JP6498413B2 - Information processing system, information processing apparatus, control server, generation server, operation control method, and operation control program - Google Patents

Description

  The present invention relates to an information processing system, an information processing apparatus, a control server, a generation server, an operation control method, and an operation control program.

  When an abnormal operation (crash) occurs during the execution of a program, a memory dump is collected by outputting information stored in the memory, and the collected memory dump is analyzed to analyze bugs and vulnerabilities hidden in the program In general, it is common to identify problems such as these. As a result, it is possible to modify the program based on the specified defect information and distribute the correction program (patch program), and to update to a more reliable program.

  Here, when a so-called cyber attack such as an act of intruding into a computer to illegally acquire information or a computer stop is often performed, such a problem of the program is often aimed. Therefore, the program update is effective not only for preventing abnormal operation of the program but also as a defense against attacks on the computer.

  As a technique for detecting such an attack on a computer, for example, a technique for detecting unauthorized access related to a buffer overflow attack is disclosed (for example, Patent Document 1).

Japanese Patent No. 4572259

  However, until the fix program is distributed, a series of steps from identifying the problem of the program caused by the attack, creating a fix program to correct the specified problem, and verifying whether the problem has been resolved correctly It is necessary to step on. Therefore, since it takes a certain time from the detection of the attack until the correction program is distributed and applied, there is a problem in that the attack against the computer cannot be prevented during that time, and the attack target is expanded.

  The present invention has been made in view of the above, and an object of the present invention is to provide a technique for preventing an attack on a computer without applying a correction program.

  An information processing system according to an embodiment of the present invention is an information processing system that includes one or more information processing devices and communicates with one or more devices, and detects an abnormality of a program operation, When an abnormality is detected by the abnormality detection means, output means for outputting the storage contents of the memory to memory dump information, and feature information indicating the characteristics of the attack that causes the abnormality based on the memory dump information Analyzing means for extracting, generating means for generating a block list based on the feature information, and control means for controlling the operation of the information processing system based on the block list.

  According to the embodiment of the present invention, it is possible to prevent an attack on a computer without applying a correction program.

It is a figure which shows the outline | summary of the information processing system which concerns on 1st embodiment. It is a figure which shows the outline | summary of the operation | movement procedure of the information processing system which concerns on 1st embodiment. It is a figure which shows an example of the hardware constitutions of the information processing apparatus which concerns on 1st embodiment. It is a figure which shows an example of a function structure of the information processing system which concerns on 1st embodiment. It is a figure which shows an example of an operation | movement of an example of a block list, and a control means. It is a figure which shows the outline | summary of the operation | movement procedure of the information processing system which concerns on 2nd embodiment. It is a figure which shows an example of a function structure of the information processing system which concerns on 2nd embodiment.

Hereinafter, embodiments will be described with reference to the drawings. In the drawings, the same components are denoted by the same reference numerals, and redundant description may be omitted. The embodiment described below is only an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.
<< First Embodiment >>
(Overview)
FIG. 1 is a diagram showing an overview of an information processing system according to the first embodiment. The information processing system 10 according to the first embodiment is connected to an external network, and performs information processing by receiving a request from a device (not shown) existing on the end of the external network and information The processing apparatus 20b, an analysis server 30 that analyzes an abnormality occurring in the program, and a block list generation server 40 that generates a block list including information for detecting an attack on the information processing apparatus 20 are configured. .

  In the information processing system 10, the information processing device 20a, the information processing device 20b, the analysis server 30, and the block list generation server 40 are configured to be able to communicate with each other. The information processing system 20 included in the information processing system 10 may be one or three or more. Hereinafter, an arbitrary information processing device 20 among the “information processing device 20a” and the “information processing device 20b” is referred to as an “information processing device 20”.

  FIG. 2 is a diagram illustrating an outline of an operation procedure of the information processing system according to the first embodiment. An outline of the operation of the information processing system 10 according to the first embodiment will be described with reference to FIGS. 1 and 2. An outline of the operation will be described on the premise that the information processing apparatus 20a performs a predetermined process by communicating with a device (hereinafter referred to as an “external device”) that exists ahead of the external network.

