JP6478730B2 - Malignant URL candidate acquisition device, malignant URL candidate acquisition method, and program - Google Patents

Description

  The present invention relates to a technique for collecting candidates for malignant URLs constituting a blacklist.

  Important issues include attacks by malicious programs targeting computer vulnerabilities, and attacks by distribution of malware that performs an operation to illegally acquire information of the computer.

  The URL of an access destination to which an unauthorized program or the like may be downloaded is called a malignant URL. The list of malicious URLs can be maintained as a blacklist and used for filtering to protect the user.

Patent No. 4739962 JP, 2012-118713, A

  In order to create a blacklist consisting of malignant URLs, for a malignant URL candidate suspected to be malignant, for example, using a technology described in Patent Document 1, the site of the malignant URL candidate actually attacks at the site Determine if there is. Then, as a result of the determination, a malignant URL candidate determined to be a site to attack is included in the blacklist as a malignant URL. The technique described in Patent Document 1 is a technique for determining whether a malignant URL candidate is a malignant URL by injecting a malignant URL candidate called a seed into a honey client.

  However, at present, there is a problem that the number of seeds (malignant URL candidates) is small, and as a result, the number of malignant URLs obtained by the above-described technique is small.

  The current seed can be obtained by collecting SPAM mail, URLs extracted from logs of various security devices, URLs that an operator of the SOC (Security Operations Center) found during customer handling, and the like. However, with this method, only known malignant URL candidates can be found, and many malignant URL candidates can not be acquired.

  In view of the above problems, Patent Document 2 proposes a technique for searching for an unknown malignant URL candidate using knowledge that there is a high possibility that a malignant URL exists in the vicinity of a malignant URL. However, the Internet space is so wide that it can not find many malicious URL candidates that may exist in places that are not nearby.

  The present invention has been made in view of the above, and it is an object of the present invention to provide a technology capable of efficiently acquiring unknown malignant URL candidates on the Internet.

According to an embodiment of the present invention, there is provided a malignant URL candidate acquiring device for acquiring a malignant URL candidate, which is a URL used to detect a malignant site,
Feature string storage means for storing a feature string that is a string used at a known malignant site;
Search means for executing a search for a search device on the Internet by using the characteristic character string as a keyword;
A determination unit configured to determine a malignant URL candidate based on the search result obtained by the search unit;
The search means is
When using a search device in which information on a malignant site is stored as the search device, a malignant URL candidate acquiring device is provided which acquires an IP address from the FQDN portion included in the characteristic character string and performs a search based on the IP address. Ru.

Further, according to the embodiment of the present invention, there is provided a method for acquiring a malignant URL candidate, which is performed by a malignant URL candidate acquiring device for acquiring a malignant URL candidate which is a URL used to detect a malignant site,
The malignant URL candidate acquisition device includes a characteristic character string storage unit that stores a characteristic character string that is a character string used at a known malignant site;
A search step of executing a search on a search device on the Internet by using the characteristic character string as a keyword;
Determining a malignant URL candidate based on the search result obtained by the search step;
In the search step, the malignant URL candidate acquisition device
When using a search device in which information on a malignant site is stored as the search device, a method for acquiring a malignant URL candidate is provided which acquires an IP address from the FQDN portion included in the characteristic character string and performs a search based on the IP address. Ru.

  According to the embodiment of the present invention, it is possible to efficiently acquire unknown malignant URL candidates on the Internet.

It is a figure for demonstrating the outline | summary of embodiment of this invention. It is a block diagram of malignant URL candidate acquisition device 10 concerning an embodiment of the invention. It is a flowchart for demonstrating operation | movement of the malignant URL candidate acquisition apparatus 10 in this Embodiment. It is a figure which shows the example of a characteristic character string.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that the embodiments described below are merely examples, and the embodiments to which the present invention is applied are not limited to the following embodiments.

