KR101619059B1 - Apparatus, system and method for generation and distribution lightweight signature - Google Patents

Abstract

Provides are malicious script signature management apparatus, system and method. The malicious script signature management apparatus comprises: a detection information analysis unit which receives first detection information related to a malicious code, computes a detection hit rate for an existing first signature, and generates second detection information; a signature generation unit which receives the second detection information, and generates a second signature; and a signature distribution management unit which receives the second signature, distributes the second signature to an external system, and manages a distribution cycle related to the second signature.

Description

[0001] Apparatus, system and method for generation and distribution of lightweight signatures for malicious script detection [

The present invention relates to a lightweight signature generation and distribution apparatus, system, and method for malicious script detection.

In order to secure the network, it is necessary to grasp the characteristics of attack packets first. When the registered signature is registered in the received packet, the corresponding security policy is applied to protect the target network from the malicious user or program by registering the characteristics of the attack packet as a signature.

Most of the techniques for extracting the characteristics of attack packets on the network are based on techniques for checking or classifying the similarity of electronic documents including web documents on the Internet. In order to check the similarity between vast amounts of electronic documents, it is first necessary to briefly describe the characteristics of each document. By comparing these simplified documents, the amount of computation required to verify similarity can be minimized.

Korean Patent Publication No. 2010-0073134 discloses an apparatus and a method for determining string inclusion for an automatic signature generation system.

A problem to be solved by the present invention is to provide a malicious script signature management apparatus capable of collecting traffic information and source information for a malicious script and generating, distributing and managing the signature based on the collected malicious script.

Another problem to be solved by the present invention is to provide a malicious script signature management system capable of collecting traffic information and source information for a malicious script and generating, distributing and managing the signature based on the collected malicious script.

Another object of the present invention is to provide a malicious script signature management method capable of collecting traffic information and source information on a malicious script and generating, distributing, and managing signatures based on the collected malicious script .

The problems to be solved by the present invention are not limited to the above-mentioned problems, and other matters not mentioned can be clearly understood by those skilled in the art from the following description.

According to an aspect of the present invention, there is provided an apparatus for managing malicious script signatures, the apparatus comprising: a first detection unit configured to detect first malicious code, A signature generating unit for receiving the second detection information and generating a second signature, and distributing the second signature to the external system by receiving the second signature, and distributing the second signature to the external system, And a signature distribution management unit for managing the period.

In some embodiments of the present invention, the detection information analyzing unit includes a detection information extracting unit and a detection accuracy ratio calculating unit. The detection information extracting unit extracts a first ID of the first signature from the first detection information, The detection hit rate calculation unit may receive the detection frequency information about the first signature from the detection information storage unit using the first ID and calculate a detection hit rate.

In some embodiments of the present invention, the signature generation unit includes a script clustering unit, the script clustering unit extracts a newly detected second script from the second detection information, and detects a first detected script from the first signature And clustering the first and second scripts to create a cluster.

In some embodiments of the present invention, the signature generator may further include an association signature generator, and the association signature generator may generate a binding signature based on the cluster.

In some embodiments of the present invention, the signature generator further includes a signature refiner, and the signature refiner may refine the combiner signature to reduce the code length of the combiner signature.

In some embodiments of the present invention, the signature generator may further include a signature type conversion unit, and the signature type conversion unit may convert the combined signature whose code length is reduced to the second signature that operates in a specific module.

In some embodiments of the present invention, the signature distribution management module includes an active signature inquiry module and a signature distribution module, and the active signature inquiry module is provided with the second signature from the active signature store, The system information storage unit can be inquired to determine the distribution cycle for the second signature.

According to another aspect of the present invention, there is provided a malicious script signature management system for analyzing a first script included in a web page using a first signature or a second signature, A malicious script detection interception device for processing the first script according to an analysis result and generating and storing the first or second signature, and if the first or second signature is detected by the malicious script detection interception device upon request, 2 signature, wherein the first signature includes code pattern information of a maliciously-detected script, and the second signature is based on first detection information about the first script And calculating a detection hit ratio of the first signature.

