Malware analysis support system, malware analysis support method

Abstract

To provide a malware analysis support system and a malware analysis support method enabling a malware analysis to be efficiently performed while reflecting the conditions of the malware analysis.SOLUTION: In a malware analysis support system and a malware analysis support method of supporting a malware analysis, an analyst computer includes: an analysis input unit configured to input analysis conditions of the malware analysis; an analysis purpose input unit configured to input analysis purpose information that is information corresponding to a malware analysis purpose included in the analysis conditions and collected through the malware analysis; and an analysis procedure suggestion unit configured to display an analysis procedure of the malware analysis. The analysis computer includes a recommended analysis procedure creation unit configured to execute a process for calculating the analysis procedure to be recommended to the user on a basis of the analysis conditions, the analysis purpose information, a past analysis procedure, and a current analysis procedure. The analysis procedure suggestion unit recommends, to the user, the analysis procedure calculated by the recommended analysis procedure creation unit.SELECTED DRAWING: Figure 8

Description

Technical Field

[0001] The present invention relates to a malware analysis support system and a malware analysis support method. Background Art

[0002] In order to prevent cyber-attacks using malicious software (malware), cyber countermeasures are generally implemented by grasping the functions and behavior of malware. Such malware analysis is performed as part of information security. As an example of information security inspection, Patent Document 1 discloses a technology that enables efficient security inspection by allowing an inspection support apparatus to receive activity history information related to security inspections performed by a plurality of inspection apparatuses, identify matching conditions from the received activity history, and generate related activity histories. Prior Art Literature Patent Literature

[0003] Patent Document 1 International Publication No. 2021 / 124538 Summary of the Invention Problems to be Solved by the Invention

[0004] In malware analysis, analysis procedures vary intricately depending on analysis conditions such as the purpose of analysis, information to be obtained, malware family of the analysis target, version, and analysis environment. Even when analyzing the same malware, different analysis procedures may occur. For example, malware analysis for the purpose of updating a blacklist follows an analysis procedure for obtaining file hashes, and domains or IP addresses of attacker servers that the malware connects to, whereas malware analysis for the purpose of recovery after malware infection follows an analysis procedure for obtaining information related to malware removal.

[0005] Thus, considering that the analysis procedure differs depending on the analysis conditions in malware analysis, the technology described in Patent Document 1 generates activity based solely on the activity history, which presents a problem in that it cannot perform malware analysis efficiently. [Means for solving the problem]

[0006] A malware analysis support system that assists a user in malware analysis using an analysis computer and an analysis computer, wherein the analysis computer includes an analysis input unit for inputting analysis conditions for the malware analysis, an analysis purpose input unit for inputting analysis purpose information which corresponds to the malware analysis purpose included in the analysis conditions and is information collected through the malware analysis, and an analysis procedure proposal unit for displaying the analysis procedure for the malware analysis, the analysis computer includes a recommended analysis procedure creation unit that performs processing to calculate the analysis procedure to recommend to the user based on the analysis conditions, the analysis purpose information, past analysis procedures, and the current analysis procedure, and the analysis procedure proposal unit recommends the analysis procedure calculated by the recommended analysis procedure creation unit to the user. [Effects of the Invention]

[0007] According to the present invention, a malware analysis support system and a malware analysis support method can be provided that enable efficient malware analysis by taking into account the conditions for malware analysis. [Brief explanation of the drawing]

[0008] [Figure 1] This figure shows an example of the hardware and software configuration of a malware analysis support system according to the first embodiment of the present invention. [Figure 2] Figure 1 shows an example of a functional configuration diagram of an analytical computer. [Figure 3] Figure 1 shows an example of a functional configuration diagram of the analyst computer. [Figure 4] Figure 1 shows an example of the analysis screen displayed on the analyst's computer. [Figure 5] Figure 2 shows an example of the data structure of the analysis history table. [Figure 6] Figure 2 shows an example of the data structure of the analysis objective table. [Figure 7] Figure 2 shows an example of the data structure of the analysis procedure table. [Figure 8] This figure shows an example of a sequence diagram illustrating the overall process according to the first embodiment of the present invention. [Figure 9] Figure 8 shows an example of a flowchart illustrating the analysis input process. [Figure 10] Figure 8 shows an example of a flowchart illustrating the input process for analysis objective information. [Figure 11] Figure 8 shows an example of a flowchart illustrating the malware analysis procedure support process. [Figure 12] Figure 11 shows an example of a flowchart illustrating the process for creating a recommendation analysis procedure. [Figure 13] Figure 8 shows an example of a flowchart illustrating the proposed analysis procedure. [Figure 14] This figure shows an example of a sequence diagram illustrating the overall process according to a second embodiment of the present invention. [Figure 15] Figure 14 shows an example of a flowchart illustrating the analysis objective information recommendation process. [Figure 16] Figure 14 shows an example of a flowchart illustrating the input process for recommendation analysis objective information.

[0009] Embodiments of the present invention will be described below with reference to the drawings. The following description and drawings are illustrative for illustrating the present invention, and have been omitted and simplified as appropriate for clarity of explanation. The present invention can also be carried out in various other forms. Unless otherwise specified, each component may be singular or plural.

