Attack code detection apparatus, attack code detection method, and attack code detection program
View Patent ↗An attack code detection apparatus includes a preprocessing unit that analyzes in advance a library file for learning used in an ROP (Return Oriented Programming) chain, and obtains sets including the addresses of ROP gadgets, which represent pieces of code in the library file, and increment values of the stack pointer at the time of execution of the ROP gadgets; and a detecting unit that refers to the obtaining result of the preprocessing unit, that verifies, regarding an unknown data series representing the examination target, whether or not the ROP chain is valid in which the ROP gadgets are correctly linked, and that detects whether or not the unknown data series representing the examination target is a malicious data series.
1. An attack code detection apparatus comprising:
a memory; and
a processor coupled to the memory and programmed to execute a process comprising:
using, as learning data, a known malicious data series including a Return Oriented Programming (ROP) chain and a known benign data series;
generating a probability model in which features of byte strings of malicious data strings are learnt and generating a probability model in which features of byte strings of benign data series are learned;
preprocessing that
analyzes in advance a library file for learning used in the ROP chain, and
obtains as an offset dictionary a set including an address of an ROP gadget, which represents a piece of code in the library file, and an increment value of stack pointer at time of execution of the ROP gadget; and
detecting that
uses the probability model of the learning and the offset dictionary of the preprocessing,
verifies, regarding an unknown data series representing an examination target, whether or not the ROP chain is valid in which ROP gadgets are correctly linked, and
determines that the unknown data series representing the examination target is a malicious data series, when a likelihood ratio of a likelihood that the unknown data series includes the ROP chain by a likelihood that the unknown data series does not include the ROP chain is equal to or greater than a predetermined threshold,
wherein the likelihood that the unknown data series includes the ROP chain is determined by multiplying a probability, based on the probability model in which features of byte strings of malicious data strings are learnt, that the unknown data series includes the ROP chain, by a probability determined based on the offset dictionary that the unknown data series does not cause an ROP chain violation, and wherein the likelihood that the unknown data series does not include the ROP chain is based on the probability model in which features of byte strings of benign data strings are learnt.
2. The attack code detection apparatus according to claim 1 , wherein the detecting takes into account possibility of correct linking among the ROP gadgets, performs a likelihood ratio test between a model of the malicious data series and a model of the benign data series, and detects whether or not the unknown data series representing the examination target is the malicious data series.
3. The attack code detection apparatus according to any one of claim 1 , wherein the malicious data series and the benign data series are document files.
4. An attack code detection method implemented in an attack code detection apparatus, comprising:
a preprocessing that includes
using, as learning data, a known malicious data series including a Return Oriented Programming (ROP) chain and a known benign data series,
generating a probability model in which features of byte strings of malicious data strings are learnt and generating a probability model in which features of byte strings of benign data series are learned,
analyzing in advance a library file for learning used in the ROP chain, and
obtaining as an offset dictionary a set including an address of an ROP gadget, which represents a piece of code in the library file, and an increment value of stack pointer at time of execution of the ROP gadget; and
a detecting that includes
using, based on the probability model of the learning and the offset dictionary of the preprocessing,
verifying, regarding an unknown data series representing examination target, whether or not the ROP chain is valid in which ROP gadgets are correctly linked, and
determining that the unknown data series representing the examination target is a malicious data series, when a likelihood ratio of a likelihood that the unknown data series includes the ROP chain by a likelihood that the unknown data series does not include the ROP chain is equal to or greater than a predetermined threshold,
wherein the likelihood that the unknown data series includes the ROP chain is determined by multiplying a probability, based on the probability model in which features of byte strings of malicious data strings are learnt, that the unknown data series includes the ROP chain, by a probability determined based on the offset dictionary that the unknown data series does not cause an ROP chain violation, and wherein the likelihood that the unknown data series does not include the ROP chain is based on the probability model in which features of byte strings of benign data strings are learnt.
5. A non-transitory computer-readable recording medium having stored therein an attack code detection program that causes a computer to execute a process comprising:
a preprocessing that includes
using, as learning data, a known malicious data series including a Return Oriented Programming (ROP) chain and a known benign data series,
generating a probability model in which features of byte strings of malicious data strings are learnt and generating a probability model in which features of byte strings of benign data series are learned,
analyzing in advance a library file for learning used in the ROP chain, and
obtaining as an offset dictionary a set including an address of an ROP gadget, which represents a piece of code in the library file, and an increment value of stack pointer at time of execution of the ROP gadget; and
a detecting that includes
using, based on the probability model of the learning and the offset dictionary of the preprocessing,
verifying, regarding an unknown data series representing examination target, whether or not the ROP chain is valid in which ROP gadgets are correctly linked, and
determining that the unknown data series representing the examination target is a malicious data series, when a likelihood ratio of a likelihood that the unknown data series includes the ROP chain by a likelihood that the unknown data series does not include the ROP chain is equal to or greater than a predetermined threshold,
wherein the likelihood that the unknown data series includes the ROP chain is determined by multiplying a probability, based on the probability model in which features of byte strings of malicious data strings are learnt, that the unknown data series includes the ROP chain, by a probability determined based on the offset dictionary that the unknown data series does not cause an ROP chain violation, and
wherein the likelihood that the unknown data series does not include the ROP chain is based on the probability model in which features of byte strings of benign data strings are learnt.