KR101126532B1 - Malware execution preventing method based on positive security using reputation information and system thereof - Google Patents

Abstract

PURPOSE: A positive security-based malicious code execution preventing method and a malicious code execution preventing system are provided to originally block the execution of a malicious code by applying a positive security technique to a file on a non-allowed path. CONSTITUTION: A kernel driver(110) hooks a kernel of a user computer and obtains a control right about file execution. A white-list database(150) stores file information or a computer path. A hash extracting module(170) extracts the hash information of the file. A reputation security server(200) supplies evaluation information to a user computer.

Description

Positive security-based malware execution prevention method using reputation information and malware execution prevention system using same {MALWARE EXECUTION PREVENTING METHOD BASED ON POSITIVE SECURITY USING REPUTATION INFORMATION AND SYSTEM THEREOF}

An embodiment according to the concept of the present invention relates to a technique for preventing malicious code execution, and more particularly, a positive security based malware for determining whether to execute an executable file through approval of a user using reputation information. An execution prevention method and a system using the same.

Malware generally refers to program codes that are intentionally designed to damage computer systems, and include viruses, worms, Trojan horses, backdoors, hijackers, and spies. Spyware or various hacking programs. Malware that spreads from various paths such as web services and e-mails is executed regardless of the intention of the user through exploit code, etc., and infects the user's computer to damage system resources or leak user's personal information. It also makes your computer a zombie computer for DDoS (Distributed Denial of Service) attacks. In the past, negative security-based signature detection techniques have been mainly researched and developed to protect the system from such malicious codes. The signature detection technique is a technique that analyzes and applies the form and flow of the attack in the system, and the mechanism consisting of a specific target in the system by the signature method, and stores patterns such as known viruses and worms. A threat is detected by holding a database and comparing a suspect executable or process with a pattern stored in the database. Generally, the signature method is applied after analyzing the attack pattern or flow, so it can show a very good defense against known attack techniques, but the prevention effect against unknown attacks could not be expected. Even if some of them were modified, there was a problem that the malicious code could not be detected. Recently, a heuristic technique using a statistical technique has been used as one of the methods for overcoming the limitation of the detection technique using the signature. It is so high that the problem of efficiency is pointed out. Such negative type malicious code blocking techniques are disclosed in detail in Korean Patent Nos. 2009-0080220, 2006-0011558, and the like.

The technical problem to be achieved by the present invention is to determine the execution of the executable file through the approval of the user using the reputation information by providing a positive security-based method for preventing malicious code execution and system using the same that can prevent malware infection inherently It is.

In addition, it provides a malicious code blocking method and a system using the same by minimizing the inconvenience of the positive security technology by allowing the executable file that is found to be a normal file to be executed immediately without using a security warning window when using reputation information.

According to an embodiment of the present invention, a method of blocking malicious code execution based on a positive method includes a step in which a kernel driver hooks a kernel of a user computer to obtain control of file execution and an attempt to execute an arbitrary file is detected by the kernel driver. If so, the hash extraction module extracts the hash information of the arbitrary file and transmits it to the reputation security server, and the reputation security server to generate the evaluation information corresponding to the transmitted hash information to provide to the malicious code blocking module And displaying, by the malicious code blocking module, a security warning window including the provided evaluation information to induce a user to execute execution of the arbitrary file.

If the computer path of the random file does not exist in the white list DB, hash information of the random file is extracted and transmitted to the flatbed security server.

The positive-based malicious code execution blocking method may further include: when attempting to execute the arbitrary file, when the computer path of the arbitrary file exists in the white list DB or when the digital file is digitally signed in the arbitrary file, It may further comprise the step of executing any file directly.

The positive-based malicious code execution blocking method includes, when the arbitrary file is executed through the security alert window, when the reputation security server adjusts the reputation level of the arbitrary file and the random file is cured or deleted. And further adjusting the flatness.

According to an embodiment of the present disclosure, the positive-based malicious code execution blocking method may include updating, by the reputation security server, a result of increasing or decreasing the reputation degree of the arbitrary file in the evaluation information and updating the updated evaluation information. The method may further include transmitting in real time to the malicious code blocking module.

The computer path of the arbitrary file includes a window system path or a program installation path, and the white list DB stores a computer path designated by the user to be executable.

