KR101308866B1 - Open type system for analyzing and managing malicious code - Google Patents

Abstract

An open malware management and analysis system is disclosed. The malicious code management and analysis system uses a virtual environment to check whether the input malicious code is a previously analyzed malicious code and to filter the previously analyzed malicious code, and when the identified malicious code is a new malicious code. By executing the input new malicious code extracts the behavior of the new malicious code and stores in the analysis database, the malicious code behavior extraction unit, by comparing the behavior of the new malicious code and the behavior of the malicious code previously stored in the analysis database Malware behavior analysis unit for analyzing the behavior of new malicious code, detailed analysis section of the malicious code provides an environment for malicious code analysts to analyze the behavior of the new malicious code, the analyzed malware, the malicious code to analyze and analysis Display at least one action of the malicious code in progress and request the analysis of the malicious code And an analysis system interface unit which displays the analysis contents of the malicious code, and an analysis system controller which controls the analysis of the behavior of the new malicious code and configures the analysis environment of the new malicious code.

Description

Open malware management and analysis system {OPEN TYPE SYSTEM FOR ANALYZING AND MANAGING MALICIOUS CODE}

The present invention relates to a malicious code management and analysis system that provides an environment and analysis contents for analyzing malicious code by extracting and executing analysis and storing the execution behavior of malicious code included in an executable file.

Currently, about 50,000 malicious codes are generated every day around the world, and each security company is responding to each other through malicious code analysis.

As an invention for coping with such malicious codes, Korean Patent Publication No. 10-2011-0087826 (published Aug. 03, 2011) "Malicious software detection method using a virtual machine" includes an attachment to a received e-mail. Determine whether the file exists, and if the file exists, determine whether the file corresponds to a pre-registered malicious code by executing the file on a virtual machine. Analyzing whether to classify it as malicious code is described.

However, while this method can detect that the file attached to the e-mail does not infect the user's computer, it cannot reduce the effort of analysts who analyze the malware if it is new. There is a problem. Therefore, as the number of new malicious codes increases, the number of malicious codes to analyze is increasing compared to the size of each security company's workforce.

In order to overcome the difference between the number of malicious codes and the number of analysts, researches on analysis techniques are being conducted, which can be classified into static analysis and dynamic analysis. Static analysis is difficult due to execution compression, encryption, and obfuscation techniques. Therefore, many researches have been conducted to analyze automatically through dynamic analysis. However, the code execution is smaller than that of static analysis, which leads to the disadvantage of missing malicious behaviors. As can be achieved through a variety of system calls in the analysis method using the system call is limited.

Accordingly, in order to overcome the limitation of analyzing using a system call, a method of analyzing through behavior analysis has been studied. In the case of behavior analysis, the process of malicious code analysis is shortened by observing the behavior of malicious code, leaving a log, and classifying the behavior log through a classifier or clustering.

Although advances in analytical automation technology make much of the automation possible, its accuracy is not yet reliable. In the end, the involvement of analysts is necessary to analyze malicious code, but the number of human resources that can be analyzed is limited compared to the number of malicious codes. However, analyzing each company independently causes duplicate analysis of malicious code, causing labor waste.

Open malware management that can prevent duplicate analysis of malware by filtering the analyzed malware and storing it in the analysis DB (Date Base) by determining whether the input malicious code is pre-analyzed or new malicious code. And an analysis system.

Malware Analysis By analyzing the behavioral similarity between the analysis contents stored in the DB and the already analyzed malware, an open malware management and analysis system that can simplify the process of analyzing new malware using the analysis of malware analysis. Is initiated.

Open malware management that analyzes behaviors of malicious code automatically, reducing the time for analysts to analyze behaviors, and reducing the time and effort required for analysis by sharing malware and analysis data. The system is disclosed.

The malicious code management and analysis system uses a virtual environment to check whether the input malicious code is a previously analyzed malicious code and to filter the previously analyzed malicious code, and when the identified malicious code is a new malicious code. By executing the input new malicious code extracts the behavior of the new malicious code and stores in the analysis database, the malicious code behavior extraction unit, by comparing the behavior of the new malicious code and the behavior of the malicious code previously stored in the analysis database Malware behavior analysis unit for analyzing the behavior of new malicious code, detailed analysis section of the malicious code provides an environment for malicious code analysts to analyze the behavior of the new malicious code, the analyzed malware, the malicious code to analyze and analysis Display at least one action of the malicious code in progress and request the analysis of the malicious code And an analysis system interface unit which displays the analysis contents of the malicious code, and an analysis system controller which controls the analysis of the behavior of the new malicious code and configures the analysis environment of the new malicious code.

