Sample evaluation method, sample evaluation system, and program

Abstract

This invention provides a method and system for efficiently evaluating the analysis priority of specimens. [Solution] The sample evaluation method involves acquiring a sample and unencrypted data, fixing seed information, obtaining first encrypted data obtained by encrypting the unencrypted data using an encryption key generated based on the seed information, comparing the unencrypted data with the first encrypted data, removing at least one longest matching portion from the first encrypted data to generate first LCS (longest matching portion) removed encrypted data, further encrypting the same unencrypted data with the same sample to generate second LCS removed encrypted data by performing the same processing, and determining the analysis priority of the sample based on the similarity between the first LCS removed encrypted data and the second LCS removed encrypted data.

Description

Technical Field

[0001] The present invention relates to a sample evaluation method, a sample evaluation system, and a program.

Background Art

[0002] In recent years, the threat of ransomware has been increasing. The number of ransomware damage cases and the amount of damages remain at a high level. Ransomware refers to malware (malicious software) that infects (intrudes into) a computer, encrypts the files contained in the computer to render the files unusable, and then demands money (ransom) in exchange for restoring (decrypting) the files. Patent Document 1 discloses a method for protecting data from ransomware (malware).

[0003] If files encrypted by ransomware can be restored, the damage can be mitigated by accelerating recovery, and the need to pay ransom is eliminated. At present, work is being carried out to analyze ransomware (also referred to as "sample") to find those for which decryption software (decryption tool) can be created. Non-Patent Document 1 discloses decryption of files encrypted by ransomware.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Non-Patent Documents

[0005]

Non-Patent Document 1

[0006] Whether a decryption tool can be created is determined by analyzing the internal structure of the ransomware (sample) to identify any cryptographic vulnerabilities. If the ransomware (sample) itself has no vulnerabilities, decryption is difficult and impractical. If a decryption tool can be created quickly, the damage can be reduced, but malware analysis requires highly advanced skills and is highly dependent on individual expertise. Furthermore, it is unavoidable that a certain amount of time resources will be spent regardless of the analyst's skill level. In addition, if time is spent analyzing files without vulnerabilities, the analysis of ransomware (samples) from which a decryption tool can be created will be postponed, potentially resulting in increased damage. However, currently, there is a technical challenge in that it is unavoidable to allocate analysis resources to samples that are difficult to decrypt.

[0007] In light of these challenges, one of the objectives of the present invention is to efficiently identify samples that have the potential for decryption and for which a decryption tool can be created, thereby efficiently evaluating the priority of sample analysis. [Means for solving the problem]

[0008] According to one embodiment of the present invention, a sample evaluation method is provided, which includes a computer acquiring a sample and one unencrypted data, fixing seed information, acquiring first encrypted data obtained by the sample encrypting the one unencrypted data using an encryption key generated based on the seed information, comparing the one unencrypted data with the first encrypted data and removing at least one Longest Common Subsequence (LCS) from the first encrypted data to generate first LCS-removed encrypted data, acquiring second encrypted data different from the first encrypted data obtained by the sample encrypting the one unencrypted data using an encryption key generated based on the seed information, comparing the one unencrypted data with the second encrypted data and removing at least a portion of the Longest Common Subsequence from the second encrypted data to generate second LCS-removed encrypted data, and determining the analysis priority of the sample based on the similarity between the first LCS-removed encrypted data and the second LCS-removed encrypted data.

[0009] In the above-described sample evaluation method, the sample may include ransomware.

[0010] In the above-described sample evaluation method, the seed information may include time information.

[0011] In the above-described sample evaluation method, removing the longest matching portion may include removing multiple longest matching portions until it is determined that the detected matching portion is a coincidence.

[0012] In the sample evaluation method described above, the matching portion being a coincidence includes the length of the matching portion being less than or equal to the maximum length that the longest matching portion can take, and the maximum length that the longest matching portion can take may be calculated based on the length of the byte sequence contained in one of the unencrypted data and the length of the byte sequence contained in the first encrypted data.