  First, it is assumed that an illegal packet that causes the information processing device 20a to cause a buffer overflow is transmitted from the external device to the information processing device 20a. When the information processing apparatus 20a includes vulnerability to this illegal packet, the program installed in the information processing apparatus 20a may cause an abnormal process and crash (stop operation).

  When the information processing apparatus 20a detects that the program has crashed (S101), the information processing apparatus 20a outputs memory dump information in which the contents of the memory at the time of the crash are filed (S102), and transmits them to the analysis server 30.

  The analysis server 30 analyzes the memory dump information, thereby causing an attack that causes the program to crash, such as an attack code that causes the program to crash in the memory dump information or the URL of the external device that is the transmission source of the illegal packet. It is specified whether or not feature information (hereinafter referred to as “feature information”) indicating the feature of the image is included (S103).

  The analysis server 30 transmits the identified feature information to the block list generation server 40. The block list generation server 40 generates a block list based on the received feature information (S104) and transmits it to the information processing apparatus 20a.

  When the information processing device 20a compares the communication packet with the external device and the feature information included in the block list and determines that the communication packet with the external device is an illegal packet, the information processing device 20a blocks the communication with the external device. (S105). Thereby, the information processing apparatus 20a can avoid the crash of the program even when the same illegal packet is received again without applying the correction program to the application program.

  The block list generation server 40 may transmit the block list to the information processing apparatus 20b in addition to the information processing apparatus 20a. As a result, the information processing apparatus 20b can prevent an attack by the illegal packet. That is, the knowledge obtained by the attack on the information processing apparatus 20a can be used for many computers.

The information processing device 20 may be of any type as long as it operates in accordance with a program. For example, the information processing apparatus 20 may be a PC (Personal Computer), a server, a portable terminal, a tablet terminal, or the like, or may be a network device such as an L2 / L3 switch or a router.
(Hardware configuration)
FIG. 3 is a diagram illustrating an example of a hardware configuration of the information processing apparatus according to the first embodiment. The information processing apparatus 20 includes a CPU 201, a ROM 202, a RAM 203, an HDD 204, an operation unit 205, a display unit 206, a drive device 207, and a NIC (Network Interface card) 208.

  The CPU 201 is a processor that performs overall control of the information processing apparatus 20. Programs such as an operating system, applications, and various services stored in the CPU 201, the HDD 204, and the like are executed, and each function of the information processing apparatus 20 is realized. The ROM 202 stores various programs and data used by the programs. The RAM 203 is used as a storage area for loading a program, a work area for the loaded program, and the like. Various information and programs are stored in the HDD 204.

  The operation unit 205 is hardware for receiving an input operation from the user, and is, for example, a keyboard or a mouse. The display unit 206 is hardware that performs display for the user.

  The drive device 207 reads the program from the storage medium 209 that stores the program. The program read by the drive device 207 is installed in the HDD 204, for example. The NIC 208 is a communication interface for connecting the information processing apparatus 20 to a network and transmitting / receiving data.

  Note that the storage medium 209 refers to a non-transitory storage medium. Examples of the storage medium 209 include a magnetic storage medium, an optical disk, a magneto-optical storage medium, and a nonvolatile memory.

The hardware configurations of the analysis server 30 and the block list generation server 40 are the same as those in FIG.
(Functional configuration)
FIG. 4 is a diagram illustrating an example of a functional configuration of the information processing system according to the first embodiment. First, the functional configuration of the information processing apparatus 20 will be described with reference to FIG. As illustrated in FIG. 4, the information processing apparatus 20 according to the first embodiment includes a communication unit 301, an abnormality detection unit 302, an output unit 303, a control unit 304, and a block list management unit 305. FIG. 4 shows functions particularly related to the first embodiment. For example, functions that are not related to the embodiment according to the present invention, such as a Web client function, are not shown. .

  Each of these means can be realized by causing the information processing apparatus 20 to execute a program describing the processing content of each means. That is, each of these means is realized by executing a program corresponding to a process executed by each means using hardware resources such as the CPU 201, the ROM 202, the RAM 203, and the HDD 204 built in the information processing apparatus 20. Is possible. The above-mentioned program can be recorded on a computer-readable storage medium 209 or the like for storage or distribution. It is also possible to provide the program through a network such as the Internet.

