KR101266037B1 - Method and apparatus for treating malicious action in mobile terminal - Google Patents

Abstract

The present invention provides a method for processing malicious behavior in a mobile terminal, the method comprising: accessing resources in the mobile terminal and monitoring and transmitting data and behavior of the application inputted by the mobile terminal; And analyzing the presence of malware and accessing resources in the application, and controlling the execution of the application according to the determination result.

Description

METHOD AND APPARATUS FOR TREATING MATERIAL ACTIVITY IN MOBILE TERMINAL {METHOD AND APPARATUS FOR TREATING MALICIOUS ACTION IN MOBILE TERMINAL}

The present invention relates to the processing of malicious behavior in a mobile terminal, and implements a behavior-based malware detection scheme, which is a dynamic analysis, to handle the malicious behavior in a mobile terminal to prevent anonymous application threat behavior and access to resources in the system at an early stage. A method and apparatus are disclosed.

Today's mobile operating system (Mobile OS) is designed to protect users' information and prevent malicious behavior of applications. The mobile operating system allows only explicitly declared behaviors to restrict the application's indiscriminate access to private information and resource usage. In addition, by providing a sandbox for the execution of a secure application, it is possible to cope with incorrect resource use (Application Crash) or abnormal behavior (Abnormal).

However, despite these efforts, malicious codes still steal user information or use paid services without permission.

Most of the previous studies for detecting malicious codes in mobile operating systems are difficult to detect anonymous malicious codes (Unknown Malicious Code or unanalyzed malware) using signature-based malicious codes.

Regarding the malicious code detection, the existing mobile security application analyzes the data of the anonymous application within the range allowed by the operating system to determine the malicious code and perform an operation such as control. Security system in mobile operating system does not have malicious function analysis function for application, but for security, it allows general application to use minimal resources and sends arbitrary application access to other application or important data of operating system. Restricted via the box. However, malware generation is still increasing and malware developers are bypassing the security system of the mobile operating system. Therefore, there are limitations on mobile security applications that have a passive inspection method.

Accordingly, the present invention is to provide a method and apparatus for processing malicious behavior in a mobile terminal that implements a behavior-based malware detection scheme that is a dynamic analysis and monitors the behavior of malicious applications, and analyzes them to limit threat behavior of anonymous applications. do.

According to an aspect of the present invention, in the method for processing malicious behavior in a mobile terminal, the process of monitoring the data input and behavior of the application and access to resources in the mobile terminal of the application input to the mobile terminal, and transmitting and monitoring; And analyzing the transmitted monitoring result to determine whether malicious code exists in the application and access to resources, and controlling the execution of the application according to the determination result.

According to another aspect of the present invention, in the mobile terminal malicious behavior processing apparatus, providing a communication and interface of the mobile terminal, integrated management of a plurality of applications and monitoring the status of the application input to the mobile terminal, the monitoring result Operating under the operating system and controlling the execution of the application according to the information output from the operating system, and removing the malicious code for malicious behavior and blocking the threat for access to resources. It includes a security application.

The present invention implements behavior-based malware detection, which is a dynamic analysis, to reduce false and undetected detections of malicious code detection, and to threaten anonymous applications early through the cooperation of operating systems and security applications in mobile devices. And the effect of restricting access to resources in the system.

1 is a schematic flowchart of a malicious behavior processing method in a mobile terminal according to an embodiment of the present invention.
2 is a flowchart illustrating a monitoring result analysis operation in a malicious behavior processing method in a mobile terminal according to an embodiment of the present invention.
Figure 3 is a block diagram showing the configuration of a malicious behavior processing apparatus in a mobile terminal according to an embodiment of the present invention.
Figure 4 is a block diagram showing the configuration of a framework (framework) designed based on the user information protection and malicious behavior blocking of the application in the OS of the mobile terminal according to an embodiment of the present invention.
Figure 5 is a block diagram showing the configuration of the monitoring unit in the malicious behavior processing apparatus in the mobile terminal according to an embodiment of the present invention.
Figure 6 is a block diagram showing the configuration of the analysis unit in the malicious behavior processing apparatus in the mobile terminal according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. It will be appreciated that those skilled in the art will readily observe that certain changes in form and detail may be made therein without departing from the spirit and scope of the present invention as defined by the appended claims. To those of ordinary skill in the art.