[0013] In the sample evaluation method described above, the matching portion being a coincidence includes the length of the matching portion being less than or equal to the maximum length that the longest matching portion can take, and the maximum length that the longest matching portion can take may be calculated based on the upper limit of the arbitrary application frequency of the longest matching portion, the length of the byte sequence contained in one of the unencrypted data, and the length of the byte sequence contained in the first encrypted data.

[0014] In the above-described sample evaluation method, removing multiple longest matching portions until the detected matching portion is determined to be a coincidence may include removing multiple longest matching portions until the difference between the length of the first longest matching portion between the unencrypted data and the first encrypted data and the length of the second longest matching portion between the unencrypted data and the first encrypted data detected after the first longest matching portion exceeds a preset threshold.

[0015] In the above sample evaluation method, the similarity between the first LCS-removed encrypted data and the second LCS-removed encrypted data may be calculated by comparison using fuzzy hashing.

[0016] Furthermore, according to one embodiment of the present invention, a program is provided for causing a computer to execute the above-mentioned sample evaluation method.

[0017] Furthermore, according to one embodiment of the present invention, a sample evaluation system is provided which includes a control unit that acquires a sample and one unencrypted data, fixes seed information, acquires first encrypted data obtained by the sample encrypting the one unencrypted data using an encryption key generated based on the seed information, compares the one unencrypted data with the first encrypted data and removes at least one Longest Common Subsequence (LCS) from the first encrypted data to generate first LCS-removed encrypted data, acquires second encrypted data different from the first encrypted data obtained by the sample encrypting the one unencrypted data using an encryption key generated based on the seed information, compares the one unencrypted data with the second encrypted data and removes at least a portion of the Longest Common Subsequence from the second encrypted data to generate second LCS-removed encrypted data, and determines the analysis priority of the sample based on the similarity between the first LCS-removed encrypted data and the second LCS-removed encrypted data.

[0018] In the above-described sample evaluation system, the sample may include ransomware.

[0019] In the above-described sample evaluation system, the seed information may include time information.

[0020] In the above-described sample evaluation system, removing the longest matching portion may include removing multiple longest matching portions until it is determined that the detected matching portion is a coincidence.

[0021] In the sample evaluation system described above, the matching portion being a coincidence includes the length of the longest matching portion being less than or equal to the maximum length the longest matching portion can take, and the maximum length the longest matching portion can take may be calculated based on the length of the byte sequence contained in one of the unencrypted data and the length of the byte sequence contained in the first encrypted data.

[0022] In the sample evaluation system described above, that the matching portion is a chance match includes that the length of the matching portion is equal to or less than the maximum possible length that the longest matching portion can take, and the maximum possible length that the longest matching portion can take may be calculated based on the upper limit value of any occurrence frequency of the longest matching portion, the length of the byte string included in the one piece of unencrypted data, and the length of the byte string included in the first encrypted data.

[0023] In the sample evaluation system described above, removing the plurality of longest matching portions until the detected matching portion is determined to be a chance match includes removing the plurality of longest matching portions until the difference between the length of the first longest matching portion between the unencrypted data and the first encrypted data and the length of the second longest matching portion detected next between the unencrypted data and the first encrypted data exceeds a preset threshold value.

[0024] In the sample evaluation system described above, the similarity between the first LCS-removed encrypted data and the second LCS-removed encrypted data may be calculated by comparison using a fuzzy hash. [Effects of the Invention]

[0025] According to one embodiment of the present invention, it is possible to efficiently evaluate the analysis priority of a sample by efficiently finding a sample for which a decryption tool can be created, with room for cryptographic decryption. [Brief Description of the Drawings]

