Nippon Telegraph and Telephone Corporation

Yuto Otsuki

Makoto Iwamura

Yuhei Kawakoya

Takeshi Yagi

Takeo Hariu

Jun Miyoshi

Toshinori Usui

Yuma Kurogome

A rule generation apparatus includes processing circuitry configured to enumerate rule candidates with different degrees of abstraction as candidates for a rule for detecting a malware trace using an analysis result of malware, and calculate evaluation values of the rule candidates enumerated using a predetermined evaluation function and sort a rule from among the rule candidates based on the evaluation values.

Rule generating device and rule generating program

An analysis function imparting device according to the present invention includes processing circuitry configured to execute a script engine while monitoring the script engine to acquire an execution trace including an application programming interface (API) trace and a branch trace, analyze the execution trace, and detect a hook point that is a location to which a hook is applied and a code for analysis is inserted, detect, based on monitoring at the hook point, a tap point that is a memory monitoring location at which the code for analysis outputs a log, and apply a hook to the script engine to impart an analysis function to the script engine based on the hook point and the tap point.

Analysis function imparting device, analysis function imparting method, and recording medium

For the purpose of reproducing a call stack accurately without restricting the range of application, a stack scanner extracts, from a stack area of a thread whose call stack is to be acquired in a memory space of an application process, possible return addresses that are addresses in a feasible region in the memory space each representing a command right after a function call command. A program analyzer analyzes a control flow representing a flow of control configured by a branch in a function that is called by the function call command right before the command represented by each of the possible return addresses and, when there is a route reaching a command currently being executed in the control flow, determines that the possible return address is a return address and, when there is not the route, determines that the possible return address is not a return address.

Call stack acquisition device, call stack acquisition method and call stack acquisition program

A call stack acquisition device reproduces, from a memory dump, a memory space of a process to which a thread as a production target of a call stack belongs. Then, the call stack acquisition device acquires execution context of the thread by acquiring, from a virtual memory space, register information of the thread, which is stored in a memory by an OS. In addition, the call stack acquisition device acquires a current stack position and a currently executed function from the acquired execution context. Thereafter, the call stack acquisition device acquires the call stack by tracing return addresses of a series of functions as callers of the currently executed function on the stack from metadata of an execution file of the process including the thread.

Growing community of inventors

Musashino, Japan

Yuto Otsuki