The present invention proposes an action-based malware detection system in an operating system of a mobile terminal to process malicious codes in the mobile terminal. A framework for this is defined, and a monitoring unit and an analysis unit are configured based on this. By monitoring the main action of the application input to the mobile terminal to monitor the threat behavior, receiving the monitored results, and analyzing and controlling the threat behavior of the application to perform malicious code detection and blocking, dynamic analysis By implementing a behavior-based malware detection method, we will reduce the false and undetected detections of malicious code detection, and provide a technology that can limit the threat behavior of anonymous applications early through the monitoring and analysis sections. .

In addition, the portable terminal according to an embodiment of the present invention is a digital broadcasting terminal, a personal digital assistant (PDA), a smart phone, a tablet PC, an iPad, an example of a 3G terminal. For example, all information communication such as International Mobile Telecommunication 2000 (IMT-2000) terminal, Wideband Code Division Multiple Access (WCDMA) terminal, Global System For Mobile Communication Packet Radio Service (GSM / GPRS) terminal, and Universal Mobile Telecommunication Service (UMTS) terminal. Devices and multimedia devices. However, it will be readily apparent to those skilled in the art that the configuration according to the embodiments described herein may also be applied to fixed terminals, such as digital TVs, desktop computers, and the like, except where applicable only to portable terminals.

In addition, the application referred to in the present invention refers to an exe-type application program that performs a specific function, but the present invention is not limited thereto.

Hereinafter, a method of processing malicious behavior in a mobile terminal according to an embodiment of the present invention will be described in detail with reference to FIG. 1.

1 is a schematic flowchart of a malicious behavior processing method in a mobile terminal according to an embodiment of the present invention. Referring to FIG. 1, in operation 110, an anonymous application A 100 is input to the mobile terminal and attempts a malicious action. In addition, another anonymous application B is input to the mobile terminal in step 112 and attempts to access personal information in the mobile terminal.

At this time, the malicious behavior of the anonymous application A (100) means a malicious code that performs a malicious function to the application, such as viruses, hacking programs, spyware, and the like. The malicious function refers to a function of executing a spam message or a Dos attack, such as reducing the performance of the mobile terminal, deleting or changing data, or leaking data.

In addition, access to the personal information of the anonymous application B (102) is a resource such as a number of resources in the mobile terminal that is not specified in the profile of the application, such as GPS or network resources, the corresponding mobile terminal identity (EIEI) of the mobile terminal, etc. Means use.

In operation 114, the mobile operating system (OS) 104 of the portable terminal accesses resources in the portable terminal of anonymous applications A and B (100, 102) input to the portable terminal and the data of the application. Behavior is monitored and transmitted, and the monitoring result transmitted in step 116 is analyzed.

Here, monitoring access to resources in the mobile terminal means attempting to access resources in the mobile terminal to use or control the resources and to monitor information collection of the resources.

Also, the monitoring result analysis will be described in detail with reference to FIG. 2. First, in step 210, it is checked whether or not to register the authority setting for the use of monitoring information for a specific application when the monitoring result is analyzed.

In this case, the permission setting registration is performed by notifying the user in advance about the permission setting registration through the display unit of the mobile terminal and performing the user permission.

After recognizing the execution of the anonymous application in step 212, the monitor receives information about the execution of the specific application in step 214.

In this case, the monitoring result analysis in step 210 is performed by acquiring an event generated when a predetermined application accesses a resource in the mobile terminal.

In addition, step 214 is performed by selecting only a specific event from the event obtained by step 210, generating it in a message form, and transmitting the same through a predefined protocol.

In step 216, the received information is analyzed using a profile and signature-based detection technology of the corresponding application.

In the step 216, when the monitored information about the specific application is received, only the reception information selected based on a preset reception through a filter is received.

In step 218, the result of the analysis determines whether the malicious code is an existing malicious code.

As a result of the operation of step 218, if the malicious code is not an existing malicious code, the process moves to step 220 to monitor the behavior of the application.

In step 222, the monitored result is analyzed through signature data indicating a pattern of malicious code as information required for malicious code verification.

In operation 224, the result of the analysis determines whether malicious activity is performed.

In more detail, step 224 stores and reconstructs a message received through a predefined protocol, and analyzes the reconstructed message to determine whether there is malicious activity.

In addition, the determination of the malicious behavior is performed by requesting the malicious code search through the malicious code database of the server connected through the mobile terminal and the network, and querying the malicious behavior pattern through the return request for the searched result.

