Abstract: A program analysis unit of a browser emulator manager exhaustively searches a code by performing syntax analysis of a code included in web content to search a transfer code to another site or a content acquisition code, and specifies at least any of an object and a function and a property of the object used in the code found as a result of the search. Further, the program analysis unit extracts a code having a dependence relationship with the transfer code or the content acquisition code based on at least any of the object and the function and the property of the object thus specified.

Abstract: A browser emulator is caused to emulate a client environment that is arbitrary values of types and versions of an OS, a browser, and a plugin. Further, the browser emulator monitors execution of a script or a plugin. A browser emulator manager then causes the browser emulator to patrol a predetermined Web site, and accumulates, in an analysis information database, results of access to the Web site in association with information on client environments emulated upon the access to the Web site. The browser emulator manager then refers to the accumulated results of access, and identifies a Web site that causes a difference between results of access according to a difference between client environments.

Abstract: A dynamically-loaded code analysis device includes a memory unit, an extraction unit, and a specification unit. The memory unit memorizes dynamically-loaded code information indicating a class structure of a dynamically-loaded code and call method information in which tag information added to user information is associated with a class structure of a code performed for the user information, for each of the dynamically-loaded codes acquired via a network. The extraction unit detects transmission of user information to another device and specifies tag information that matches the tag information added to the user information from the call method information memorized in the memory unit, to extract a class structure associated with the tag information. The specification unit searches the memory unit for dynamically-loaded code information indicating the class structure, to specify a dynamically-loaded code corresponding to the dynamically-loaded code information.

Abstract: A virtual machine includes a shadow memory, a shadow disk, and a virtual NIC. A virtual machine includes a guest OS. The shadow memory and the shadow disk each store therein pieces of data and pieces of tag information assigned to the pieces of data, so as to be kept in correspondence with one another. When malware transmits data, the virtual NIC generates the transmission information containing the transmitted data and tag information assigned to the transmitted data and further transmits the generated transmission information to the virtual machine. The guest OS extracts the tag information from the received transmission information. Further, the guest OS determines a transfer destination of the transmission information on the basis of the extracted tag information and further transfers the transmission information to the determined transfer destination.

Abstract: A monitoring unit in a monitoring system determines whether or not a program to be executed is a program to be monitored. If it is determined that the program to be executed is a program to be monitored, the monitoring unit in the monitoring system adds, in order, before an instruction string included in a function called by the program to be monitored, an instruction string satisfying a predetermined condition, and a condition branch instruction, which is an instruction starting a predetermined control process when the predetermined condition is satisfied.

Abstract: In an unauthorized access detecting system, authentication information to be leaked outside is generated. In the unauthorized access detecting system, the generated authentication information is set on an analyzing host, and a program to be analyzed is operated on the analyzing host. In the unauthorized access detecting system, access to a content using the authentication information is detected, and if the access using the authentication information is detected, the access is identified as unauthorized access.

Abstract: A monitoring device inspects a redirect code inserted into content of a compromised web site, and, in accordance with a result thereof, when information of a new malicious website is described in the redirect code, the monitoring device acquires information of the malicious website and registers the information on a blacklist. In addition, the monitoring device unregisters information of the malicious website that is no longer described in the redirect code in the content from the blacklist.

Abstract: In an unauthorized access detecting system, authentication information to be leaked outside is generated, and unauthorized access to a content using the generated authentication information is detected. In the unauthorized access detecting system, if the unauthorized access has been detected, content falsification is monitored. If, as a result of the monitoring, content falsification has been detected, the unauthorized access detecting system extracts a character string, which has been newly added to the content.

Abstract: A monitoring unit in a monitoring system determines whether or not a program to be executed is a program to be monitored. If it is determined that the program to be executed is a program to be monitored, the monitoring unit in the monitoring system adds, in order, before an instruction string included in a function called by the program to be monitored, an instruction string satisfying a predetermined condition, and a condition branch instruction, which is an instruction starting a predetermined control process when the predetermined condition is satisfied.