KR101369254B1 - Apparatus and method for detecting malicious application - Google Patents

Abstract

In the present invention, in diagnosing a malicious application in a mobile terminal such as an Android OS-based smartphone, after extracting only the manifest.mf file, which is a certificate file having hash information of all individual files included in the apk file of the application, By comparing the hash information of all the individual files in the apk file in the decompressed certificate file with the pre-stored signature hash information, it is possible to diagnose the malicious application more quickly and accurately while preventing performance degradation of the terminal.

Description

Apparatus and method for diagnosing malicious applications {APPARATUS AND METHOD FOR DETECTING MALICIOUS APPLICATION}

The present invention relates to the diagnosis of malicious applications, and in particular, in diagnosing malicious applications in a mobile terminal such as an Android OS-based smartphone, a certificate having hash information of all individual files included in an apk file that is an application installation file. After decompressing only the manifest.mf file, it compares the hash information of all the individual files in the apk file existing in the extracted certificate file with the pre-stored signature hash information to prevent malicious performance while reducing the performance of the device. The present invention relates to an apparatus and method for diagnosing malicious applications that enable rapid and accurate diagnosis.

Recently, with the development of mobile communication technology as well as wired and wireless Internet, mobile phones having various functions such as wireless internet function as well as telephone call function have been spreading. In particular, the smart phone (smartphone) has been spreading in recent years, it is possible to install a variety of applications such as multimedia playback function, users are using the smartphone for various purposes.

In general, a smart phone combines the advantages of a mobile phone and a personal digital assistant (PDA), and is implemented by integrating data communication functions such as schedule management, fax transmission, and Internet access. In general, a smart phone is equipped with a wireless communication module such as a Wi-Fi, so that data can be transmitted and received via the Internet. In addition to retrieving Internet information, characters can be input into a liquid crystal display using an electronic pen, .

Each of these smartphones has its own operating system, and application programs that can be executed by the operating system are being actively developed.

Among the operating systems of smartphones, the Android platform is an open source platform opened by Google's OHA (Open Handset Alliance). It is a Linux kernel, a virtual machine (VM) and a frame. Framework refers to a software package that includes both the application and the application.

As the expectation of users on the Android platform rises and the number of portable devices such as smartphones equipped with the Android platform increases due to the high response of the terminal manufacturers and mobile communication service providers, the Android application market has begun to be activated. Demand for Android applications is growing.

On the other hand, as the number of smartphone users equipped with the Android platform increases, malicious codes targeting the Android OS are also rapidly increasing, and the Android malware producers use various techniques learned in the existing PC environment to produce Android malicious applications. Reflecting, it is developing faster than that on PC.

In the past, the malicious application is typically produced by modifying the classes.dex and AndroidManifest.xml files included in the Android application APK file.

Accordingly, in order to detect Android malicious applications as described above, the apk file of the Android application is decompressed to detect a hash value for all apk decompressed files, and the detection is performed by comparing with a DB having a signature for the malicious application. .

(Patent Literature)

Korean Laid-Open Patent No. 2011-0084693 (published July 26, 2011)

However, in the conventional method of decompressing all apk files of an application to obtain hash information for all the decompressed files and diagnosing a malicious application based on the signature hash information, it takes a long time to decompress the apk file. As a result, there was a problem such as a decrease in the performance of the portable terminal.

Accordingly, in the present invention, in diagnosing a malicious application in a mobile terminal such as an Android OS-based smartphone, only the manifest.mf file, which is a certificate file having hash information of all individual files included in the apk file, which is an installation file of the application, is diagnosed. After the decompression, the hash information of all the individual files in the apk file existing in the decompressed certificate file and the pre-stored signature hash information are compared to prevent the performance degradation of the device and to diagnose the malicious application more quickly and accurately. To provide a device and method for diagnosing malicious applications.

The present invention described above is a malicious application diagnosis apparatus, and includes a signature DB storing normal or malicious signature hash information for an application that can be installed in a portable terminal, and extracting a manifest.mf file having hash information of the application from the application. It includes a certificate file extraction unit and a diagnostic unit for reading the hash information of the application from the extracted manifest.mf file and comparing the signature hash information previously stored in the signature database, and diagnosing whether the application is malicious.

The certificate file extracting unit may search for and extract the manifest.mf file from an apk file that is an installation file of the application.

The diagnostic engine unit may extract the hash information of the entire file of the application by extracting the manifest.mf file.

