JP7206980B2 - COMMUNICATION CONTROL DEVICE, COMMUNICATION CONTROL METHOD AND COMMUNICATION CONTROL PROGRAM - Google Patents

Description

The present invention relates to a communication control device, a communication control method, and a communication control program, and more particularly to a communication control device, a communication control method, and a communication control program capable of ensuring high security.

In recent years, cyberattacks have diversified, and the damage caused by malware that cannot be detected by conventional antivirus software is increasing.

In particular, there is fileless malware as malware whose damage has increased rapidly recently. Fileless malware can run powershell.exe without saving the executable to disk. exe or cmd. It exploits a normal OS process such as exe and operates on the memory within the process. As an example of an attack using fileless malware, first, a shortcut file (LNK file) is embedded in a doc file, attached to an email, and sent to the target. When the user who received the mail double-clicks the shortcut file embedded in the attached doc file, powershell. exe is executed. A decoy document and a script are then downloaded from an external website. The downloaded script then downloads the body of the malicious program and executes it in memory. In this way, fileless malware avoids file scanning by traditional signature-based antivirus software because it does not store executable files on disk in an attack.

Patent Literature 1 describes a system that performs communication control based on information of an application that performs communication. In the system described in Patent Literature 1, first, an application communicates in a virtual machine containing an agent. As such, network socket event requests are intercepted by agents before they reach the transport layer of the OSI reference model. The identity of the communicating application is then sent to the security server to determine whether to permit or deny the intercepted network socket event request.

Japanese Patent Publication No. 2016-514295

In the communication control system disclosed in Patent Document 1, when only authorized processes of the OS are permitted to communicate with a specific server on the internal network, security rules are established in advance to permit communication between the process and the server. Register it on the server. Thereby, the communication control system disclosed in Patent Document 1 can ensure security. However, if communication with a large number of unspecified servers on an external network is permitted by normal processes of the OS, communication of malware using normal processes such as fileless malware will also be forwarded.

One of the characteristics of malware that uses the normal process of the OS, including fileless malware, is that the starting point of an attack is that a user executes a downloader script via a phishing email or the like. The downloader script is MSHTA. Javascript (registered trademark) executed by exe, powershell. For example, PowerShell code executed by an exe. At this time, the downloaded script downloads another file from another website, and finally connects to the C&C server. There are many.

In this way, it has been a challenge to ensure security against attacks involving multiple communications carried out by malware using legitimate processes.

In view of the above-mentioned problems, the purpose of the present disclosure is to combine the analysis results of multiple communication flows performed by malware using legitimate processes and perform communication control as communication patterns, thereby blocking unauthorized communication patterns and It is an object of the present invention to provide a communication control device, a communication control method, and a communication control program capable of ensuring high security.

A communication control apparatus according to an embodiment provides a plurality of communication flows transmitted from the same or parent-child process among a plurality of communication flows transmitted from a process executed in a client apparatus that communicates with a server apparatus. a communication pattern extraction unit for extracting the communication flow of the above as a communication pattern; and a communication pattern inspection unit that controls communication to the server device.

According to one embodiment, it is possible to provide a communication control device, a communication control method, and a communication control program capable of ensuring high security.

2 is a block diagram illustrating a main part of the communication control device according to Embodiment 1; FIG. 2 is a block diagram illustrating configurations of a client device and a communication control device according to Embodiment 1; FIG. 2 is a block diagram illustrating configurations of a client device and a communication control device according to Embodiment 1; FIG. 4 is a diagram exemplifying identification information stored in an identification information storage unit in the communication control device according to the first embodiment; FIG. 4 is a diagram exemplifying communication flow control information stored in a control information storage unit in the communication control device according to the first embodiment; FIG. 4 is a diagram exemplifying communication patterns stored in a communication pattern storage unit in the communication control device according to the first embodiment; FIG. 4 is a diagram exemplifying unauthorized communication patterns stored in an unauthorized communication pattern storage unit in the communication control device according to the first embodiment; FIG. 4 is a flowchart showing operations of the client device according to the first embodiment; FIG. 8 is a flowchart illustrating communication flow reception processing in a communication flow transmission/reception unit in the communication control device according to the first embodiment; FIG. 4 is a flow diagram illustrating an identification information reception process in an identification information reception unit in the communication control device according to the first embodiment; FIG. 4 is a flow diagram illustrating matching processing in a matching unit in the communication control device according to the first embodiment; FIG. 4 is a flow diagram illustrating analysis processing in an analysis unit in the communication control device according to the first embodiment; FIG. 4 is a flow diagram illustrating communication flow inspection processing in a communication flow inspection unit in the communication control device according to the first embodiment; FIG. 4 is a flow diagram illustrating communication pattern extraction processing in a communication pattern extraction unit in the communication control device according to the first embodiment; FIG. 4 is a flow diagram illustrating communication pattern inspection processing in a communication pattern inspection unit in the communication control device according to the first embodiment; FIG. 8 is a flowchart illustrating communication flow transmission processing in a communication flow transmission/reception unit in the communication control device according to the first embodiment; FIG. FIG. 9 is a flow diagram illustrating temporary information deletion processing in a temporary information deletion unit in the communication control device according to the first embodiment; 4 is a flow diagram illustrating an example of unauthorized communication pattern control processing in an unauthorized communication pattern control unit in the communication control device according to the first embodiment; FIG.

(Embodiment 1)
A communication control device according to the first embodiment will be described. FIG. 1 is a block diagram illustrating a main part of a communication control device according to Embodiment 1. FIG. As shown in FIG. 1, communication control device 200 is a device for controlling data communication between client device 100 and server device 300 . When the client device 100 communicates with the server device 300 , it goes through the communication control device 200 . Also, the communication control device 200 constructs a communication system together with the client device 100 and the server device 300 .

