KR101005593B1 - Method and Apparatus for Providing Security Service Using Hook - Google Patents

Abstract

The method for providing a computer security service using a hook according to an embodiment of the present invention, which detects a hacking attempt by using a virtual input message flag or inputting time information at a kernel level in an input message, may be performed from an operating system. Monitoring a received input message using a hook; Determining whether a virtual input message flag is included in the input message; And detecting whether a macro hack is generated using the determination result.

Message, hook, hack, hack

Description

Method and apparatus for providing computer security service using hook {Method and Apparatus for Providing Security Service Using Hook}

The present invention relates to computer security, and more particularly to computer security using a hook.

Due to the development of communication technology and the popularization of high speed internet, many tasks that were performed offline have been performed online. Recently, the field of work that can be performed online has been expanded to provide game service using online. It is becoming.

In particular, as the increase in the provision of online game services has soared, various game hacking (nuclear) attempts have occurred. Representative types of these game hacks are the Macro Hack and the Speed Hack.

Macro Hack is an advanced behavior of Auto Mouse, which automatically delivers mouse input to the game and enables the game to run automatically without the user. This means passing the input to the game so that it can run repeatedly.

In addition, speed hacking means changing the response time of a game program by changing the time-related information of the computer so that the time of the computer becomes faster or slower than the actual time. Using this speed hack, the character's movement or attack speed in the game is several to hundreds of times faster, and the packet sent from the client to the server is also faster.

Unlike general hacking, such game hacking manipulates the memory of the game process to change specific data such as the character's stats and stamina, so that the balance between users may be broken and serious problems such as a heavy load on the game server may occur. Therefore, there is increasing interest in the concept and concept of game security for preventing such various game hacking.

For example, in order to prevent a malicious user from generating a virtual input by a macro hack, a method of blocking a call of the API through hooking an API used for generating a virtual input has been proposed.

However, in the above-described method, since the control DLLs must be injected into all APIs used for generating virtual inputs, memory and CPU usage are increased, and the speed of the computer is reduced, and collisions may occur when performing hooking for each API. There is a problem that can be.

In addition, the conventional method has a problem that it cannot block the macro hack attempt using a virtual input driver at the kernel level.

On the other hand, in the case of the speed hack is performed by hooking the time-related APIs as shown in Figure 1, if it is determined that the time-related API is hooked by determining whether the time-related APIs are hooked to prevent such speed hacking Although a method of determining that it is a speed hack has been proposed, there is a problem that it is not easy to determine whether a time-related API is hooked.

The present invention has been made in view of the above-described problem, and a method and apparatus for providing a computer security service using a hook capable of detecting a hacking attempt by using a time information at a kernel level or determining a virtual input message flag in an input message. It is technical problem to provide.

 Another object of the present invention is to provide a method and apparatus for providing a computer security service using a hook that can determine whether an input message is changed using a virtual input message generated by itself.

Another object of the present invention is to provide a method and apparatus for providing a computer security service using a hook that can reduce the load of a computer by installing a hook in a system message queue.

The present invention also provides a method and apparatus for providing a computer security service using a hook that can detect a hacking attempt by using a difference between a time at the kernel level obtained from an input message and a time at a user level obtained from a time-related API. It is another technical problem to provide.

Computer security service providing method using a hook according to an aspect of the present invention for achieving the above object comprises the steps of monitoring the input message received from the operating system (Operating System) using a hook (Hook); Determining whether a virtual input message flag is included in the input message; And detecting whether a macro hack is generated using the determination result.

According to an embodiment, in the detecting of the macro hacking occurrence, if the virtual input message flag is included in the input message, the input message is determined as a virtual input message of a first type, and the macro hack is determined to be generated. It is characterized by.

In this case, the first type of virtual input message may be a virtual input message generated using a user level window API (Application Programming Interface).

The method may further include filtering the input message when it is detected that the macro hack is generated.

In one embodiment, the hook is characterized in that it comprises a keyboard low level hook or a mouse low level hook.

On the other hand, the hook is characterized in that installed in the system message queue where all the messages are temporarily stored.

On the other hand, generating a virtual input to provide to the operating system; And determining whether to change the first input message by monitoring the first input message generated based on the virtual input through the hook.