As a result of the determination, if it does not correspond to the malicious behavior, go to step 220 to continuously monitor the behavior of the application and perform subsequent processes, and if the malicious behavior corresponds to stopping the use of the application in step 226; Notify this user.

On the other hand, if the existing malicious code in step 218 to go to step 226 to stop using the application and notify the user.

Subsequently, referring to FIG. 1, in step 118, the OS 104 transmits the analysis result to the security application 106 to determine whether the malware exists in the application and whether the resource is accessed.

At this time, the OS 104 transmits the main information such as the analysis results for the anonymous applications A and B 100 and 102 only to the security application 106, and not to the general application 108, thereby indiscriminate application control. And to prevent another security problem from occurring.

Subsequently, in step 120, the security application 106 notifies the OS 104 of the existence of malicious code in the application and access of resources.

In operation 122, the execution of the corresponding application is controlled according to the determination result of operation 120. In other words, in the application whose execution is controlled, the malicious code is removed for malicious behaviors and the threats for access to resources are blocked.

In the above, the malicious behavior processing method in the mobile terminal according to an embodiment of the present invention has been described.

Hereinafter, a malicious activity processing apparatus in a mobile terminal according to an embodiment of the present invention will be described in detail with reference to FIG. 3.

3 is a block diagram showing the configuration of a malicious behavior processing apparatus in a mobile terminal according to an embodiment of the present invention. Referring to FIG. 3, the malicious activity processing apparatus in the portable terminal is illustrated as including only an OS 310 and a security application 318. In addition, the portable terminal includes a camera, a speaker, a microphone, a memory, a wireless communication unit, and the like. Can be equipped with more.

The OS 310 provides a communication and interface of the mobile terminal, integrates and manages a plurality of applications, monitors the state of the application 300 input to the mobile terminal, and controls the execution of the application according to the monitoring result. .

The security application operates under the OS 310, and performs security for removing a malicious code for malicious behavior and blocking a threat for access to a resource in a specific application through information output from the OS 310. Contains an application.

In more detail, the OS 310 includes a monitoring unit 312 that monitors and transmits an application input to the mobile terminal to a resource in the mobile terminal and monitors data and behavior of the application, and the transmission. Analyzing the monitoring results to control the overall operation of the analysis unit 316 and the mobile terminal for determining the presence of malicious code and access to resources, and in particular, executing the application according to the determination result of the analysis unit. The control unit 314 for controlling the.

FIG. 4 is a block diagram showing a configuration of a framework 400 designed based on protecting user information and blocking malicious behavior of an application in an OS of a mobile terminal according to an embodiment of the present invention.

Referring to FIG. 4, the framework 400 includes an event capture unit 410, a message manager 412, a message analzyr 414, and a data manager. 416).

The event capture unit 410 obtains an event generated when a predetermined application accesses a resource in the mobile terminal, selects only a specific event from the obtained event, and generates and transmits it in the form of a message.

The message manager 412 transmits the message generated by the event capture unit 410 through a predefined protocol.

The message analyzer 414 stores and reconstructs the message transmitted from the message manager 412, and analyzes the reconstructed message to determine whether there is malicious activity.

The data manager 416 requests a search for a corresponding malicious code through a malicious code database, and inquires about a malicious behavior pattern through a request for return of the searched result.

When the event capture unit 410 receives the monitored information about the specific application, the event capture unit 410 transmits only the reception information selected based on a preset reception through the event message filter 418 to the message manager unit 412.

In addition, the event capture unit 410 may communicate with an external device through a stream interface 420 using a predefined protocol.

In this case, the stream interface 420 is to allow each unit in the framework to be patched to the service of the operating system to enable independent service execution without conflict with the operating system, in addition to the shared memory 432, It is implemented with a binder IPC (430) and a socket (Socket, 428).

Meanwhile, a first item of a message structure 422 transmitted between units 410, 412, 414, and 416 within the framework is a version defining a version of a protocol, and a second item is generated. A type defining a type of an event to be generated, a third item representing a caller name defining an application generating the event, and a fourth item representing a capture detecting the generated event; In this case, the fifth item is composed of parameters defining parameter values delivered with the resource requested by the application.

The message analyzer 412 may include a container interface 424 that stores and reconstructs a message transmitted from the message manager 412 in a list or tree form. It includes an algorithm interface (426) to analyze the message to determine the presence of malicious behavior (algorithm interface, 426).