The client device 100 includes an OS (Operating System). The client device 100 is a terminal that communicates with the server device 300 via the communication control device 200 by the process 101 that runs on the OS. Process 101 is executed in client device 100 that communicates with server device 300 . For example, the client device 100 is a business terminal. In that case, the server device 300 is a database server that stores business data. A process 101 is a process of a business application that handles business data.

On the OS of the client device 100, not only the process 101 but also multiple processes may run. Further, in this embodiment, there may be a plurality of separate client devices that operate in the same manner as the client device 100 .

The communication control device 200 includes a communication pattern extraction section 210 and a communication pattern inspection section 212 . To explain the outline of the communication control device 200, the communication pattern extraction unit 210 extracts a plurality of communication flows transmitted from the same or parent-child process 101 out of a plurality of communication flows transmitted from the process 101 executed in the client device 100. communication flow is extracted as a communication pattern. The communication pattern inspection unit 212 performs communication control of the communication flow to the server device 300 based on the result of matching the communication pattern extracted by the communication pattern extraction unit 210 and the fraudulent communication pattern. Details of the client device 100 and the communication control device 200 will be described below.

FIG. 2 is a block diagram illustrating configurations of a client device and a communication control device according to the first embodiment. As shown in FIG. 2 , the client device 100 includes an identification information extractor 103 and an identification information transmitter 104 . The identification information extraction unit 103 extracts identification information from the communication request when the process 101 executed on the OS of the client device 100 issues a communication request to the server device 300 . The identification information transmission unit 104 transmits the extracted identification information to the communication control device 200 .

As shown in FIG. 2, the communication control device 200 includes an identification information receiving unit 201, a communication flow transmitting/receiving unit 202, a collating unit 206, a communication flow inspecting unit 208, a communication pattern extracting unit 210, and a communication pattern inspecting unit. 212.

The identification information receiving unit 201 receives identification information extracted from the communication request from the client device 100 when the process 101 executed in the client device 100 requests the server device 300 for data communication. . Specifically, the identification information receiving unit 201 receives the identification information extracted from the communication request by the identification information extraction unit 103 and transmitted by the identification information transmission unit 104 in the client device 100 .

The communication flow transmitting/receiving unit 202 receives communication flows transmitted from the client device 100 to the server device 300 . The collation unit 206 collates the header portion of the received communication flow with the header identification information in the identification information received by the identification information reception unit 201, and determines whether the two match. For example, the matching unit 206 associates the communication flow with the identification information when both match.

If there is a communication flow whose header part matches the header identification information of the identification information as a result of collation by the collation unit 206, the communication flow inspection unit 208 checks the matching communication flow for the identification information, Communication control is executed based on setting rules set based on information obtained from the header part and data part of the communication flow. Specifically, the communication flow inspection unit 208 permits/denies transmission of the communication flow based on the setting rule. Also, for example, the communication flow inspection unit 208 outputs the communication flow to the communication pattern extraction unit 210 when the identification information linked to the communication flow matches predetermined control information.

When the communication flow inspection unit 208 permits transmission of the communication flow, the communication pattern extraction unit 210 combines the analysis results of the reception date and time of the communication flow, the header part of the communication flow, and the data part of the communication flow, and Extract as a pattern. The reception date and time of the communication flow, the header portion of the communication flow, and the data portion of the communication flow are obtained from a plurality of communication flows received from the process 101 or a process having a parent-child relationship with the process 101 . In this manner, the communication pattern extraction unit 210 extracts, as communication patterns, a plurality of communication flows transmitted from the same process or from processes having a parent-child relationship. Further, the communication pattern extraction unit 210 adds the communication flow to the communication pattern when the output communication flow is a communication flow transmitted from the same process or a parent-child process.

The communication pattern inspection unit 212 collates the communication pattern of the process 101 or a process having a parent-child relationship with the process 101 and the unauthorized communication pattern, and controls communication based on the result. Specifically, the communication pattern inspection unit 212 performs communication control of the communication flow to the server device 300 based on the result of collation between the communication pattern extracted by the communication pattern extraction unit 210 and the fraudulent communication pattern. I do.

Thus, in this embodiment, the communication control device 200 acquires from the client device 100 the identification information extracted from the communication request of the process 101, and uses the identification information to perform communication control. In addition, communication control is performed by combining not only information and identification information obtained from a single communication flow, but also information obtained from a plurality of communication flows received from the same or parent-child process. In other words, according to this embodiment, the communication control device 200 can perform communication control using information that cannot be obtained by analyzing a single communication flow, and as a result, high security can be ensured. It becomes possible.

Next, the configurations of the client device 100 and the communication control device 200 according to this embodiment will be described more specifically. FIG. 3 is a block diagram illustrating configurations of a client device and a communication control device according to the first embodiment; First, the client device 100 will be described.

<Client device>
As shown in FIG. 3, the client device 100 comprises a communication flow transmitter/receiver 102 and an agent 105 .

When receiving a communication request from the process 101 , the communication flow transmitting/receiving unit 102 transmits data corresponding to the communication request to the server device 300 . A communication request is, for example, a network socket event request.

The agent 105 has the identification information extraction unit 103 described above and the identification information transmission unit 104 described above. Agent 105 is constructed by a program installed in client device 100 . Therefore, the identification information extraction unit 103 and the identification information transmission unit 104 are also constructed by programs.

In this embodiment, the identification information extractor 103 intercepts the communication request before it reaches the communication flow transmitter/receiver 102 from the process 101 . Then, the identification information extraction unit 103 extracts identification information (described later) from this communication request. Identification information extraction section 103 outputs the extracted identification information to identification information transmission section 104 . Also, at this time, the identification information extraction unit 103 may monitor the communication log and extract the identification information based on the communication log.