In this case, in the determining whether the first input message is changed, when the virtual input message flag is not included in the first input message, the first input message is determined to be changed.

In one embodiment, generating first time information at a kernel level using the input message; And when the first time information is the same for each input message, determining the input message as a virtual input message of a second type, and determining that a macro hack is generated.

In this case, the virtual input message of the second type is generated using a virtual input driver at a kernel level, and the first time information is a difference value between a key down time and a key up time obtained from the input message. It is characterized by.

The method may further include detecting whether a speed hack is generated using first time information at a kernel level obtained from the input message and second time information at a user level obtained from a time-related API.

In this case, the first time information is a difference value between the key down time and the key up time at the kernel level, and the second time information is a difference value between the key down time and the key up time at the user level calculated using a time-related API. It is characterized by.

In the detecting of whether the speed nucleus is generated, the speed nucleus may be determined to be generated when a difference between the first time information and the second time information is greater than or equal to a threshold value.

Device for providing a computer security service using a hook according to an aspect of the present invention for achieving the above object comprises a hook management module for monitoring an input message received from the operating system using a hook; A macro nucleus detection module that detects whether or not a macro nucleus is generated by determining whether a virtual input message flag is included in the input message; And a filtering module for filtering the input message if it is detected that a macro hack has been generated.

According to the present invention, the macro hack attempted at the user level can be detected by determining whether a virtual input message flag exists in the input message, or the macro hack attempted at the kernel level can be detected using time information at the kernel level. This has the effect of easy implementation of computer security.

 In addition, the present invention can determine whether or not to change the input message by using the virtual input message generated by itself, the original attempt to conceal the attempt of the macro hack by deleting the virtual input message flag included in the input message. There is an effect that can be blocked.

In addition, the present invention has the effect that the load on the computer can be reduced by installing the hook in the system message queue.

In addition, the present invention can easily detect the speed hack attempt using only the difference between the time at the kernel level obtained from the input message and the time at the user level obtained from the time-related API. There is.

Prior to describing the present invention, an input message and a hook used in the present invention will be briefly described.

First, an input message refers to actual input generated by an input device such as a keyboard or a mouse, virtual input generated by software using an API (application programming interface) or a device driver, and virtual input generated using a virtual input driver. It means a message generated by the operating system based on the basis. Input messages generated by the operating system are temporarily stored in the system message queue, classified by process, and assigned to the thread message queue of each process. In an embodiment, the above-described input message may be a window input message. Hereinafter, for convenience of description, it is assumed that the input message is a window input message. However, this is just one example. It will not be limited.

Next, a hook is a system message handling mechanism that can be installed by an application to monitor the traffic of an input message. You can use this hook to check the contents of a Windows input message from the operating system. In one embodiment, the hook may be a window message hook for hooking a window message. Hereinafter, for convenience of explanation, the hook is assumed to be a window message hook. However, this hook is only one example and the hook is limited to a window message hook. It won't be.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram illustrating a computer security service providing apparatus according to an embodiment of the present invention applied to a computer system. The apparatus 300 for providing a computer security service according to an embodiment of the present invention is a macro hack or a speed hack in which a malicious user attempts to take advantage of a game by interworking with the computer system 302. Detects and blocks macro or speed hacks.

The computer security service providing apparatus 300 includes a window message hook management module 310, a macro nuclear detection module 320, and a filtering module 330 as shown.

First, the window message hook management module 310 installs a window message hook and monitors a window input message received from the operating system 340 using the installed window message hook.

In this case, the window message hook management module 310 may install a window message hook in the system message queue 350 in which all window messages transmitted from the operating system 340 are temporarily stored. In the present invention, the window message hook management module 310 to install the window message hook to the system message queue 350, the window message hook to install the window message hook in the thread message queue 360 is temporarily stored in each process window message If the window message hooks need to be installed for each thread message queue 360, the load of the system may be increased.

In one embodiment, the window message hook installed by the window message hook management module 310 may include a keyboard low level message hook or a mouse low level message hook.

The window message hook management module 310 may install a window message hook by calling a function as follows.