The evaluation information may include at least one of whether malicious code for the random file and expert analysis information or user reputation for the random file.

Generating the evaluation information and providing the evaluation information to the malicious code blocking module may include at least one of malicious code of the arbitrary file and user reputation when the reputation security server has file information on the transmitted hash information. Create and provide evaluation information.

The generating of the evaluation information and providing the evaluation information to the malicious code blocking module may include agreeing to collecting the random file with the malicious code blocking module when the reputation security server does not have file information on the transmitted hash information. Requesting and agreeing with the malicious code blocking module, transmitting the arbitrary file to an expert server, collecting expert analysis information on the arbitrary file from the expert server, and at least one of the collected expert analysis information and user reputation. And generating and providing evaluation information including one.

Positive-based malicious code execution blocking system according to an embodiment of the present invention, a white list DB for hooking the kernel of the user's computer to obtain control over the execution of the file and a predetermined computer path from the user And a hash extracting module for extracting hash information of the arbitrary file, and receiving the extracted hash information from the hash extracting module when the computer path of the arbitrary file to be executed in the kernel is not registered in the white list DB. And a reputation security server for generating evaluation information corresponding to the hash information and providing the same to the user computer.

The positive-based malicious code execution blocking system may further include an expert server that receives the expert file from the reputation security server and transmits the expert analysis information analyzed to the reputation security server.

The reputation security server, based on the evaluation information provided to the user computer, and adjusts the reputation for the random file up when the file is executed, and if the random file is treated or deleted, adjusts the reputation down.

According to an embodiment, the reputation security server updates the evaluation information by reflecting the result of the reputation degree up or down adjustment for the arbitrary file in the evaluation information and provides the updated evaluation information to the user computer in real time.

The malicious code blocking method and the system using the same according to an embodiment of the present invention have the effect of blocking the execution of unknown malicious code by applying a positive security technology that pre-verifies a file to be executed in an unauthorized path.

In addition, the malicious code blocking method and the system using the same according to an embodiment of the present invention can receive the reputation information of the executable file from the reputation security database when pre-verification of the executable file, so that the user can safely execute the file. There is an effect that can be determined.

The detailed description of each drawing is provided in order to provide a thorough understanding of the drawings referred to in the detailed description of the invention.
Figure 1 shows an internal block diagram of a malicious code blocking system according to an embodiment of the present invention.
2 is a block diagram illustrating an internal security warning window according to an embodiment of the present invention.
3 is a flow chart illustrating a method for blocking positive based malware according to an embodiment of the present invention.
Figure 4 is a flow chart for explaining a positive based malware blocking method according to another embodiment of the present invention.
5 is a flowchart illustrating a method for blocking positive malware based on another embodiment of the present invention.

Specific structural or functional descriptions of the embodiments according to the inventive concept disclosed herein are provided for the purpose of describing the embodiments according to the inventive concept only. It may be embodied in various forms and is not limited to the embodiments described herein.

Embodiments according to the inventive concept may be variously modified and have various forms, so embodiments are illustrated in the drawings and described in detail herein. However, this is not intended to limit the embodiments in accordance with the concept of the invention to the specific forms disclosed, it includes all changes, equivalents, or substitutes included in the spirit and scope of the present invention.

The terms first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are intended to distinguish one element from another, for example, without departing from the scope of the invention in accordance with the concepts of the present invention, the first element may be termed the second element, The second component may also be referred to as a first component.

When a component is said to be "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that another component may exist in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between. Other expressions describing the relationship between components, such as "between" and "immediately between," or "neighboring to," and "directly neighboring to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this specification, terms such as "comprise" or "have" are intended to indicate that the described feature, number, step, operation, component, part, or combination thereof exists, and one or more other features or numbers are present. It should be understood that it does not exclude in advance the possibility of the presence or addition of steps, actions, components, parts or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and are not construed in ideal or excessively formal meanings unless expressly defined herein. Do not.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Figure 1 shows an internal block diagram of a positive-based malware blocking system according to an embodiment of the present invention.

Referring to FIG. 1, the malicious code blocking system 10 includes a malicious code blocking module 100 and a reputation security server 200 mounted on a user's computer.

