Determining device, determining method, and determining program

Abstract

A determining device (10) extracts posts that may be malicious posts from a known Zombified Blog. The determining device (10) then collects websites using a plurality of search queries generated using character strings included in the extracted posts. The determining device (10) subsequently detects malicious posts from posts on the collected websites, and determines that a website in which the number of detected malicious posts is equal to or greater than a predetermined number is a Zombified Blog. This enables the determining device (10) to detect new Zombified Blogs with a high degree of accuracy.

Description

Determination device, determination method, and determination program

[0001] The present invention relates to a device, a method, and a program for determining a Zombified Blog.

[0002] Blogs, one of the most common web content on the Internet, are often left unmanaged. Abandoned or poorly managed blogs can pose a threat to cybersecurity.

[0003] For example, some blogs have a function for posting via email. If an attacker posts a malicious post to such a blog via email and makes it public, there is a risk that users who view this malicious post will be redirected to a malicious site. A blog on which malicious posts are continuously posted like this is called a Zombified Blog.

[0004] Malvertising on Blogspot: Scams, adult content, and exploit kits, [online], [Retrieved January 30, 2024], Internet <URL: https: / / www.malwarebytes.com / blog / news / 2016 / 05 / malvertising-on-blogspot-scams-adult-content-and-exploit-kits> Blogger and WordPress Sites Hacked to Show Sextortion Scams, [online], [Retrieved January 30, 2024], Internet <URL: https: / / www.bleepingcomputer.com / news / security / blogger-and-wordpress-sites-hacked-to-show-sextortion-scams / > Zhu et al., "ChainSmith: Automatically Learning the Semantics of Malicious Campaigns by Mining Threat Intelligence Reports," Proceedings of the 3rd IEEE European Symposium on Security and Privacy (EuroSP), 2018. Shin et al., "#Twiti: Social Listening for Threat Intelligence," Proceedings of the Web Conference 2021 (WWW), 2021. Tang et al., "Clues in Tweets: Twitter-Guided Discovery and Analysis of SMS Spam," Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS), 2022. Nakano et al., "Canary in Twitter Mine: Collecting Phishing Reports from Experts and Non-experts," Proceedings of the 18th International Conference on Availability, Reliability and Security (ARES), 2023.Lee et al., "WarningBird: Detecting suspicious URLs in Twitter Stream," Proceedings of the 19th Network and Distributed System Security Symposium (NDSS), 2012.Gao et al., "Towards Online Spam Filtering in Social Networks," Proceedings of the 19th Annual Network and Distributed System Security Symposium (NDSS), 2012.Lee et al., "D-Fence: A Flexible, Efficient, and Comprehensive Phishing Email Detection System," IEEE European Symposium on Security and Privacy (EuroSP), 2021.Ho et al., "Detecting and Characterizing Lateral Phishing at Scale," Proceedings of the 28th USENIX Security Symposium (USENIX Security), 2019.Duman et al., "EmailProfiler: Spearphishing Filtering with Header and Stylometric Features of Emails," IEEE 40th Annual Computer Software and Applications Conference (COMPSAC), 2016.

[0005] However, none of the existing cybersecurity technologies take into account the characteristics of Zombified Blogs, where malicious posts are continuously posted by attackers to any legitimate blog. As a result, they are unable to detect malicious posts with high accuracy, nor are they able to identify Zombified Blogs.

[0006] For example, there is a technology that extracts elements characteristic of phishing emails from email header information to detect phishing emails (see Non-Patent Documents 9, 10, and 11). It is conceivable that applying such a technology would be able to detect malicious emails. However, emails used to post blogs may lack email header information, attachment information, and the like. Therefore, even if the above technology is applied, it may not be possible to detect malicious emails.

[0007] Therefore, an object of the present invention is to solve the above-mentioned problems and identify Zombified Blogs.

[0008] In order to solve the above-mentioned problems, the present invention is characterized by comprising an extraction unit that extracts posts that may be malicious posts from websites that are known to have malicious posts posted continuously; a collection unit that collects websites using multiple search queries generated using strings contained in the extracted posts; and a determination unit that detects malicious posts from the collected posts on the websites and determines that websites with a predetermined number or more of detected malicious posts are websites where malicious posts are posted continuously.

