Program analysis device, program analysis method, and program analysis program

Abstract

This program analysis device 30 comprises: an identification unit 31 that identifies a transmission function 330 for information included in a first program 33 and a reception function 340 for information included in a second program 34 by performing static analysis 311 on the first and second programs 33, 34 and / or performing dynamic analysis 312 on the operations of an information processing device 40 for executing both of the first and second programs 33, 34; and an estimation unit 32 that estimates that the information is propagated between the transmission function 330 and the reception function 340, for which a specification indicated by an identification result relating to the transmission function 330 and the reception function 340 meets a prescribed condition 320. This makes it possible to track the propagation of the information even when the information is propagated across programs.

Description

Program analysis device, program analysis method, and recording medium storing program analysis program

[0001] The present invention relates to a program analysis device, a program analysis method, and a recording medium on which a program analysis program is stored.

[0002] In recent years, cyber attacks using malicious programs (malware) have been rampant, exposing society to threats such as information leaks and system failures. Furthermore, the functions of malicious programs are becoming more diverse and sophisticated with each passing year. Therefore, there is a need for technology to more effectively detect such malicious programs.

[0003] In relation to such technology, Patent Literature 1 discloses an identification device that, when malware is executed, assigns a tag to data received by the malware that can uniquely identify the source of the data, and tracks the propagation of the tagged data. The device acquires, from among the tracked data, the tag of data referenced by a branch instruction executed by the malware. The device analyzes information about branch destination instructions not executed by the malware after the branch instruction. Based on the analysis results, the device then identifies the identification information of the command server that issues commands to the malware from the source identification information corresponding to the acquired tag.

[0004] Furthermore, Patent Literature 2 discloses a computer system that performs dynamic analysis of a malicious program sample and outputs analysis results including the destinations with which the malicious program communicates. This system detects changes in the destinations based on the results of periodic observation of the destinations and outputs the detection results. This system then stores the analysis results and detection results in a format that can be shared by multiple external computers.

[0005] Furthermore, Patent Document 3 discloses an information processing device that reads a manifest file included in an application program and provides information about the application program to an operating system. This device analyzes the likelihood of the application program being malware based on the usage permission information for each function described in the manifest file.

[0006] International Publication No. 2016 / 093182 International Publication No. 2021 / 024532 Japanese Patent Application Laid-Open No. 2013-222422

[0007] A malicious function (backdoor) in a malicious program executes unauthorized processing (e.g., processing authorized only to a legitimate system administrator) using information input from outside that is known only to the attacker. To detect such malicious functions, a method is used, for example, to analyze the control structure of a program and trace the flow of information input from outside as it propagates from one variable to another. Such malicious function detection methods typically perform analysis within the program, which poses a problem: when tracing the propagation of information input from outside and that information reaches an information transmission function that transmits information to another program, it is not possible to trace the subsequent propagation of the information.

[0008] In other words, the problem is to be able to trace the propagation of information even when the information propagates across programs. Patent Documents 1 to 3 cannot solve this problem.

[0009] A main object of the present invention is to make it possible to trace the propagation of information even when the information propagates across programs.

[0010] A program analysis device according to one aspect of the present invention comprises an identification means for identifying an information transmission function included in a first program and an information reception function included in a second program by performing at least one of a static analysis of the first program and the second program and a dynamic analysis of the operation of an information processing device that executes both the first program and the second program, and an estimation means for estimating that information propagates between the transmission function and the receiving function whose specifications indicated by the identification results for the transmission function and the receiving function satisfy predetermined conditions.

[0011] In another aspect of achieving the above object, a program analysis method according to one embodiment of the present invention identifies, by a first information processing device, the information transmission function contained in a first program and the information reception function contained in a second program by performing at least one of a static analysis of the first program and the second program and a dynamic analysis of the operation of a second information processing device that executes both the first program and the second program, and estimates that information is propagated between the transmission function and the reception function whose specifications indicated by the identification results for the transmission function and the reception function satisfy specified conditions.

[0012] In addition, in a further aspect of achieving the above-mentioned object, a program analysis program according to one embodiment of the present invention causes a computer to perform a specific process of identifying an information transmission function contained in a first program and an information reception function contained in a second program by performing at least one of a static analysis of the first program and the second program and a dynamic analysis of the operation of an information processing device that executes both the first program and the second program, and an estimation process of estimating that information propagates between the transmission function and the reception function where the specifications indicated by the identification results for the transmission function and the reception function satisfy specified conditions.

[0013] Furthermore, the present invention can also be realized by a computer-readable non-volatile recording medium on which such a program analysis program (computer program) is stored.

[0014] According to the present invention, even when information is propagated across programs, the propagation of information can be traced.