  Hereinafter, the term "site" used in malignant sites / attack sites etc. is used to mean including content and URL. Also, "content" means information to be sent from the server to the terminal, such as HTML data, and "URL" indicates the location of the content on the network.

(Overview of the embodiment)
First, an outline of a malignant URL candidate acquisition technique according to an embodiment of the present invention will be described with reference to FIG. As shown in FIG. 1, a malignant URL candidate acquisition device 10 is provided in the present embodiment. The malignant URL candidate acquisition device 10 is connected to the Internet 30, and has a function of searching information on the Internet 30 using the search device 20 on the Internet 30. Each search device is a device provided with a search engine, and includes one or more servers. The network to which the malignant URL candidate acquisition device 10 searches is not limited to the Internet 30, and may be a communication network other than the Internet 30.

  In step 1, the malignant URL candidate acquisition device 10 acquires a feature character string that is likely to exist at a malignant site. With regard to the characteristic character string, the malignant URL candidate acquiring device 10 may acquire the characteristic character string according to a viewpoint described later, or may input a characteristic character string already acquired.

  The malignant URL candidate acquisition device 10 performs a search using the search device 20 on the Internet 30 by using the characteristic character string acquired in step 1 as a key (step 2). Although the details will be described later, the search device 20 is a device provided with a search engine for general Internet search, a device provided with a source code search engine, a device providing a malignant site accumulation site, and the like.

  The malignant URL candidate acquisition device 10 outputs the URL itself obtained in the search of step 2 or the URL selected according to a predetermined criterion as a malignant URL candidate.

  The output malignant URL candidate is used as a seed of the malignant URL candidate in the technology described in, for example, Patent Document 1, and it is determined whether the malignant URL candidate is actually a malignant URL.

(Configuration Example of Malignant URL Candidate Acquisition Device 10)
FIG. 2 shows a configuration diagram of the malignant URL candidate acquisition device 10 according to the present embodiment. As shown in FIG. 2, the malignant URL candidate acquisition device 10 according to the present embodiment includes a characteristic character string acquisition unit 11, a characteristic character string storage unit 12, a search control unit 13, a search execution unit 14, and a search result storage unit 15. , And the URL candidate determination unit 16. The function classification and function name of the malignant URL candidate acquiring device 10 shown in FIG. 2 are merely an example. The function classification and function name of the malignant URL candidate acquiring device 10 capable of executing the process in the present embodiment are not limited to those shown in FIG. The outline of each functional unit is as follows.

  The characteristic character string acquisition unit 11 acquires a characteristic character string by receiving an input of a characteristic character string from the outside, or acquires a characteristic character string from content and / or a URL of a known malignant site. The acquired example of characteristic characters is stored in the characteristic character example storage unit 12.

  The search control unit 13 determines the control content such as which search device is used to perform the search and in what procedure the search is performed according to the type of each of the characteristic character strings stored in the characteristic character string. . The search execution unit 14 executes a search for a search device on the Internet 30 using the characteristic character string in accordance with the control content determined by the search control unit 13. The search results (URL, part of the content, etc.) by the search executed by the search execution unit 14 are stored in the search result storage unit 15. The search control unit 13 and the search execution unit 14 may be integrated as a search unit (search means).

  The URL candidate determination unit 16 determines a malignant URL candidate from the URLs of the search results stored in the search result storage unit 15, and outputs the determined malignant URL candidate.

  The malignant URL candidate acquisition device 10 according to the present embodiment can be realized, for example, by causing one or more computers to execute a program in which the processing content described in the present embodiment is described. That is, the function possessed by the malignant URL candidate acquiring apparatus 10 executes a program corresponding to the process performed by the malignant URL candidate acquiring apparatus 10 using hardware resources such as a CPU, a memory, a hard disk, etc. built in the computer. It is possible to realize by doing. The program can be recorded on a computer readable recording medium (portable memory or the like), and can be stored or distributed. Moreover, it is also possible to provide the above program through a network such as the Internet or e-mail.

