Computer Security Symposium 201521 - 23 October 2015ࢿࢵࢺ࣮࣡ࢡ㏻ಙࡢ┦㛵ᛶ࡟ᇶ࡙ࡃ Drive-by Download ᨷᧁ᳨▱ᡭἲᑎ⏣ᡂ࿃͊ᑠᯘᓧ͊ᑠฟ࿴ᘯ͊℩ᡞཱྀṊ◊͊ 㐨᰿៞἞͊⩚⸨㐓ᩥ͊ᒣୗᗣ୍͊͊ᰴᘧ఍♫PFU
220-8567⚄ዉᕝ┴ᶓ὾ᕷす༊ࡳ࡞࡜ࡳࡽ࠸ 4 ୎┠ 4-5ᶓ὾࢔࢖࣐࣮ࢡࣉࣞ࢖ࢫ࠶ࡽࡲࡋᖺࠎ㧗ᗘ໬ࡀ㐍ࡴ࣐࢙ࣝ࢘࢔ࡣ㸪ᵝࠎ࡞᳨▱ᅇ㑊ᡭἲࢆ⏝࠸࡚⤌⧊ࢿࢵࢺ࣮࣡ࢡࡢ
ฟධཱྀࡸ࢚ࣥࢻ࣏࢖ࣥࢺ࡟࠾ࡅࡿࢭ࢟ࣗࣜࢸ࢕ᑐ⟇ࢆᕦጁ࡟ࡍࡾᢤࡅ࡚࠸ࡿ㸬ࡑࡇ࡛ᮏ✏࡛ࡣ㸪Drive-by Downloadᨷᧁ㸦௨ୗ㸪DbDᨷᧁ㸧ࡀṇつ࢔ࣉࣜࢣ࣮ࢩࣙࣥ࡟ࡣぢࡽࢀ࡞࠸≉᭷
ࡢ㏻ಙᣲືࢆ♧ࡍࡇ࡜࡟╔┠ࡋ㸪ࢿࢵࢺ࣮࣡ࢡ㏻ಙࢆ┘どࡍࡿࡇ࡜࡛㸪ᨷᧁ⪅࠾ࡼࡧ࣐ࣝ࢘
࢙࢔࡟ᐹ▱ࡉࢀࡿࡇ࡜࡞ࡃ㸪DbDᨷᧁ࡟ࡼࡿឤᰁ➃ᮎࢆ᳨ฟࡍࡿᡭἲࢆᥦ᱌ࡍࡿ㸬ᮏᡭἲ࡛ࡣ㸪➃ᮎࡢ㏻ಙࢆ┘どࡋ㸪࣐࢙ࣝ࢘࢔άື㑄⛣ࣔࢹࣝ࡬㏻ಙᣲືࢆᙜ࡚ࡣࡵ㸪┦㛵ศᯒࡍࡿࡇ࡜࡟ࡼࡾ⤌⧊ෆ࡟₯ࡴឤᰁ➃ᮎࢆ᳨▱ࡍࡿ㸬ࡲࡓ㸪᳨ド࡜ࡋ࡚㸪DbDᨷᧁ୍㐃ࡢ㏻ಙࢹ࣮
ࢱࢆྵࡴMWS Datasetsࢆ౑⏝ࡋ㸪ᮏᡭἲࡢ᭷ຠᛶࢆホ౯ࡋࡓ㸬

Drive-by Download Detection Method based on Network Traffic Correlation
Seigo Terada†

Takashi Kobayashi†

Mugen Setoguchi†

Kazuhiro Koide†
Keiji Michine†

Itsufumi Hato†

Kouichi Yamashita††PFU LIMITED
YOKOHAMA i-MARK PLACE 4-5 MinatoMirai 4-chome, Nishi-ku, Yokohama-shi, Kanagawa
220-8567, JAPAN
Abstract Annually, improved Malware have invaded into a network by various evasion techniques. In
this paper, therefore, we focus on Drive-by Download attacks (DbD attacks) has specific network
traffic behaviors are different from formal applications, and propose the method detects devices
infected by DbD attacks by observing on a network traffic without notification to attacker or malware.
Furthermore, the method deals with correlation analysis using malware activity transition model whichbased on common traffic behaviors of malware. Also, for testing, we evaluated the effectiveness of themethod by using MWS Datasets has some traffic flow data of DbD attacks.