In some embodiments of the present invention, the malicious script signature management apparatus includes a detection information analysis unit, a signature generation unit, and a signature distribution management unit, and the detection information analysis unit may receive the first detection information, The signature generation unit generates the second signature by receiving the second detection information, and the signature distribution management unit receives the second signature, calculates the detection probability of the signature, generates the second detection information, Distribute the second signature to the malicious script detection interception device, and manage the distribution period for the second signature.

In some embodiments of the present invention, the detection information analyzing unit includes a detection information extracting unit and a detection ratio calculating unit, and the detection information extracting unit extracts a first ID related to the first signature from the first detection information , The detection hit rate calculation unit may receive the detection frequency information on the first signature from the detection information storage unit using the first ID and calculate the detection hit rate.

In some embodiments of the present invention, the signature generation unit includes a script clustering unit, a combination signature generation unit, a signature refinement unit, and a signature type conversion unit. The script clustering unit combines the first script And a second script detected as a malicious code are clustered to generate a cluster, and the combination signature generation unit generates a combination signature based on the cluster, and the signature refinement unit refines the combination signature, And the signature type conversion unit may convert the combining signatures whose code length is reduced to the second signature operating in a specific module.

In some embodiments of the present invention, the signature distribution management module includes an active signature inquiry module and a signature distribution module, wherein the active signature inquiry module is provided with the second signature from the active signature store, Can inquire the system information storage unit to determine the distribution period for the second signature.

According to another aspect of the present invention, there is provided a method for managing malicious script signatures, comprising the steps of: detecting first malicious code detection information, Generating second detection information based on a hit ratio, generating a second signature by receiving the second detection information, and distributing the second signature to an external system, wherein the first signature includes And the second signature is generated by clustering a new malicious script extracted from the second detection information and a previously detected malicious script extracted from the first signature.

In some embodiments of the present invention, generating the second signature comprises generating a binding signature based on the clustering applied clustering, refining the binding signature to reduce the code length of the binding signature, And converting the combined signature to a second signature operating in a particular module.

In some embodiments of the present invention, distributing the second signature may set a distribution period for the second signature and may be distributed according to the set distribution period.

Other specific details of the invention are included in the detailed description and drawings.

According to the malicious script signature management apparatus, system, and method according to the present invention, traffic information and source information on a malicious script can be collected and a signature can be generated, distributed, and managed based on the collected malicious script.

1 is a schematic block diagram of a malicious script signature management system according to an embodiment of the present invention.
2 is a block diagram illustrating a detailed module included in the malicious script signature management apparatus of FIG.
3 is a block diagram illustrating a detailed module included in the detection information analysis unit of FIG.
4 is a flowchart for explaining the operation of the detection information extracting unit included in the detection information analyzing unit.
5 is a flowchart for explaining the operation of the detection hit ratio calculation unit included in the detection information analysis unit.
FIG. 6 is a block diagram illustrating the detail module included in the signature generation unit of FIG. 2. FIG.
7 is a flowchart for explaining the operation of the signature generation unit.
8 is a flowchart for explaining the operation of the script clustering unit included in the signature generation unit.
9 is a flowchart for explaining the operation of the combined signature generation unit included in the signature generation unit.
10 is a flowchart for explaining the operation of the signature refiner included in the signature generator;
11 is a flowchart for explaining the operation of the signature type conversion unit included in the signature generation unit.
FIG. 12 is a block diagram showing a detailed module included in the signature distribution management unit of FIG. 2. FIG.
13 is a flowchart sequentially illustrating a malicious script signature management method according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Each block may represent a portion of a module, segment, or code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative implementations the functions mentioned in the blocks may occur out of order. For example, two blocks that are shown one after the other may actually be executed substantially concurrently, or the blocks may sometimes be performed in reverse order according to the corresponding function.

Although the first, second, etc. are used to describe various elements, components and / or sections, it is needless to say that these elements, components and / or sections are not limited by these terms. These terms are only used to distinguish one element, element or section from another element, element or section. Therefore, it goes without saying that the first element, the first element or the first section mentioned below may be the second element, the second element or the second section within the technical spirit of the present invention.