[0015] 1 is a block diagram showing a configuration of a program analysis system 1 according to a first embodiment of the present invention. FIG. 2 is a diagram showing an example of source code of a program 101 according to the first embodiment of the present invention. FIG. 3 is a diagram showing an example of source code of a program 102 according to the first embodiment of the present invention. FIG. 4 is a diagram showing an example of the contents of a static analysis rule 1110 and an information propagation estimation rule 120 in static analysis according to the first embodiment of the present invention. FIG. 5 is a diagram explaining a first example of dynamic analysis by the dynamic analysis unit 112 according to the first embodiment of the present invention, and an operation of the estimation unit 12 based on the result of the dynamic analysis. FIG. 6 is a diagram explaining a second example of dynamic analysis by the dynamic analysis unit 112 according to the first embodiment of the present invention, and an operation of the estimation unit 12 based on the result of the dynamic analysis. FIG. 7 is a diagram explaining a third example of dynamic analysis by the dynamic analysis unit 112 according to the first embodiment of the present invention, and an operation of the estimation unit 12 based on the result of the dynamic analysis. FIG. 8 is a flowchart showing an operation of estimating cross-program information propagation through static analysis by the program analysis device 10 according to the first embodiment of the present invention. FIG. 9 is a flowchart showing an operation of estimating cross-program information propagation through dynamic analysis by the program analysis device 10 according to the first embodiment of the present invention. FIG. 10 is a block diagram showing a configuration of a program analysis device 30 according to a second embodiment of the present invention. FIG. 11 is a flowchart showing an operation of the program analysis device 30 according to the second embodiment of the present invention. FIG. 9 is a block diagram showing a configuration of an information processing device 900 capable of realizing a program analysis device according to each embodiment of the present invention.

[0016] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0017] First Embodiment FIG. 1 is a block diagram showing the configuration of a program analysis system 1 according to a first embodiment of the present invention.

[0018] The program analysis system 1 roughly includes a program analysis device 10 and a program execution device 20. The program analysis device 10 and the program execution device 20 are connected to each other so as to be able to communicate with each other.

[0019] The program execution device 20 is a device having a configuration similar to that of an information processing device 900, which will be described later with reference to FIG. 12, for example. The program execution device 20 executes programs 101, 102, etc., which will be described later. The programs 101 and 102 are specimens that are the targets of the program analysis device 10 for analyzing the propagation of information across programs. The program 101 is an example of a first program or a second program. The program 102 is an example of a first program or a second program. The program analysis device 10 and the program execution device 20 may be configured in the same information processing device.

[0020] The program analysis device 10 includes a specifying unit 11, an estimating unit 12, and a storage unit 13. The specifying unit 11 and the estimating unit 12 are examples of specifying means and estimating means.

[0021] The storage unit 13 is, for example, a storage device such as a RAM (Random Access Memory) or a hard disk 904, which will be described later with reference to FIG. 12. The storage unit 13 stores a program 101, a program 102, and a dynamic analysis test scenario 110. The storage unit 13 may store programs other than the program 101 and the program 102 (i.e., three or more programs) as targets of analysis by the program analysis device 10. The program 101, the program 102, and the dynamic analysis test scenario 110 stored in the storage unit 13 will be described later.

[0022] The program analysis device 10 according to this embodiment performs at least one of static analysis and dynamic analysis on the programs 101 and 102 to estimate the presence of information propagation between the programs 101 and 102. Below, the operation of the program analysis device 10 to estimate information propagation across programs will be described in order for the cases where static analysis is performed on the programs 101 and 102 and where dynamic analysis is performed.

[0023] <Operation of estimating information propagation across programs through static analysis of programs> The program analysis device 10 estimates the existence of information propagation from program 101 to program 102, or from program 102 to program 101, by performing static analysis on the source files of programs 101 and 102.

[0024] The static analysis unit 111 included in the identification unit 11 identifies the functions for transmitting information to the outside, which are included in the programs 101 and 102 (first programs), and the functions for receiving information from the outside, which are included in the programs 101 and 102 (second programs), by performing static analysis on the source code of the programs 101 and 102. More specifically, the static analysis unit 111 performs static analysis on the source code of the program 101 to identify the specifications of an information transmission function 1011 and an information reception function 1012, which are included in the program 101, based on static analysis rules 1110. Similarly, the static analysis unit 111 performs static analysis on the source code of the program 102 to identify the specifications of an information transmission function 1021 and an information reception function 1022, which are included in the program 102, based on the static analysis rules 1110.

[0025] FIG. 2 is a diagram illustrating an example of source code of the program 101 according to this embodiment. FIG. 3 is a diagram illustrating an example of source code of the program 102 according to this embodiment. FIG. 4 is a diagram illustrating an example of static analysis rules 1110 according to this embodiment and the contents of information propagation estimation rules 120 in static analysis, which will be described later. More specifically, the static analysis rules 1110 illustrated in FIG. 4 include a sending function specification rule and a receiving function specification rule. The sending function specification rule is a rule for specifying the specifications of the information sending function 1011 or the information sending function 1021. The receiving function specification rule is a rule for specifying the specifications of the information receiving function 1012 or the information receiving function 1022.