1. ࡣࡌࡵ࡟᫖௒㸪࣐࢙ࣝ࢘࢔ឤᰁ࡟ࡼࡾᵝࠎ࡞⤌⧊ࡢ᝟ሗ₃࠼࠸ࡀ㦁ࡀࢀ㸪ᖺࠎ㧗ᗘ໬ࡍࡿ࣐ࣝ࢘
࢙࢔࡬ࡢᑐᛂࡀᚲせ࡜࡞ࡗ࡚࠸ࡿ㸬࣐࢙ࣝ࢘࢔ࡢឤᰁ⤒㊰ࡣᵝࠎ࠶ࡿࡀ㸪Web ⤒⏤࡛➃ᮎࢆឤᰁࡉࡏࡿᨷᧁᡭἲࡢ 1 ࡘ࡜ࡋ࡚㸪Web ࣈ－1－ࣛ࢘ࢨࡸ➃ᮎෆ࢔ࣉࣜࢣ࣮ࢩࣙࣥࡢ⬤ᙅᛶࢆ฼⏝ࡍࡿ Drive-by Download ᨷᧁ(௨ୗ㸪DbDᨷᧁ)ࡀ࠶ࡿ㸬DbD ᨷᧁࡣ㸪ᶆⓗ࡜ࡍࡿ⤌⧊ࡸಶேࡀ㜀ぴࡍࡿ Web ࢧ࢖ࢺୖ࡟⬤ᙅᛶᨷᧁࢆ⾜࠺ᝏᛶࢥࣥࢸࣥࢶࢆ⏝ពࡋ㸪Web ࢧ࢖ࢺࢆ㜀ぴࡋࡓ฼⏝⪅ࡢ➃ᮎ࡬⛎ᐦ⿬࡟࣐࢙ࣝ࢘࢔ࢆࢲ࣮࢘ࣥࣟࢻࡉࡏࡿᨷᧁᡭἲ࡛࠶ࡿ㸬DbD ᨷᧁࡢࡼ࠺࡞እ㒊࠿ࡽࡢ࣐࢙ࣝ࢘࢔౵ධࢆ㜵ࡄࡓࡵࡢࢭ࢟ࣗࣜࢸ࢕〇ရ࡜ࡋ࡚㸪࢔ࣥࢳ࢘࢕ࣝࢫ〇ရࡸࢧࣥࢻ࣎ࢵࢡࢫ〇ရ࡞࡝ᵝࠎ࡞ࡶࡢࡀ࠶ࡿ㸬ࡋ࠿ࡋ㸪㏆ᖺࡢ㧗ᗘ࡞࣐࢙ࣝ࢘࢔ࡣ㸪ᑐ⟇ᢏ⾡࡜ྠᵝ࡟㐍໬ࢆ㐙ࡆ࡚࠾ࡾ㸪౛࠼ࡤ㸪ᐇ⾜ࢥ࣮ࢻࡢ㞴ㄞ໬ࡸ⮬㌟ࡢືస⎔ቃ࡟ᛂࡌࡓ㞃ⶸᡭἲࢆ⏝࠸࡚㸪ࡇࢀࡽࢭ࢟ࣗࣜࢸ࢕〇ရࡢ᳨▱ᶵᵓࢆᅇ㑊ࡍࡿ㸬DbD ᨷᧁ࡟࠾࠸࡚ࡣ㸪ᨷᧁࡢ≉ᛶୖ㸪HTTPࢥࣥࢸࣥࢶࡢ㑄⛣ࡀ㉳ࡇࡿࡓࡵ㸪HTTP ࣓ࢵࢭ࣮ࢪࡢ㑄⛣ࢆ┘どࡍࡿᡭἲࡀ◊✲ࡉࢀ࡚࠸ࡿ [1] [2] [3] [4] [5]㸬ᮏ◊✲࡛ࡣ㸪࣐࢙ࣝ࢘࢔ࡢάືࢆࢿࢵࢺ࣡
࣮ࢡ㏻ಙࡢほⅬ࡛ 8 ࡘࡢάືࣇ࢙࣮ࢬ࡟ᩚ⌮ࡋࡓ࣐࢙͆ࣝ࢘࢔άື㑄⛣ࣔࢹ͇ࣝࢆᐃ⩏ࡋ㸪┘どࡍࡿ➃ᮎࡢ㏻ಙࢆྛࣇ࢙࣮ࢬ࡟ᙜ࡚ࡣࡵ㸪άືࣇ࢙࣮ࢬࡢ㑄⛣ࢆ┦㛵ศᯒࡍࡿᡭἲ࡟ࡼ
ࡾ DbD ᨷᧁࡢ᳨▱ࢆ⾜࠺㸬ࡲࡓ㸪ᮏᡭἲ࡛ࡣ㸪ࢿࢵࢺ࣮࣡ࢡࢆ┘どࡋ㸪HTTP ࣜࢡ࢚ࢫࢺ࠾ࡼࡧࣞࢫ࣏ࣥࢫ࣓ࢵࢭ࣮ࢪࢆ᳨ᰝࡍࡿࡇ࡜࡛άືࣇ࢙࣮ࢬࢆ㆑ูࡍࡿ㸬ᐇ㝿ࡢ⬤ᙅᛶᨷᧁࡸ࣐࢙ࣝ࢘࢔࡟ࡼࡿάື㏻ಙࢆ➃ᮎࡢእ㒊࠿ࡽ┘どࡍࡿࡓࡵ㸪ᨷᧁ⪅ࡸ࣐࢙ࣝ࢘࢔࡟ᐹ▱ࡉࢀࡿࡇ࡜࡞ࡃ㸪DbD ᨷᧁࡀ⾜ࢃࢀࡓ➃ᮎࢆ᳨ฟࡍࡿࡇ࡜ࡀ࡛ࡁࡿ㸬ᮏᡭἲࡢ᭷ຠᛶࢆ☜ㄆ᳨࣭ドࡍࡿࡓࡵ࡟
MWS Datasets 2015 [6]࡛ᥦ౪ࡉࢀࡿ D3M㸪࠾ࡼ ࡧ Barracuda Labs ࡀ ᥦ ౪ ࡋ ࡚ ࠸ ࡿ
Threatglass [7]ࡢ DbD ᨷᧁ࡟㛵ࡍࡿ㏻ಙࢹ࣮ࢱࢆ⏝࠸࡚ホ౯ࢆ⾜ࡗࡓ㸬࢘ࢨ࠾ࡼࡧ Web ࣉࣟ࢟ࢩ࡟ほ ࢭࣥࢧࢆタ⨨ࡋ DbD ᨷᧁ࡟㛵ࢃࡿ⬣ጾࢆࣜ࢔ࣝࢱ࢖࣒࡟ᢕᥱࡍࡿࣇ࣮࣒࣮ࣞ࣡ࢡࢆᥦ᱌ࡋ࡚࠸ࡿ㸬㐍⸨ࡽ [5]ࡣ㸪HTTP ࣞࢫ࣏ࣥࢫ࣊ࢵࢲ࡟ྵࡲ
ࢀࡿContent-Type᝟ሗࢆ⏝࠸ࡿDbDᨷᧁ᳨▱ᡭἲࢆᥦ᱌ࡋ࡚࠸ࡿ㸬
HTTP ㏻ಙࡢࣜࢡ࢚ࢫࢺࣛ࢖ࣥࡸࣜࢡ࢚ࢫ
ࢺ࠾ࡼࡧࣞࢫ࣏ࣥࢫࡢ࣊ࢵࢲ࣮᝟ሗࡢࡳࢆಙࡌ࡚㸪HTTP ㏻ಙࡢ㑄⛣ࢆ┦㛵ⓗ࡟᳨ᰝࡍࡿሙྜ㸪࣐࢙ࣝ࢘࢔࡟ࡼࡿࢥࣥࢸࣥࢶഇ⿦࡟ᑐࡋ࡚⪏ᛶࡀపࡃ࡞ࡗ࡚ࡋࡲ࠺㸬ࡑࡢࡓࡵᮏᡭ
ἲ࡛ࡣ㸪HTTP ㏻ಙࡢ࣎ࢹ࢕᝟ሗࡶ᳨ᰝࡋ㸪࣊ࢵࢲ࣮᝟ሗ࡜ࡢ୍⮴ᛶࢆ☜ㄆࡋ㸪ࢥࣥࢸࣥࢶࡢ┿ഇᛶࢆ᳨ᰝࡋ࡚࠸ࡿ㸬ࡓࡔࡋ㸪ࣇ࢓࢖ࣝ㸭ࢥࣥࢸࣥࢶ⮬యࡢᝏᛶ(୙ṇ࡞ࢥ࣮ࢻࡸᨷᧁࢥ࣮ࢻࡢ᭷↓)ࢆ᳨ᰝࡍࡿ࡜⭾኱࡞ゎᯒࢆ⾜࠺ᚲせࡀ࠶ࡿࡓࡵ㸪ࢥࣥࢸࣥࢶ⮬యࡢᝏᛶ᳨ᰝࡣ⾜ࡗ࡚࠸࡞࠸㸬ࡘࡲࡾ㸪ᮏᡭἲࡣ㸪ࢥࣥࢸࣥࢶ⮬యࡢᝏᛶࢆ᳨ᰝࡍࡿᡭἲࡼࡾࡶ㍍㔞࠿ࡘ㸪࣐࢙ࣝ࢘࢔࡟ࡼࡿࢥࣥࢸࣥࢶഇ⿦࡟ᑐࡍࡿ⪏ᛶࡀ㧗࠸ᡭἲࢆ┠ᣦࡍ㸬