According to one side, the malicious code filtering unit may calculate the hash value of the input malicious code to filter the pre-analyzed malicious code by comparing with the analysis information and vaccine previously stored in the analysis database.

According to another aspect, the malicious code activity extracting unit is a computer hardware device, a kernel, a virtual system control program for executing and controlling a malicious code in the virtual environment, a virtual system on which the malicious code is executed, and an operating system object generated in the virtual system. It may include a behavior monitor for observing and storing the behavior of.

According to another aspect, the virtual system control program executes the input malicious code in a different environment in the virtual system through a virtualization module interface, and when the operation of the input malicious code is finished, the virtual system is entered It may be a program that returns to the environment before the malicious code was executed.

According to another aspect, the behavior monitor may monitor the operation occurring on the operating system object and store it in a log file.

According to another aspect, the operating system object may be at least one of a process, a memory, a file, a registry, a network, and a system call.

According to another aspect, the virtual system may execute the malicious code in different kernels and execution environments through a virtualization module interface constituting the virtual computer environment in a real computer environment.

According to another aspect, the malicious code behavior analysis unit abstracts a log file generated by the malicious code behavior extraction unit to determine behavior similarity with malicious code stored in the analysis database, and if the behavior similarity is equal to or greater than a reference similarity, Hash values of similar malware can be stored in the analysis database.

According to another aspect, the analysis system interface unit displays analysis information classified into the malicious code to be analyzed, the malicious code under analysis and the analyzed malicious code among the information stored in the analysis database, and the malicious code to be analyzed and the analysis The analysis system may request the analysis of the malicious code in progress.

According to another aspect, when receiving the analysis request for the malicious code, the analysis system controller delivers the analysis information previously stored in the analysis database to the detailed malware analysis unit to build the virtual environment and analyze the behavior of the malicious code. Can be controlled.

The method for managing and analyzing malware includes checking whether the input malicious code is a previously analyzed malicious code to filter the previously analyzed malicious code, and when the identified malicious code is a new malicious code, using the inputted virtual environment. Extracting the behavior of the new malicious code by executing the new malicious code and storing it in an analysis database; analyzing the behavior of the new malicious code by comparing the behavior of the new malicious code with the behavior of the malicious code previously stored in the analysis database Providing an environment for analyzing the behavior of the new malicious code, and analyzing at least one of the analyzed malicious code, the malicious code to be analyzed, and the malicious code under analysis. It may include the step of displaying.

In the analysis of malware, filtering and behavior extraction process prevent duplicate analysis of malicious codes, and primarily analyze similarity with respect to contents of activity extraction, group similar malwares together, and analyze similar malware analysis contents already analyzed. By reducing the time required for analysis, you can respond quickly to malicious codes.

By opening and sharing the malware and analysis results, it can reduce the inefficiency of malicious code response and can cope with a large amount of malicious code by establishing a joint malware response system.

1 is a block diagram illustrating a malicious code management and analysis system according to an embodiment of the present invention.
2 is a block diagram illustrating a malicious code activity extracting unit according to an embodiment of the present invention.
3 is a flowchart illustrating a method of automatically extracting a behavior of a malicious code and storing it in a DB when an executable file is input in an embodiment of the present invention.
Figure 4 is a block diagram showing a detailed analysis of the malicious code in an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a malicious code management and analysis system according to an embodiment of the present invention.

Referring to FIG. 1, the malware management and analysis system includes a malicious code filtering unit 100, a malware analysis system 200, an analysis system control unit 300, and an analysis system interface 400. The analysis system interface 400 may include an additional device for collecting malicious code.

