Patent Description:
Many of cyber attacks use malware-infected terminals, which are infected with malware. When measures against cyber attacks and malware-infected terminals are taken, internet protocol (IP) addresses are often handled as unique identifiers. Specifically, the IP addresses of malware-infected terminals are used as a blacklist or signatures in some cases, and the traffic transmitted from the IP addresses are handled as abnormal traffic in some cases. The IP address used by such a malware-infected terminal is a dynamic IP address assigned by an internet service provider (ISP) in many cases.

Herein, if a dynamic IP address is assigned to a terminal, the IP address is not permanently used by the same terminal. For example, the IP address of the terminal is changed at the timing when a point-to-point protocol over Ethernet (PPPoE) session is reconnected, power is disconnected, or a change is made by ISP.

Therefore, malware-infected terminals cannot be precisely specified with dynamic IP addresses. Therefore, a method for identifying dynamic IP addresses among IP addresses has been proposed in order to avoid using the dynamic IP addresses for specification of malware-infected terminals.

For example, there has been proposed a method in which, if a PoinTeR (PTR) record of a target IP address includes a keyword designated in advance or part or all of the numerical values of first to fourth octets of the IP address, the IP address or a /<NUM> address block including the IP address is identified as a dynamic IP address (for example, see Non Patent Literatures <NUM> to <NUM>).

However, the conventional dynamic IP identifying methods are not capable of accurately identifying dynamic IP addresses in some cases. For example, if the PTR record of a dynamic IP address does not match any of designated keywords, it is difficult for the conventional methods to identify the dynamic IP address. Also, if a designated keyword is included in the PTR record of an IP address which is not a dynamic IP address, the conventional methods may erroneously identify the IP address, which is not a dynamic IP address, as a dynamic IP address.

The problem underlying the invention is solved by the subject matter of the independent clams. Advantageous embodiments are disclosed in the dependent claims. According to an example an identification device includes: a specification unit configured to specify a boundary dividing a row of an IP address, which is included in an IP address block and sorted by a predetermined order, into a plurality of parts based on predetermined information about the IP address; and an identification unit configured to identify the IP address included in the part as a dynamic IP address when the part divided by the boundary satisfies a predetermined condition.

According to the present invention, dynamic IP addresses can be accurately identified.

Hereinafter, embodiments of an identification device, an identification method, and an identification program according to the present application will be described in detail based on drawings. Note that the present invention is not limited by the embodiments described below.

First, a configuration of an identification device according to a first embodiment will be described by using <FIG> is a diagram illustrating an example of the configuration of the identification device according to the first embodiment. As illustrated in <FIG>, an identification device <NUM> has an input unit <NUM>, an output unit <NUM>, a storage unit <NUM>, and a control unit <NUM>.

The input unit <NUM> receives data input from a user. The input unit <NUM> is, for example, an input device such as a mouse or a keyboard. The output unit <NUM> outputs data, for example, by display on a screen. The output unit <NUM> is, for example, a display device such as a display. The input unit <NUM> and the output unit <NUM> may be an interface, which inputs/outputs data by communication with external devices.

The input unit <NUM> receives input of IP address blocks as illustrated in <FIG> is a diagram illustrating an example of the IP address blocks according to the first embodiment. The IP address block is an aggregate of one or more IP addresses.

Herein, as illustrated in the record of a serial number <NUM> of <FIG>, the IP address block is expressed like "<NUM>. <NUM>/<NUM>". The IP address block "<NUM>. <NUM>/<NUM>" includes <NUM> IP addresses including "<NUM>. <NUM>" as higher <NUM> bits, in other words, a first octet to a third octet and including an arbitrary value as a lower <NUM> bits, in other words, a fourth octet.

Returning to <FIG>, the storage unit <NUM> is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), or an optical disk. The storage unit <NUM> may be a data-rewritable semiconductor memory such as a random access memory (RAM), a flash memory, or a non volatile static random access memory (NVSRAM). The storage unit <NUM> stores an operating system (OS) and various programs, which are executed by the identification device <NUM>. Furthermore, the storage unit <NUM> stores various information used in execution of the programs. The storage unit <NUM> stores setting information <NUM>.