[0026] Based on the transmission function identification rule of item No. 1 illustrated in FIG. 4, the static analysis unit 111 identifies (extracts) that the address assigned to the offset X(.sin_addr.s_addr) of the second argument "addr" of "connect," which has as its first argument "sock," the first argument of "send," the information transmission function 1011 in the program 101 illustrated in FIG. 2, is "inet_addr("127.0.0.1")." Based on the transmission function identification rule of item No. 1 illustrated in FIG. 4, the static analysis unit 111 identifies that the port number assigned to the offset Y(.sin_port) of the second argument "addr" is "htons(1234)." In this way, the static analysis unit 111 identifies, as specifications of the information transmission function 1011 included in the program 101, the address and port related to the destination of information from the information transmission function 1011.

[0027] Based on the reception function specification rule of item No. 1 illustrated in FIG. 4, the static analysis unit 111 determines that the address assigned to the offset X (.sin_addr.s_addr) of the second argument "addr" of "bind," which has as its first argument the first argument "sock" of "accept," which outputs "sock2," which is the first argument of "recv," the information reception function 1022 in the program 102 illustrated in FIG. 3, is "INADDR_ANY." Note that "INADDR_ANY" indicates that any address value is acceptable. Based on the reception function specification rule of item No. 1 illustrated in FIG. 4, the static analysis unit 111 determines that the port number assigned to the offset Y (.sin_port) of the second argument "addr" is "htons(1234)." In this way, the static analysis unit 111 specifies, as the specifications of the information reception function 1022, the address and port related to the destination of the information from the information reception function 1022.

[0028] If the identification results by the static analysis unit 111 regarding the information transmission function and reception function contained in the program 101 and the program 102 satisfy the information propagation estimation rule 120 (predetermined condition), the estimation unit 12 estimates that information will propagate in the combination of the transmission function and the reception function.

[0029] According to the information propagation estimation rule 120 of item No. 1 illustrated in Fig. 4, the conditions for estimating that information propagates between the programs 101 and 102 are that the address on the receiving side is "INADDR_ANY," or that the address on the sending side and the receiving side match, and that the port on the sending side and the receiving side match. With respect to the program 101 illustrated in Fig. 2 and the program 102 illustrated in Fig. 3 described above, the specifications of the information transmission function 1011 and the information reception function 1022 identified by the static analysis unit 111 satisfy the information propagation estimation rule 120 of item No. 1 illustrated in Fig. 4. Therefore, in this case, the estimation unit 12 estimates that information propagates from "send," which is the information transmission function 1011 of the program 101 illustrated in Fig. 2, to "recv," which is the information reception function 1022 of the program 102 illustrated in Fig. 3.

[0030] 4 show other examples of the static analysis rule 1110 and the information propagation estimation rule 120. However, the static analysis rule 1110 and the information propagation estimation rule 120 of the items 2 and 3 do not apply to any part of the source code shown in FIG. 2, but may apply to the program 101 including source code different from the source code shown in FIG. 2 and the program 102 including source code different from the source code shown in FIG. 3.

[0031] In the case of item number 2 illustrated in FIG. 4 , the static analysis unit 111 identifies (extracts) the socket file path substituted for the offset X(.sun_path) of the second argument of "connect," which has as its first argument the first argument of "send," which is the information transmission function 1011 (or the information transmission function 1021). The static analysis unit 111 identifies the socket file path substituted for the offset X(.sun_path) of the second argument of "bind," which has as its first argument the first argument of "accept," which outputs the first argument of "recv," which is the information reception function 1022 (or the information reception function 1012). Then, if the socket file paths on the sending side and the receiving side match, the estimation unit 12 estimates that information is propagated from "send," which is the information transmission function 1011 (or the information transmission function 1021), to "recv," which is the information reception function 1022 (or the information reception function 1012).

[0032] In the case of item number 3 illustrated in FIG. 4 , the static analysis unit 111 identifies (extracts) a file path assigned to the first argument of "ftok," which has the first argument of "shmget" as its return value and the ID assigned to the second argument of "ftok." "shmget" returns the first argument of "shmat," which is the information transmission function 1011 (or the information transmission function 1021). Note that the static analysis unit 111 determines that "shmat" is the sender because "IPC_CREAT" is specified as the third argument of "shmget." The static analysis unit 111 identifies (extracts) a file path assigned to the first argument of "ftok," which has the first argument of "shmget" as its return value and the ID assigned to the second argument of "ftok." "shmget" returns the first argument of "shmat," which is the information reception function 1022 (or the information reception function 1012). At this time, the static analysis unit 111 determines that "shmat" is the receiving side because "IPC_CREAT" is not specified as the third argument of "shmget." If the file path and ID match between the sending side and the receiving side, the estimation unit 12 estimates that information is propagated from "shmat," which is the information sending function 1011 (or the information sending function 1021), to "shmat," which is the information receiving function 1022 (or the information receiving function 1012).

[0033] Next, with reference to the flowchart of FIG. 8, the operation (processing) of estimating the propagation of information across programs through static analysis by the program analysis device 10 according to this embodiment will be described in detail.

[0034] The static analysis unit 111 of the identification unit 11 performs static analysis on the programs 101 and 102 based on the static analysis rules 1110, and identifies specifications of the information transmitting function 1011, the information receiving function 1012, the information transmitting function 1021, and the information receiving function 1022 (step S101). The estimation unit 12 determines whether the specifications identified by the static analysis unit 111 satisfy the information propagation estimation rules 120 for a combination of transmission and reception across any of the programs among the information transmitting function 1011, the information receiving function 1012, the information transmitting function 1021, and the information receiving function 1022 (step S102).