The identification information includes header identification information, process identification information, and client identification information. The header identification information is information below the transport layer of the OSI reference model. The header identification information includes, for example, the IP address included in the IP header and the port number included in the TCP/UDP header. The process identification information is information for identifying the process that communicated. Process identification information includes, for example, a process name, parent process name, and execution user name. The client identification information is identification information for identifying the client device 100 . Examples of client identification information include computer name and OS name.

The identification information transmission section 104 transmits the identification information received from the identification information extraction section 103 to the communication control device 200 .

With such a configuration, when the client device 100 communicates with the outside, the agent 105 uses the identification information of the process 101 that is the source of the communication request, the identification information of the client device 100, and the header identification information of the communication flow. , and transmit them to the communication control device 200 .

<Communication control device>
Next, the configuration of the communication control device 200 will be specifically described. In this embodiment, the communication control device 200 inspects the communication flow transmitted from the client device 100 to the server device 300, and determines whether or not to relay the communication flow according to the inspection result.

As shown in FIG. 3, in this embodiment, the communication control device 200 includes, in addition to the above configuration, a communication flow storage unit 203, an identification information storage unit 204, a control information storage unit 205, an analysis unit 207, It comprises a communication pattern storage unit 209 , an unauthorized communication pattern storage unit 211 , a temporary information deletion unit 213 and an unauthorized communication pattern control unit 214 .

In this embodiment, the identification information receiving unit 201 receives identification information transmitted from a plurality of client devices 100 in which the agent 105 is installed, and stores the received identification information, reception time, entry number and are stored in the identification information storage unit 204 . The entry number is a unique number assigned to each piece of identification information stored in the identification information storage unit 204 .

The identification information storage unit 204 stores identification information. The identification information storage unit 204 is, for example, a database.

4 is a diagram exemplifying identification information stored in an identification information storage unit in the communication control apparatus according to the first embodiment; FIG. As shown in FIG. 4, the identification information storage unit 204 stores an entry number, each piece of identification information, and a reception time. The identification information includes client identification information, header identification information, and process identification information. The client information includes computer name and OS. The header identification information includes an IP header with a source IP address and a destination IP address, and a TCP header with a source port number and a destination port number. The process identification information includes process name, process ID, parent process name, process having parent process ID, and execution user having user name, user ID, belonging group name and belonging group ID.

The communication flow transmitting/receiving unit 202 receives a communication flow transmitted from the client device 100 to the server device 300 in this embodiment. Then, the communication flow transmitting/receiving unit 202 stores the received communication flow and communication flow storage location information (described later) in the communication flow storage unit 203 . Also, in this embodiment, the communication flow transmitting/receiving unit 202 transmits the communication flow stored in the corresponding position based on the communication flow storage position information.

The communication flow storage location information is information for specifying the location in the communication flow storage unit 203 where the communication flow is stored. Communication flow storage position information is, for example, a buffer ID.

The communication flow storage unit 203 stores communication flows. The communication flow storage unit 203 is, for example, a reception buffer of memory.

With such a configuration, the communication control device 200 relays communication flows transmitted from the client device 100 . Further, the communication control device 200 can suspend the transmission of the communication flow to the server device 300, which is the original destination.

In this embodiment, the collation unit 206 collates the header portion of the communication flow stored in the communication flow storage unit 203 with the header identification information of the entry (input data) stored in the identification information storage unit 204. do. If a matching communication flow is found in the matching process, the matching unit 206 outputs the entry number and the communication flow storage location information of the communication flow to the analysis unit 207 . On the other hand, if not found, the matching unit 206 terminates the process.

The collation unit 206 may perform the collation process periodically, or may execute the collation process triggered by the storage of the communication flow in the communication flow storage unit 203 by the communication flow transmission/reception unit 202. . Also, the collation unit 206 may execute the collation processing triggered by the storage of the identification information in the identification information storage unit 204 by the identification information reception unit 201 .

With such a configuration, information that cannot be obtained from the header information of the communication flow, such as the transmission source process of the communication flow transmitted from the client device 100 and the executing user of the process, is associated with the communication flow. In other words, the identification information extracted by the agent 105 of the client device 100 and the communication flow are linked.

When the analysis unit 207 receives the entry number of the identification information storage unit 204 and the communication flow storage location information from the collation unit 206, the analysis unit 207 identifies the communication flow in the communication flow storage unit 203 based on the received communication flow storage location information. . The analysis unit 207 also analyzes the data portion of the specified communication flow and extracts data identification information (described later). Then, the analysis unit 207 outputs the communication flow storage location information, the entry number of the identification information storage unit 204, and the data identification information (described later) extracted from the analysis result to the communication flow inspection unit 208. FIG. Note that the analysis unit 207 is configured to be included inside the communication control device 200 in this embodiment, but may be configured to be connected from outside the communication control device 200 .

The data identification information is information extracted from the data portion of the communication flow by the analysis unit 207, and specifies the content of data included in the communication flow. Specifically, the data identification information specifies, for example, inserting records into a database (INSERT), extracting secret information of a credit card or the like (SELECT), etc., as the content of the data.

The control information storage unit 205 stores communication flow control information (described later). The control information storage unit 205 is, for example, a database.

The communication flow control information is information used by the communication flow inspection unit 208 to determine permission or abandonment of communication flow transmission. Communication flow control information must be registered in the control information storage unit 205 in advance.