The storage unit <NUM> stores the information about IP addresses as setting information <NUM>. Herein, the setting information <NUM> will be described by using <FIG> is a diagram illustrating an example of the setting information according to the first embodiment. The setting information <NUM> is stored in the storage unit <NUM> manually or automatically before identification processing of dynamic IP addresses is carried out. For example, the setting information <NUM> may be acquired from a secure sockets layer (SSL) server certificate.

As illustrated in <FIG>, the setting information <NUM> includes items such as serial numbers, IP addresses, AS numbers, PTR records, and effective second level domains (e2LDs). The serial numbers are the numbers for identifying respective records. The PTR records are reverse lookup records of domain name system (DNS) and represent host names for the IP addresses. The e2LDs are top level domain names and second level domain names included in the PTR records.

The record of the serial number <NUM> of <FIG> represents that the AS number of the IP address "<NUM>. <NUM>" is "AS64496", the PTR record is "www. com", and the e2LD is "example.

Returning to <FIG>, the control unit <NUM> controls the entire identification device <NUM>. The control unit <NUM> is, for example, an electronic circuit such as a central processing unit (CPU) or a mirco processing unit (MPU) or an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). The control unit <NUM> has an internal memory for storing programs, which define various processing procedures, and control data and executes processing by using the internal memory. The control unit <NUM> functions as various processing units when the various programs work. For example, the control unit <NUM> has a specification unit <NUM> and an identification unit <NUM>.

Based on the setting information <NUM>, the specification unit <NUM> specifies boundaries which divide rows of IP addresses sorted in a predetermined order, which are IP addresses included in IP address blocks input to the input unit <NUM>, into a plurality of parts. For example, as illustrated in <FIG>, the specification unit <NUM> specifies a position 100a and a position 100b as boundaries. The setting information <NUM> is an example of predetermined information about IP addresses. The part referred to herein is part of the IP addresses included in the input IP address blocks and is an aggregate of the IP addresses maintaining the order and continuity of the sorted rows.

As illustrated in <FIG>, first, the specification unit <NUM> sorts the IP addresses by the predetermined order. <FIG> is a diagram for describing management boundaries according to the first embodiment. According to the present embodiment, the specification unit <NUM> uses the values of respective octets of the IP addresses considered as numerical values as keys and carries out sorting by the magnitude relation of the keys. In the example of <FIG>, the IP addresses are sorted in the ascending order of the keys.

For example, the specification unit <NUM> compares first information about a first IP address with second information about a second IP address, which is subsequent to the first IP address in the order of rows, and, if the similarity between the first information and the second information is equal to or less than a threshold value, specifies the position between the first IP address and the second IP address as a boundary. In other words, the specification unit <NUM> compares the values of predetermined items of two records which have continuous serial numbers in <FIG> and, if the similarity thereof is equal to or less than a predetermined value, specifies the position between the two continuous records as a boundary. The cases in which the similarity between the two comparison targets is equal to or less than the predetermined value include the cases in which the two comparison targets do not completely match.

Specifically, the specification unit <NUM> specifies the boundary based on the information with which whether the IP addresses have the same administrator or operator or not can be specified. In the present embodiment, if the AS numbers or e2LDs are different between two IP addresses, the specification unit <NUM> determines that the administrator or the operator of the two IP addresses are different from each other.

For example, since the AS numbers are different between the records having serial numbers <NUM> to <NUM> and the records having serial numbers <NUM> or higher in <FIG>, the specification unit <NUM> specifies a position 100b between the record of the serial number <NUM> and the record of the serial number <NUM> as a boundary. In this case, the records before the position 100b and the records after the position 100b are divided into segments <NUM> and segments <NUM>, respectively.

Furthermore, since e2LDs are different between the records of the serial numbers <NUM> to <NUM> and the records of the serial numbers <NUM> and higher among the records of the segment <NUM>, the specification unit <NUM> specifies the position 100a between the record of the serial number <NUM> and the record of the serial number <NUM> as a boundary. In this case, the records before the position 100a and the records after the position 100a in the segment <NUM> are denoted by branch numbers and divided into segments <NUM>-<NUM> and segments <NUM>-<NUM>, respectively.