2. 㛵㐃◊✲

Phase ␒ྕ ࣐࢙ࣝ࢘࢔άື
Phase1 (P1) ౵ධPhase2 (P2) ᥈⣴Phase3 (P3) ឤᰁ࣭ᾐ₶Phase4 (P4) ᐇ⾜ᙧᘧࣇ࢓࢖ࣝࡢࢲ࣮࢘ࣥࣟࢻ
Phase5 (P5) C&C ࢧ࣮ࣂ᳨⣴Phase6 (P6) C&C ㏻ಙ
Phase7 (P7) ᦢྲྀ᝟ሗࡢ࢔ࢵࣉ࣮ࣟࢻPhase8 (P8) ᨷᧁάື⾲ 1 ࣐࢙ࣝ࢘࢔άືࣇ࢙࣮ࢬ

HTTP ㏻ಙࡢ㑄⛣࡟ὀ┠ࡋࡓ DbD ᨷᧁࡢ᳨▱࡟㛵ࡍࡿ◊✲࡜ࡋ࡚㸪ᑎ⏣ࡽ [1]ࡣ㸪Web࣮࣌ࢪ࢔ࢡࢭࢫ᫬ࡢ㑄⛣ࡢ≉ᚩࢆᢳฟࡋ㸪
DbD ᨷᧁࡢุู࡟ Web ࢔ࢡࢭࢫ㑄⛣ࡢ⪃៖ࡀ᭷ຠ࡛࠶ࡿࡇ࡜ࢆ♧ࡋ࡚࠸ࡿ㸬኱㇂ࡽ [2]࡜໭㔝ࡽ [3]ࡣ㸪⤌⧊ෆࡢࢿࢵࢺ࣮࣡ࢡᶵჾࡸࢭ࢟ࣗࣜࢸ࢕ᶵჾࡢࣟࢢ࠿ࡽ DbD ᨷᧁࡢᐃᛶⓗ࡞≉ᚩࢆᢳฟࡋ㸪⤫ྜศᯒࢆࡍࡿࡇ࡜
࡛ DbD ᨷᧁࢆ᳨▱ࡍࡿ᪉ᘧࢆᥦ᱌ࡋ࡚࠸ࡿ㸬ࡲࡓ㸪ᯇ୰ࡽ [4]ࡣ㸪࣮ࣘࢨࡀ౑⏝ࡍࡿࣈࣛ－2－3. ᳨▱ᡭἲ
3.1. ࣐࢙ࣝ࢘࢔άື㑄⛣ࣔࢹࣝࡲࡎ㸪ᮏᡭἲ࡛ᐃ⩏ࡍࡿ“࣐࢙ࣝ࢘࢔άື㑄⛣ࣔࢹࣝ”࡟ࡘ࠸࡚ㄝ᫂ࡍࡿ㸬ᮏࣔࢹࣝࡣ㸪࣐࢙ࣝ࢘࢔ࡢ౵ධ࡜άືࢆࢿࢵࢺ࣮࣡ࢡ㏻ಙࡢ
ほⅬ࡛ 8 ࡘࡢάືࣇ࢙࣮ࢬ࡟ᩚ⌮ࡋ(⾲ 1)㸪ࡑࢀࡒࢀࡢάືࣇ࢙࣮ࢬ࠿ࡽูࡢάືࣇ࢙࣮ࢬ࡬ࡢ㑄⛣ࢆᩚ⌮ࡋࡓࡶࡢ࡛࠶ࡿ(ᅗ 1)㸬

ᅗ 1㻌 ࣐࢙ࣝ࢘࢔άື㑄⛣ࣔࢹࣝࡇࡇ࡛ࡣ㸪౵ධࣇ࢙࣮ࢬ㸪ᐇ⾜ᙧᘧࣇ࢓࢖ࣝࡢࢲ࣮࢘ࣥࣟࢻࣇ࢙࣮ࢬ࡟ࡘ࠸࡚ㄝ᫂ࡍࡿ㸬౵ධࣇ࢙࣮ࢬ(Phase1)ࡣ㸪࣓࣮ࣝ࡞࡝࡟ῧ௜ࡉ
ࢀࡓᝏᛶࢥࣥࢸࣥࢶ࡬ࡢࣜࣥࢡ URL ࡢࢡࣜࢵࢡ㸪ᨵࡊࢇࡉࢀࡓṇつࡢ Web ࢧ࢖ࢺ࡬ࡢ࢔ࢡࢭࢫ࡞࡝ࢆዎᶵ࡟㸪ᝏᛶࢥࣥࢸࣥࢶࡀ౵ධࡍࡿࣇ࢙࣮ࢬ࡛࠶ࡿ㸬ᮏᡭἲ࡟࠾࠸᳨࡚ᰝᑐ㇟࡜ࡍࡿᝏᛶࢥࣥࢸࣥࢶೃ⿵ࡣ㸪ୗグ 5 ✀㢮࡜ࡋ࡚࠸ࡿ㸬12345࣓ࢵࢭ࣮ࢪࡢ Content-Type ࣊ࢵࢲ࣮㸪ࡲࡓࡣ㸪࣎ࢹ࢕㒊ࡢࢹ࣮ࢱ࡟ྵࡲࢀࡿࣇ࢓࢖ࣝࡢ࣐ࢪࢵࢡࢼࣥࣂ࣮ࢆ᳨ᰝࡋ㸪ᝏᛶࢥࣥࢸࣥࢶೃ⿵ࡢࢲ࣮࢘ࣥࣟࢻࢆุᐃࡍࡿ㸬ᐇ⾜ᙧᘧࣇ࢓࢖ࣝࡢࢲ࣮࢘ࣥࣟࢻࣇ࢙࣮ࢬ(Phase4)ࡣ㸪ୖグ౵ධࣇ࢙࣮ࢬ࡛ᨷᧁࢥ࣮ࢻࡀ
㏦ࡾ㎸ࡲࢀࡓࡢࡕ㸪࣐࢙ࣝ࢘࢔ࡢ㓄ᕸࢧ࢖ࢺ࠿ࡽ࣐࢙ࣝ࢘࢔ᮏయࢆࢲ࣮࢘ࣥࣟࢻࡍࡿࣇ࢙࣮ࢬ࡛࠶ࡿ㸬ࡲࡓ㸪C&C ࢧ࣮ࣂ࠿ࡽࡢᣦ௧࡟ᚑࡗ࡚㸪᪤࡟➃ᮎෆ࡟₯ࡴ࣐࢙ࣝ࢘࢔ࡀ᪂ࡋ࠸ᶵ⬟ࡢ㏣ຍ࡞࡝ࢆ┠ⓗ࡟᪂ࡓ࡞ᐇ⾜ᙧᘧࣇ࢓࢖ࣝࢆࢲ࣮࢘ࣥࣟࢻࡍࡿሙྜࡶᮏࣇ࢙࣮ࢬ
࡟ྵࡲࢀࡿ㸬ᐇ⾜ᙧᘧࣇ࢓࢖ࣝࢆ㆑ูࡍࡿࡓࡵࡢ᳨ᰝࡣ㸪 HTTP ࣞࢫ࣏ࣥࢫ࣓ࢵࢭ࣮ࢪࡢContent-Type ࣊ࢵࢲ࣮࡜࣎ࢹ࢕㒊ࡢࢥࣥࢸࣥ
ࢶࡢᩚྜᛶ᳨ᰝ㸪ࡲࡓࡣ㸪࣎ࢹ࢕㒊ࡢࢹ࣮ࢱ࡟ᑐࡋᐇ⾜ᙧᘧࣇ࢓࢖ࣝࡢ MZ ࢩࢢࢿࢳࣕ࡜PE ࣊ࢵࢲ࣮ࡢᏑᅾ㸪zip ➼ࡢ࢔࣮࢝࢖ࣈࣇ࢓
࢖࡛ࣝ࠶ࡿሙྜࡣ࢔࣮࢝࢖ࣈࡉࢀࡓࣇ࢓࢖ࣝ
ࡢᣑᙇᏊ(.exe ࡸ.dll ࡞࡝)ࢆ᳨ᰝࡋ㸪ᐇ⾜ᙧᘧࣇ࢓࢖ࣝࡢࢲ࣮࢘ࣥࣟࢻࢆุูࡍࡿ㸬