[0010] The positions, sizes, shapes, and ranges of the components shown in the drawings may not represent their actual positions, sizes, shapes, and ranges in order to facilitate understanding of the invention. Therefore, the present invention is not necessarily limited to the positions, sizes, shapes, and ranges disclosed in the drawings.

[0011] Furthermore, although various types of information are described using expressions such as "table" as an example, various types of information may be represented by data structures other than these.

[0012] (First Embodiment of the Present Invention and Overall Configuration) (Fig. 1) The malware analysis support system 100 is configured to include an analyst computer 110 and an analysis computer 120, but may also include a malware analysis environment 130 for a malware analyst (user) to analyze malware.

[0013] The analyst computer 110 is a terminal operated by a user, and has functions of inputting analysis conditions, analysis procedures and the like for malware analysis, and presenting recommended analysis procedures to the user. As a hardware configuration, the analyst computer 110 includes a processor 111, a main storage device 112, a secondary storage device 113, an input / output device 114, a NWIF 115, a bus bar 116 connecting these components, and the like. Note that the analyst computer 110 can be implemented by a general server device, a personal computer, a mobile terminal, or other information processing devices.

[0014] The processor 111 controls each functional unit of the analyst computer 110, reads data and programs stored in the secondary storage device 113 into the main storage device 112, and executes processing defined by the programs.

[0015] The main storage device 112 is, for example, a Random Access Memory (RAM), includes a volatile storage element, and stores programs to be executed by the processor 111 and data. The secondary storage device 113 is a Hard Disk Drive (HDD), a Solid State Drive (SSD), or the like, and includes a non-volatile storage element.

[0016] The input / output device 114 includes input devices that accept user operations such as a keyboard and mouse, and output devices that display information such as a touch panel, display, and speaker. The analyst computer 110 can acquire information entered by user operations using such input devices. Furthermore, it can present the entered information to the user, for example, by displaying it on a screen, using such output devices. An example of information presented to the user is the analysis screen 400 shown in Figure 4, which will be described later.

[0017] NWIF115 is connected to a network. The network connects the analyst computer 110, the analysis computer 120, and the malware analysis environment 130, and the analyst computer 110 can send and receive data via the network.

[0018] The analysis computer 120 is a user-operated terminal that has the function of inputting conditions and procedures for malware analysis and presenting recommended procedures to the user. The analysis computer 120 has a hardware configuration that includes a processor 121, main memory 122, secondary memory 123, input / output device 124, NWIF 125, and a busbar 126 connecting these. The analysis computer 120 can be implemented using general server equipment, personal computers, or information processing devices such as mobile terminals.

[0019] The processor 121 controls each functional unit of the analytical computer 120, reads data and programs stored in the sub-memory 123 into the main memory 122, and executes the processing defined by the program.

[0020] The main memory 122 is a RAM or similar device, containing volatile memory elements, and stores programs executed by the processor 121 and data. The secondary memory 123 is a hard disk drive (HDD) or solid state drive (SSD), containing non-volatile memory elements.

[0021] The input / output device 124 includes input devices that accept user input, such as a keyboard or mouse, and output devices that display information, such as a touch panel, display, or speaker. The analysis computer 120 can acquire information input by user input using the input devices, and can also present information to the user, for example, by displaying it on a screen, using the output devices. An example of information presented to the user is the analysis screen 400 shown in Figure 4, which will be described later.

[0022] NWIF125 is connected to a network. The network connects the analyst computer 110, the analysis computer 120, and the malware analysis environment 130, and the analysis computer 120 can send and receive data via the network NW.

[0023] The malware analysis environment 130 is an environment in which the user performs malware analysis according to the analysis procedure recommended by the analyst computer 110, and is, for example, a sandbox. The malware analysis environment 130 may consist of a physical computer or a virtual environment, and may reside, for example, within the analyst computer 110.

[0024] (Figure 2) The analysis computer 120 has the following functional units: a malware analysis procedure support unit 201, a recommended analysis procedure creation unit 202, an analysis objective information recommendation unit 203, an analysis procedure execution unit 204, an analysis report creation unit 205, and an external device linkage unit 206. The secondary memory device 123 of the analysis computer 120 stores the analysis history table 123a, the analysis objective table 123b, and the analysis procedure table 123c. The analysis computer 120 uses the aforementioned processor 121 to read the programs stored in the secondary memory device 123 into the main memory device 122 and execute each process.

[0025] The malware analysis procedure support unit 201 executes malware analysis procedure support processing to recommend malware analysis procedures to the user. The malware analysis procedure support processing will be described later in Figure 11.

[0026] The recommended analysis procedure creation unit 202 executes a recommended analysis procedure creation process to calculate a malware analysis procedure to recommend to the user. The recommended analysis procedure creation process will be described later in Figure 12.

[0027] The analysis objective information recommendation unit 203 executes the analysis objective information recommendation process. The analysis objective information recommendation process will be described later in the second embodiment (Figure 15).

[0028] The analysis procedure execution unit 204 pre-defines the execution method for a portion of the malware analysis procedure, with the aim of reducing the burden on the user, and automatically executes the malware analysis procedure according to the defined execution method. The analysis procedure execution process of the analysis procedure execution unit 204 will be described later in the third embodiment.