Furthermore, the specification unit <NUM> specifies boundaries based on the similarity of predetermined character strings included in predetermined information. Specifically, if the Jaro-Winkler distance (Reference Literature <NUM>: <NPL>) between a first character string, which is the host name of the first IP address excluding e2LD, and a second character string, which is the host name of the second IP address, which is subsequent to the first IP address in the order of the rows, excluding e2LD, is equal to or lower than a threshold value, the specification unit <NUM> specifies the position between the first IP address and the second IP address as a boundary. Herein, in the present embodiment, the host names are the PTR records.

A comparison method of the character strings by the specification unit <NUM> will be described by using <FIG> are diagrams for describing the comparison method of the character strings according to the first embodiment. First, as illustrated in <FIG>, a PTR record "test1. jp" includes a comparison-target character string <NUM> and an e2LD <NUM>. A PTR record "test2. jp" includes a comparison-target character string <NUM> and an e2LD <NUM>. In this case, the specification unit <NUM> calculates the Jaro-Winkler distance between the comparison-target character string <NUM> and the comparison-target character string <NUM> as <NUM>.

As illustrated in <FIG>, a PTR record "test1. jp" includes a comparison-target character string <NUM> and an e2LD <NUM>. A PTR record "invalid. jp" includes a comparison-target character string <NUM> and an e2LD <NUM>. In this case, the specification unit <NUM> calculates the Jaro-Winkler distance between the comparison-target character string <NUM> and the comparison-target character string <NUM> as <NUM>.

In this case, as illustrated in <FIG>, the specification unit <NUM> specifies a position 200a, a position 200b, a position 200c, a position 200d, a position 200e, and a position 200f as boundaries based on the Jaro-Winkler distances. <FIG> is a diagram for describing character string boundaries according to the first embodiment.

For example, since the Jaro-Winkler distance between the record of a serial number <NUM> of <FIG> and the record of a serial number <NUM> in <FIG> is equal to or less than the threshold value, the specification unit <NUM> specifies a position 200a between the record of the serial number <NUM> and the record of the serial number <NUM> as a boundary. In this case, the records before the position 200a and the records after the position 200a in segments <NUM>-<NUM> are further denoted by branch numbers and divided into segments <NUM>-<NUM>-<NUM> and segments <NUM>-<NUM>-<NUM>, respectively.

Herein, the Jaro-Winkler distance is an index which becomes <NUM> if two character strings completely match and becomes <NUM> if they do not match at all, and the Jaro-Winkler distance is defined based on a Jaro distance. The specification unit <NUM> calculates the Jaro distance Φ as Equation (<NUM>). The specification unit <NUM> calculates the Jaro-Winkler distance Φn as Equation (<NUM>).

<MAT> i: The number of characters of common prefix.

For example, "test1" and "test2" of <FIG> are different only by the one-digit number subsequent to the prefix "test". Therefore, the Jaro-Winkler distance between "test1" and "test2" is <NUM>, which is an extremely large value. On the other hand, "test1" and "invalid" of <FIG> do not contain matching characters at all, and the Jaro-Winkler distance thereof is therefore <NUM>.

For example, if the threshold value of the Jaro-Winkler distance is <NUM>, the combinations in the example of <FIG> for which the Jaro-Winkler distances of the character strings of comparison targets conceivably become equal to or less than the threshold value are, for example, the serial number <NUM> and the serial number <NUM>, the serial number <NUM> and the serial number <NUM>, the serial number <NUM> and the serial number <NUM>, the serial number <NUM> and the serial number <NUM>, and the serial number <NUM> and the serial number <NUM>. On the other hand, the Jaro-Winkler distances of the character strings of comparison targets conceivably become larger than the threshold value in the ranges including, for example, the serial number <NUM> to the serial number <NUM> and the serial number <NUM> to the serial number <NUM>.

