Nippon Telegraph and Telephone Corporation

Kazufumi Aoki

Takeo Hariu

Yo Kanemoto

Tomonori Ikuse

Kazunori Kamiya

Tohru Sato

Kensuke Nakata

Nariyoshi Chida

Kotomi Kuroki

Mitsuaki Akiyama

Daiki Chiba

Makoto Iwamura

Shingo Orihara

Yuta Takata

Yang Zhong

Toshiki Shibahara

Hiroshi Asakura

Hirokazu Kodera

An estimation unit retrieves a subtree that matches a query to be estimated, from subtrees included in a syntax tree created from a query inserted into a Web request. In addition, the estimation unit presents information for specifying the type of damage of an attack and an attack target, the information being associated in advance with the subtree obtained by the retrieval of the retrieval unit.

Estimation system, estimation method, and estimation program

An information processing device includes an element extraction unit that extracts elements relating to actions of an attacker from each input log, a generation unit that generates a parser based on definition information defining the actions of the attacker in a formal grammar, the parser detecting, from a log, a log string having a feature corresponding to an action defined by the definition information, a parsing unit that detects, from a log consisting of the elements extracted by the element extraction unit, log strings having features corresponding to the actions defined by the definition information by using the parser, and a reconstruction unit that reconstructs the log strings detected by the parsing unit, adds a label indicating an action defined by the definition information to each of the reconstructed log strings, and outputs the labeled log strings as a log corresponding to a series of actions of the attacker.

Information processing device and information processing program

A phishing site detection device extracts, from a phishing kit, a condition of access sources with which the access to a phishing site is blocked. Then, the phishing site detection device accesses a phishing site constructed by the phishing kit using one or more extracted conditions of access sources, and stores an access result for each condition of access sources in an access result storage module. Thereafter, the phishing site detection device sets a condition of access sources with which the access to the phishing site constructed by the phishing kit is blocked, accesses a website to be detected, and determines whether the website is a phishing site on the basis of the access result.

Phishing site detection device, phishing site detection method and phishing site detection program

A regularization unit standardizes similar expressions across a plurality of URIs in access logs of requests made to a plurality of web servers, thereby changing the URIs into regularized URIs. A calculation unit calculates, among the access logs that are from the same source, the relative frequency of certain access logs to all access logs, the certain access logs corresponding to requests made to different destinations for the same regularized URI and also corresponding to certain response codes. If the largest of all the relative frequencies calculated for the regularized URIs is at least a certain threshold, a determination unit determines the regularized URIs to be scanning targets.

Detection device and detection program

A determination method includes determining an attack type of an attack code included in an attack request on the server, carrying out emulation of an attack by the attack code on the server in accordance with the determined attack type, and in a case of succeeding in an attack on the server as a result of the emulation, extracting a feature appearing in a response from the server, and examining whether a plurality of responses respectively corresponding to a plurality of requests to the server after the attack request each have the extracted feature, and in a case where at least any one of the plurality of responses has the extracted feature, determining that an attack by the attack code has succeeded, by a processor.

Determination method, determination device and recording medium

A determination method includes determining an attack type of an attack code included in an attack request on a server, carrying out emulation of an attack by the attack code on the server in accordance with the determined attack type, extracting a feature related to a backdoor operation appearing in an attack code on the server in a case of succeeding in an attack on the server as a result of the emulation, and determining that an attack by the attack code has succeeded in a case where a communication log of the server has the extracted feature, by a processor.

A communication device is installed in between a client terminal and a web server which performs communication with the client terminal. The communication device includes a memory, and processing circuitry coupled to the memory and configured to of information included in communication between the web server and the client terminal, perform obfuscation with respect to information related to web application, and send communication, which includes information obfuscated at the performing, to destination.

Communication device, communication system, and recording medium

A command server identification device adds a tag to data received by malware upon execution of the malware, the tag capable of uniquely identifying identification information for a transmission source of the data, and tracks propagation of the data added with the tag. The command server identification device acquires a tag of data referenced by a branch instruction executed by the malware, among the tracked data. The command server identification device analyzes information on an instruction of a branch destination not executed by the malware after the branch instruction. Then, the command server identification device identifies identification information of a command server for issuing a command to the malware from the identification information of the transmission source corresponding to the acquired tag, based on the result of analysis.

