correction value of 2 from the threshold of cluster 2. As a result, after the threshold correction, for both clusters, there will be no points representing malware features within the range of the threshold from the cluster's representative point.

[0176] Next, in step 1703, the integrated management server 103 obtains a list of response times 1202 for detected files from the response cost information table 705 and calculates the average response time.

[0177] Next, in step 1704, the integrated management server 103 obtains a list of detection dates and times 805 for detection files belonging to the cluster from the detection file information table 701 and calculates the false positive frequency.

[0178] Next, in step 1705, the cluster parameter correction unit 307 of the integrated management server 103 corrects the threshold of the cluster to which the file determined to be normal belongs by a larger amount the longer the processing time is when registering the file determined to be normal in step 1303 (Figure 13) to the whitelist.

[0179] Furthermore, in step 1705, the cluster parameter correction unit 307 corrects the cluster threshold based on the frequency with which files detected as abnormal by the heuristic detection method are classified over a predetermined period.

[0180] In this embodiment, the cluster parameter correction unit 307 adds a correction value determined from the average response time and false detection frequency to the cluster threshold. The correction value can be, for example, a value obtained by multiplying the average response time and false detection frequency by a predetermined constant. That is, the correction value should be a value that increases as the average response time increases and as the detection frequency increases.

[0181] (Malware countermeasures by the operator) Figure 20 is a flowchart of the malware response process performed by an operator according to one embodiment. Figure 21 shows an example of the malware response screen 1901 presented to the operator.

[0182] First, in step 1801, the operator accesses the malware response screen 1901 via the client terminal 105. In this embodiment, the process is initiated at any time based on the operator's decision, but the operator may also be notified via a notification system such as email. You may prompt them to take action to deal with the malware.

[0183] The malware response screen 1901 shown in Figure 21 includes a list of detected files 1902, a link to detailed information about the detected files 1903, detailed information about the detected files 1904, a whitelist judgment result 1905, and a button to report the response result 1906.

[0184] The detected file list 1902 displays the information about each detected file stored in the detected file information table 701.

[0185] The detection file details link 1903 is a button that displays detailed information about the detection file selected by the operator. In this embodiment, the detection file name in the detection file list 1902 is made a hyperlink, enabling the selection of a detection file.

[0186] The detection file details information 1904 displays the details of the detection file selected by the operator. In this embodiment, it is displayed dynamically when the operator clicks the detection file details information link 1903.

[0187] Whitelist judgment result 1905 displays the judgment result for the detection file selected by the operator. In this embodiment, in addition to the binary judgment result of normal or abnormal based on the whitelist judgment, the feature quantities of the detection file and information of the whitelist cluster closest to the detection file are projected onto a two-dimensional feature space and presented as a graph.

[0188] The action result report button 1906 is a button that reports the results of the action taken for the detection file selected by the operator. In this embodiment, there is a false positive button to report that it was a false positive and an action taken button to report that it has been taken care of.

[0189] Next, in step 1802, the operator selects a detected file from the malware countermeasures screen 1901 via the client terminal 105.

[0190] Next, in step 1803, the operator takes appropriate incident response measures for the selected detected file and reports the results from the malware response screen 1901. Incident response measures include investigating the incident, reporting to the security department, analyzing the detected file, and developing countermeasures. As a result of the incident response, it may be found that the detected file was a false positive and is actually a normal file, or it may be treated as malware.

[0191] In the incident response process in step 1803, if the detected file is reported as resolved, the integrated management server 103 updates the status 806 for the detected file in the detected file information table 701 (Figure 8) to "Resolved".

[0192] On the other hand, if a detection file is reported as a false positive during the incident response process in step 1803, the integrated management server 103 registers the time required to handle the detection file in the response cost information table 705 (Figure 12).

[0193] The time required for remediation can be measured on the client terminal 105 from the moment the operator clicks the detected file details link 1903 on the malware remediation screen 1901 until they click the remediation result report button 1906.

[0194] Next, in step 1807, the integrated management server 103 performs false positive correction processing on the detected file. The false positive correction processing is the same as the false positive correction processing described above (Figure 16). It appears that way.

[0195] Next, in step 1808, the integrated management server 103 updates the status 806 for the detected file in the detected file information table 701 (Figure 8) from "Not handled" to "False positive".

[0196] <Malware Information Collection Process> Figure 22 is a flowchart of a malware information collection process according to one embodiment.

[0197] First, in step 2001, the integrated management server 103 obtains malware information from the malware information distribution server 104. The integrated management server 103 periodically executes step 2001.

