Determination device

Abstract

This determination device receives inputs of a domain name to be determined, a determination result as to whether or not the domain name is malicious, and a date and time serving as a reference for determining whether or not the determination result is valid. Thereafter, the determination device collects the operation history for the domain name. The determination device refers to the collected operation history for the domain name, and identifies a change in the operation of the domain name in a predetermined period up to the date and time. Thereafter, when the identified change in the operation of the domain name exceeds a predetermined range, the determination device determines that the determination result as to whether or not the domain name is malicious is not valid. Meanwhile, when the identified change in the operation of the domain name is within the predetermined range, the determination device determines that the determination result as to whether or not the domain name is malicious is valid.

Description

Judgment device

[0001] The present invention relates to a determination device for determining whether a determination result as to whether a domain name is malicious or not is valid or not.

[0002] To date, many techniques for detecting malicious domain names using machine learning have been proposed. For example, there is a technique that uses the characteristics of malicious domain names themselves or information related to malicious domain names to learn the characteristics of malicious domain names and determine whether a new domain name is malicious (Patent Documents 1 and 2). These techniques make it possible to identify domain names that have been involved in malicious activities with a certain degree of accuracy.

[0003] Patent No. 6196008 Patent No. 6315640

[0004] However, because the above technology makes its judgments based on a large amount of learning data accumulated over time, there is a possibility that domain names previously determined to be malicious may still be determined to be malicious (falsely detected) even if they have expired or been sanitized. Furthermore, the above technology may not determine (overlook) a domain name that was previously used for legitimate services as malicious if it is reacquired and abused. In other words, the results of the above technology's determination of whether a domain name is malicious or not are not necessarily reliable (effective).

[0005] Therefore, an object of the present invention is to solve the above-mentioned problems and to determine whether the result of determining whether a domain name is malicious or not is valid or not.

[0006] In order to solve the above-mentioned problems, the present invention is characterized by comprising a data input unit that accepts input of a domain name to be judged, a judgment result as to whether the domain name is malicious or not, and a date and time that is used as a reference for judging whether the judgment result is valid or not; a collection unit that collects the operation history of the domain name; an identification unit that refers to the collected operation history of the domain name and identifies changes in the operation of the domain name during a specified period up to the date and time; and a judgment unit that judges that the judgment result as to whether the domain name is malicious or not is invalid if the identified change in the operation of the domain name exceeds a specified range.

[0007] According to the present invention, it is possible to determine whether the result of determining whether a domain name is malicious is valid or not.

[0008] Fig. 1 is a diagram illustrating an overview of processing executed by a determination device. Fig. 2 is a diagram illustrating an example of the configuration of the determination device. Fig. 3 is a diagram illustrating an example of a domain timeline. Fig. 4 is a diagram illustrating an example of processing procedures executed by the determination device. Fig. 5 is a diagram illustrating an example of a computer that executes a determination program.

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a description will be given of an embodiment of the present invention with reference to the drawings, but the present invention is not limited to the embodiment.

[0010] [Overview] An overview of the processing executed by the determination device of this embodiment will be described with reference to Fig. 1. The determination device determines whether the determination result of whether a domain name acquired from a conventional technique or an external organization is malicious or not is valid.

[0011] First, the determination device accepts inputs of, for example, prior art, a domain name, a determination result of whether the domain name is malicious or not (malicious determination result) made by an external organization, and information indicating the date and time used as the basis for determining whether the malicious determination result is valid (determination date and time) (S1: input of domain name and determination date and time). The determination device also collects historical data related to the use of the domain name (S2). For example, the determination device collects historical data related to the domain name, such as WHOIS records, DNS (Domain Name System) records, and TLS (Transport Layer Security) certificates.

[0012] The determination device then references the WHOIS record, DNS record, and historical data of the TLS certificate for the domain name collected in S2 to construct a Domain Timeline (see Figure 3) showing the life cycle of the domain name (S3).

[0013] Then, the determination device refers to the Domain Timeline constructed in S3 and identifies whether there has been a significant change in the life cycle of the domain name before or after the above-mentioned determination date and time (S4: life cycle change identification).

[0014] Thereafter, the determination device determines whether the maliciousness determination result of the domain name at the determination date and time is valid or not based on the result of the identification in S4 (S5: the maliciousness determination result of the domain name is valid or invalid).