5 is a diagram exemplifying communication flow control information stored in a control information storage unit in the communication control apparatus according to the first embodiment; FIG. As shown in FIG. 5, the communication flow control information includes client identification information, header identification information, process identification information, data identification information, and control method. The data identification information has the contents of the data part, for example, a database containing record deletion, record update, confidential information retrieval, and a mate containing an attached file. Control methods include communication pattern inspection, acceptance, and drop.

If there is an entry (input data) that matches the client identification information, header identification information, process identification information, and data identification information, the communication flow control information is checked by the communication flow inspection unit 208 for the target communication flow. is information that determines the content of communication control. Communication control determined by communication flow control information includes, for example, permission and abandonment of communication flow transmission. The communication flow control information also defines communication control rules by the communication flow inspection unit 208 .

In this embodiment, the communication flow inspection unit 208 performs communication control based on header identification information, process identification information, client identification information, data identification information, and communication flow control information. Specifically, based on the entry number received from the analysis unit 207, the communication flow inspection unit 208 retrieves the client identification information, the header identification information, and the process identification information of the entry (input data) from the identification information storage unit 204. and read. Then, when the read information and the data identification information received from the analysis unit 207 match an entry stored in the control information storage unit 205, the communication flow inspection unit 208 selects the control method for the entry. Based on this, a communication flow control method is determined.

For example, when the control method is "communication pattern inspection", the communication flow inspection unit 208 outputs the communication flow storage location information, the entry number of the identification information storage unit 204, and the data identification information to the communication pattern extraction unit 210. do. Also, when the control method is “permit”, the communication flow inspection unit 208 outputs communication flow storage location information to the communication flow transmission/reception unit 202 . Furthermore, when the control method is “discard”, the communication flow inspection unit 208 outputs the process identification information to the illegal communication pattern control unit 214 and discards the communication flow in the communication flow storage unit 203 .

Thus, the communication flow control information includes, for example, client identification information, header identification information, process identification information, data identification information, and a control method as predetermined control information. The control method includes communication pattern inspection for outputting the communication flow to the communication pattern extraction unit 210, permission for transmitting the communication flow to the server device 300, and cancellation for deleting the communication flow.

With such a configuration, according to the communication control device 200, the header information of the communication flow, the analysis result of the data part, the information of the transmission source process of the communication flow, and the information of the client device 100 can be flexibly combined. Communication control becomes possible.

For example, in communication between a specific client and database server, only data reference (SELECT) is permitted for one application, and reference (SELECT), insertion (INSERT), update ( It is possible to perform communication control that permits all of UPDATE and DELETE.

However, if the process 101 is an application process that communicates with an arbitrary server on an external network, it may not be possible to determine whether the communication is unauthorized just by inspecting a single communication flow. Therefore, by setting the control method of communication from the process 101 to the external network to "communication pattern inspection" in the control information storage unit 205, the communication pattern inspection unit 212, which will be described later, can perform communication combining analysis results of a plurality of communication flows. Communication control can be performed based on the pattern.

On the other hand, for communications such as DNS that are frequently performed and communications between internal networks that do not require communication pattern inspection, by setting the control method to "permit" in the control information storage unit 205, communication pattern inspection can be performed. It is possible to exclude from the target.

The communication pattern storage unit 209 stores communication patterns (described later). The communication pattern storage unit 209 is, for example, a database.

A communication pattern is information determined based on process identification information, client identification information, header identification information, and data identification information.

6 is a diagram exemplifying communication patterns stored in a communication pattern storage unit in the communication control apparatus according to the first embodiment; FIG. As shown in FIG. 6, the communication pattern storage unit 209 stores, as one communication pattern, communication flows transmitted by the same or parent-child processes. The communication pattern includes, for example, a communication pattern ID, a communication flow reception order, a PID (process ID), a PPID (parent process ID), a process name, an OS, a protocol, a download file type, and a reception time. including. In addition to the columns shown in FIG. 6, other information included in the process identification information, client identification information, header identification information, and data identification information may be added to the columns.

In this embodiment, the communication pattern extraction unit 210 extracts communication patterns based on client identification information, header identification information, process identification information, and data identification information. Specifically, communication pattern extraction unit 210 receives communication flow storage location information, the entry number of identification information storage unit 204, and data identification information from communication flow inspection unit 208 . If there is an entry (input data) whose PID or PPID matches the PID or PPID included in the process identification information in the communication pattern storage unit 209, a communication pattern entry with the same communication pattern ID as that entry exists. Add If no matching entry exists, add a communication pattern entry with a new communication pattern ID. After that, the communication pattern ID of the added entry and the communication flow storage position information are output to the communication pattern inspection unit 212 .

The unauthorized communication pattern storage unit 211 stores an unauthorized communication pattern (described later). The communication pattern storage unit 209 is, for example, a database.

An unauthorized communication pattern represents a communication pattern by an unauthorized process, and is information used by the communication pattern inspection unit 212 to determine permission or abandonment of communication flow transmission. The unauthorized communication pattern is registered in the unauthorized communication pattern storage unit 211 via the unauthorized communication pattern control unit 214 .

7 is a diagram exemplifying unauthorized communication patterns stored in an unauthorized communication pattern storage unit in the communication control device according to the first embodiment; FIG. As shown in FIG. 7, the unauthorized communication pattern storage unit 211 stores communication pattern ID, sequence, process name, OS, protocol, and download file type as unauthorized communication patterns. In addition, other information included in the process identification information, client identification information, header identification information, and data identification information may be added to the columns.

