Identification device, identification method, and identification program

An identification method executed by an identification device, the identification method comprising:

• adding a tag to data received by malware upon execution of the malware, the tag capable of uniquely identifying identification information for a transmission source of the data, and track propagation of the data added with the tag;
• acquiring a tag of data referenced by a branch instruction executed by the malware, among the tracked data;
• analyzing information on an instruction of a branch destination not executed by the malware after the branch instruction to generate an analysis result;
• and
• identifying identification information of a command server for issuing a command to the malware from the identification information of the transmission source corresponding to the tag acquired, based on the analysis result,
• wherein the method further comprises:
• recording a snapshot of a virtual machine that executes the malware in the runtime state,
• using the recorded snapshot, restore a state at a time of executing the branch destination, and
• forcibly executing the branch destination not executed by the malware after the branch instruction,
• determining the identification information of the transmission source of the data referenced by forcibly executing the branch destination, as the identification information of the command server,
• dynamically analyzing at least one of an Application Programming Interface (API) and a system called at the unexecuted branch destination,
• based on the API and system call called in the unexecuted area that is dynamically analyzed, determining the identification information of the transmission source corresponding to the tag of the data referenced by the branch instruction, as the identification information of the command server, and
• adding the identification information of the command server to a blacklist which enables blocking communication with the command server, and finding and isolating an infected terminal.

A non-transitory computer-readable recording medium having stored an identification program for causing a computer to execute a process comprising:

• adding a tag to data received by malware upon execution of the malware, the tag capable of uniquely identifying identification information for a transmission source of the data, and track propagation of the data added with the tag;
• acquiring a tag of data referenced by a branch instruction executed by the malware, among the tracked data;
• analyzing information on an instruction of a branch destination not executed by the malware after the branch instruction to generate an analysis result;
• and
• identifying identification information of a command server for issuing a command to the malware from the identification information of the transmission source corresponding to the tag acquired, based on the analysis result,
• wherein the process further comprises:
• recording a snapshot of a virtual machine that executes the malware in the runtime state,
• using the recorded snapshot, restore a state at a time of executing the branch destination, and
• forcibly executing the branch destination not executed by the malware after the branch instruction,
• determining the identification information of the transmission source of the data referenced by forcibly executing the branch destination, as the identification information of the command server,
• dynamically analyzing at least one of an Application Programming Interface (API) and a system called at the unexecuted branch destination,
• based on the API and system call called in the unexecuted area that is dynamically analyzed, determining the identification information of the transmission source corresponding to the tag of the data referenced by the branch instruction, as the identification information of the command server, and
• adding the identification information of the command server to a blacklist which enables blocking communication with the command server, and finding and isolating an infected terminal.