Herein, in general, a network operator or an administrator of ISP, etc. collectively sets continuous IP addresses as dynamic IP addresses in many cases. For the sake of improving convenience in management or operation, in many cases, character strings which are combinations of a common prefix and numerical values, which are different among IP addresses, are set in the PTR records of the continuous IP addresses which are set collectively. For example, the PTR records of the serial number <NUM> to the serial number <NUM> in <FIG> are combinations of a common prefix "host" with numbers. The Jaro-Winkler distances between the comparison-target character strings of such PTR records, which have a common prefix part and are different only by the number part, tend to become large.

Returning to <FIG>, if the part divided by the boundary satisfies a predetermined condition, the identification unit <NUM> identifies the IP addresses included in the part as dynamic IP addresses. For example, if the number of IP addresses included in the part divided by the boundary is equal to or higher than a threshold value, the identification unit <NUM> identifies the IP addresses included in the part as dynamic IP addresses.

As illustrated in <FIG>, the identification unit <NUM> identifies a part 300a, a part 300b, and a part 300c as dynamic IP addresses among the parts in which segments divided by boundaries match. <FIG> is a diagram for describing identification of types according to the first embodiment. For example, the identification unit <NUM> identifies the part in which the number of included IP addresses is equal to or more than a parameter N, which can be arbitrarily set, as dynamic IP addresses. In this case, if N=<NUM>, the identification unit <NUM> identifies the part 300b as dynamic IP addresses since the number of the IP addresses included in the part 300b corresponding to segments <NUM>-<NUM>-<NUM> is <NUM>.

The parameter N used in identification may be determined in advance by using IP address blocks, which are obviously static IP addresses or dynamic IP addresses, as training data. The parameter N may be determined by an administrator or may be automatically determined by the identification device <NUM>.

Herein, an example of a case in which the identification device <NUM> determines the parameter N will be described. With respect to IP address blocks which are known whether they are dynamic IP addresses or not, the identification device <NUM> executes identification processing by the identification device <NUM> while the value of N is incremented from <NUM>. Then, the identification device <NUM> calculates the sum of the number of static IP addresses erroneously identified as dynamic IP addresses and the number of dynamic IP addresses erroneously identified as static IP addresses. In this process, the identification device <NUM> employs the value of N that minimizes the calculated sum.

A processing flow of the identification device <NUM> will be described by using <FIG> is a flow chart illustrating a processing flow of the identification device according to the first embodiment. As illustrated in <FIG>, first, the identification device <NUM> receives input of an IP address block (step S11).

Then, the identification device <NUM> reads the setting information <NUM>, which corresponds to IP addresses included in the received IP address block, from the storage unit <NUM> (step S12). Then, the identification device <NUM> specifies a management boundary based on the setting information <NUM> (step S13). Herein, the management boundary is the boundary which is specified based on the information with which whether the IP addresses have the same administrator or operator or not can be specified. For example, the management boundary is the position before/after which the AS numbers or e2LDs of the sorted rows of the IP addresses are different.

Then, the identification device <NUM> specifies a character string boundary based on the setting information <NUM> (step S14). The character string boundary is the boundary specified based on the similarity of predetermined character strings. For example, the character string boundary is the position at which the Jaro-Winkler distance of the e2LD-excluding parts of the PTR records of the IP addresses, which are sequential in the sorted row of the IP addresses, becomes equal to or less than a threshold value.

The identification device <NUM> identifies the types of the IP addresses based on the management boundaries and the character string boundaries (step S15). For example, the types of the IP addresses are static IP addresses and dynamic IP addresses. If the number of the IP addresses included in the part of the sorted rows of the IP addresses divided by the management boundaries and the character string boundaries is equal to or higher than the threshold value, the identification device <NUM> identifies this part as dynamic IP addresses.

Then, the identification device <NUM> outputs identification results (step S16). For example, as the identification results, the identification device <NUM> outputs a list of the IP addresses which have been identified as dynamic IP addresses.

