KR101064940B1 - Method and Apparatus for Longtime-Maintaining Reexamination Protecting Information for Malicious Code, and Computer Readable Recording Medium Containing Program thereof - Google Patents

Abstract

According to the present invention, even when the signature list of the malware diagnosis engine is updated, it is possible to maintain rescan prevention information on a file that has already been scanned according to a tag (TAG) verification result, thereby increasing the speed of diagnosis. It is about long time operation technology. According to an aspect of the present invention, a rescan prevention list including a first tag which is a tag TAG of the file is generated for at least one file that has been scanned for infection by a diagnostic engine, and at least one signature of the diagnostic engine is generated. Generate a signature list including a second tag that is a tag of the signature, compare a second tag of a signature added when the signature list is updated, and a first tag of each file of the re-examination prevention list; When the first tag and the second tag is the same, it provides a long time operation method of the malicious code re-scan prevention information for deleting the file from the re-scan prevention list. According to the present invention, defense against malicious code is strengthened, and diagnostic speed is improved by selectively maintaining rescan prevention information even when the signature of the diagnostic engine is updated.

Malware, Signatures, Updates, Anti-Rescan Information, White Lists, Tags

Description

Method and Apparatus for Longtime-Maintaining Reexamination Protecting Information for Malicious Code, and Computer Readable Recording Medium Containing Program about}

The present invention relates to a computer-readable recording medium having recorded thereon a method, a device and a program for executing the method for preventing malicious code rescanning. Specifically, even if the signature list of the malware diagnosis engine is updated, it is possible to maintain rescan prevention information on a file that has already been scanned according to a tag (TAG) verification result, thereby increasing the speed of diagnosis. It relates to a long time operation technology.

Today's computer users face the threat of various kinds of malicious code, including viruses. Many users are using programs to diagnose and repair malware infections in order to protect their systems from these threats.

The malware diagnosis engine resides in memory and performs real-time monitoring or performs basic or detailed inspection of files stored in the system by user's command. In this case, if you actually check all the files every time the diagnosis is performed, the diagnosis time becomes considerably longer. Therefore, diagnostic engines increase the speed of diagnosis in general tests by reducing the number of unnecessary retests by operating retest prevention information, also called a white list. As such, preventing rescanning of scanned files has become an important factor in securing diagnostic performance.

Conventional rescanning techniques have relied heavily on external file-related information such as file name, size, file creation or modification date. The rescan prevention information and this information in the file system or its hash value are compared to determine whether to check the file. If there is no change in this information, it is skipped without retesting and retesting only if there is a change in this information. However, some viruses do not increase the size of the infected file, but instead return the file creation or modification date back to the pre-infection date. According to the prior art, even though a file infected with such a virus should be deleted from the rescan protection information, the file remains in the rescan protection information and thus is excluded from diagnosis of the engine.

In addition, the prior art has initialized the rescan prevention information when the diagnostic engine is updated in preparation for the possibility that the sample included in the rescan prevention information is a new malicious code. The rescan protection information for the files to be skipped is created in the user's system, so if there is new malicious code or undiagnosed samples that were not known at the time of the rescanning information creation, the malicious code will be turned into a normal file. Because. Therefore, in the prior art, it is necessary to reset such rescanning prevention information when updating signatures or diagnostic engines, which are information required for malicious code diagnosis. In recent years, the update cycle of the diagnosis engine is gradually shortened, so that the update is performed more than once a day. However, there is a problem that the diagnostic performance is deteriorated due to frequent initialization of the rescan prevention information.

The present invention has been made to solve this problem, and aims to strengthen the system defense by adding a signal against a virus that does not change the size or modification date of the infected file by including important information of the actual file as a tag. do.

In addition, it is an object of the present invention to improve diagnostic performance by selectively maintaining the retest prevention information without initializing each time even when updating the signature of the diagnostic engine.

