Fujitsu Corporation

Kunihiko Yoshimura

Ryusuke Masuoka

Toshitaka Satomi

Koji Yamada

Kouta Tanabe

A non-transitory computer-readable storage medium storing a program that causes an information processing apparatus to execute a process, the process includes executing a first program by using a system including a kernel of an operating system (OS) and shared libraries, acquiring first information on a first file group read out from the shared libraries, executing a second program by using the system, acquiring second information on a second file group read out from the shared libraries, executing similarity determination processing of determining similarity between the first program and the second program by comparing the first information and the second information that have been acquired, and outputting the similarity that has been determined.

Dynamic malware analysis based on shared library call information

A non-transitory computer-readable storage medium storing a program that causes an information processing apparatus to execute a process, the process includes executing a first program and a second program using a system including a kernel of an OS, acquiring first information regarding a first API call and second information regarding a second API call, executing a similarity judgment process in which a similarity between the first program and the second program is judged, wherein the first information is information indicating at least one of a type of the first API call, the number of executions of the first API call, and a call order of the first API call, the second information includes at least one of a type of the second API call, the second information includes the number of executions of the second API call, and a call order of the second API cal.

Non-transitory computer-readable storage medium, information processing apparatus and method for detecting malware

A non-transitory computer-readable recording medium storing a control program causing a computer to execute processing, the processing includes: displaying a first node of a first type and a second node of a second type; receiving registration of a third node representing an access destination in association with the first node; receiving registration of a fourth node representing mask processing on information in association with the second node; receiving registration of a fifth node representing an information category in association with the second node; allowing transmission of information about a cyber attack event to the third node; and providing the information about the cyber attack event after executing the mask processing associated with the fourth node on information belonging to the information category associated with the fifth node, when the information about the cyber attack event is transmitted to the third node.

Non-transitory computer-readable recording medium storing control program, control method, and information processing device

A non-transitory recording medium recording a cyber-attack analysis supporting program that causes a computer to execute a process, the process includes: accepting registration of information of one or more items regarding a cyber-attack event in response to detection of malware in an information processing system of a monitoring target; and displaying the information registered regarding the cyber-attack event in a state in which each of the one or more items is coupled as a subordinate node to a representative node of the cyber-attack event.

Non-transitory recording medium recording cyber-attack analysis supporting program, cyber-attack analysis supporting method, and cyber-attack analysis supporting apparatus

A non-transitory computer readable recording medium storing a computer executable program that, when executed, causes a computer to perform a cyber attack analysis support process, the cyber attack analysis support process includes: when information of a first cyber attack event including information of malware is registered as a result of a detection of the malware within an information processing system to be monitored, searching for a second cyber attack event having a similarity relationship with the first cyber attack event by referring to a storage storing information on past cyber attack events; and displaying information of the searched second cyber attack event and the registered information of the first cyber attack event on a display circuit.

Non-transitory computer-readable recording medium storing cyber attack analysis support program, cyber attack analysis support method, and cyber attack analysis support device

Growing community of inventors

Katsushika, Japan

Kunihiko Yoshimura