KR100743372B1 - Method and apparatus for detecting virus in attached file of e-mail - Google Patents

Abstract

A method and apparatus for detecting malicious code in an attachment of an e-mail are disclosed. The present invention includes the steps of: A) sampling the e-mail attached to the file containing the malicious code of the e-mail transmitted through the network; B) decoding the attachment of the email to set a diagnosis location and a diagnostic range of the malicious code; C) encoding a diagnosis range of a diagnosis location set in said attachment; D) comparing the encoded diagnostic range with a corresponding portion of the attached file of step A) to determine whether they are identical; E) If the determination result of the step D) is the same, including the step of setting the diagnostic range of the diagnosis location as a diagnostic criterion, the malicious code can be detected and blocked even without the decoding of the attachment of the e-mail.

Network, email, attachments, malware

Description

How to detect malicious code in attachments of emails and its device {METHOD AND APPARATUS FOR DETECTING VIRUS IN ATTACHED FILE OF E-MAIL}

1 illustrates a system for detecting malicious code in an attachment of an e-mail according to an embodiment of the present invention.

2 is a flowchart illustrating a method of generating a diagnostic criterion for detecting malicious code in an attachment of an e-mail according to an embodiment of the present invention.

3 is a flowchart illustrating a method for detecting malicious code in an attachment of an email according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

110, 130, 150: client terminal

200: network

300: mail server

400: mail filtering server

500: malware detection device

600: manager server

The present invention relates to a method for detecting malicious code in an attachment of an email and a device thereof, and more particularly, to an attachment of an email without decoding the attachment of an email encoded according to the Multi-Purpose Internet Mail Extensions (MIME) standard. The present invention relates to a malicious code detection method and a device thereof.

In general, a method of filtering the header and the body of the email has been used to detect and block malicious code spreading through the email (E-mail). This method checks the header and the body of the email, and prohibits the transmission of the email when a predetermined keyword is included.

However, recently, malicious codes spread through emails generally use similar mail types, and thus, even if the header and body of the email are filtered, the malicious codes cannot be detected or detected or Even if blocked, there has been a problem that it is difficult to correctly classify whether the malicious code is modified and new. For example, recently, malicious codes have a very general mail subject and body in order to prevent distribution by the filtering method. Therefore, according to the filtering method, when a header and a body of an e-mail are the same, a malicious code may not be detected, and even if detected, it is difficult to reclassify it as a modification.

In addition, if the email is written in a language other than English or Korean, it is impossible to detect malicious codes because the filtering method supports only English and Korean, and an operator for each language is provided to support other languages. The problem arises. In other words, the malicious code can be produced anywhere in Korea and non-English. For example, if the email is written in Chinese, Spanish, German, or French, the malicious code includes the malicious code. There has been a problem that it cannot effectively cope with.

The present invention was created in view of the above circumstances, and an object of the present invention is to detect the presence or absence of malicious code in an attached file in the encoded state using a diagnostic signature without having to decode the attached file of the email encoded according to the MIME standard. The present invention provides a method and apparatus for detecting malicious code in an attachment of an e-mail for scanning.

Malware detection method in the attachment of the email according to the first aspect of the present invention for achieving the above object,
A) sampling an e-mail to which a file containing malicious code is attached among e-mails transmitted through a network;
B) decoding the attachment of the email to search for the location of the malicious code and to set a diagnostic location and diagnostic range for the location;
C) encoding said diagnostic range of said diagnostic location;
D) comparing the encoded diagnostic range with a corresponding portion of the attached file of step A) to determine whether they are identical; And

E) if the determination result of step D) is the same, setting the diagnosis position and the diagnosis range as diagnosis criteria.

delete

delete

delete

delete

Malware detection method in the attachment of the e-mail according to the second aspect of the present invention for achieving the above object,
I) sending an email to which the file encoded by the Multi-Purpose Internet Mail Extensions (MIME) protocol is attached to the mail device;
Ii) determining whether the file attached to the e-mail is an executable file and determining whether the file is executable or compressed; And

I) generating a warning message when the file is compressed and executed, and checking whether malicious code exists in the file as a diagnostic criterion.

delete

delete

An apparatus for detecting malicious code in an attachment of an email according to a third aspect of the present invention for achieving the above object,
An e-mail receiving unit for receiving an e-mail to which a file encoded by a Multi-Purpose Internet Mail Extensions (MIME) protocol is attached through a network;
A diagnostic criterion manager for managing a diagnostic criterion for determining whether a malicious code exists in the attachment file of the e-mail;

And a detection unit for determining whether a malicious code exists in the attached file by reading the diagnostic standard according to the attached file from the diagnostic standard management unit and comparing the diagnostic standard with the attached file.

delete

delete

Therefore, according to the present invention, it is possible to detect and block malicious code even without decoding the attachment of the email.