[0015] For example, if the determination device determines in S4 that there has been a major change in the life cycle of the domain name around the above-mentioned determination date and time, it determines that the maliciousness determination result for the domain name at the above-mentioned determination date and time is invalid.On the other hand, if the determination device determines in S4 that there has not been a major change in the life cycle of the domain name around the above-mentioned determination date and time, it determines that the maliciousness determination result for the domain name at the above-mentioned determination date and time is valid.

[0016] For example, in the Domain Timeline shown in Figure 3, as of 2022-11-22, the target domain name has had a change of Registrar, an expired Creation Date and re-registered, an expired Expiry Date, a change of MNAME, an issuer.O, and a change of Not After within the past year.

[0017] Therefore, the maliciousness determination result of the domain name as of 2022-11-22 is not necessarily reliable. Therefore, the determination device determines that the maliciousness determination result of the domain name is invalid.

[0018] On the other hand, if there is no significant change in the lifecycle of the domain name as of 2022-11-22, the maliciousness determination result of the domain name is considered to be reliable to a certain extent. Therefore, the determination device determines that the maliciousness determination result of the domain name is valid.

[0019] According to such a determination device, it is possible to determine whether the determination result as to whether a domain name is malicious or not is valid based on the past life cycle fluctuations of the domain name.

[0020] [Configuration Example] Next, a configuration example of the determination device 10 will be described with reference to Fig. 2. The determination device 10 includes, for example, an input / output unit 11, a communication unit 12, a storage unit 13, and a control unit 14.

[0021] The input / output unit 11 is an interface that controls the input and output of various data. For example, the input / output unit 11 accepts input of a domain name, a maliciousness determination result for the domain name, a determination date and time, etc. The input / output unit 11 also outputs the processing result by the control unit 14 (for example, a determination result as to whether the maliciousness determination result for the domain name is valid or not).

[0022] The communication unit 12 is an interface used when the determination device 10 communicates data with external devices. For example, the communication unit 12 acquires historical data such as WHOIS records, DNS records, and TLS certificates related to a specified domain name from various servers via a network.

[0023] The storage unit 13 stores data, programs, etc. that are referenced when the control unit 14 executes various processes. The storage unit 13 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. For example, the storage unit 13 stores the domain name received by the input / output unit 11, the maliciousness determination result of the domain name, the determination date and time, etc.

[0024] The control unit 14 is responsible for overall control of the determination device 10. The functions of the control unit 14 are realized, for example, by a CPU (Central Processing Unit) executing a program stored in the storage unit 13. The control unit 14 includes, for example, a data input unit 141, a collection unit 142, a timeline construction unit 143, an identification unit 144, and a determination unit 145.

[0025] [Data Input Unit] The data input unit 141 accepts input of a domain name to be judged, a maliciousness judgment result for the domain name, and a judgment date and time for determining whether the maliciousness judgment result is valid. For example, the data input unit 141 accepts input of a domain name, a maliciousness judgment result for the domain name based on prior art or an external organization ("non-malicious"), and the judgment date and time ("2022-11-22").

[0026] [Collection Unit] The collection unit 142 collects the operation history of the domain name to be judged. For example, the collection unit 142 collects historical data of the WHOIS record, DNS record, and TLS certificate related to the domain name.

[0027] For example, the collection unit 142 collects historical data of the WHOIS records, DNS records, and TLS certificates related to the domain name by using a service that collects, aggregates, and provides WHOIS records, DNS records, TLS certificates, etc. The collection unit 142 may also actively collect the WHOIS records, DNS records, and TLS certificates of the domain names to be collected without using the above-mentioned service.

[0028] [Timeline Construction Unit] The timeline construction unit 143 refers to the operation history of the domain name collected by the collection unit 142 (e.g., historical data such as WHOIS records, DNS records, and TLS certificates) and constructs a Domain Timeline (see Figure 3) that shows changes in each item in the operation history.

[0029] The Domain Timeline is information that shows, for example, the chronological changes in domain name registration, DNS settings, TLS certificates, etc. for a certain domain name. This Domain Timeline is used to understand the life cycle of a domain name.

[0030] For example, the timeline construction unit 143 tracks when and how the registration information of the domain name itself in the WHOIS record, such as 'Registrar', 'Creation Date', 'Expiry Date', and 'Domain Status', has changed.

[0031] Furthermore, the timeline construction unit 143 tracks when and how 'MNAME', 'RNAME', and 'SERIAL' in the DNS SOA (Start Of Authority) record in the DNS record have changed.

