KR100545678B1 - System for preventing spread of virus and method thereof - Google Patents

Abstract

The present invention relates to a virus spreading prevention system and method, and more particularly, an abnormal process such as a virus infected process in a terminal extracts predetermined information such as an e-mail address in the terminal, and uses the extracted e-mail address. The present invention relates to a virus spreading prevention system and method for preventing the spread of the virus to other terminals to prevent the damage from being expanded.

Virus spread prevention system according to an embodiment of the present invention, the storage unit for storing the policy information associated with the process and network information, the process of generating the packet, if a packet for transmission over the network from the terminal is generated A process identification unit for identifying a network, a packet inspection unit for searching for network information included in the packet, a search unit for searching policy information associated with a process identified in the process identification unit, and based on the policy information retrieved by the search unit A determination unit for determining whether to transmit the packet, and a policy execution unit for executing a predetermined policy according to a determination result of the determination unit, wherein the network information includes any one of destination address information, port number, and protocol information. It is characterized by including the above.

According to the virus spread prevention system and method according to the present invention, when a predetermined process in a user terminal accesses a network, the abnormal process by blocking or allowing access of the process to the network based on policy information associated with the process, That is, by preventing the virus-infected process from propagating the virus to other terminals, there is an effect of preventing the virus from spreading.

Worm virus, process, email, network, block

Description

SYSTEM FOR PREVENTING SPREAD OF VIRUS AND METHOD THEREOF

1 is a view showing a schematic configuration of a virus spreading prevention system according to an embodiment of the present invention.

2 and 3 are diagrams illustrating an example of process-specific network information maintained in a storage unit in an embodiment according to the present invention.

4 is a flowchart illustrating a virus spreading prevention method according to another embodiment of the present invention.

5 is an internal block diagram of a general purpose computer system that may be employed to construct a virus spread prevention system according to the present invention.

<Explanation of symbols for main parts of the drawings>

100: virus spread prevention system

101: storage unit 102: process identification unit

103: packet inspection unit 104: search unit

105: judging unit 106: policy execution unit

The present invention relates to a virus spreading prevention system and method, and more particularly, an abnormal process such as a virus infected process in a terminal extracts predetermined information such as an e-mail address in the terminal, and uses the extracted e-mail address. The present invention relates to a virus spreading prevention system and method for preventing the spread of the virus to other terminals to prevent the damage from being expanded.

Today, data transmission over the network is becoming more common and various technologies are being developed to increase the data transmission speed, which improves the quality of life of people. However, the spread of viruses has also been accelerated and broadened. For example, a virus is spread more often through e-mail or the like than an unauthorized third party manipulating the terminal directly through a wired / wireless communication network or an in-house LAN.

Therefore, in order to prevent and treat damage caused by a virus, a conventional technique is to treat a terminal infected with a virus with a predetermined vaccine program, or to prevent the virus from executing when a file to which a virus is attached is transmitted through a network. Various technologies have been developed, such as a technique for preventing the file itself from being transmitted.

However, in the case of a terminal that is already infected with a virus, blocking the virus that has spread through the network cannot be solved and must be treated with an antivirus program. However, it takes some time from the time of the virus infection to the time of treating the virus with the vaccine program, during which time the virus not only destroys the resources in the terminal, but also ii) the resources in the terminal (eg, e-mail). There is a problem that the desired purpose can be sufficiently achieved by spreading the virus to other terminals, such as sending a large amount of e-mail containing a virus to another terminal by accessing a file including an address).

The virus spreading prevention system and method according to the present invention has been devised to solve the above-mentioned problems. In the user terminal infected with a virus, the virus spreads to other terminals by accessing the network through a communication mechanism such as e-mail. It aims to effectively defend against spread.

In addition, in the present invention, when a process that allows access to resources in the terminal but does not allow access to the network accesses the network, the virus is spread by the process by blocking the access or alerting the user or security server. It is an object of the present invention to provide a virus spread prevention system and method that can be prevented in advance.