[0029] The analysis report creation unit 205 creates an analysis report based on predefined analysis report templates for each malware analysis purpose and information from the analysis procedure table 123c. The analysis report creation process used by the analysis report creation unit 205 will be described later in the fourth embodiment.

[0030] The external device linkage unit 206 links with external security devices. The external device linkage processing of the external device linkage unit 206 will be described later in the fourth embodiment.

[0031] The analysis history table 123a of the secondary memory device 123 of the analysis computer 120 will be described in detail later in Figure 5. The analysis objective table 123b will be described in detail later in Figure 6. The analysis procedure table 123c will be described in detail later in Figure 7.

[0032] (Figure 3) The analyst computer 110 includes an analysis input unit 301, an analysis objective input unit 302, an analysis procedure proposal unit 303, a recommended analysis objective information input unit 304, a procedure input assistance function unit 305, and a post-processing proposal unit 306. The analyst computer 110's processor 111 reads the program stored in the sub-memory 113 into the main memory 112 and executes each process.

[0033] The analysis input unit 301 executes analysis input processing for the user to input analysis conditions related to malware analysis. The analysis input processing will be explained in Figure 9 below.

[0034] The analysis purpose input unit 302 executes an analysis purpose information input process to input analysis purpose information that the user sets as the analysis purpose for malware analysis. The analysis purpose information input process will be explained in Figure 10 below.

[0035] The analysis procedure proposal unit 303 executes an analysis procedure proposal process that outputs a malware analysis procedure recommended to the user. The analysis procedure proposal process will be explained in Figure 13 below.

[0036] The recommendation analysis purpose information input unit 304 executes the recommendation analysis purpose information input process. The recommendation analysis purpose information input process will be described later in Figure 16 (Second Embodiment).

[0037] The procedure input assistance function unit 305 tracks the work performed on the analyst computer 110 and executes procedure input assistance processing to automatically create the current analysis procedure, with the aim of reducing the burden on the user. The procedure input assistance processing will be described later in the third embodiment.

[0038] The Post-Event Response Proposal Unit 306 presents the analysis report created by the Analysis Report Creation Unit 205 (Figure 2) and asks the user whether or not to execute it on the External Device Linkage Unit 206. The processing of the Post-Event Response Proposal Unit 306 will be described later in the fourth embodiment.

[0039] (Figure 4) The analysis screen 400 displayed on the analyst computer 110 includes an analysis condition input section 401, an analysis objective information input section 402, and an analysis procedure input / proposal section 403, and is displayed to the user. The analysis screen 400 can be implemented, for example, as an executable application, a web page, or a browser extension.

[0040] The analysis condition input section 401 of the analysis screen 400 is a screen for receiving input for each analysis condition necessary for the analysis input processing of the analysis input section 301 (see Figure 9). The analysis conditions referred to here include, for example, the purpose of analysis, sample hash, analysis environment, sample family, analyst ID, and analyst skill level.

[0041] The analysis purpose information input section 402 of the analysis screen 400 is a screen for receiving input of analysis purpose information necessary for the analysis purpose information input processing of the analysis purpose information input section 302 (see Figure 10).

[0042] The analysis procedure input / proposal section 403 of the analysis screen 400 is related to the analysis procedure proposal processing of the analysis procedure proposal section 303 (see Figure 13) and is a screen for outputting the recommended procedure.

[0043] (Figure 5) Analysis history table 123a is created for each analysis unit performed with a single malware analysis objective and stores information related to the malware analysis. Analysis history table 123a stores records with the following fields: analysis history ID 501, analysis objective 502, sample hash 503, sample family 504, analysis environment 505, analyst ID 506, analyst proficiency level 507, analysis objective ID 508, and analysis procedure ID 509.

[0044] Analysis History ID 501 is a field that stores an identifier assigned to uniquely identify a single malware analysis. For example, Analysis History ID 501 is assigned a number.

[0045] Analysis Objective 502 stores information about the purpose for which the user is performing the malware analysis. Examples of Analysis Objective 502 include incident response and blacklist updates.

[0046] The sample hash 503 stores information for identifying and storing the malware being analyzed, as a hash value. The stored hash value may be, for example, SHA256 or MD5. Since the purpose of the sample hash 503 is to identify and store the malware being analyzed, the actual sample may be stored in a separate secondary storage device, and the path to that storage location may be recorded.

[0047] Sample family 504 stores information about the malware family and version being analyzed. Examples of malware included in sample family 504 include FormBook and AgentTesla. If the malware family is unknown, an instruction such as "Unknown" or "NONE" may be stored.

[0048] The analysis environment 505 is a field that stores information about the malware analysis environment 130. For example, the analysis environment 505 stores the sandbox name, the analysis environment name, and an identifier assigned to identify the environment.

[0049] The Analyst ID 506 is a field that stores an identifier assigned to uniquely identify the user who performed the malware analysis. For example, Analyst ID 506 is assigned a number.

[0050] The Analyst Proficiency 507 field is used to store information about the user's proficiency in malware analysis, with the aim of determining the effectiveness of the malware analysis procedure. For example, Analyst Proficiency 507 may store words such as "High" or "Low" to represent proficiency, or a numerical value representing proficiency.