According to an embodiment, the malicious code blocking system 10 may further include an expert security server 300. The user's computer may be connected to various types of computers or network communication such as a desktop, a laptop, a laptop, and an internet connection. Various electronic devices such as mobile phones and PDAs may be used.

A module in the present specification may mean hardware capable of performing functions and operations according to each name described in the present specification, and also refers to computer program code capable of performing specific functions and operations. It may also mean an electronic recording medium, such as a processor, on which computer program code is capable of performing specific functions and operations.

In other words, a module may mean a functional and structural combination of hardware for performing the technical idea of the present invention and software for driving the hardware.

The malicious code blocking module 100 includes a kernel driver 110, a white list DB 130, a search comparison module 150, and a hash extraction module 170.

The kernel driver 110 hooks the kernel of the user computer to obtain control over file execution.

In more detail, the kernel driver 110 operates in the kernel mode and checks the exchange buffer every predetermined time, for example, 10 ms, by a thread. Transfer control of file execution to user

That is, unlike the conventional negative based security technology, the malware blocking system 10 according to the embodiment of the present invention is a positive security system that verifies all executable files by the hooked kernel driver 110 before being executed. .

Therefore, when a user visits a web site infected by a hacker while surfing the Internet, an exploit code may prevent the execution file from being downloaded and executed without the user's consent.

The white list DB 130 stores information on an executable file or a computer path, such as a window system path or a program installation path, which the user has designated to allow file execution.

The search comparison module 150 searches and compares whether the computer path of any executable file to be executed in the kernel is stored in the white list DB 130.

In addition, the search comparison module 150 searches and compares whether the arbitrary executable file is stored in the white list DB 130 as a file designated by the user.

That is, the search comparison module 150 checks the computer path of the file to be executed, for example, a window system path or a program installation path, and searches and compares whether the file exists in the white list DB 130 registered as a path trusted by the user.

As a result of the comparison, when the computer path of the arbitrary file to be executed exists in the white list DB 130, the search comparison module 150 transmits the comparison result R1 to the kernel driver 110, and the kernel driver ( In response, 110 controls the arbitrary file to be executed.

According to an embodiment, if the random file has a digital signature, the search comparison module 150 executes the random file immediately without verification, similar to the case where the computer path of the random file described above exists in the white list DB 130. It may have a user option to enable it.

If the computer path of the arbitrary file does not exist in the white list DB 130, the search comparison module 150 transmits the comparison result R2 to the hash extraction module 170.

The hash extracting module 170 extracts a hash value hash1 for the arbitrary executable file in response to the comparison result R2 transmitted from the search comparing module 150 and converts the extracted hash value hash1 into a reputation security server. Send to 200.

Also, according to an embodiment, the search comparison module 150 may recognize a file having a digital signature, such as a window update file, as a normal file even if the file is not included in the whitelist DB 130.

Accordingly, the search comparison module 150 may request the kernel driver 110 to execute the file that has been digitally signed as described above without immediately requesting verification from the reputation security server 200.

The reputation security server 200 of the malicious code blocking system 10 includes a search control module 210, a reputation DB 230, a malicious code DB 250, an expert analysis DB 270, and an evaluation information generation module 290. Contains

According to an embodiment, the reputation security server 200 may further include a sandbox 280 or an antivirus / vaccine server 285.

When the hash information (hash1) for the arbitrary file described above is transmitted from the hash extraction module 170 to the flatbed security server 200, the search control module 210 of the flatbed security server 200 is stored in the hash information (hash1) Search whether the corresponding file information exists in the reputation DB 230, the malicious code DB 250 or the expert analysis DB 270.

At this time, the reputation DB 230 is a database that collects and stores reputation information (Reputation information) of the user for each of the files, the malware DB 250 has file information known as malicious code The expert analysis DB 270 is a database in which expert opinions and analysis results of respective files are stored.

When the search control module 210 searches for file information corresponding to the hash information hash1 in the malicious code DB 250 and the reputation DB 230, the evaluation information generation module 290 is based on the retrieved file information. It determines whether the arbitrary file is malicious code and calculates the reputation of users for the arbitrary file.

Evaluation information generation module 290 generates the evaluation information including the determination of the malicious code and the reputation of the user and transmits to the malicious code blocking module 100.