[0035] If the specification satisfies the information propagation estimation rule 120 (Yes in step S103), the estimation unit 12 estimates that information will propagate across programs in the combination (step S104).If the specification does not satisfy the information propagation estimation rule 120 (No in step S103), the estimation unit 12 estimates that it is unclear whether information will propagate across programs in the combination (step S105).

[0036] If there is a combination of transmission and reception across programs for which an estimation regarding information propagation has not yet been performed (Yes in step S106), the process returns to step S102. If there is no combination of transmission and reception across programs for which an estimation regarding information propagation has not yet been performed (No in step S106), the estimation unit 12 outputs an estimation result regarding information propagation between the program 101 and the program 102 (step S107), and the entire process ends.

[0037] <Operation of Estimating Information Propagation Across Programs Through Dynamic Analysis of Programs> The program analysis device 10 estimates the existence of information propagation from the program 101 to the program 102 or from the program 102 to the program 101 by performing dynamic analysis on the operation of the program execution device 20, which executes both the program 101 and the program 102 (e.g., simultaneously). At this time, the program execution device 20 executes the program 101 and the program 102 in accordance with a dynamic analysis test scenario 110 provided by the program analysis device 10. The dynamic analysis test scenario 110 is created, for example, by a user of the program analysis device 10, and includes data to be provided to the program 101 and the program 102, data representing the execution environments of the programs 101 and 102, and the like. The dynamic analysis test scenario 110 is created so as to detect as thoroughly as possible the propagation of information that occurs between the program 101 and the program 102.

[0038] The dynamic analysis unit 112 included in the identification unit 11 identifies the functions included in the programs 101 and 102 (first programs) for transmitting information to the outside and the functions included in the programs 101 and 102 (second programs) for receiving information from the outside by performing dynamic analysis on information representing the execution status of the programs by the program execution device 20. More specifically, the dynamic analysis unit 112 performs dynamic analysis on information representing the time series of instructions (functions, etc.) executed by a program execution device that simultaneously executes the programs 101 and 102, thereby identifying the specifications of the executed information transmission function 1011, information reception function 1012, information transmission function 1021, and information reception function 1022 based on dynamic analysis rules 1120. Note that the information representing the execution status of the program by the program execution device 20 can be acquired by an existing API (Application Programming Interface) or the like that traces the execution status of the program (such as the execution history of functions in the order in which they were executed) step by step.

[0039] FIG. 5 is a diagram illustrating a first example of the dynamic analysis by the dynamic analysis unit 112 according to this embodiment and the operation of the estimation unit 12 based on the results of the dynamic analysis.

[0040] The dynamic analysis unit 112 acquires information representing the execution status of the program by the program execution device 20 described above, and identifies (extracts) from that information the specifications of the information transmitting function 1011, information receiving function 1012, information transmitting function 1021, and information receiving function 1022 based on the dynamic analysis rule 1120. As illustrated in FIG. 5 , the dynamic analysis unit 112 identifies the transmission / reception type, the program containing the information transmitting function or information receiving function, the caller address of the information transmitting function or information receiving function, and the name of the information transmitting function or information receiving function in the chronological order in which the information transmitting function or information receiving function was executed from the information representing the execution status of the program. Note that the dynamic analysis rule 1120 includes a list of names, etc., related to the information transmitting function or information receiving function, and indicates that the above items are extracted from the information representing the execution status of the program. Of the above items, the caller address is necessary to distinguish between multiple information transmitting functions or information receiving functions of the same type included in the program. The dynamic analysis rule 1120 may indicate that items other than the above items are to be extracted from the information indicating the execution status of the program.

[0041] The estimation unit 12 estimates the existence of information propagation between the programs 101 and 102 based on the analysis results by the dynamic analysis unit 112 and the information propagation estimation rule 120. The information propagation estimation rule 120 indicates that when an information sending function and an information receiving function are executed consecutively in a state where there is no reception waiting, information is propagated between the information sending function and the information receiving function. Note that the reception waiting state indicates a state where the information receiving function associated with the information sending function (which receives information transmitted from the information sending function) has not been executed since the information sending function was executed.

[0042] 5 , the dynamic analysis result by the dynamic analysis unit 112 shows that "recv," which is the information receiving function 1022 of the program 102 related to time series item number 2, is executed after "send," which is the information sending function 1011 of the program 101 related to time series item number 1. In this case, there is no wait for reception between "send" of time series item number 1 and "recv" of time series item number 2, and the information sending function and the information receiving function are consecutive. Therefore, the estimation unit 12 estimates, in accordance with the information propagation estimation rule 120, that information is propagated from "send" in the program 101 related to time series item number 1 to "recv" in the program 102 related to time series item number 2.