[0051] The analysis objective ID 508 is a field that stores an identifier assigned to uniquely identify the field in the analysis objective table 123b related to the malware analysis being performed. A column stored in the analysis objective ID 508 field of the analysis objective table 123b that has the same value as the analysis objective ID 508 value in the analysis history table 123a is considered to be the relevant analysis objective. For example, the analysis objective ID 508 is assigned a number.

[0052] The analysis procedure ID 509 is a field that stores an identifier assigned to uniquely identify the field in the analysis procedure table 123c related to the malware analysis being performed. The value of analysis procedure ID 509 in the analysis history table 123a and the column stored in analysis procedure ID 509 in analysis procedure table 123c that has the same value are considered to be related analysis procedures. For example, analysis procedure ID 509 is assigned a number.

[0053] (Figure 6) The analysis objective table 123b is created for each configured analysis objective unit and stores the analysis objective and the analysis objective information to be collected during malware analysis according to that objective. The analysis objective table 123b stores records with the fields Analysis Objective ID 508, Analysis Objective 602, Recommended Analysis Objective Information 603, and Analysis Objective Information 604.

[0054] The analysis objective ID 508 is a field that stores an identifier assigned to uniquely identify a single analysis objective. For example, the analysis objective ID 508 is assigned a number.

[0055] Analysis objective 602 stores information about the purpose for which the user is performing the malware analysis. Examples of analysis objective 602 include incident response and blacklist updates.

[0056] The recommended analysis purpose information 603 is a field that stores the recommended analysis purpose information recommended by the analysis purpose information recommendation unit 203 (Figure 2). Note that the recommended analysis purpose information 603 is used in the second embodiment, so in the first embodiment, the field for recommended analysis purpose information 603 may be left blank. The analysis purpose information referred to here is the type of information collected through malware analysis that corresponds to and achieves the set analysis purpose. For example, the recommended analysis purpose information 603 stores the domain name of the attacker server and the malware persistence method.

[0057] Analysis purpose information 604 is a field that stores the analysis purpose information actually set by the user. For example, analysis purpose information 604 stores the domain name of the attacker server and the malware persistence method (the malware's function to run again after being stopped).

[0058] (Figure 7) Analysis procedure table 123c is created for each malware analysis procedure and stores information related to the malware analysis procedure. Analysis procedure table 123c stores records with the following fields: analysis procedure ID 509, analysis purpose information 702, analysis environment 703, family name 704, recommended analysis procedure 705, analysis procedure 706, tool 707, and result 708.

[0059] Analysis Procedure ID 509 is a field that stores an identifier assigned to uniquely identify a series of malware analysis procedures. For example, Analysis Procedure ID 509 is assigned a number.

[0060] Analysis purpose information 702 is a field that stores the analysis purpose information actually set by the user. For example, analysis purpose information 702 stores the domain name of the attacker server and the malware persistence method.

[0061] The analysis environment 703 is a field that stores information about the malware analysis environment 130. For example, the analysis environment 703 stores the sandbox name, the analysis environment name, or an identifier assigned to identify the environment.

[0062] Family name 704 stores information about the family and version of the malware being analyzed. For example, family name 704 might include FormBook or AgentTesla. If the family being analyzed is unknown, it may store result information such as "Unknown" or "NONE."

[0063] The recommended analysis procedure 705 is a field that stores malware analysis procedures to be recommended to the user by the recommended analysis procedure creation unit 202. The recommended analysis procedure 705 stores tasks related to malware analysis, such as domain searches on reputation sites and analysis of communication logs.

[0064] Analysis procedure 706 is a field that stores malware analysis procedures. Analysis procedure 706 stores tasks related to malware analysis, such as domain searches on reputation sites and analysis of communication logs.

[0065] Tool 707 is a field that corresponds to each step of analysis procedure 706 and stores the tools used in each step and the names of the web pages viewed. Tool 707 stores the name of the reputation site, the name of the tool used for communication logging, and the name of the tool used for analysis.

[0066] Result 708 is a field that stores the value obtained as a result of performing each step in the analysis procedure 706. For example, Result 708 stores example[.]com (the result of performing the step "research potential attacker server domain names on reputation sites in advance").

[0067] (Figure 8) Figure 8 shows a sequence diagram of the malware analysis support system 100 of the present invention, which includes the processes performed by the analyst computer 110 and the analysis computer 120, as well as the information transmitted and received. In the first embodiment of the present invention, the analyst computer 110 uses an analysis input unit 301, an analysis objective input unit 302, and an analysis procedure proposal unit 303, while the analysis computer 120 uses a malware analysis procedure support unit 201 and a recommended analysis procedure creation unit 202.

[0068] The user enters analysis conditions related to malware analysis into the analysis condition input unit 401 displayed on the analysis screen 400 (Figure 4). Based on the various information regarding the analysis conditions entered by the user, the analyst computer 110 executes the analysis input process (see Figure 9) in the analysis input unit 301 (Figure 3) (step S801).

[0069] Furthermore, the user inputs analysis objective information to be set as the purpose of malware analysis into the analysis objective information input unit 402, and the analyst computer 110 executes analysis objective information input processing (see Figure 10) in the analysis objective input unit 302 based on the analysis objective information input from the user (step S802).

[0070] From step S802 onward, a loop process is initiated, and the process is executed at any given time. The conditions for looping include, for example, when new information is entered or when the user clicks a button to select an update.

