Program analysis system, program analysis method and storage medium

1. A program analysis system comprising:

a memory that stores:

a set of instructions;

a known factor code that is data representing a mathematical model into which a known execution code is transformed; and

success state information indicating a state in which an attack by a fraudulent program is successful; and

at least one processor configured to execute the set of instructions to

determine whether or not an inspection-target execution code is a fraudulent program by executing at least processing of generating an analysis-target abstract code that is data representing a mathematical model into which the inspection-target execution code is transformed and determining whether or not the analysis-target abstract code includes the known factor code held in the memory, and processing of determining whether or not a state at an end of execution of the inspection-target execution code is included in the success state information held in the memory,

determine that the inspection-target execution code is a fraudulent program when the analysis-target abstract code includes the known factor code held in the memory and a state at an end of execution of the inspection-target execution code is included in the success state information held in the memory;

decompose the analysis-target abstract code into analysis-target factor codes being relatively prime factor codes that do not have a dependence between a factor code and another factor code in which a variable in an output vector is included in common when the known factor code held in the memory is determined to be not included in the analysis-target abstract code;

execute processing of determining whether or not the known factor code is included in the analysis-target abstract code after rearranging the analysis-target factor codes at least partly when the decomposed analysis-target factor codes which are rearranged at least partly is equivalent to the analysis-target abstract code before rearranging in a result of execution; and

determine that the inspection-target execution code is a fraudulent program when the analysis-target abstract code after rearranging the analysis-target factor codes at least partly includes the known factor code, and a state at an end of execution of the inspection-target execution code is included in the success state information held in the memory.

2. The program analysis system according claim 1 , wherein

the mathematical model is a model representing an instruction included in a certain execution code by use of one or more mappings, an input vector and an output vector, the input vector and the output vector being related to the mappings, and

the at least one processor is further configured to

generate the analysis-target abstract code by transforming one or more instruction sequences included in the inspection-target execution code into the mappings and integrating the mappings by calculating a product of multiplying one or more of the mappings generated by transforming.

3. The program analysis system according to claim 2 , wherein

an element of the input vector and the output vector in the mathematical model is information indicating a state of an information processing device in which the inspection-target execution code is executed, the information including at least information indicating a content of a register implemented in an arithmetic device included in the information processing device in which the inspection-target execution code is executed and information indicating a content of a specific address in a memory included in the information processing device in which the inspection-target execution code is executed, and

the at least one processor is further configured to

determine whether or not an element of the output vector is included in the success state information held in the memory, the element of the output vector indicating a state of an end of execution of the inspection-target execution code.

4. The program analysis system according to claim 2 , wherein

the at least one processor is further configured to

transform one or more instruction sequences included in the inspection-target execution code into the mappings by use of transformation information associating an instruction included in an execution code with the mapping that is the mathematical model representing the instruction.

5. The program analysis system according to claim 4 , wherein

the memory is further configured to:

store a specimen of an execution code executing an attack using a vulnerability; and

store a specimen of a known fraudulent program, and

the at least one processor is further configured to:

generate a known abstract code that is data representing the mathematical model into which an execution code is transformed by use of the transformation information, the execution code being of at least either one of a specimen held in the memory and a specimen held in a fraudulent program data holding unit, and providing the memory with the known factor code into which the known abstract code is decomposed; and

determine that the inspection-target execution code is a fraudulent program when the analysis-target abstract code includes at least either one of the known factor code acquired from a specimen held in the memory and the known factor code acquired from a specimen held in the fraudulent program data holding unit, and a state at an end of execution of the inspection-target execution code is included in the success state information held in the memory.

6. The program analysis system according to claim 4 , wherein

the memory is further configured to

store a specimen of an execution code executed in a system operating normally, and

the at least one processor is further configured to:

generate a known abstract code that is data representing the mathematical model into which an execution code of a specimen held in the memory is transformed by use of the transformation information, and providing the memory with the known factor code into which the known abstract code is decomposed; and

transform the inspection-target execution code into the analysis-target abstract code by use of the transformation information, and generating an execution code with a code size reduced in comparison with the original inspection-target execution code by replacing at least part of the analysis-target abstract code with the known factor code acquired from an execution code of a specimen held in the memory.

7. The program analysis system according to claim 2 , wherein

the at least one processor is further configured to

integrate the mappings into which the instruction sequences included in the execution code is transformed by calculating a product of transformation matrices each included in the mappings into which the instruction sequences included in the execution code is transformed, when the mapping is represented by a linear function including a single transformation matrix.

8. A program analysis method comprising:

generating an analysis-target abstract code that is data representing a mathematical model into which an inspection-target execution code is transformed;

determining whether or not the inspection-target execution code is a fraudulent program by executing at least processing of determining whether or not the analysis-target abstract code includes a known factor code that is data representing a mathematical model into which a known execution code is transformed, and processing of determining whether or not a state at an end of execution of the inspection-target execution code is included in success state information indicating a state in which an attack by a fraudulent program is successful;

determining that the inspection-target execution code is a fraudulent program when the analysis-target abstract code includes the known factor code and a state at an end of execution of the inspection-target execution code is included in the success state information;

decomposing the analysis-target abstract code into analysis-target factor codes being relatively prime factor codes that do not have a dependence between a factor code and another factor code in which a variable in an output vector is included in common when the known factor code is determined to be not included in the analysis-target abstract code;

executing processing of determining whether or not the known factor code is included in the analysis-target abstract code after rearranging the analysis-target factor codes at least partly when the decomposed analysis-target factor codes which are rearranged at least partly is equivalent to the analysis-target abstract code before rearranging in a result of execution; and

determining that the inspection-target execution code is a fraudulent program when the analysis-target abstract code after rearranging the analysis-target factor codes at least partly includes the known factor code, and a state at an end of execution of the inspection-target execution code is included in the success state information.

9. A non-transitory computer readable storage medium storing a computer program causing a computer to execute:

generating an analysis-target abstract code that is data representing a mathematical model into which an inspection-target execution code is transformed;

determining whether or not the inspection-target execution code is a fraudulent program by executing at least processing of determining whether or not the analysis-target abstract code includes a known factor code that is data representing a mathematical model into which a known execution code is transformed, and processing of determining whether or not a state at an end of execution of the inspection-target execution code is included in success state information indicating a state in which an attack by a fraudulent program is successful;

determining that the inspection-target execution code is a fraudulent program when the analysis-target abstract code includes the known factor code and a state at an end of execution of the inspection-target execution code is included in the success state information;

decomposing the analysis-target abstract code into analysis-target factor codes being relatively prime factor codes that do not have a dependence between a factor code and another factor code in which a variable in an output vector is included in common when the known factor code is determined to be not included in the analysis-target abstract code;

executing processing of determining whether or not the known factor code is included in the analysis-target abstract code after rearranging the analysis-target factor codes at least partly when the decomposed analysis-target factor codes which are rearranged at least partly is equivalent to the analysis-target abstract code before rearranging in a result of execution; and

determining that the inspection-target execution code is a fraudulent program when the analysis-target abstract code after rearranging the analysis-target factor codes at least partly includes the known factor code, and a state at an end of execution of the inspection-target execution code is included in the success state information.