The communication pattern inspection unit 212 performs communication control based on the communication pattern and the unauthorized communication pattern in this embodiment. Specifically, based on the communication pattern ID received from the communication pattern extraction unit 210 , the communication pattern inspection unit 212 reads an entry (input data) with a matching communication pattern ID from the communication pattern storage unit 209 . Then, if there is an entry in the illegal communication pattern storage unit 211 that matches each piece of information (order, process name, OS, protocol, download file type in the case of FIG. 6) contained in the read entry, the illegal communication pattern is detected. consider Then, the communication pattern inspection unit 212 discards the communication flow in the communication flow storage unit 203 based on the communication flow storage position information. The communication pattern inspection unit 212 outputs communication flow storage position information to the communication flow transmission/reception unit 202 when there is no matching entry.

In this embodiment, when the values in the columns of the communication pattern and the unauthorized communication pattern match, it is determined as an unauthorized communication pattern. However, in another embodiment, each column may be prioritized and a mismatch of some of the lower priority columns may be considered an illegal communication pattern. Furthermore, in another embodiment, each column may be weighted, a score corresponding to the weight is added each time the column matches, and if the score exceeds a threshold, it may be regarded as an unauthorized communication pattern.

With this configuration, even in cases where it is not possible to determine whether or not the communication is unauthorized by examining a single communication flow, it is possible to perform communication control based on the communication pattern that combines the analysis results of multiple communication flows. be.

Temporary information deletion unit 213 monitors identification information storage unit 204 and communication pattern storage unit 209, and deletes entries after a certain period of time based on the reception time. Specifically, temporary information deletion unit 213 refers to the entry stored in identification information storage unit 204 and the reception time of the entry stored in communication pattern storage unit 209, and subtracts the time from the current time. is longer than the preset time, the entry is deleted. Similarly, the temporary information deletion unit 213 may periodically execute the deletion process, or separately receive a notification from the client device 100 at the timing when the process 101 ends, and use the notification as a trigger to execute the deletion process. good too.

With such a configuration, the communication control device 200 deletes the identification information that has been received for a certain period of time, thereby reducing the number of entries that are read unnecessarily. It is possible to improve the speed of communication pattern extraction processing in .

The unauthorized communication pattern control unit 214 adds, updates, and deletes entries in the unauthorized communication pattern storage unit 211 in this embodiment. Specifically, based on the process identification information received from the communication flow inspection unit 208, the unauthorized communication pattern control unit 214 stores the PID or PPID included in the process identification information and the PID or PPID in the communication pattern storage unit 209. Check if an entry with a matching PPID exists. Here, if an entry exists, a new entry is added to the unauthorized communication pattern storage unit 211 with the communication pattern of the entry as an unauthorized communication pattern. Further, the unauthorized communication pattern control unit 214 may receive a request to add, update, or delete an unauthorized communication pattern in the unauthorized communication pattern storage unit 211 from outside the communication control device 200 .

With this configuration, unauthorized communication patterns can be added/updated/deleted in real time, so it is possible to quickly respond to cyberattacks. For example, assume that communication flow inspection and communication pattern inspection permit a downloader to communicate with an external server several times, but subsequent communications that bring out confidential documents can be discarded in communication flow inspection. At this time, if no countermeasures are taken, another attack may be carried out using the same technique. However, according to this embodiment, when discarding a communication flow that brings out a confidential document in a communication flow inspection, the communication pattern of the communication performed by the process and the parent process of the process is registered as an unauthorized communication pattern. Therefore, even if a similar attack is carried out after that, the communication before the confidential document is stolen can be discarded.

<Operation of the client device>
Next, operations of the client device 100 and the communication control device 200 will be described with reference to FIGS. 8 to 18. FIG. 1 to 7 will be referred to as needed in the following description. Further, in this embodiment, the communication control method is implemented by operating the client device 100 and the communication control device 200 . Therefore, the description of the communication control method in this embodiment is replaced with the description of the operations of the client device 100 and the communication control device 200 below.

First, using FIG. 8, the operation of the client device 100 in this embodiment will be described. FIG. 8 is a flowchart showing the operation of the client device according to the first embodiment; Specifically, FIG. 8 shows detection processing and identification information transmission processing of the agent 105 .

As shown in FIG. 8, first, in the client device 100, when the process 101 operating on the client device 100 issues a communication request to the server device 300, the identification information extraction unit 103 receives this communication request as a communication flow transmission/reception. Before reaching the unit 102, it is intercepted (step S101).

Next, the identification information extraction unit 103 extracts identification information from the intercepted communication request (step S102).

Next, the identification information extraction unit 103 transmits the intercepted communication request to the server device 300 via the communication flow transmission/reception unit 102 (step S103). Next, the identification information extraction unit 103 outputs the extracted identification information to the identification information transmission unit 104 (step S104).

After that, the identification information transmission unit 104 transmits the identification information output from the identification information extraction unit 103 to the communication control device 200 (step S105).

<Operation of communication control device>
Next, the operation of the communication control device 200 according to this embodiment will be described with reference to FIGS. 9 to 18. FIG. 9 is a flowchart illustrating communication flow reception processing in a communication flow transmission/reception unit in the communication control apparatus according to the first embodiment; FIG.

As shown in FIG. 9, first, the communication flow transmitting/receiving unit 202 receives a communication flow transmitted from the communication flow transmitting/receiving unit 102 of the client device 100 to the server device 300 (step S201). That is, the communication flow transmitted from the client device 100 is received. Next, the communication flow transmitting/receiving unit 202 stores the communication flow received in step S201 in the communication flow storage unit 203 (step S202).

10 is a flowchart illustrating an identification information reception process in an identification information reception unit in the communication control apparatus according to the first embodiment; FIG. As shown in FIG. 10, first, the identification information receiving unit 201 receives identification information transmitted from the identification information transmitting unit 104 of the client device 100 (step S301). That is, when the process 101 executed in the client device 100 requests the server device 300 for data communication, the identification information extracted from the communication request is received from the client device 100 . Next, the identification information receiving unit 201 stores the received identification information, reception time, and entry number in the identification information storage unit 204 (step S302).