In order to achieve the above object, a first aspect of the present invention is to generate a rescan prevention list including a first tag that is a tag TAG of the file for one or more files that have been scanned for infection by a diagnostic engine, Generate a signature list including a second tag that is a tag of the signature for one or more signatures of a diagnostic engine, and add a second tag of the signature added when the signature list is updated and a first tag of each file of the re-examination prevention list Compared to, if the first tag and the second tag is the same as a result of providing a long-term operating method of the malicious code re-scan prevention information to delete the file from the re-scan prevention list.

In addition, the tag provides a method for long-term operation of the malicious code re-scan prevention information including a value of processing a part of the file or signature.

In addition, a part of the file or signature provides a long-term operation method of anti-malware rescan prevention information including any one or more of an MZ header, a PE header, an entry point (EP) area, or a back part of the file.

In addition, the above process provides a method for long-term operation of the malicious code re-check prevention information made by a function including a CRC32 or a hash function.

In addition, when the first tag and the second tag is different as a result of the comparison provides a long-term operation method of the malicious code re-scan prevention information to leave the file on the re-scan prevention list.

In addition, when the diagnostic engine is unloaded, any one or more of the rescanning prevention list or the signature list is stored, and when reloading the diagnostic engine, malicious code rescanning prevention information is updated at least one of the rescanning prevention list or the signature list. It provides a long time operation method of.

In addition, when a virus diagnosis code is added in an update of the diagnosis engine, a method for long-term operation of anti-malware rescan prevention information for performing an infection check on a file registered in the rescan prevention list at the first execution of the diagnosis engine is provided. do.

In addition, the infection check for the registered file provides a long-term operation method of anti-malware re-scanning information performed on at least one of a header, an EP area, or a program end area of the file.

In order to achieve the above object, a second aspect of the present invention provides a computer-readable recording medium having recorded thereon a program for executing any one of the above methods.

In order to achieve the above object, a third aspect of the present invention provides a rescan prevention for storing a rescan prevention list including a first tag which is a tag TAG of the file, for at least one file that has been scanned for infection by a diagnosis engine. A signature list including a list storage unit and a second tag which is a tag of the signature with respect to one or more signatures of the diagnostic engine, each file of the signature and the second tag of the signature added upon updating of the signature list; A tag comparison unit for comparing the first tag of the anti-malware rescanning prevention information, and a rescanning prevention list management unit for deleting the file from the rescanning prevention list when the first tag and the second tag are the same as the comparison result. Providing a long time operating device.

In addition, the tag provides a device for a long time operation of the malicious code re-scan prevention information including a value of processing a part of the file or signature.

In addition, a portion of the file or signature provides a long-term operation device of the malicious code re-scan prevention information including any one or more of an MZ header, a PE header, an EP area, or the back of the file.

In addition, the processing provides a device for a long time operation of the malicious code re-scan prevention information made by a function including a CRC32 or a hash function.

In addition, when a virus diagnosis code is added in an update of the diagnosis engine, malware rescan prevention information including an infection check unit that performs an infection check on a file registered in the rescan prevention list when the diagnosis engine is first executed. Provides a long time operating device.

In addition, the infection check for the registered file provides a long-term operation device of the anti-malware re-scanning information performed on at least one of the header, the EP area, or the program end area of the file.

According to the present invention, by adding a tag to the rescan prevention information and signature and using it as a signal, defense against malicious code can be enhanced.

In addition, the diagnostic speed is improved by selectively maintaining the retest prevention information even when the signature of the diagnostic engine is updated.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intentions or customs of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification.

1 illustrates the use of a recheck prevention list before and after signature list update in the prior art. Figure 1a before the update, Figure 1b shows the situation after the update.

Reference is first made to FIG. 1A. File list 110 represents a list of files that exist within a user system. Lists the file name, size, type, modified date, etc. of files including explorer.exe (111). After the diagnosis engine performs an infection check on the files, the rescan prevention list 120 is generated for the files not infected with the malicious code.

