JP6169497B2 - Connection destination information determination device, connection destination information determination method, and program - Google Patents

Description

  The present invention relates to a technique for acquiring a malicious URL related to malware, which is malicious software created with the intention of performing harmful operations.

  In recent years, various malware has appeared. Malware is often downloaded to a computer by accessing a specific server device (URL). As a method of judging whether a downloaded program by accessing a URL is malware, a method of performing a static analysis for analyzing a program code or a dynamic analysis for analyzing a behavior by actually operating a program There is a technique to do. By performing such an analysis, it is possible to determine that the URL from which the program determined to be malware is a malicious URL.

  Such a malicious URL is stored as a black list and used for filtering or the like, thereby protecting the user. Patent Document 1 is a prior art document related to blacklist acquisition and maintenance.

JP 2012-118713 A

  In order to acquire a malicious URL, the method of performing a static analysis or a dynamic analysis increases the analysis cost. In addition, only the acquisition source of the malware determined to be malicious by the analysis is used as the malicious URL. Information cannot be obtained. Therefore, there is a problem that the malicious technology cannot efficiently acquire the malicious URL even though the malicious URL is increasing day by day.

  The present invention has been made in view of the above points, and an object of the present invention is to provide a technique that enables efficient acquisition of malignant connection destination information such as a malignant URL.

According to an embodiment of the present invention, there is provided a connection destination information determination device having a function of determining malignant connection destination information indicating a malignant connection destination that is a distribution source of malware on a network,
Connection destination information storage means for storing identification information of the suspicious program acquired via the network and connection destination information indicating the acquisition source of the suspicious program;
Analysis means for analyzing a suspect program corresponding to predetermined connection destination information among a plurality of connection destination information stored in the connection destination information storage means;
When the analysis unit determines that the suspicious program to be analyzed is malware, the predetermined connection destination information is determined to be malicious connection destination information and stored in the connection destination information storage unit. Connection destination information determining means for determining that the connection destination information corresponding to the suspected program having the same identification information as the identification information of the suspected program determined to be malware among the plurality of connection destination information is malignant connection destination information; There is provided a connection destination information determination apparatus characterized by comprising:

Further, according to the present embodiment, there is provided a connection destination information determination method executed by a connection destination information determination apparatus having a function of determining malignant connection destination information indicating a malignant connection destination that is a malware distribution source on a network. And
The connection destination information determination device includes connection destination information storage means for storing identification information of a suspicious program acquired via a network and connection destination information indicating an acquisition source of the suspicious program,
An analysis step for analyzing a suspect program corresponding to predetermined connection destination information among a plurality of connection destination information stored in the connection destination information storage means;
When it is determined by the analysis step that the suspicious program to be analyzed is malware, the predetermined connection destination information is determined to be malignant connection destination information and stored in the connection destination information storage means. A connection destination information determining step for determining that the connection destination information corresponding to the suspected program having the same identification information as the identification information of the suspected program determined to be the malware among the plurality of connection destination information is malignant connection destination information; A connection destination information determination method is provided.

  According to the embodiment of the present invention, it is possible to provide a technique capable of efficiently acquiring malignant connection destination information such as a malignant URL.

1 is an overall configuration diagram of a system according to an embodiment of the present invention. 2 is a functional configuration diagram of a connection destination information management apparatus 10. FIG. 4 is a flowchart illustrating an operation example of a connection destination information management apparatus 10. It is a figure which shows the example of the URL list stored in the URL list storage part 15. FIG. 4 is a flowchart illustrating an operation example of a connection destination information management apparatus 10. It is a figure which shows the example of the URL list after reflecting a dynamic analysis result. It is a flowchart which shows the confirmation method of URL.

  Embodiments of the present invention will be described below with reference to the drawings. The embodiment described below is only an example, and the embodiment to which the present invention is applied is not limited to the following embodiment. For example, in the following embodiment, the connection destination information management apparatus 10 has a honey client function and an anti-virus software function, and determines whether the suspicious file acquisition source URL is a malicious URL. In the present invention, these functions are not essential, and it is possible to adopt a configuration that does not include either or both of these functions.

  In this embodiment, a URL is used as connection destination information indicating a connection destination. However, the connection destination information is not limited to a URL, and may be another address. Furthermore, in the present embodiment, the suspicious file is dynamically analyzed to determine the association of the malicious URL, but the analysis method is not limited to the dynamic analysis.

