KR100870140B1 - Detection Apparatus and Method of Embedded Malicious Code in File - Google Patents

Abstract

The present invention relates to an apparatus and a method for detecting a file hidden by malicious code by checking an abnormality of a process operating in a file processing process, the configuration of which is statically analyzed whether an executable file format is included in a file to be scanned. analysis) an execution code detection module to search through, a support program search module searching for a support program according to the extension of the inspection target file and providing a corresponding process name and an execution path, and newly generated by monitoring the searched support process Abnormal process detection module that determines the normal status of the parent process for the process using the tree structure of the process, and abnormal process forced termination module forcibly terminating the newly created process when the target file is determined to be a malicious file All abnormal processes by including It can prevent the execution of the source.

Malware, Office Documents

Description

Detection Apparatus and Method of Embedded Malicious Code in File}

1 is an overall configuration diagram of a device for detecting hidden files according to the present invention,

2 is a flowchart illustrating a method of detecting a hidden file in a malicious code according to the present invention.

<Description of Major Symbols in Drawing>

10. User Interface 101. Execution Code Detection Module

102. Support Program Search Module 103. Abnormal Process Detection Module

104. Normal process DB 105. Abnormal process forced termination module

106. Display unit

The present invention relates to a method for detecting a hidden file by a malicious code executing an arbitrary executable file format by using a vulnerability in processing a file format supported by a specific program (doc, ppt, xls, hwp, wmf, etc.). In more detail, the present invention relates to an apparatus and a method for detecting a hidden file by checking whether a malicious code is hidden by a process operating in a file processing process.

Executes arbitrary code hidden in a file using vulnerabilities of programs that support certain extensions such as doc-MS Office Word, ppt-MS Office PowerPoint, xls-MS Office Excel, hwp-Hangul, wmf-MS Windows Media Player A lot of attacks are being made as a technique.

This technique is not only a threat unknown to general users, but also has a significant effect when malicious files are spread to hidden files such as email, messenger, and peer-to-peer. Do.

As a method of detecting an attack using the MS Office suite among the attacks of such a technique, there is a Korean Patent Application No. 10-2005-0044241, "Detecting Office Documents with Hidden Malicious Code." This patent proposes a method for detecting malicious codes using vulnerabilities that execute hidden malware using macro functions of commonly used Microsoft Office documents.

As described above, the prior arts have been technologies for detecting malicious codes by pattern matching or response to attacks that execute specific malicious codes using only macros.

However, this method has a problem that cannot be detected if the hidden malicious code is encoded and the vulnerability is not used to execute arbitrary code using a macro.

An object of the present invention for solving the above problems of the prior art is not only a macro but also all programs can cope with an attack using a vulnerability in the process of processing the file format supported by them, the file is not a basic pattern matching technique The present invention relates to a hidden file detection device and a method for hiding malicious code that can fundamentally prevent execution of all abnormal processes operating in a processing process.

Hidden file detection apparatus according to the present invention is an executable code detection module for searching through the static analysis (static analysis) whether the executable file format included in the scan target file, and the support program according to the extension of the scan target file Supporting program search module that searches and informs the corresponding process name and execution path, and abnormal process that determines whether the parent process for the new process generated by monitoring the searched support process is normal by using the tree structure of the process And a detection module and an abnormal process forced termination module forcibly terminating the generated new process when the file to be inspected is determined to be a malicious file.

On the other hand, the malicious code hidden file detection method according to the present invention comprises the steps of performing a static analysis (static analysis) to determine whether the executable file format exists in the file to be scanned, the result of the static analysis, the file to be scanned If the executable file format MZ header and PE header does not exist, step 2 of monitoring whether a new process is generated by executing a support program of the file to be inspected; and according to the monitoring result, the new process for the file to be inspected. Characterized in that it comprises three steps to determine whether the normal.

In addition, the method of detecting a file hidden in the malicious code may further include four steps of determining that the scan target file is a malicious file and forcibly terminating the new process if the new process is determined to be an abnormal process in step 3. It is done.