The terminology used herein is for the purpose of illustrating embodiments and is not intended to be limiting of the present invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. It is noted that the terms "comprises" and / or "comprising" used in the specification are intended to be inclusive in a manner similar to the components, steps, operations, and / Or additions.

Unless defined otherwise, all terms (including technical and scientific terms) used herein may be used in a sense commonly understood by one of ordinary skill in the art to which this invention belongs. Also, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise.

1 is a schematic block diagram of a malicious script signature management system according to an embodiment of the present invention. 2 is a block diagram illustrating a detailed module included in the malicious script signature management apparatus of FIG. 3 is a block diagram illustrating a detailed module included in the detection information analysis unit of FIG. 4 is a flowchart for explaining the operation of the detection information extracting unit included in the detection information analyzing unit. 5 is a flowchart for explaining the operation of the detection hit ratio calculation unit included in the detection information analysis unit. FIG. 6 is a block diagram illustrating the detail module included in the signature generation unit of FIG. 2. FIG. 7 is a flowchart for explaining the operation of the signature generation unit. 8 is a flowchart for explaining the operation of the script clustering unit included in the signature generation unit. 9 is a flowchart for explaining the operation of the combined signature generation unit included in the signature generation unit. 10 is a flowchart for explaining the operation of the signature refiner included in the signature generator; 11 is a flowchart for explaining the operation of the signature type conversion unit included in the signature generation unit. FIG. 12 is a block diagram showing a detailed module included in the signature distribution management unit of FIG. 2. FIG.

Hereinafter, a malicious script signature management system according to the present invention will be described. Prior to the description, terms used in the following description are defined as follows. A signature is a pattern information used for detecting a malicious script in a script analysis engine, and is defined as an object having pattern information about a malicious script that has been detected. A token is defined as a language element with a specific meaning. The binding signature extracts a common token between the script to be combined and defines it as a generated signature by combining them. The YARA signature is a tool used for malware detection in the YARA module, which is a signature that contains the detection rules of the YARA module. The IDS signature is a tool used in the IDS (Intrusion Detection System), which is a signature that includes detection rules of the IDS. Call Trace is a signature created by normalizing the call flow information of the API that is called during the detection operation and adding PageRank. The TF-IDF (Term Frequency-Inverse Document Frequency) is a method of quantifying the frequency of occurrence of a specific word in a document in order to determine the importance of a specific word in the document. The active signature is the signature to be distributed to the external system. Inactive signatures are signatures that are not distributed to external systems.

Referring to FIG. 1, a malicious script signature management system 1 according to an embodiment of the present invention includes a malicious script detection blocking apparatus 100 and a malicious script signature management apparatus 200.

The malicious script signature management system 1 generates a new signature suitable for a new malicious script which can not be detected as an existing signature by using the existing malicious script information and the existing signature detection information detected by the malicious script detection interception apparatus 100 , And distributes a signature having a high detection hit ratio to an external system for an existing signature. The malicious script signature management system 1 is not dependent on a specific network but operates to manage malicious scripts and signatures by receiving detection information and periodically provide signatures to external systems.

The malicious script detection interception device 100 serves to detect a malicious script. The malicious script detection blocking device 100 performs an operation of receiving a signature from the malicious script signature management device 200 to detect a malicious script. The result of detecting the malicious script is provided again to the malicious script signature management device 200 And is reflected in the signatures generated later. A detection operation can be performed on the malicious script which has been deformed or polymorphized by using the signature generated later.

The malicious script signature management system 1 performs a signature generation function, a detection information collection / analysis function, and a signature distribution function. The signature is created by overlapping and clustering malicious script newly detected by an external system with malicious script that has been detected previously, generating a combined signature based on a clustered cluster, And to convert the combined signature with reduced code length into a YARA signature or an IDS signature. The generated YARA signature and IDS signature are stored in the signature store. For malicious scripts manually entered by the administrator, a call trace is generated and stored in the signature storage.

