KR101013417B1 - Method for detecting hidden malicious code by using network information - Google Patents

Abstract

A method for detecting concealed malware using network information includes driving an application for obtaining network information at the user level, and driving a hooking driver for hooking a function of the TCPIP driver at the kernel level and the network by the application. Calling an information acquisition function and acquiring network information, acquiring the original network information by hooking a function of the TCPIP driver, and comparing the network information obtained by the application with the original network information obtained by hooking a function of the TCPIP driver. If the network information acquired by the application run at the user level and the original network information obtained by hooking the function of the TCPIP driver are different from each other, the original network information obtained by hooking the function of the TCPIP driver is concealed. It is configured to include an extracting process and the port of the infection.

Stealth Malware, Network, TCPIP

Description

How to detect concealed malware using network information {METHOD FOR DETECTING HIDDEN MALICIOUS CODE BY USING NETWORK INFORMATION}

The present invention relates to a method for detecting concealed malware, and more particularly, to a method for detecting concealed malware by comparing network information obtained at the user level with network information obtained by hooking the TCPIP driver at the kernel level. will be.

The rapid development of computers and the Internet has brought great change and convenience in almost all human activities, including economy, society, and culture. Due to the development of the Internet, all aspects of human life are changing at a very rapid pace. Now you can view banking business even if you do not visit the bank directly, you can trade all stocks with a click of a mouse in the room, and you can freely shop online in front of your computer with a credit card. Correspondence and information can be delivered.

However, behind the remarkable development of computers and the Internet, there are many cases of being damaged by computer viruses and malware. These viruses or malware can invade specific servers or computer systems, paralyze others' systems, cause serious damage to information owned by others, or extract important information.

Conventionally, in order to defend against such malicious codes, a method of preventing intrusion of malicious codes by tracking system resources used by malicious codes has been used. Recently, malicious codes that cannot be detected only by tracking system resources have appeared.

Among the various computer-related malware, malicious code with the function of concealing the use of system resources such as process, registry, file, network, etc. is called concealed malware. In particular, the concealed malicious code hides its own process so that the user cannot know whether the malicious code is infected, so as to collect personal information of the infected system user or send a large amount of spam mail to a specific server.

Until now, programs that detect malicious code information such as files and registries and repair computers infected with malware have been widely known, but measures to detect and block malicious codes when they conceal their processes and network use are It does not exist yet.

The present invention has been made to solve the above problems, and has an object of the present invention to provide a method for fundamentally detecting concealed malware by blocking network information.

The objects of the present invention are not limited to the above-mentioned objects, and other objects that are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, a method of detecting concealed malware using network information according to an embodiment of the present invention includes the steps of running an application for obtaining network information at a user level and a TCPIP driver at a kernel level. Driving a hooking driver that hooks a function, calling a network information acquisition function by an application, acquiring network information, hooking a function of the TCPIP driver, acquiring the original network information, and an application driven at the user level. Comparing the network information obtained by hooking a function of the TCPIP driver with the original network information obtained by hooking a function of the TCPIP driver, and the network information obtained by hooking a function of the TCPIP driver with the network information obtained by an application driven at a user level. book If different, it is configured to include an extracting process and the port of the concealed type malicious code via the network source information obtained by the function of the hooking TCPIP driver.

Preferably, the method further comprises blocking the process of the extracted stealth malware.

More preferably, the method further comprises blocking the port of the extracted stealth malware.

More preferably, the application may call the GetTcpTable or GetExtendedTcpTable function to obtain the network information.

More preferably, the application may call the ZwDeviceIoControlFile function to obtain the network information.

More preferably, the hooking driver is characterized by hooking the IofCompleteRequest or NT IofCompleteRequest function of the TCPIP driver.

More preferably, the hooking driver is characterized by hooking a TCPIP filter driver or a TCPIP hook driver on the upper end of the TCPIP driver.

According to the method for detecting the concealed malware using the network information of the present invention as described above has the following effects.