In addition, the manifest.mf file may be generated as one file inside an apk file, which is an installation file of the application, when the electronic signature for the application is performed.

In addition, the manifest.mf file is characterized in that the hash information of the entire file is stored in a text form.

In addition, the diagnostic engine unit, if one or more of the hash information of each of the individual files for all the files included in the application is found to match the normal signature hash information stored in the signature DB is found to be normal to the application. It is characterized by judging by the application.

In addition, the diagnostic engine unit, when one or more of the hash information of each of the individual files for all the files included in the application matches the malicious signature hash information stored in the signature DB is found to be malicious It is characterized by judging by the application.

In addition, the diagnostic engine unit may block the installation of the portable terminal for the application diagnosed as a malicious application or delete the application for the already installed application.

In addition, the portable terminal is characterized in that the electronic device equipped with the Android OS.

In addition, the application is characterized in that the application for Android OS.

In addition, as a method for diagnosing malicious applications, extracting a manifest.mf file having hash information of the application from an apk file of an application that can be installed in a portable terminal, and extracting the entire file of the application from the manifest.mf file. Reading the hash information, comparing whether the hash information of at least one of the hash information of all the files included in the application matches with the stored normal or malicious signature hash information, and comparing the result of the comparison And determining whether the application is malicious or not based on the above.

The determining may include searching whether one or more of the hash information for all the files of the application match the normal signature hash information, and one or more matches with the search results. The method may further include determining the application as a normal application.

The determining may include searching whether one or more pieces of the hash information of all the files of the application match the malicious signature hash information, and the files matching the hash information in the search result. If more than one is found, characterized in that it further comprises the step of determining the application as a malicious application.

In addition, if it is determined that the application is a malicious application, blocking the installation of the application to the portable terminal, and if the application is already installed in the portable terminal further comprises the step of deleting the application It features.

In addition, the manifest.mf file may be generated as one file inside an apk file of the application when the electronic signature for the application is performed.

In addition, the manifest.mf file is characterized in that the hash information of the entire file of the application is stored in a text form.

In the present invention, in diagnosing a malicious application in a mobile terminal such as an Android OS-based smartphone, only the manifest.mf file, which is a certificate file having hash information of all individual files included in an apk file, which is an application installation file, is extracted. Then, by comparing the hash information of all the individual files in the apk file existing in the decompressed certificate file with the stored signature hash information, it is possible to prevent malicious performance of the device and to diagnose the malicious application more quickly and accurately. have.

1 is a detailed block diagram of a malicious application diagnostic apparatus according to an embodiment of the present invention;
2 is a conceptual diagram of malicious application diagnosis according to an embodiment of the present invention;
3 is an operation control flowchart for diagnosing malicious applications according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings will be described in detail the operating principle of the present invention. In the following description of the present invention, when it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intentions or customs of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification.

Each block of the accompanying block diagrams and combinations of steps of the flowchart may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which may be executed by a processor of a computer or other programmable data processing apparatus, And means for performing the functions described in each step are created. These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible for the instructions stored in the block diagram to produce a manufacturing item containing instruction means for performing the functions described in each block or flowchart of the block diagram. Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible that the instructions that perform the processing equipment provide the steps for executing the functions described in each block of the block diagram and at each step of the flowchart.

Also, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order according to the corresponding function.

1 is a detailed block diagram of a diagnosis apparatus 100 for diagnosing a malicious application of a portable terminal according to an embodiment of the present invention. The certificate file extracting unit 102, the diagnosis engine unit 104, and a signature are performed. ) DB (database) 106 and the like. Such a portable terminal may include a terminal such as a smartphone and a tablet PC.

Hereinafter, an operation of each part of the malicious application diagnosis apparatus 100 of the present invention will be described in detail with reference to FIG. 1.

First, the signature DB 106 stores white signature hash information and / or malware signature hash information for an application installed in the portable terminal.

The certificate file extracting unit 102 extracts a certificate file having hash information of the application from among the decompressed files of the application with respect to an application newly downloaded or installed in the portable terminal.

All applications installed on the Android platform have an apk (android package) file format, which is a compressed file that has a Java jar format, and can be installed and executed on a portable terminal after digital signing.

In this case, when the above application is digitally signed, a manifest.mf file, which is a certificate file, is generated inside the apk file. The certificate file includes hash information of all files included in the apk file. This hash information can also be used, including SHA-1 hashes, other hash algorithms specified in the certificate, such as MD5 and SHA-256.