In order to achieve the above object and to solve the problems of the prior art, the virus spread prevention system according to an embodiment of the present invention, the storage unit for storing the policy information associated with the process and network information, transmitted from the terminal through the network When a packet to be generated is generated, a process identification unit for identifying a process that generated the packet, a packet inspection unit for searching network information included in the packet, a process identified by the process identification unit and the packet inspection unit A search unit for searching for policy information associated with network information, a determination unit for determining whether to transmit the packet based on the policy information retrieved by the search unit, and for performing a predetermined policy according to the determination result of the determination unit. A policy execution unit, wherein the network information None of less address information, port number, and protocol information, characterized in that it comprises at least one.

In addition, the virus spread prevention method according to another aspect of the present invention, the step of maintaining the policy information associated with the process and network information in the database in association with the process, detecting a packet generated by a predetermined process and waiting to be transmitted from the terminal Searching network information included in the packet; searching policy information associated with the network information searched by the process and the packet inspector; determining whether to transmit the packet based on the policy information searched by the searcher And performing a predetermined policy according to the determination result of the determination unit, wherein the network information includes any one or more of a destination address, a destination port number, and protocol information.

Hereinafter, a virus spreading prevention system and method according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

As described above, it takes some time from the time of virus infection to the time of treating the virus with the vaccine program, during which time the virus i) destroys resources in the terminal, ii) resources in the terminal (e.g., There was a problem in that the virus was spread to other terminals by accessing a file containing an e-mail address) and sending a large amount of e-mail containing the virus to another terminal.

In order to solve the problems i) and ii), the applicant of the present invention specifies to what extent a given process executed by a given user can access a given resource, and only a process to which the access is allowed to access the resource. It has been applied for 'resource protection system and method in the terminal' (Korean Patent Application No. 10-2003-0075526) (hereinafter referred to as 'application invention'). According to the above-described invention, the virus-infected process is prevented from accessing a predetermined resource to corrupt or contaminate the resource.

Therefore, not only an abnormal process accesses a predetermined resource and destroys the resource, but also a process in which the abnormal process is allowed to access a resource such as a file including an e-mail address according to a predetermined criterion. It is effective to prevent an unauthorized process from accessing the e-mail address and sending an e-mail with a virus to another terminal.

However, the present invention does not determine whether a script or a macro executed by the process is stable in the case of a script or a macro executed by a process deemed to be allowed to access a predetermined resource.

Accordingly, the present invention provides a virus spreading prevention system and method that can prevent a process that is allowed to access a given resource from spreading the virus to a network while executing a script or macro.

1 is a view showing a schematic configuration of a virus spreading prevention system 100 according to an embodiment of the present invention. Hereinafter, referring to FIG. 1, the virus spread prevention system 100 according to the present invention will be described in detail.

The virus spread prevention system 100 according to the present invention includes a storage unit 101, a process identification unit 102, a packet inspection unit 103, a search unit 104, a determination unit 105, and a policy execution unit 106. Include. The virus spread prevention system 100 is installed in association with the L7 layer of the terminal. The virus spread prevention system 100 according to the present embodiment needs to identify a subject, ie, a process, for generating predetermined data transmitted through a network, as described below, which is possible in the L7 layer. Because.

The L7 layer is an application layer, and a network interface is provided so that a user and a terminal can communicate with each other. That is, a layer where a user and a terminal communicate with each other, and services provided in this layer are e-mail, FTP, SMTP, Telnet, and Internet. For example, when a user requests the execution of a web browser such as Internet Explorer® to access the Internet, an operation of identifying a web browser selected by the user in the L7 layer (application layer) and communicating with each other is performed. For example, when a process infected with a virus such as a worm virus sends an e-mail by accessing a resource including an e-mail address in the terminal, the process is identified in the L7 layer.

The storage unit 101 stores policy information associated with process and network information. The network information includes any one or more of destination address information, port number, and protocol information. The policy information may be input by a user through a user interface of the terminal and maintained in the storage unit 101, or may be transmitted and maintained from a predetermined security server through a communication network.

The protocol information is information on the type of protocol used for transmitting a predetermined packet, such as Transmission Control Protocol (TCP) or User Data Protocol (UDP).

The process identification unit 102 identifies the process that generated the packet when a packet for transmission through the network is generated from the terminal.

The term 'packet' used in this embodiment refers to a basic unit of data transmitted from the terminal to the network. In general, a packet includes source address information, source port number, destination address information, and the like. Contains the destination port number. A packet generated according to the ICMP (Internet Control Message Protocol) does not include a port number, and the information included in the predetermined packet may change according to the type of protocol.