  The communication unit 301 transmits / receives a packet to / from the external device, the analysis server 30, and the block list generation server 40.

  The abnormality detection unit 302 monitors a program running on the information processing apparatus 20 and detects an abnormality occurring in the program. As an error that occurs in a program, for example, when an operating program tries to refer to a memory area that is not permitted to access, or when an operating program tries to divide by 0, the program The state where the operation cannot be continued is given. The program is running, but it can be in an infinite loop or deadlock.

  There are various factors leading to such a state, but the abnormality detection means 302 is not limited to a specific factor, and detects an abnormality occurring in the program. The means for detecting the abnormality by the abnormality detection means 302 is not limited. For example, an abnormality may be detected by using an error detection function provided in the CPU 201, or an abnormality may be detected by using an error detection function provided in an OS (Operating System) kernel. .

  The output unit 303 outputs the memory dump information by writing the contents stored in the RAM 203 to a file in accordance with an instruction from the abnormality detection unit 302. The output unit 303 transmits the output memory dump information to the analysis server 30 via the communication unit 301. The memory dump information is the contents stored in the main memory at a certain moment written out in a file, and is used mainly for the purpose of analyzing a problem of the program.

  Note that the output unit 303 may write all the contents stored in the main memory to a file, or may write to a file limited to the contents of a specific area of the main memory. Not only the contents stored in the main memory itself, but also information that is useful for problem analysis, which indirectly indicates the contents of the memory (the address of the memory where the abnormality occurred in the program, the value stored in the memory) (Hash value etc.) may be written to the file. Further, the output unit 303 is not limited to the main memory, and for example, writes the area stored in the HDD 204 used as a virtual memory and the contents stored in the external storage device used by other programs to a file. Also good.

  Further, the output unit 303 may use a function for outputting memory dump information that is pre-installed in the OS.

  The block list management unit 305 stores the block list received from the block list management server in the RAM 203 or the HDD 204, and reads and updates it as necessary.

  The control unit 304 protects against attacks from external devices by using a block list.

  FIG. 5 is a diagram illustrating an example of the block list and an example of the operation of the control unit 304. Here, an operation example (part 1) of the control means 304 will be described with reference to FIG.

  FIG. 5A is an example of information stored in the block list. The block list stores a character string indicating the URL of the external device that is the attack source, and a byte string of an attack code (exploit code). Attack code is a script or program created to attack software vulnerabilities.

  FIG. 5B shows a state where a web browser installed in the information processing apparatus 20 accesses a web server via the Internet. The control unit 304 installs a virtual proxy realized by software in the information processing apparatus 20 so that when the web browser accesses the web server, the virtual browser is accessed via the virtual proxy. The virtual proxy monitors packets transmitted / received between the web browser and the web server, and compares the transmitted / received packets with the URL or attack code stored in the block list. When the access destination of the web browser matches the access destination indicated by the URL stored in the block list, Proxy prevents the web browser from accessing the access destination, for example, by discarding the packet. Thereby, it is possible to prevent the web browser from accessing an unauthorized external device. If the byte string of the packet received from the web server matches the byte string of the attack code stored in the block list, Proxy discards the packet, for example. Thereby, the attack packet can be prevented from entering the information processing apparatus 20.

  An operation example (No. 2) of the control unit 304 will be described. For example, an application program for downloading a file from a specified URL may use a file download API provided by the OS or the like. Therefore, when the application program calls the API, the API is hooked so that another API prepared in advance operates instead of the API. Another API prepared in advance compares whether the URL that the application program is trying to access matches the URL stored in the block list, and operates so as not to download the file if they match. This can prevent the application program from downloading a file from an unauthorized server.

  The control unit 304 is not limited to the function shown in the above operation example. If the block list can be used to defend against attacks from external devices, other functions can be applied. Further, the present invention is not limited to protection from attacks from external devices, and may include a function for preventing malfunction of the information processing device 20 due to bugs or the like.

  Next, the functional configuration of the analysis server 30 will be described with reference to FIG. As shown in FIG. 4, the analysis server 30 according to the first embodiment includes a communication unit 311, an analysis unit 312, and a display unit 313.