[0026] [Figure 1] 1 is a block diagram showing the overall configuration of a sample evaluation system according to an embodiment of the present invention. [Figure 2] 2 is a flowchart showing an example of the flow of processing executed by the sample evaluation system according to the embodiment of the present invention. [Figure 3] This is an example of an API used when acquiring time information according to an embodiment of the present invention. [Figure 4] This is an example of code for immobilization according to an embodiment of the present invention. [Figure 5] This is an example of a user interface showing the result of running a program that outputs the return value of a Windows API to the screen twice while it is using an API hook. [Figure 6] This flowchart shows an example of the processing flow performed by a sample evaluation system according to one embodiment of the present invention. [Figure 7] This flowchart shows an example of the LCS removal process performed in a sample evaluation system according to one embodiment of the present invention. [Figure 8] This is an example of encrypted data before and after the removal of the longest matching portion. [Modes for carrying out the invention]

[0027] Embodiments of the present invention will be described below with reference to the drawings. However, the present invention can be implemented in many different ways, and is not limited to the embodiments described below. The drawings may be schematic in order to clarify the explanation, but they are merely examples and do not limit the interpretation of the present invention. In addition, the letters "1st," "2nd," etc., attached to each element are convenient indicators used to distinguish each element and have no further meaning unless specifically explained. In the drawings referenced in this embodiment, the same part or part having a similar function will be denoted by the same or similar symbols (simply the number xxx with A, B or -1, -2 etc. attached), and repeated explanations may be omitted. Also, some parts of the configuration may be omitted from the drawings. Furthermore, if something can be recognized by a person with ordinary skill in the art to which the present invention belongs, no further explanation will be given.

[0028] <First Embodiment> A sample evaluation system according to one embodiment of the present invention will be described in detail with reference to the drawings.

[0029] (1-1. Configuration of the specimen evaluation system) Figure 1 shows a block diagram illustrating the overall configuration of the sample evaluation system 100. As shown in Figure 1, the sample evaluation system 100 includes a control unit 110, a storage unit 120, and a user interface unit 130. In one embodiment of the present invention, the sample evaluation system 100 is implemented on a single terminal (computer).

[0030] The control unit 110 includes a CPU (Central Processing Unit), a GPU (Graphic Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other arithmetic processing circuit, as well as memory having ROM (Read-only Memory) and RAM (Random Access Memory). The control unit 110 controls the functions of each part using a sample evaluation program contained in the memory.

[0031] The storage unit 120 may utilize semiconductor memory such as an SSD (Solid State Drive), as well as magnetic recording media (magnetic tape, magnetic disk, etc.), optical recording media, magneto-optical recording media, or memory-capable elements that serve as storage media. The storage unit 120 functions as a database for storing various types of information used in the sample evaluation program. The sample evaluation program only needs to be executable by a computer and may be provided stored on the aforementioned computer-readable recording media.

[0032] The database for the sample evaluation program in the storage unit 120 includes information such as the sample 1201, the data file 1203, and the threshold 1205.

[0033] In one embodiment of the present invention, sample 1201 represents ransomware. Note that sample 1201 may also be malware other than ransomware, or other software.

[0034] In one embodiment of the present invention, the data file 1203 (also referred to as "unencrypted data") refers to data encrypted by an encryption key generated by the sample. The data file 1203 contains various types of data. The type and size of the data file 1203 are set as appropriate. For example, the data file 1203 may be a 628-byte py format data file, a 30-kilobyte xlsx format data file, or a 150-kilobyte word format data file. The data type may also be PDF format, jpg format, or exe format. Furthermore, the data file 1203 may contain multiple files of various types and sizes as described above.

[0035] The user interface unit 130 performs information input and output with the user. The user interface unit 130 includes a display unit 131 and an operation unit 133. The display unit 131 is a display device such as a liquid crystal display or an organic EL (Electro Luminescence) display, and the displayed content is controlled by signals input from the control unit 110. The operation unit 133 includes a controller, buttons, or switches. When the user performs actions such as moving up, down, left, or right, pressing, or rotating using the operation unit 133, information based on those actions is input to the control unit 110. Note that if the user interface unit 130 is a display device (touch panel) with a touch sensor, the display unit 131 and the operation unit 133 may be located in the same place.

