Back to results
US 10,097,567 B2Granted
Information processing apparatus and identifying method
AssigneeNippon Telegraph and Telephone Corporation
InventorsMakoto Iwamura, Yuhei Kawakoya, Takeo Hariu
Life of this patent
Estimating the term…
Abstract
An information processing apparatus includes an adding unit and an identifying unit. The adding unit adds, to data received from a communication destination device by a program to be analyzed, a tag, by which the communication destination device is identifiable. If the tag has been added to data executed by a new program when an activation of or an activation reservation for the new program is detected, the identifying unit identifies the communication destination device identified by the tag.
Claims6
An information processing apparatus, comprising:
- a communication network interface;
- a memory;
- and
- processing circuitry configured to:
- when a data packet has been received at the communication network interface,
- extract identification information of a communication destination device from the data packet of a communication destination device which is the source of the data packet and store the identification information of the communication destination device in a first area of the memory in association with a tag,
- store application data included in the data packet in a second area of the memory, and
- generate positional information associating information indicating a storage position in the second area of the memory of the application data with the tag,
- wherein when an activation of or an activation reservation for a particular monitored program is detected and the stored application data is executed by the monitored program, the processing circuitry identifies the communication destination device identified in association with the tag in the first area of the memory as a malware distribution site, and
- when communication information indicating that a monitored target instruction for communication is stored in association with a storage position in an area of the memory, and when the monitored target instruction is called by the monitored program, the processing circuitry extracts identification information of a communication destination device from the called monitored target instruction and stores the identification information of the communication destination device in a first area of the memory in association with a tag,
- wherein the monitored program is predetermined as a malware program to be analyzed in the information processing apparatus.
8 more elements
An identifying method, implemented on an information processing apparatus that includes a communication network interface;
- a memory;
- and processing circuitry, the method comprising:
- when a data packet has been received at the communication network interface,
- extracting identification information of a communication destination device from the data packet of a communication destination device which is the source of the data packet and storing the identification information of the communication destination device in a first area of the memory in association with a tag;
- storing application data included in the data packet in a second area of the memory;
- and
- generating positional information associating information indicating a storage position in the second area of the memory of the application data with the tag,
- wherein when an activation of or an activation reservation for a particular monitored program is detected and the stored application data is executed by the monitored program, the method includes identifying the communication destination device identified in association with the tag in the first area of the memory as a malware distribution site, and
- when communication information indicating that a monitored target instruction for communication is stored in association with a storage position in an area of the memory, and when the monitored target instruction is called by the monitored program, the method includes extracting identification information of a communication destination device from the called monitored target instruction and storing the identification information of the communication destination device in a first area of the memory in association with a tag,
- wherein the monitored program is predetermined as a malware program to be analyzed in the information processing apparatus.
7 more elements
Dependencies are inferred from the claim text.