(System configuration)
FIG. 1 shows a configuration diagram of a system according to an embodiment of the present invention. As shown in FIG. 1, the system according to the present embodiment has a configuration in which a connection destination information management apparatus 10 is connected to a network 20 in which a plurality of Web servers 30 exist.

  The connection destination information management apparatus 10 accesses the Web server 30 corresponding to the predetermined URL, downloads the suspicious file from the Web server 30 with the URL, and determines whether the suspicious file is malware. This is an apparatus having a function of determining whether a URL is a malicious URL. Hereinafter, the functional configuration of the connection destination information management apparatus 10 will be described in more detail.

  FIG. 2 shows a functional configuration diagram of the connection destination information management apparatus 10. As shown in FIG. 2, the connection destination information management apparatus 10 includes an access unit 11, a suspicious file storage unit 12, a malware determination unit 13, a URL list creation unit 14, a URL list storage unit 15, a dynamic analysis unit 16, and a URL determination. Unit 17 and URL confirmation control unit 18. The functional outline of each functional unit is as follows.

  The access unit 11 includes a function of accessing a predetermined URL, downloading a suspicious file from an access destination (such as a Web server) of the URL, and storing the suspicious file in the suspicious file storage unit 12. The predetermined URL is a URL that may be a malicious URL. For example, a URL attached to a spam mail or the like can be set as the predetermined URL.

  In the present embodiment, the suspicious file is an executable file (EXE file) and may be referred to as a suspicious program. If the suspicious file is malware, the suspicious file is executed on the computer, and for example, personal information is illegally leaked to the outside or further malware is downloaded.

  In the present embodiment, the access unit 11 includes a honey client function. The honey client may be referred to as a client-type honeypot. The honey client accesses the predetermined URL as described above, downloads the suspicious file from the access destination of the URL, stores the suspicious file in the suspicious file storage unit 12, and accesses the predetermined URL. Thus, when there is an attack targeting a vulnerability such as a Web browser, the function of detecting it is included. In the present embodiment, when the attack is detected by the access unit 11 (honey client), the access destination URL is determined to be a malicious URL.

  The suspicious file storage unit 12 stores the suspicious file acquired by the access unit 11 together with the URL of the access destination and the access date and time (= suspected file acquisition date and time).

  The malware determination unit 13 has a function of determining whether or not the suspect file is malware by pattern matching between a signature prepared in advance and the suspect file. In the present embodiment, the malware determination unit 13 includes a plurality of types of anti-virus software, and determines that the suspect file is malware when the suspect file is determined to be malware by at least one anti-virus software. .

  The URL list creation unit 14 creates a URL list by storing information such as the result of accessing the URL by the access unit 11 and the malware determination result in the URL list storage unit 15. Each record in the URL list includes the access date and time, the URL accessed at the access date and time, the identification information of the suspicious file acquired by the access, the determination result by the access unit 11 (honey client), and the malware determination of the suspicious file by the malware determination unit 13 Results and comprehensive judgment results are included.

  In the present embodiment, the identification information of the suspicious file is a hash value of the suspicious file that is binary data, but is not limited thereto.

  As described above, the determination by the access unit 11 (honey client) is based on the malicious URL (also referred to as “black”, hereinafter referred to as “B”) when the attack is detected. If it is determined that there is, it is determined to be normal (also referred to as “white”, hereinafter referred to as “W”). In the malware determination of the suspicious file by the malware determination unit 13, as described above, when it is determined that the malware is malware by at least one anti-virus software, the access destination URL is determined to be a malicious URL (B). If the anti-virus software is not determined to be malware, the access destination URL is determined to be normal (W).

  The URL list creation unit 14 sets the overall determination result to B when either or both of the determination result by the access unit 11 and the determination result by the malware determination unit 13 is B, and the determination result by the access unit 11 and the malware determination unit 13 When both of the determination results by are W, the comprehensive determination result is W. This determination process may be performed by the URL determination unit 17.

  The dynamic analysis unit 16 operates the suspicious file (executable file) in the URL list stored in the URL list storage unit 15 and performs dynamic analysis to examine its behavior, so that the suspicious file is malware. Determine whether or not. Since dynamic analysis takes a certain amount of time, in this embodiment, the dynamic analysis by the dynamic analysis unit 16 is performed at a timing longer than the time interval for acquiring the suspicious file. The suspicious file to be subjected to dynamic analysis is, for example, the latest suspicious file at the timing (the suspicious file acquired most recently).