  Each of these means can be realized by causing the analysis server 30 to execute a program describing the processing contents of each means. That is, each of these means is realized by executing a program corresponding to a process executed by each means using hardware resources such as the CPU 201, the ROM 202, the RAM 203, and the HDD 204 built in the analysis server 30. It is possible. The above-mentioned program can be recorded on a computer-readable storage medium 209 or the like for storage or distribution. It is also possible to provide the program through a network such as the Internet.

  The communication unit 311 transmits and receives packets between the information processing apparatus 20 and the block list generation server 40.

  The analysis unit 312 analyzes the memory dump information to specify whether or not feature information is included. For example, malware, which is software including malicious code, may include the URL of the transmission destination server of exploited information in the program code. When an abnormality occurs in an application program or the like due to such malware operation, the URL is included in the memory dump information. Therefore, the URL can be extracted by analyzing the memory dump information. Further, an attack code (exploit code) that causes an abnormality may be extracted from the memory dump information. The analysis unit 312 handles the URL or attack code obtained by the above unit as feature information. The analysis unit 312 is not limited to the function realized by the above method. Other functions can be applied as long as the feature information is extracted.

  The analysis unit 312 transmits the feature information to the block list generation server 40 via the communication unit 311.

  The display unit 313 displays the memory dump information or the feature information via the display unit 206 so that the user can visually recognize it. Further, a part of the memory dump information may be extracted and displayed. Further, the memory dump information partially analyzed by the analysis unit 312 may be displayed. When extracting feature information from the memory dump information, the feature information may be specified by detailed analysis by a user having specialized skills. Therefore, by providing the display unit 313, a user having specialized skills can perform a detailed analysis using the memory dump information.

  Next, the functional configuration of the block list generation server 40 will be described with reference to FIG. As illustrated in FIG. 4, the block list generation server 40 according to the first embodiment includes a communication unit 321, an input unit 322, and a generation unit 323.

  Each of these means can be realized by causing the block list generation server 40 to execute a program describing the processing contents of each means. That is, each of these means uses a hardware resource such as the CPU 201, ROM 202, RAM 203, and HDD 204 built in the block list generation server 40 to execute a program corresponding to the process executed by each means. It is possible to realize. The above-mentioned program can be recorded on a computer-readable storage medium 209 or the like for storage or distribution. It is also possible to provide the program through a network such as the Internet.

  The communication unit 321 transmits and receives packets between the analysis server 30 and the information processing apparatus 20.

  The input unit 322 receives input of feature information via the operation unit 205. Feature information obtained by analyzing memory dump information by a user having specialized skills can be reflected in the block list.

The generation unit 323 generates a block list by grouping one or more pieces of feature information into a file. In addition, the generation unit 323 transmits the generated block list to the information processing apparatus 20 via the communication unit 321.
(effect)
As described above, according to the first embodiment, it is possible to prevent an attack against a computer without applying a correction program to the information processing apparatus 20. That is, since it is not necessary to wait for completion of creation and verification of the correction program, it is possible to quickly defend against attacks on the computer.
<< Second Embodiment >>
Next, a second embodiment will be described based on the drawings. The description of the same components as those in the first embodiment is omitted. Also, points not particularly mentioned may be the same as those in the first embodiment.
(Overview)
FIG. 6 is a diagram illustrating an outline of an operation procedure of the information processing system according to the second embodiment. The outline of the operation of the information processing system 10 according to the first embodiment will be described with reference to FIG.

In addition to the functions of the information processing system 10 according to the first embodiment, the information processing system 10 according to the second embodiment monitors an attack against a program installed in the information processing apparatus 20 (S111). It has a function to generate intentional exception handling (hereinafter referred to as “pseudo-crash”) when a specific attack is detected or when a suspicious behavior is discovered even if a specific attack is not reached. (S112). In this way, by causing a pseudo crash, the processing procedure (S102 to S105) according to the first embodiment is forcibly executed. As a result, it is possible to perform information analysis by collecting memory dump information and to protect against an attack that does not induce a program crash, as well as a block list.
(Hardware configuration)
The hardware configurations of the information processing apparatus 20, the analysis server 30, and the block list generation server 40 are the same as those in FIG.
(Functional configuration)
FIG. 7 is a diagram illustrating an example of a functional configuration of the information processing system according to the second embodiment. A functional configuration of the information processing apparatus 20 will be described with reference to FIG. As shown in FIG. 7, the information processing apparatus 20 according to the second embodiment includes a communication unit 301, an abnormality detection unit 302, an output unit 303, a control unit 304, a block list management unit 305, an attack detection unit, and an abnormality. A generating means 307 is provided. FIG. 7 shows functions that are particularly related to the second embodiment. For example, functions that are not related to the embodiment according to the present invention, such as a Web client function, are illustrated. Absent.