3.2. DbD ᨷᧁࡢ┦㛵ศᯒDbD ᨷᧁࡣ௨ୗࡢὶࢀ࡛ᐇ⾜ࡉࢀࡿ(ᅗ 2)㸬

Java Package
SilverlightFlashPDF
HTML/JavaScript (Internet Explorer)ᝏᛶࢥࣥࢸࣥࢶೃ⿵ࢆ㆑ูࡍࡿࡓࡵࡢ᳨ᰝࡣ㸪ࡲࡎ㸪HTTP ࡢ GET ࣜࢡ࢚ࢫࢺ࣓ࢵࢭ࣮
ࢪࢆ᳨ᰝࡋ㸪URI ࡟ୖグᝏᛶࢥࣥࢸࣥࢶೃ⿵ࡢ ࣇ࢓ ࢖ࣝ ᣑᙇ Ꮚࡀ タᐃ ࡉࢀ ࡚࠸ ࡿ (.jarࡸ.xap, .swf ࡞࡝)㸪ࡲࡓࡣ㸪HTTP ࣜࢡ࢚ࢫࢺ࣊ࢵࢲ࣮ࡀୖグᝏᛶࢥࣥࢸࣥࢶೃ⿵ࢆࢲ࢘ࣥ
࣮ࣟࢻࡍࡿ㝿ࡢ≉ᚩࢆ‶ࡓࡋ࡚࠸ࡿ(User-Agent ࣊ࢵࢲ࣮࡟ Java ࡢ User-Agent ࡀタᐃࡉࢀ࡚࠸ࡿ࡞࡝)ሙྜ㸪HTTP ࣞࢫ࣏ࣥࢫ－3－ᅗ 2 DbD ᨷᧁࡢὶࢀ‽ഛẁ㝵ᨷᧁ⪅ࡣ㸪ᶆⓗࡀ࢔ࢡࢭࢫࡍࡿṇつࡢWeb ࢧ࢖ࢺࢆᨵࡊࢇࡋ㸪ᨷᧁࢧ࣮ࣂ࡬ㄏᑟ(ࣜࢲ࢖ࣞࢡࢺ)ࡍࡿࣜࣥࢡࢆᤄධࡍࡿ㸬

1.ᨷᧁࢧ࣮ࣂ࡬ࡢㄏᑟᶆⓗࡀᨵࡊࢇࡉࢀࡓࢧ࢖ࢺ࡟࢔ࢡࢭࢫࡍࡿ࡜㸪ᶆⓗࡣ㸪ࢧ࢖ࢺ࡟ᇙࡵ㎸ࡲࢀࡓࠕᨷᧁࢧ࣮ࣂ࡬ㄏᑟࡍࡿࣜࣥࢡࠖ࡟ᚑࡗ࡚㸪ᨷᧁࢧ࣮ࣂ࡬ㄏᑟࡉࢀࡿ㸬
3. ᝏᛶࢥࣥࢸࣥࢶࡢࢲ࣮࢘ࣥࣟࢻᨷᧁࢧ࣮ࣂ࠿ࡽᶆⓗ࡟ᑐࡋ࡚㸪ᶆⓗࡀ౑⏝ࡍࡿ Web ࣈࣛ࢘ࢨࡸྛ✀ࣉࣛࢢ࢖࣭ࣥࢯࣇࢺ࢙࢘࢔ࡢ⬤ᙅᛶࢆ฼⏝ࡍࡿᝏᛶࢥࣥࢸࣥࢶࡀ㏦ࡾ㎸ࡲࢀࡿ㸬
4. ࣐࢙ࣝ࢘࢔ᮏయࡢࢲ࣮࢘ࣥࣟࢻᝏᛶࢥࣥࢸࣥࢶ࡟ࡼࡿ⬤ᙅᛶࢆ฼⏝ࡋࡓᨷᧁࡀᡂຌࡍࡿ࡜㸪ᶆⓗ࡟ᑐࡋ࡚ࢲ࢘
࣮ࣥࣟࢻࢥ࣮ࢻࡀㄞࡳ㎸ࡲࢀ㸪࣐࢙ࣝ࢘࢔ᮏయࡀ⮬ືⓗ࡟ࢲ࣮࢘ࣥࣟࢻࡉࢀࡿ㸬
2.

ᮏᡭἲ࡛ࡣ㸪ୖグ“3. ᝏᛶࢥࣥࢸࣥࢶࡢࢲ࣮࢘ࣥࣟࢻ”ࢆ౵ධࣇ࢙࣮ࢬ㸪“4. ࣐࢙ࣝ࢘࢔ᮏయࡢࢲ࣮࢘ࣥࣟࢻ”ࢆᐇ⾜ᙧᘧࣇ࢓࢖ࣝࡢࢲ࣮࢘ࣥࣟࢻࣇ࢙࣮ࢬ࡬ᙜ࡚ࡣࡵ㸪DbD ᨷᧁࡢ᮲௳ࢆ‶ࡓࡍ࠿┦㛵ศᯒࢆ⾜࠺㸬┦㛵ศᯒࡢ᮲௳ࢆ⾲ 2 ࡟♧ࡍ㸬⾲ 2 ෆ࡟♧ࡍ“TCP ࢥࢿࢡࢩࣙࣥ”㸪“᥋⥆ඛࢧ࣮ࣂ”ࡢ᮲௳ࡣ㸪Phase1
࡜ Phase4 ࡢ㏻ಙࡢ TCP ࢥࢿࢡࢩࣙࣥ㸪ࡲࡓࡣ㸪᥋⥆ඛࢧ࣮ࣂࡀྠ୍࠿࡝࠺࠿ࡢ᮲௳࡛࠶
ࡿ㸬“HTTP ㏻ಙࡢ๭ࡾ㎸ࡳ”ࡢ᮲௳ࡣ㸪Phase1
࡜ Phase4 ࡢ㏻ಙ㛫࡟ Phase1 ࡜ྠ୍ࡢࢧ࣮ࣂ࡜ࡢ HTTP ㏻ಙࢆ⾜ࡗࡓ࠿࡝࠺࠿ࡢ᮲௳࡛࠶ࡿ㸬TCP᥋⥆ඛ
HTTP ㏻ಙࡢࢥࢿࢡ
๭ࡾ㎸ࡳ
ࢧ࣮ࣂ
ࢩࣙࣥ
CA1――
ྠ୍CA2␗࡞ࡿ
ྠ୍
࡞ࡋCA3␗࡞ࡿྠ୍
࠶ࡾ(1 ࡘチᐜ)⾲ 2 Phase1-Phase4 ࡢ┦㛵᮲௳┦㛵᮲௳