The collection / analysis of the detection information is performed by collecting / analyzing the detection information provided by the external system, authenticating whether the information provided from the external system registered is correct, classifying the detection information only when the information is authenticated, Select the API to call. When detecting using the existing signature, the detection hit ratio of the signature is calculated using the detection information.

Deploying signatures distributes the active signatures to an external system according to a predefined distribution cycle. Signature deployments include batch deployments, floating deployments where only variant signatures are deployed, and emergency deployments due to a sudden increase in certain malicious scripts.

The detailed module of the malicious script signature management apparatus 200 will be described in detail with reference to FIG. 2 to FIG.

The malicious script signature management apparatus 200 includes a detection information analysis unit 210, a signature generation unit 220, and a signature distribution management unit 230.

The detection information analysis unit 210 receives the first detection information DI1 related to the malicious code and calculates the detection hit ratio of the first signature SN1 that exists and generates the second detection information DI2. Here, the first detection information DI1 means information provided according to the result of detecting malicious script code from the malicious script detection interception apparatus 100. [ That is, the first detection information DI1 includes, for example, malicious script information, malicious action information, signature ID information, obfuscation information, MPO IP information, MPO Port information, network protocol information of the MPO, (Hereinafter the same).

Also, the first signature SN1 is a signature including code pattern information of a maliciously-detected script and means a code pattern to be compared at the time of static analysis (the same applies hereinafter).

The second detection information DI2 includes malicious script information, malicious behavior information, signature ID information, obfuscation information, spreader IP information, spread port information, network protocol information of the spreader, detection time information, (Hereinafter the same).

The detection information analysis unit 210 may include a detection information extraction unit 211, a detection hit ratio calculation unit 212, and a detection information storage unit 213.

The detection information extraction unit 211 extracts the first ID ID1 of the first signature SN1 from the first detection information DI1 and provides the first ID ID1 to the detection hit ratio calculation unit 212 .

4, when the input data is event information (EI), the detection information extracting unit 211 determines whether the input data corresponds to the event information EI Record the event and exit. The detection information extraction unit 211 calls the detection hit ratio calculation unit 212 when the input data is the first detection information DI1 and the second detection information RTI ID = 0.0 > DI2 < / RTI >

The detection hit ratio calculation unit 212 receives the detection frequency information DFI related to the first signature SN1 from the detection information storage unit 213 using the first ID ID1 and uses the detection frequency information DFI And calculates a detection hit ratio of the first signature SN1.

5, the detection hit ratio calculation unit 212 receives a first ID (ID1) related to the first signature SN1 and receives the first ID (ID1) from the detection information storage unit 213 using the first ID (ID1) The existing detection hit ratio information is inquired. Then, the detection frequency information DFI of the period to be calculated is inquired using the first ID (ID1). The detection hit ratio is calculated according to the mathematical expression of (latest frequency / (latest frequency + past frequency)) * 10 using the detected detection frequency information (DFI). For example, the recent period can be set to one week, and the past period can be set to three months. The computed detection hit ratio is stored in the system information storage unit DB2.

The signature generator 220 receives the second detection information DI2 and generates a second signature SN2.

The signature generating unit 220 may include a script clustering unit 221, a combining signature generating unit 222, a signature refining unit 223, and a signature type converting unit 224. [

Specifically, referring to FIG. 7, the operation of the signature generation unit 220 varies according to the type of input data. If the input data is the malicious script information entered by the administrator, call trace is generated in the call trace module. Then, when the input data is the newly detected second script SC2 extracted from the second detection information DI2, generation of a YARA signature and an IDS signature are performed through script clustering, combining signature generation, signature refinement and signature type conversion. do.

Hereinafter, a specific operation of the detailed module of the signature generation unit 220 will be described.

The script clustering unit 221 receives the second detection information DI2 and extracts a second detected script SC2 from the second detection information DI2 and detects the second detected script DI2 from the first signature SN1 One script (SC1) is extracted, and the first script (SC1) and the second script (SC2) are clustered to generate the cluster (C).