The packet inspecting unit 103 searches for network information included in the packet.

The retrieval unit 104 retrieves the policy information associated with the process identified by the process identification unit and the network information retrieved by the packet inspection unit from the storage unit 101.

The determination unit 105 determines whether to transmit the packet based on the policy information retrieved by the search unit.

The policy execution unit 106 performs a predetermined policy according to the determination result of the determination unit.

2 and 3 are diagrams showing an example of the policy information held in the storage unit 101. Policy information is maintained in association with process and network information. Hereinafter, the virus spread prevention system 100 according to the present embodiment will be described in more detail with reference to FIGS. 2 and 3.

The virus spread prevention system 100 determines whether to allow the packet generated by the process to be transmitted from the terminal to the network based on the policy information.

The network information may be any one or more of destination address information, port number, and protocol information. Destination address information is data for identifying a destination (another terminal) to which the packet is to be transmitted, and a destination port number among port numbers is for identifying an application process that will finally receive data included in the packet in the other terminal, The source port number is used to identify the process that generated the packet. The port number stored in the storage unit 101 is a source port number.

According to the policy information as shown in Fig. 2, when the process A.exe generates a packet including the destination address information (192.168.1.1), the port number 123, and the protocol information TCP, the transmission of the packet is allowed.

In FIG. 2, access right 0x01 includes " access to the network " (i.e., protocol information generated by process A.exe and indicating that the packet is according to the destination address information 192.168.1.1, port number 123, and TCP). Packet means "transmission is allowed").

In addition, access right 0x02 means "Access to the network is not allowed" (that is, a packet generated by Process C.exe that contains protocol information indicating that it is a packet according to SMTP. ).

When a packet is generated by a predetermined process, the process identification unit 102 identifies the process that generated the packet, and the packet inspection unit 103 examines the network information included in the packet. For example, assume that the identified process is B.exe and the checked network information corresponds to 200.188.0.1 for destination address information, 125 for source port number, and UDP for protocol information.

Since the process identified by the process identification unit is B.exe, the search unit 104 searches for policy information associated with the process B.exe in the storage unit 101.

The determination unit 105 determines whether to allow the transmission of the packet by using the policy information retrieved by the search unit and the network information inspected by the packet inspection unit 103.

As shown in Fig. 2, since the process B.exe does not grant access to the packet transmitted using SMTP, the policy execution unit 106 performs a predetermined policy accordingly.

As such, even the same process may or may not be allowed to access the network according to the policy information (network information) associated with the process.

According to an embodiment of the present invention, the policy execution unit 106 blocks a process that is not allowed to access the network based on the policy information from accessing the network. That is, the policy execution unit 106 blocks the packet generated by the process E.exe from being transmitted from the terminal.

Further, according to another embodiment of the present invention, the policy execution unit 106 records in a predetermined log file that a process that is not allowed to access the network has accessed the network based on the policy information. It alerts the user or any secure server (not shown) connected to the network. For example, the policy execution unit 106 controls to display a warning message on the display device of the terminal indicating that a process that is not allowed to access the network has accessed the network. Alternatively, the policy execution unit 106 transmits the warning message to a predetermined security server through a communication network. That is, the policy execution unit 106 may notify the user, etc., that the process is not allowed to access the network and may be an unsafe operation performed by a virus or the like so that the policy execution unit 106 may cope with it.

At this time, according to another embodiment of the present invention, if an explicit command to perform the transmission of the packet from the user or the security server in spite of the warning, the policy execution unit 106 to transmit the packet. Can be controlled.

On the other hand, when the determination result of the determination unit 105, when the process is allowed to access the network, that is, the transmission of the packet generated by the process is allowed, the virus spread prevention system 100 does not execute a special policy The terminal transmits the packet to another terminal through a network.

Meanwhile, there may be a case in which the process Z.exe tries to access the network but the storage unit 101 does not have the policy information itself associated with the process Z.exe. At this time, according to another embodiment of the present invention, if the search unit 140 cannot search the policy information associated with the identified process, or the policy information associated with the identified process is retrieved, the determination unit 105 If it is not possible to determine whether to allow the packet transmission only by the retrieved policy information, the determination unit 105 displays a message on the display device of the terminal inquiring whether the packet is allowed to be transmitted or not, and the policy execution unit 106. Performs a predetermined policy according to the message.

