Identifying apparatus, identifying method, and identifying program
AssigneeNippon Telegraph and Telephone Corporation
InventorsTomonori Ikuse, Kazufumi Aoki, Takeo Hariu
Life of this patent
Estimating the term…
Abstract
A command and control server identifying apparatus provides data received by malware upon execution of the malware with a tag that allows to uniquely identify communication destination information of a source of the data, and tracks propagation of the data provided with the tag. Then, the command and control server identifying apparatus obtains a tag of data referred to by a branch instruction executed by the malware among tracked data. Then, the command and control server identifying apparatus identifies communication destination information of a command and control server that issues a command to the malware, based on communication destination information of a source associated with the obtained tag.
Claims8
An identifying apparatus for identifying a command and control server transmitting a malicious program (malware) comprising:
- a memory;
- at least one central processing unit (CPU) connected to the memory and configured to
- tag, upon execution of malware, received malware data with source identification tag data, the source identification tag data allowing to uniquely identify communication destination information of a source of the malware data,
- track, on a virtual computing machine, propagation of the malware data associated with the source identification tag data,
- obtain, for each of plural branch destinations of a branch instruction, a tag of data referred to when the branch instruction is branched into the plural branch destinations, the branch instruction being executed by the malware and including any one of an application program interface (API) call, a system call, a jump (jmp) instruction, or a call instruction,
- identify communication destination information of a command and control server, by identifying communication destination information of a source associated with the obtained tags and common among the plural branch destinations, the command and control server issuing a command to the malware,
- block communication with the identified communication destination of the command and control server;
- create, in response to detecting that the communication destinations associated with the tags are different, a new tag, and record the created tag and communication destinations associated with tags in communication destination information database;
- and
- set created tag in a tag saving area associated with computation result saving destination,
- wherein the identifying apparatus is infected by the malware during the tracking operation.
An identifying method for identifying a command and control server transmitting a malicious program (malware) performed by an identifying apparatus, the method comprising:
- tagging, upon execution of malware, received malware data with a source identification tag, the source identification tag data allowing to uniquely identify communication destination information of a source of the malware data;
- tracking, on a virtual computing machine, propagation of the malware data associated with the source identification tag data;
- obtaining, for each of plural branch destinations of a branch instruction, a tag of data referred to when the branch instruction is branched into the plural branch destinations, the branch instruction being executed by the malware and including any one of an application program interface (API) call, a system call, a jump (jmp) instruction, or a call instruction;
- identifying communication destination information of a command and control server, by identifying communication destination information of a source associated with the obtained tags and common among the plural branch destinations, the command and control server issuing a command to the malware;
- blocking communication with the identified communication destination of the command and control server;
- creating, in response to detecting that the communication destinations associated with the tags are different, a new tag, and record the created tag and communication destinations associated with tags in communication destination information database;
- and
- setting created tag in a tag saving area associated with computation result saving destination,
- wherein the identifying apparatus is infected by the malware during the tracking operation.
A non-transitory computer-readable recording medium having stored an identifying program for causing a computer to perform a method for identifying a command and control server transmitting a malicious program (malware), the method comprising:
- tagging, upon execution of malware, received malware data with source identification tag data, the source identification tag data allowing to uniquely identify communication destination information of a source of the data;
- tracking, on a virtual computing machine, propagation of the malware data associated with the source identification tag data;
- obtaining, for each of plural branch destinations of a branch instruction, a tag of data referred to when the branch instruction is branched into the plural branch destinations, the branch instruction being executed by the malware and including any one of an application program interface (API) call, a system call, a jump (jmp) instruction, or a call instruction;
- identifying communication destination information of a command and control server, by identifying communication destination information of a source associated with the obtained tags and common among the plural branch destinations, the command and control server issuing a command to the malware;
- blocking communication with the identified communication destination of the command and control server;
- creating, in response to detecting that the communication destinations associated with the tags are different, a new tag, and record the created tag and communication destinations associated with tags in communication destination information database;
- and
- setting created tag in a tag saving area associated with computation result saving destination,
- wherein the computer is infected by the malware during the tracking operation.
Dependencies are inferred from the claim text.