[0036] In Figure 1, the control unit 110 includes, as functional units, an acquisition unit 1101, a fixing unit 1103, an LCS removal unit 1105, a similarity calculation unit 1107, and a determination unit 1109.

[0037] The acquisition unit 1101 has the function of acquiring various types of information. In one embodiment of the present invention, the acquisition unit 1101 acquires a sample, a data file, seed information, and encrypted data.

[0038] The fixing unit 1103 has the function of fixing the seed information.

[0039] The LCS removal unit 1105 has the function of removing the longest common sequence (LCS) from the encrypted data file. The longest common sequence is the longest substring that appears in both of the two binary sequences (in this example, the data before and after encryption).

[0040] The similarity calculation unit 1107 has the function of calculating the similarity between two encrypted data sets from which the longest matching portion has been removed.

[0041] The determination unit 1109 has a function to determine whether the target sample has a high priority for analysis (whether there is a good chance of reproducing the encryption key from the target sample) based on its similarity. In one embodiment of the present invention, "reproducing the encryption key" means creating a key identical to the encryption key created when the sample was encrypted.

[0042] (1-2. Method for evaluating specimens) Next, the sample evaluation method in the sample evaluation system 100 will be explained in detail using diagrams. Figure 2 is a flowchart showing an example of the sample evaluation method in the sample evaluation system 100.

[0043] (1-2-1. Obtaining specimens and data files) The control unit 110 acquires the sample to be determined as to whether the encryption key can be reproduced, and the data file to be encrypted (unencrypted data) (S110). In this embodiment, the sample and data file may be input by the user, or they may be acquired from a database for the sample evaluation program stored in the storage unit 120.

[0044] In one embodiment of the present invention, the sample (ransomware) is not particularly limited. In this example, the sample obtained is ransomware called "AtomSilo," but is not limited to this, and other ransomware may be obtained.

[0045] (1-2-2. Fixing seed information) Next, the control unit 110 processes information that could serve as seed information to fix it (step S115).

[0046] In one embodiment of the present invention, seed information (also referred to as "random number seed information") is information that serves as the source for generating random numbers for cryptographic key generation. In this example, time information is used as seed information.

[0047] In one embodiment of the present invention, when fixing time information, the Windows API may be used. As a more specific method for fixing time information, the Windows API function "GetSystemTimePreciseAsFileTime" can be used. Figure 3 shows an example of API 1000 used when fixing time information. Figure 4 shows an example of code 2000 for fixing using "GetSystemTimePreciseAsFileTime". In this case, the time information is fixed by setting up an API hook using a dynamic analysis tool (e.g., Frida) and fixing the return value. Figure 5 shows an example of user interface 3000 showing the result of running a program that outputs the return value of the Windows API to the screen twice with the API hook enabled. As shown in Figure 5, it can be confirmed that the time information has been fixed. This makes it possible to use a fixed value when a sample uses time information as seed information.

[0048] (1-2-3. Encryption process) Next, the control unit 110 executes the sample and retrieves the data file (obtains encrypted data) after a period of time has elapsed in which it can be determined that encryption has been performed (or it may monitor the state of the data file, such as renaming) (step S120).

[0049] Figure 6 is a flowchart of an example of encryption processing using the sample "AtomSilo". Note that the encryption processing using the sample is not limited to this, and other processing may be performed depending on the type of sample. First, random numbers are generated from fixed seed information (time information) (step S1201), and an encryption key is generated based on the random numbers (step S1203). Symmetric key encryption (AES; Advanced Encryption Standard) is used for the encryption key. In one embodiment of the present invention, by using fixed seed information, the same random numbers can be generated, and as a result, the same encryption key can be generated.