(Detailed Operation of Malignant URL Candidate Acquisition Device 10)
Hereinafter, the detailed operation of the malignant URL candidate acquisition device 10 will be described according to the flowchart of FIG. Although the attack site is mentioned as an example of a malignant site in the detailed operation explanation here, this is an example, and the present invention is applicable to a malignant site which is not limited to the attack site. The attack site is, for example, a site such as drive-by download where a certain attack is triggered when accessed by a browser or the like.

<Step 101: Feature String Extraction>
First, as step 101, extraction of a characteristic character string is performed. The characteristic character string may be extracted automatically by a device (computer) outside the malignant URL candidate acquiring device 10 or manually by using a computer. The malignant URL candidate acquiring device 10 The characteristic character string acquisition unit 11 may automatically perform the process.

  An attack site is often created using an attack tool called ExploitKIT (hereinafter referred to as EK), which is a type of application, and characteristic character strings are included in the content of the attack site created with each EK. Often included. Also, even if EK is not used, characteristic code that is essential to an attack tends to be present in the content of the attack site.

  Based on the above findings, in the present embodiment, a characteristic character string included in the content of a known attack site and / or a characteristic character string included in an attack URL that is a URL of a known attack site is extracted. . More specifically, extraction is performed in the following manner. In the following, the feature character string included in the content and the feature character string included in the URL will be described separately. In FIG. 3, the characteristic character string contained in the content is shown as an HTML system, and the characteristic character string contained in the URL is shown as a URL system.

<Characteristic string included in content such as HTML data>
Viewpoint (1): Features that appear on the specifications of EK and obfuscation applications (1-1) In various EKs (applications), feature strings that appear unique to each application exist. Since such an EK is incorporated into a site to attack, a characteristic character string unique to the application is extracted from the content of the EK or a known attacking site, and a site having the characteristic character string is searched. The attack URL candidate can be obtained with.

  As an example, as shown in (a) of FIG. 4, “<? PHP // 003ab if (! Extension_loaded ('ionCube Loader'))” is a character string that is characteristic of EK called Blackhole EK. Note that "" is not included in the feature character string in the feature character string in the example. The same applies to the following.

  (1-2) The creator of an attack site often obfuscates the source code of the content using a source code obfuscation tool in order to make it difficult to decipher the source code of the site. In particular, many sites using EK are obfuscated using source code obfuscation tools. From this point of view, in the present embodiment, the characteristic character string appearing when using the source code obfuscation tool is an attack site created using the source code obfuscation tool itself or the source code obfuscation tool. Extract from the content of

  As an example of such a characteristic character string, as shown in FIG. 4B, there is “/ * km0ae9gr6m * /” extracted from content etc. created using Blackhole EK.

  (1-3) Even when the content of the attack site is obfuscated by the source code obfuscation tool, there are character strings that are not obfuscated by some source code obfuscation tools. For example, a character string specific function name or the like. In this embodiment, from such a point of view, the character string that is not obfuscated is extracted from the content of the attack site and the like created using the source code obfuscation tool.

  As an example of such a feature string, as shown in (c) of FIG. 4, “function muls (cqq, lg6) {var hx, ik, bhf, in the content of the attack site created using Fiesta EK, There are dr, jbf, fr; ik ''; hx = ''.

Viewpoint (2): Features that emerge from the nature of the attack site itself Content provided from the attack site is essential to include a feature string that is not in the content of the regular site, in order to trigger the attack code at the attack destination It is. In this embodiment, from such a point of view, for example, the characteristic character string related to the attack code is extracted from the content of the known attack site.

  As an example of such a characteristic character string, as shown in FIG. 4D, “clsid: BD 96 C 556, which is a class ID indicating RDS.DataControl in the case of vulnerability (CVE-2006-0003 (MS 06-014)) -65A3-11D0-983A-00C04FC29E36 ".

