Malware communication analyzer and malware communication analysis method

The present invention relates to a technique for identifying information leaked to the outside from malware when malware infection of an information processing terminal connected to the Internet is discovered.

As a conventional technique for analyzing malware, for example, Patent Document 1 shows a method of executing malware in a special experimental environment and recording a system call, a history of computer resource usage, and a message sent to a remote terminal. ing.

In addition, recently, information leakage incidents due to targeted attacks using malware have frequently occurred. When an infection caused by malware is discovered, it is necessary to identify the information in the data when the data is transmitted from the malware to the outside. For this purpose, it is necessary to record the communication performed by the information processing terminals on the Internet and the network in the organization, and extract and analyze the communication record of the terminal infected with malware. Some of these malware have a decryption function that is paired with the encryption function inside and encrypt the communication with the outside, and if you do not analyze the malware and identify the encryption key and decryption function, it will actually be It is not possible to clarify what the content of the communicated information is.

Regarding the technique for identifying such an encryption key and a decryption function, in Patent Document 2, malware is executed, an encryption key candidate is specified from the trace information at that time, and the decryption function in the identified malware is used to perform malware. A method of decrypting a communication and identifying a key from the result is disclosed.

<p num="0005"><patcit num="1"><text>Japanese Patent No. 4755658</text></patcit><patcit num="2"><text>Japanese Unexamined Patent Publication No. 2013-114637</text></patcit></p>

<p num="0006"> In the conventional technology, it is necessary to actually operate the malware and analyze the communication contents of the malware recorded during the operation. Therefore, it is necessary to obtain an actual sample of the malware and construct a malware execution environment. .. For this reason, there is a problem that it takes time and cost to analyze the communication contents of malware, and the analysis is not efficient.</p><p num="0007"> The present invention has been made to solve the above-mentioned problems, and an object of the present invention is to efficiently identify the communication content performed by malware without actually operating the malware.</p>

<p num="0008"> In order to solve the above-mentioned problems, the malware communication analysis device of the present invention is used by the data and the key extraction information that describes the signature that describes the characteristics of the communication performed by the malware and the method of extracting the encryption key from the communication packet. Generated by the malware information database that stores the decryption function information, which is the information of the decryption function, the packet analysis unit that analyzes the communication packet and generates the packet analysis data that stores the analysis result, and the packet analysis unit. A packet comparison unit that compares the packet analysis data and the signature stored in the malware information database to determine whether or not they match, and the packet analysis data and the signature by the packet comparison unit. When it is determined that the two match, the key extraction unit that extracts the encryption key from the packet analysis data using the key extraction information associated with this signature, and the encryption key and the packet extracted by the key extraction unit. It is provided with a decoding unit that decodes the encrypted text of the packet analysis data by using the decoding function information associated with the signature that is determined to match the packet analysis data by the comparison unit.</p><p num="0009"> Further, the malware communication analysis method of the present invention includes a signature that describes the characteristics of communication performed by the malware, key extraction information that describes a method of extracting an encryption key from a communication packet, and a decryption function that is information on a decryption function used by the malware. This is a malware communication analysis method of a malware communication analyzer that decrypts the coded text of the communication packet using a malware information database that stores information in association with each other. The packet analysis unit analyzes and analyzes the communication packet. The packet analysis step that generates the packet analysis data that stores the result and the packet comparison unit compare the packet analysis data generated by the packet analysis step with the signature stored in the malware information database, and both of them compare. When the packet comparison step for determining whether or not they match and the key extraction unit determines that the packet analysis data and the signature match by the packet comparison step, the key extraction information associated with this signature is used. A key extraction step for extracting an encryption key from the packet analysis data using the data, and the signature determined by the decryption unit to match the packet analysis data with the encryption key extracted by the key extraction step and the packet comparison step. It is provided with a decryption step of decrypting the encrypted text of the packet analysis data by using the decryption function information associated with.</p>