That is, the policy execution unit 106 does not take any further action when the message is a message for allowing the transmission of the packet, and blocks the transmission of the packet when the message is a message disallowing the transmission of the packet. do.

According to one embodiment of the present invention, if it is not possible to determine whether to allow access to the network only by the policy information maintained in the storage unit 101 as described above, the determination unit 105 does not allow access to the process. Do not. That is, the policy information as shown in Fig. 2 does not specify whether or not the process B.exe can transmit a packet in accordance with SMTP, and the determination unit 105 allows the transmission of the undefined packet. I never do that.

Further, according to another embodiment of the present invention, as shown in FIG. 3, the operation of a process not maintained by the policy information and maintaining the policy information associated with the process requiring attention to the contrary to the above configuration You can also allow them all. At this time, unlike in the above-described embodiment, the determination unit 105 allows all packets other than the packet including the destination address information 200.188.0.1 and the port number 125 as the packets generated by B.exe.

As such, the storage 101 maintains policy information associated with the network information and processes that are allowed to access the network (shown in FIG. 2), processes and network information that are not allowed to access the network. There may be various embodiments, such as a method for maintaining policy information (shown in FIG. 3), a process for allowing access to a network, and a method for maintaining policy information associated with a process for which access is not allowed, respectively.

Meanwhile, in the above-described embodiment, the case where the destination address information, the source port number, and the protocol information are used as the network information has been described, but there may be various embodiments such as only the destination address information is used as the network information. That is, when a predetermined process generates a packet including predetermined destination address information, policy information may be maintained to allow or disallow transmission of the packet.

Further, according to another embodiment of the present invention, the virus spread prevention system 100 authenticates according to a predetermined user authentication system 110 before determining whether to allow access to a network of a process according to policy information. If the user has not executed the process, the user may not allow the access.

By such a configuration, a process accessible to a file including an e-mail address, such as a * .wab, * .dbx, * .htm, and * .eml file, accesses the file and extracts the e-mail address according to the present invention. Even if successful, if the process is not allowed to access the network according to the present embodiment, since the transmission of an e-mail containing a virus to another terminal using the e-mail address is blocked, the virus spreads. Can be prevented.

Hereinafter, a virus spreading prevention method according to another embodiment of the present invention will be described. 4 is a flowchart illustrating a virus spread prevention method according to the present embodiment. Hereinafter, with reference to Figure 4, it will be described in detail the processes performed in each step in the virus spreading prevention method according to the present invention.

First, in step 410 policy information associated with process and network information is maintained in a database. The network information includes at least one of destination address information, source port number, and protocol information.

Since the policy information maintained in the predetermined database has been described in detail with reference to FIGS. 2 and 3, the detailed description thereof will be omitted.

In step 420, a packet generated by a predetermined process and waiting to be transmitted from the terminal is detected.

In operation 430, network information included in the packet is searched.

Step 440 retrieves policy information associated with the process from the database.

In step 450, it is determined whether to transmit the packet based on the policy information retrieved by the search unit. Since the policy information can be set in association with the process and the network information, even if the network access by the same process, the access may or may not be allowed according to the network information.

In operation 460, a predetermined policy is performed according to the determination result of the determination unit. If the determination result of the determination unit allows the process to access the network, the packet generated by the process is transmitted to the destination address, and the determination unit allows the process to access the network. If not, perform a policy to block access to the network of the process.

Further, according to another embodiment of the present invention, even if the determination of the determination unit does not allow the process to access the network, the process allows access to the network, that is, to transmit the packet and 'access It may also notify the user or security server (administrator side) only that this unauthorized process has accessed the network. In this case, the fact can also be recorded in a predetermined log file.

Embodiments of the invention also include computer-readable media containing program instructions for performing various computer-implemented operations. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The medium or program instructions may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. The medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, or the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

5 is an internal block diagram of a general purpose computer system that may be employed to construct a virus spreading prevention system in accordance with the present invention.