  When the URL corresponding to the suspicious file determined to be malware by the dynamic analysis unit 16 with respect to the URL list stored in the URL list storage unit 15, the URL determination unit 17 is W when the comprehensive determination result is W. The URL corresponding to the suspicious file having the same hash value as the hash value of the suspicious file determined to be B, rewriting W to B, and determined to be malware by the dynamic analysis unit 16, When the comprehensive determination result is W, it is determined that it is B, and W is rewritten to B.

  Whether or not the suspicious file determined to be malware by the dynamic analysis unit 16 and the other suspicious file in the URL list storage unit 15 is the same using the suspicious file stored in the suspicious file storage unit 12 You may determine by determining whether a file (binary data) itself is the same.

  The URL confirmation control unit 18 instructs the access unit 11 to access each URL whose overall determination result is B in the URL list storage unit 15 at a predetermined timing such as once a day, for example. 11 confirms whether the URL is B or not. In the present embodiment, the URL can be accessed by the access unit 11, the suspicious file can be downloaded, and the hash value of the suspicious file already exists in the hash value of the suspicious file already downloaded (the URL list already exists). If the URL is the same, the URL is determined to be B. In other cases, when the URL is accessible, for example, the access unit 11 and the malware determination unit 13 determine that a new suspicious file has been downloaded as described above.

  Note that each functional unit in the connection destination information management apparatus 10 does not need to be provided in one apparatus (computer). For example, a configuration in which the URL list storage unit 15, the dynamic analysis unit 16, and the URL determination unit 17 are provided in a device different from other functional units is possible.

  The connection destination information management apparatus 10 according to the present embodiment can be realized by causing one or a plurality of computers to execute a program describing the processing contents described in the present embodiment. That is, the function of the connection destination information management apparatus 10 executes a program corresponding to the process executed by the connection destination information management apparatus 10 using hardware resources such as a CPU, memory, and hard disk built in the computer. This can be realized by doing so. Further, the program can be recorded on a computer-readable recording medium (portable memory or the like), stored, or distributed. It is also possible to provide the program through a network such as the Internet or electronic mail.

(Operation example of connection destination information management apparatus 10)
Hereinafter, an operation example of the connection destination information management apparatus 10 having the above configuration will be described with reference to a flowchart and the like. In this example, the suspicious file is acquired by accessing the URL at a predetermined cycle, and the suspicious file is dynamically analyzed at a cycle longer than the predetermined cycle. In some cases, the suspicious file is not acquired when the URL is accessed. In this example, however, an example in which the suspicious file is acquired every time the URL is accessed is described for easy understanding. In addition, it is assumed that the URL to be accessed at each time is prepared in advance and held by the access unit 11.

<Operation example when accessing URL>
FIG. 3 is a flowchart showing an operation example when accessing the URL in the connection destination information management apparatus 10.

  In step 101, the access unit 11 determines whether or not the current time is an access timing to the URL.

  In step 102, the access unit 11 accesses the URL and acquires the suspicious file. In step 103, the access unit 11 determines whether the access destination URL is B by determining whether there is an attack by the function of the honey client. Further, the malware determination unit 13 determines whether the suspicious file is malware. It is determined whether or not the access destination URL is B. If either or both of the determination result of the access unit 11 and the determination result of the malware determination unit 13 are B, the URL list creation unit 14 sets the total determination result for the URL to B (Yes in Step 103) Step 104). In addition, when both the determination result of the access unit 11 and the determination result of the malware determination unit 13 are W, the URL list creation unit 14 sets the comprehensive determination result for the URL to W (No in step 103, step 105).

  The URL list creation unit 14 stores a URL list record in the URL list storage unit 15 based on the determination result (step 106). Thereafter, the processing from step 101 is repeated for another URL.

  FIG. 4 shows an example of the URL list obtained by the above processing. As shown in FIG. 4, each record in the URL list includes an access date and time, a URL accessed at the access date and time, a hash value of a suspicious file obtained by access, a determination result by the access unit 11 (honey client), and a malware determination unit 13. This includes the malware judgment result and the overall judgment result of the suspicious file. As shown in FIG. 4, if either of the determination result by the access unit 11 and the determination result by the malware determination unit 13 is B, the total determination result is B. That is, in the example of FIG. 4, URL1 and URL3 are malicious URLs.

<Operation example when performing dynamic analysis>
FIG. 5 is a flowchart illustrating an operation example when the dynamic analysis unit 16 of the connection destination information management apparatus 10 performs dynamic analysis of the suspicious file.