[0050] Next, the sample performs encryption on the data file (unencrypted data) using an encryption key (step S1203). In one embodiment of the present invention, an initialization vector (IV) is used when encrypting the data file. Furthermore, there are no particular restrictions on the range to be encrypted when encrypting the data file. In this example, the operation of encrypting 16 bytes and then skipping 32 bytes is repeated on the data file, so that the encrypted data file repeatedly contains plaintext (unencrypted part) and ciphertext (encrypted part). Furthermore, in one embodiment of the present invention, the encryption key is encrypted using the RSA (Rivest-Shamir-Adleman) algorithm, a type of public-key scheme, and added as a footer to the end of the data file (step S1205). In addition, information such as an identifier may be placed in the footer. Furthermore, the file name of the encrypted data file is changed (step S1209). From the above process, encrypted data is generated (completed). The encrypted data file may be stored in the storage unit 120.

[0051] (1-2-4.LCS removal) Returning to Figure 2, the control unit 110 compares the data file (unencrypted data) with the encrypted data file (first encrypted data) and performs a process to remove the Longest Common Subsequence (LCS) from the encrypted data file (step S130). Figure 7 is a flowchart showing the removal of the Longest Common Subsequence from the encrypted data file.

[0052] First, the data files before and after encryption are compared (step S1301), and the longest matching portion (LCS) is detected (searched and extracted) (step S1303). In one embodiment of the present invention, a rolling hash method and a binary search method can be used as methods for detecting the longest matching portion. Furthermore, assuming that the size of the target data file is several hundred KB (kilobytes), using this method can reduce the time required to detect the longest matching portion in one step, and as a result, the removal of the longest matching portion can be processed at high speed. Moreover, by using this method, when calculating the similarity described later, it is possible to evaluate using the exact difference rather than an approximation, so judgment can be made with higher accuracy, and the misjudgment of "likely to be reproduced, high priority for analysis (false positive)" for samples that are unlikely to be reproduced with the encryption key can be reduced.

[0053] Next, it is determined whether the detected (longest) matching portion is a coincidence (step S1305). If the detected matching portion is not a coincidence (step S1305; No), the longest matching portion is removed (step S1307), and the process returns to step S1301 to compare the data files before and after encryption again. This process is repeated multiple times until the detected (longest) matching portion is less than or equal to the length (data length, byte length) that would be expected to be a coincidence, i.e., the maximum length the longest matching portion can take.

[0054] In one embodiment of the present invention, the maximum length (minimum length of the longest matching portion) that can be taken by the longest matching portion for determining whether the detected matching portion is a coincidence can be calculated (predicted) based on the file size (data size) of the encrypted data file (encrypted data) and the unencrypted data. Specifically, the maximum length E that can be taken by the longest matching portion is calculated based on Equation 1.

number

[0055] Figure 8 shows an example of encrypted data 4000 before and after the removal of the longest matching portion. As shown in Figure 8, by using one embodiment of the present invention, data with the longest matching portion removed can be easily generated.

[0056] If the detected (longest) matching portion is a coincidence (less than or equal to the length of the minimum longest matching portion), the removal of the longest matching portion is completed, and LCS-removed encrypted data is generated (completed) (step S1309).

[0057] Let's return to Figure 2 for explanation. The control unit 110 determines whether it has two or more LCS-removed encrypted data for the target sample (step S140). If there is only one LCS-removed encrypted data (step S140; No), the process returns to step S120 and the data file is encrypted again. If there are two or more LCS-removed encrypted data (step S140; Yes), the process proceeds to the calculation of similarity (step S150).

[0058] (1-2-5. Calculation of Similarity) Next, the control unit 110 calculates the similarity between the two data files (LCS-removed encrypted data) from which the longest matching portion has been removed (S150). In one embodiment of the present invention, the similarity is calculated by comparison using fuzzy hashing. In one embodiment of the present invention, ssdeep is used as the fuzzy hash. When comparing using fuzzy hashing, the similarity between data with similar content can be shown numerically, even if they are not a perfect match.