－4－ᅗ 3 ┦㛵᮲௳ 1 (ᕥ)࠾ࡼࡧ┦㛵᮲௳ 2 (ྑ)ᅗ 4 ┦㛵᮲௳ 3

౛࠼ࡤ㸪Angler Exploit Kit (Angler EK)ࡣ㸪⾲3㸪ᅗ 5 ࡢࡼ࠺࡟ CA2 ࡢ᮲௳࡟୍⮴ࡍࡿ≉ᚩࡀ࠶ࡿࡓࡵ DbD ᨷᧁࢆ᳨▱ࡍࡿࡇ࡜ࡀ࡛ࡁ
ࡿ㸬⾲ 3 ࡟࠾ࡅࡿ␒ྕձ㹼ճࡣ㸪ᅗ 5 ࡟࠾ࡅࡿ HTTP ㏻ಙձ㹼ճ࡟ࡑࢀࡒࢀᑐᛂࡍࡿ㸬
␒
ྕ
ձ
ղ
ճ

TCP ࢥࢿ
ࢡࢩࣙࣥ
Conn-A
Conn-BConn-C᥋⥆ඛࢧ࣮ࣂPhaseࢻ࣓࢖ࣥ Aࢻ࣓࢖ࣥ Bࢻ࣓࢖ࣥ B―14

⾲ 3 Angler EK ࡢᨷᧁࢩ࣮ࢣࣥࢫࡲ࡜ࡵ࠶ࡿ㸬ࡇࡢࢹ࣮ࢱࢭࢵࢺ࡟ࡣ㸪⛅ᒣࡽࡀ㛤Ⓨࡋࡓ㧗ᑐヰᆺࣁࢽ࣮ࢡࣛ࢖࢔ࣥࢺ
(Marionette) [8]ࡀᕠᅇࡋࡓ DbD ᨷᧁ࡟㛵㐃ࡍ
ࡿ URL ࡟࢔ࢡࢭࢫࡋࡓ㝿ࡢࣃࢣࢵࢺ࢟ࣕࣉ
ࢳࣕࣇ࢓࢖ࣝࡀ཰ࡵࡽࢀ࡚࠸ࡿ㸬ࡋ࠿ࡋ㸪ࣁࢽ࣮ࢡࣛ࢖࢔ࣥࢺࡀᕠᅇࡋࡓ㝿㸪ᨷᧁࢧ࣮ࣂࡀ೵Ṇࡋ࡚࠸ࡿ㸪DL ࡋࡓᨷᧁࢫࢡࣜࣉࢺࡢᐇ⾜࡟ኻᩋࡍࡿ࡞࡝ࡋ࡚㸪࣐࢙ࣝ࢘࢔ᮏయࢆ
ࢲ࣮࢘ࣥࣟࢻࡋ࡚࠸࡞࠸㏻ಙࡀከࡃぢࡽࢀࡓ㸬ᮏᡭἲ࡛ࡣ㸪࣐࢙ࣝ࢘࢔ᮏయࡀࢲ࣮࢘ࣥࣟࢻ
ࡉࢀ࡞ࡅࢀࡤ㸪Phase4 ࢆ᳨ฟ࡛ࡁ࡞࠸ࡓࡵ㸪
DbD ᨷᧁࢆ᳨▱ࡋ࡞࠸㸬ࡑࡢࡓࡵ㸪 D3M ࠿ࡽ࣐࢙ࣝ࢘࢔ᮏయࡢࢲ࣮࢘ࣥࣟࢻࢆ⾜ࡗ࡚࠸ࡿ㏻ಙࢩ࣮ࢣࣥࢫ 11 ಶࢆᢤ⢋ࡋ㸪DbD ᨷᧁࢆ᳨▱࡛ࡁࡿ࠿ホ౯ࢆ⾜ࡗࡓ㸬ᅗ 5 Angler EK ࡢᨷᧁࢩ࣮ࢣࣥࢫ

4. ホ౯ヨ㦂4.1. ヨ㦂᪉ἲᮏホ౯࡛ࡣ㸪ᮏᡭἲࢆᐇ⿦ࡋࡓࣉࣟࢢ࣒ࣛ
ࢆ Linux ࣐ࢩࣥୖ࡛ືసࡉࡏ㸪㏻ಙࢆࣉ࣑ࣟ
ࢫ࢟ࣕࢫ࣮ࣔࢻ࡛ࣔࢽࢱࣜࣥࢢࡉࡏࡓ㸬ࡑࡋ࡚㸪ࣃࢣࢵࢺ㏦ಙ⏝࣐ࢩࣥ࠿ࡽ㸪tcpreplay ࣉࣟࢢ࣒ࣛࢆ⏝࠸࡚ DbD ㏻ಙࢆྵࡴࣃࢣࢵࢺ
࢟ࣕࣉࢳࣕࣇ࢓࢖ࣝࢆ෌⏕࣭㏦ಙࡋ㸪ヨ㦂ࣉࣟࢢ࣒ࣛࡀືసࡍࡿ࣐ࢩࣥ࡬㏦ฟࡍࡿࡇ࡜࡛
ホ౯ࢆ⾜ࡗࡓ㸬ᅗ 6 ᳨▱ヨ㦂ࡢᵓᡂ

4.2. D3M 2015 ࡟ࡼࡿホ౯
D3M (Drive-by Download Data by Marionette)ࡣ㸪࣐࢙ࣝ࢘࢔ᑐ⟇◊✲ேᮦ⫱ᡂ࣮࣡ࢡࢩࣙࢵࣉ࡛㓄ᕸࡉࢀ࡚࠸ࡿࢹ࣮ࢱࢭࢵࢺࡢ 1 ࡘ࡛－5－

D3M 2015299
ᕠᅇ URL ᩘ11(2)࣐࢙ࣝ࢘࢔ࢆ DL ࡋࡓᩘ
9DbD ᳨▱ᩘ
81.8᳨▱⋡ (%)⾲ 4 D3M ࡟ࡼࡿホ౯⤖ᯝ䈜 ()ෆࡣ࣐࢙ࣝ࢘࢔᳨యࡢࣘࢽ࣮ࢡᩘ