Viewpoint (3): Characteristics that emerge from the nature of the link relationship of the attack site As the tampering entrance site, attackers often cause site transition with iframes and redirects. From such a point of view, a character string including a code for causing transition by iframe or redirect is extracted as a characteristic character string, for example, from the content of the tampered entrance site or the like.

  As an example of such a feature string, as shown in FIG. 4 (e), “<iframe src =" / news / information-ups-934387535.php? Iczbdqgs = 1f: 1h: 1l: 1l: 1f: 2w & wtxsk = o & qfgksyd = 1 m: 1 f: 1 m: 31: 31: 1 f: 1 j: 31: 1 l: 1 l & 1 a: 1 f: 1 d: 1 d: 1 f: 1 d: 1 f: 1 d: 1 f "> </ iframe>

  In addition, although the characteristic character string of said three viewpoints was shown as an example of the characteristic character string contained in content, such as HTML data, the viewpoint of extraction of the characteristic character string contained in the said content is restricted to said example. Do not mean. In addition, the characteristic character string extracted in each of the above viewpoints may be used alone as it is, or a plurality of characteristic character strings may be used in combination, or a part of the characteristic character strings extracted in each perspective ( Fragments may be used, or a combination of fragments may be used. Moreover, all of a plurality of viewpoints may be used, or a part may be used.

  As described above, with regard to making the fragment / combination into the characteristic character string, the characteristic character string of the fragment / combination may be created at the extraction stage, or at the stage of determination of search procedure etc. or the stage of search execution. Fragment / combination feature strings may be created.

<Feature string included in URL>
The URL of an attack site created using EK often contains a characteristic string unique to EK. From this point of view, in the present embodiment, for example, the characteristic character string is extracted from the URL of the attack site created by EK. As an example of such a feature string, there is “.com / content / main.php? Page =, /r57.php” as shown in FIG. 4 (f).

  In addition, a combination of a character string obtained by decomposing a path portion in a character string of a URL extracted from the above viewpoint, and a decomposed character string may be acquired as a feature character string.

  As shown in (g) of FIG. 4, there is "main.php" as an example of the path part decomposed character string corresponding to the above specific example, and there is "com, main.php" as an example of combination.

  As described above, with regard to decomposing / combining into the characteristic character strings, decomposing / combining characteristic character strings may be created at the extraction stage, or at the stage of determination of a search procedure or the like or at the stage of search execution. It is also possible to create disassembly / combination feature strings.

  Although the example of extraction of the characteristic character string included in the content and the example of extraction of the characteristic character string included in the URL have been described above, the characteristic character string (whole, fragment, etc.) included in the content and the URL A combination with the feature character string (whole, part, etc.) included in the symbol string may be used as the feature character string.

  The characteristic character string acquiring unit 11 in the malignant URL candidate acquiring device 10 receives the input of the characteristic character string extracted as described above, and stores the characteristic character string in the characteristic character string storage unit 12. Alternatively, the characteristic character string acquisition unit 11 in the malignant URL candidate acquisition device 10 automatically acquires characteristic character strings from contents / URLs and the like of known attack sites from the viewpoint as described above, and the characteristic character strings acquired are characterized. It is stored in the character string storage unit 12.

<Step 102: Determination of Optimal Search Information for Each Device and Procedure>
Next, using the feature character string stored in the feature character string storage unit 12, the search control unit 13 in the malignant URL candidate acquisition device 10 uses which feature character string for which search device, and how Decide whether to search according to For example, the search control unit 13 determines search information and procedures for each device according to a predetermined rule.

  In this embodiment, as an example of a search device used for a search, three types of a device provided with an Internet search engine, a device provided with a source code search engine, and a malignant site storage site (a device storing information on malignant sites) are used. It is supposed to be done. However, the present invention is not limited to a specific number / type of search devices. For example, one type of search device may be used. In addition, even when one type of search device is used, a search may be performed using a plurality of search devices (search sites).