The malicious code filtering unit 100 receives the executable file input through the analysis system interface 400 and calculates MD5, SHA1, and SHA256 hash values of the code included in the executable file. In addition, by comparing the calculated hash value and the analysis information previously stored in the analysis database (DB: Data Base) 230, it is determined whether the inputted executable file is a pre-analyzed executable file, and determined whether it is a malicious code detected by an antivirus engine. By outputting the result, it checks whether the malicious code input is the previously analyzed malicious code and filters the previously analyzed malicious code. At this time, if there is analysis information stored in the analysis DB 230 for the calculated hash value, the corresponding analysis information is outputted, and if the malicious code is detected in the vaccine, the vaccine information and the malicious code name information detected are analyzed in the system interface ( To 400). If the executable file is not detected through the analysis DB 230 and the vaccine, the executable file may be input to the malicious code activity extracting unit 210 of the malicious code analysis system 200.

The malicious code analysis system 200 includes a malicious code behavior extracting unit 210, a malicious code behavior analyzing unit 220, an analysis DB 230, and a detailed malicious code analyzing unit 240.

The malicious code analysis system 200 transmits the executable file transmitted from the malicious code filtering unit 100 to the malicious code activity extracting unit 210 and transmits the analysis request requested from the analysis system interface 400 to the analysis system controller 300. Process detailed malware analysis unit 240 through).

The malicious code activity extracting unit 210 corresponds to the executable file filtered by the malicious code filtering unit 100 and observes and stores a system change occurring when the executable file is executed.

In the case of malicious code, whether it can be executed depends on the operating system (OS) environment and the application environment, and execute the executable file in various environments using the virtual system that creates a different environment, and observe the result. .

2 is a block diagram illustrating a malicious code activity extracting unit according to an embodiment of the present invention. Hereinafter, the malicious code behavior extraction unit according to the present invention will be described in more detail with reference to FIG. 2.

The malicious code activity extracting unit 210 may include an activity monitor 211, a virtual system control program 212, and a virtual system 213.

The behavior monitor 211 observes a state change that is changed by an executable file executed in the virtual system 213 through the virtualization module interface. Changes to observe include process creation and modification, memory read and write, file creation, modification and deletion, registry value changes, port state changes and new packet creation in the network area, and system call functions used by executables. In addition, the behavior monitor 211 monitors the operation occurring on the operating system object as described above and stores it in a log file.

The virtual system control program 212 transmits the executable file received from the malware filtering unit to execute the executable file in different environments through the virtualization module interface of the virtual system 213. The system 213 is controlled to be initialized to the state before the executable file is executed. After the initialization, the log file stored by the behavior monitor 211 is transmitted to the malicious code behavior analyzer 220.

The virtual system 213 establishes a virtual system having a plurality of kernels through a virtualization module on a physical device, and exchanges commands and data with the virtual system through an interface included in the virtualization module. When the executable file filtered by the malicious code filtering unit 100 is delivered, a command to be executed is transmitted from the virtual system control program 212, and the virtual system 213 is prepared in different kernel environments and application environments prepared in advance. Run the executable. Actions occurring in the virtual system are stored in the log file by the action monitor 211. The behavior monitor 211 sorts the stored file contents according to environments, leaving only the file contents of the virtual environment where the most behavior is extracted, and deleting the rest. Since the kernel and the application environment of the virtual system 213 are changeable by the user, a detailed description thereof will be omitted.

The malicious code behavior analyzer 220 stores the file containing the execution record generated by the malicious code behavior extractor 210 through an abstraction process. The abstraction process is a process of integrating the actual execution history one step further than analyzing the execution history directly. The abstraction process is an abstraction process for each stored property (object, operation), where an object can be a process, memory, file, registry, network, etc., and operations can be created, deleted, modified, read, written, opened, It can be close, run, wait, access, listening, and so on. In the case of system calls, even though they do the same thing (NtReadFile, ZwReadFile), the function names used must be abstracted. After the abstraction, the malware behavior analysis unit 220 determines the behavior similarity with the malicious code stored in the analysis DB, and finds records in which the behavior similarity is equal to or greater than the reference similarity (for example, 80% or more in common). The key value (hash value) of the corresponding record is added to the property and stored in the analysis DB.

In this case, when the similarity degree is less than 80%, the malicious code behavior analyzer 220 sets and stores a related property value as null.

3 is a flowchart illustrating a method of automatically extracting a behavior of a malicious code and storing it in a DB when an executable file is input in an embodiment of the present invention. Hereinafter, a method for managing and analyzing malware according to the present invention will be described with reference to the drawings.

