Analysis apparatus, analysis method, and analysis program

• US 10,701,087 B2
• Filed: 10/17/2016
• Issued: 06/30/2020
• Est. Priority Date: 11/02/2015
• Status: Active Grant

• Current Assignee: Nippon Telegraph and Telephone Corporation
• Original Assignee: Nippon Telegraph and Telephone Corporation
• Inventors: Takata, Yuta, Akiyama, Mitsuaki, Yagi, Takeshi
• Primary Examiner(s): Chang, Kenneth W
• Application Number:
  US15/768,624
• Publication Number:
  US 20180316696A1
• Time in Patent Office: 1,352 Days
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: G06F 16/986 Document structures and storage, e.g. HTML extensions
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A browser emulator manager causes a browser emulator(s) to access a website. The browser emulator traces content interpretation and script execution on a browser that have occurred by access to the website. When detecting transfer, the browser emulator records, in transfer information, a transfer method, a transfer source URL, and a transfer destination URL thereof. When detecting the script execution, the browser emulator records, in the transfer information, an execution method and an execution source script thereof. A graph construction unit constructs a directed graph on the basis of the transfer information. Thereafter, a graph analysis unit specifies places of content and a script causing the transfer by tracing the directed graph.

Claims

1. An analysis apparatus analyzing content and a script of a website, the analysis apparatus comprising:

a memory; and

a processor coupled to the memory and programmed to execute a process comprising;

accessing the website using a browser;

recording, in transfer information, a URL of the website as a transfer source URL, a URL of another web site as a transfer destination URL, a function name or a property name of the script used for transfer as a transfer method to the transfer destination URL, and identification information of the script as an execution source script when the transfer to the other website is caused by execution of the script in the website, and records, in the transfer information, identification information of a generation source script of a new script as the execution source script in the website, identification information of the new script as a generated script, and a function name or a property name of the generation source script used for generation as a script execution method when the script of the website generates the new script; and

constructing a directed graph representing URLs of a series of websites that the browser has accessed, the transfer method to the URL, the script used for the transfer, and the script execution method, the directed graph including the transfer source URL and the transfer destination URL recorded in the transfer information each as a first type of node, each first type of node being connected to each other in the directed graph based on the series of web sites that the browser has accessed, the execution source script and the generated script in the transfer source URL are each a second type of node encapsulated within the first type of node of the transfer source URL, and the transfer method recorded in the transfer information is an edge corresponding to a connection between the first type of nodes in the directed graph, and the script execution method recorded in the transfer information is an edge corresponding to a connection between the second type of nodes in the directed graph.

2. The analysis apparatus according to claim 1, wherein the process further comprises:

in the case in which an HTTP response in access to the website is an HTTP response indicating transfer, recording, in the transfer information, the URL of the website as the transfer source URL, a transfer destination URL contained in an HTTP response header from the website as the transfer destination URL, and an HTTP status code number contained in the HTTP response header as the transfer method to the transfer destination URL; and

in the case in which the HTTP response in the access to the web site is not the HTTP response indicating transfer, recording, in the transfer information, the URL of the website as the transfer source URL, the URL of the other website as the transfer destination URL, and an HTML tag as the transfer method to the transfer destination URL when the transfer to the other web site is caused by interpretation of the HTML tag in the content of the website.

3. The analysis apparatus according to claim 1, wherein the process comprises:

when an HTML tag instructing transfer to the other website is inserted into the content of the website by execution of the script, recording, in the transfer information, the URL of the website as the transfer source URL, the URL of the other website as the transfer destination URL, the HTML tag and the function name or the property name of the script that has inserted the HTML tag as the transfer method to the transfer destination URL, and the identification information of the script as the execution source script.

4. The analysis apparatus according to claim 1, wherein the process comprises:

when a script read from the other website is executed and access to the other website is transferred to a different website by interpretation of the content of the web site, recording, in the transfer information, the URL of the other website as the transfer source URL, a URL of the different website as the transfer destination URL, a function name or a property name of the script used for transfer as the transfer method, and identification information of the script as the execution source script.

5. The analysis apparatus according to claim 1, wherein the process further comprises:

analyzing a transfer process from a node serving as a root of the directed graph to a node serving as a starting point set to any of the nodes constituting the directed graph, an execution process of the script, and a place of the content or a place of the script causing the transfer to the node as the starting point by tracing the directed graph in reverse order to the node serving as the root of the directed graph from the node as the starting point.

6. An analysis method of analyzing content and a script of a website, the analysis method comprising:

accessing the website using a browser;

recording, in transfer information, a URL of the website as a transfer source URL, a URL of another web site as a transfer destination URL, a function name or a property name of the script used for transfer as a transfer method to the transfer destination URL, and identification information of the script as an execution source script when the transfer to the other website is caused by execution of the script in the website, and recording, in the transfer information, identification information of a generation source script of a new script as the execution source script in the website, identification information of the new script as a generated script, and a function name or a property name of the generation source script used for generation as a script execution method when the script of the website generates the new script; and

constructing a directed graph representing URLs of a series of websites that the browser has accessed, the transfer method to the URL, the script used for the transfer, and the script execution method, the directed graph including the transfer source URL and the transfer destination URL recorded in the transfer information each as a first type of node, each first type of node being connected to each other in the directed graph based on the series of web sites that the browser has accessed, the execution source script and the generated script in the transfer source URL are each a second type of node encapsulated within the first type of node of the transfer source URL, and the transfer method recorded in the transfer information is an edge corresponding to a connection between the first type of nodes in the directed graph, and the script execution method recorded in the transfer information is an edge corresponding to a connection between the second type of nodes in the directed graph.

7. A non-transitory computer readable storage medium having stored therein an analysis program for analyzing content and a script of a website, the analysis program causing a computer to execute a process comprising:

accessing the website using a browser;

recording, in transfer information, a URL of the website as a transfer source URL, a URL of another web site as a transfer destination URL, a function name or a property name of the script used for transfer as a transfer method to the transfer destination URL, and identification information of the script as an execution source script when the transfer to the other website is caused by execution of the script in the website, and recording, in the transfer information, identification information of a generation source script of a new script as the execution source script in the website, identification information of the new script as a generated script, and a function name or a property name of the generation source script used for generation as a script execution method when the script of the website generates the new script; and

constructing a directed graph representing URLs of a series of websites that the browser has accessed, the transfer method to the URL, the script used for the transfer, and the script execution method, the directed graph including the transfer source URL and the transfer destination URL recorded in the transfer information each as a first type of node, each first type of node being connected to each other in the directed graph based on the series of web sites that the browser has accessed, the execution source script and the generated script in the transfer source URL are each a second type of node encapsulated within the first type of node of the transfer source URL, and the transfer method recorded in the transfer information is an edge corresponding to a connection between the first type of nodes in the directed graph, and the script execution method recorded in the transfer information is an edge corresponding to a connection between the second type of nodes in the directed graph.