HHOOK SetWIndowsHookEx [Int IdHook , HOOKLPROC Ipfn , HINSTANCE hMod , DWORD dwThreadId ]

Here, IdHook refers to a window message hook type to be installed. In one embodiment, the hook type may include a keyboard low level message hook or a mouse low level message hook as described above. When the hook type is a keyboard low level message hook, the hook type may be set to "WH_KEYBOARD_LL", and when the hook type is a mouse low level message hook, the hook type may be set to "WH_MOUSE_LL".

Next, Ipfn means a pointer of the window message hook management module 310, and hMod means a handle of a DLL having the window message hook management module 310. In addition, dwThreadId refers to an identifier of a thread message queue associated with the window message hook management module 310. If the value is set to 0, the window message hook management module 310 may display all thread messages existing in the system. It indicates that the window message hook management module 310 associated with the queue.

Next, the macro hack detection module 320 detects whether the macro hack is attempted by determining whether the virtual input message flag is included in the window input message monitored by the window input message hook management module 310.

Here, the virtual input message flag refers to a flag that is inserted into the window input message when the operating system 340 generates the window input message based on the virtual input when the virtual input is generated using the window API at the user level.

Accordingly, the macro nucleus detection module 320 may determine whether the corresponding window input message is a virtual input message by determining whether the monitored window input message includes a virtual input message flag.

As a result, when the window input message includes the virtual input message flag, the macro hack detection module 320 determines that the window input message is a virtual input message, and that the macro hack is attempted by a malicious user. To judge.

Meanwhile, the window input message determined as not the virtual input message by the macro hack detection module 320 is allocated to the thread message queue 360 from the system message queue 350 and then processed by the message processing unit 410.

If the filtering module 330 determines that the macro hack is attempted by the macro hack detection module 320, the window input message is filtered from the system message queue 350 to the thread message queue 370 by filtering the window input message. Do not allow assignment.

As described above, when a malicious user generates a virtual input using a window API to attempt a macro hack, the present invention determines whether a virtual input message flag exists in a window input message generated based on the virtual input. By detecting a macro hack attempt, if a macro hack attempt is detected, the macro hack attempt is blocked by filtering the corresponding window input message.

In the above-described embodiment, the macro hack detection module 320 has been described as detecting the macro hack by determining whether the virtual input message flag is included in the window input message.

However, if the malicious user installs the window message hook again in the system message queue 350 after the window message hook management module 310 installs the window message hook in the system message queue 350, the malicious user has a window. The window input message may be monitored before the message hook management module 310 may allow a malicious user to delete the virtual input message flag from the window input message.

In this case, even if the window input message monitored by the window message hook management module 310 is a virtual input message, since the virtual input message flag has already been deleted from the window input message by the malicious user, the macro detection module 320 may be used. The window input message is not judged as a virtual input message, and thus the macro hack is determined not to be attempted.

In order to prevent this, the apparatus for providing a computer security service according to the present invention may further include a virtual input generation module 370 and a change determination module 380.

The virtual input generation module 370 generates a virtual input by itself and serves to provide the operating system 340 and the change determination module 380 to be described later. In one embodiment, the virtual input generation module 370 generates a virtual input by using a value that has no meaning, such as "OxFF", so that the virtual input does not affect the computer system. Can be generated.

Subsequently, when the operating system 340 generates the window input message based on the virtual input generated by the virtual input generation module 370, the operating system 340 inserts the virtual input message flag in the window input message like the general window input message.

The change determination module 380 determines whether the virtual input message flag is included in the window input message generated based on the virtual input by the virtual input generation module 370 among the window input messages transmitted from the operating system 340. To judge. As a result of determination, when the virtual input message flag is not included in the corresponding window input message, it is determined that the corresponding window input message is changed.

That is, although the window input message generated based on the virtual input generated by itself is a virtual input message, the virtual input message flag is included in the window input message generated based on the virtual input even though the virtual input message flag must be included. Not included means that the user artificially deleted the virtual input message flag from the window input message, which means that the malicious user altered the window input message using the window message hook.

Meanwhile, in the above-described embodiment, it has been described that the computer security service providing apparatus 300 blocks the attempted macro hack using a virtual input generated through the Windows API. However, macro hacks may be attempted using virtual input generated via the Windows API as well as virtual input generated using a virtual input driver at the kernel level. In this case, as described above, the macro hack cannot be detected by whether the window input message includes the virtual input message flag.