[0198] Next, in step 2002, the integrated management server 103 stores the acquired malware information in the malware information table 704 (Figure 11). Here, the malware ID 1101 and feature quantity 1102 are included in the malware information distributed by the malware information distribution server 104.

[0199] Next, in step 2003, the integrated management server 103 retrieves a list of whitelist clusters from the whitelist information table 702 (Figure 9).

[0200] Next, in steps 2004 to 2005, the cluster parameter correction unit 307 of the integrated management server 103 performs cluster parameter correction processing for all clusters. This processing is the same as the cluster parameter correction processing described above (Figure 18).

[0201] Next, in step 2006, the integrated management server 103 updates the cluster information in the whitelist information table 702. The cluster threshold 903 has been updated by the cluster parameter correction process in step 2005.

[0202] The malware information collection process is for collecting malware information used in the cluster parameter correction process in step 2005. If the cluster parameter correction process is not performed, the malware information collection process does not need to be performed either.

[0203] <Normal file collection process> Figure 23 is a flowchart of a normal file collection process according to one embodiment.

[0204] First, in step 2101, the monitored terminal 102 sends a list of normal files to the integrated management server 103. The monitored terminal 102 periodically performs the process in step 2101.

[0205] Next, in step 2102, the integrated management server 103 stores the acquired normal file information in the normal file information table 703 (Figure 10) and retrieves all normal file information from the normal file information table 703.

[0206] The normal file ID 1001, file attribute information 1002, feature quantity 1003, and update date and time 1005 shown in Figure 10 are included in the normal file information transmitted from the monitored terminal 102. Note that the cluster ID 1004 will be updated later, so it is sufficient to set it to "NULL" at this stage.

[0207] Next, in step 2103, the integrated management server 103 classifies the normal files into clusters of attribute information for normal files. The method for classifying into clusters is the same as that used in step 1503 (whitelist cluster identification process) of the false positive handling process (Figure 16) described above.

[0208] Next, in step 2104, the integrated management server 103 updates the cluster ID 1004 in the normal file information table 703 (Figure 10). The cluster ID 1004 is determined by the cluster classification process in step 2103.

[0209] Next, in steps 2104 to 2106, the integrated management server 103 iteratively performs cluster parameter calculation (step 2105) and cluster parameter correction (step 2106) for all clusters.

[0210] In step 2105, the cluster parameter calculation process can be performed in the same way as the cluster parameter calculation process (step 1506) in the false detection handling process (Figure 16) described above.

[0211] For the cluster parameter correction process, the same process as described above (Figure 18) should be used.

[0212] Next, in step 2107, the integrated management server 103 stores the cluster information from the whitelist information table 702. The cluster ID 1004 is determined by the cluster classification process in step 2103.

[0213] The cluster representative point 902 and the cluster threshold 903 are determined by the cluster parameter calculation process in step 2105 and the cluster parameter correction process in step 2106.

[0214] This normal file collection process makes it possible to perform whitelisting even when sufficient whitelisting information has not yet been acquired, such as immediately after the start of security operations. For example, by setting a period for observing normal files before security operations begin, whitelisting can be performed appropriately from the start of security operations.

[0215] It should be noted that the present invention is not limited to the embodiments described above, and can be implemented with appropriate modifications without departing from the spirit of the invention. For example, the embodiments described above are described in detail for the purpose of clearly explaining the present invention, and are not necessarily limited to those having all the configurations described.

[0216] Furthermore, each of the above configurations, functions, processing units, and processing means may be implemented in hardware, either partially or entirely, by designing them as integrated circuits, for example. Alternatively, each of the above configurations and functions may be implemented in software by having the processor interpret and execute programs that implement each function. Information such as programs, tables, and files that implement each function can be stored in memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD. Furthermore, the control lines and information lines shown are those deemed necessary for explanatory purposes, and not all control lines and information lines are necessarily shown in the actual product. In reality, it is safe to assume that almost all components are interconnected.

[0217] ==Summary== As described above, the false detection response system 101 of the embodiment has an information processing unit and a storage device. The system is configured using a processing device and stores a whitelist containing representative points in the feature space of multiple clusters, each of which multiple normal files have been classified based on predetermined features, and thresholds indicating the distance from the representative points to define the range of each of the multiple clusters. The system extracts the features of detected files that have been detected as abnormal by a heuristic detection method, and then performs a process to determine whether the detected files that were detected as abnormal by the heuristic detection method are normal or not, based on the distance from the point representing the features of the detected file to the representative point of each of the multiple clusters and the thresholds for each of the multiple clusters.