According to the present invention, even if the malicious code invades the system, even if the malicious code has a function of concealing the use of system resources such as a process, a registry, a file, and a network, the malware can be detected at its source. In addition, since the malicious code is diagnosed and treated by collecting and analyzing the process ID and the module information of the concealed malicious code, the damage of the system can be minimized by blocking the spread of the malicious code.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

It will be appreciated that the combination of each block in the accompanying block diagram and each step in the flowchart may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram. Computer program instructions It can also be mounted on a computer or other programmable data processing equipment, so a series of operating steps are performed on the computer or other programmable data processing equipment to create a computer-implemented process to perform the computer or other programmable data processing equipment. It is also possible for the instructions to provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative embodiments, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a conceptual diagram showing the appearance of a computer operating system for performing the concealed malware detection method according to an embodiment of the present invention.

Computer operating systems running computers can be divided into kernel level and user level. The kernel level is an integral part of the computer's operating system that resides in the main memory of the computer. It is a module that creates special processes, process monitors, environment exchanges between processes, and new processes to handle system initialization and interrupts. And the like. In addition, drivers are located that enable the computer to connect to the network and perform communications. On the other hand, at the user level, various application programs are run in the computer operating system, and processes and interrupts processed at the kernel level are delivered to the application program. At this time, the processes and interrupts delivered to the application program are processed in various forms and delivered to the application program, which may be delivered in the form of a message by a message queue, or may not be processed in the form of a message. It can also be delivered directly.

If a stealth malware enters the computer, the stealth malware will hide TCPIP hooking for the TCPIP driver 104 at the kernel level, as shown in Figure 1, to conceal its process and network usage. The driver or the TCPIP filter driver 103 is driven. The TCPIP hooking (filter) driver 103 may be a driver used to check IRP_MJ_DEVICE_CONTROL and IRP_MJ_INTERNAL_DEVICE_CONTROL IOs transmitted from the Microsoft Windows operating system to the TCPIP driver. If the TCP_MIB_ADDRTABLE_ENTRY_EX_ID and the TCP_MIB_ADDRTABLE_ENTRY_ID are performed among IOs generated by IRP_MJ_DEVICE_CONTORL and IRP_MJ_INTERNAL_DEVICE_CONTROL, the TCPIP driver 104 delivers network information. At this time, the TCPIP hooking (filter) driver 103 running the concealed malicious code identifies the above IO request and modulates the network information transmitted from the TCPIP driver 104 after the TCPIP driver 104 completes the IO. To conceal ports and processes of concealed malware.

On the other hand, in order to detect this type of concealed malicious code, in the embodiment of the present invention, the hooking driver 105 which runs an application 101 for obtaining network information at the user level and hooks a function of the TCPIP driver at the kernel level. Drive.

First, an application for obtaining network information at the user level calls the network information acquisition WIN32 function to check whether the malicious code invading the system has altered the network information to conceal its network information. If network information is modified by certain malicious code, the modified data is obtained. The modulated data is then used to determine whether it is modulated.

In this case, the function used to obtain network information may be a GetTcpTable function or a GetExtendedTcpTable function. GetTcpTable is a function to get IP / Port network session information of Local / Remote. GetExtendedTcpTable is a function to get IP / Port of Local / Remote and Process ID that owns the session. Here, the network information means information about the network connection provided by the TCPIP driver 104, for example, network protocol, local IP address and port, remote IP address and port, network status, network process ID, and the like. It may include.

On the other hand, Iphlpapi.dll 102 is a DLL that exports GetTcpTable or GetExtendedTcpTable functions in the Windows operating system. When a request for network information is made at the user level, the kernel level ZwDeviceIoControlFile function is called. At this time, the ZwDeviceIoControlFile function may be hooked by a concealed malicious code. The concealed malicious code executes ZwDeviceIoControlFile and then, as described above, hooks and modulates the TCIP data transmitted from the TCPIP driver 104 by the TCPIP hooking driver 103 to conceal the ports and processes used by the malware. do.