[0071] As the first loop processing step from step S802 onward, the analyst computer 110 transmits the analysis objective, sample hash, analysis environment, sample family, analyst ID, analyst proficiency level, analysis objective information, and current analysis procedure information, which are entered into the analysis condition input unit 401 and analysis objective information input unit 402 displayed on the analysis screen 400, to the analysis computer 120. The malware analysis procedure support unit 201 of the analysis computer 120 executes malware analysis procedure support processing (see Figure 11) based on the various information received (step S803).

[0072] The malware analysis procedure recommended to the user, output by the malware analysis procedure support processing, is sent from the analysis computer 120 to the analyst computer 110. Based on the received malware analysis procedure, the analyst computer 110 executes the analysis procedure proposal processing (see Figure 13) in the analysis procedure proposal unit 303 (step S804).

[0073] (Figure 9) The analysis input process (Figure 8: step S801) executed on the analyst computer 110 based on various malware analysis information entered by the user into the analysis condition input unit 401 (Figure 4) will be described below. The analyst computer 110 presents the analysis condition input unit 401 to the user for input of analysis conditions, such as analysis purpose, sample hash, analysis environment, sample family, analyst ID, and analyst proficiency level (step S901).

[0074] The analyst computer 110 determines whether the user has entered any data into the analysis condition input unit 401 (step S902). If it is determined that data has been entered (step S902: YES), the process proceeds to step S903. On the other hand, if it is determined that no data has been entered (step S902: NO), the process proceeds to step S901 and enters a loop.

[0075] The analyst computer 110 transmits the analysis purpose, sample hash, analysis environment, sample family, analyst ID, and analyst proficiency level entered by the user to the analysis computer 120 (step S903).

[0076] (Figure 10) The analysis purpose information input process (Figure 8: step S802) executed on the analyst computer 110 based on the analysis purpose information set as the analysis purpose of malware analysis entered by the user into the analysis purpose information input unit 402 (Figure 4) will be described. The analyst computer 110 presents the analysis purpose information input unit 402 to the user for input of the analysis purpose information (step S1001). This analysis purpose information corresponds to the malware analysis conditions entered by the user and is information collected through malware analysis.

[0077] The analyst computer 110 determines whether user input has been received in the analysis purpose information input unit 402 (step S1002). If it is determined that input has been received (step S902: YES), the process proceeds to step S1003. On the other hand, if it is determined that no input has been received (step S902: NO), the process proceeds to step S1001 and enters a loop.

[0078] The analyst computer 110 transmits the analysis purpose information entered by the user to the analysis computer 120 (step S1003).

[0079] (Figure 11) In the analysis computer 120, the malware analysis procedure support processing of the malware analysis procedure support unit 201 and the recommended analysis procedure creation unit 202 (Figure 2) (Figure 8: Steps S803 and S804) will be described.

[0080] After the processing of steps S903 (Figure 9) and S1003 (Figure 10) performed on the analyst computer 110, the malware analysis procedure support unit 201 obtains analysis conditions and analysis objective information (analysis objective, sample hash, analysis environment, sample family, analyst ID, analyst proficiency level, and list of analysis objective information) from the analyst computer 110 (step S1101).

[0081] The malware analysis procedure support unit 201 updates the analysis objective 602 and analysis objective information 604 in the analysis objective table 123b (Figure 6), and further updates the analysis objective 502, sample hash 503, sample family 504, analysis environment 505, analyst ID 506, and analyst proficiency 507 in the analysis history table 123a (Figure 5) (step S1102).

[0082] If no information regarding the purpose of malware analysis has been registered in the past, the analysis computer 120 will create a new column and obtain the current analysis procedure entered into the analysis procedure input / proposal unit 403 on the analyst computer 110 (step S1103).

[0083] The recommended analysis procedure creation unit 202 refers to the analysis procedure table 123c (Figure 7) and obtains past analysis procedures (step S1104). Based on the past analysis procedures obtained from the analysis procedure table 123c, the analysis conditions and analysis objective information entered by the user, and the current analysis procedure, the recommended analysis procedure creation unit 202 calculates and creates an analysis procedure to recommend to the user and executes the recommended analysis procedure creation process (step S1105).

[0084] The analysis computer 120 sends the analysis procedure to be recommended to the user, which was created in the recommended analysis procedure creation process, to the analyst computer 110 (step S1106).

[0085] (Figure 12) The recommended analysis procedure creation unit 202 of the analysis computer 120 will now be described. When the analysis procedure proposal unit 303 of the analyst computer 110 is executed (described later in Figure 13), the recommended analysis procedure creation unit 202 of the analysis computer 120 performs an analysis procedure proposal process (step S1201) in which it extracts analysis procedures similar to past analysis procedures for each piece of information in the list of analysis objectives input by the user and recommends them to the user.

[0086] Furthermore, to determine whether a procedure is similar to a past analysis procedure, the analysis purpose information, analysis environment, family name, and current malware analysis procedure are utilized. In addition, while methods such as graph neural networks are used to recommend malware analysis procedures, this invention does not rely on this algorithm.