In this case, the algorithm interface unit 426 is used to analyze the stored message, and the algorithm uses a statistical algorithm (Statistic Algorithm, 434) and a genetic algorithm (Genetic Algorithm, 436).

Here, the event capture unit 410 and the message manager 412 of the framework correspond to the monitoring unit in the malicious behavior processing apparatus in the mobile terminal according to an embodiment of the present invention. 5, the event capture unit 512 acquires an event generated when a predetermined application 510 accesses a resource 513 in the mobile terminal, and only a specific event in the obtained event through the event filter 514. After selection, the message is generated in the form of a message and transmitted to the message manager 516 through a predefined protocol.

The message manager 516 determines whether to transmit the corresponding message through the corresponding message filter 518, and selects only the determined message and transmits the message to the analyzer 520.

Here, the message analyzing unit 414 and the data manager 416 of the framework correspond to the analyzing unit in the malicious behavior processing apparatus in the mobile terminal according to an embodiment of the present invention. Referring to FIG. The controller 612 notifies the message received from the message manager 516 to the message analyzer 610 to control the execution of the corresponding application.

In addition, the message analyzer 610 registers the authority setting for the use of monitoring information for a specific application, and the profile and signature of the corresponding application with respect to the information received from the message manager 516. The analysis is performed using the base detection technology, and if the malicious code exists in the application, it is determined whether the malicious code is an existing malicious code.

At this time, when performing analysis using the profile and signature-based detection technology of the application, the container interface unit 614 for storing and reconfiguring in a list or tree form, and the reconstruction. The algorithm is performed using an algorithm interface unit 616 which analyzes the received message and determines whether there is malicious activity.

The algorithm interface unit 616 is used to analyze the stored message, and the algorithm may use a statistical algorithm and a genetic algorithm.

The algorithm interface unit 616 outputs the analysis result to the data manager unit 620, and the data manager unit 620 requests a corresponding malicious code search through the malicious code database 622, and Inquiry about malicious behavior pattern through return request.

As described above, an operation related to a method and apparatus for processing malicious behaviors in a mobile terminal according to the present invention can be made. Meanwhile, in the above description of the present invention, specific embodiments have been described, but various modifications can be made without departing from the scope of the present invention. Can be implemented. Accordingly, the scope of the present invention should not be limited by the illustrated embodiments, but should be determined by equivalents of the claims and the claims.

312: monitoring unit 314: control unit
316: analysis unit 318: security applications

Claims (23)