[0032] In addition, the timeline construction unit 143 tracks when and how 'Issuer.C', 'Issuer.CN', 'Issuer.O', 'validity.not_before', 'validity.not_after', and 'Subject.CN' have changed among the certificates that are currently required for use in TLS certificates on Web / HTTPS.

[0033] Then, the timeline construction unit 143 constructs a Domain Timeline (see FIG. 3) that shows the tracking results of each of the above items in chronological order. Note that the timeline construction unit 143 may construct a Domain Timeline that includes tracking results of other items in addition to the above items.

[0034] [Domain Timeline Example] Figure 3 shows an example of the Domain Timeline for a certain domain name. The domain name in question had been used for legitimate purposes for over 10 years, but was dropped and caught by an attacker, left unused for about a year, and then suddenly used for malicious purposes.

[0035] For example, the WHOIS timeline of the Domain Timeline shown in Figure 3 shows that the registrar changed from Foo Inc. to Bar Ltd. at some point. We can also see that the Creation Date was maintained at 2009-10-10, but expired and was re-registered on 2021-12-28. We can also see that the Expiry Date was extended every year from 2019-10-10 to 2021-10-10, but then expired.

[0036] Also, from the SOA timeline of the Domain Timeline shown in FIG. 3, it can be seen that the MNAME changed from ns.foo.test to ns.suspended.test, and then changed to ns.bar.test.

[0037] Furthermore, the transitions between Issuer.0 and Not After in the TLS timeline shown in Figure 3 reveal that the domain name registrar began using the BazCert Corp. certificate while it was still Foo Inc., but there were gaps due to the certificate expiring several times. It also reveals that the certificate expired (2021-06-03) before the domain name expired (2021-10-10). Furthermore, it reveals that the domain name registrar changed from Foo Inc. to Bar Ltd. some time later, and the QuxCert Inc. certificate began to be activated.

[0038] [Identification Unit] Returning to the explanation of Fig. 2, the identification unit 144 refers to the Domain Timeline of the domain name constructed by the timeline construction unit 143, and identifies changes in the use of the domain name in the predetermined period up to the above-mentioned determination date and time.

[0039] For example, the identification unit 144 refers to historical data of the WHOIS record, DNS record, and TLS certificate at each point in the domain name's domain timeline, and identifies whether there have been any major changes in the lifecycle before or after the above-mentioned determination date and time.

[0040] This identification can be achieved, for example, by the identification unit 144 detecting whether each item in the Domain Timeline has changed within a predetermined period prior to the above-mentioned determination date and time. The predetermined period can be set to any period, such as the past day, week, month, or year, for each item in the Domain Timeline.

[0041] For example, the identification unit 144 identifies from the Domain Timeline shown in Figure 3 that during a specified period up to the judgment date and time '2022-11-22', the Registrar of the domain name has changed, the Creation Date has expired and been re-registered, the Expiry Date has expired, the MNAME has changed, the Issuer.O has changed, the Not After has changed, the Subject.CN has changed, etc.

[0042] [Determination Unit] The determination unit 145 determines whether the maliciousness determination result of the domain name is valid or not, based on the change in the use of the domain name identified by the identification unit 144.

[0043] In other words, the determining unit 145 determines whether the maliciousness determination result of the domain name at the determination date and time is consistent with the time series of changes in the life cycle during the predetermined period up to the determination date and time.

[0044] For example, if the change in the use of the domain name identified by the identification unit 144 exceeds a predetermined range, the determination unit 145 determines that the maliciousness determination result of the domain name is invalid. On the other hand, if the change in the use of the domain name identified by the identification unit 144 is within a predetermined range, the determination unit 145 determines that the maliciousness determination result of the domain name is valid.

[0045] For example, if the changes in the operation of the domain name during the predetermined period up to the above-mentioned judgment date and time identified by the identification unit 144 include a change in the Registrar, a re-registration due to the expired Creation Date, an expired Expiry Date, a change in MNAME, a change in Issuer.O, or a change in Not After, the determination unit 145 determines that the maliciousness determination result for the domain name is invalid. Then, the determination unit 145 outputs the determination result.

[0046] The above determination process is merely an example, and the determination unit 145 may make a determination using a determination threshold set according to the type, period, and importance of the change in domain name operation. The determination result by the determination unit 145 is output as a binary classification result indicating, for example, whether the maliciousness determination result at the determination date and time is valid.

[0047] 4, an example of a processing procedure executed by the determination device 10 will be described. First, the determination device 10 accepts input of a domain name to be determined by the determination device 10, a maliciousness determination result for the domain name, and a determination date and time for determining whether the maliciousness determination result is valid (S11).