[0009] According to the present invention, Zombified Blogs can be identified.

[0010] FIG. 1 is a diagram for explaining an overview of a determination device. FIG. 2 is a diagram showing an example of the configuration of a determination device. FIG. 3 is a diagram showing an example of a search query. FIG. 4 is a diagram showing an example of an algorithm for collecting blog feed URLs. FIG. 5 is a diagram for explaining an example of a procedure for determining malicious URLs. FIG. 6 is a diagram showing an example of a processing procedure executed by the determination device. FIG. 7 is a diagram showing an example of a computer that executes a determination program.

[0011] Hereinafter, a mode (embodiment) for carrying out the present invention will be described with reference to the drawings. The present invention is not limited to the embodiment shown below. Note that a Zombified Blog in this embodiment is a blog to which Malicious Posts are continuously posted.

[0012] Although the determination device will be described as collecting URLs of candidate Zombified Blogs from the web, the invention is not limited to this example. For example, the determination device may collect URLs of candidate websites where malicious posts are continuously posted.

[0013] First, an overview of the determination device of this embodiment will be described with reference to Fig. 1. The determination device continuously monitors posts to known Zombified Blogs and extracts new suspicious posts ((1) Extract New Suspicious Posts).

[0014] Next, the determination device generates search queries from the extracted suspicious posts ((2) Generate Search Queries). The search queries here are, for example, search queries that include the titles of the extracted suspicious posts.

[0015] The determination device then uses the generated search query to search a search engine and collect blog posts ((3) Collect Blog Posts). For example, the determination device searches blogs using the search query, extracts URLs of RSS (Rich Site Summary) / ATOM feeds from the blogs, and collects information about posts on the blogs (e.g., blog URLs, blog titles, post titles, post bodies, etc.) from the extracted URLs.

[0016] Finally, the determination device performs a binary classification of the collected blog posts into either Zombified Blogs or Unzombified Blogs based on the information on the posts ((4) Classify Zombified Blogs). For example, the determination device detects malicious posts from the collected blog post information. The determination device then determines blogs with a predetermined number of detected malicious posts or more as Zombified Blogs. On the other hand, the determination device determines blogs with a number of detected malicious posts less than the predetermined number as Unzombified Blogs.

[0017] Such a determination device can detect new Zombified Blogs with high accuracy.

[0018] [Configuration Example] Next, a configuration example of the determination device 10 will be described with reference to Fig. 2. The determination device 10 includes, for example, an input / output unit 11, a communication unit 12, a storage unit 13, and a control unit 14.

[0019] The input / output unit 11 is an interface that controls the input and output of various data. For example, the input / output unit 11 receives input of setting information for the determination device 10 and outputs processing results (e.g., URLs of blogs determined to be Zombified Blogs) by the control unit 14.

[0020] The communication unit 12 is a communication interface for communicating with an external device (for example, a web server that provides a blog) via a network.

[0021] The storage unit 13 stores data, programs, etc. that are referenced when the control unit 14 executes various processes. The storage unit 13 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. For example, the storage unit 13 stores suspicious posts, etc., output from the control unit 14.

[0022] The control unit 14 controls the entire determination device 10. The functions of the control unit 14 are realized, for example, by a central processing unit (CPU) executing a program stored in the storage unit 13.

[0023] [Control Unit] The control unit 14 includes, for example, an extraction unit 141, a query generation unit 142, a collection unit 143, and a determination unit 144.

[0024] [Extraction Unit] The extraction unit 141 extracts posts (suspicious posts) that may be malicious posts from known Zombified Blogs. For example, the extraction unit 141 extracts suspicious posts by performing the following steps 1-1 to 1-5.

[0025] 1-1: The extraction unit 141, for example, continuously monitors new posts in known Zombified Blogs.

[0026] 1-2: The extraction unit 141 extracts new posts whose titles are equal to or longer than a predetermined number of characters from among new posts in known Zombified Blogs obtained by monitoring 1-1.