[0059] (1-2-6. Determining Analysis Priority) Next, the control unit 110 determines whether the calculated similarity is equal to or greater than a preset threshold (step S160). In this example, the threshold is set to "80%", but it can be adjusted as appropriate. If the similarity is less than the threshold (step S160; No), the sample is evaluated as having a low analysis priority (low likelihood of reproducing the encryption key from the sample, immobilization failure) (step S170). On the other hand, if the similarity is equal to or greater than the threshold (step S160; No), the sample is evaluated as having a high analysis priority (high likelihood of reproducing the encryption key from the sample, immobilization success) (step S180). This completes the sample evaluation method.

[0060] Whether a decryption tool can be reproduced depends on revealing the internal structure of the ransomware (sample) and determining whether it has cryptographic vulnerabilities. Therefore, if the ransomware (sample) itself has no vulnerabilities, decryption is difficult and impractical. Furthermore, while creating a decryption tool quickly would reduce damage, malware analysis requires highly advanced skills, making it highly dependent on individual expertise, and it is unavoidable that a certain amount of time resources will be spent regardless of the analyst's skill level. Moreover, if time is spent analyzing files without vulnerabilities, the analysis of ransomware (samples) from which decryption tools can be created will be postponed, potentially resulting in increased damage. Currently, there is a technical challenge in that it is unavoidable to allocate analysis resources to samples that cannot be decrypted.

[0061] However, by using this embodiment, it is possible to efficiently identify samples that have room for decryption and for which a decryption tool can be created, thereby efficiently evaluating the analysis priority of samples. Furthermore, by using one embodiment of the present invention, it is possible to detect samples in which the encryption key can be reproduced at low cost and easily.

[0062] <Second Embodiment> This embodiment describes a sample evaluation method different from that of the first embodiment. Specifically, while the first embodiment of the present invention showed an example of detecting coincidental matching portions from the size of a data file (calculating the smallest longest matching length), this embodiment describes an example of detecting coincidental matching portions based on their frequency of occurrence (calculating the maximum length that the longest matching portion can take).

[0063] In this embodiment, an upper limit α for the frequency of occurrence of the longest matching portion may be set, and the maximum length Lmin that the longest matching portion can take in order to remain below the upper limit α may be calculated. In this case, the sizes (length of each byte sequence) of the two data files before and after encryption to be compared are "n" and "m", and the length of the longest matching portion is "l". Since there are (n-l+1) × (m-l+1) starting positions where a continuous match of the longest matching length l appears in the byte sequences (strings) of n and m, we set N = (n-l+1) and M = (m-l+1). As a result, the maximum length Lmin that the longest matching portion can take is calculated by formula 2.

number

[0064] In equation 2, for example, for a data file where the length of the byte sequences n and m (data size) is 300KB, if α = 0.01, the maximum length that the longest matching portion can take is Lmin ≈ 6 (a 6-byte match occurs about once every 100 times). Note that α = 1 is also acceptable.

[0065] Therefore, by using this embodiment, it is possible to predict (calculate) the maximum length that the longest matching portion of the coincidental matching portion can take, based on its frequency of occurrence.

[0066] <Third Embodiment> This embodiment describes a sample evaluation method different from that of the first embodiment. Specifically, this embodiment describes an example in which a coincidental match portion is detected based on the difference in length of the longest matching portion.

[0067] In this embodiment, for data files before and after encryption, the longest matching portion (byte sequence) of the unencrypted (unencrypted, plaintext) part is first excluded, and then the longest matching portion is detected in the part where the unencrypted and encrypted parts are mixed. At this time, the size (byte length) of the longest matching portion of a coincidence will be smaller than the size (byte length) of the longest matching portion of the unencrypted part. By detecting this difference (drop) in the length of the longest matching portion, it is determined whether it is a coincidence. Specifically, the length l1 ≥ l2 ≥ ... of the longest matching portion is detected, and when the difference (drop) between the length lk of one longest matching portion (also called the "length of the first longest matching portion") and the length of the next longest matching portion detected (lk+1) (also called the "length of the second longest matching portion") exceeds a predetermined threshold, it can be determined that the detected matching portion is a coincidence.