[0087] (Figure 13) The processing of the analysis procedure proposal unit 303 of the analyst computer 110 will now be described. When the analysis procedure proposal processing (Figure 12: step S1201) by the recommended analysis procedure creation unit 202 of the analysis computer 120 is executed, the analysis procedure proposal unit 303 of the analyst computer 110 receives the malware analysis procedure to be recommended to the user from the analysis computer 120 (step S1301). The analyst computer 110 outputs the malware analysis procedure to be recommended to the user to the analysis procedure input / proposal unit 403 (Figure 4). At the same time, the analyst computer 110 requests the user to input the actual malware analysis procedure, tools, and results (step S1302).

[0088] The analyst computer 110 determines whether user input has been received in the analysis procedure input / proposal unit 403 (step S1303). If it is determined that input has been received (step S1303: YES), the process proceeds to step S1304. On the other hand, if it is determined that no input has been received (step S1303: NO), the process proceeds to step S1305.

[0089] The analyst computer 110 executes the processing of the analysis procedure proposal unit 303 again based on the actual malware analysis procedure, tools, and results entered by the user, and instructs the analysis computer 120 to re-execute the malware analysis procedure support processing (step S1304). At this time, the analysis computer 120 may update the analysis procedure 706, tools 707, and results 708 in the analysis procedure table 123c. Once step S1304 is completed, step S1301 is executed again.

[0090] If the analyst computer 110 has not received any user input in the analysis procedure input / proposal unit 403 (Figure 4), it determines whether all user input has been completed (step S1305). If the input is complete (step S1303: YES), the flow is terminated. On the other hand, if the input is not complete (step S1303: NO), step S1302 is executed.

[0091] As described above, the present invention recommends to the user an analysis procedure similar to a past analysis procedure, based on malware analysis conditions and analysis objective information input by the user, and past and current malware analysis procedures. Furthermore, it processes a process to create a malware analysis procedure to recommend to the user again, taking into account the actual analysis procedure, tools, and results input by the user. In this way, a malware analysis support system 100 can be realized that can perform malware analysis efficiently while taking into account the conditions for malware analysis.

[0092] Furthermore, the analysis computer 120 may compare past malware analysis procedures with the current malware analysis procedures to calculate the progress rate of the malware analysis procedures, and display the malware analysis procedure progress rate calculated by the analyst computer 110 to the user.

[0093] (Second Embodiment) (Figure 14) The malware analysis support system 100 shown in the second embodiment recommends analysis objective information to the user that corresponds to the purpose of malware analysis. In the second embodiment, in addition to the functional units of the analyst computer 110 and the analysis computer 120 used in the first embodiment, the analyst computer 110 uses a recommended analysis objective information input unit 304 (Figure 3), and the analysis computer 120 uses an analysis objective information recommendation unit 203 (Figure 2).

[0094] The analysis objective information recommendation unit 203 of the analysis computer 120 performs an analysis objective information recommendation process, which calculates the analysis objective information to be set based on the analysis objective input by the user and recommends it to the user (details are described later in Figure 15).

[0095] The recommended analysis objective information input unit 304 of the analyst computer 110 performs the recommended analysis objective information input process (details will be described later in Figure 16). In the recommended analysis objective information input process, first, the recommended analysis objective information to be recommended to the user, calculated by the analysis objective information recommendation unit 203, is obtained and output to the analysis objective information input unit 402 (Figure 4). The user then inputs the analysis objective information they have decided on based on the outputted recommended analysis objective information into the analysis objective information input unit 402.

[0096] A sequence diagram of the malware analysis support system 100 according to the second embodiment will be described. The analyst computer 110 transmits the analysis purpose, sample hash, analysis environment, sample family, analyst ID, and analyst proficiency information, which were processed in the analysis input processing (step S1401), to the analysis computer 120. Based on the information received from the analyst computer 110, the analysis computer 120 performs analysis purpose information recommendation processing in the analysis purpose information recommendation unit 203 (Figure 2) (step S1402).

[0097] The analysis computer 120 transmits the recommended analysis objective information to be recommended to the user, calculated by the analysis objective information recommendation process, to the analyst computer 110. The analyst computer 110 executes the recommended analysis objective information input process based on the acquired recommended analysis objective information (step S1403). The subsequent loop processing is the same as the loop processing in Figure 8 of the first embodiment described above.

[0098] (Figure 15) The processing flow of the analytical computer 120 (Figure 14: step S1402) is described below. The analysis purpose information recommendation unit 203 of the analytical computer 120 obtains the analysis purpose, sample hash, analysis environment, sample family, analyst ID, and analyst proficiency level from the analyst computer 110 (step S1501).

[0099] The analysis purpose information recommendation unit 203 updates the analysis purpose, sample hash, analysis environment, sample family, analyst ID, and analyst proficiency level in the analysis history table 123a based on the information obtained from the analyst computer 110 (step S1502).

[0100] The analysis objective information recommendation unit 203 refers to the analysis objective table 123b (Figure 6) and obtains a list of analysis objective information from the analysis objective table 123b for rows that have an analysis objective that matches the analysis objective obtained from the analyst computer 110 (step S1503). Based on the list of analysis objective information obtained from the analysis objective table 123b, the analysis objective information recommendation unit 203 calculates recommended analysis objective information to recommend to the user (step S1504). The analysis objective information recommendation unit 203 utilizes algorithms such as collaborative filtering when calculating the recommended analysis objective information, but the type of algorithm is not limited to the present invention.