As described above, the identification device <NUM> of the present embodiment specifies the boundaries which divide the rows of IP addresses, which are the IP addresses included in the IP address block and sorted in the predetermined order, into a plurality of parts based on predetermined information about IP addresses. If the part divided by the boundaries satisfy the predetermined condition, the identification unit <NUM> identifies the IP addresses, which are included in the part, as dynamic IP addresses. In this manner, the identification device <NUM> of the present embodiment identifies dynamic IP addresses without using specific keywords. Therefore, according to the identification device <NUM>, dynamic IP addresses can be accurately identified.

For example, if the parts 300a, 300b, and 300c in <FIG> are to be identified as dynamic IP addresses by using a conventional method, keywords such as "host" and "test" have to be designated in advance. If such keywords are not designated in advance, it is difficult for conventional methods to identify dynamic IP addresses at the accuracy that is equivalent to or better than the present embodiment. It is not realistic to cover all the keywords which are used in the PTR records of dynamic IP addresses. Therefore, according to the method of the present embodiment, dynamic IP addresses can be easily and accurately identified compared with conventional methods.

The identification device <NUM> compares first information about a first IP address with second information about a second IP address, which is subsequent to the first IP address in the order of rows, and, if the similarity between the first information and the second information is equal to or less than a threshold value, specifies the position between the first IP address and the second IP address as a boundary. In this manner, the identification device <NUM> specifies boundaries by focusing on the combinations of IP addresses, which are continuous in the order. Therefore, the identification device <NUM> does not have to evaluate all the combinations of IP addresses, and boundaries can be efficiently specified.

The identification device <NUM> specifies boundaries based on the information with which whether the IP addresses have the same administrator or operator or not can be specified. Therefore, the identification device <NUM> can specify the dynamic IP addresses which are collectively managed by the same administrator or operator.

The identification device <NUM> specifies boundaries based on the similarity of predetermined character strings included in predetermined information. Therefore, the identification device <NUM> can specify the dynamic IP addresses which use a common prefix in PTR records.

If the Jaro-Winkler distance between the first character string excluding the e2LD from the host name of the first IP address and the second character string excluding the e2LD from the host name of the second IP address, which is subsequent to the first IP address in the order of the rows, is equal to or lower than the threshold value, the identification device <NUM> specifies the position between the first IP address and the second IP address as a boundary. In this manner, the identification device <NUM> can specify dynamic IP addresses by focusing on the part which highly possibly uses a common prefix in PTR records.

If the number of IP addresses included in the part divided by boundaries is equal to or higher than a threshold value, the identification device <NUM> identifies the IP addresses included in the part as dynamic IP addresses. There is a tendency that the larger the number of the IP addresses in the segment, the higher the possibility that they are dynamic IP addresses. The identification device <NUM> can accurately identify dynamic IP addresses by using such a tendency.

In the above described embodiment, the example of the case in which the IP addresses, which are identification targets of the identification device <NUM>, are IPv4 has been described. On the other hand, the IP addresses of the identification targets of the identification device <NUM> may be IPv6. Even if the IP addresses are IPv6, as well as the above described embodiment, the identification device <NUM> can carry out sorting by using the value of each sectioned part, which is considered as a numerical value, as a key.

In the above described embodiment, the example of the case in which the similarity between the character strings is evaluated by the Jaro-Winkler distance has been described. On the other hand, the identification device <NUM> may evaluate the similarity between the character strings by using an index other than the Jaro-Winkler distance. For example, the identification device <NUM> can use the number or rate of the matching characters in the front side of two character strings as the similarity between the character strings.

The constituent elements of the illustrated devices are functionally conceptual and are not necessarily required to be physically formed like the illustration. In other words, specific modes of distribution and integration of the devices are not limited to the illustration, but all or part thereof may be functionally or physically configured to be distributed or integrated in arbitrary units depending on various loads, usage conditions, etc. Furthermore, all or arbitrary part of the processing functions carried out in the devices may be realized by a CPU and a program(s) analyzed and executed by the CPU or may be realized as hardware by wired logic.