<p num="0010"> According to the present invention, the characteristics of malware communication obtained from the results of analyzing a plurality of malwares, the method of extracting the encryption key for each malware, and the decryption function extracted from the malware are registered in the database, and the malware communication is performed. By collating the characteristics of the malware with the communication record of the malware to identify the type of malware, and using the encryption key extraction method and decryption function suitable for the identified malware, the encrypted communication is actually decrypted. It has the effect of being able to efficiently identify the communication content performed by the malware without operating the malware.</p>

<figref num="1">It is a block diagram which shows one Example of the malware communication analysis apparatus which concerns on Embodiment 1. FIG.</figref><figref num="2">It is a figure which shows the data structure of the packet analysis data 9.</figref><figref num="3">It is a block diagram which shows one configuration example of the malware information database 3 which concerns on Embodiment 1.</figref><figref num="4">It is a figure which shows the data structure of execution control information 20.</figref><figref num="5">It is a block diagram which shows one structural example of a key extraction part 5.</figref><figref num="6">It is a structural diagram which shows one structural example of a decoding unit 6.</figref><figref num="7">It is a flowchart which shows the process flow of the malware communication analysis apparatus which concerns on Embodiment 1.</figref><figref num="8">It is a flowchart which shows the process flow of the decoding unit 6.</figref><figref num="9">It is a block diagram which shows one Example of the malware communication analysis apparatus which concerns on Embodiment 2. FIG.</figref><figref num="10">It is a block diagram which shows one configuration example of the malware information database 3 which concerns on Embodiment 2.</figref>

Embodiment 1. FIG. 1 is a configuration diagram showing an embodiment of the malware communication analysis device according to the first embodiment. The malware communication analysis device 1 is composed of a packet analysis unit 2, a malware information database 3, a packet comparison unit 4, a key extraction unit 5, a decryption unit 6, and a result output unit 7. The packet recording data 8 is input to the packet analysis unit 2, the packet analysis unit 2 analyzes the packet information, and outputs the packet analysis data 9.

The packet recording data 8 is data in which communication packets with the Internet are recorded. Here, any means may be used as the means for acquiring the communication packet. Further, the data in which the communication packet is recorded may be the data acquired in the past or the data acquired in real time.

The packet analysis unit 2 extracts packets from the packet recording data 8 in the order in which they were recorded, and generates packet analysis data 9. FIG. 2 is a diagram showing a data structure of packet analysis data 9. The packet analysis data 9 is composed of IP information 10, transport information 11, header information 12, and payload information 13. IP information 10 is information about the IP protocol. The trustport information 11 is information about the TCP protocol or the UDP protocol. The header information 12 is the header information of the upper layer protocol carried by the TCP protocol or the UDP protocol. The payload information 13 is information on the payload of the upper layer protocol carried by the TCP protocol or the UDP protocol. Format 14 describes the format for referencing the packet analysis data 9. The value 15 is a value referred to in the packet analysis data. The packet analysis unit 2 divides the packet into IP information 10, trustport information 11, header information 12, and payload information 13 to generate packet analysis data 9.

The malware information database 3 stores various information related to communication performed by malware. FIG. 3 is a configuration diagram showing a configuration example of the malware information database 3 according to the first embodiment. The malware record database 3 is configured by associating signature 16, key extraction information 17, and decryption function information 18, and further, decryption function information 18 is composed of code information 19 and execution control information 20. Hereinafter, the signature 16, the key extraction information 17, and the decryption function information 18 will be described in order.

Signature 16 is information that expresses the characteristics of communication performed by malware, and communication performed by malware using a regular expression that expresses a pattern of information in a communication packet and a logical operator that indicates a comparison method with packet analysis data. Describe the characteristics of. For example, signature 16 is an information that specifies one of IP information 10, trustport information 11, and header information 12 for each malware, and a regular value that represents any of the values of IP information 10, trustport information 11, and header information 12. It consists of a logical operator that indicates how to compare the representation with the packet analysis data 9. As will be described later, this signature 16 is used for pattern matching with the packet analysis data 9 by the packet comparison unit 4, and is verified whether it matches the packet analysis data 9.