  Hereinafter, features of each search device will be described, and search information suitable for the search device and an example of a search procedure will be described. The search control unit 13 determines the search information and the search procedure. All of the contents of the search described below (contents determined by the search control unit 13) may be executed, or only a part may be executed.

(1) Internet Search Engine The Internet search engine is a search engine that provides a general Internet search service, and is a search engine provided by, for example, Google (registered trademark), bing (registered trademark) or the like.

  In general, the Internet search engine caches information (content, URL, etc.) of a site once accessed, and by using the cache, a search related to a search request can be performed at high speed. Note that not only the Internet search engine but also a source code search engine and a malignant site storage site described later use such a cache.

  The Internet search engine has an advantage that it has a large amount of cache and can search by specifying various conditions when searching. The latter feature may be reworded as having a high degree of freedom in IF (interface). While Internet search engines have such advantages, they have the disadvantage that search results may contain many unintended results. The latter can be reworded as "there is a lot of trash".

  With such a feature, the Internet search engine can be applied to either an HTML system characteristic character string or a URL system characteristic character string. Therefore, in the present embodiment, for example, the search control unit 13 is an HTML system characteristic. It decides to search using the Internet search engine for each of the character string and the URL system characteristic character string. The search here may be, for example, a search using a normal search window or a program search using an API on the search engine side.

  As described above, since the search results using the Internet search engine contain a lot of trash, in the present embodiment, the search control unit 13 uses the white list to attack the search results using the Internet search engine. Decide to perform the procedure to execute processing excluding regular URLs that are not URLs. Here, the whitelist is, for example, a list in which URLs are arranged in descending order of the number of times of access on the Internet, and as such a whitelist, a whitelist provided by alexa, OpenDNS, DMOZ or the like can be used. That is, in the above procedure, processing is performed to remove the URLs included in the white list from the results obtained by the search.

  In addition, for example, the search control unit 13 may determine to perform an inurl search in order to perform a search in the URL for the URL characteristic character string.

  Further, for example, the search control unit 13 holds a specific FQDN (Fully Qualified Domain Name) in advance, and determines to perform a search using an HTML-based characteristic character string in the specific FQDN. The site indicated by the specific FQDN is, for example, an attack site, a falsification site, an operation shell placement site, or the like. A search within a specific site can be realized by performing a site search. Also, for example, using the link search (search on the to-link), find the URL of the site linked to the site of the specific FQDN, and perform the search using the characteristic character string of the HTML system at the site of the URL. You may decide.

(2) Source Code Search Engine The source code search engine is a search engine that searches for source code such as CSS, HTML, Javascript (registered trademark) in a web site. As source code search engines, for example, nerdydata, meanpath, etc. are available. The source code search engine is characterized in that although the cache amount is medium, it is possible to accurately identify a site having source code including a character string related to a search request.

  In view of the above characteristics, the search control unit 13 determines that the search by the source code search engine is to be performed using the HTML characteristic character string.

(3) Malignant site storage site A malignant site storage site is a site that stores information on malignant sites such as attack sites and enables search, for example, scumware. org, dfk. There is a site such as de. In the malignant site accumulation site, information on malignant sites is accumulated, but the amount of cache is small and the degree of freedom of IF is small.

  Since the search method (IF) of the malignant site storage site is limited to IP search, FQDN search, path search and the like, the search control unit 13 may use, for example, a characteristic character string (a URL system or an HTML system). It is decided to perform a search for malignant site storage sites using a predetermined search procedure.

  The predetermined search procedure, for example, acquires the FQDN part from the characteristic character string having the FQDN part, acquires the IP address corresponding to the FQDN part using the whois command, and stores the malignant site using the IP address as a key It is to search the site. In the search procedure, an FQDN search or "IP address acquisition by whois-> IP address search" may be performed using the FQDN obtained from the search result obtained by the IP search.