  In step 201, the dynamic analysis unit 16 determines whether or not the current time is the dynamic analysis timing. If the current time is the dynamic analysis timing, the dynamic analysis unit 16 proceeds to step 202.

  In step 202, the dynamic analysis unit 16 selects one suspicious file from the URL list stored in the URL list storage unit 15, and executes dynamic analysis on the suspicious file.

  As the suspicious file to be subjected to the dynamic analysis, for example, the most recently obtained suspicious file can be selected. In addition, for example, in the URL list, the largest number of suspect files (that is, suspect files having the same hash value) from among the suspect files that have not been subjected to dynamic analysis or comprehensive determination by linking described later. It is also possible to select the one having the largest number from the group and perform dynamic analysis on one of the suspect files.

  In step 203, the URL determination unit 17 determines whether or not the dynamic analysis result is B (malware). If it is B, the process proceeds to step 204. If not B, the processing from step 201 is repeated.

  In step 204, the URL determination unit 17 determines that the URL determination result of the URL corresponding to the suspicious file determined to be malware by the dynamic analysis unit 16 is W for the URL list in the URL list storage unit 15. When the comprehensive determination result is W for the URL corresponding to the suspicious file having the same hash value as the hash value of the suspicious file determined to be malware by the dynamic analysis unit 16 while rewriting it to B , It is determined to be B, and W is rewritten to B. That is, not only the URL directly corresponding to the suspicious file determined to be malware by the dynamic analysis unit 16 but also the URL associated with the suspicious file in the URL list is determined to be a malicious URL.

  FIG. 6 shows a URL list after reflecting the dynamic analysis result. In the example of FIG. 6, since the dynamic analysis was performed on the latest suspected file 1 at 2013/10/2 CC time CC minute CC second, it was determined that it was malware. The determination result is rewritten from W to B. Further, the comprehensive determination result is rewritten from W to B for URL 2 corresponding to the suspect file 1 of 2013/10/2 AA hours AA minutes AA seconds, which is the same hash value as the hash value of the suspect file 1.

  After step 204, the processing from step 201 is repeated. For example, a flag is assigned to a URL whose determination result in the dynamic analysis unit 16 is B, and a suspicious file having the same hash value as the suspicious file of the URL (that is, a URL to be associated), The URL to which the flag is attached may not be subjected to dynamic analysis and linking determination in the subsequent processing. Further, a URL with a flag may be a URL confirmation target described later. When the flag is attached in this way, the flag may be removed when the flagged URL is changed from B to W by the URL confirmation process described later.

  For example, it is possible to provide a black list by extracting a URL whose overall determination result is B from the URL list obtained by the above processing and outputting the URL list.

  In the above example, the comprehensive determination result based on the determination result of the access unit 11 and the determination result of the malware determination unit 13 is rewritten, but the determination of the access unit 11 and the determination of the malware determination unit 13 may not be performed. . In this case, the access unit 11 periodically accesses the URL and acquires the suspicious file, thereby creating a URL list that does not include the determination result of the access unit 11 and the determination result of the malware unit 13 in FIGS. To do. Then, dynamic analysis is performed on one suspicious file at a certain timing, and if it is B, the URL corresponding to the suspicious file and the URL associated with it are set to B. This method can also detect a malicious URL efficiently.

<Operation example when confirming URL>
FIG. 7 shows a flowchart of the URL confirmation operation by the URL confirmation control unit 18 of the connection destination information management apparatus 10. This confirmation processing is periodically executed, for example, once a day for each URL for which a suspicious file is acquired in the URL list and the overall determination is B.

  Even if it is a malignant URL, it may not function as a URL or may not be malignant over time. As in this example, by performing the confirmation process, it is accurately determined whether or not the URL once determined to be malignant is certainly malignant, so that the accuracy of information on whether or not it is malignant in the URL list is improved. As a result, a high quality blacklist can be provided.

  In step 301, the URL confirmation control unit 18 determines whether or not there is an unprocessed URL to be confirmed in the URL list. If there is a target URL, the process proceeds to step 302. If not, the URL confirmation process is performed. finish.

  In step 302, the URL confirmation control unit 18 instructs the access unit 11 to access one URL among URLs to be confirmed, and the access unit 11 accesses the URL. The URL confirmation control unit 18 acquires the suspicious file obtained by the access and obtains a hash value that is identification information thereof.