  The attack detection unit 306 detects a suspicious behavior with respect to the information processing apparatus 20 by monitoring the communication performed with the external apparatus or the operation of the memory. For example, suspicious behavior can be detected by the following means (1) to (2) or a combination of these means. The attack detection means 306 is not limited to the following means. Any means that can detect a suspicious behavior with respect to the information processing apparatus 20 can be applied.

  Further, for example, when an illegal order of electronic commerce is detected, the attack detection unit 306 may determine that a suspicious behavior has been detected according to a user instruction.

  (1) A characteristic character string or byte string that can be determined to be highly likely to be malware is extracted in advance by analyzing the malware, and the file includes these characteristic character string or byte string. Or the like is detected, the attack detection unit 306 can determine that malware has entered the information processing apparatus 20.

  (2) When a program being executed outputs its own program as a file and further attempts to execute the output file, the program is considered to be malware. Therefore, when such an operation is detected, the attack detection unit 306 can determine that malware has entered the information processing apparatus 20.

The abnormality generation unit 307 generates intentional exception processing (pseudo-crash) inside the information processing apparatus 20. For example, the abnormality generation unit 307 can forcibly generate exception processing by starting a program that performs division by zero. Further, the abnormality generation means 307 can forcibly generate exception processing by writing a value in a memory area that is inaccessible from the program. The means for generating exception handling is not limited to the above means. Other means can be applied as long as intentional exception handling can be generated.
(effect)
As described above, according to the second embodiment, it is possible to prevent an attack against a computer without applying a correction program to the information processing apparatus 20. That is, since it is not necessary to wait for completion of creation and verification of the correction program, it is possible to quickly defend against attacks on the computer.

  Further, a general OS often has a function of generating memory dump information in advance at the timing when an exception occurrence is detected. Therefore, according to the second embodiment, it is possible to generate and collect memory dump information using a function provided by the OS.

In addition, according to the second embodiment, it is possible to perform analysis by collecting memory dump information and defense by a block list against an attack that does not induce an application program crash. . Further, by analyzing the collected memory dump information, it is possible to collect detailed information regarding the detected suspicious behavior, which can be used for finding unknown attack techniques.
(Supplement of the embodiment)
In each embodiment of the present invention, the information processing system 10 does not necessarily need to be divided into the information processing apparatus 20, the analysis server 30, and the block list generation server 40. For example, some of the functions of the analysis server 30 and the block list generation server 40 may be implemented in the information processing apparatus 20. Further, all functions may be implemented in the information processing apparatus 20.

  In each embodiment of the present invention, some or all of the information processing apparatus 20, the analysis server 30, and the block list generation server 40 may be mounted on a cloud server.

  In each embodiment of the present invention, the display unit 313, the analysis unit 312 and the communication unit 311 included in the analysis server 30 are not necessarily provided. For example, you may make it construct | assemble the information processing system 10 except the display means 313, the analysis means 312 and the communication means 311 with which the analysis server 30 is provided. Regarding the analysis of the memory dump information and the extraction of the feature information, it is possible to construct an information processing system 10 that protects against attacks based on the feature information by using a service provided by an OS vendor or the like.

  As described above, the present invention is not limited to each embodiment, and various modifications and improvements can be made within the scope of the present invention.

  In each embodiment, the communication unit 321 is an example of a distribution unit. The URL and attack code of the external device that is the attack source are examples of feature information. The block list generation server is an example of a generation server.