[0101] The analysis objective information recommendation unit 203 updates the recommended analysis objective information 603 in the analysis objective table 123b with the recommended analysis objective information calculated in step S1504 (step S1505). The analysis objective information recommendation unit 203 transmits the recommended analysis objective information calculated in step S1504 to the analyst computer 110 (step S1506).

[0102] (Figure 16) The processing flow of the analyst computer 110 (Figure 14: step S1403) will be explained. The recommendation analysis objective information input unit 304 (Figure 3) of the analyst computer 110 executes the recommendation analysis objective information input process. The recommendation analysis objective information input unit 304 outputs the recommendation analysis objective information received from the analysis computer 120 to the analysis objective information input unit 402 (Figure 4) and presents it to the user (step S1601).

[0103] The recommendation analysis purpose information input unit 304 determines whether the user has entered analysis purpose information into the analysis purpose information input unit 402 based on the recommendation analysis purpose information presented to the user (step S1602). If it is determined that input has been received (step S1602: YES), the process proceeds to step S1603. On the other hand, if it is determined that no input has been received (step S1602: NO), the process proceeds to step S1601, and a loop is initiated.

[0104] When the user enters information for the purpose of analysis, the entered information for the purpose of analysis is transmitted to the analysis computer 120 (step S1603). Subsequent processing is the same as in the first embodiment.

[0105] As described above, according to the second embodiment, the malware analysis support system 100 can provide more efficient malware analysis support to users who have a clear malware analysis objective but are not sure what kind of analysis objective information they should collect, by presenting recommended analysis objective information to the user based on the malware analysis objective entered by the user.

[0106] (Third embodiment) In the third embodiment, the analysis procedure execution unit 204 (Figure 2) of the analysis computer 120 pre-defines the execution method for a part of the malware analysis procedure, with the aim of reducing the burden on the user in performing the malware analysis procedure, and automatically executes the analysis procedure according to the defined execution method.

[0107] The analysis procedure execution process of the analysis procedure execution unit 204, for example, pre-programs the API integration of a reputation site and, when executing the procedure to investigate the reputation of the malware to be analyzed, automatically obtains the reputation of the malware to be analyzed and proposes it to the user. The analyst computer 110 may also have a function to determine the truthfulness of the information that is automatically executed and proposed in this way.

[0108] Furthermore, the procedure input assistance function unit 305 (Figure 3) of the analyst computer 110 tracks the work performed on the analyst computer 110 and automatically creates the current analysis procedure, with the aim of reducing the user's burden. The procedure input assistance function processing of the procedure input assistance function unit 305 records (tracks) browser access history, command execution history, and application execution history, and creates the current analysis procedure based on that history.

[0109] In this way, the malware analysis support system 100 can track the analysis procedure, automatically input the current analysis procedure, and automatically execute the analysis procedure according to predefined tasks performed by the user, thereby providing malware analysis support with minimal burden on the user.

[0110] (Fourth Embodiment) In the fourth embodiment, to support the user after malware analysis, an analysis report is created and operations on external security devices are performed. The analysis report creation unit 205 (Figure 2) of the analysis computer 120 creates a report based on predefined analysis report templates for each analysis purpose, and the analysis procedure 706, tools 707, and results 708 of the analysis procedure table 123c. The report template, for example, defines the results corresponding to the analysis procedure using variables, and is implemented by substituting the results 708 of the analysis procedure table 123c.

[0111] Furthermore, the external device linkage unit 206 (Figure 2) of the analysis computer 120 links with external security devices based on the analysis procedure 706, tool 707, and result 708 of the analysis procedure table 123c, for purposes such as updating the blacklist of target malware. The external device linkage process of the external device linkage unit 206, for example, uses the API of an external security device to discover the domain name of an attacker server and adds that domain name to the blacklist.

[0112] The post-analysis response proposal unit 306 (Figure 3) of the analyst computer 110 presents the analysis report created by the analysis report creation unit 205 to the user and asks the user whether or not to execute the external device linkage process in the external device linkage unit 206. In this way, the malware analysis support system 100 can provide malware analysis support with minimal burden on the user.

[0113] According to the embodiments of the present invention described above, the following effects and advantages are achieved.

[0114] (1) A malware analysis support system 100 that assists a user in malware analysis using an analyst computer 110 and an analysis computer 120, wherein the analyst computer 110 includes an analysis input unit 301 for inputting analysis conditions for malware analysis, an analysis purpose input unit 302 for inputting analysis purpose information which corresponds to the malware analysis purpose included in the analysis conditions and is information collected through malware analysis, and an analysis procedure proposal unit 303 for displaying the analysis procedure for malware analysis. The analysis computer 120 includes a recommended analysis procedure creation unit 202 that performs processing to calculate an analysis procedure to recommend to the user based on the analysis conditions, the analysis purpose information, past analysis procedures, and the current analysis procedure. The analysis procedure proposal unit 303 recommends the analysis procedure calculated by the recommended analysis procedure creation unit to the user. In this way, a malware analysis support system can be provided that can efficiently perform malware analysis while taking into account the conditions for malware analysis.