In addition, when the file information exists only in the malicious code DB 250, the evaluation information generation module 290 generates evaluation information as a result of judging whether the arbitrary file is a malicious code or a normal file. 100).

Similarly, when the file information exists only in the reputation DB 230, the evaluation information generation module 290 generates the evaluation information with the reputation of users for the arbitrary file and transmits the evaluation information to the malicious code blocking module 100. .

On the other hand, if the file information corresponding to the hash information (hash1) does not exist in the reputation DB 230 or malicious code DB 250, the search control module 210 asks whether to agree to the collection of the arbitrary file (que) is transmitted to the malicious code blocking module 100.

When the search control module 210 receives the consent message (ack) from the malicious code blocking module 100 in response to the transmitted message (que), the search control module 210 receives the information about the arbitrary file malicious code Information about the random file collected and collected from the blocking module 100 is transmitted to the expert server 300.

The expert server 300 analyzes the information on the transmitted random file and uses the analysis information on whether the random file is a malicious code or a normal file or detailed information on other random files as the expert analysis information as the reputation security server 200. To transmit.

The search control module 210 receives expert analysis information transmitted from the expert server 300 and stores the expert analysis information in the expert DB 270, and the evaluation information generating module 290 evaluates the evaluation information based on the expert analysis information. Create and transmit to the malicious code blocking module 100.

According to an embodiment, the reputation security server 200 analyzes the collected arbitrary files on its own, for example, using a sandbox 280 or an antivirus / vaccine server 285, and the information on the arbitrary files according to the analysis result. It can be stored in the malware DB (250).

As described above, when the arbitrary file is about to be executed, the reputation security server 200 serves to verify whether the arbitrary file is malicious code or normal code and provide reputation information or expert analysis information about the executable file of users. Do this.

On the other hand, the malicious code blocking module 100 receives the evaluation information from the reputation security server 200, and displays a security warning window (WIN) including the received evaluation information on the display of the user computer.

Therefore, the user of the computer can check the evaluation information for any file to be executed through the security warning window (WIN) displayed on the display.

2 is a block diagram illustrating an internal security warning window according to an embodiment of the present invention.

1 and 2, the security warning window WIN includes a flatness display unit D1, an expert information display unit D2, an execution button B1, a treatment button B2, and a stop button B3.

The reputation degree of the user about the arbitrary file to be executed is displayed on the reputation display unit D1, and the expert analysis information on the arbitrary file is displayed on the expert information display unit D2.

According to an embodiment, the flatness may be implemented in the form of a graph such as a pie chart.

The process of displaying the flatness degree on the flatness display part D1 and the process of displaying expert analysis information on the expert information display part D2 has been described in detail in the description of FIG. 1, and thus unnecessary description thereof will be omitted.

When the user executes the arbitrary file by clicking the execution button B1 through the security warning window WIN, the malicious code blocking module 100 transmits the execution button click information CL1 to the flatbed security server 200.

In response to the transmitted execution button click information CL1, the reputation security server 200 updates the reputation DB 230 with a value of adjusting the reputation degree of the corresponding arbitrary file.

On the contrary, when the user clicks the treatment button B2 to treat the arbitrary file, the malicious code blocking module 100 transmits the treatment button click information CL2 to the reputation security server 200.

In response to the transmitted treatment button click information CL2, the reputation security server 200 updates the reputation DB 230 with a value of adjusting the reputation degree of the corresponding arbitrary file.

The reputation security server 200 updates the reputation DB 230 corresponding to the click of the execution button B1 or the treatment button B2 of the user, and immediately sends the update result to the malicious code blocking module 100. Feedback.

Therefore, the malicious code blocking module 100 may display a reputation that is updated in real time through the reputation display unit D1, and the user may check a result in which his / her selection is immediately reflected.

On the other hand, when it is difficult to determine whether to execute or treat the arbitrary file, the user can temporarily stop the execution of the arbitrary file by clicking the stop button B3.

In the description of FIG. 2, the user has to click the treatment button B2 or the stop button B3 in order to treat or stop the random file. It may also have the option of treating or stopping.

3 is a flow chart illustrating a method for blocking positive based malware according to an embodiment of the present invention.