Accordingly, the present invention may further include a time information generation module 390 as shown to block the macro hack attempted using the virtual input generated by the virtual input driver at the kernel level.

The time information generation module 390 generates first time information at the kernel level using the window input message monitored by the window message hook management module 310. In an embodiment, the time information generation module 390 may calculate the first time information by using a difference value between the key down occurrence time and the key up occurrence time at the kernel level obtained from the window input message.

According to this embodiment, the macro nucleus detection module 320 determines whether the first time information generated by the time information generation module 390 is the same for each window input message. As a result of determination, when the first time information is the same for each window input message, the macro hack detection module 320 determines that the window input message is a virtual input message at the kernel level, and determines that the macro hack is generated.

Here, when the first time information is the same for each window input message, the macro nucleus detection module 320 determines that the window input message is a virtual input message in the case of a virtual input generated mechanically using a virtual input driver. This is because the first time information, which is the difference between the down occurrence time and the keyup occurrence time, is likely to be the same in all the window input messages.

Meanwhile, in the above-described embodiment, the computer security service providing apparatus 300 describes the attempted detection of a macro nucleus using a virtual input, but further includes a speed nucleus detection module 400 to hook the time-related API. Speed attempts can also be detected.

For speed nuclear detection, the time information generation module 390 described above generates not only the first time information at the kernel level obtained from the window input message, but also the second time information at the user level obtained from the time-related API. . Here, the time-related API may include GetTickCount, SetTimer, timeGetTime, etc., and the second time information may be generated using a difference value between the key down occurrence time and the key up occurrence time at the user level obtained from the time related API. Can be.

The speed nucleus detection module 400 detects whether a speed nucleus is generated by using the first time information and the second time information generated by the time information generation module 390 described above. Specifically, the speed nucleus detection module 400 determines that the speed nucleus is generated when the difference between the first time information and the second time information is greater than or equal to a threshold. That is, the difference between the first time information and the second time information more than the threshold value means that the malicious user has changed the time using a time-related API at the user level, and thus, the speed hack is determined to have occurred.

Hereinafter, a method of providing a computer security service using a hook according to the present invention will be described with reference to FIGS. 3 to 5.

3 is a flowchart showing a method of blocking a macro hack using a window message hook according to the first embodiment of the present invention. The macro hack blocking method shown in FIG. 3 shows a method of blocking a macro hack attempted by using a virtual input generated by a malicious user using the Windows API at the user level.

As shown, first install the window message hook (S400). In one embodiment, the window message hook may be installed in a system message queue in which all window messages are temporarily stored, and the installed window message hook may include a keyboard low level message hook or a mouse low level message hook.

Thereafter, it is determined whether the window message hook is normally installed (S405), and if normally installed, the window input message received from the operating system is monitored using the installed window message hook (S410).

Next, it is determined whether the virtual input message flag is included in the monitored window input message (S420).

As a result of determination, if the virtual input message flag is included in the window input message, it is determined that the macro hack is generated by determining the corresponding window input message as the virtual input message (S430).

If the virtual input message flag is not included in the window input message in S420, the corresponding window input message is determined not to be a virtual input message, and the corresponding window message is processed according to the message loop (S440).

On the other hand, although not shown in Figure 3 above, when the malicious user installs the window message hook again after the installation of the window message hook, the malicious user first monitors the window input message, the malicious user in the window input message By deleting the virtual input message flag, the macro hack can be concealed.

In order to prevent this, the present invention provides a process (not shown) for generating a virtual input by itself and providing it to the operating system after the above-described window message hook installation process, and a window input message generated based on the generated virtual input. The method may further include determining whether the window input message is changed by monitoring (not shown).

In this case, when determining whether to change the window input message, if the virtual input message flag is not included in the window input message generated based on the generated virtual input, the corresponding window input message may be determined to be changed.

4 is a flowchart showing a method of blocking a macro nucleus using a hook according to a second embodiment of the present invention. The macro hack blocking method shown in FIG. 4 shows a method of blocking a macro hack attempted using a virtual input generated by a malicious user using a virtual input driver at the kernel level.

As shown, first install the window message hook (S500). As in the first embodiment, the window message hook may be installed in a system message queue where all window messages are temporarily stored, and the installed window message hook may be a keyboard low level message hook or a mouse low level message hook.