In the method of handling malicious behavior in a mobile terminal,
The monitoring unit in the mobile operating system of the mobile terminal monitors and transmits the data input and behavior of the application and access to resources in the mobile terminal of the application input to the mobile terminal;
A process in which the analysis unit in the mobile operating system of the portable terminal analyzes the monitoring result transmitted from the monitoring unit to determine whether the malicious code exists in the application and whether the resource is accessed;
The control unit in the mobile operating system of the portable terminal includes the process of controlling the execution of the application in accordance with the result of the determination of the presence of malicious code and access to resources,
And removing the malicious code for malicious activity and blocking the threat for access to resources in the application whose execution is controlled according to the determined result.
The process of monitoring access to resources in the mobile terminal,
Attempt to access resources in the mobile terminal to use or control the resources, monitor the collection of information of the resources,
The monitoring result analysis,
Registering a permission setting for the use of monitoring information for a specific application;
Receiving the monitored information when executing the specific application;
Analyzing the received information using a profile and signature-based detection technique of the corresponding application;
A process of determining whether the malicious code is an existing malicious code when the malicious code exists in the corresponding application as a result of the analysis using the profile of the application and the signature-based detection technology;
Determining whether the malicious code is an existing malicious code, and controlling the execution of the corresponding application according to the determined result;
Access to resources in the mobile terminal and monitoring the data and behavior of the application,
A predetermined application acquires an event generated when accessing a resource in a mobile terminal, selects only a specific event from the obtained event, generates it in a message form, and transmits it through a predefined protocol.
The monitoring result analysis,
Storing and reconstructing a message received through the predefined protocol, and analyzing the reconstructed message to determine whether there is a malicious activity. delete delete According to claim 1, The result of determining whether the malicious code is an existing malicious code
If the malicious code is not an existing malicious code, the behavior of the application is monitored, and the monitored result is analyzed through signature data indicating a pattern of the malicious code as information necessary for verifying the malicious code, and the malicious result as a result of the analysis. If it is determined that the use of the application stops using the notification method to the user characterized in that the mobile device handling malicious behaviors. delete delete The method of claim 1, wherein the malicious activity is determined,
The malicious code processing method of the mobile terminal characterized in that the request is performed through the malicious code database of the server connected via the mobile terminal and the network, and by querying the pattern of malicious behavior through the return request for the searched results. The method of claim 1, wherein the registering of the authority setting comprises:
The method for processing malicious behavior in a mobile terminal, characterized in that the user is notified in advance of the registration of the permission setting through the display unit of the mobile terminal. The method of claim 1, wherein the performing of the analysis using the profile and signature-based detection technique of the application comprises:
When receiving the monitored information for the specific application, malicious behavior processing method in the mobile terminal, characterized in that is performed by receiving only the received information selected based on the preset reception through the filter. delete In the mobile terminal malicious behavior processing device,
An operating system for providing a communication and interface of the mobile terminal, integrated management of a plurality of applications, monitoring the state of the application input to the mobile terminal, and controlling the execution of the application according to the monitoring result;
It operates under the operating system, and includes a security application for performing the removal of the malicious code for malicious behaviors and the threat of access to resources through the information output from the operating system,
The operating system,
A monitoring unit that monitors and transmits data input and behavior of the application and access to resources in the portable terminal of the application input to the portable terminal;
An analysis unit for analyzing the transmitted monitoring result and determining whether malicious code exists in the application and whether access to a resource is performed;
A control unit for controlling execution of a corresponding application according to a determination result of the analysis unit;
Wherein,
Attempt to access resources in the mobile terminal to use or control the resources, monitor the collection of information of the resources,
The analysis unit,
Registering the authority setting for the use of monitoring information for a specific application, receiving the monitored information when executing the specific application, and using the profile and signature-based detection technology of the corresponding application with respect to the received information. When the analysis is performed, and if the malicious code is present in the application, it is determined whether the malicious code is an existing malicious code, and outputs it to the controller.
The operating system,
An event capture unit for acquiring an event occurring when a predetermined application accesses a resource in the mobile terminal, selecting only a specific event from the obtained event, and generating and transmitting the specific event in a message form;
A message manager for transmitting the message generated by the event capture unit through a predefined protocol;
A message analzyr for storing and reconstructing the message transmitted from the message manager unit and analyzing the reconstructed message to determine whether there is malicious activity;
Requests to search the malicious code through the malicious code database and blocks the malicious behavior of the application and user information protection in the mobile terminal including a data manager for retrieving the pattern of malicious behavior through a request for return of the searched result. Malicious behavior processing device in a mobile terminal, characterized in that it comprises a framework designed based on. delete delete delete The method of claim 11, wherein the control unit,
If the malicious code determined by the analysis unit is not an existing malicious code, the behavior of the application is monitored and received through the monitoring unit, and the result of the monitoring through the analysis unit is a pattern of malicious code as information necessary for malicious code verification. And controlling to analyze the signature data using the signature data, and stopping the use of the corresponding application and notifying the user if it is determined that the malicious activity is a result of the analysis. delete delete The method of claim 11, wherein the event capture unit,
When receiving the monitored information for the particular application, the malicious behavior processing device in the mobile terminal, characterized in that for transmitting only the received information selected based on the preset reception through the filter. The method of claim 11, wherein the message analysis unit,
A container interface unit for storing and reconstructing a message transmitted from the message manager unit in a form of a list or a tree;
And an algorithm interface unit configured to analyze the reconstructed message and determine whether there is a malicious activity. The method of claim 11, wherein the event capture unit,
An apparatus for processing malicious behavior in a mobile terminal, characterized in that communication with an external device is possible through a stream interface using a predefined protocol. The method of claim 20, wherein the stream interface,
Each unit in the framework is patched to a service of the operating system to enable the independent service execution without conflict with the operating system, characterized in that the device for handling malicious behaviors in the mobile terminal. The method of claim 11,
The first item of the message transmitted between each unit in the framework is a version defining the version of the protocol, the second item is a type defining the type of the event to occur, and the third item is the Caller name (caller name) that defines the application that triggered the event, the fourth item is the capture (capture) to detect the generated event, the fifth item defines the parameter value to be delivered with the resource requested by the application Malicious behavior processing device in a mobile terminal, characterized in that formed as a parameter (parameter). A computer-readable recording medium having recorded thereon a program for executing the method for processing malicious activity according to any one of claims 1, 4, 7, 8, and 9.

Images