  In step 303, the URL confirmation control unit 18 determines whether or not the hash value of the suspicious file obtained in step 302 is the same as the hash value of the suspicious file corresponding to the corresponding URL in the URL list. If they are the same, the process proceeds to step 304; otherwise, the process proceeds to step 305.

  In step 304, the URL confirmation control unit 18 has confirmed that the URL is surely B, and keeps the overall determination result as B.

  In step 305, for example, a new suspicious file is downloaded, and the hash value of the suspicious file is recorded in the URL list, and determination by the access unit 11 and the malware determination unit 13 is performed. That is, if either the determination result of the access unit 11 or the determination result of the malware determination unit 13 is B, the comprehensive determination result is B, and otherwise W.

  After steps 304 and 305, the process returns to step 301. Similar processing is repeated for the URL to be confirmed.

  As a result of the attempt to access the URL, there may be a case where the URL cannot be accessed (when the URL is not alive). In this case, the URL is not B, so W. Alternatively, information indicating that the URL does not exist may be recorded.

  Moreover, although the case where a suspicious file is not downloaded from URL may also generate | occur | produce, the determination result of the access part 11 (honey client) is made into a comprehensive determination result.

  That is, in this embodiment, when the URL can be accessed by the access unit 11, the suspicious file can be downloaded, and the hash value of the suspicious file is the same as the hash value of the suspicious file that has already been downloaded. In addition, it is determined that the URL is B.

  In addition, based on the dynamic analysis result described with reference to FIG. 5, for each URL (URL where a suspicious file having the same hash value is obtained) associated with the URL that is B in the dynamic analysis result, FIG. By the confirmation process described with reference to FIG. 5, the access unit 11 can access the URL, the suspicious file can be downloaded, and the hash value of the suspicious file is the same as the hash value of the suspicious file that has already been downloaded. When it is confirmed that there is a URL, the overall determination result for the associated URL may be B.

(Summary of the embodiment, effects, etc.)
As described above, in this embodiment, a connection destination information determination apparatus (for example, connection destination information management) having a function of determining malignant connection destination information indicating a malignant connection destination that is a distribution source of malware on the network. A connection destination information storage means for storing identification information of a suspicious program acquired via a network and connection destination information indicating the acquisition source of the suspicious program; and the connection destination information storage means. Analysis means for analyzing a suspicious program corresponding to predetermined connection destination information among a plurality of stored connection destination information, and the analysis means determined that the suspicious program to be analyzed is malware The predetermined connection destination information is determined as malignant connection destination information, and among the plurality of connection destination information stored in the connection destination information storage means, There is provided a connection destination information determination device comprising connection destination information determination means for determining that connection destination information corresponding to a suspicious program having the same identification information as identification information of a suspicious program determined to be malware is malignant connection destination information. The

  The connection destination information determination means has the same identification information as the identification information of the suspicious program determined to be the malware, even if the connection destination information is determined not to be malicious connection destination information in the past. If the connection destination information corresponds to the suspicious program, the connection destination information is determined to be malicious connection destination information.

  The connection destination information determination device includes an access unit that acquires a suspicious program by accessing a server device corresponding to predetermined connection destination information, identification information of the suspicious program acquired by the access unit, and the suspicious program A connection destination information list creating unit that stores connection destination information indicating a program acquisition source in the connection destination information storage unit may be provided.

  The access means has, for example, a function of detecting an attack received by accessing a server device corresponding to the predetermined connection destination information, and when the attack is detected by the access means, It is determined that the predetermined connection destination information is malicious connection destination information.

  The connection destination information determination device determines whether the predetermined connection destination information is malicious connection destination information by determining whether the suspicious program corresponding to the predetermined connection destination information is malware. Malware determination means having a function of anti-virus software, and when the predetermined connection destination information is determined to be malignant connection destination information by at least one of the access means and the malware determination means Means for determining that the connection destination information is malignant connection destination information.

  Further, the connection destination information determination device acquires a suspicious file by accessing a server device corresponding to the connection destination information determined to be malignant connection destination information, and identifies the suspicious file identification information, A connection that determines whether or not the identification information of the suspicious file already acquired by past access to the server device is the same, and determines that the connection destination information is malignant connection destination information if they are the same It is good also as providing a prior information confirmation means.

  The identification information is, for example, a hash value of binary data of the suspect program. The analysis by the analyzing means is, for example, dynamic analysis in which the suspected program is operated and its behavior is analyzed.

  According to the present embodiment, a URL associated with a suspicious file determined to be malware by dynamic analysis of the suspicious file is determined to be a malicious URL, so that it is determined as W in the past and used as a blacklist. URLs that were not received can be restored and the black list can be expanded.