[0043] 5 , the information transmission function 1011 "send" of the program 101 relating to time series item number 4 is executed after the information transmission function 1011 "send" of the program 101 relating to time series item number 3. After that, the information reception function 1022 "recv" of the program 101 relating to time series item number 4 is executed after the information reception function 1022 "recv" of the program 102 relating to time series item number 5. In this case, the information transmission function 1011 is executed consecutively, and the above-mentioned reception wait occurs. Therefore, the estimation unit 12 estimates, in accordance with the information propagation estimation rule 120, that it is unknown whether information has propagated with respect to the information transmission functions 1011 and information reception functions 1022 relating to time series item numbers 3 to 6.

[0044] 6 is a diagram illustrating a second example of dynamic analysis by the dynamic analysis unit 112 according to this embodiment and the operation of the estimation unit 12 based on the results of the dynamic analysis. Fig. 6 illustrates an example in which the estimation unit 12 repeatedly estimates new combinations of information sending functions and information receiving functions through which information is propagated, using combinations of information sending functions and information receiving functions that have already been estimated to propagate information between programs.

[0045] 6, as in the example of FIG. 5, the estimation unit 12 estimates in the first estimation operation, in accordance with the information propagation estimation rule 120, that information will propagate from "send" in the program 101 of time series item number 1 to "recv" in the program 102 of time series item number 2. The estimation unit 12 also estimates that, since reception waits are occurring for the information transmission function 1011 and the information reception function 1022 of time series item numbers 3 to 6, it is unclear whether information will propagate. The estimation unit 12 also estimates that, since reception waits are occurring for the information transmission function 1011 and the information reception function 1022 of time series item numbers 7 to 10, it is unclear whether information will propagate.

[0046] In the second estimation operation, the estimation unit 12 utilizes the fact that "send" of time series item number 1 and "recv" of time series item number 2 are a combination that propagates information, as indicated by the first estimation result, to estimate that information propagates between "send" in program 101 of time series item number 3 and "recv" in program 102 of time series item number 5. Then, the estimation unit 12 utilizes the fact that "send" of time series item number 3 and "recv" of time series item number 5 are a combination that propagates information, to estimate that a correspondence exists between time series item number 4 and time series item number 6, which are the remaining items in time series item numbers 3 to 6. In other words, the estimation unit 12 estimates that information propagates from "write" in program 102 of time series item number 4 to "read" in program 103 of time series item number 6.

[0047] In the third estimation operation, the estimation unit 12 utilizes the fact that the "write" of time series item number 4 and the "read" of time series item number 6 are a combination that propagates information, as indicated by the second estimation result, to estimate that information propagates between "write" in program 102 of time series item number 8 and "read" in program 103 of time series item number 9. Then, the estimation unit 12 utilizes the fact that the "write" of time series item number 8 and the "read" of time series item number 9 are a combination that propagates information, to estimate that a correspondence exists between time series item number 7 and time series item number 10, which are the remaining items in time series item numbers 7 to 10. In other words, the estimation unit 12 estimates that information propagates from "send" in program 102 of time series item number 7 to "recv" in program 104 of time series item number 10.

[0048] In the example shown in Figure 6, the estimation unit 12 performs the above-mentioned three estimation operations and estimates that information is propagated in any combination of information transmission function and information reception function of time series item numbers 1 to 10.

[0049] 7 is a diagram illustrating a third example of dynamic analysis by the dynamic analysis unit 112 according to this embodiment and the operation of the estimation unit 12 based on the results of the dynamic analysis. Based on the general characteristic that information transmitted from a certain program is rarely received by the same program, the estimation unit 12 excludes information propagation between an information transmitting function and an information receiving function in the same program.

[0050] 7 , the estimation unit 12 first estimates that it is unclear whether information is being propagated because reception waits are occurring for the information transmission functions and information reception functions associated with time series item numbers 1 to 4, in accordance with the information propagation estimation rule 120. The estimation unit 12 also estimates that it is unclear whether information is being propagated because reception waits are occurring for the information transmission functions and information reception functions associated with time series item numbers 5 to 8.

[0051] The estimation unit 12 then excludes information propagation from "send" in program 101 of time series item number 1 to "recv" in program 101 of time series item number 3. Similarly, the estimation unit 12 excludes information propagation from "write" in program 102 of time series item number 5 to "read" in program 102 of time series item number 8.

[0052] Then, of the "recv" of time series item number 3 and the "recv" of time series item number 4, which are candidates for the destination of the information of "send" of time series item number 1, the estimation unit 12 estimates that "recv" of time series item number 4, which has not been excluded as the destination of the information of "send" of time series item number 1, is the destination of the information. The estimation unit 12 estimates that, in time series item numbers 1 to 4, information propagates between "send" in the remaining program 102 of time series item number 2 and "recv" in the program 101 of time series item number 3.

[0053] Similarly, the estimation unit 12 estimates that, of the "read" of time series item number 7 and the "read" of time series item number 8, which are candidates for the destination of the information of the "write" of time series item number 5, the "read" of time series item number 7, which has not been excluded as the destination of the information of the "write" of time series item number 5, is the destination of the information. The estimation unit 12 estimates that, in time series item numbers 1 to 4, information propagates between the "write" in the program 103 of the remaining time series item number 6 and the "read" in the program 102 of the time series item number 8.