In the related art, when a general diagnosis is performed, a check is skipped when the information on the rescan prevention list 120 is not changed with reference to the file list 110 and the rescan prevention list 120. For example, file names, sizes, modified dates, and the like of explorer.exe 111 in the file list 110 and explorer.exe 121 in the rescan prevention list 120 are compared. The modified date of the explorer.exe (111) in the file list 110 is 2/30/2009 2:30 PM, and the modified date of the explorer.exe (121) in the anti-rescan list 120 is 2008-04-10. In the case of 11:27 AM, since the comparison results are different, it can be determined that any change has occurred in the explorer.exe (111) file after the final inspection. In this case, the explorer.exe (111) file is treated as a rescan target, and the actual diagnosis is performed by referring to the signature list 130 without skipping the scan. It can be seen that the signature list 130 includes signatures such as Win-Trojan / OnelineGameHack 131.

Next, reference is made to FIG. 1B. In addition to the Win-Trojan / OnelineGameHack 131 signature included in the existing signature list 130 of FIG. 1A, it can be seen that the Win-Spyware / Agent 132 signature has been added. In the related art, the retest prevention list 120 is initialized 125 because of the above-described problems when updating a signature. As a result of the initialization 125, no information remains in the re-check prevention list 120. Therefore, since there is no information to be referred to in the rescan prevention list, the diagnosis engine performs diagnosis while directly referring to the signature of the signature list 130 for each file of the file list 110.

2 illustrates the use of an anti-rescan list before and after updating a signature list according to an embodiment of the present invention. Figure 2a before the update, Figure 2b shows the situation after the update.

First, reference is made to FIG. 2A. The file list 110 is no different from that of the prior art shown in Fig. 1A. However, the difference between the information about the tag TAG is added to the re-check prevention list 120 and the signature list 130. The tag reads information of a part of the actual file and records the information or the processing result of the information. Here, a part of the actual file may be a part in which information of the file that is changed depending on whether or not a malicious code is infected, such as a MZ header, a PE header, an EP area, or the back of the file, may be recorded. In the process, a function such as CRC32 or a hash function may be used, and a string, a constant value, or the like may be specified. The structure of the tags is described in detail later.

First, the tag of explorer.exe 221 is 28BF8D22, the tag of ie7.exe is 549A93E9, and the tag of feather.bmp is 80CA8F54. In the present embodiment, the tag may generate the information of the designated part of each file as a processed value by using the CRC32 function. It can be seen that the tag 43A47C25 is added to Win-Trojan / OnelineGameHack.B 231 of the signature list 130. When determining whether to skip with reference to the retest prevention list 120, the tag information of the file list 110 and the retest prevention list 120 may be used as a signal. In addition to comparing that the modified dates of explorer.exe (111) in the file list (110) and explorer.exe (121) in the rescan prevention list (120) are different, compare the tags of both to see whether or not to skip. You can decide. In that case, you can strengthen your system's defense against viruses that do not change the size or modification date of the infected file. The tag of the file list 110 may be implemented so that the user can check it.

Next, reference is made to FIG. 2B. As shown in FIG. 1B, it can be seen that the Win-Spyware / Agent.B 232 signature is added to the conventional signature list 130. According to the related art, the retest prevention list 120 is initialized 125 when the signature is updated so that no information remains in the retest prevention list 120. However, according to the present invention, even when the diagnosis engine or signature is updated, the retest prevention list 120 is not collectively initialized. An embodiment of the present invention compares the tag of the added signature 232 of the signature list 130 with the tag of each file of the rescan prevention list 120 to determine whether to maintain the rescan prevention information. When updating the diagnosis engine or signature, only re-inspection information that is in conflict with the updated signature is selectively deleted.

For example, the tag of Win-Spyware / Agent.B 232 may be 28BF8D22, which may be the same as 28BF8D22 which is a tag of explorer.exe 221 of the rescan prevention list 120. This is judged to be a situation in which the explorer.exe 221 file in the rescan prevention list 120 has a high probability of being infected with the malicious code Win-Spyware / Agent.B 232. In this case, only explorer.exe 221 is deleted from the rescan prevention list 120, and other files with a tag that does not match any tag of the signature existing in the signature list 130 remain in the rescan prevention list 120. You can. The retest prevention list 120 may be stored in a memory or a disk and used again when the diagnostic engine is loaded.