For example, in FIG. 3, when the signature 16 describes "HTTP.HEADER (Request URI) =="//www.malware.com "", the header information 12 is selected as the target and the protocol is Matches if it is HTTP and the Request URL is the same as "//www.malware.com". Also, if the signature 16 describes "HTTP.HEADER (VBNET) ~ =" [0-9] * "", header information 12 is selected as the target, the protocol is HTTP, and the header is It matches when there is a header called VBNET and a numerical value is described as the value of the header. Also, when the signature 16 describes "IP.SRCADDR ==" 10.74.5.112 "", IP information 10 is selected as the target, and the source IP address is "10.74.5.112". Match the case. In the description of such signature 16, the logical product AND, the logical sum OR, and the negative NOT can be used as logical operators, and a plurality of descriptions can be combined.

The key extraction information 17 is script information that describes a method of extracting an encryption key from a communication packet. In this script information, the operation to be executed on the byte string extracted from the packet analysis data 9 is described in a script expression. In addition, for the script information, a script expression for extracting the encryption key is prepared according to the location where the encryption key of the malware is embedded. For example, the encryption key possessed by the malware may be a fixed key embedded in the malware itself, or the ciphertext of the communication packet may include the key or information related to the key. The key extraction information corresponding to the case of a fixed key is, for example, "$ KEY =" 0xDFC14B23 ";" when the key is a hexadecimal number DFC14B23 as shown in the first line of FIG. Express. If the ciphertext of the communication packet contains the key and the key exists in the SECRETKEY header of the HTTP protocol, as shown in the second line of Fig. 3, "$ KEY = HTTP.Header ( SECRET KEY); . In addition, assuming that the code text of the communication packet contains information related to the key, the value obtained by extracting 4 bytes from the 16th byte from the beginning of the payload information 13 of the communication packet and the hexadecimal number FDFDFDFD are exclusive. When the value obtained by XOR is the key, "$ WORK = mid (HTTP.PAYLOAD, 16,4);" and "$ KEY = xor ($ WORK)" as shown in the third line of Fig. 3. , "OxFDFDFDFD"); ".

The decryption function information 18 is information about the decryption function used by the malware. The code information 19 of the decoding function information 18 describes the instruction code that implements the decoding function, and the execution control information 20 is the CPU register information indicating the order of the arguments for calling the decoding function and the return value. Is described. FIG. 4 is a diagram showing a data structure of the execution control information 20. The execution control information 20 is composed of the setting item 21 and the setting content 22.

The packet comparison unit 4 compares the packet analysis data 9 with the signature 16 stored in the malware information database 3 and determines whether they match.

The key extraction unit 5 reads the key extraction information 17 corresponding to the signature 16 matched by the packet comparison unit 4, and extracts the encryption key from the packet analysis data 9 according to the description. FIG. 5 is a configuration diagram showing a configuration example of the key extraction unit 5. The key extraction unit 5 is composed of a key extraction information interpretation unit 23 and an extraction execution unit 24. The key extraction information interpretation unit 23 interprets the key extraction information 17. The extraction execution unit 24 extracts the key from the packet analysis data 9 and outputs the encryption key 25.

The decryption unit 6 decrypts the encryption data recorded in the payload information 13 of the packet analysis data 9 with the encryption key 12 extracted by the key extraction unit 5 to obtain the decryption data (decrypted text). FIG. 6 is a structural diagram showing a configuration example of the decoding unit 6. The decoding unit 6 includes an execution control unit 26, a code memory 27, a stack memory 28, and a buffer memory 29. Further, the buffer memory 16 includes an input buffer 30, an output buffer 31, and a key buffer 32. The execution control unit 26 manages the execution of the decoding function. The code information 19 read from the malware information database 3 is loaded into the code memory 27. The stack memory 28 is for giving an argument to the decoding function. The buffer memory 29 exchanges the encrypted data of the decryption function, the decrypted data, and the encryption key information by the input buffer 30, the output buffer 31, and the key buffer 32, respectively.

The result output unit 7 outputs the decoded sentence obtained by the decoding unit 6. For example, the decoded text is displayed and output on a display unit (not shown).

Next, the operation of the malware communication analysis device according to the first embodiment will be described with reference to FIG. 7. FIG. 7 is a flowchart showing a processing flow of the malware communication analysis device according to the first embodiment.

