CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is based on PCT filing PCT/JP2019/016345, filed Apr. 16, 2019, which claims priority to JP 2018-132725, filed Jul. 12, 2018, the entire contents of each are incorporated herein by reference.

FIELD

The present invention relates to an identification device, an identification method, and an identification program.

BACKGROUND

Many of cyber attacks use malware-infected terminals, which are infected with malware. When measures against cyber attacks and malware-infected terminals are taken, internet protocol (IP) addresses are often handled as unique identifiers. Specifically, the IP addresses of malware-infected terminals are used as a blacklist or signatures in some cases, and the traffic transmitted from the IP addresses are handled as abnormal traffic in some cases. The IP address used by such a malware-infected terminal is a dynamic IP address assigned by an internet service provider (ISP) in many cases.

Herein, if a dynamic IP address is assigned to a terminal, the IP address is not permanently used by the same terminal. For example, the IP address of the terminal is changed at the timing when a point-to-point protocol over Ethernet (PPPoE) session is reconnected, power is disconnected, or a change is made by ISP.

Therefore, malware-infected terminals cannot be precisely specified with dynamic IP addresses. Therefore, a method for identifying dynamic IP addresses among IP addresses has been proposed in order to avoid using the dynamic IP addresses for specification of malware-infected terminals.

For example, there has been proposed a method in which, if a PoinTeR (PTR) record of a target IP address includes a keyword designated in advance or part or all of the numerical values of first to fourth octets of the IP address, the IP address or a /24 address block including the IP address is identified as a dynamic IP address (for example, see Non Patent Literatures 1 to 4).

CITATION LIST

Non Patent Literature

Non Patent Literature 1: Yinglian Xie, Fang Yu, Kannan Achan, Eliot Gillum, Moises Goldszmidt and Ted Wobber, “How Dynamic are IP Addresses?,” in SIGCOMM'07 Proceedings of the 2007 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, pp. 301-312, 2007.Non Patent Literature 2: Philipp Richter, Georgios Smaragdakis, David Plonka and Arthur Berger, “Beyond Counting: New Perspectives on the Active IPv4 Address Space,” in IMC'16 Proceedings of the 2016 Internet Measurement Conference, pp. 135-149, 2016.Non Patent Literature 3: Yu Jin, Esam Sharafuddin and Zhi-Li Zhang, “Identifying Dynamic IP Address Blocks Serendipitously through Background Scanning Traffic,” in CoNEXT '07 Proceedings of the 2007 ACM CoNEXT conference, 2007.Non Patent Literature 4: Xue Cai and John Heidemann, “Understanding Block-level Address Usage in the Visible Internet,” in SIGCOMM'10 Proceedings of the ACM SIGCOMM 2010 conference, pp. 99-110, 2010.

SUMMARY

Technical Problem

However, the conventional dynamic IP identifying methods are not capable of accurately identifying dynamic IP addresses in some cases. For example, if the PTR record of a dynamic IP address does not match any of designated keywords, it is difficult for the conventional methods to identify the dynamic IP address. Also, if a designated keyword is included in the PTR record of an IP address which is not a dynamic IP address, the conventional methods may erroneously identify the IP address, which is not a dynamic IP address, as a dynamic IP address.

Solution to Problem

To solve a problem and to achieve an object, an identification device includes: a specification unit configured to specify a boundary dividing a row of an IP address, which is included in an IP address block and sorted by a predetermined order, into a plurality of parts based on predetermined information about the IP address; and an identification unit configured to identify the IP address included in the part as a dynamic IP address when the part divided by the boundary satisfies a predetermined condition.

Advantageous Effects of Invention

According to the present invention, dynamic IP addresses can be accurately identified.