[0027] 1-3: The extraction unit 141 extracts character strings corresponding to URLs (character strings beginning with "http") from the text of the post extracted in 1-2, and excludes URLs that are clearly legitimate sites from the extracted URL character strings. For example, the Tranco List described in the following literature 1 can be used as a whitelist indicating the URLs of legitimate sites.

[0028] Reference 1: Pochat et al., Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation, Proceedings of the 26th Network and Distributed System Security Symposium (NDSS), 2019.

[0029] 1-4: The extraction unit 141 also extracts a character string that corresponds to a Bitcoin (registered trademark) wallet address (25 to 36 alphanumeric characters) from the body of the post extracted in 1-2.

[0030] 1-5: The extraction unit 141 outputs a post that satisfies 1-2 and contains the character string extracted in either 1-3 or 1-4 as a suspicious post.

[0031] [Query Generation Unit] The query generation unit 142 generates search queries from the suspicious posts extracted by the extraction unit 141. For example, the query generation unit 142 generates multiple search queries by executing the following steps 2-1 to 2-4.

[0032] 2-1: The query generation unit 142 acquires the title of the suspicious post extracted by the extraction unit 141.

[0033] 2-2: The query generation unit 142 generates search queries for extensive searching and search queries for more in-depth searching using the titles of the suspicious posts acquired in 2-1.

[0034] 2-3: In Extensive Searching, the query generation unit 142 generates search queries in three patterns, for example, as shown by reference numeral 301 in Figure 3: a pattern in which the title of the suspicious post is used as the search query directly (pattern A), a pattern in which the title of the suspicious post is searched using the title tag (pattern B), and a pattern in which an exact match search of the title of the suspicious post is performed (pattern C).

[0035] 2-4: In addition, in More In-depth Searching, the query generation unit 142 generates the above three patterns of search queries (patterns D, E, and F) targeting pages under a specific domain name, as shown by reference numeral 302 in FIG. 3 .

[0036] The specific domain name here is, for example, the pay-level domain name of the well-known Zombified Blog. Note that a pay-level domain name is the smallest domain name that a user can purchase (e.g., example.com, example.co.uk).

[0037] [Collection Unit] Returning to the explanation of Fig. 2, the collection unit 143 collects URLs of blogs that are candidates for Zombified Blogs and information about posts on those blogs through a search engine, using the search queries generated by the query generation unit 142. For example, the collection unit 143 collects URLs of blogs that are candidates for Zombified Blogs and information about posts on those blogs by executing the steps shown in 3-1 to 3-4 below.

[0038] 3-1: The collection unit 143 acquires the results of a search performed by a search engine using the search queries generated by the query generation unit 142. The search engine used may be Google (registered trademark) search, Bing search, or the like.

[0039] 3-2: Next, the collection unit 143 receives the list of URLs obtained in 3-1 (list of URLs of candidate Zombified Blogs) as input, and extracts the feed URLs of the blogs for the searched URLs, for example, using Algorithm 1 shown in Figure 4.

[0040] For example, first, the collection unit 143 accesses the URL of the search result to obtain HTML, extracts the URL from the "a" tag and the "link" tag, and sets it as a candidate for the feed URL. Next, the collection unit 143 adds a character string (e.g., index.xml, rss.xml, etc.) that is common to feed URLs to the end of the extracted URL, and sets it as a candidate for the feed URL. Finally, the collection unit 143 accesses the candidate for the feed URL, <rss> 、 <rdf> 、 <feed>If any of the tags exists, the feed URL candidate is extracted as the feed URL.

[0041] 3-3: Next, the collection unit 143 collects the following six pieces of information from the blog feed URL extracted in 3-2. Note that for efficient information collection, for example, the feed parser described in the following document 2 can be used.

[0042] Reference 2: kurtmckee / feedparser: Parse feeds in Python, https: / / github.com / kurtmckee / feedparser

[0043] Information collected: Blog URL, blog title, post title, post body, post date and time, post URL

[0044] 3-4: Next, the collection unit 143 further extracts the following three pieces of information for each blog post from the information collected in 3-3.

[0045] The preprocessed post body with HTML tags removed, the target URL extracted using regular expressions from the preprocessed post body and within the a tag of the HTML tag, and the target Bitcoin wallet address extracted using regular expressions from the preprocessed post body.