Specifically, referring to FIG. 8, the script clustering unit 221 receives the second detection information DI2 and extracts a newly detected second script SC2. Then, the second script SC2 is classified as malicious and obfuscated, and the portion of the second script SC2 that actually acts as malicious is extracted. Then, remove the annotations of the extracted parts, and substitute specific values for elements having the same contents but different contents, such as IP. Extract the tokens based on the extracted part. Removes a normal token (for example, a function) and a token of three or fewer characters from the extracted tokens. Computes the TF-IDF value of the remaining tokens, and vectorizes the value. You can use Lucene, which is open source. And the length of the generated vector is normalized to be 1. Then, it is confirmed whether or not the cluster exists in the item classified as malicious behavior and obfuscation. If there is no cluster, a new cluster is formed. In the case of a cluster, the transformation distance reflecting the network information is calculated for each script of the cluster using the TF-IDF vector to search for the closest existing script. When the distance between the cluster containing the closest existing script and the new script is less than the set value, the new script is merged into the cluster. If the set value is exceeded, a new cluster is created.

The combining signature generation unit 222 generates a combining signature US based on the cluster C. [

Specifically, referring to FIG. 9, the combining signature generation unit 222 receives clustering information as input data. In this case, the clustering information may include a clustering number, a corresponding clustering CF (number of scripts, a linear sum, a square sum), and the like. The binding signature generation unit 222 queries the malicious script in the same cluster based on the clustering number. Extract a common token between all scripts in the cluster to which the new script has been added. The combination of the extracted common tokens is the binding signature (US). In script clustering, replace the same-form token that you replace with a regular expression that can represent a type. The combining signature generating unit 222 outputs the input clustering information and the combining signature US.

The signature refinement section 223 refines the binding signature US to reduce the cord length of the binding signature US.

Specifically, referring to FIG. 10, the signature refinement unit 223 receives clustering information and a combination signature US as input data. Then, remove duplicate tokens contained in other tokens. It preprocesses the core token that should not be deleted in the subsequent process. After confirming that the tablets using the TF-IDF are set, the tablets having the TF-IDF value less than 10% of the largest TF-IDF value of the corresponding signature are refined. If the signature is set to be greater than 0.9 and the JACCARD similarity to the existing signatures is greater than 0.9, a duplicate part of the two signatures is used to make one signature, and the remaining two signatures are deleted. Lt; / RTI > The signature refinement unit 223 outputs the input clustering information and the combination signature US that performed the refinement.

The signature type conversion unit 224 converts the refined join signature US into a second signature SN2 that operates in a specific module (e.g., YARA, IDS).

Specifically, referring to FIG. 11, the signature type conversion unit 224 receives the clustering information and the combination signature US performed as the input data. Then, the binding signature (US) is generated with the YARA signature. Add network information that is meta information to the YARA signature with the META option. Converts YARA signatures to IDS signatures. The signature type conversion unit 224 outputs a YARA signature and an IDS signature together with the received clustering information and the combination signature US.

The signature distribution management unit 230 receives the second signature SN2 and distributes the second signature SN2 to the malicious script detection blocking apparatus 100 and transmits the second signature SN2 to the malicious script detection blocking apparatus 100. [ As shown in FIG.

The signature distribution management unit 230 may include an active signature inquiry module 231 and a signature distribution module 232. [

12, the active signature inquiry module 231 receives the second signature SN2 from the active signature storage DB1 and provides the second signature SN2 to the signature deployment module 232 . At this time, the active signature inquiry module 231 inquires the corresponding active signature from the active signature storage DB1 using the LUV inputted through the signature API. When LUV is 0, all active signatures are inquired, and when LUV is n, all active signatures whose LUV is (n + 1) or more are inquired.

The active signature inquiry module 231 compresses the inquired active signature into a ZIP and provides it to the signature distribution module 232.

The signature distribution module 232 inquires the system information storage unit DB2 to determine the distribution period DP related to the second signature SN2 and transmits the distribution period DP to the malicious script detection / And distributes the second signature SN2.

Hereinafter, a malicious script signature management method according to an embodiment of the present invention will be described.

13 is a flowchart sequentially illustrating a malicious script signature management method according to an embodiment of the present invention.