  Also, as a predetermined search procedure, the FQDN part is obtained from the characteristic character string having the FQDN part, the FQDN search is performed first, and the IP address search is performed using the IP address obtained by the search. It is also good. In the procedure, when the search result obtained by the FQDN search is the FQDN, the IP address is searched after obtaining the IP address by whois.

  Further, the search control unit 13 may decide to perform partial FQDN search (partial path search) when performing the above-mentioned FQDN search. For example, when the original FQND is “aaa.bbb.ccc.yahoo.co.jp”, “bbb.ccc.yahoo.co.jp”, “ccc.yahoo.co.jp”, “fcc. Decide to search using all or part of "yahoo.co.jp".

<Step 103: Search Execution>
The search control unit 13 instructs the search execution unit 14 to execute a search by passing the determined characteristic character string and information indicating the search procedure to each search device to the search execution unit 14. As a search procedure, a pattern of the procedure may be determined in advance, and information indicating which pattern is to be searched may be passed to the search execution unit 14 or a search procedure may be passed in the form of a program code.

  Also, instead of giving control to the search execution unit 14 passing the characteristic character string / search procedure to the search execution unit 14, the search control unit 13 has information on the search procedure, and the search control unit 13 performs the search The search may be executed by specifying the characteristic character string and the search site to the search execution unit 14 according to the procedure.

  By the search execution in step 103, for example, the search result is stored in the search result storage unit 15 for each search device (Internet search engine, source code search engine, malignant site storage site, etc.). The search result stored in the search result storage unit 15 may be only a URL that can be used as a malignant URL candidate, or in addition to the URL, information of the site obtained by the search (abstract, part of source code, etc.) May be included. When a plurality of characteristic character strings are stored in the characteristic character string storage unit 12, the search may be executed for each (all) characteristic character strings according to the control content determined in step 102. , May be performed for some feature strings.

  Since the search result is the result of the search according to the above-described procedure, for example, the search result by the Internet search engine is the search result after filtering by the white list.

<Step 104: Malignant URL Candidate Determination>
Next, the URL candidate determination unit 16 determines a URL to be a malignant URL candidate (seed) from the search results stored in the search result storage unit 15. With regard to the determination here, for example, if the number of obtained URLs is equal to or less than a predetermined threshold value, URLs of all search results may be determined as malignant URL candidates. Further, regardless of the number of obtained URLs, URLs of all search results may be determined as malignant URL candidates.

  In addition, if the number of obtained URLs is larger than a predetermined threshold, or regardless of the number of obtained URLs, the URL candidate determination unit 16 determines that URLs obtained from a plurality of search devices are malignant URL candidates. It may be determined as For example, when there are three search devices, search device A, search device B, and search device C as search devices (search engine, search site, etc.), a result of performing a search based on a certain characteristic character string by each search device , URL1 is obtained only from the search device A, and URL2 is determined not to set the URL1 as a malignant URL candidate but to set the URL2 as a malignant URL candidate, for example, when obtained from the search device B and the search device C. Do. In addition, scoring may be performed in consideration of information other than the URL obtained as the search result, and the score may be output. Alternatively, a score may be provided with a threshold, and one having a threshold or more may be determined as a malignant URL candidate and output.

(About other search condition extraction)
As shown in step 201 of FIG. 3, in the search for each of the Internet search engine, the source code search engine, and the malignant URL storage site described above, the search control unit 13 selects a search target as a specific IP address, a specific FQDN, It may decide to focus on a specific VPS (hosting service of virtual dedicated server). This search condition is considered to be effective because it is known from the inventor's past findings that a malignant site is likely to exist for a specific IP address / specific FQDN / specific VPS.

  Also, the search for the specific IP address / specific FQDN / specific VPS may be performed independently.

