Cryptographic block identification apparatus, cryptographic block identification method, and non-transitory computer readable recording medium storing cryptographic block identification program

A cryptographic block identification method of a cryptographic block identification apparatus which analyzes an execution trace in which an execution step of malware is recorded, and identifies a cryptographic block, the cryptographic block identification method comprising:

• analyzing the execution trace, calculating an evaluation value representing cipher likeliness of the execution step based on whether or not an operation type that characterizes cipher likeliness is included in the execution step, and extracting an execution step where the evaluation value exceeds a threshold L, as a block candidate which is a candidate of a cryptographic block;
• and
• identifying a region of the execution trace in which the block candidates are consecutive beyond a threshold M, as a cryptographic block.

A non-transitory computer readable recording medium storing a cryptographic block identification program that causes a computer to execute:

• analyzing an execution trace in which an execution step of malware is recorded, calculating an evaluation value representing cipher likeliness of the executions step based on whether or not an operation type that characterizes cipher likeliness is included in the execution step, and extracting an execution step where the evaluation value exceeds a threshold L, as a block candidate which is a candidate of a cryptographic block;
• and
• identifying a region of the execution trace in which the block candidates are consecutive beyond a threshold M, as a cryptographic block.