Analysis apparatus, analysis method, and analysis program
An analysis apparatus has a transfer path matching unit that is provided with a real browser log La and a browser emulator log Lb as input and identifies, as a specific transfer path, a transfer path that is not transferred to a malicious URL on a pseudo-browser where the transfer path is transferred to the malicious URL on a real browser, based on the malicious URL information in a malicious URL database, and an analysis avoidance code identification unit that identifies an analysis avoidance code that avoids analysis by utilizing a browser-specific function or an implementation difference between the real-browser and the pseudo-browser, among script codes that are executed on a website, based on the specific transfer path.
1. An analysis apparatus that analyzes a content and a script code on a website, wherein the analysis apparatus comprises:
a memory; and
a processor coupled to the memory and programmed to execute a process comprising:
matching that is provided with, as input, an access log for a Uniform Resource Locator (URL) of a website as an analysis target on a real browser that is a browser of a real system and an access log for the URL of a website as an analysis target on a pseudo-browser that simulates environment of the real browser and identifies, as a specific transfer path, a transfer path that is not transferred to a malicious URL on the pseudo-browser where the transfer path is transferred to the malicious URL on the real browser, based on the malicious URL; and
identifying an analysis avoidance code that avoids analysis by utilizing a browser-specific function or an implementation difference between the real-browser and the pseudo-browser, among script codes that are executed on the website, based on the specific transfer path, wherein
the matching creates respective transfer graphs from the access logs for the real browser and the pseudo-browser and matches respective transfer paths in the created two transfer graphs to one another to identify the specific transfer path.
2. The analysis apparatus according to claim 1 , wherein:
the identifying identifies a terminal URL of the specific transfer path and identifies, as the analysis avoidance code, a script code that is executed due to access to the identified terminal URL among the script codes that are executed on the website.
3. The analysis apparatus according to claim 1 , wherein the matching matches transfer paths by using at least one of a domain name, a path, a query key, and a query value.
4. The analysis apparatus according to claim 3 , wherein the matching executes matching of transfer paths at a granularity of the at least one of a domain name, a path, a query key, and a query value and regards a URL with a greatest number of coincidence at each granularity as identical.
5. An analysis method that is executed by an analysis apparatus that analyzes a content and a script code on a website, wherein the analysis method comprises:
providing for matching, as input, an access log for a URL website as an analysis target on a real browser that is a browser of a real system and an access log for the URL of a website as an analysis target on a pseudo-browser that simulates environment of the real browser and identifying, as a specific transfer path, a transfer path that is not transferred to a malicious URL on the pseudo-browser where the transfer path is transferred to the malicious URL on the real browser, based on the malicious URL; and
identifying an analysis avoidance code that avoids analysis by utilizing a browser-specific function or an implementation difference between the real-browser and the pseudo-browser, among script codes that are executed on the website, based on the specific transfer path, wherein
the matching creates respective transfer graphs from the access logs for the real browser and the pseudo-browser and matches respective transfer paths in the created two transfer graphs to one another to identify the specific transfer path.
6. A non-transitory computer-readable recording medium having stored therein an analysis program for causing a computer to execute a process comprising:
providing for matching, as input, an access log for a URL of a website as an analysis target on a real browser that is a browser of a real system and an access log for the URL of a website as an analysis target on a pseudo-browser that simulates environment of the real browser and identifying, as a specific transfer path, a transfer path that is not transferred to a malicious URL on the pseudo-browser where the transfer path is transferred to the malicious URL on the real browser, based on the malicious URL; and
identifying an analysis avoidance code that avoids analysis by utilizing a browser-specific function or an implementation difference between the real-browser and the pseudo-browser, among script codes that are executed on the website, based on the specific transfer path, wherein
the matching creates respective transfer graphs from the access logs for the real browser and the pseudo-browser and matches respective transfer paths in the created two transfer graphs to one another to identify the specific transfer path.