User Agent String Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware communication detection systems are limited in their applicability due to the requirement for a special browser capable of executing authentication programs, which can lead to communication disruptions and inability to detect disguised malware in various environments.
Innovation Solution
An information processing device and system that calculates the degree of possibility of a user agent being genuine based on communication history, including identifiers and user agent strings, to identify and notify on fake user agents impersonating practical user agents, allowing for detection across diverse environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a special browser capable of executing authentication programs is used for malware communication detection, then the ability to detect disguised malware is improved, but the adaptability to different environments deteriorates and communication may be disrupted
Solution Approach 1:
The patent creates a copy of the browser's user agent information (user agent string) and analyzes it separately through the authentication program. Instead of requiring the actual browser to execute the authentication program, the system copies the relevant identification information from the browser's request header and performs the authentication analysis on this copied data, thereby eliminating the need for special browser modifications while maintaining detection capability
Solution Approach 2:
The patent extracts the user agent string from the browser's request header and separates it from the actual browser execution context. By taking out this identification information and analyzing it independently through the authentication program, the system achieves malware detection without requiring the browser itself to be modified or to execute special authentication code
2Reliability
If communication is monitored through proxy server with authentication program execution, then malware detection capability is improved, but system complexity increases
Solution Approach 1:
The patent introduces the user agent string as an intermediary element between the browser and the authentication program. Instead of requiring direct execution of authentication programs in the browser or complex integration, the user agent string serves as a mediator that carries identification information from the browser request to the authentication analysis, simplifying the overall system architecture while maintaining security detection capability
Data Source
AI summary
An information processing device of the present invention includes: a degree-of-possibility calculation unit that calculates, based on a history of communication between a client and a server, the history including at least an identifier of the server, an identifier of the client, and a user agent character string included in a request header sent from the client, a degree of possibility that indicates a degree of certainty of a practical user agent permitted to operate as a portion of the client, with respect to each user agent that relates to the user agent character string; and a disguise information notification unit that outputs, based on the basis of the degree of possibility, disguise information that is information regarding communication performed by a fake user agent impersonating the practical user agent.