On the other hand, in the embodiment of the present invention, the hooking driver 105 for hooking a function of the TCPIP driver 104 at the kernel level is driven. In other words, the hidden malicious code hooks a function of the TCPIP driver 104 so as to obtain network information in a step before delivering the modulated network to the user level through the TCPIP hooking driver 103. The function of the TCPIP driver 104 hooking at this time may be IofCompleteRequest or NT IofCompleteRequest of the TCPIP driver 104. The IofCompleteRequest function is an NT Export function that is called first when the IO of the TCPIP driver 104 is completed, and the TCPIP driver 104 imports the function. The hooking driver 105 stores the original network information obtained from the TCPIP driver 104.

In order to check whether the concealed malicious code is invaded, the original network information stored by the hooking driver 105 and the network information obtained by the application 101 are compared with each other. If the two network information is different from each other, it is determined that the concealed malicious code intrudes and modifies the network information, and the process and port of the concealed malicious code are extracted from the original network information acquired by the hooking driver 105. .

Hereinafter, with reference to FIG. 2 to be described sequentially the method of detecting the concealed malware according to an embodiment of the present invention.

2 is a flowchart illustrating a concealed malware detection method according to an embodiment of the present invention.

First, the application 101 for obtaining network information at the user level is driven (S201). In addition, at the kernel level, the hooking driver 105 for hooking a function of the TCPIP driver 104 is driven (S202).

Thereafter, the network information acquisition function is called by the application 101 driven at the user level to obtain network information (S203). At this time, the application 101 driven at the user level calls the GetTcpTable or GetExtendedTcpTable function to obtain network information.

In addition, at the kernel level, the hooking driver 105 for hooking the function of the TCPIP driver 104 acquires the original network information by hooking the function of the TCPIP driver 104 (S204). At this time, the hooking driver 105 hooks the IofCompleteRequest or NT IofCompleteRequest function of the TCPIP driver 104.

Thereafter, the network information obtained by the application 101 driven at the user level and the original network information obtained by hooking a function of the TCPIP driver 104 are compared with each other (S205).

If the network information obtained by the application 101 driven at the user level and the original network information obtained by hooking the function of the TCPIP driver 104 are different from each other, the function obtained by hooking the function of the TCPIP driver 104 is obtained. The process and the port of the concealed malware are extracted through the original network information (S206).

After extraction, it can block the malicious code's process or port to prevent damage by malicious code.

The present invention can be embodied as computer readable codes on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CO-ROM, magnetic tape, floppy disks, optical data storage devices, and the like, which may also be implemented in the form of carrier waves (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

Although the embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. I can understand that. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

1 is a conceptual diagram showing the appearance of a computer operating system for performing the concealed malware detection method according to an embodiment of the present invention.

2 is a flowchart illustrating a concealed malware detection method according to an embodiment of the present invention.

Claims (8)

In the method for detecting concealed malware using network information, Running an application for obtaining network information at a user level; Driving a hooking driver that hooks a function of the TCPIP driver at the kernel level; Calling a network information acquisition function by the application and obtaining network information; Hooking a function of the TCPIP driver to obtain original network information; Comparing the network information obtained by the application with the original network information; And  If the network information obtained by the application and the original network information are different from each other, extracting a process and a port of a concealed malicious code through the original network information; Stealth malware detection method. The method of claim 1, Blocking the process of the extracted stealth malicious code further comprising: Stealth malware detection method. The method of claim 1, Blocking the port of the extracted stealth malicious code further comprising: Stealth malware detection method. The method of claim 1, The application may obtain the network information by calling a GetTcpTable or GetExtendedTcpTable function. Stealth malware detection method. The method of claim 1, The application calls the ZwDeviceIoControlFile function to obtain the network information Stealth malware detection method. The method of claim 1, The hooking driver hooks the IofCompleteRequest or NT IofCompleteRequest function of the TCPIP driver. Stealth malware detection method. The method of claim 1, The hooking driver hooks a TCPIP filter driver or a TCPIP hook driver of an upper stage of the TCPIP driver. Stealth malware detection method. A computer readable recording medium having recorded thereon a computer program for performing the method of claim 1 on a computer.

Images