FIG. 11 is a flowchart exemplifying collation processing in the collation unit in the communication control device according to the first embodiment; As shown in FIG. 11, first, the matching unit 206 proceeds to step S401 triggered by step S202 or step S302. In step S401, the matching unit 206 reads the entry (input data) stored in the identification information storage unit 204, and proceeds to step S402.

In step S<b>402 , the matching unit 206 analyzes the header portion of the communication flow stored in the communication flow storage unit 203 . After that, the matching unit 206 determines whether or not there is a communication flow having a header with matching header identification information (step S403).

If the result of determination in step S403 is that there is no communication flow having a header with matching header identification information, the matching unit 206 terminates the processing. On the other hand, as a result of the determination in step S403, if there is a communication flow having a header with matching header identification information, the matching unit 206 causes the analysis unit 207 to store the entry number of the entry and the communication flow of the communication flow. Position information is output (step S404). In this way, the collating unit 206 collates the header portion of the received communication flow with the header identification information in the identification information, and links the communication flow and the identification information when they match.

12 is a flow chart illustrating analysis processing in an analysis unit in the communication control device according to the first embodiment; FIG. As shown in FIG. 12, the analysis unit 207 first receives the communication flow storage location information and the entry number of the identification information storage unit 204 from the collation unit 206 (step S501).

Next, the analysis unit 207 reads the communication flow of the communication flow storage unit 203 specified based on the communication flow storage location information (step S502).

Next, the analysis unit 207 analyzes the data portion of the read communication flow (step S503). After that, the analysis unit 207 outputs the communication flow storage location information, the entry number of the identification information storage unit 204, and the data identification information extracted based on the analysis result to the communication flow inspection unit 208 (step S504).

13 is a flow diagram illustrating communication flow inspection processing in a communication flow inspection unit in the communication control device according to the first embodiment; FIG. As shown in FIG. 13, the communication flow inspection unit 208 first receives the communication flow storage location information, the entry number of the identification information storage unit 204, and the data identification information from the analysis unit 207 (step S601).

Next, communication flow inspection unit 208 reads the entry in identification information storage unit 204 based on the entry number (step S602). Next, the communication flow inspection unit 208 reads the entry (input data) of the control information storage unit 205 (step S603).

Next, the communication flow inspection unit 208 checks that an entry matching the header identification information, the process identification information, the client identification information, and the received data identification information of the entry in the identification information storage unit 204 is stored in the control information storage unit 205. (step S604).

If the matching entry does not exist in the control information storage unit 205 as a result of the determination in step S604, the communication flow inspection unit 208 proceeds to step S605. On the other hand, if the matching entry exists in the control information storage unit 205 as a result of the determination in step S604, the communication flow inspection unit 208 proceeds to step S606 (step S604).

At step S605, the communication flow inspection unit 208 outputs the process identification information of the entry read at step S602 to the unauthorized communication pattern control unit 214 (step S605). Next, the communication flow inspection unit 208 discards the communication flow in the communication flow storage unit 203 specified based on the communication flow storage location information (step S610).

In step S606, the communication flow inspection unit 208 determines whether the control method of the entry is "discard". As a result of the determination in step S606, if the entry control method is "discard", the communication flow inspection unit 208 proceeds to step S605. On the other hand, if the result of determination in step S606 is that the entry control method is not "discard", the communication flow inspection unit 208 proceeds to step S607.

In step S607, the communication flow inspection unit 208 determines whether the control method of the entry is "permit". As a result of the determination in step S607, if the control method of the entry is "permit", the communication flow inspection unit 208 proceeds to step S608. On the other hand, if the result of determination in step S607 is that the control method of the entry is not "permit", the communication flow inspection unit 208 proceeds to step S609. That is, if the identification information linked to the communication flow matches the "communication pattern inspection" as the predetermined control information, the process proceeds to step S609.

In step S<b>608 , the communication flow inspection unit 208 outputs communication flow storage location information to the communication flow transmission/reception unit 202 . In step S<b>609 , the communication flow inspection unit 208 outputs communication flow storage position information and the like to the communication pattern extraction unit 210 .

FIG. 14 is a flowchart exemplifying communication pattern extraction processing in a communication pattern extraction unit in the communication control apparatus according to the first embodiment; As shown in FIG. 14, the communication pattern extraction unit 210 first receives communication flow storage location information, an entry number of the identification information storage unit 204, and data identification information from the communication flow inspection unit 208 (step S701). ).

Next, communication pattern extraction unit 210 reads the entry in identification information storage unit 204 based on the entry number (step S702). Next, the communication pattern extraction unit 210 reads the entry of the communication pattern storage unit 209 (step S703).

Next, the communication pattern extraction unit 210 determines whether the PID or PPID included in the process identification information of the entry in the identification information storage unit 204 matches the PID or PPID of the entry read in step S703 (step S704). ).

If the matching entry exists in the communication pattern storage unit 209 as a result of the determination in step S704, the communication pattern extraction unit 210 proceeds to step S705. On the other hand, if the matching entry does not exist in the communication pattern storage unit 209 as a result of the determination in step S704, the communication pattern extraction unit 210 proceeds to step S706 (step S704).

In step S705, the communication pattern extraction unit 210 sets the communication pattern ID to the same value as the entry matched in step S704, sets the order to the maximum value of the entry +1, and sets the other columns to the information contained in the entry read in step S702. , adds a new entry to the communication pattern storage unit, and proceeds to step S707 (step S705). In this way, it is determined whether the communication flows are sent from the same or parent-child processes, and if the communication flows are sent from the same or parent-child processes, the communication Add communication flows to patterns.