Meanwhile, when the diagnostic engine is updated, a virus diagnosis code may be additionally included in addition to the signature, there may be another embodiment. For the first execution of the diagnostic engine and the second and subsequent executions, it is determined differently whether to skip the infection check for the file registered in the rescan prevention list. For the first execution, a check check may be performed on at least one of a header, an entry point (EP) area, and a program end area to confirm safety. On the other hand, in the second and subsequent executions, only the basic information may be examined to increase diagnostic efficiency. The basic information may include a file name, size, date created or modified, a tag, and the like. In the case of an update that does not include additional virus diagnostic code and simply adds a signature, it can only check and skip the basic information of the file. Through the configuration of this embodiment, a sample that is frequently tested may not perform more tests after the first check test, thereby increasing diagnostic performance.

Also, at least one of the retest prevention list 120 or the signature list 130 is stored when the diagnostic engine is unloaded, and the retest prevention list 120 or the signature list 130 is loaded when the diagnostic engine is loaded. It may be implemented to update any one or more of the above.

3 illustrates a configuration of a tag according to an embodiment of the present invention.

The tag 310 may be divided into TAG1 and TAG2, which are parts generated from the representative value, of a part of the file or signature, and TAG3 and TAG4, which are parts generated from the detailed value. The portion generated from the representative value and the detail value is composed of the information corresponding to the position and the information corresponding to the value, respectively. Tag for the position of the representative value TAG1 (311), tag for the value of the representative value (TAG2 312), tag for the position of the detail value TAG3 (313), tag for the value of the detail value It may be referred to as TAG4 (314). In some embodiments, the processing of the file or part of the signature may be performed by a CRC32 function. In the case of using the CRC32 function, the accuracy is higher than that of the conventional checksum and the data size is 32 bit, etc., higher than the hash function, resulting in high efficiency. The tag of the representative value may be implemented as a check sum value that is a result of processing of any one or more of an MZ header, a PE header, an entry point (EP) area, or the back of the file.

4 is a flowchart illustrating each step of the long-term operation method of the re-examination prevention information according to an embodiment of the present invention.

First, a rescan prevention list including a first tag, which is a tag of a file on which an infection has been checked, is generated (S410), and a signature list including a second tag, which is a tag of a signature of a diagnosis engine, is generated (S420). When updating the signature list, the second tag of the signature to be added is compared with the first tag of the recheck prevention list (S430). Files having the same comparison result are deleted from the rescanning prevention list (S440), and files having different comparison results are left in the rescanning prevention list (S445). Through this flow, it is possible to operate the retest prevention information for a long time.

5 is a block diagram illustrating a schematic structure of a re-test prevention information long time operation apparatus according to an embodiment of the present invention.

The file storage unit 410 stores a file of the user system, and the infection check unit 420 loads a diagnostic engine to check a file stored in the file storage unit 410. The rescan prevention list storage unit 430 stores a rescan prevention list including a first tag, which is a tag TAG of the file, for at least one file that has been scanned for infection by a diagnosis engine.

The signature management server 440 manages signatures, such as updating signatures of diagnostic engines for new malicious codes. The signature list storage unit 450 stores a signature list including one or more signatures of the diagnostic engine, the second tag being a tag of the signature. The signature list storage unit 450 may be implemented in either the user system or the signature management server. The tag comparison unit 460 compares the second tag of the signature added when the signature list is updated with the first tag of each file of the rescan prevention list. The rescan prevention list management unit 470 which has received the comparison result deletes the file having the same comparison result from the rescan prevention list.

Modules, functional blocks or means of the embodiments of the present invention described above may be implemented in a variety of known elements such as electronic circuits, integrated circuits, ASICs (Application Specific Integrated Circuit), each implemented separately or two or more It can be integrated.