[0068] (modified version) Within the scope of the spirit of the present invention, a person skilled in the art can conceive of various modifications and alterations, and it is understood that such modifications and alterations also fall within the scope of the present invention. For example, any addition, deletion, or design change of components, or addition, omission, or modification of steps, or combination of configurations of the above-described embodiments, as appropriate by a person skilled in the art, are also included within the scope of the present invention, as long as they retain the gist of the present invention.

[0069] (1) In one embodiment of the present invention, an example was shown in which the sample evaluation system 100 is implemented on a single terminal, but the present invention is not limited thereto. For example, the sample evaluation system 100 may be configured by connecting multiple terminals, clients, or servers on a network.

[0070] (2) In one embodiment of the present invention, an example was shown in which time information (current time information) is used as seed information, but the present invention is not limited thereto. Seed information may be other time information (for example, terminal operating time), a MAC address, or information caused by the terminal (hardware), such as heat or electrical noise from the control unit (CPU).

[0071] (3) In one embodiment of the present invention, a file encrypted by ransomware was described as an example, but the present invention is not limited thereto. There is room for application to software other than ransomware, or to communication data with a C2 (Command and Control) server. By observing the fixation of communication data and attempting key reconstruction, encrypted communication can be decrypted in near real time.

[0072] (4) In one embodiment of the present invention, an example was shown in which the longest matching portion is removed until the detected matching portion is evaluated to be a coincidence (the shortest longest matching length), but the present invention is not limited thereto. Depending on the size and type of the data file, the present invention can also be applied when at least one longest matching portion is removed. Furthermore, all of the byte sequence extracted as the longest matching portion (LCS) may be deleted, or only a part of it may be deleted.

[0073] (5) In one embodiment of the present invention, an example was shown in which, when encrypting a data file, the operation of encrypting 16 bytes and then skipping 32 bytes is repeated, but the present invention is not limited thereto. For example, only a part of the data file (e.g., the header portion) may be encrypted, or the entire data file may be encrypted.

[0074] (6) In one embodiment of the present invention, an example was shown in which two encrypted data sets are generated and the similarity is calculated, but the present invention is not limited thereto. Three or more encrypted data sets may be generated and the similarity is calculated. This can improve the accuracy of the analysis priority of the samples.

[0075] (7) In one embodiment of the present invention, an example of performing dynamic analysis to evaluate a sample by actually moving the sample has been shown, but the present invention is not limited thereto. For example, the sample may be evaluated by emulating the movement of the sample (based on semi-dynamic analysis) without actually moving the sample. [Explanation of Symbols]

[0076] 100...Sample evaluation system, 110...Control unit, 120...Storage unit, 130...User interface unit, 131...Display unit, 133...Operation unit, 1101...Acquisition unit, 1103...Fixation unit, 1105...Removal unit, 1107...Similarity calculation unit, 1109...Determination unit, 1201...Sample, 1203...Data file, 1205...Threshold, 2000...Code for fixing algorithm, 3000...User interface, 4000...Data

Claims

1. Computers Obtain a sample and one unencrypted data, Fixed seed information, The sample obtains first encrypted data by encrypting one unencrypted data using an encryption key generated based on the seed information, The first unencrypted data and the first encrypted data are compared, and at least one longest common subsequence (LCS) is removed from the first encrypted data to generate the first LCS-removed encrypted data. The sample obtains a second encrypted data, which is different from the first encrypted data, by encrypting the one unencrypted data using an encryption key generated based on the seed information. The first unencrypted data and the second encrypted data are compared, and at least a portion of the longest matching portion is removed from the second encrypted data to generate the second LCS-removed encrypted data. The similarity between the first LCS-removed encrypted data and the second LCS-removed encrypted data is calculated. A sample evaluation method, which includes evaluating the sample as having a low analysis priority when the calculated similarity is below a threshold, and evaluating the sample as having a high analysis priority when the similarity is equal to or greater than a threshold.

2. The aforementioned sample contains ransomware, The sample evaluation method according to claim 1.

3. The aforementioned seed information includes time information, The sample evaluation method according to claim 1.

4. Removing the longest matching portion includes removing multiple longest matching portions until the detected matching portion is determined to be a coincidental match. The sample evaluation method according to claim 1.