  For example, for a particular VPS, as the security of a particular VPS provider is weak and prone to tampering, list the corresponding FQDN from the IP range of the particular VPS. For example, rebtex is used here. The FQDN itself can be used as an attack URL candidate (seed). This is because the top site is often embedded with a falsification code for attacking sites.

(Effects of the embodiment, etc.)
As described above in detail, in the present embodiment, the combination of “feature character string extraction”, “determination of optimum search information for each device and procedure”, and “determination of URL candidate” shown in the flow chart of FIG. By carrying out the process, it is possible to obtain many seeds with a high probability of malignancy. In addition, by combining “other search condition extraction”, it is possible to obtain a seed with a higher probability of malignancy. With the technology of the present embodiment, unknown malignant URLs can be efficiently discovered from the Internet space. As a result, many malignant URL candidates can be provided.

(Summary of the embodiment)
According to the present embodiment, a malignant URL candidate acquiring device for acquiring a malignant URL candidate that is a URL used to detect a malignant site, which is a character string used as a character string used in a known malignant site A characteristic character string storage unit that stores a string, a search unit that executes a search for a search device on the Internet by using the characteristic character string as a keyword, and a malignancy based on the search result obtained by the search unit There is provided a malignant URL candidate acquiring apparatus comprising: determining means for determining URL candidates.

  The search means performs a search based on the characteristic character string in a specific site when using a search device provided with an internet search engine as the search device, or a search based on the characteristic character string in a URL It can be carried out.

  The search means may perform a search based on a characteristic character string included in the content of a known malignant site, when using a search device provided with a source code search engine as the search device.

  When the search unit uses a search device in which information on a malignant site is stored as the search device, the search unit acquires an IP address from the FQDN portion included in the characteristic character string and performs a search based on the IP address. Good.

  When the search unit uses a search device including an Internet search engine as the search device, the search unit removes a URL included in a white list from the result obtained by the search for the search device as the search result. It is also good.

  The search means performs a search based on the characteristic character string using a plurality of search devices, and the determination means uses URLs obtained from a plurality of search devices of the plurality of search devices as the malignant URL candidate. It may be determined.

  The characteristic character string is, for example, a character string included in the content of the malignant site created using a predetermined application, a character string included in the URL of the malignant site, a character for activating the attack code at the attack destination It is a string or a string indicating transition to another site.

(Section 1)
A malignant URL candidate acquisition device for acquiring a malignant URL candidate, which is a URL used to detect a malignant site,
Feature string storage means for storing a feature string that is a string used at a known malignant site;
Search means for executing a search for a search device on the Internet by using the characteristic character string as a keyword;
A determination unit that determines a malignant URL candidate based on a search result obtained by the search unit;
Malignant URL candidate acquisition device provided with
(Section 2)
The search means is
When using a search device provided with an internet search engine as the search device, a search based on the characteristic character string is performed in a specific site, or a search based on the characteristic character string in a URL is performed.
The malignant URL candidate acquisition device according to claim 1.
(Section 3)
The search means is
When using a search device provided with a source code search engine as the search device, the search is performed based on the characteristic character string included in the content of the known malignant site
The malignant URL candidate acquisition device according to the first or second aspect.
(Section 4)
The search means is
When using a search device in which information on a malignant site is stored as the search device, an IP address is acquired from the FQDN portion included in the characteristic character string, and a search is performed based on the IP address
The malignant URL candidate acquisition device according to any one of the items 1 to 3.
(Section 5)
The search means is
When using a search device provided with an internet search engine as the search device, the result obtained by removing the URL included in the white list from the result obtained by the search for the search device is used as the search result.
The malignant URL candidate acquiring apparatus according to any one of the items 1 to 4.
(Section 6)
The search means performs a search based on the characteristic character string using a plurality of search devices,
The determination means determines, as the malignant URL candidate, a URL obtained from a plurality of search devices among the plurality of search devices.
The malignant URL candidate acquiring apparatus according to any one of the items 1 to 5.
(Section 7)
The characteristic character string is a character string included in the content of a malignant site created using a predetermined application, a character string included in the URL of the malignant site, a character string for activating an attack code at an attack destination, Or, it is a character string that indicates the transition to another site
The malignant URL candidate acquiring apparatus according to any one of the items 1 to 6.
(Section 8)
A malignant URL candidate acquisition method executed by a malignant URL candidate acquisition device for acquiring a malignant URL candidate that is a URL used to detect a malignant site,
The malignant URL candidate acquisition device includes a characteristic character string storage unit that stores a characteristic character string that is a character string used at a known malignant site;
A search step of executing a search on a search device on the Internet by using the characteristic character string as a keyword;
A determination step of determining a malignant URL candidate based on the search result obtained by the search step;
Malignant URL candidate acquisition method comprising
(Section 9)
A program for causing a computer to function as each means in the malignant URL candidate acquisition device according to any one of items 1 to 7.
The present invention is not limited to the above embodiment, and various modifications and applications are possible within the scope of the claims.