  In this embodiment, the analysis by the anti-virus software or the honey client is not performed for all the suspicious files with a high analysis cost. Therefore, the blacklist can be efficiently expanded without greatly increasing the analysis cost.

  Further, in the present embodiment, the URL confirmation control unit 18 periodically checks whether the URL once determined to be a malicious URL is surely malicious or not, so a highly accurate black list is provided. Is possible.

  The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

DESCRIPTION OF SYMBOLS 10 Connection information management apparatus 11 Access part 12 Suspicious file storage part 13 Malware determination part 14 URL list preparation part 15 URL list storage part 16 Dynamic analysis part 17 URL determination part 18 URL confirmation control part 20 Network 30 Web server

Claims (10)

A connection destination information determination device having a function of determining malignant connection destination information indicating a malignant connection destination as a malware distribution source on a network,
Connection destination information storage means for storing identification information of the suspicious program acquired via the network and connection destination information indicating the acquisition source of the suspicious program;
Analysis means for analyzing a suspect program corresponding to predetermined connection destination information among a plurality of connection destination information stored in the connection destination information storage means;
When the analysis unit determines that the suspicious program to be analyzed is malware, the predetermined connection destination information is determined to be malicious connection destination information and stored in the connection destination information storage unit. Connection destination information determining means for determining that the connection destination information corresponding to the suspected program having the same identification information as the identification information of the suspected program determined to be malware among the plurality of connection destination information is malignant connection destination information; A connection destination information determination device comprising: The connection destination information determination means has the same identification information as the identification information of the suspicious program determined to be the malware, even if the connection destination information is determined not to be malicious connection destination information in the past. The connection destination information determination apparatus according to claim 1, wherein if the connection destination information corresponds to the suspicious program, the connection destination information is determined to be malignant connection destination information. Access means for acquiring a suspicious program by accessing a server device corresponding to predetermined connection destination information;
Connection destination information list creating means for storing identification information of the suspected program acquired by the access means and connection destination information indicating the acquisition source of the suspected program in the connection destination information storage means, The connection destination information determination device according to claim 1 or 2. The access means has a function of detecting an attack received by accessing a server device corresponding to the predetermined connection destination information,
The connection destination information determination apparatus according to claim 3, further comprising: a unit that determines that the predetermined connection destination information is malicious connection destination information when the attack is detected by the access means. Malware determination having a function of anti-virus software that determines whether or not the predetermined connection destination information is malicious connection destination information by determining whether or not the suspicious program corresponding to the predetermined connection destination information is malware Means,
When the predetermined connection destination information is determined to be malignant connection destination information by at least one of the access unit and the malware determination unit, the predetermined connection destination information is determined to be malignant connection destination information. The connection destination information determination device according to claim 4, further comprising: The suspicious file is acquired by accessing the server device corresponding to the connection destination information determined to be malicious connection destination information, and is already acquired by the identification information of the suspicious file and past access to the server device. It is characterized in that it comprises a connection destination information confirmation means for determining whether or not the identification information of the suspicious file being made is the same, and determining that the connection destination information is malignant connection destination information if they are the same. The connection destination information determination device according to any one of claims 1 to 5.   The connection destination information determination apparatus according to claim 1, wherein the identification information is a hash value of binary data of the suspicious program. The connection destination information determination apparatus according to claim 1, wherein the analysis by the analysis unit is dynamic analysis in which the suspicious program is operated to analyze its behavior. A connection destination information determination method executed by a connection destination information determination apparatus having a function of determining malignant connection destination information indicating a malignant connection destination as a malware distribution source on a network,
The connection destination information determination device includes connection destination information storage means for storing identification information of a suspicious program acquired via a network and connection destination information indicating an acquisition source of the suspicious program,
An analysis step for analyzing a suspect program corresponding to predetermined connection destination information among a plurality of connection destination information stored in the connection destination information storage means;
When it is determined by the analysis step that the suspicious program to be analyzed is malware, the predetermined connection destination information is determined to be malignant connection destination information and stored in the connection destination information storage means. A connection destination information determining step for determining that the connection destination information corresponding to the suspected program having the same identification information as the identification information of the suspected program determined to be the malware among the plurality of connection destination information is malignant connection destination information; A connection destination information determination method comprising:   The program for functioning a computer as each means in the connecting point information determination apparatus of any one of Claims 1 thru | or 8.

Images