Hereinafter, with reference to the accompanying drawings will be described a preferred embodiment of the present invention.

1 illustrates a system for detecting malicious code in an attachment of an e-mail according to an embodiment of the present invention.

As shown in FIG. 1, the system of the present invention includes a plurality of client terminals 110, 130, and 150 from the network 200, the mail server 300, and the client terminal 110 via the network 200. To determine whether a malicious code exists in the email when it is to be transmitted to another client terminal 130, a mail filtering server 400 for filtering an email to which a file is attached, and a malicious code in an attachment of the email. An administrator server 600 for generating a malicious code detection apparatus 500 for determining whether there exists, and a Policy / Signature (hereinafter referred to as a diagnostic criterion) for detecting the malicious code, and for monitoring the occurrence of the malicious code. It is configured to include.

Client terminals 110, 130, and 150 are connected to the network 200 to transmit and receive e-mails. In this case, the client terminal may attach the file to the e-mail and transmit the file to another client terminal. The attached file is a document file, an image file, a video file, etc. written in Word, Excel, Korean, etc.

In addition, the client terminal intermittently transmits the executable file as an e-mail attachment file, but even in this case, the executable file is rarely generated by executing the executable file. In other words, more than 95% of malicious code spread through e-mail is compressed or encrypted using a separate tool to reduce the size of attached attachments and interfere with analysis.

The attachments included when the client terminal sends mail are encoded according to the MIME protocol by each client terminal (Client Terminal: 110, 130, 150) before being transmitted to the mail server 300 through the network 200, and the mail server 300 is The mail is transmitted to the mail filtering server 400 to determine whether a malicious code exists in the email.

The mail filtering server 400 detects malicious code included in an email and prevents it from being distributed through the email. In addition, the mail filtering server 400 transmits the email to the malicious code detection apparatus 500 to determine whether there is malicious code in the attachment when the attachment exists in the email in order to detect the malicious code more accurately. do.

The malicious code detection apparatus 500 includes an email receiver 510, a detector 530, a diagnostic criteria manager 550, and a transmitter 570 for receiving an email with a file attached from the mail filtering server 400. It is configured to include.

The diagnostic criterion manager 550 manages the diagnostic criteria generated from the manager server 600 in conjunction with the manager server 600, and when an email with a file is received from the email receiver 510, Diagnostic criteria are provided to the detection unit 530. The diagnosis criteria determines a diagnosis location and a diagnosis range according to whether the attachment is an executable file, and if the attachment is an executable file, whether the attachment is executable or compressed. The diagnosis location and the diagnosis range are encoded by MIME protocol. .

The detection unit 530 transmits a warning message to the manager server 600 through the transmission unit 570 when the attachment of the e-mail received from the email reception unit 510 is compressed. The detection unit 530 determines whether a malicious code exists in an attachment file based on a diagnosis criterion according to the attachment file, and transmits the result to the manager server 600 through the transmission unit 570.

The operating state of the present invention configured as described above will be described.

2 is a flowchart illustrating a method of generating a diagnostic criterion for detecting malicious code in an attachment of an e-mail according to an embodiment of the present invention.

To generate the diagnostic criteria, the administrator must obtain a file of malicious code that is distributed via email. Therefore, an email that has been reported as including malicious code in an email with an attached file or an email that is likely to include malicious code is sampled at the administrator's judgment (S200).

When sending a file via e-mail, the attachment is encoded by the MIME protocol. Therefore, the administrator decodes the attached file in order to check where the malicious code exists in the attached file (S210).

Looking at the decoded attached file, if there is an MZ header or a portable executable header of the file, it can be determined whether the file is an executable file. Therefore, first of all, the diagnostic criteria is generated by encoding an arbitrary range from a start position of a MZ header or a portable executive header of a file to determine whether the executable file is executable.

In other words, when a portion containing information about the executable file is encoded and generated as a diagnostic criterion, the attachment file is compared with the generated diagnostic criterion without decoding the encoded attachment file through the mail server 300. You can determine whether the attachment is an executable file.

In addition, a second diagnostic criterion for determining whether the executable file is executable or compressed is encoded by encoding a specific range, for example, within 16 or 32 bytes from an entry point of the file (ie, start address = EP, Entry Point). (S215).

However, if the attachment is not an executable file, in order to determine the presence of malicious code, a diagnosis location and a diagnosis range for determining the type of the attachment file are set, and the diagnosis location and the diagnosis range are set in the data area of the attachment. After setting, third diagnostic criteria are generated by encoding the set diagnostic position and the diagnostic range, respectively (S230 and S270).