[0218] With this configuration, since information from each of multiple clusters is used for the determination, the amount of information required is less than when information from each of multiple normal files is used. Therefore, it becomes easy to determine whether the detection result by the heuristic detection method is a false positive or not.

[0219] In the false positive detection system 101 of this embodiment, if the distance in the feature space between a representative point of any one of the multiple clusters and a point indicating the feature quantity of the detected file is smaller than the threshold of any one of the clusters, the detected file is determined to be normal. With this configuration, the accuracy of determining whether or not a detection is false is improved.

[0220] In the false positive detection response system 101 of this embodiment, a normal file is a file that has been detected as abnormal by a heuristic detection method and then determined to be normal. Among multiple normal files belonging to a cluster, a representative point is determined based on the feature quantities of the file that was most recently detected as abnormal. With this configuration, the optimal representative point can be calculated in accordance with the evolution of malware.

[0221] In the false positive detection response system 101 of this embodiment, a threshold is determined based on the distance in the feature space between a first point representing the feature quantity of a first file and a second point representing the feature quantity of a second file that was detected as abnormal following the first file, among a group of normal files belonging to a cluster. With this configuration, the optimal threshold can be calculated in accordance with the evolution of malware.

[0222] In the false positive detection response system 101 of this embodiment, the system extracts the features of abnormal files and corrects the threshold based on the distance between the points representing the features of abnormal files in the feature space and the representative points of the cluster. With this configuration, if there are many points representing malware features in the vicinity of a cluster in the feature space, the threshold for the cluster can be reduced. In other words, in whitelisting, it becomes possible to reduce the risk of mistakenly identifying malware variants located near clusters as normal.

[0223] In the false positive detection response system 101 of this embodiment, the longer the processing time when registering a file determined to be normal to the whitelist, the higher the threshold for the cluster to which the file determined to be normal belongs. With this configuration, when the workload for the operator dealing with malware is high, it becomes possible to increase the reliability of the whitelist and reduce the cost of dealing with malware for the operator.

[0224] In the false positive response system 101 of this embodiment, the cluster threshold is corrected based on the frequency with which files are classified as abnormal by a heuristic detection method over a predetermined period. With this configuration, when the frequency of false positives is high, it becomes possible to increase the reliability of the whitelist and reduce the cost to operators in dealing with malware.

[0225] The false detection response method of the embodiment involves an information processing device having a computing device and a storage device, which The process involves: storing a whitelist containing representative points in the feature space of multiple clusters, each of which normal files are classified based on predetermined features, and thresholds indicating the distance from the representative points to define the range of each of the multiple clusters; extracting the features of detected files that have been detected as abnormal by a heuristic detection method; and determining whether the detected files that have been detected as abnormal by a heuristic detection method are normal or not, based on the distance from the points representing the features of the detected files to the representative points of each of the multiple clusters and the thresholds for each of the multiple clusters in the feature space.

[0226] This method uses information from each of multiple clusters for the determination, thus requiring less information than when using information from each of multiple normal files. Therefore, it becomes easy to determine whether the detection result by the heuristic detection method is a false positive or not.

[0227] The program of the embodiment implements the following functions in an information processing device having a computing device and a memory device: a function to store a whitelist including representative points in the feature space of multiple clusters into which multiple normal files are classified based on predetermined features, and thresholds indicating the distance from the representative points to define the range of each of the multiple clusters; a function to extract the features of detected files that have been detected as abnormal by a heuristic detection method; and a function to determine whether a detected file that has been detected as abnormal by a heuristic detection method is normal or not, based on the distance from a point indicating the features of the detected file to the representative point of each of the multiple clusters in the feature space, and the threshold for each of the multiple clusters.

[0228] This type of program uses information from each of multiple clusters for its determination, requiring less information than when using information from each of multiple normal files. Therefore, it becomes easy to determine whether the detection result from the heuristic detection method is a false positive or not. [Explanation of Symbols]