The malicious code filtering unit 100 calculates the hash value of the executable file (S1), compares it with the hash value stored in the analysis DB or the already analyzed malicious code (S2), and compares whether the malicious code is diagnosed with the vaccine engine (S3). ) Finally, it includes the function of determining whether the new malicious code to be analyzed (S4). If the new malicious code is not detected (S6), the analysis result stored as already detected by the analysis DB or the vaccine engine is output (S7).

However, if it is determined that the new malicious code (S4) by the malicious code behavior extraction unit 210 to execute the executable file in the virtual environment to extract the malicious code features (S5) and save it as a file.

The file in which the behavior of the malicious code is recorded is transmitted to the malicious code behavior analysis unit 220 and compared to the analysis contents stored in the analysis DB 230 through the feature abstraction process (S8). The key value of the similar malicious code is stored (S10).

Figure 4 is a block diagram showing a detailed analysis of the malicious code in an embodiment of the present invention. Hereinafter, with reference to Figure 4 will be described in more detail the function of the malicious code analysis unit according to the present invention.

The detailed malware analysis unit 240 may include an analysis environment 241, an analysis environment storage image 242, and a hardware and kernel layer 243.

The analysis environment 241 generates and maintains a different analysis environment at the request of the analyst, and this analysis environment is controlled by the analysis system control interface of the hardware and kernel layer 243.

In this case, not only the analysis environment but also the tools used for malware analysis are installed in each analysis environment, and such tools may include a debugger, a network packet monitoring tool, a file, a registry, and a process monitoring tool by default. have. In addition, report templates are stored in each analysis environment, and a program for storing a completed report in an analysis DB may be included.

The analysis environment storage image 242 stores each analysis environment in the form of a file, and when an analysis environment creation request comes in, the requested analysis environment file is loaded into the analysis environment 241 of the virtual system.

The hardware and kernel layer 243 is a layer that abstracts a plurality of hardware resources into a single hardware resource in order to provide cloud services to analysts. The abstraction kernel is responsible for allocating hardware resources to each analysis environment.

The analysis system control unit 300 receives the analysis request of the requested analyst through the analysis system interface 400 and brings the malicious code to be analyzed from the analysis DB 230 to the detailed analysis unit 240 of the malicious code 240, The code behavior extracting unit 210 issues a command through the analysis system control interface to establish the analysis environment 241 in the environment where the most behavior is extracted.

The analysis system interface 400 may provide three interfaces in the form of a web page. In this case, the analysis system interface 400 may include, for example, a malicious code input request, a malicious code analysis request, and an analysis DB 230 information inquiry interface.

The malicious code input request is an interface for receiving an executable file into the system, and the received file is a malicious code filtering unit 100, a malicious code activity extracting unit 210, a malicious code activity analyzing unit 220, an analysis DB ( 230) Results may be output via the module.

In the analysis DB 230 information retrieval interface, the stored malicious codes are classified into three categories, analysis completed, analysis, and unanalyzed, and output on a web page. A report retrieval service and an analysis request service may be provided for each classification. have. When a specific malicious code is selected after the request for analysis, the analysis system interface 400 sends an analysis request to the analysis system controller 300, and when the analysis environment configuration is completed in the detailed malware analysis unit 240, the analysis system interface ( In step 400, the analyst is connected to the generated analysis environment 241 of the detailed malware analysis unit 240.

Therefore, the malware management and analysis system according to the present invention prevents redundant analysis of analysts through the analysis system interface, and automates the analysis through the malware filtering unit, the action extraction unit, and the action analysis unit of the analysis system. Reducing the effort can effectively respond to malware. In addition, by opening and sharing the malicious code and analysis results, it is possible to reduce the inefficiency of the malicious code response and to cope with a large amount of malicious code by establishing a joint malicious code response system.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the equivalents of the claims, as well as the claims.