1 to 3, the kernel driver 110 hooks a kernel of a user computer to obtain control of file execution (S10).

When an attempt to execute a random file is detected by the kernel driver 110 (S30), the hash extracting module 170 extracts the hash information hash1 of the random file and transmits the hash information (hash1) to the flatbed security server 200 (S50). ).

The reputation security server 200 generates evaluation information (eval) corresponding to the transmitted hash information (hash1) and provides it to the malicious code blocking module 100 (S70).

The malicious code blocking module 100 displays a security warning window WIN including the provided evaluation information (eval) on the monitor of the user's computer (S90) to induce a user to execute or block the arbitrary file. .

Figure 4 is a flow chart for explaining a positive based malware blocking method according to another embodiment of the present invention.

1, 2 and 4, the kernel driver 110 hooks the kernel of the user computer to obtain control of file execution (S110).

When an attempt to execute an arbitrary file is detected by the kernel driver 110 (120), the search comparison module 150 searches whether the computer path of the arbitrary file exists in the white list DB 130 (S130).

As a result of the search, when the computer path of the arbitrary file exists in the white list DB 130, the search comparison module 150 transmits the search result R1 to the kernel driver 110.

The kernel driver 110 directly executes the arbitrary file without displaying the security warning window WIN in response to the transmitted search result R1 (S350).

On the other hand, if the computer path of the arbitrary file does not exist in the white list DB 130, the search comparison module 150 transmits the search result (R2) to the hash extraction module 170.

The hash extracting module 170 extracts a hash value hash1 for the arbitrary executable file in response to the search result R2 transmitted from the search comparing module 150 and converts the extracted hash value hash1 into a reputation security server. It transmits to 200 (S150).

When the hash information (hash1) for the arbitrary file is transmitted to the flatbed security server 200, the search control module 210 of the flatbed security server 200 is the file information corresponding to the hash information (hash1) malicious code DB It is searched whether it exists in 250 (S170).

When the file information corresponding to the hash information (hash1) is detected as a malicious code in the malicious code DB 250, the search control module 210 transmits the search result (R3) to the kernel driver 110, kernel driver 110 automatically deletes the random file in response to the transmitted search result R3 (S400).

The search control module 210 of the reputation security server 200 sequentially searches whether file information corresponding to the hash information hash1 exists in the reputation DB 230 (S190).

If the file information corresponding to the hash information (hash1) is retrieved from the reputation DB 230 without being detected as a malicious code in the malicious code DB (250), the evaluation information generation module 290 is the reputation information corresponding to the file information The evaluation information (eva1) is generated from and transmitted to the malicious code blocking module 100 (S210).

If the file information corresponding to the hash information (hash1) does not exist in the reputation DB 230 or the malicious code DB 250, the search control module 210 asks whether or not to consent to the collection of the arbitrary file (que ) Is transmitted to the malicious code blocking module 100 (S230).

When the search control module 210 receives the consent message (ack) from the malicious code blocking module 100 in response to the transmitted message (que), the search control module 210 receives the information about the arbitrary file malicious code The information on the random file collected and collected from the blocking module 100 is transmitted to the expert server 300 (S250).

The expert server 300 analyzes the information on the transmitted random file and uses the analysis information on whether the random file is a malicious code or a normal file or detailed information on other random files as the expert analysis information as the reputation security server 200. To transmit.

The search control module 210 receives expert analysis information transmitted from the expert server 300 and stores the expert analysis information in the expert DB 270 (S270), and the evaluation information generating module 290 evaluates the information based on the expert analysis information. Create (eva2) and transmits to the malicious code blocking module 100 (S290).

The malicious code blocking module 100 receives the evaluation information eva1 or eva2 from the evaluation information generation module 290, and displays a security warning window WIN including the received evaluation information eva1 or eva2 on the display of the user's computer. It is displayed (S300).

When the user clicks the execute button B1 through the security alert window WIN, the malicious code blocking module 100 executes the arbitrary file and transmits the execute button click information CL1 to the flatbed security server 200. (S310).

In response to the transmitted execution button click information CL1, the reputation security server 200 updates the reputation DB 230 with a value of increasing the reputation of the corresponding arbitrary file (S320).

