Abstract: A system and method are provided for detecting a botnet in a network based on traffic flow, daisy chained mechanism and white-list generation mechanism. The system and method uses the known malicious components in a botnet such as IP address, domain name and URL, to be the root of a daisy chain and creates a network graph based on given traffic flow data such as NetFlow data, DNS cache data, DNS sinkhole data, DDoS data and Attack log data in threat sensors. The system and method iteratively detects new malicious factors by tracing that network graph. The system and method also introduces a technique to create a white list which is used in the daisy chain to reduce false positive.

Abstract: An information processing apparatus includes an adding unit and an identifying unit. The adding unit adds, to data received from a communication destination device by a program to be analyzed, a tag, by which the communication destination device is identifiable. If the tag has been added to data executed by a new program when an activation of or an activation reservation for the new program is detected, the identifying unit identifies the communication destination device identified by the tag.

Abstract: An information processing device and method that monitor a behavior of malware (program), and generate a log which associates identification information of an invoked library function, input data to the library function, output data from the library function and a taint tag for uniquely specifying output data every time the program invokes a library function. Further, the information processing device and method refer to a taint tag set to output data from an information processing device and a log, track a dependent relationship between items of data input and output to and from libraries and specify a library function which has generated the output data from the information processing device.