DESCRIPTION OF SYMBOLS 10 Information processing system 20 Information processing apparatus 30 Analysis server 40 Block list generation server 50 External network 301, 311, 321 Communication means 302 Abnormality detection means 303 Output means 304 Control means 305 Block list management means 306 Attack detection means 307 Abnormality generation means 312 Analysis means 313 Display means 322 Input means 323 Generation means

Claims (11)

An information processing system having one or more information processing devices and communicating with one or more devices,
An anomaly detecting means for detecting an anomaly of the program operation;
When an abnormality is detected by the abnormality detection means, an output means for outputting the storage content of the memory to the memory dump information;
Based on the memory dump information, analysis means for extracting feature information indicating the feature of the attack that causes the abnormality,
Generating means for generating a block list based on the feature information;
Control means for controlling the operation of the information processing system based on the block list;
An information processing system. Having communication means for communicating with the device;
The control unit compares the feature information included in the block list with a packet communicated by the communication unit, and when the device determines that the device is an attack source device, blocks the communication with the device.
The information processing system according to claim 1.   The information processing system according to claim 1, further comprising distribution means for distributing the block list in order to share the block list among a plurality of the information processing apparatuses. Having input means for receiving input of feature information;
The information processing system according to any one of claims 1 to 3, wherein the generation unit generates the block list based on feature information received by the input unit. Attack detection means for detecting an attack on the program by monitoring memory operation or communication;
5. The information processing system according to claim 1, further comprising: an abnormality generation unit that generates an abnormality in the operation of the program when an attack is detected by the attack detection unit. An information processing system having one or more information processing devices and communicating with one or more devices,
An anomaly detecting means for detecting an anomaly of the program operation;
When an abnormality is detected by the abnormality detection means, an output means for outputting the storage content of the memory to the memory dump information;
Input means for receiving input of feature information indicating characteristics of an attack that causes the abnormality, obtained by analyzing the memory dump information;
Generating means for generating a block list based on the feature information;
Control means for controlling the operation of the information processing system based on the block list;
An information processing system. An information processing device that communicates with one or more devices,
An anomaly detecting means for detecting an anomaly of the program operation;
When an abnormality is detected by the abnormality detection means, an output means for outputting the storage content of the memory to the memory dump information;
Transmitting means for transmitting the memory dump information;
Receiving means for receiving a block list including characteristic information extracted based on the memory dump information, which is characteristic information indicating characteristics of an attack that causes the abnormality;
Control means for controlling the operation of the information processing device based on the received block list;
An information processing apparatus. An analysis server connected to an information processing device and a generation server that communicate with one or more devices,
Receiving means for receiving, from the information processing apparatus, memory dump information in which the memory content of the information processing apparatus is output;
Based on the memory dump information, an analysis unit that extracts feature information indicating characteristics of an attack that causes an abnormality in the operation of the program included in the information processing device;
Transmitting means for transmitting the feature information to the generation server;
An analysis server having A generation server connected to the information processing apparatus and the analysis server,
Received from the analysis server is feature information indicating the characteristics of an attack that causes abnormal operation of the program, and the feature information extracted based on the memory dump information from which the memory content of the information processing device is output is received Receiving means for
Generating means for generating a block list based on the feature information;
Transmitting means for transmitting the block list to the information processing apparatus;
A generation server. An operation control method of an information processing system that communicates with one or more devices and has one or more information processing devices,
An abnormality detection step for detecting an abnormality in the operation of the program;
When an abnormality is detected by the abnormality detection step, an output step of outputting the storage content of the memory to the memory dump information;
Based on the memory dump information, an analysis step for extracting feature information indicating a feature of an attack that causes the abnormality;
Generating a block list based on the feature information;
A control step for controlling the operation of the information processing system based on the block list;
An operation control method. An operation control program for an information processing device that communicates with one or more devices,
In the information processing device,
An attack detection step of detecting an attack on the program by monitoring memory operation or communication;
When an attack is detected by the attack detection step, an abnormality generation step for generating an abnormality in the operation of the program in order to cause the information processing apparatus to generate memory dump information;
An input step of receiving input of feature information indicating characteristics of an attack that causes the abnormality, obtained by analyzing the memory dump information;
Generating a block list based on the feature information;
A control step for controlling the operation of the information processing apparatus based on the block list;
Operation control program for executing

Images