[0054] In the example shown in Figure 7, the estimation unit 12 estimates that information is propagated in a combination of an information transmission function and an information reception function of any of time series items 1 to 8, by excluding the propagation of information between the information transmission function and the information reception function in the same program described above.

[0055] Next, with reference to the flowchart of FIG. 9, the operation (processing) of estimating propagation of information across programs through dynamic analysis by the program analysis device 10 according to this embodiment will be described in detail.

[0056] The dynamic analysis unit 112 of the identification unit 11 performs dynamic analysis of the operation of the program execution device 20 that simultaneously executes the programs 101 and 102 based on the dynamic analysis rules 1120, and identifies the specifications of the information transmitting function 1011, the information receiving function 1012, the information transmitting function 1021, and the information receiving function 1022 (step S201). The estimation unit 12 determines whether the specifications of any of the transmission and reception combinations of the information transmitting function 1011, the information receiving function 1012, the information transmitting function 1021, and the information receiving function 1022 satisfy the information propagation estimation rules 120, taking into account the transmission and reception combinations that have been estimated to propagate information (step S202).

[0057] If the specification satisfies the information propagation estimation rule 120 (Yes in step S203), the estimation unit 12 estimates that information will propagate across programs in the combination (step S204).If the specification does not satisfy the information propagation estimation rule 120 (No in step S203), the estimation unit 12 estimates that it is unclear whether information will propagate across programs in the combination (step S205).

[0058] If there is a combination of transmission and reception across programs for which an estimation regarding information propagation has not yet been performed (Yes in step S206), the process returns to step S202. If there is no combination of transmission and reception across programs for which an estimation regarding information propagation has not yet been performed (No in step S206), the estimation unit 12 outputs an estimation result regarding information propagation between the program 101 and the program 102 (step S207), and the entire process ends.

[0059] The program analysis device 10 according to this embodiment can track the propagation of information even when the information propagates across programs, because the program analysis device 10 identifies the transmitting and receiving functions of the information included in the programs 101 and 102 by performing at least one of static analysis and dynamic analysis on the programs 101 and 102, and estimates that the information propagates between the transmitting and receiving functions whose identification results satisfy the information propagation estimation rule 120.

[0060] The effects achieved by the program analysis device 10 according to this embodiment will be described in detail below.

[0061] The malicious functions of malicious programs execute unauthorized processing using information input from outside that is known only to the attacker. To detect such malicious functions, for example, a method is used that analyzes the control structure of the program to trace the flow of information input from outside as it propagates from one variable to another. Such malicious function detection methods typically perform analysis within the program, so when tracing the propagation of information input from outside, if that information reaches an information transmission function that transmits information to another program, there is a problem in that it is not possible to trace the subsequent propagation of the information.

[0062] To address such problems, the program analysis device 10 according to this embodiment performs, for example, at least one of static analysis of the programs 101 and 102 and dynamic analysis of the operation of the program execution device 20 that executes both the programs 101 and 102. The program analysis device 10 identifies an information sending function 1011 included in the program 101 and an information receiving function 1022 included in the program 102 through the static analysis and the dynamic analysis. The program analysis device 10 then estimates that information propagates between the information sending function 1011 and the information receiving function 1022, the specifications of which indicated by the identification results for the information sending function 1011 and the information receiving function 1022 satisfy the information propagation estimation rule 120. Therefore, the program analysis device 10 can track the propagation of information even when the information propagates across programs.

[0063] Furthermore, the program analysis device 10 according to the present embodiment repeatedly estimates new combinations of information transmitting functions and information receiving functions through which information is propagated, using combinations of information transmitting functions and information receiving functions that have already been estimated to propagate information, as illustrated in Fig. 6. This allows the program analysis device 10 to more comprehensively detect combinations of information transmitting functions and information receiving functions through which information is propagated.

[0064] Furthermore, the program analysis apparatus 10 according to this embodiment uses excluding information propagation between information sending functions and information receiving functions in the same program as the information propagation estimation rule 120. This allows the program analysis apparatus 10 to more comprehensively detect combinations of information sending functions and information receiving functions through which information is propagated.

[0065] In addition, the program analysis device 10 of this embodiment performs at least one of static analysis and dynamic analysis on programs 101 and 102, but by performing both static analysis and dynamic analysis and having the analysis results complement each other, it is possible to more comprehensively track the propagation of information across programs.

[0066] For example, in the program 101 illustrated in Fig. 2 and the program 102 illustrated in Fig. 3, if the program does not contain information for identifying the communication partner (for example, the communication partner is set by a configuration file or via the program), it is difficult to identify, by static analysis, the combination of the information transmission function and the information reception function through which the information is propagated. Therefore, the program analysis device 10 can identify, by dynamic analysis, such combinations of the information transmission function and the information reception function that are difficult to identify by static analysis.

[0067] On the other hand, it may be difficult to identify, by dynamic analysis, a combination of information sending functions and information receiving functions through which information is propagated, due to a lack of test scenarios for dynamic analysis and issues with the timing at which the information sending functions and information receiving functions are executed. Therefore, the program analysis device 10 can identify, by static analysis, such combinations of information sending functions and information receiving functions that are difficult to identify by dynamic analysis.