First, in step S101, the packet analysis unit 2 reads the packets from the packet recording data 8 in the order in which they were recorded. Next, in step S102, the packet analysis unit 2 divides the read packet into IP information 10, trustport information 11, header information 12, and payload information 13 to generate packet analysis data 9. Next, in step S103, the packet comparison unit 4 reads the signature 16 from the malware information database 3.

Next, in step S104, the packet comparison unit 4 performs pattern matching between the packet analysis data 9 and the signature 16 and determines whether or not the packet analysis data 9 matches the signature 16. If they match, the packet related to the packet analysis data 9 can be regarded as the communication performed by the malware, and the branch of Yes proceeds to step S105. If they do not match, the process proceeds to step S108 by branching No.

Next, in step S105, the key extraction unit 5 extracts the encryption key 12 from the packet analysis data 9 using the key extraction information 17. First, the key extraction information interpretation unit 23 reads the key extraction information 17 corresponding to the signature 16 determined to match by the packet comparison unit 4 from the malware information database 3. Next, the extraction execution unit 24 selects a byte string of an arbitrary length at an arbitrary position from the packet, and according to the script representation of the key extraction information 17, the packet analysis data 9 is used for key extraction. Perform the operation. In this operation, the encryption key 25 is extracted by specifying the byte position, extracting the byte string, and executing the operation of the extracted byte string according to the operation instruction of the script information.

Next, in step S106, the decryption unit 6 decrypts the ciphertext from the packet analysis data 9 using the encryption key 12 and the decryption function information 18 read from the malware information database 3 to obtain the decrypted text. The process of step S106 will be described in detail later.

Next, in step S107, the result output unit 7 displays the packet analysis data 9 and the decrypted text.

Next, in step S108, the packet comparison unit 4 determines whether or not the signature 16 of the malware information database 3 has ended, and if the signature 16 has ended, the branch of Yes proceeds to step S109. .. If the signature 16 is not finished, the process up to step S107 is repeated by returning to step S103 by branching No to read the next signature 16.

Finally, in step S109, if the packet recording data 8 has not been completed, the packet analysis unit 2 returns to step S101 by branching No, and repeats the analysis of the next packet recording data 8. If the packet recorded data 8 is completed, the entire process is terminated by the branch of Yes.

Next, the processing of the decoding unit 6 in step S106 will be described in detail. FIG. 8 is a flowchart showing the processing flow of the decoding unit 6.

First, in step S201, the execution control unit 26 reads the code information 19 of the decryption function from the malware information database 3 and loads it into the code memory 27. Next, in step S202, the execution control unit 26 copies the payload information 13 of the packet analysis data 9 to the input buffer 30. Next, in step S203, the execution control unit 26 copies the encryption key 25 to the key buffer 32.

Next, in step S204, the execution control unit 26 determines whether or not to pass the argument of the decoding function via the register. This is because the decryption function pushes the arguments to the stack differently for each malware, and the arguments may be passed via a specific CPU register. The execution control unit 26 determines whether to push the start address of the input buffer 30, the start address of the output buffer 31, and the start address of the key buffer 32 to the stack or to the register based on the setting content 22 of the execution control information 20. decide. For example, if the setting item 21 is an input buffer pointer and the corresponding setting content 22 is described as STACK (2), in step S206, the input buffer pointer is pushed to the second stack and then decoded. Call a function. Further, for example, when the setting item 21 is an output buffer pointer and the corresponding setting content 22 is described as DI, in step S205, the output buffer pointer is copied to the DI register and then the decoding function is called. ..

Next, in step S207, the execution control unit 26 calls the code information 19 of the decoding function loaded in the code memory 27. As a result, the result of decrypting the encrypted data (payload information 13) of the input buffer 30 is output to the output buffer 31.

Next, in step S208, the execution control unit 26 determines whether or not the call of the decoding function ends without the occurrence of an exception at the time of execution. If no exception occurs, the process proceeds to step S209 by branching Yes, and if there is an exception, processing ends by branching No.