When the user clicks the clean button B2 to clean the random file, the malicious code blocking module 100 cleans the random file and returns the clean button click information CL2 to the reputation security server 200. To send.

In response to the transmitted treatment button click information CL2, the reputation security server 200 updates the reputation DB 230 with a value of lowering the reputation of the corresponding random file (S330).

5 is a flowchart illustrating a method for blocking positive malware based on another embodiment of the present invention.

1, 2 and 5, the kernel driver 110 hooks the kernel of the user computer to obtain control of file execution (S410).

When an attempt to execute an arbitrary file is detected by the kernel driver 110 (S420), the search comparison module 150 searches whether the computer path of the arbitrary file exists in the white list DB 130 (S430).

As a result of the search, when the computer path of the arbitrary file exists in the white list DB 130, the search comparison module 150 transmits the search result R1 to the kernel driver 110.

The kernel driver 110 directly executes the arbitrary file without displaying the security warning window WIN in response to the transmitted search result R1 (S700).

If the computer path of the arbitrary file does not exist in the white list DB 130, the search comparison module 150 transmits the search result R2 to the hash extraction module 170.

The hash extracting module 170 extracts a hash value hash1 for the arbitrary executable file in response to the search result R2 transmitted from the search comparing module 150 and converts the extracted hash value hash1 into a reputation security server. Transfer to step 200 (S450).

When the hash information (hash1) for the arbitrary file is transmitted to the flatbed security server 200, the search control module 210 of the flatbed security server 200, the file information corresponding to the hash information (hash1) is a reputation table DB ( In step 230, it is searched whether it exists.

When file information corresponding to the hash information hash1 is retrieved from the reputation DB 230, the evaluation information generation module 290 generates evaluation information eva1 from the reputation corresponding to the file information to block malicious code. Transmit to 100 (S490).

When the file information corresponding to the hash information (hash1) does not exist in the reputation DB 230, the search control module 210 sends a message (que) asking whether to consent to the collection of the arbitrary file (block) of the malware code module ( 100) (S500).

When the search control module 210 receives the consent message (ack) from the malicious code blocking module 100 in response to the transmitted message (que), the search control module 210 receives the information about the arbitrary file malicious code Collecting from the blocking module 100 (S280) and transmits the information on the collected arbitrary files to the sandbox (280) (S520).

The sandbox 280 analyzes the information on the transmitted random file and transmits analysis information on whether the random file is a malicious code or a normal file or detailed information on other random files to the reputation security server 200 ( S540).

The search control module 210 receives the analysis information transmitted from the sandbox 280 and stores the analysis information in the malicious code DB 250 or the expert analysis DB 270, and the evaluation information generation module 290 is based on the analysis information. The evaluation information eva2 is generated and transmitted to the malicious code blocking module 100 (S560).

The malicious code blocking module 100 receives the evaluation information eva1 or eva2 from the evaluation information generation module 290, and displays a security warning window WIN including the received evaluation information eva1 or eva2 on the display of the user's computer. To display (S580).

When the user clicks the execute button B1 through the security alert window WIN, the malicious code blocking module 100 executes the arbitrary file and transmits the execute button click information CL1 to the flatbed security server 200. (S600).

In response to the transmitted execution button click information CL1, the reputation security server 200 updates the reputation DB 230 with a value that raises the reputation of the corresponding arbitrary file (S610).

When the user clicks the clean button B2 to clean the random file, the malicious code blocking module 100 cleans the random file and returns the clean button click information CL2 to the reputation security server 200. To send.

In response to the transmitted treatment button click information CL2, the reputation security server 200 updates the reputation DB 230 with a value of adjusting the reputation degree of the corresponding arbitrary file (S630).

According to an embodiment, after updating the reputation DB 230 (after S610 or S630), the reputation security server 200 may feed back the update result to the malicious code blocking module 100.

Positive-based malicious code execution blocking method according to an embodiment of the present invention is implemented in the form of program instructions that can be executed by various computer means may be recorded in a computer readable medium.

The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination.

Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Hardware devices specially configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory and the like.

The medium may be a transmission medium such as an optical or metal line, a wave guide, or the like, including a carrier wave for transmitting a signal designating a program command, a data structure, or the like.

Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As a result, the malicious code blocking method and the system using the same according to an embodiment of the present invention have the effect of blocking the execution of unknown malicious code by applying a positive security technology that pre-verifies a file to be executed in an unauthorized path. For example, when pre-verification of an executable file, the reputation information of the executable file may be provided from the reputation security database, the user may safely determine whether to execute the file.

Although the present invention has been described with reference to one embodiment shown in the drawings, this is merely exemplary, and those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

10: malware blocking system
100: Malware Protection Module
110: kernel driver
130: white list DB
150: search comparison module
170: hash extraction module
200: Reputation Security Server
210: search control module
230: reputation DB
250: malware DB
270 Expert Analysis DB
280: sandbox
285: Antivirus / Vaccine Server
290: evaluation information generation module
300: expert server

Claims (14)

Hooking a kernel of a user computer by a kernel driver to obtain control over file execution;
If an attempt to execute an arbitrary file is detected by the kernel driver, extracting hash information of the arbitrary file by the hash extracting module and transmitting the hash information of the arbitrary file to a reputation security server;
Providing, by the reputation security server, evaluation information corresponding to the transmitted hash information to a malicious code blocking module;
Displaying, by the malicious code blocking module, a security warning window including the provided evaluation information to induce a user to execute execution of the arbitrary file; And
And adjusting the reputation level of the random file by the reputation security server when the random file is executed through the security alert window, and lowering the reputation level when the random file is cleaned. How to block malware execution. The method of claim 1, wherein the hash extraction module extracts the hash information of the arbitrary file and transmits the hash information to the flat panel security server.
Positive-based malicious code execution blocking method of extracting the hash information of the random file and transmitting it to the reputation security server when the computer path of the random file does not exist in the white list DB or the random file is not digitally signed. . The method of claim 1, wherein the positive based malware blocking method is executed.
And if the computer path of the random file exists in the white list DB when the random file is executed, the kernel driver further includes executing the random file directly. delete The method of claim 1, wherein the positive based malware blocking method is executed.
The reputation security server further includes the step of updating the reputation information of the arbitrary file to increase or decrease the adjustment result reflected in the evaluation information, and further comprising the step of transmitting the updated evaluation information to the malicious code blocking module in real time How to block malware execution. delete The method of claim 1,
And the evaluation information includes at least one of whether malicious code for the random file and expert analysis information or user reputation for the random file. The method of claim 7, wherein the generating of the evaluation information and providing the evaluation information to the malicious code blocking module include:
Positive reputation malicious code execution blocking method for generating and providing the evaluation information including at least one of the malicious code and the user reputation of the arbitrary file when the reputation security server has file information on the transmitted hash information. The method of claim 7, wherein the generating of the evaluation information and providing the evaluation information to the malicious code blocking module include:
If the reputation security server does not hold file information on the transmitted hash information, requesting consent for collecting the arbitrary file to the malicious code blocking module;
Transmitting the arbitrary file to an expert server and collecting expert analysis information on the arbitrary file from the expert server when consent to collect from the malicious code blocking module; And
And generating and providing evaluation information including at least one of the collected expert analysis information and user reputation. A computer-readable recording medium having recorded thereon a program for executing the method of any one of claims 1 to 3, 5, and 7-9. A kernel driver that hooks a kernel of a user computer to obtain control over file execution;
A white list DB that stores file information or a computer path designated to allow file execution from a user;
A hash extraction module for extracting hash information of the arbitrary file when the file information or the computer path of the arbitrary file to be executed in the kernel is not registered in the white list DB; And
And a flatbed security server that receives the extracted hash information from the hash extraction module and generates evaluation information corresponding to the hash information and provides the same to the user computer.
The reputation security server,
Positive-based malware execution blocking system for adjusting the reputation of the random file when the random file is executed through the evaluation information provided to the user computer, and lowering the reputation when the random file is cleaned. The system of claim 11, wherein the positive based malware blocking system is
Positive-based malicious code execution blocking system further comprises an expert server for transmitting the expert analysis information received by analyzing the arbitrary file from the reputation security server to the reputation security server. delete The flat panel security server of claim 11,
Positive-based malicious code execution blocking system for updating and reflecting the result of the increase or decrease the reputation of the arbitrary file in the evaluation information, and provides the updated evaluation information to the user computer in real time.

Images