Malware analysis continuation system and malware analysis continuation method

1 . A malware analysis continuation system connected to an Internet, comprising:

a processor;

a memory storing programs;

wherein the processor executes the programs to configure:

a communication destination observation unit configured to observe communication with an attacker server and accumulating a response to the communication as past data;

a dynamic analysis unit configured to perform dynamic analysis of malware;

a communication mediation unit configured to mediate communication of the dynamically analyzed malware and performing control such that the response accumulated as the past data is returned to continue the dynamic analysis even in a case where the communication with the attacker server is stopped;

a similar communication extraction unit configured to extract past communication similar to communication generated by the malware as similar communication from the past data; and

a screen depiction unit configured to depict information related to the malware on a screen,

wherein the screen depiction unit displays a communication summary of the communication and content of the similar communication as the information related to the malware on the screen, and the communication summary and the similar communication include a URL of the attacker server, a sample family name of the malware, a request issued by the malware, and a response from the attacker server.

2 . The malware analysis continuation system according to claim 1 ,

wherein the communication mediation unit temporarily suspends the communication with the attacker server, checks a state of a communication destination of the communication, determines whether or not the communication destination is in operation, and resumes the communication of the malware when determining that the communication destination is in operation.

3 . The malware analysis continuation system according to claim 2 ,

wherein the communication mediation unit determines whether or not the communication destination was observed in the past when determining that the communication destination is not in operation and returns the observed result as the response for the temporarily suspended communication when determining that the communication destination was observed in the past.

4 . The malware analysis continuation system according to claim 3 ,

wherein the communication mediation unit returns the similar communication as the response for the temporarily suspended communication when determining that the communication destination was not observed in the past.

5 . The malware analysis continuation system according to claim 1 ,

wherein the similar communication extraction unit extracts the similar communication from the past data on the basis of characteristics of the malware or characteristics of the communication.

6 . The malware analysis continuation system according to claim 5 ,

wherein the similar communication extraction unit extracts the similar communication from the past data on the basis of characteristics of a URL path of the communication.

7 . The malware analysis continuation system according to claim 5 ,

wherein the similar communication extraction unit extracts the similar communication from the past data on the basis of characteristics of parameters of the communication.

8 . The malware analysis continuation system according to claim 5 ,

wherein the similar communication extraction unit extracts the similar communication from the past data on the basis of characteristics of a sample family of the malware.

9 . The malware analysis continuation system according to claim 1 , further comprising:

a user terminal connected via a predetermined network,

wherein the screen depiction unit displays information related to the malware on a screen of the user terminal.

10 . The malware analysis continuation system according to claim 1 , further comprising:

an external user terminal connected to the Internet,

wherein the screen depiction unit displays information related to the malware on a screen of the external user terminal.

11 . A malware analysis continuation method in a malware analysis continuation system connected to an Internet, the malware analysis continuation method comprising:

a communication destination observation step of observing communication with an attacker server and accumulating a response to the communication as past data, using a communication destination observation unit;

a dynamic analysis step of performing dynamic analysis of malware using a dynamic analysis unit;

a communication mediation step of mediating communication of the dynamically analyzed malware and performing control such that the response accumulated as the past data is returned to continue the dynamic analysis even in a case where the communication with the attacker server is stopped, using a communication mediation unit;

a similar communication extraction step of extracting past communication similar to communication generated by the malware as similar communication from the past data, using a similar communication extraction unit; and

a screen depiction step of depicting information related to the malware on a screen using a screen depiction unit,

wherein a communication summary of the communication and content of the similar communication are displayed as the information related to the malware on the screen, and the communication summary and the similar communication include a URL of the attacker server, a sample family name of the malware, a request issued by the malware, and a response from the attacker server.

12 . The malware analysis continuation method according to claim 11 ,

wherein, in the similar communication extraction step, the similar communication is extracted from the past data on the basis of characteristics of the malware or characteristics of the communication.