Identifying device, identifying method and identifying program
An identifying device monitors malware to be analyzed and acquires, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data. Then, the identifying device creates, by using the acquired log data, a dependency relation graph that is a digraph in which the malware, download data, and communication destination are set as nodes and a dependency relation of each node is set as an edge. Then, the identifying device detects a malicious node by collating the respective nodes of the created dependency relation graph with the known maliciousness information, and traces an edge in a direction from a terminal point to a start point while setting the malicious node as a base point, and then identifies the traced node as a new malicious node.
1. An identifying device comprising:
processing circuitry configured to
monitor malware to be analyzed and acquire, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data;
create, by using the log data acquired by the processing circuitry, a dependency relation graph that is a digraph in which the malware, the download data, and the communication destination are set as nodes and a dependency relation of each node is set as an edge; and
detect a malicious node by collating the respective nodes of the dependency relation graph created by the processing circuitry with known maliciousness information, and trace an edge in a direction from a terminal point to a start point while setting the malicious node as a base point, and then identify a traced node as a new malicious node, wherein
the processing circuitry performs monitoring by assigning a monitoring target tag to a file of the malware, and in the case where the malware calls an API to be monitored, the processing circuitry acquires the log data by assigning, to data related to the API, a tag that can uniquely identify a transmission source of the data and then tracking propagation of the data assigned with the tag, wherein
the processing circuitry further performs monitoring by acquiring a value of an instruction pointer register that corresponds to an instruction, and, when a memory region indicated by the instruction pointer register is assigned with the monitoring target tag, determining the instruction as the file of the malware.
2. The identifying device according to claim 1 , wherein in the case where a node identified as the malicious node is a communication destination node, the processing circuitry identifies the communication destination node as a malicious site.
3. The identifying device according to claim 2 , wherein in the case where the node identified as the malicious node is a communication destination node, the processing circuitry identifies the communication destination node as a malicious site, and additionally, in the case where a node immediately before reaching the communication destination node is a download data node, the processing circuitry detects the node identified as the malicious site as a malware download site.
4. An identifying method executed in an identifying device, comprising processes of:
monitoring, by processing circuitry of the identifying device, malware to be analyzed and acquiring, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data;
creating, by the processing circuitry, by using the log data acquired in the monitoring process, a dependency relation graph that is a digraph in which the malware, the download data, and the communication destination are set as nodes and a dependency relation of each node is set as an edge; and
detecting, by the processing circuitry, a malicious node by collating the respective nodes of the dependency relation graph created in the creating process with known maliciousness information, and tracing an edge in a direction from a terminal point to a start point while setting the malicious node as a base point, and then identifying a traced node as a new malicious node, wherein
the processes includes monitoring by assigning a monitoring target tag to a file of the malware, and in the case where the malware calls an API to be monitored, the processing circuitry acquires the log data by assigning, to data related to the API, a tag that can uniquely identify a transmission source of the data and then tracking propagation of the data assigned with the tag, wherein
the processes further includes monitoring by acquiring a value of an instruction pointer register that corresponds to an instruction, and, when a memory region indicated by the instruction pointer register is assigned with the monitoring target tag, determining the instruction as the file of the malware.
5. A non-transitory computer-readable recording medium having stored an identifying program to cause a computer to execute steps of:
monitoring malware to be analyzed and acquiring, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data;
creating, by using the log data acquired in the monitoring step, a dependency relation graph that is a digraph in which the malware, the download data, and the communication destination are set as nodes and a dependency relation of each node is set as an edge; and
detecting a malicious node by collating the respective nodes of the dependency relation graph created in the creating step with known maliciousness information, and tracing an edge in a direction from a terminal point to a start point while setting the malicious node as a base point, and then identifying a traced node as a new malicious node, wherein
the steps includes monitoring by assigning a monitoring target tag to a file of the malware, and in the case where the malware calls an API to be monitored, the processing circuitry acquires the log data by assigning, to data related to the API, a tag that can uniquely identify a transmission source of the data and then tracking propagation of the data assigned with the tag, wherein
the steps further includes monitoring by acquiring a value of an instruction pointer register that corresponds to an instruction, and, when a memory region indicated by the instruction pointer register is assigned with the monitoring target tag, determining the instruction as the file of the malware.