Next, in step S209, the execution control unit 26 takes out the CPU register value in which the return value is described in the setting item 21 of the execution control information 20, and in step S210, determines the success or failure of the return value. If the result of the determination is successful, the branch of Yes proceeds to step S211 and the decrypted statement is fetched from the output buffer 31. If it fails, the process ends with a No branch.

The above is the description of the malware communication analysis device 1 according to the first embodiment. In the first embodiment, the code information 19 extracted from the malware body is used as the decryption function, but the microprocessor of the malware communication analysis device 1 If the environment is different from the malware, another program created to operate on the malware communication analyzer 1 may be called by imitating the algorithm of the decryption function of the malware. If a program that decrypts known malware communication already exists, that program may be called.

As described above, the invention of the first embodiment uses the characteristics of malware communication obtained from the results of analyzing a plurality of malwares, the method of extracting the encryption key for each malware, and the decryption function extracted from the malware in a database. Register, identify the type of malware by comparing the characteristics of malware communication with the communication record of malware, and use the encryption key extraction method and decryption function suitable for the identified malware to encrypt the communication. By decrypting the above, there is an effect that the communication content performed by the malware can be efficiently specified without actually operating the malware.

Embodiment 2. In the first embodiment, the case where the encryption key of the malware is a fixed key embedded in the malware body and the case where the ciphertext of the communication packet contains the key or information related to the key is implemented. The morphology was explained. In the second embodiment, the embodiment corresponding to the case where the key is included in the packet received before the packet containing the ciphertext will be described.

FIG. 9 is a configuration diagram showing an embodiment of the malware communication analysis device according to the second embodiment. In the malware communication analysis device 1 according to the second embodiment, the key holding unit 33 is added to the configuration of the first embodiment, and various information stored in the malware information database 3 is expanded.

FIG. 10 is a configuration diagram showing a configuration example of the malware information database 3 according to the second embodiment. The malware information database 3 is composed of key signature 34, key extraction information 17, ciphertext signature 35, decryption function information 18, code information 19, and execution control information 20. In this configuration, the key signature 34, which represents the characteristics of the communication in which the malware key is transmitted, and the ciphertext signature 35, which represents the characteristics of the communication in which the malware transmits the ciphertext, are held.

Further, the key holding unit 33 holds the encryption key 12 extracted by the key extraction unit 5.

Next, the operation of the malware communication analysis device according to the second embodiment will be described. The packet comparison unit 4 performs pattern matching between the packet analysis data 9 and the key signature 34, and verifies whether the packet analysis data 9 matches the key signature 34. If they match, the process of extracting the encryption key 12 by the key extraction unit 5 is the same as that of the first embodiment, but the encryption key 12 is held by the key holding unit 33 without performing the processing of the decryption unit 6. Keep it.

Next, the packet comparison unit 4 performs pattern matching between the subsequent packet analysis data 9 and the key signature 34, and verifies whether the packet analysis data 9 matches the key signature 34. If they match, the decryption unit 6 is processed by using the encryption key 12 held by the key holding unit 33 without performing the processing of the key extraction unit 5.

By processing in this way, there is an effect that the ciphertext can be decrypted even when the encryption key 12 exists inside the previously received packet.

Further, when the encryption key 12 is held by the key holding unit 33, it can be omitted without performing the processing of the key extracting unit 5, so that there is an effect that the processing can be speeded up.

By keeping the contents of the key signature 34 and the ciphertext signature 35 the same, it is possible to perform the same operation as the malware communication analysis device 1 related to the first embodiment.

1 malware communication analyzer, 2 packet analysis unit, 3 malware information database, 4 packet comparison unit, 5 key extraction unit, 6 decryption unit, 7 result output unit, 8 packet recording data, 9 packet analysis data, 10 IP information, 11 Transport information, 12 header information, 13 payload information, 14 format, 15 value, 16 signature, 17 key extraction information, 18 decryption function information, 19 code information, 20 execution control information, 21 setting items, 22 settings, 23 keys Extraction information interpretation unit, 24 Extraction execution unit, 25 Encryption key, 26 Execution control unit, 27 Code memory, 28 Stack memory, 29 Buffer memory, 30 Input buffer, 31 Output buffer, 32 Key buffer, 33 Key holder, 34 keys Signature, 35 cipher signature.