In step S706, the communication pattern extraction unit 210 sets the communication pattern ID to the smallest positive number that does not overlap with existing entries, sets the order to 1, and determines other columns based on the identification information of the entry read in step S702. , a new entry is added to the communication pattern storage unit, and the process proceeds to step S707 (step S706).

In step S707, the communication pattern extraction unit 210 outputs the communication pattern ID of the added entry and the communication flow storage position information to the communication pattern inspection unit 212 (step S707).

15 is a flow diagram illustrating communication pattern inspection processing in a communication pattern inspection unit in the communication control apparatus according to the first embodiment; FIG. As shown in FIG. 15, the communication pattern inspection unit 212 first receives a communication pattern ID and communication flow storage location information from the communication pattern extraction unit 210 (step S801).

Next, the communication pattern inspection unit 212 reads the entry in the communication pattern storage unit 209 based on the communication pattern ID (step S802). Next, the communication pattern inspection unit 212 reads the entry of the unauthorized communication pattern storage unit 211 (step S803).

Next, the communication pattern inspection unit 212 determines whether the information in each column of the entry read in S802 matches the entry in the unauthorized communication pattern storage unit (step S804).

As a result of the determination in step S804, if a matching entry exists in the unauthorized communication pattern storage unit 211, the communication pattern inspection unit 212 proceeds to step S805. On the other hand, if the result of determination in step S804 is that no matching entry exists in the unauthorized communication pattern storage unit 211, the communication pattern inspection unit 212 proceeds to step S806 (step S804).

In step S805, the communication pattern inspection unit 212 discards the communication flow in the communication flow storage unit 203 specified based on the communication flow storage location information (step S805). In step S806, the communication pattern inspection unit 212 outputs the communication flow storage location information to the communication flow transmission/reception unit 202 (step S806).

16 is a flowchart illustrating communication flow transmission processing in a communication flow transmission/reception unit in the communication control device according to the first embodiment; FIG. As shown in FIG. 16, first, the communication flow transmitting/receiving unit 202 receives communication flow storage location information from the communication flow inspecting unit 208 or the communication pattern inspecting unit 212 (step S901).

Next, the communication flow transmitting/receiving unit 202 reads the communication flow of the communication flow storage unit 203 specified based on the communication flow storage location information (step S902). After that, the communication flow transmitting/receiving unit 202 transmits the communication flow read in step S802 to the server apparatus 300 (step S903).

17 is a flowchart illustrating temporary information deletion processing in a temporary information deletion unit in the communication control apparatus according to the first embodiment; FIG. As shown in FIG. 17, first, the temporary information deletion unit 213 advances to step S1001 when a certain period of time has passed or an event that occurs in the communication control device 200 serves as a trigger. In step S<b>1001 , temporary information deletion section 213 reads entries stored in identification information storage section 204 and communication pattern storage section 209 .

Next, the temporary information deletion unit 213 determines whether the time obtained by subtracting the reception time of the read entry from the current time exceeds a preset time (step S1002).

As a result of the determination in step S1002, if the preset time has been exceeded, the temporary information deletion unit 213 deletes the entry read in step S1001 (step S1003).

On the other hand, if the preset time has not been exceeded as a result of the determination in step S1002, the temporary information deletion unit 213 terminates the process.

FIG. 18 is a flow chart exemplifying unauthorized communication pattern control processing in an unauthorized communication pattern control unit in the communication control apparatus according to the first embodiment; As shown in FIG. 18, first, the unauthorized communication pattern control unit 214 receives process identification information from the communication flow inspection unit 208 (step S1101).

Next, the unauthorized communication pattern control unit 214 reads the entry in the communication pattern storage unit 209 (step S1102). Next, the unauthorized communication pattern control unit 214 determines whether the PID or PPID included in the process identification information matches the PID or PPID of the entry read in step S1102 (step S1103).

If the matching entry does not exist in the communication pattern storage unit 209 as a result of the determination in step S1103, the process ends. On the other hand, if the matching entry exists in the communication pattern storage unit 209 as a result of the determination in step S1103, the unauthorized communication pattern control unit 214 proceeds to step S1104 (step S1103).

In step S1104, the unauthorized communication pattern control unit 214 adds a new entry to the unauthorized communication pattern storage unit 211, using the communication pattern of the entry that matches in step S1103 as an unauthorized communication pattern (step S1104).
In this manner, the communication control device 200 can control communication between the client device 100 and the server device 300. FIG.

Next, the effects of this embodiment will be described. According to the communication control device 200 of the present embodiment, the communication flow transmitted by the process that is the same as or in a parent-child relationship with the transmission source process of the communication flow is analyzed, and based on the communication pattern that combines the analysis results, the client device 100 and communication between the server device 300 can be controlled. This makes it possible to ensure a high level of security that cannot be achieved by analyzing a single communication flow.

Further, the communication control device 200 of this embodiment acquires identification information extracted from the request of the process 101 in the client device 100, and uses this identification information to perform communication control. Therefore, it is possible to extract and inspect a plurality of communication flows with predetermined identification information.

For example, it is possible to block unauthorized communications by extracting and inspecting, as communication patterns, multiple communications performed by malware that uses legitimate processes of the OS, such as fileless malware.

In addition to manually registering fraudulent communication patterns, by automatically registering fraudulent communication patterns based on the results of communication flow inspection, it is possible to take countermeasures against similar attacks in real time.

In this way, the communication control device of the present embodiment combines analysis results of a plurality of communication flows performed by malware using legitimate processes, and performs communication control as a communication pattern, thereby blocking unauthorized communication patterns, A high level of security can be ensured.