100: malware filtering unit
200: Malicious code analysis system
300: analysis system control unit
400: analysis system interface

Claims (15)

A malicious code filtering unit which checks whether the input malicious code is a previously analyzed malicious code and filters the previously analyzed malicious code;
A malicious code activity extracting unit configured to extract the behavior of the new malicious code and store it in an analysis database by executing the input new malicious code using a virtual environment when the identified malicious code is a new malicious code;
A malicious code behavior analysis unit that analyzes the behavior of the new malicious code by comparing the behavior of the new malicious code with the behavior of the malicious code previously stored in the analysis database;
Malware detailed analysis unit provides an environment for analyzing the behavior of the new malicious code malware analysts;
An analysis system interface unit for displaying at least one action of the analyzed malicious code, the malicious code to be analyzed, and the malicious code under analysis, requesting analysis of the new malicious code, and displaying analysis contents of the new malicious code; And
Analysis system control unit for controlling the analysis of the behavior of the new malicious code and configuring the analysis environment of the new malicious code
Including, malware management and analysis system. The method of claim 1,
The malicious code filtering unit,
And analyzing the pre-analyzed malicious code by calculating a hash value of the input malicious code and comparing it with pre-stored analysis information and a vaccine in the analysis database. The method of claim 1,
The malicious code behavior extraction unit,
Monitors and stores behaviors of virtual system control programs that execute and control computer hardware devices, kernels, and malicious codes in the virtual environment, virtual systems on which the identified malicious code is executed, and operating system objects occurring in the virtual systems. Malware management and analysis system comprising a. The method of claim 3,
The virtual system control program,
A program that executes the input malicious code in a different environment in the virtual system through a virtualization module interface, and returns the virtual system to an environment before the input malicious code is executed when the input malicious code is finished. Malware management and analysis system, characterized in that. The method of claim 3,
The act monitor,
The malware management and analysis system, characterized in that for monitoring the operation occurring on the operating system object and stored in a log file. The method of claim 5,
The operating system object,
Malware management and analysis system, characterized in that at least one of the process, memory, files, registry, network and system calls. The method of claim 3,
The virtual system,
A malicious code management and analysis system comprising executing the identified malicious code in a different kernel and execution environment through a virtualization module interface constituting a virtual computer environment in a real computer environment. The method of claim 1,
The malicious code behavior analysis unit,
Abstracts the log file generated by the malicious code activity extracting unit to determine behavior similarity with the malicious code stored in the analysis database, and when the behavior similarity is equal to or greater than a reference similarity, stores a hash value of the similar malicious code in the analysis database. Malware management and analysis system, characterized in that. The method of claim 1,
The analysis system interface unit,
The analysis system controller displays analysis information classified into the malicious code to be analyzed, the malicious code under analysis, and the analyzed malicious code among the information stored in the analysis database, and analyzes the malicious code to be analyzed and the malicious code under analysis. Malware management and analysis system, characterized in that requesting to. The method of claim 1,
The analysis system control unit,
Receiving the analysis request for the new malicious code, the analysis information previously stored in the analysis database is delivered to the detailed analysis section of the malicious code to build the virtual environment, characterized in that the control of the behavior analysis of the new malicious code Management and analysis system. Filtering the analyzed malicious code by checking whether the input malicious code is a previously analyzed malicious code;
If the identified malicious code is a new malicious code, extracting the behavior of the new malicious code by executing the input new malicious code using a virtual environment and storing it in an analysis database;
Analyzing the behavior of the new malicious code by comparing the behavior of the new malicious code with the behavior of the malicious code previously stored in the analysis database;
Providing an environment for malicious code analysts to analyze the behavior of the new malicious code; And
Displaying at least one action of the analyzed malicious code, the malicious code to be analyzed, and the malicious code under analysis and the analysis contents of the new malicious code;
Including, malware management and analysis method. 12. The method of claim 11,
Wherein the filtering step comprises:
Calculating the hash value of the input malicious code and comparing the analysis information and vaccine previously stored in the analysis database to filter the input malicious code if the input malicious code corresponds to the previously analyzed malicious code. Characteristic management and analysis method characterized by. 12. The method of claim 11,
Wherein the storing step comprises:
Monitoring and storing operations occurring on at least one of a process, a memory, a file, a registry, a network, and a system call of a virtual system on which the identified malicious code is executed, and storing the same as a log file. Way. 12. The method of claim 11,
The identified malicious code,
The malware management and analysis method, characterized in that executed in the different kernel and execution environment in the virtual environment. The method of claim 13,
After the storing step,
Abstracting the stored log file to determine behavioral similarity with malicious code stored in the analysis database; And
Storing a hash value of the similar malicious code in the analysis database when the behavior similarity is greater than or equal to a reference similarity.
Malware management and analysis method further comprising a.

Images