[0115] (2) The analysis computer 120 includes an analysis objective information recommendation unit 203 that calculates recommended analysis objective information to recommend to the user based on the analysis objective information entered in the analyst computer 110. The analyst computer 110 includes a recommended analysis objective information input unit 304 that presents the calculated recommended analysis objective information to the user and accepts the analysis objective information entered by the user based on the recommended analysis objective information. In this way, malware analysis support with less burden on the user can be realized.

[0116] (3) The analyst computer 110 is equipped with a procedure input assistance function unit 305 that tracks the work performed on the analyst computer 110 and automatically creates the current analysis procedure. This reduces the burden on the user.

[0117] (4) The analysis computer 120 includes an analysis procedure execution unit 204 that pre-defines the method for executing a part of the analysis procedure and automatically executes the analysis procedure according to the defined execution method. This reduces the burden on the user.

[0118] (5) The analysis computer 120 includes an analysis report generation unit 205 that creates an analysis report based on the results of the malware analysis and presents the analysis report to the user. This makes it possible to provide malware analysis support with minimal burden on the user.

[0119] (6) The analysis computer 120 is equipped with an external device linkage unit 206 that cooperates with external security devices based on the malware analysis results. This makes it possible to provide malware analysis support with minimal burden on the user.

[0120] (7) The analyst computer 110 calculates the progress rate of the malware analysis procedure based on past malware analysis procedures and the current malware analysis procedure, and presents the calculated progress rate to the user. In this way, malware analysis can be performed efficiently by taking into account the conditions of the malware analysis.

[0121] (8) A malware analysis support method that assists a user in malware analysis using an analyst computer 110 and an analysis computer 120, wherein the analyst computer 110 accepts from the user the analysis conditions for malware analysis and analysis purpose information, which corresponds to the malware analysis purpose included in the analysis conditions and is information collected through malware analysis. The analysis computer 120 calculates an analysis procedure to recommend to the user from the analysis conditions, the analysis purpose information, past analysis procedures and the current analysis procedure, and the analyst computer 110 adopts a method of recommending the calculated analysis procedure to the user. In this way, a malware analysis support method can be provided that allows for efficient malware analysis while taking into account the conditions for malware analysis.

[0122] It should be noted that the present invention is not limited to the embodiments described above, and various modifications and combinations of other configurations can be made without departing from the spirit of the invention. Furthermore, the present invention is not limited to having all the configurations described in the embodiments described above, and may also include configurations in which some of those configurations are omitted. [Explanation of Symbols]

[0123] 100 Malware Analysis Systems 110 Analyst Computer 120 Analytical calculator 130 Malware Analysis Environment

Claims

1. A malware analysis support system that assists users in malware analysis using an analyst computer and an analysis computer, The aforementioned analyst computer comprises an analysis input unit for inputting analysis conditions for the malware analysis, an analysis purpose input unit for inputting analysis purpose information which corresponds to the malware analysis purpose included in the analysis conditions and is information collected through the malware analysis, and an analysis procedure proposal unit for displaying the analysis procedure for the malware analysis. The analysis computer includes a recommended analysis procedure creation unit that performs processing to calculate the analysis procedure to be recommended to the user based on the analysis conditions, the analysis objective information, past analysis procedures, and the current analysis procedure. The aforementioned analysis procedure proposal unit recommends the analysis procedure calculated by the aforementioned recommended analysis procedure creation unit to the user. Malware analysis support system.

2. A malware analysis support system according to claim 1, The analysis computer includes an analysis objective information recommendation unit that calculates recommended analysis objective information to recommend to the user based on the analysis objective information input to the analyst computer. The aforementioned analyst computer includes a recommendation analysis objective information input unit that presents the calculated recommendation analysis objective information to the user and accepts the analysis objective information entered by the user based on the recommendation analysis objective information. Malware analysis support system.

3. A malware analysis support system according to claim 2, The aforementioned analyst computer includes a procedure input assistance function unit that tracks the work performed on the analyst computer and automatically creates the current analysis procedure. Malware analysis support system.

4. A malware analysis support system according to claim 3, The aforementioned analysis computer includes an analysis procedure execution unit that pre-defines a method for executing a part of the analysis procedure and automatically executes the analysis procedure according to the defined execution method. Malware analysis support system.

5. A malware analysis support system according to claim 2, The aforementioned analysis computer includes an analysis report generation unit that generates an analysis report based on the results of the malware analysis and presents the analysis report to the user. Malware analysis support system.

6. A malware analysis support system according to claim 5, The aforementioned analysis computer includes an external device collaboration unit that collaborates with external security devices based on the results of the malware analysis. Malware analysis support system.

7. A malware analysis support system according to claim 1, The aforementioned analyst computer calculates the progress rate of the analysis procedure based on past and current analysis procedures, and presents the calculated progress rate to the user. Malware analysis support system.

8. A malware analysis support method that assists a user in malware analysis using an analyst computer and an analysis computer, The aforementioned analyst computer receives input from the user, which includes the analysis conditions for the malware analysis and analysis purpose information, which corresponds to the malware analysis purpose included in the analysis conditions and is information collected through the malware analysis. The aforementioned analysis computer calculates the analysis procedure to recommend to the user based on the analysis conditions, the analysis objective information, past analysis procedures, and the current analysis procedure. The aforementioned analyst computer recommends the calculated analysis procedure to the user. Malware analysis support methods.

Images