[0068] Furthermore, the program analysis device 10 according to the present embodiment may use the estimation result by the estimation unit 12 regarding information propagation based on the result of static analysis by the identification unit 11 to make an estimation regarding information propagation based on the result of dynamic analysis by the identification unit 11. That is, the program analysis device 10 may, for example, perform dynamic analysis by reflecting the estimation result obtained in static analysis in the dynamic analysis test scenario 110. This allows the program analysis device 10 to more efficiently track the propagation of information across programs.

[0069] 10 is a block diagram showing the configuration of a program analysis device 30 according to a second embodiment of the present invention. The program analysis device 30 includes an identifying unit 31 and an estimating unit 32. The identifying unit 31 and the estimating unit 32 are examples of an identifying means and an estimating means, respectively.

[0070] The identification unit 31 identifies an information transmission function 330 included in the first program 33 and an information reception function 340 included in the second program 34 by performing at least one of static analysis 311 on the first program 33 and the second program 34 and dynamic analysis 312 on the operation of the information processing device 40 that executes both the first program 33 and the second program 34. The first program 33 is, for example, a program similar to the program 101 or the program 102 according to the first embodiment. The second program 34 is, for example, a program similar to the program 101 or the program 102 according to the first embodiment. The transmission function 330 is, for example, a function similar to the information transmission function 1011 or the information transmission function 1021 according to the first embodiment. The reception function 340 is, for example, a function similar to the information reception function 1012 or the information reception function 1022 according to the first embodiment. The static analysis 311 is, for example, an analysis similar to the analysis performed by the static analysis unit 111 according to the first embodiment. The dynamic analysis 312 is, for example, the same analysis as the analysis performed by the dynamic analysis unit 112 according to the first embodiment. The identification unit 31 operates in the same manner as the identification unit 11 according to the first embodiment, for example.

[0071] The estimation unit 32 estimates that information propagates between the transmitting function 330 and the receiving function 340 when the specifications indicated by the identification results for the transmitting function 330 and the receiving function 340 satisfy a predetermined condition 320. The predetermined condition 320 is, for example, a condition similar to the information propagation estimation rule 120 according to the first embodiment. The estimation unit 32 operates in the same manner as the estimation unit 12 according to the first embodiment, for example.

[0072] Next, the operation (processing) of the program analysis device 30 according to this embodiment will be described in detail with reference to the flowchart of FIG.

[0073] The identification unit 31 performs static analysis 311 on the first program 33 and the second program 34, and identifies the transmission function 330 and the reception function 340 (step S301). The identification unit 31 performs dynamic analysis 312 on the information processing device 40 that executes both the first program 33 and the second program 34, and identifies the transmission function 330 and the reception function 340 (step S302). The estimation unit 32 estimates that information propagates between the transmission function 330 and the reception function 340 whose specifications satisfy the predetermined condition 320 (step S303), and the entire processing ends.

[0074] The program analysis device 30 according to this embodiment can track the propagation of information even when the information propagates across programs. The reason is that the program analysis device 30 identifies the transmitting function 330 and the receiving function 340 of the information included in the first program 33 and the second program 34 by performing at least one of static analysis and dynamic analysis on the first program 33 and the second program 34, and estimates that the information propagates between the transmitting function 330 and the receiving function 340 whose identification results satisfy the predetermined condition 320.

[0075] <Hardware Configuration Example> In each of the above-described embodiments, each unit in the program analysis device 10 shown in Fig. 1 or the program analysis device 30 shown in Fig. 10 can be realized by dedicated HW (Hardware) (electronic circuitry). In Fig. 1 and Fig. 10, at least the following components can be considered as functional (processing) units (software modules) of a software program: - Identification units 11 and 31 - Static analysis unit 111 - Dynamic analysis unit 112 - Estimation units 12 and 32 - Storage control function in storage unit 13

[0076] However, the division of the various components shown in these drawings is for the sake of convenience of explanation, and various configurations may be assumed for implementation. An example of the hardware environment in this case will be described with reference to FIG. 12.

[0077] Fig. 12 is a diagram illustrating an example of the configuration of an information processing device 900 (computer system) that can realize the information processing device included in the program analysis device 10 according to the first embodiment of the present invention or the program analysis device 30 according to the second embodiment. That is, Fig. 12 shows the configuration of at least one computer (information processing device) that can realize the systems shown in Figs. 1 and 10, and represents a hardware environment that can realize each function in the above-mentioned embodiments.

[0078] 12 includes the following components, but may not include some of the following components: CPU (Central Processing Unit) 901, ROM (Read Only Memory) 902, RAM (Random Access Memory) 903, hard disk (storage device) 904, communication interface 905 with external devices, bus 906 (communication line), reader / writer 908 capable of reading and writing data stored in recording medium 907 such as CD-ROM (Compact Disc Read Only Memory), and input / output interface 909 such as a monitor, speaker, keyboard, etc.

[0079] That is, the information processing device 900 including the above components is a general computer in which these components are connected via a bus 906. The information processing device 900 may include multiple CPUs 901 or may include a CPU 901 configured with multiple cores. The information processing device 900 may include a GPU (Graphical Processing Unit) (not shown) in addition to the CPU 901.