That is, the certificate file extracting unit 102 extracts a manifest.mf file, which is a certificate file having hash information of all files constituting the application among the files included in the apk file.

The diagnostic engine unit 104 decompresses the certificate file extracted from the certificate file extracting unit 102 to read hash information about all the files constituting the application, and stores a normal or malicious signature hash previously stored in the signature DB 106. After comparing the information, the application is diagnosed as malicious.

That is, the diagnosis engine unit 104 may determine that the application is a normal application when one or more matches with the normal signature hash information stored in the signature DB 106 are searched among the hash information of the entire file of the application. have. In addition, if one or more of the hash information about the entire file of the application matches with the malicious signature hash information is detected, it can be diagnosed as a malicious application.

In this case, the diagnosis engine unit 104 may block the installation of the mobile terminal for the application diagnosed as the malicious application as above, or delete the application for the already installed application.

2 illustrates an operation concept in a diagnostic apparatus for diagnosing malicious applications of a portable terminal according to an embodiment of the present invention.

Hereinafter, an operation of each part of the malicious application diagnosis apparatus 100 will be described once again with reference to FIG. 2.

As shown in FIG. 2, the apk file of the application installed on the Android platform must have AndroidManifest.xml, classes.dex, and resources.arsc files in the form of a folder in a subdirectory of the root directory 202. . At this time, there exists a manifest.mf file, which is a certificate file 204, which stores hash information of all individual files included in the [META-INF] directory.

That is, in the certificate file 204, as shown by reference numeral 210 of FIG. 2, hash information of all individual files included in the apk file is stored in the form of text.

The certificate file 204 is extracted by the certificate file extracting unit 102 and transferred to the diagnosis engine unit 104.

Then, the diagnostic engine unit 104 writes the hash information about all the individual files included in the apk file recorded in the text file in the certificate file 204, that is, the entire files constituting the application, to the signature DB 106. It compares the stored normal or malicious signature hash information and diagnoses whether the application is malicious.

That is, the diagnosis engine unit 104 may determine the application as a normal application when one or more matches with the normal signature hash information stored in the signature DB 106 among the hash information of the entire file, for example. In addition, if one or more of the hash information about the entire file of the application matches with the malicious signature hash information is detected, it can be diagnosed as a malicious application.

At this time, in diagnosing the malicious status of the conventional Android application, the time is increased by configuring the hash information of the entire file of the application by decompressing all the individual files included in the apk file and reading the hash information. It took a lot of time, and there was a problem that the performance of the terminal is deteriorated. Also, when the diagnosis is performed only on some files that are highly likely to be infected by malware, such as classes.dex and resoures.arsc, only a specific part of the file is checked. The risk of misdiagnosis is as described above.

Therefore, in the present invention, instead of collecting hash information of all individual files by decompressing all the individual files included in the apk file as described above, the hash information of all the individual files in the apk file is in text form. By decompressing only the certificate file 204, which is stored in the system, the hash information for the entire file of the application can be obtained, thereby greatly reducing the time required to construct the hash information, and also for the entire file (single file) for each file. By performing the diagnosis with the hash information for, it is possible to prevent the risk of misdiagnosis.

3 illustrates an operation control flow for diagnosing a malicious application in the apparatus 100 for diagnosing a malicious application according to an embodiment of the present invention. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 1, 2, and 3. FIG.

First, when a malicious application diagnosis for a portable terminal is requested, the diagnostic engine unit 104 of the diagnostic apparatus 100 searches for an application having an apk file format by performing file type analysis on files installed in the portable terminal ( S300, S302).

In this case, when an application having an apk file format is searched, the diagnostic engine unit 104 decompresses a mankfest.mf file, which is a certificate file 204 having hash information about the entire file of the application, from the apk file of the corresponding application. (S304). At this time, the manifest.mf file, which is the certificate file 204 as described above, may be extracted from the certificate file extractor 102 and provided to the diagnostic engine 104.

In the certificate file 204, as shown by reference numeral 210 of FIG. 2, hash information of all individual files included in the apk file is stored in a text form, and the diagnosis engine unit 104 stores the certificate file 204. Hash information is read for all individual files included in the apk file recorded in text form, that is, the entire files constituting the application (S306).