[0048] After S11, the collection unit 142 collects the operation history of the domain name to be judged (S12). Thereafter, the timeline construction unit 143 refers to the operation history of the domain name collected in S12 and constructs a Domain Timeline of the domain name (S13).

[0049] After S13, the identification unit 144 identifies changes in the use of the domain name during the predetermined period up to the above-mentioned judgment date and time (S14). Thereafter, the judgment unit 145 judges whether the changes in the use of the domain name identified in S14 exceed a predetermined range (S15). If the judgment unit 145 determines in S15 that the changes in the use of the domain name do not exceed the predetermined range (No in S15), it judges that the maliciousness judgment result of the domain name is valid (S16). On the other hand, if the judgment unit 145 determines that the changes in the use of the domain name exceed the predetermined range (Yes in S15), it judges that the maliciousness judgment result of the domain name is invalid (S17).

[0050] By executing the above process, the determination device 10 can determine whether the maliciousness determination result of the domain name is valid or not.

[0051] [System Configuration, etc.] The components of each unit shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program executed by the CPU, or can be realized as hardware using wired logic.

[0052] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0053] [Program] The above-described determination device 10 can be implemented by installing a program (determination program) as package software or online software on a desired computer. For example, by executing the above-described program on an information processing device, the information processing device can function as the determination device 10. The information processing device referred to here includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as terminals such as PDAs (Personal Digital Assistants).

[0054] 5 is a diagram showing an example of a computer that executes a determination program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0055] The memory 1010 includes a read-only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input / output system (BIOS). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0056] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define the processes executed by the determination device 10 are implemented as program modules 1093 in which computer-executable code is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to those of the functional configuration of the determination device 10 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0057] Data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary and executes them.

[0058] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0059] The functions of the elements disclosed herein may be implemented using circuitry or processing circuitry including general-purpose processors, special-purpose processors, integrated circuits, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), conventional circuits, and / or combinations thereof that are programmed using one or more programs stored in one or more memories or otherwise configured to perform the disclosed functions. A processor is considered processing circuitry or circuitry because it includes transistors and other circuitry. A processor may also be a programmed processor that executes a program stored in a memory. In this disclosure, a circuit, unit, or means is hardware that performs the recited functions or hardware that is programmed to perform the recited functions. The hardware may be any hardware disclosed herein that is programmed or configured to perform the recited functions.

[0060] There is a memory that stores a computer program including computer instructions. These computer instructions provide the logic and routines that enable hardware (e.g., processing circuitry or circuitry) to perform the methods disclosed herein. The computer program may be implemented in commonly known forms as a computer-readable storage medium, a computer program product, a memory device, a recording medium such as a CD-ROM or DVD, and / or memory in an FPGA or ASIC.

[0061] REFERENCE SIGNS LIST 10 Determination device 11 Input / output unit 12 Communication unit 13 Storage unit 14 Control unit 141 Data input unit 142 Collection unit 143 Timeline construction unit 144 Identification unit 145 Determination unit

Claims

1. A judgment device characterized by comprising: a data input unit that accepts input of a domain name to be judged, a judgment result as to whether the domain name is malicious or not, and a date and time that is used as the basis for judging whether the judgment result is valid or not; a collection unit that collects the operation history of the domain name; an identification unit that refers to the collected operation history of the domain name and identifies changes in the operation of the domain name during a specified period up to the date and time; and a judgment unit that judges that the judgment result as to whether the domain name is malicious or not is invalid if the identified changes in the operation of the domain name exceed a specified range.

2. The judgment device described in claim 1, characterized in that the judgment unit judges that the judgment result of whether the domain name is malicious or not is valid if the change in the operation of the identified domain name is within a predetermined range.

3. The determination device described in claim 1, characterized in that the domain name operation history is the operation history of the domain name recorded in at least one of a WHOIS record, a DNS (Domain Name System) record, and a TLS (Transport Layer Security) certificate.

4. The determination device described in claim 3, characterized in that the identification unit: identifies when and how at least one of the Registrar, Creation Date, Expiry Date, and Domain Status of the domain name in the WHOIS record changed; identifies when and how at least one of the MNAME, RNAME, and SERIAL in the SOA record of the domain name in the DNS record changed; and identifies when and how at least one of Issuer.C, Issuer.CN, Issuer.O, validity.not_before, validity.not_after, and Subject.CN of the domain name in the TLS certificate changed.

Images