1. Field
The embodiments discussed herein are directed to a malware detecting apparatus and method and a monitoring apparatus.
2. Description of the Related Art
Malware of a latent type that does not perform conspicuous infection activity on a network, such as a worm, is increasing. Since such malware acts in response to an infection activity instruction from a command-and-control server a personal computer (PC) often becomes latently infected with the malware without being noticed by an end user. Thus, such malware often serves for various types of unauthorized access, for example, as a base of a SPAM or DDOS (Distributed Denial of Service) attack.
Therefore, there exists a demand for techniques for discovering such latent-type malware at an early stage. Source programs of such malware are publicly available, for example, on the Internet, so that an attacker can obtain source code of malware relatively easily and create customized malware. Therefore, a large number of varieties of such malware exist.
For pattern matching by an anti-virus software installed on a PC, an anti-virus software vendor collects and analyzes samples of malware propagating in large scale and creates patterns for detecting the malware. However, since latent-type malware does not propagate in large scale, it takes a considerable time to collect samples, so that it is difficult to create patterns for detection.
Furthermore, since a large number of varieties arises for specific malware, it is difficult to detect the malware by anti-virus pattern patching. In view of this difficulty, conventionally malware detecting techniques detect malware-infected nodes based on behavior of malware on networks. Conventionally, the amount of communication of each node is monitored, and a node for which the amount of communication exceeds a threshold is identified as an infected node.
However, since the above-described related art is directed to detecting malware that causes increasing infection at a rapid rate, it is difficult to detect latent-type malware with slow infection activity as distinguished from normal communication. Therefore, in some cases, the related art fails to identify infected nodes, or incorrectly identifies non-infected nodes as infected nodes.
For example, with techniques that identify a node for which the amount of communication exceeds a threshold as an infected node, it is difficult to set a threshold for distinguishing communication associated with infection activity by malware and normal communication. Furthermore, it is not possible to detect malware if the amount of communication associated with infection activity by malware is substantially the same as the amount of normal communication.