If the attached file is an executable file and is not executable, the diagnostic range is set and encoded from an entry point and an entry point for each section to generate fourth and fifth diagnostic criteria (S250 and S270).

In addition, after checking the import table of the attached file according to the administrator's choice, set the location where the DLL (Dynamic Link Library) or API (Application Program Interface) used in the attached file is located in the diagnostic range and encode it. It is possible to generate a sixth diagnostic criterion.

If the attached file is an executable file and is executable and compressed, a diagnosis position and a diagnostic range are determined and encoded in a code area of the attached file to generate a seventh diagnostic reference (S260 and S270).

The first to seventh diagnostic criteria generated by the respective methods are compared with the corresponding places of the encoded attachment file, and the diagnostic criteria are determined in the same case, but if not the same, the diagnostic criteria cannot be used as diagnostic criteria (S290). ).

The first to seventh diagnostic criteria are used to determine malicious codes by grouping at least two groups using regular expressions according to an administrator's selection.

3 is a flowchart illustrating a method for detecting malicious code in an attachment of an email according to an embodiment of the present invention.

In the client terminal, the attachment is encoded by the MIME protocol and transmitted to the mail server 300 (S300 and S310).

The mail server 300 transmits to the mail filtering server 400 to check whether malicious code exists in the email in which the attached file is encoded. In the mail filtering server 400, the file is attached to the email. Forwards the email to the malware detection device 500.

The malicious code detection apparatus 500 determines whether the attachment file of the received email is an executable file and, if the executable file is an executable compressed file, by using diagnostic criteria (S320 and S340).

By comparing the diagnosis criteria generated to determine whether the executable file with the predetermined range from the start position of the MZ header or PE header of the attachment file, it is possible to determine whether the executable file of the attachment file.

If the attachment is not an executable file as a result of the determination, the type of the attachment file is determined to read a diagnosis criterion according to the type of attachment file (S330).

When the attachment result is the executable file, it is determined whether the attached file is executable or compressed (S340). If the attachment is executable and compressed, a high probability of containing malicious code is transmitted, thereby transmitting a warning message to the manager server 600 (S360).

However, when the executable file is not executable and compressed, the diagnostic criteria for detecting malicious code included in the executable file is read (S350).

The read out diagnostic criteria are compared with the diagnosis ranges at the corresponding diagnosis positions of the attached file, respectively, to determine whether they are the same (S370 and S380).

If the comparison result of step S380 is the same, the malicious code is present in the attached file. If the comparison result is not identical, the malicious code is not present in the attachment file, and the email is returned to the mail server 300. In step S390 and S395, the email is transmitted to an arrival mail address.

As described in detail above, according to the method and apparatus for detecting malicious code in an attachment of an email of the present invention, the attachment file is stored because the presence of the malicious code is checked as encoded in the mail server without decoding the file attached to the email. The time required to check for malicious code can be significantly reduced as well as saving time for decoding, and the system resource consumption can be reduced.

In addition, by using the correct diagnostic value that is not affected by the header and body of the email, it is possible to apply the diagnostic value immediately after analyzing the malicious code, so that it can quickly respond to the malicious code.

In addition, malicious codes such as MyDoom, Bagel, and Japy worm variants included in non-English, German, Italian, and non-Hangul languages can be easily processed without any additional process, regardless of the header and body. There is an effect that it can be detected.

In addition, since the diagnosis criteria are different for each malicious code, the modified malicious code having the same name is recognized as the same malicious code according to the header and the body content in the existing product. All malicious code can be classified to produce accurate statistics.

Although the present invention has been described in detail with reference to preferred embodiments, the present invention is not limited to the above-described embodiments, and the technical field to which the present invention belongs without departing from the gist of the present invention as claimed in the following claims. Anyone skilled in the art will have the technical idea of the present invention to the extent that various modifications or changes are possible.