Also, the second step may include steps 2-1 of searching for a support program supporting the inspection target file, steps 2-2 of executing the inspection target file with the support program, and a new process in execution of the support program. Characterized in that it comprises a 2-3 steps to monitor whether it is generated.

In addition, in step 3, as a result of the monitoring in step 2, step 3-1 of checking whether the generated parent process of the new process is a process of a support program using a tree structure of the process, and the parent process is a support program. And 3-3 of searching whether there is a new process name generated in the normal process DB, and 3-3 of determining if the generated new process name is not present in the normal process DB. It features.

Hereinafter, the file detection apparatus 100 in which malicious code is hidden will be described in detail with reference to FIG. 1.

1 illustrates a configuration of a file detection apparatus 100 for hiding malicious code according to the present invention. The file detection apparatus 100 for hiding malicious code includes an execution code detection module 101, a support program search module 102, The abnormal process detection module 103, the normal process DB 104, abnormal process forced termination module 105 and the display unit 106.

According to the present invention, the malicious code hidden file detection device 100 receives a scan target file from the user through a user interface (10), whether the malicious code is included in the received scan target file The test results are outputted.

Specifically, the execution code detection module 101 of the file detection apparatus 100 in which the malicious code is hidden performs a static analysis on a scan target file received through a user interface 10. Detect whether the executable file formats MZ Header and PE Header are included.

As a result of detection, if the file to be scanned contains MZ Header and PE Header, which are executable file formats, it is determined that the file to be scanned is a hidden file, that is, a malicious file. Try searching for the program.

In detail, the executable code detection module 101 finds an executable file format for the target file to be scanned, and checks the DOS MZ header-PE header part to see if the corresponding string is in accordance with the PE format specification for the general PE file structure. If the above two conditions are met, the malicious code for the file is detected as embedded.

Here, PE stands for Portable Executable, which is the basic file format of Win32. "Portable Executable" means it can be used in common under the win32 platform. All Win32 executables (except VxD and 16-bit DLLs) use the PE file format.

On the other hand, if malicious code is not detected in the scanned file, the program that supports the scanned file type is searched.

The support program search module 102 searches for a support program corresponding to the extension of the file to be scanned and informs the corresponding process name and execution path. For example, if the file to be scanned has a doc extension, it will tell you the process name and execution path of the resulting MS Office Word when you search for support programs.

The abnormal process detection module 103 searches and compares the normal process DB 104 to determine whether the parent process of the new process, which is generated by monitoring the process executing the file to be inspected, is a support program and a normal process.

Here, the normal process DB 104 defines and stores a process normally generated by the program in advance.

As a result of the search, if the parent process is not detected in the normal process DB 104, the new process is an abnormal process, and thus, the scan target file is determined to be a malicious file. Output through the display unit 106.

Determination of abnormal process of abnormal process detection module 103 is that in Win32, all processes are tree structure, so process is expected to be abnormal process through relationship between parent process and child process. Judge. Therefore, if an abnormal process is created while executing a program that supports the file type to be scanned, it is determined to be a malicious file.

Abnormal process forced termination module 105, when it is determined that the inspection target file is a malicious file, forcibly terminates the generated new process, and outputs through the display unit 106 that the inspection target file is a malicious file.

Next, a process of detecting a file hidden by the malicious code in the file detection apparatus 100 in which the malicious code is hidden as described above will be described in detail with reference to FIG. 2.

2 is a flowchart illustrating a process of detecting a hidden file, ie, a malicious file, by a malicious code according to the present invention, and is performed in the following steps.

When the device and the program are started by the user 201 and the user inputs the file to be inspected through the user interface 10 (202), the execution code detection module 101 performs the test object through static analysis. In operation 203, the MZ header is checked in the file.

If the MZ Header exists in the inspection result 203 and the file to be inspected, it is checked whether the PE Header exists (204). If the PE header exists inside the inspection target file, the inspection target file is determined to be a hidden file in the malicious code (205), the result is output (215), and the device and the program are terminated (216).