Computer system 500 includes one or more processors 510 that are coupled to a main memory including random access memory (RAM) 520 and read only memory (ROM) 530. The processor 510 is also called a central processing unit (CPU). As is well known in the art, the ROM 530 serves to transfer data and instructions to the CPU unidirectionally, and the RAM 520 typically transfers data and instructions bidirectionally. Used to. RAM 520 and ROM 530 may include any suitable form of computer readable media. Mass storage 540 is bidirectionally coupled to processor 510 to provide additional data storage capability and may be any of the computer readable recording media described above. The mass storage device 1204 is used to store programs, data, and the like, and is a secondary memory device such as a hard disk which is generally slower than the main memory device. Certain mass storage devices such as CD ROM 560 may be used. The processor 510 may include one or more inputs and outputs, such as a video monitor, trackball, mouse, keyboard, microphone, touchscreen display, card reader, magnetic or paper tape reader, voice or handwriting reader, joystick, or other known computer input / output device. Is connected to the interface 550. Finally, the processor 510 may be connected to a wired or wireless communication network through the network interface 570. Through this network connection, the procedure of the method described above can be performed. The apparatus and tools described above are well known to those skilled in the computer hardware and software arts.

The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention.

As described above, although the present invention has been described with reference to a limited embodiment and drawings, the present invention is not limited to the above embodiments, and may be applied to various virus spread prevention methods, and those skilled in the art to which the present invention pertains. Various modifications and variations are possible without departing from the spirit of the invention from the description.

According to the virus spread prevention system and method according to the present invention, when a predetermined process in a user terminal accesses a network, the abnormal process by blocking or allowing access of the process to the network based on policy information associated with the process, That is, by preventing the virus-infected process from propagating the virus to other terminals, there is an effect of preventing the virus from spreading.                     

In addition, according to the present invention, there is provided a virus spread prevention system and method for alerting the fact that a process that is not allowed to access the network requests access to the network so that the user or security server can quickly prepare the countermeasures. do.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above-described embodiments, which can be variously modified and modified by those skilled in the art to which the present invention pertains. Modifications are possible. Accordingly, the spirit of the present invention should be understood only by the claims set forth below, and all equivalent or equivalent modifications thereof will belong to the scope of the present invention.

Claims (8)

In the virus spread prevention system, A storage unit for storing policy information associated with process and network information; A process identification unit for identifying a process that generated the packet when a packet for transmission through the network is generated from the terminal; A packet inspecting unit for searching network information included in the packet; A retrieving unit for retrieving policy information associated with the process identified by the process identification unit; A determination unit for determining whether to transmit the packet based on the policy information retrieved by the search unit and the network information retrieved by the packet inspection unit; And A policy execution unit for executing a predetermined policy according to the determination result of the determination unit Including, And the network information comprises at least one of destination address information, port number, and protocol information. The method of claim 1, The policy execution unit, And a warning message is displayed on a display unit of the terminal when the transmission of the packet is not permitted as a result of the determination of the determination unit. The method of claim 1, The policy execution unit, And if the transmission of the packet is not permitted as a result of the determination of the determination unit, blocking the transmission of the packet from the terminal. The method of claim 1, The determination unit, If it is not possible to determine whether to allow the packet transmission based on the network information and the policy information retrieved by the packet inspecting unit, inquiring whether to allow the packet transmission to the user of the terminal; And Determining whether to allow the packet to be transmitted over a network based on an input from the user Virus spreading prevention system, characterized in that to carry out. In the virus spread prevention method, Maintaining policy information associated with the process and network information in a database in association with the process; Detecting a packet generated by a predetermined process and waiting to be transmitted from the terminal; Retrieving network information included in the packet; Retrieving policy information associated with the process; Determining whether to transmit the packet based on the policy information retrieved by the searcher and the network information retrieved by the packet inspector; And Performing a predetermined policy according to a determination result of the determination unit; Including, And the network information comprises at least one of a destination address, a destination port number, and protocol information. The method of claim 5, The step of performing the policy, Displaying a warning message on a display unit of the terminal when transmission of the packet is not permitted as a result of the determination of the determination unit; Virus spreading prevention method comprising a. The method of claim 5, The step of performing the policy, Blocking the transmission of the packet from the terminal if the transmission of the packet is not allowed as a result of the determination of the determination unit; Virus spreading prevention method comprising a. 8. The virus identification prevention method according to any one of claims 5 to 7, wherein the method is a computer readable recording medium having recorded thereon a computer-implemented program.

Images