10 Malignant URL Candidate Acquisition Device 20 Search Device 30 Internet 11 Characteristic Character String Acquisition Unit 12 Characteristic Character String Storage Unit 13 Search Control Unit 14 Search Execution Unit 15 Search Result Storage Unit 16 URL Candidate Determination Unit

Claims (8)

A malignant URL candidate acquisition device for acquiring a malignant URL candidate, which is a URL used to detect a malignant site,
Feature string storage means for storing a feature string that is a string used at a known malignant site;
Search means for executing a search for a search device on the Internet by using the characteristic character string as a keyword;
A determination unit configured to determine a malignant URL candidate based on the search result obtained by the search unit;
The search means is
The malignant URL candidate acquisition device which acquires an IP address from the FQDN part included in the characteristic character string and performs a search based on the IP address when using a search device in which information on a malignant site is stored as the search device. The search means is
When using a search device provided with an Internet search engine as the search device, a search based on the characteristic character string is performed in a specific site, or a search based on the characteristic character string in a URL is performed. Malignant URL candidate acquisition device described. The search means is
The malignant URL candidate acquisition device according to claim 1 or 2, wherein when using a search device including a source code search engine as the search device, the search is performed based on a characteristic character string included in the content of a known malignant site. The search means is
When using the search device comprising an Internet search engine as the retrieval device, of claims 1 and the search results the results obtained by removing the URL included in the whitelist from the results obtained in the search for the search device 3 The malignant URL candidate acquisition device according to any one of the above. The search means performs a search based on the characteristic character string using a plurality of search devices,
The malignant URL candidate acquisition device according to any one of claims 1 to 4 , wherein the determination unit determines a URL obtained from a plurality of search devices among the plurality of search devices as the malignant URL candidate. The characteristic character string is a character string included in the content of a malignant site created using a predetermined application, a character string included in the URL of the malignant site, a character string for activating an attack code at an attack destination, The malignant URL candidate acquisition device according to any one of claims 1 to 5 , which is a character string instructing transition to another site. A malignant URL candidate acquisition method executed by a malignant URL candidate acquisition device for acquiring a malignant URL candidate that is a URL used to detect a malignant site,
The malignant URL candidate acquisition device includes a characteristic character string storage unit that stores a characteristic character string that is a character string used at a known malignant site;
A search step of executing a search on a search device on the Internet by using the characteristic character string as a keyword;
Determining a malignant URL candidate based on the search result obtained by the search step;
In the search step, the malignant URL candidate acquisition device
When using a search device in which information on a malignant site is stored as the search device, a method for acquiring a malignant URL candidate which acquires an IP address from an FQDN section included in the characteristic character string and performs a search based on the IP address . The program for functioning a computer as each means in the malignant URL candidate acquisition apparatus of any one of Claim 1 thru | or 6 .

Images