[0080] The present invention, explained using the above-mentioned embodiment as an example, supplies a computer program capable of realizing the following functions to the information processing device 900 shown in FIG. 12. The functions are the functions described above in the block diagrams (FIGS. 1 and 10) or the flowcharts (FIGS. 8, 9, and 11) referred to in the description of the embodiment. The present invention is then achieved by reading the computer program into the CPU 901 of the hardware, interpreting it, and executing it. The computer program supplied to the device may be stored in a readable / writable volatile memory (RAM 903) or a non-volatile storage device such as a ROM 902 or a hard disk 904.

[0081] In the above case, the method of supplying the computer program to the hardware can be a currently common procedure, such as installing the program in the device via a recording medium 907 such as a CD-ROM, or downloading the program from an external source via a communication line such as the Internet. In such a case, the present invention can be considered to be constituted by the code constituting the computer program or the recording medium 907 on which the code is stored.

[0082] The present invention has been described above using the above-described embodiments as exemplary examples. However, the present invention is not limited to the above-described embodiments. In other words, the present invention can be applied in various aspects that can be understood by a person skilled in the art within the scope of the present invention.

[0083] 1 Program analysis system 10 Program analysis device 11 Identification unit 111 Static analysis unit 1110 Static analysis rule 112 Dynamic analysis unit 1120 Dynamic analysis rule 12 Estimation unit 120 Information propagation estimation rule 13 Storage unit 101 Program 1011 Information transmission function 1012 Information reception function 102 Program 1021 Information transmission function 1022 Information reception function 110 Dynamic analysis test scenario 20 Program execution device 30 Program analysis device 31 Identification unit 311 Static analysis 312 Dynamic analysis 32 Estimation unit 320 Predetermined condition 33 First program 330 Transmission function 34 Second program 340 Reception function 40 Information processing device 900 Information processing device 901 CPU 902 ROM 903 RAM 904 Hard disk (storage device) 905 Communication interface 906 Bus 907 Recording medium 908 Reader / writer 909 Input / output interface

Claims

1. an identification means for identifying an information transmission function included in a first program and an information reception function included in a second program by performing at least one of a static analysis of the first program and the second program and a dynamic analysis of the operation of an information processing device that executes both the first program and the second program; an estimation means for estimating that information is transmitted between the transmitting function and the receiving function when specifications indicated by the identification results regarding the transmitting function and the receiving function satisfy predetermined conditions; A program analysis device comprising:

2. the specifying means specifies, in the static analysis, a specification of an information transmission function representing the transmission function and a specification of an information reception function representing the reception function; the estimation means uses, as the predetermined condition, a condition that a port to which information is sent by the information sending function and a port to which information is received by the information receiving function match. The program analysis device according to claim 1 .

3. the estimation means uses, as the predetermined condition, a condition that an address of a destination of information transmitted by the information transmitting function matches an address of a destination of information transmitted by the information receiving function; The program analysis device according to claim 2 .

4. the identifying means identifies, in the static analysis, an information sending function representing the sending function and an information receiving function representing the receiving function; the estimation means uses, as the predetermined condition, a match between a socket file path related to the information transmission function and a socket file path related to the information reception function. The program analysis device according to claim 1 .

5. The identifying means acquires, in the dynamic analysis, an information transmission status resulting from the execution of an information transmission function representing the transmission function, and an information reception status resulting from the execution of an information reception function representing the reception function, the estimation means uses, as the predetermined condition, that the information transmission function indicated by the transmission status and the information reception function indicated by the reception status are in one-to-one correspondence; The program analysis device according to claim 1 .

6. the estimation means repeatedly estimates a new combination of the transmission function and the reception function through which information is propagated, using a combination of the transmission function and the reception function through which information is propagated, 6. The program analysis device according to claim 5.

7. the estimation means uses, as the predetermined condition, excluding propagation of information between the information sending function and the information receiving function in the same program; 7. The program analysis device according to claim 5 or 6.

8. the estimation means uses an estimation result regarding information propagation based on the result of the static analysis by the identification means to make an estimation regarding information propagation based on the result of the dynamic analysis by the identification means; 3. The program analysis device according to claim 1.

9. By the first information processing device, identifying an information transmission function included in a first program and an information reception function included in a second program by performing at least one of a static analysis of the first program and the second program and a dynamic analysis of the operation of a second information processing device that executes both the first program and the second program; It is estimated that information is transmitted between the transmitting function and the receiving function when the specifications indicated by the identification results regarding the transmitting function and the receiving function satisfy predetermined conditions. Program analysis methods.

10. an identification process for identifying an information transmission function included in a first program and an information reception function included in a second program by performing at least one of a static analysis of the first program and the second program and a dynamic analysis of the operation of an information processing device that executes both the first program and the second program; an estimation process for estimating that information is transmitted between the transmitting function and the receiving function, the specifications of which are indicated by the identification results relating to the transmitting function and the receiving function and which satisfy predetermined conditions; A program analysis program for executing the above on a computer.