Although the embodiments have been described for the understanding of the present invention as described above, it will be understood by those skilled in the art, the present invention is not limited to the specific embodiments described herein, but variously without departing from the scope of the present invention. May be modified, changed and replaced. For example, the technique of the present invention may be applied to a picture, an image, etc., which may be displayed by a display such as an LCD instead of a character. Therefore, it is intended that the present invention cover all modifications and variations that fall within the true spirit and scope of the present invention.

1 illustrates the use of a recheck prevention list before and after signature list update in the prior art.

2 illustrates the use of a re-examination prevention list before and after updating a signature list according to an embodiment of the present invention.

3 illustrates a structure of a tag according to an embodiment of the present invention.

4 is a flowchart illustrating each step of the long-term operation method of the re-examination prevention information according to an embodiment of the present invention.

5 is a block diagram illustrating a schematic structure of a device for a long time operation of re-test prevention information according to an exemplary embodiment of the present invention.

Claims (15)

Generating a rescan prevention list including a first tag which is a tag of the file for at least one file that has been scanned for infection by a diagnostic engine, Generate a signature list for one or more signatures of the diagnostic engine, the signature list comprising a second tag that is a tag of the signature, Comparing the second tag of the signature added when the signature list is updated with the first tag of each file of the recheck prevention list; If the first tag and the second tag is the same as a result of the comparison, the file is deleted from the rescan prevention list, At least one of the re-check prevention list or the signature list is stored when the diagnostic engine is unloaded. Updating any one or more of the retest prevention list or the signature list when the diagnostic engine is loaded How to use malware rescan prevention information for a long time. The method of claim 1, The tag includes a value that processes a portion of the file or signature. How to use malware rescan prevention information for a long time. 3. The method of claim 2, The portion of the file or signature comprises at least one of an MZ header, a PE header, an EP region, or the back of the file. How to use malware rescan prevention information for a long time. 3. The method of claim 2, The processing is accomplished by a function or hash function containing CRC32. How to use malware rescan prevention information for a long time. The method of claim 1, If the first tag and the second tag are different from each other as a result of the comparison, How to use malware rescan prevention information for a long time. delete The method of claim 1, When a virus diagnosis code is added in an update of the diagnosis engine, the first execution of the diagnosis engine performs an infection check on a file registered in the rescan prevention list. How to use malware rescan prevention information for a long time. The method of claim 7, wherein The infection check of the registered file is performed on at least one of a header, an EP area, and a program end area of the file. How to use malware rescan prevention information for a long time. A program for executing the method according to any one of claims 1 to 5, 7 or 8 is recorded. Computer-readable recording media. A rescan prevention list storage unit configured to store a rescan prevention list including a first tag which is a tag TAG of the file, for at least one file that has been scanned for infection by a diagnosis engine; In a signature list including a second tag that is a tag of the signature for one or more signatures of the diagnostic engine, the second tag of the signature added when the signature list is updated and the first tag of each file of the recheck prevention list With the tag comparison part to compare, A rescan prevention list manager for deleting the file from the rescan prevention list when the first tag and the second tag are the same as the comparison result; If the virus diagnosis code is added in the update of the diagnosis engine, an infection check unit that performs an infection check on a file registered in the rescan prevention list at the first execution of the diagnosis engine Long-term operating device of the malware re-scan prevention information, including. The method of claim 10, The tag includes a value that processes a portion of the file or signature. Prolonged operation of malware rescan prevention information. The method of claim 11, The portion of the file or signature comprises at least one of an MZ header, a PE header, an EP region, or the back of the file. Prolonged operation of malware rescan prevention information. The method of claim 11, The processing is accomplished by a function or hash function containing CRC32. Prolonged operation of malware rescan prevention information. delete The method of claim 10, The infection check of the registered file is performed on at least one of a header, an EP area, and a program end area of the file. Prolonged operation of malware rescan prevention information.

Images