Identification device, identification method, and identification program

A detecting apparatus generates a collection of events, the collection being formed based on a predetermined condition, from events obtained for each identifier identifying a terminal in a monitoring target network or a piece of malware. The detecting apparatus then extracts, from a cluster formed of collections of events, the collections having a similarity therebetween equal to or larger than a certain similarity, events commonly appearing in the collections of events belonging to the same cluster, and extracts, according to a predetermined condition, the taken out events as a collection of detection purpose events. The detecting apparatus then detects that a malware infected terminal is present in the monitoring target network, if a generated collection of events based on communications in the monitoring target network is determined to match the extracted collection of detection purpose events.

Malware infected terminal detecting apparatus, malware infected terminal detecting method, and malware infected terminal detecting program

A malware analysis system includes a preliminary analysis unit, a determination unit, and a designation unit. The preliminary analysis unit executes malware obtained as a candidate for an analyzing subject to obtain information related to communication transmitted from the malware. The determination unit determines whether the malware is handled as an analyzing subject based on information obtained by the preliminary analysis unit. The designation unit designates an analyzing order with respect to malware having been determined by the determination unit as an analyzing subject based on information obtained by the preliminary analysis unit.

Malware analysis system, malware analysis method, and malware analysis program

A blacklist generating device acquires a malicious communication log and a normal communication log. A malicious communication profile extracting function calculates statistics on communication patterns included in the malicious communication log and outputs a communication pattern satisfying a certain condition to a potential blacklist. A normal communication profile extracting function calculates statistics on communication patterns included in the normal communication log and outputs a communication pattern satisfying a certain condition to a whitelist. A blacklist creating function searches the potential blacklist for a value with the value on the whitelist, excludes a coincident communication pattern from the potential blacklist, and creates a blacklist.

Black list generating device, black list generating system, method of generating black list, and program of generating black list

A malicious communication pattern extraction apparatus extracts communication patterns of traffic group of malwares, and replaces the values of predetermined field with variation in a traffic group with a wild card. Further, the malicious communication pattern extraction apparatus classifies pieces of malware having similar communication patterns in the traffic group into the same cluster, and for each cluster, extracts, as a malicious communication pattern, a communication pattern group having an appearance rate in a traffic group of respective pieces of malware in the cluster, the appearance rate being equal to or larger than a predetermined value. Thereafter, the malicious communication pattern extraction apparatus eliminates, from the extracted malicious communication patterns, any malicious communication pattern having a conformance rate to a traffic group not infected with malware, the conformance rate being equal to or larger than a predetermined value.

Malicious communication pattern extraction apparatus, malicious communication pattern extraction method, and malicious communication pattern extraction program

A detection device includes a data-propagation tracking unit that gives communication data a tag including attribute information associated with communication destination information of the communication data and tracks propagation of communication data on which the tag including the attribute information is given, and a falsification detection unit that detects falsification on the communication data when, in the communication data, there is a tag including attribute information different from attribute information corresponding to a transmission destination or a transmission source of the communication data.

Detection device, detection method, and detection program

An identifying device monitors malware to be analyzed and acquires, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data. Then, the identifying device creates, by using the acquired log data, a dependency relation graph that is a digraph in which the malware, download data, and communication destination are set as nodes and a dependency relation of each node is set as an edge. Then, the identifying device detects a malicious node by collating the respective nodes of the created dependency relation graph with the known maliciousness information, and traces an edge in a direction from a terminal point to a start point while setting the malicious node as a base point, and then identifies the traced node as a new malicious node.

Identifying device, identifying method and identifying program

A command and control server identifying apparatus provides data received by malware upon execution of the malware with a tag that allows to uniquely identify communication destination information of a source of the data, and tracks propagation of the data provided with the tag. Then, the command and control server identifying apparatus obtains a tag of data referred to by a branch instruction executed by the malware among tracked data. Then, the command and control server identifying apparatus identifies communication destination information of a command and control server that issues a command to the malware, based on communication destination information of a source associated with the obtained tag.

Growing community of inventors

Musashino, Japan

Kazufumi Aoki