If there is no MZ Header in the inspection result 203 and the inspection target file, the support program search module 102 searches for the support program supporting the inspection target file (206). The abnormal process detection module 103 starts process monitoring for the support program (207) and executes the inspection target file with the searched support program (208).

In process monitoring 207, check whether a new process has been created (209), and when the result of check (209), a new process is created, whether the parent process of the created process is a process of the support program using the tree structure of the process. Check 210.

As a result of the check 210, if the parent process of the generated process is a process of the support program, it is searched whether the generated new process name exists in the normal process DB 104 (211).

If the newly created process name does not exist in the normal process DB 104, the search result 211 determines that it is a malicious file (212), and terminates the new process that is an abnormal process in the abnormal process forced termination module 105 (213). After outputting 215 that the scan target file is a malicious file, the device and the program are terminated (216). Otherwise, process monitoring 209 is repeated until the end of the support program.

If the check result 209 does not generate a new process until the support program ends, or if the new process generated in the search result 211 is normal, it is determined to be a normal file and outputs the result (215). The program ends (216).

Although the present invention has been described in more detail with reference to some embodiments, the present invention is not necessarily limited to these embodiments, and various modifications can be made without departing from the spirit of the present invention.

As described above, the apparatus and method for detecting malicious code hidden files according to the present invention can detect unknown malicious codes for hidden files by detecting abnormal files generated according to whether a subprocess is executed as well as executable files. In addition, there is an effect that can detect all the malicious files using the vulnerability in the process of processing the file format supported by a particular program.

Claims (11)

delete delete delete An executable code detection module for searching through static analysis whether the executable file format is included in the inspection target file; A support program search module for searching for a support program according to the extension of the inspection target file and indicating a corresponding process and an execution path; It is determined whether the other process exists in the normal process DB by using a tree structure in which a relationship between a parent process and a child process is defined for another process generated while monitoring the support program. An abnormal process detection module for determining whether the other process is normal; And If the other process is determined to be an abnormal process in the abnormal process detection module, the abnormal process forced termination module for determining that the scan target file is a hidden file and forcibly terminating the other process. File detection device hidden malicious code, characterized in that comprises a. Performing a static analysis to determine whether an executable file format exists in the file to be inspected; If the executable file format MZ header and PE header are not present in the inspection target file as a result of the static analysis, the support program of the inspection target file is executed, and whether the assistance program generates another process is monitored. step; And Determining whether the other process is normal for the inspection target file according to the monitoring result; In the third step, as a result of the monitoring in the second step, by using a tree structure in which a relationship between a parent process and a child process is defined, it is determined whether a parent process of the other process is a process of a support program. Step 3-1; Step 3-2, if the parent process is a supporting program, searching for a presence of the other process in a normal process DB; And 3-3 steps of determining that the process is an abnormal process if the other process does not exist in the normal process DB. The method of claim 5, Wherein the static analysis is performed by checking whether an executable file format MZ header and a PE header exist in the file to be scanned. The method of claim 6, As a result of the static analysis, when the executable file format MZ header and the PE header exist in the inspection target file, the malicious code comprises determining that the inspection target file is a file including malicious code and outputting the result. How to detect hidden files. The method of claim 5, Step 2-1 includes searching for a support program supporting the file to be scanned using the extension of the file to be examined; Step 2-2 of executing the inspection target file with the support program; And Step 2-3 of monitoring whether the other process is generated in the execution of the support program Hidden file detection method characterized in that the malicious code is made, including. delete The method of claim 5, In the third step, if the parent process of the other process is found in the normal process DB, the third process outputs the file to be inspected as a normal file and ends after outputting the file as a normal file. Detection method. The method of claim 5, In the method of detecting a file in which the malicious code is hidden, if the other process is determined to be an abnormal process in step 3, the file to be detected is determined to be a malicious file and forced to terminate the other process. Hidden file detection method characterized in that it further comprises a.

Images