[0046] [Determination Unit] The determination unit 144 detects malicious posts from blog posts collected by the collection unit 143, and determines that a blog in which the number of detected malicious posts is equal to or greater than a predetermined number is a zombified blog.

[0047] For example, if the URL of a website described in a blog post is determined to be the URL of a malicious website based on external threat information, or if the URL is determined to be the URL of a website linked to the same resource as a website determined to be malicious based on past analysis, the determination unit 144 detects the post as a malicious post.The determination unit 144 then determines a blog in which the number of detected malicious posts is equal to or greater than a predetermined number as a zombified blog.

[0048] For example, the determination unit 144 determines whether or not the blog collected by the collection unit 143 is a Zombified Blog by executing the following steps 4-1 to 4-5.

[0049] 4-1: The determination unit 144 uses the information on the blogs and posts in the blogs collected by the collection unit 143 to identify malicious posts by the following processes 4-2, 4-3, and 4-4.

[0050] 4-2: The determination unit 144 uses multiple antivirus engines to inspect the target URLs (URLs listed in the body of blog posts) collected by the collection unit 143, and determines whether or not they are judged to be malicious by a predetermined number of or more antivirus engines. For example, VirusTotal, described in the following document 3, can be used for the inspection.

[0051] Reference 3: VirusTotal, https: / / www.virustotal.com /

[0052] 4-3: The determining unit 144 identifies a URL that is linked to the same resource as the attacker among the URLs to be investigated that are collected by the collecting unit 143, and determines that the URL is a malicious URL.

[0053] For example, as shown in FIG. 5, if the pay-level domain name of the URL under investigation is identical to the pay-level domain name (e.g., malicious.example) of any domain name (e.g., evil.malicious.example) that was determined to be malicious in a previous analysis ((1)), the determination unit 144 determines that the URL under investigation is a malicious URL.

[0054] For example, if the URL under investigation is target.malicious.example, the pay-level domain name of the URL is the same as the pay-level domain name (malicious.example) of a domain name (evil.malicious.example) that was determined to be malicious in a previous analysis, so the determination unit 144 determines that the URL under investigation is a malicious URL.

[0055] Next, the determination unit 144 acquires an IP address (e.g., 192.0.2.255) associated with the A record of a domain name (e.g., evil.malicious.example) that was determined to be malicious in a previous analysis. The determination unit 144 then checks whether the acquired IP address has been determined to be malicious (a malicious IP address) by a predetermined number or more of antivirus engines.

[0056] Then, if the acquired IP address (e.g., 192.0.2.255) is determined to be a malicious IP address and the IP address linked to the A record of the domain name of the target URL (e.g., http: / / target.evil.example) is the same as the IP address (e.g., 192.0.2.255) ((2)), the determination unit 144 determines that the target URL is a URL of the same resource as the attacker ((3)). In other words, the determination unit 144 determines that the target URL is a malicious URL.

[0057] On the other hand, if the pay-level domain name of the URL under investigation is different from the pay-level domain name of a domain name determined to be malicious in a previous analysis, the determination unit 144 determines that the URL under investigation is not a malicious URL.

[0058] For example, consider the case where the URL to be investigated is http: / / target.legitimate.example. In this case, if legitimate.example is different from the pay-level domain name of any domain determined to be malicious in past analyses, the determination unit 144 determines that the URL to be investigated is not a malicious URL (an unrelated URL).

[0059] Furthermore, even if the IP address associated with the domain name of the URL under investigation is the same as the IP address (e.g., 192.0.2.128) associated with a domain name determined to be malicious in a past analysis, if the IP address has not been determined to be malicious by a predetermined number or more of antivirus engines ((4) Non-malicious IP address), the determination unit 144 determines that the URL under investigation is not a malicious URL (an unrelated URL) ((5)).

[0060] 4-4: The determination unit 144 checks whether or not there are any fraud reports for the Bitcoin wallet address to be investigated collected by the collection unit 143. Whether or not there are any fraud reports can be determined using, for example, BitcoinWhosWho described in the following literature 4.