D3M 2015
CA ๭ྜ(%)
9―DbD ᳨▱ᩘ
CA1111.1
CA2888.9
CA300.0⾲ 5 D3M ࡟୍࡚⮴ࡋࡓ DbD ᮲௳ᮏホ౯࡛ࡣ㸪ୖグ⾲ 4 ࡢ⤖ᯝࡢ㏻ࡾࡢ᳨▱⋡ࢆ♧ࡋ㸪⾲ 5 ࡢ⤖ᯝ࠿ࡽ DbD ᨷᧁࢩ࣮ࢣࣥࢫࡣ㸪࡯ࡰ CA2 ࡢ᮲௳࡟ᙜ࡚ࡣࡲࡿࡶࡢࡀ᳨ฟࡉࢀࡓ㸬ࡇࢀࡣ㸪᳨యࣘࢽ࣮ࢡᩘ࠿ࡽࢃ࠿
ࡿࡼ࠺࡟㸪ྠ୍ URL ࡬␗࡞ࡿ᪥࡟࢔ࢡࢭࢫࢆ⾜ࡗࡓ㏻ಙࢩ࣮ࢣࣥࢫࡸ URL ࡣ␗࡞ࡿࡀ
ྠ୍ࢧ࣮ࣂ࡬࢔ࢡࢭࢫࡋࡓ㏻ಙࢩ࣮ࢣࣥࢫࡀ
࠶ࡾ㸪ࡑࢀࡒࢀྠ୍ᨷᧁࢩ࣮ࢣࣥࢫࢆグ㘓ࡋࡓࡓࡵ࡛࠶ࡿ㸬௒ᅇ᳨▱ࡋࡓ DbD ࢩ࣮ࢣࣥࢫࡢ 1 ࡘ࡜ࡋ࡚㸪Content-Type ࣊ࢵࢲ࣮ࢆ image/gif ࡜ブ⛠ࡋࡓୖ࡛࣐࢙ࣝ࢘࢔ᮏయ(exe)ࣇ࢓࢖ࣝࢆࢲ࢘
࣮ࣥࣟࢻࡋ࡚࠸ࡿࡶࡢࡀぢࡽࢀࡓ㸬ᮏᡭἲ࡛ࡣ㸪Content-Type ࣊ࢵࢲ࣮࡜࣎ࢹ࢕㒊ࡢ୍⮴ᛶࢆ☜ㄆࡋ࡚࠸ࡿࡓࡵ㸪ࡇࡢࢱ࢖ࣉࡢ DbD ࢩ࣮ࢣࣥࢫࢆၥ㢟࡞ࡃぢࡘࡅࡿࡇ࡜ࡀ࡛ࡁࡓ㸬ࡲࡓ㸪࣐࢙ࣝ࢘࢔ᮏయࡢࢲ࣮࢘ࣥࣟࢻࡀ⾜ࢃࢀ࡞࠿ࡗࡓ 288 ࣇ࢓࢖ࣝ࡟ࡘ࠸࡚ࡣ㸪ᨷᧁ࡟ኻᩋࡋ࡚࠸ࡿࡓࡵ㸪Phase4 ࡀ᳨ฟࡉࢀࡎ㸪
DbD ᨷᧁࡢ᳨▱ࡣᮇᚅ㏻ࡾ⾜ࢃࢀ࡞࠿ࡗࡓ㸬᳨▱࡛ࡁ࡞࠿ࡗࡓ㏻ಙࣃࢱ࣮ࣥ 2 ௳࡟ࡘ࠸࡚ࡣ㸪URL ࡣ␗࡞ࡿࡀୗグ⾲ 6 ࡢࡼ࠺࡟ྠ୍ࢧ࣮ࣂ࡬ࡢ࢔ࢡࢭࢫ࡛࠶ࡾ㸪࡯ࡰྠ୍ࡢ㏻ಙ
ࣃࢱ࣮ࣥࢆ♧ࡋࡓ㸬ࡇࡢ㏻ಙࣃࢱ࣮ࣥࡀ┦㛵᮲௳࡟୍⮴ࡏࡎ㸪᳨▱࡟⮳ࡽ࡞࠿ࡗࡓ㸬
URLࣃࢱ࣮ࣥ
1
http://www.zi**.pl/2
http://zi**.pl/⾲ 6 ᳨▱࡛ࡁ࡞࠿ࡗࡓ URLThreatglass CA ๭ྜ(%)
65
DbD ᳨▱ᩘ
CA11421.5
CA25178.5
CA300⾲ 8 Threatglass ࡟୍࡚⮴ࡋࡓ DbD ᮲௳Threatglass ࡟ࡼࡿホ౯࡛ࡣ㸪⾲ 7 ࡟♧ࡍ㏻ࡾ
ࡢ᳨▱⋡ࢆ♧ࡋࡓ㸬୍⮴ࡋࡓ CA ᮲௳ࡢ๭ྜ࡜ࡋ࡚ࡣ㸪CA1 ᮲௳ࡀ 21.5%㸪CA2 ᮲௳ࡀ
78.5%࡛࠶ࡾ㸪DbD ᨷᧁࢩ࣮ࢣࣥࢫ࡜ࡋ࡚㸪
D3M Dataset ࡜ྠࡌࡃ Phase1 ࠿ࡽ Phase4 ࡢ㑄⛣ࡣྠ୍ TCP ࢥࢿࢡࢩࣙࣥୖ㸪ࡲࡓࡣ㸪HTTP
๭ࡾ㎸ࡳࡀ↓࠸ู TCP ࢥࢿࢡࢩࣙࣥࡢࣃࢱ
࣮ࣥࡢ 2 ✀㢮ࡀぢࡽࢀࡓ㸬ࡓࡔࡋ㸪D3M ࡟ẚ࡭࡚ CA1 ࡢ᮲௳ࡢ๭ྜࡀቑ࠼㸪CA1 ࡢ᮲௳ࡢ᭷ຠᛶࡀ♧ࡉࢀࡓ㸬