[0229] 101: False positive detection response system 102: Monitored terminals 103: Integrated Management Server 104: Malware information distribution server 105: Client terminal 106: Database 107a: Network 107b: Network 201: Transceiver Unit 202: Arithmetic device 203: Malware Detection Unit 204: Feature Extraction Unit 205: Whitelist Judgment Unit 206: False Detection Handling Request Department 207: Malware Response Request Department 208: Normal file output section 301: Transceiver Unit 302: Arithmetic device 303: False detection handling request receiving unit 304: Malware Response Request Receiving Unit 305: Whitelist Cluster Identification Unit 306: Cluster parameter calculation unit 307: Cluster parameter correction unit 308: Malware Response Screen Generation Unit 309: Malware Information Gathering Department 310: Normal File Information Receiving Unit 401: Transmitter / Receiver 402: Arithmetic device 403: Malware Information Distribution Department 501: Transceiver Unit 502: Input / output section 503: Arithmetic device 601: Computer equipment 602: Processor 603: Main memory 604: Auxiliary storage device 605: Transceiver 606: Output device 607: Input device 701: Detected File Information Table 702: Whitelist Information Table 703: Normal File Information Table 704: Malware Information Table 705: Table of Costs to Address 801: Detection File ID 802: File attribute information 803: Features 804: Cluster ID 805: Detection date and time 806: Status 807: Other Information 901: Cluster ID 902: Representative point of the cluster 903: Cluster threshold 1001: Normal file ID 1002: File attribute information 1003: Features 1004: Cluster ID 1005: Update date and time 1101: Malware ID 1102: Features 1201: Detection File ID 1202: Response time 1901: Malware Response Screen 1902: List of detected files 1903: Detected file details link 1904: Detection File Details 1905: Whitelisting result 1906: Report Action Results Button

Claims

1. It is configured using an information processing device having a computing device and a memory device, A whitelist is stored which includes a representative point in the feature space of each of the multiple clusters, each of which multiple normal files have been classified based on predetermined features, and a threshold value indicating the distance from the representative point to define the range of each of the multiple clusters. The aforementioned feature quantities are extracted from the detection file that has been detected as abnormal by the heuristic detection method. In the feature space, a process to determine whether the detected file, which was detected as abnormal by the heuristic detection method, is normal or not, based on the distance from the point representing the features of the detected file to the representative point of each of the multiple clusters, and the threshold of each of the multiple clusters. A false positive detection response system that performs this task.

2. A false detection response system according to claim 1, The detection file is determined to be normal if the distance in the feature space between a representative point of any one of the aforementioned clusters and a point representing the features of the detection file is smaller than the threshold of any one of the aforementioned clusters. False positive detection response system.

3. A false detection response system according to claim 2, The aforementioned normal file is a file that was initially detected as abnormal by a heuristic detection method and then determined to be normal. The representative point is determined based on the point that represents the feature quantity of the file whose date and time of detection as abnormal is the most recent among the multiple normal files belonging to the cluster. False positive detection response system.

4. A false detection response system according to claim 3, The threshold is determined based on the distance in the feature space between a first point representing the feature quantity of a first file and a second point representing the feature quantity of a second file detected as abnormal following the first file, among the multiple normal files belonging to the cluster. False positive detection response system.

5. A false detection response system according to any one of claims 1 to 4, The process of extracting the aforementioned features from the abnormal file is executed. The threshold is corrected based on the distance between a point representing the feature of the abnormal file in the feature space and the representative point of the cluster. False positive detection response system.

6. A false detection response system according to any one of claims 1 to 4, The longer the processing time when registering a file determined to be normal to the whitelist, the higher the threshold for the cluster to which the file determined to be normal belongs. False positive detection response system.

7. A false detection response system according to any one of claims 1 to 4, The threshold of the cluster is corrected based on the frequency with which files are classified as abnormal by a heuristic detection method during a predetermined period. False positive detection response system.

8. An information processing device having a computing device and a memory device, A step of storing a whitelist that includes a representative point in the feature space of each of several clusters, each of which multiple normal files have been classified based on predetermined features, and a threshold indicating the distance from the representative point to define the range of each of the several clusters. The steps include: extracting the feature quantities of the detection file that has been detected as abnormal by a heuristic detection method; In the feature space, the steps include determining whether the detection file detected as abnormal by the heuristic detection method is normal or not, based on the distance from the point representing the feature of the detection file to the representative point of each of the multiple clusters and the threshold of each of the multiple clusters, A method for handling false positives.

9. An information processing device having a computing unit and a memory device, A function to store a whitelist that includes a representative point in the feature space of each of several clusters, each of which multiple normal files have been classified based on predetermined features, and a threshold indicating the distance from the representative point to define the range of each of the several clusters. A function to extract the aforementioned feature quantities from detection files that have been detected as abnormal by a heuristic detection method, In the feature space, a function to determine whether a detected file detected as abnormal by a heuristic detection method is normal or not, based on the distance from a point representing the features of the detected file to the representative point of each of the multiple clusters, and the threshold of each of the multiple clusters. A program to achieve this.

Images