Thereafter, it is determined whether the window message hook is normally installed (S505), and if normally installed, the window input message received from the operating system is monitored using the installed window message hook (S510).

Next, the first time information at the kernel level is generated using the monitored window input message (S520). In an embodiment, the first time information may be generated using a difference value between the key down time and the key up time obtained from the window input message.

Thereafter, it is determined whether the first time information generated in S520 is the same for each window input message (S530).

As a result of the determination, when the first time information is the same for each window input message, it is determined that the macro hack is generated by determining the corresponding window input message as a virtual input message (S540).

If the first time information for each window input message is not the same as the determination result of S530, it is determined that the corresponding window input message is not a virtual input message, and the corresponding window message is processed according to the message loop (S550).

On the other hand, also in the second embodiment, the same as in the first embodiment, after the above-described window message hook installation process for preventing a malicious user from attempting to conceal the macro hack by deleting the virtual input message flag from the window input message. Determining whether the window input message has been changed by monitoring the window input message generated by the virtual input by itself and providing the operating system to the operating system (not shown), and by monitoring the window input message generated based on the virtual input generated by itself. It may further include a process (not shown). Since this has been described in detail already, the detailed description will be omitted.

In the above-described embodiment, macro nucleus detection using the Windows API at the user level and macro nucleus detection using the virtual input driver at the kernel level are described as being performed separately. It may be performed.

That is, after performing the macro nuclear detection process using the Windows API at the user level, the macro nuclear detection process using the virtual input driver at the kernel level or the macro nuclear detection process using the virtual input driver at the kernel level is performed. You can then perform a macro hacking process using the Windows API at the user level.

5 is a flowchart showing a method of blocking a speed hack using a hook according to a third embodiment of the present invention.

As shown, first install the window message hook (S600). As in the first embodiment, the window message hook may be installed in a system message queue where all window messages are temporarily stored, and the installed window message hook may be a keyboard low level message hook or a mouse low level message hook.

Subsequently, it is determined whether the window message hook is normally installed (S605), and if normally installed, the window input message received from the operating system is monitored using the installed window message hook (S610).

Next, the first time information at the kernel level is generated using the monitored window input message, and the second time information at the user level is generated using the time-related API (S620).

In one embodiment, the first time information may be generated using a difference between a key down occurrence time and a key up occurrence time obtained from a window input message, and the second time information may be obtained using a time related API. The difference between the key down occurrence time and the key up occurrence time can be generated.

Thereafter, a difference value between the first time information and the second time information is calculated (S630), and it is determined whether the calculated difference value is greater than or equal to a threshold value (S640).

As a result, if the calculated difference value is greater than or equal to the threshold value, it is determined that the speed hack is attempted, and the corresponding window input message is filtered (S650). If the calculated difference value is less than the threshold value, the corresponding window input message is processed according to the message loop ( S660).

The computer security service providing method described above may be embodied in the form of program instructions that can be executed by various computer means and recorded in a computer-readable recording medium. In this case, the computer-readable recording medium may include program instructions, data files, data structures, and the like, alone or in combination. On the other hand, the program instructions recorded on the recording medium may be those specially designed and configured for the present invention or may be available to those skilled in the art of computer software.

The computer-readable recording medium includes a magnetic recording medium such as a magnetic medium such as a hard disk, a floppy disk and a magnetic tape, an optical medium such as a CD-ROM and a DVD, a magnetic disk such as a floppy disk, A magneto-optical media, and a hardware device specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. The recording medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, or the like.

In addition, program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

On the other hand, those skilled in the art will understand that the present invention described above can be implemented in other specific forms without changing the technical spirit or essential features.

Therefore, it is to be understood that the embodiments described above are exemplary in all respects and not restrictive. The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts should be construed as being included in the scope of the present invention. do.

1 is a view showing a speed nuclear blocking method according to the prior art.

2 is a schematic block diagram of an apparatus for providing a computer security service according to an embodiment of the present invention.

3 is a flowchart showing a macronuclear blocking method according to the first embodiment of the present invention.

4 is a flowchart showing a macronuclear blocking method according to a second embodiment of the present invention.