5. The fact that the matching portion is a coincidence includes the length of the matching portion being less than or equal to the maximum length that the longest matching portion can take. The maximum length that the longest matching portion can take is calculated based on the length of the byte sequence contained in one of the unencrypted data and the length of the byte sequence of the first encrypted data. The sample evaluation method according to claim 4.

6. The fact that the matching portion is a coincidence includes the length of the matching portion being less than or equal to the maximum length that the longest matching portion can take. The maximum length that the longest matching portion can take is calculated based on the upper limit of any frequency of occurrence of the longest matching portion, the length of the byte sequence contained in one of the unencrypted data, and the length of the byte sequence contained in the first encrypted data. The sample evaluation method according to claim 4.

7. Removing multiple longest matching portions until the detected matching portion is determined to be a coincidental match is, The process includes removing multiple longest matching portions until the difference between the length of a first longest matching portion between the unencrypted data and the first encrypted data and the length of a second longest matching portion between the unencrypted data and the first encrypted data detected after the first longest matching portion exceeds a preset threshold. The sample evaluation method according to claim 4.

8. The similarity between the first LCS-removed encrypted data and the second LCS-removed encrypted data is calculated by comparison using fuzzy hashing. The sample evaluation method according to claim 1.

9. to the computer The sample evaluation method described in any one of claims 1 to 8 is performed. program.

10. Obtain a sample and one unencrypted data, Fixed seed information, The sample obtains first encrypted data by encrypting one unencrypted data using an encryption key generated based on the seed information, The first unencrypted data and the first encrypted data are compared, and at least one longest common subsequence (LCS) is removed from the first encrypted data to generate the first LCS-removed encrypted data. The sample obtains a second encrypted data, which is different from the first encrypted data, by encrypting the one unencrypted data using an encryption key generated based on the seed information. The first unencrypted data and the second encrypted data are compared, and at least a portion of the longest matching portion is removed from the second encrypted data to generate the second LCS-removed encrypted data. The similarity between the first LCS-removed encrypted data and the second LCS-removed encrypted data is calculated. A sample evaluation system including a control unit that evaluates the analysis priority of a sample as low when the calculated similarity is below a threshold, and evaluates the analysis priority of a sample as high when the similarity is above a threshold.

11. The aforementioned sample contains ransomware, The specimen evaluation system according to claim 10.

12. The aforementioned seed information includes time information, The specimen evaluation system according to claim 10.

13. Removing the longest matching portion includes removing multiple longest matching portions until the detected matching portion is determined to be a coincidental match. The specimen evaluation system according to claim 10.

14. The fact that the matching portion is a coincidence includes the length of the matching portion being less than or equal to the maximum length that the longest matching portion can take. The maximum length that the longest matching portion can take is calculated based on the length of the byte sequence contained in one of the unencrypted data and the length of the byte sequence contained in the first encrypted data. The specimen evaluation system according to claim 13.

15. The fact that the matching portion is a coincidence includes the length of the matching portion being less than or equal to the maximum length that the longest matching portion can take. The maximum length that the longest matching portion can take is calculated based on the upper limit of any frequency of occurrence of the longest matching portion, the length of the byte sequence contained in one of the unencrypted data, and the length of the byte sequence contained in the first encrypted data. The specimen evaluation system according to claim 13.

16. Removing multiple longest matching portions until the detected matching portion is determined to be a coincidental match is, The process includes removing multiple longest matching portions until the difference between the length of a first longest matching portion between the unencrypted data and the first encrypted data and the length of a second longest matching portion between the unencrypted data and the first encrypted data detected after the first longest matching portion exceeds a preset threshold. The specimen evaluation system according to claim 13.

17. The similarity between the first LCS-removed encrypted data and the second LCS-removed encrypted data is calculated by comparison using fuzzy hashing. The specimen evaluation system according to claim 10.

Images