Claims (19)

A) sampling an email to which a file containing malicious code is attached among emails transmitted through a network; B) decoding the attachment of the email to search for the location of the malicious code and to set a diagnostic location and diagnostic range for the location; C) encoding said diagnostic range of said diagnostic location; D) comparing the encoded diagnostic range with a corresponding portion of the attached file of step A) to determine whether they are identical; And E) If the determination result of step D) is the same, the method comprising the step of setting the diagnosis location and the diagnosis range as a diagnostic criteria, characterized in that the detection of malicious code in the e-mail attachment file. The method of claim 1, wherein in step B), B-1) The attachment file of an e-mail characterized in that a predetermined diagnostic range is set from an MZ header or a PE header and an entry point of the attachment file to determine whether the attachment file is an executable file. How to detect malware. The method of claim 2, wherein in step B), B-2) When the attachment file is an executable file, a malicious range is set in the attachment file of the email, wherein a predetermined diagnostic range is set from an entry point of the attachment file to determine whether the executable file is compressed. Code detection method. The method of claim 3, wherein in step B), B-3) When the attachment is an executable file and is not executable, the predetermined diagnostic range is set from an entry point of each attachment point or a start point of a section in order to detect the malicious code. Malicious code detection method in the attachment of the email. The process according to claim 3 or 4, wherein in step B), B-4) When the attached file is an executable file and is not executable and compressed, setting a range in which a DLL or API is located from the import table of the attached file as the predetermined diagnostic range to detect the malicious code. Malicious code detection method in the attachment of the email. The process according to claim 3 or 4, wherein in step B), B-5) The method of detecting malicious code in an attachment of an e-mail, wherein when the attachment is an executable file and is executable and compressed, the diagnosis location and a diagnosis range are set in a code area of the attachment. The process according to claim 1 or 2, wherein in step B), B-6) If the attachment is not an executable file, a diagnosis position and a diagnosis range for searching for the type of the attachment are set, and the diagnosis position and the data area of the attachment are determined according to the type of the attachment. A method for detecting malware in an e-mail attachment characterized by determining a diagnostic scope. The diagnostic position according to any one of claims 1 to 3, wherein And a diagnostic location is set according to whether the attached file is executable or compressed or encrypted malicious code. The method of claim 8, wherein the diagnostic criteria is included in a filtering item of a proactive defense program. The method of claim 8, Malicious code detection method in an attached file characterized in that encoded by the MIME protocol I) sending an email to which the file encoded by the Multi-Purpose Internet Mail Extensions (MIME) protocol is attached to the mail device; Ii) determining whether the file attached to the e-mail is an executable file and determining whether the file is executable or compressed; And Iii) generating a warning message when the file is compressed to be executed, and checking whether malicious code exists in the file as a diagnostic criterion. The method of claim 11, wherein in step ii) Whether the encoded attachment is an executable file is determined by examining an MZ header or a PE header of the attachment, Whether or not the attachment is compressed is determined by examining a predetermined range from an entry point of the attachment. 13. The method according to claim 11 or 12, wherein step iii) Iii-1) if the attached file is not an executable file, searching for a type of the attached file; Iii-2) reading a diagnostic criterion according to the type of the attached file and comparing it with a corresponding portion of the attached file; And Iii-3) further comprising determining that malicious code exists in the attached file when the diagnosis criteria and the corresponding part of the attached file match, How to detect malware in attachments of emails. 13. The method according to claim 11 or 12, wherein step iii) Iii-a) if the attachment is an executable file and is executable compressed, reading out the diagnostic criteria set in the Code area of the attached file and comparing it with the corresponding portion of the executable compressed attachment; And Iv-b) if the diagnostic criteria and the corresponding part of the executable compressed attachment match, as the result of the comparison, further comprising the step of determining that malicious code exists in the attachment; How to detect malware in files. The method of claim 14, wherein when the attached file is an executable file and is not executable and compressed, the diagnostic criteria for detecting the malicious code are: A predetermined diagnostic range set from an entry point of the attachment file, a predetermined diagnostic range set from an entry point of a section of the attachment file, and a diagnosis range in which a DLL or API is located from an import table of the attachment file Malware detection method in the attachment of the email, characterized in that it comprises at least one. The method of claim 15, wherein the diagnostic criteria, And the diagnostic range is MIME protocol, and when the diagnosis range is one or more, the diagnostic criteria is described by a regular expression. An e-mail receiving unit for receiving an e-mail to which a file encoded by a Multi-Purpose Internet Mail Extensions (MIME) protocol is attached through a network; A diagnostic criterion manager for managing a diagnostic criterion for determining whether a malicious code exists in the attachment file of the e-mail; Attachment of the e-mail characterized in that it comprises a detection unit for determining the presence of malicious code in the attachment by reading the diagnostic criteria according to the attachment from the diagnostic criteria management unit and comparing the diagnostic criteria and the attachment file Malware detection device in files. 18. The method of claim 17, wherein the diagnostic criteria is determined whether the attachment is an executable file or not, and in the case of an executable file, a diagnosis location and a diagnostic range are determined according to whether or not the executable file is compressed. Malware detection device, characterized in that. 18. The apparatus of claim 17, wherein the email is encoded in a mail filtering device, and the mail filtering device transmits the file to the email receiving unit when a file is attached to the email.

Images