5 is a flowchart showing a speed nucleus blocking method according to a third embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

310: window message hook management module 320: macro nuclear detection module

330: filtering module 370: virtual input generation module

380: change determination module 390: time information generation module

400: speed nuclear detection module

Claims (26)

Monitoring an input message received from an operating system using a hook; Determining whether a virtual input message flag is included in the input message; And A method of providing a computer security service using a hook, comprising detecting whether a macro hack is generated using the determination result. The method of claim 1, wherein in the macro nucleus detection step, And if the virtual input message flag is included in the input message, determine the input message as a virtual input message of a first type, and determine that a macro hack has been generated. The method of claim 2, wherein the first type of virtual input message is a virtual input message generated using a user level application programming interface (API). The method of claim 1, If it is detected that a macro hack has been generated, filtering the input message further comprising providing a computer security service using a hook. The method of claim 1, And the hook comprises a keyboard low level hook or a mouse low level hook. The method of claim 1, The hook is a computer security service providing method using a hook, characterized in that installed in the system message queue where all messages are temporarily stored. The method of claim 1, Generating and providing a virtual input to the operating system; And And determining whether to change the first input message by monitoring the first input message generated based on the virtual input through the hook. The method of claim 7, wherein in the determining whether or not to change the first message, And when the virtual input message flag is not included in the first message, determining that the first message has been changed. The method of claim 1, Generating first time information at a kernel level using the input message; If the first time information is the same for each input message, determining the input message as a virtual input message of a second type, and determining that a macro hack has been generated, further comprising a computer security service using a hook. How to Provide. 10. The method of claim 9, And the second type of virtual input message is generated using a virtual input driver at a kernel level. 10. The method of claim 9, And wherein the first time information is a difference value between a key down time and a key up time obtained from the input message. The method of claim 1, Detecting whether a speed hack has occurred using the first time information at the kernel level obtained from the input message and the second time information at the user level obtained from a time-related API. Computer security service providing method using. The method of claim 12, The first time information is a difference value between a key down time and a key up time at a kernel level, and the second time information is a difference value between a key down time and a key up time at a user level calculated using a time-related API. Computer security service providing method using a hook. The method of claim 12, wherein the detecting of the speed nucleus has occurred. And determining that the speed hack is generated when the difference between the first time information and the second time information is greater than or equal to a threshold value. A recording medium having recorded thereon a computer readable program for performing any one of claims 1 to 14. A hook management module for monitoring an input message received from an operating system using a hook; A macro hack detection module for detecting whether a macro hack is generated by determining whether the input message includes a virtual input message flag; And And a filtering module for filtering the input message when it is detected that a macro hack has been generated. The method of claim 16, When the macro hack detection module includes the virtual input message flag in the input message, the macro hack detection module determines the input message as a virtual input message of a first type, and determines that the macro hack is generated. Device for providing computer security services. The method of claim 17, And the first type of virtual input message is a virtual input message generated through a user level API. The method of claim 16, And the hook comprises a keyboard low level hook or a mouse low level hook. The method of claim 16, The hook management module is a device for providing a computer security service using a hook, characterized in that for installing the hook in the system message queue where all messages transmitted from the operating system is temporarily stored. The method of claim 16, A virtual input generator for generating a virtual input and providing the virtual input to the operating system; And And a change determination module for determining that the first input message is changed when the first input message generated based on the virtual input does not include the virtual input message flag. Service provision device. The method of claim 16, A time information generation module for generating first time information at a kernel level by using the input message; The macro nucleus detection module, when the first time information is the same for each input message, determines the input message as a virtual input message of a second type, and determines that a macro hack has been generated. Security service provision device. The method of claim 22, And a virtual input message of the second type is generated using a virtual input driver. The method of claim 16, A time information generation module for generating first time information at a kernel level obtained from the first input message and second time information at a user level obtained from a time related API; And And a speed nucleus detection module detecting whether a speed nucleus has occurred using the first time information and the second time information. The method of claim 24, The time information calculating module calculates the first time information by using a difference value between a key down occurrence time and a key up occurrence time at a kernel level, and calculates a key down occurrence time at a user level obtained from a time-related API. And generating the second time information by using a difference value between key-up generation times. The method of claim 24, And the speed nucleus detection module determines that the speed nucleus is generated when a difference between the first time information and the second time information is greater than or equal to a threshold value.

Images