Among the processings described in the present embodiment, all or part of the processing described to be automatically carried out may be manually carried out, or all or part of the processing described to be manually carried out may be automatically carried out by a publicly known method. Other than that, processing procedures, control procedures, specific names, various data, and information including parameters described in the above described document or drawings may be arbitrarily changed unless otherwise specifically stated.

As an embodiment, the identification device <NUM> can be implemented by installing an identification program serving as packaged software or online software, which executes the above described identification processing, in a desired computer. For example, an information processing device can be caused to function as the identification device <NUM> by executing the above described identification program by the information processing device. The information processing device referred to herein includes a personal computer of a desktop type or a laptop type. Also, other than that, for example, smartphones, mobile communication terminals such as portable phones and personal handy-phone systems (PHSs), and slate terminals such as personal digital assistants (PDAs) fall within the category of the information processing device.

Also, the identification device <NUM> can be implemented as an identification server device which uses a terminal device used by a user as a client and provides a service, which is related to the above described identification processing, to the client. For example, the identification server device is implemented as a server device which provides an identification service which uses an IP address block as input and outputs a list of dynamic IP addresses. In this case, the identification server device may be implemented as a Web server or a cloud which provides a service related to the above described identification processing by outsourcing.

<FIG> is a diagram illustrating an example of a computer which executes the identification program. A computer <NUM> has, for example, a memory <NUM> and a CPU <NUM>. The computer <NUM> has a hard disk drive interface <NUM>, a disk drive interface <NUM>, a serial port interface <NUM>, a video adapter <NUM>, and a network interface <NUM>. These units are connected by a bus <NUM>.

The memory <NUM> includes a read only memory (ROM) <NUM> and a RAM <NUM>. The ROM <NUM> stores, for example, a boot program of, for example, a basic input output system (BIOS). The hard disk drive interface <NUM> is connected to a hard disk drive <NUM>. The disk drive interface <NUM> is connected to a disk drive <NUM>. For example, an attachable/detachable storage medium such as a magnetic disk or an optical disk is inserted in the disk drive <NUM>. The serial port interface <NUM> is connected to, for example, a mouse <NUM> and a keyboard <NUM>. The video adapter <NUM> is connected to, for example, a display <NUM>.

The hard disk drive <NUM> stores, for example, an OS <NUM>, an application program <NUM>, a program module <NUM>, and program data <NUM>. More specifically, the program which defines the processings of the identification device <NUM> is implemented as the program module <NUM>, in which computer-executable codes are described. The program module <NUM> is stored, for example, in the hard disk drive <NUM>. For example, the program module <NUM> for executing the processings which are similar to the functional configuration of the identification device <NUM> is stored in the hard disk drive <NUM>. Note that the hard disk drive <NUM> may be replaced by a SSD.

Also, setting data used in the processings of the above described embodiments is stored as the program data <NUM>, for example, in the memory <NUM> or in the hard disk drive <NUM>. Then, in accordance with needs, the CPU <NUM> reads the program module <NUM> and/or the program data <NUM>, which is stored in the memory <NUM> or the hard disk drive <NUM>, to the RAM <NUM> and executes the processing of the above described embodiment.

Claim 1:
An identification device (<NUM>) comprising:
a specification unit (<NUM>) configured to specify a boundary dividing rows of IP addresses, which are included in an IP address block and sorted by a predetermined order based on a magnitude of numerical values of octets of the IP addresses, into a plurality of parts based on predetermined information about the IP addresses, the predetermined information including an AS number, a PTR record comprising an effective second level domain, e2LD, and wherein, when a Jaro-Winkler distance between a first PTR record excluding an effective second level domain, e2LD, from a host name of a first IP address and a second PTR record excluding an e2LD from a host name of a second IP address, which is subsequent to the first IP address in the order of the row, is equal to or less than a threshold value, the specification unit (<NUM>) specifies a position between the first IP address and the second IP address as the boundary; and
an identification unit (<NUM>) configured to identify the IP addresses included in a part as dynamic IP addresses when the part divided by the boundary satisfies a predetermined condition, constituted by the number of the IP address included in the part being equal to or higher than a threshold value.