4.3. Threatglass [7]࡟ࡼࡿホ౯

4.4. NCD in MWS Cup 2014 ࡟ࡼࡿホ౯Threatglass ࡣ㸪ࣂࣛࢡ࣮ࢲࢿࢵࢺ࣮࣡ࢡࢫ♫ࡀ࣐࢙ࣝ࢘࢔࡟ឤᰁࡋࡓ Web ࢧ࢖ࢺࡢ᝟ሗࢆබ㛤ࡋ࡚࠸ࡿࢥ࣑ࣗࢽࢸ࢕ࢧ࢖ࢺ࡛࠶ࡿ㸬ឤᰁࢧ࢖ࢺ࡟ᑐࡍࡿព㆑ྥୖ࡜㸪ᨷᧁ᪉ἲࡢ⌮ゎࢆ┠ⓗ࡟ᵝࠎ࡞᝟ሗࡀබ㛤ࡉࢀ࡚࠾ࡾ㸪ࣃࢣࢵࢺ࢟ࣕࣉࢳࣕࡶධᡭࡍࡿࡇ࡜ࡀ࡛ࡁࡿ㸬ᮏホ౯࡛ࡣ㸪D3M ྠᵝ࡟㸪DbD ᨷᧁ࡟㛵ࡋ
࡚ Exploit ࠿ࡽ࣐࢙ࣝ࢘࢔ᮏయࡢࢲ࣮࢘ࣥࣟ
ࢻࡲ࡛ࡢ㏻ಙࢩ࣮ࢣࣥࢫࡀྵࡲࢀࡿࣇ࢓࢖ࣝ
65 ಶࢆᢤ⢋ࡋ࡚ホ౯ࢆ⾜࡞ࡗࡓ㸬ࡓࡔࡋ㸪
Threatglass ࡢ࢟ࣕࣉࢳࣕࣇ࢓࢖ࣝࡣ㸪ᩘ kBࢆ㉸࠼ࡿࢪࣕࣥ࣎ࣇ࣮࣒ࣞࡀྵࡲࢀ࡚࠾ࡾ㸪ࡑࡢࡲࡲ࡛ࡣࣃࢣࢵࢺ㏦ಙ⏝࣐ࢩࣥ࠿ࡽࣃࢣࢵࢺࢆṇࡋࡃ㏦ฟࡍࡿࡇ࡜ࡀ࡛ࡁ࡞࠸㸬ࡇࡢࡓࡵ㸪tcpreplay ࡟ྵࡲࢀࡿ tcpedit ࢆ⏝࠸࡚㸪ࢪࣕࣥ࣎ࣇ࣮࣒ࣞࢆ MTU ࡟཰ࡲࡿࡼ࠺࡟ศ๭ࡋࡓ࢟ࣕࣉࢳࣕࣇ࢓࢖ࣝࢆసᡂࡋ㸪ホ౯ࢆ⾜ࡗࡓ㸬

NCD ࢹ࣮ࢱࢭࢵࢺࡣ㸪MWS Datasets 2015࡟ྵࡲࢀ㸪2014 ᖺ 10 ᭶ 22 ᪥࡟㛤ദࡉࢀࡓ
MWS Cup 2014 [9]ᮇ㛫୰ࡢ㏻ಙࢆ࣍࣡࢖ࢺ㏻
ಙ࡜ࡋ࡚ᥦ౪ࡍࡿࡶࡢ࡛࠶ࡿ㸬ࡇࡇ࡛ࡣ㸪ࡇࡢࢹ࣮ࢱ࡟ࡣ DbD ᨷᧁ࡟㛵ࡍࡿ㏻ಙࡣྵࡲ
ࢀ࡚࠸࡞࠸ࡶࡢ࡜ࡋ࡚㸪ㄗ᳨▱࡟㛵ࡍࡿホ౯ࢆ⾜࡞ࡗࡓ㸬ᥦ౪ࡉࢀࡓ࢟ࣕࣉࢳࣕࣇ࢓࢖ࣝࡢ⤫ィ᝟ሗࢆ⾲ 9 ࡟ࡲ࡜ࡵࡓ㸬

Threatglass65
࢟ࣕࣉࢳࣕࣇ࢓࢖ࣝᩘ
65
DbD ᳨▱ᩘ
100%᳨▱⋡
⾲ 7 Threatglass ࡟ࡼࡿホ౯⤖ᯝ－6－ࣃࢣࢵࢺ཰㞟ᮇ㛫
9:34:37㹼12:05:57
6,864,565
ࣃࢣࢵࢺᩘ
5.72
㏻ಙࣂ࢖ࢺᩘ (GB)1884ᐄඛࣘࢽ࣮ࢡ࣍ࢫࢺᩘ
43,100HTTP ࣜࢡ࢚ࢫࢺᩘ
84
ᐇ⾜ࣇ࢓࢖ࣝࡢ DL ᩘ⾲ 9 ኱఍ᮇ㛫୰ࡢ⤫ィ᝟ሗ⤖ᯝ࡜ࡋ࡚ࡣ㸪DbD ᨷᧁࢆ᳨▱ࡍࡿࡇ࡜ࡣ
࡞࠿ࡗࡓࡀ㸪ࡇࢀࡣ኱఍ᮇ㛫ࡀ▷࠿ࡗࡓࡓࡵ㸪
DbD ᨷᧁࢩ࣮ࢣࣥࢫ࡟ఝࡓ㏻ಙࡀᑡ࡞࠿ࡗ
ࡓࡇ࡜ࡀ⪃࠼ࡽࢀࡿ㸬ࡋ࠿ࡋ㸪DbD ᨷᧁ࡛ࡣ࡞ࡃ㸪C&C ㏻ಙ(Phase6)࡜ࡋ᳨࡚▱ࡋࡓ HTTP㏻ಙࡀ」ᩘ࠶ࡗࡓ㸬DbD ᨷᧁ௨እࡢ஦㇟࡟ࡘ࠸࡚ࡶ㸪ᘬࡁ⥆ࡁホ౯ࢆ⾜ࡗ࡚࠸ࡁࡓ࠸㸬ᩥ⊩┠㘓

