CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is based on PCT filing PCT/JP2017/037407, filed Oct. 16, 2017, which claims priority to JP 2017-040543, filed Mar. 3, 2017, the entire contents of each are incorporated herein by reference.

FIELD

The present invention relates to a selection apparatus, a selection method, and a selection program.

BACKGROUND

In documents for Microsoft Office (registered trademark), a threat due to a malicious document file using a macro (hereinafter, referred to as a malicious-macro-added document file) has become apparent. The malicious document file is a document file that is configured to start an attack leading to malware infection when this file is opened by a viewer application (hereinafter, referred to as a viewer) to view contents. The malicious-macro-added document file is a document file that starts an attack when this file is opened by a viewer and the macro is executed.

The document file in which a macro is usable includes Microsoft Office documents, and, as examples of file formats, document files in the Object Linking and Embedding (OLE) format, such as DOC, XLS, or PPT, and document files the Office Open XML (hereinafter, referred to as OOXML) format, such as DOCM, XLSM, or PPTM, are included.

The above-described files can include a macro that is written using a programming language called Visual Basic for Applications (hereinafter, referred to as VBA). In the macro using VBA, it is possible to use Application Programming Interface (API), ActiveX objects, and the like provided by Windows, so that most of operation that an attacker attempts to realize can be implemented by the macro. Therefore, a user is largely affected when the malicious macro is executed.

Furthermore, in a malicious document file that attacks a vulnerability using an exploit code, it is necessary to detect an exploitable vulnerability to implement the attack and it is also necessary that an environment of an attack target has this vulnerability. In contrast, in a malicious document file that uses a malicious macro, it is relatively easy to implement an attack because it is not necessary to attack the vulnerability as described above. In view of the above, the importance of countermeasures against the malicious-macro-added document file is increased.

To protect a user from the malicious-macro-added document file as described above, it is general to provide a defense mechanism on the viewer side. For example, Microsoft Office that is the most common viewer used for document files in the OLE format as described above includes a sandbox called a protected view. The protected view is a read-only mode in which an edit function is disabled, and in the protected view, it is impossible to execute a macro unless a user gives permission. Therefore, it is possible to prevent a situation in which malware infection occurs immediately after the malicious-macro-added document file is opened by the viewer. With the effect of the defense mechanism as described above, malicious-macro-added document files have rarely been observed since the beginning of the 2000s.

However, in recent years, malicious-macro-added document files are emerging again. These malicious-macro-added document files include, in the documents, text for what is called social engineering to artfully lead a user to disable the protected view. Accordingly, the malicious-macro-added document files use a technique of leading the user to deactivate the protected view and enabling execution of macros, to thereby implement attacks without influence of the protected view. The defense mechanism such as the protected view is not able to exert effects when disabled by the user. Therefore, the attack technique using the social engineering as described above prevents the defense mechanism from fully implementing functions.

The malicious-macro-added document files as described above are frequently used in a campaign. The campaign is a series of attacks to implement attacks to a large number of targets in a short time. In a campaign using a malicious file, it is often the case that files are transmitted to a large number of targets in a single organization. Therefore, as entrance measures in organizations, there is a demand for a technique of effectively determining malignancy of a large amount of malicious-macro-added document files.

To cope with this, a detection technique based on dynamic analysis has been known as one of effective techniques for detecting threats due to malicious-macro-added document files and taking countermeasures. The dynamic analysis is a technique of opening an inspection target document file by a viewer, executing a macro, and monitoring whether the macro shows malicious behaviors, thereby detecting a malicious document file.

As the dynamic analysis as countermeasures against macros, the following techniques have been proposed. For example, a dynamic detection technique of opening a document file by a viewer application and causing a macro to perform malicious operation while monitoring processes and files has been proposed (for example, see Non Patent Literature 1). Most of macros of recent years are configured to perform downloading, dropping, and execution of malware as main malicious behaviors, and therefore, it is possible to recognize a feature of the malicious behaviors by monitoring generation of files and generation of processes. Therefore, according to the technique described in Non Patent Literature 1, it may be possible to detect document files with malicious macros.

For another example, a dynamic technique of permitting execution of only macros that perform closed operation in document files and inhibiting interference with environments outside the document files has been proposed (for example, see Non Patent Literature 2). Most of malicious operation of macros of recent years needs functions of systems provided outside the document files. Therefore, according to the technique described in Non Patent Literature 2, it may be possible to detect malicious macros.

Furthermore, as another effective technique as countermeasures against document files with malicious macros, a detection technique based on static analysis has been known. For example, a technique of statically detecting a malicious document on the basis of appearance frequencies of words used in a document file or in a macro has been proposed (for example, see Non Patent Literature 3). Words used in the malicious-macro-added document files have some tendencies, and therefore, according to the technique described in Non Patent Literature 3, it may be possible to detect a certain malicious macro, such as an unobfuscated malicious macro, at a relatively high speed.

CITATION LIST

Patent Literature

Non Patent Literature 1: K. Tanuja, C H. Praneeth, Dr D. Haritha, “Dissecting Malicious Word, PDF Documents”, International Journal of Science Engineering and Advance Technology, Vol. 3, No. 3, pp. 61-68

Non Patent Literature 2: J. Dechaux, E. Filiol, “Proactive defense against malicious documents: formalization, implementation and case studies”, Journal of Computer Virology and Hacking Techniques, Volume 12, Issue 3, pp. 191-202

Non Patent Literature 3: Jing-Yao Lin, Hsing-Kuo Pao, “Multi-View Malicious Document Detection”, In Proceedings of the Conference on Technologies and Applications of Artificial Intelligence (TAAI), 2013, pp. 170-175

SUMMARY

Technical Problem

However, in the dynamic analysis techniques represented by the sandbox and the techniques described in Non Patent Literatures 1 and 2, it is necessary to perform medium-term observation (for example, about 5 minutes for a general sandbox) in order to execute a macro of an inspection target document file in a virtual environment and detect malicious behaviors; therefore, there is a common problem of low-speed performance, in which a certain period of time is needed for file inspection. Therefore, it is difficult to apply the dynamic analysis technique when a large number of files are transmitted to a single organization as in an attack called a campaign.

Furthermore, in the technique described in Non Patent Literature 3, because a static method is adopted, there is a problem in that it is difficult to recognize a feature of an obfuscated malicious macro, attacker's evasion may be achieved only with use of words that appear in a document, and detection accuracy may be reduced.

The present invention has been conceived in view of the foregoing situations, and an object of the present invention is to provide a selection apparatus, a selection method, and a selection program capable of effectively and accurately select a malicious-macro-added document file to be analyzed.

Solution to Problem

A selection apparatus includes: a macro analysis unit configured to acquire a macro feature amount from a macro in a document file to which the macro is added; a text analysis unit configured to acquire a text feature amount from text in the document file;

a cluster analysis unit configured to perform clustering using the macro feature amount and the text feature amount; and a selection unit configured to select an analysis target document file based on a result of the clustering.

Advantageous Effects of Invention

According to the present invention, it is possible to effectively and accurately select a macro document to be analyzed.