It should be noted that the present invention is not limited to the above embodiments, and can be modified as appropriate without departing from the scope of the invention. For example, the following communication control program that causes a computer to execute the communication control method in this embodiment is also included in the scope of the technical idea of the embodiment.

In other words, among the plurality of communication flows transmitted from the processes executed in the client device that communicates with the server device, the plurality of communication flows transmitted from the same or parent-child processes are extracted as communication patterns. let
Controlling communication of the communication flow to the server device based on a comparison result between the extracted communication pattern and the fraudulent communication pattern determined to be fraudulent;
A communication control program that makes a computer do things.

when the process executed in the client device requests the server device for data communication, causing the client device to receive identification information extracted from the communication request;
receiving the communication flow transmitted from the client device;
matching the header portion of the received communication flow with the header identification information in the identification information, and linking the communication flow with the identification information when both match;
determining whether the communication flow is a communication flow transmitted from the same or parent-child process when the identification information associated with the communication flow matches predetermined control information;
adding the communication flow to the communication pattern when the communication flow is a communication flow transmitted from the same or parent-child process;
9. The communication control program according to claim 8, further causing the computer to execute:

100 Client device 101 Process 102 Communication flow transmitter/receiver 103 Identification information extractor 104 Identification information transmitter 105 Agent 200 Communication control device 201 Identification information receiver 202 Communication flow transmitter/receiver 203 Communication flow storage 204 Identification information storage 205 Control information storage Unit 206 Verification unit 207 Analysis unit 208 Communication flow inspection unit 209 Communication pattern storage unit 210 Communication pattern extraction unit 212 Communication pattern inspection unit 213 Temporary information deletion unit 214 Unauthorized communication pattern control unit 300 Server device

Claims (6)

extracting, as a communication pattern, a plurality of communication flows transmitted from the same or parent-child process among a plurality of communication flows transmitted from a process executed in a client device that communicates with a server device; a communication pattern extraction unit;
a communication pattern inspection unit that controls communication of the communication flow to the server device based on a result of matching between the communication pattern extracted by the communication pattern extraction unit and the fraudulent communication pattern determined to be fraudulent;
an identification information receiving unit configured to receive, from the client device, identification information extracted from the communication request when the process executed in the client device requests the server device for data communication;
a communication flow transmitting/receiving unit that receives the communication flow transmitted from the client device;
a collation unit for collating a header portion of the received communication flow with header identification information in the identification information, and linking the communication flow with the identification information when both match;
a communication flow inspection unit that outputs the communication flow to the communication pattern extraction unit when the identification information linked to the communication flow matches predetermined control information;
with
The communication pattern extracting unit adds the communication flow to the communication pattern when the output communication flow is a communication flow transmitted from the same or parent-child process,
the identification information includes client identification information that identifies the client device, the header identification information, and process identification information that identifies the process;
The predetermined control information includes communication pattern inspection for outputting the communication flow to the communication pattern extraction unit, permission for transmitting the communication flow to the server device, and discard for deleting the communication flow.
Communications controller. further comprising an analysis unit that extracts data identification information from the data portion of the communication flow;
the predetermined control information includes the client identification information, the header identification information, the process identification information, and the data identification information;
The communication control device according to claim 1 . extracting, as a communication pattern, a plurality of communication flows transmitted from the same or parent-child process among a plurality of communication flows transmitted from a process executed in a client device that communicates with a server device; a step;
a step of controlling communication of the communication flow to the server device based on the result of matching the extracted communication pattern with the fraudulent communication pattern determined to be fraudulent;
a step of receiving, from the client device, identification information extracted from the communication request when the process executed in the client device requests the server device for data communication;
receiving the communication flow sent from the client device;
a step of collating the header portion of the received communication flow with the header identification information in the identification information, and linking the communication flow with the identification information when they match;
determining whether the communication flow is the communication flow transmitted from the same or parent-child process when the identification information associated with the communication flow matches predetermined control information;
adding the communication flow to the communication pattern if the communication flow is the communication flow transmitted from the same or parent-child process;
with
the identification information includes client identification information that identifies the client device, the header identification information, and process identification information that identifies the process;
The predetermined control information includes communication pattern inspection for extracting the communication flow as the communication pattern, permission for transmitting the communication flow to the server device, and discard for deleting the communication flow.
Communication control method. further comprising extracting data identification information from the data portion of the communication flow;
the predetermined control information includes the client identification information, the header identification information, the process identification information, and the data identification information;
The communication control method according to claim 3. extracting, as a communication pattern, a plurality of communication flows transmitted from the same process or processes having a parent-child relationship among a plurality of communication flows transmitted from a process executed in a client device that communicates with a server device;
Controlling communication of the communication flow to the server device based on the result of matching the extracted communication pattern with the fraudulent communication pattern ,
when the process executed in the client device requests the server device for data communication, causing the client device to receive identification information extracted from the communication request;
receiving the communication flow transmitted from the client device;
matching the header portion of the received communication flow with the header identification information in the identification information, and linking the communication flow with the identification information when both match;
determining whether the communication flow is a communication flow transmitted from the same or parent-child process when the identification information associated with the communication flow matches predetermined control information;
adding the communication flow to the communication pattern when the communication flow is a communication flow transmitted from the same or parent-child process;
A communication control program to be executed by a computer,
the identification information includes client identification information that identifies the client device, the header identification information, and process identification information that identifies the process;
The predetermined control information includes communication pattern inspection for extracting the communication flow as the communication pattern, permission for transmitting the communication flow to the server device, and discard for deleting the communication flow.
Communication control program. further causing the computer to extract data identification information from the data portion of the communication flow;
the predetermined control information includes the client identification information, the header identification information, the process identification information, and the data identification information;
The communication control program according to claim 5.

Images