5. ࡲ࡜ࡵ
ࢿࢵࢺ࣮࣡ࢡ㏻ಙࢆ┘どࡋ㸪➃ᮎࡀ⾜࠺
HTTP ㏻ಙࢆ࣐࢙ࣝ࢘࢔άື㑄⛣ࣔࢹࣝ࡟࠾
ࡅࡿ౵ධࣇ࢙࣮ࢬ(Phase1)㸪ᐇ⾜ᙧᘧࣇ࢓࢖ࣝ
ࡢࢲ࣮࢘ࣥࣟࢻࣇ࢙࣮ࢬ(Phase4)ࢆ┦㛵ศᯒࡍࡿᮏᡭἲ࡟ࡼࡾ DbD ᨷᧁࢆ᳨▱࡛ࡁࡿࡇ࡜ࢆ♧ࡋࡓ㸬D3M ࢆ⏝࠸ࡓホ౯࡛ࡣ㸪DbDᨷᧁࢩ࣮ࢣࣥࢫ࡛㸪Content-Type ࡀഇ⿦ࡉࢀࡓሙྜࡶၥ㢟࡞ࡃ᳨▱࡛ࡁࡿࡇ࡜ࢆ♧ࡋ㸪
HTTP ࣞࢫ࣏ࣥࢫ࣓ࢵࢭ࣮ࢪࡢ Content-Type࣊ࢵࢲ࣮࡜࣎ࢹ࢕㒊ࡢࢥࣥࢸࣥࢶࡢᩚྜᛶ᳨ᰝࢆ⾜࠺ࡇ࡜ࡢ᭷⏝ᛶࢆホ౯࡛ࡁࡓ㸬ホ౯ヨ㦂ࡢၥ㢟Ⅼ࡜ࡋ࡚㸪ホ౯ᑐ㇟ࢹ࣮ࢱ࡟࠾ࡅࡿ DbD ᨷᧁࢩ࣮ࢣࣥࢫࡢࣃࢱ࣮ࣥࡀᑡ࡞࠸ࡇ࡜㸪༑ศ࡞ㄗ᳨▱ホ౯ࡀ࡛ࡁ࡚࠸࡞࠸ࡇ࡜ࡀᣲࡆࡽࢀࡿࡓࡵ㸪ࡼࡾ㇏ᐩ࡞ࢹ࣮ࢱࢆධᡭࡋ㸪㏣ຍ࡛ᮏᡭἲࡢホ౯ࢆ⾜࠺ᚲせࡀ࠶ࡿ㸬௒ᚋࡣ㸪๓㏙ࡋࡓホ౯ࢆ⾜࠺࡜ඹ࡟㸪᭱᪂ࡢ DbD ᨷᧁࡢㄪᰝ࡜ᑐᛂࢆ⾜ࡗ࡚࠸ࡃ㸬ࡲࡓ㸪௒ᅇ᳨ド࡛ࡁ࡞࠿ࡗࡓ㈇Ⲵᛶ⬟ヨ㦂ࢆ⾜࠸㸪ࢿࢵࢺ࣮࣡ࢡ┘どࡢ㝈⏺ᛶ⬟ࢆホ౯ࡍࡿணᐃ࡛࠶ࡿ㸬ࡉࡽ࡟㸪࣐࢙ࣝ࢘࢔άື㑄⛣ࣔࢹࣝ࡟࠾ࡅࡿ Phase1㸪Phase4 ௨እࡢホ౯ࢆ⾜࠺ᚲせࡀ࠶ࡾ㸪≉࡟ C&C ㏻ಙ࡟㛵ࡍࡿ Phase6 ࡢホ౯ࢆ⾜ࡗ࡚࠸ࡃ㸬Java ࡣ㸪Oracle Corporation ཬࡧࡑࡢᏊ఍♫㸪㛵㐃఍♫ࡢ⡿ᅜཬࡧࡑࡢ௚ࡢᅜ࡟࠾ࡅࡿⓏ㘓ၟᶆ࡛ࡍ㸬Silverlight㸪Internet Explorer ࡣ㸪⡿ᅜ MicrosoftCorporation ࡢ㸪⡿ᅜ㸪᪥ᮏ࠾ࡼࡧࡑࡢ௚ࡢᅜ࡟࠾ࡅࡿⓏ㘓ၟᶆࡲࡓࡣၟᶆ࡛ࡍ㸬Flash ࡣ㸪Adobe Systems Incorporated㸦࢔ࢻࣅࢩࢫࢸ࣒ࢬ♫㸧ࡢ⡿ᅜ࡞ࡽࡧ࡟௚ࡢᅜ࡟࠾ࡅ
ࡿၟᶆࡲࡓࡣⓏ㘓ၟᶆ࡛ࡍ㸬－7－[1] ᑎ⏣๛㝧, ྂᕝᛅᘏ, ᮾゅⰾᶞ, 㫽ᒃᝅ,“᳨▱ࢆ┠ᣦࡋࡓ୙ṇࣜࢲ࢖ࣞࢡࢺࡢศᯒ,” MWS2010, 2010.
[2] ኱㇂ᑦ㐨, ໭㔝⨾⣪, 㔜⏣┿⩏, “௻ᴗෆࢿࢵࢺ࣮࣡ࢡࡢ㏻ಙࣟࢢࢆ⏝࠸ࡓࢧ࢖ࣂ࣮ᨷᧁ᳨▱ࢩࢫࢸ࣒,” MWS2013, 2013.
[3] ໭ 㔝 ⨾ ⣪ , ኱ ㇂ ᑦ 㐨 , ᐑ ᮏ ஂ ோ ⏨ ,“Drive-by-Download ᨷᧁ࡟࠾ࡅࡿ㏻ಙࡢᐃᛶⓗ≉ᚩ࡜ࡑࡢ㑄⛣ࢆᤊ࠼ࡓ᳨▱᪉ᘧ,” MWS2013, 2013.
[4] ᯇ ୰ 㝯 ᚿ , ❑ ⏣ Ṍ , ᫍ ⃝ ⿱ ஧ ,“Drive-by-Download ᨷᧁᑐ⟇ࣇ࣮࣒࣮ࣞ࣡ࢡ࡟࠾ࡅࡿ Web ࢔ࢡࢭࢫࣟࢢࢆ⏝࠸ࡓWeb ࣜࣥࢡᵓ㐀ࡢゎᯒ࡟ࡼࡿᝏᛶࢧ࢖ࢺ᳨ ฟ ᡭ ἲ ࡢ ᥦ ᱌ ,” Computer Security
Symposium 2014, Oct 2014.
[5] 㐍⸨ᗣᏕ, బ⸨ᙲὒ, ୰ᮧ㇏, 㣤⏣຾ྜྷ,“࣐࢙ࣝ࢘࢔ឤᰁࢫࢸࢵࣉࡢࣇ࢓࢖ࣝࢱ࢖ࣉ㑄⛣࡟ᇶ࡙࠸ࡓ Drive-by Download ᨷᧁ ᳨ ▱ ᡭ ἲ ,” Computer Security
Symposium 2014, Oct 2014.
[6] ⚄ⷵ㞞⣖, ⛅ᒣ‶᫛, ➟㛫㈗ᘯ, ᮧୖ⣧୍, ⏿⏣඘ᘯ, ᑎ⏣┿ᩄ, “࣐࢙ࣝ࢘࢔ᑐ⟇ࡢࡓࡵࡢ◊✲⏝ࢹ࣮ࢱࢭࢵࢺ㹼MWSDatasets 2015㹼,” ᝟ሗฎ⌮Ꮫ఍ ◊✲ሗ࿌ࢥࣥࣆ࣮ࣗࢱࢭ࢟ࣗࣜࢸ࢕(CSEC) Vol.
2015-CSEC-70, No6, 2015.
[7] BarracudaLabs,“BarracudaLabs
Threatglass,” Barracuda Networks, Inc, [࢜ࣥࣛ࢖ࣥ].
Available:
http://www.threatglass.com/.
[8] M. AKIYAMA, M. IWAMURA, Y.
KAWAKOYA, K. AOKI , M. ITOH,“Design and Implementation of HighInteraction
ClientHoneypot
for
Drive-by-Download Attacks,” IEEE Trans. ofCommunication, Vol. E93-B, No.5, pp.
1131-1139, May 2010.
[9] MWS2014 ᐇ⾜ጤဨ఍, “MWS Cup ࡟ࡘ࠸࡚ ,” 2014. [ ࢜ ࣥ ࣛ ࢖ ࣥ ]. Available:
http://www.iwsec.org/mws/2014/about.html.