[0061] Document 4: Bitcoin Address Lookup, Checker and Scam Reports BitcoinWhosWho, https: / / www.bitcoinwhoswho.com /

[0062] 4-5: Finally, the determination unit 144 determines that a blog that has a predetermined number or more of posts that fit any of the above 4-2, 4-3, and 4-4 is a Zombified Blog. On the other hand, the determination unit 144 determines that a blog that has less than a predetermined number of posts that fit any of the above 4-2, 4-3, and 4-4 is an Unzombified Blog.

[0063] According to the determination device 10, new Zombified Blogs can be detected with high accuracy.

[0064] [Example of Processing Procedure] Next, an example of processing procedure executed by the determination device 10 will be described with reference to FIG.

[0065] First, the extraction unit 141 of the determination device 10 extracts posts (suspicious posts) that may be malicious posts from known zombified blogs (S1). Next, the query generation unit 142 generates a search query from the suspicious posts extracted in S1 (S2). Thereafter, the collection unit 143 collects blogs using the search query generated in S2 (S3). For example, the collection unit 143 inputs the search query into a search engine to search for blogs that are publicly available on the Internet.

[0066] Next, the determination unit 144 detects malicious posts from the blog posts collected in S3 (S4). Here, the determination unit 144 determines whether the number of malicious posts detected from the blog is equal to or greater than a predetermined number (S5). If the determination unit 144 determines that the number of malicious posts detected from the blog is equal to or greater than the predetermined number (Yes in S5), the determination unit 144 determines that the blog is a Zombified Blog (S6). On the other hand, if the determination unit 144 determines that the number of malicious posts detected from the blog is less than the predetermined number (No in S5), the determination unit 144 determines that the blog is not a Zombified Blog (S7).

[0067] By performing the above process, the determination device 10 can detect a new Zombified Blog.

[0068] [System Configuration, etc.] The components of each unit shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program executed by the CPU, or can be realized as hardware using wired logic.

[0069] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0070] [Program] The above-described determination device 10 can be implemented by installing a program (determination program) as package software or online software on a desired computer. For example, by executing the above-described program on a computer, the computer can function as the determination device 10. The term "computer" as used herein includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as terminals such as PDAs (Personal Digital Assistants).

[0071] 7 is a diagram showing an example of a computer that executes a determination program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0072] The memory 1010 includes a read-only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input / output system (BIOS). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0073] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define the processes executed by the determination device 10 are implemented as program modules 1093 in which computer-executable code is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to those of the functional configuration of the determination device 10 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0074] Data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary and executes them.

[0075] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0076] REFERENCE SIGNS LIST 10 Determination device 11 Input / output unit 12 Communication unit 13 Storage unit 14 Control unit 141 Extraction unit 142 Query generation unit 143 Collection unit 144 Determination unit< / feed> < / rdf> < / rss>

Claims

1. A determination device comprising: an extraction unit that extracts posts that may be malicious posts from websites known to have malicious posts posted continuously; a collection unit that collects websites using multiple search queries generated using strings contained in the extracted posts; and a determination unit that detects malicious posts from the collected posts on the websites and determines that websites with a predetermined number or more of detected malicious posts are websites where malicious posts are posted continuously.

2. The determination device described in claim 1, characterized in that the determination unit detects the post as a malicious post if the website mentioned in the post is determined to be a malicious website based on external threat information, or if the website is determined to be linked to the same resource as a website determined to be malicious based on past analysis.

3. A determination method executed by a determination device, comprising the steps of: extracting posts that may be malicious posts from websites known to have malicious posts posted continuously; collecting websites using multiple search queries generated using strings contained in the extracted posts; detecting malicious posts from the collected posts on the websites, and determining that websites with a predetermined number or more of detected malicious posts are websites on which malicious posts are posted continuously.

4. A determination program for causing a computer to execute the following steps: extracting posts that may be malicious posts from websites known to have malicious posts posted continuously; collecting websites using multiple search queries generated using strings contained in the extracted posts; detecting malicious posts from the collected posts on the websites, and determining that websites with a predetermined number or more of detected malicious posts are websites where malicious posts are posted continuously.

Images