Subsequently, the diagnostic engine unit 104 may match one or more signature hash information previously stored in the signature DB 106 among the hash information of the entire file of the application read from the certificate file 204. After searching whether it is, it is determined whether the application is malicious or normal (S308).

That is, the diagnostic engine unit 104, for example, if one or more of the hash information for all the files included in the application matches the normal signature hash information stored in the signature DB 106, the application as a normal application. Diagnosis can be made. In addition, if one or more of the hash information of all files included in the application match the malicious signature hash information, the application may be diagnosed as a malicious application.

Subsequently, the diagnosis engine unit 104 may block the installation of the corresponding application diagnosed as the malicious application as described above with respect to the portable terminal or delete the corresponding application for the already installed application (S310). ).

As described above, in the present invention, in diagnosing a malicious application in a mobile terminal such as an Android OS-based smartphone, only the manifest.mf file, which is a certificate file having hash information of all individual files included in the apk file of the application, is diagnosed. After decompression, by comparing the hash information of all the individual files in the apk file existing in the decompressed certificate file with the stored signature hash information, it is possible to diagnose the malicious application more quickly and accurately while preventing the performance degradation of the terminal. .

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Accordingly, the scope of the invention should not be limited by the described embodiments but should be defined by the appended claims.

102: certificate file extraction unit 104: diagnostic engine unit
106: Signature DB

Claims (16)

A signature database storing normal signature hash information or malicious signature hash information for an application that can be installed in a portable terminal;
A certificate file extraction unit for searching for and extracting a manifest.mf file having hash information of the application from an apk file that is an installation file of the application;
Decompress the extracted manifest.mf file to extract the hash information of the entire file of the application, read it, compare it with the signature hash information previously stored in the signature database, and diagnose whether the application is malicious Engine part
Malicious application diagnostic device comprising a.
delete delete The method of claim 1,
The manifest.mf file is
Malicious application diagnostic apparatus characterized in that when the electronic signature for the application is created as a file inside the apk file that is the installation file of the application.
The method of claim 1,
The manifest.mf file is
Malicious application diagnostic device, characterized in that for storing the hash information for the entire file in the form of a text.
The method of claim 1,
The diagnostic engine unit,
If one or more matching hash signature information stored in the signature database is found among the hash information of each individual file of all files included in the application, the application is determined as a normal application. Malicious application diagnostic device.
The method of claim 1,
The diagnostic engine unit,
If one or more of the hash information of each file of each file included in the application matches with the malicious signature hash information stored in the signature database, the application is determined to be a malicious application. Malicious application diagnostic device.
The method of claim 7, wherein
The diagnostic engine unit,
Apparatus for diagnosing a malicious application characterized in that the installation of the portable terminal is blocked for the application diagnosed as a malicious application or deletes the application for an already installed application.
The method of claim 1,
The portable terminal includes:
Malicious application diagnostic device, characterized in that the electronic device equipped with Android OS.
The method of claim 1,
The application comprises:
Malicious application diagnostic device, characterized in that the application for Android OS.
Extracting a manifest.mf file having hash information of the application from an apk file of an application installable on the portable terminal,
Decompressing the manifest.mf file and reading hash information of the entire file of the application;
Comparing at least one of the hash information of all the files included in the application with the stored normal or malicious signature hash information;
Determining whether the application is malicious or normal based on the comparison result
Malicious application diagnostic method comprising a.
The method of claim 11,
The determining step,
Retrieving whether one or more of the hash information for all the files of the application match the normal signature hash information.
Determining that the application is a normal application when one or more matches with the search result is found.
Malicious application diagnostic method characterized in that it further comprises.
The method of claim 11,
The determining step,
Retrieving whether one or more of the hash information for all the files of the application match the malicious signature hash information;
Determining that the application is a malicious application when one or more files matching the hash information are found in the search result
Malicious application diagnostic method characterized in that it further comprises.
14. The method of claim 13,
If it is determined that the application is a malicious application, blocking the installation of the application to the portable terminal;
Deleting the application if the application is already installed in the portable terminal;
Malicious application diagnostic method characterized in that it further comprises.
The method of claim 11,
The manifest.mf file is
Malicious application diagnostic method characterized in that when the electronic signature for the application is generated as a file inside the apk file of the application.
The method of claim 11,
The manifest.mf file is
Malicious application, characterized in that for storing the hash information for the entire file of the application in the form of a text.

Images