Referring to FIG. 13, a malicious script signature management method according to an embodiment of the present invention includes: receiving first detection information DI1 regarding a malicious code and detecting a detection hit rate of an existing first signature SN1 (S100).

Receives the first ID (ID1) related to the first signature SN1 and inquires the existing detection hit ratio information in the detection information storage unit 213 using the first ID (ID1). Then, the detection frequency information DFI of the period to be calculated is inquired using the first ID (ID1). The detection hit ratio is calculated according to the mathematical expression of (latest frequency / (latest frequency + past frequency)) * 10 using the detected detection frequency information (DFI).

Subsequently, the second detection information DI2 is generated based on the detection hit ratio of the first signature SN1 (S110).

The second detection information DI2 includes malicious script information, malicious action information, signature ID information, obfuscation information, spoof IP information, spread port information, network protocol information of the spoof, detection time information, detection hit ratio calculation information, .

Then, the second signature SN2 is generated by receiving the second detection information DI2 (S120).

When the input data of the signature generating unit 220 is the newly detected second script SC2 extracted from the second detection information DI2, script clustering, join signature generation, signature refinement, signature type conversion, and YARA signature , An IDS signature can be generated.

Then, the second signature SN2 is distributed to the external system (S130).

The signature distribution module 232 inquires the system information storage unit DB2 to determine the distribution period DP related to the second signature SN2 and transmits the distribution period DP to the malicious script detection / The second signature SN2 can be distributed.

The steps of a method or algorithm described in connection with the embodiments of the invention may be embodied directly in hardware, software modules, or a combination of the two, executed by a processor. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, a hard disk, a removable disk, a CD-ROM, or any form of computer readable media known in the art Lt; / RTI > An exemplary recording medium is coupled to a processor, which is capable of reading information from, and writing information to, the recording medium. Alternatively, the recording medium may be integral with the processor. The processor and the recording medium may reside in an application specific integrated circuit (ASIC). The ASIC may reside within the user terminal. Alternatively, the processor and the recording medium may reside as discrete components in a user terminal.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, You will understand. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

100: Malicious script detection blocker
200: malicious script signature management device
210: Detection Information Analysis Unit
220: Signature Generator
230: Signature Distribution Management Section

Claims (15)

A detection information analyzer for receiving first detection information on malicious code to calculate a detection hit rate of a first signature existing and generating second detection information;
A signature generator for receiving the second detection information and generating a second signature; And
And a signature distribution manager for receiving the second signature and distributing the second signature to an external system, and managing a distribution cycle of the second signature,
Wherein the detection information analyzing unit includes a detection information extracting unit and a detection ratio calculating unit,
Wherein the detection information extraction unit extracts a first ID related to the first signature from the first detection information,
The detection hit ratio calculation unit receives the detection frequency information on the first signature from the detection information storage unit using the first ID and calculates a detection rate information of the first signature using a mathematical expression (a / (a + b) Wherein a includes detection frequency information between a current time point and a first past time point, b includes detection frequency information between a current time point and a second past time point, and a second past time point includes detection frequency information between a current time point and a second past time point, Wherein the malicious script signature management device is a time point before the first past time point. delete The method according to claim 1,
Wherein the signature generation unit includes a script clustering unit,
Wherein the script clustering unit extracts a second script newly detected from the second detection information, extracts a first script detected from the first signature, clusters the first and second scripts to generate a cluster, Script signature management device. The method of claim 3,
Wherein the signature generator further comprises a combining signature generator,
Wherein the combined signature generation unit generates a combined signature based on the cluster. 5. The method of claim 4,
Wherein the signature generator further comprises a signature refiner,
And the signature refinement unit refines the binding signature to reduce the code length of the binding signature. 6. The method of claim 5,
Wherein the signature generation unit further includes a signature type conversion unit,
Wherein the signature type conversion unit converts the combined signature having a reduced code length into the second signature operating in a specific module. The method according to claim 1,
Wherein the signature distribution management section includes an active signature inquiry module and a signature distribution module,
Wherein the active signature inquiry module receives the second signature from the active signature store,
Wherein the signature distribution module inquires a system information storage unit to determine a distribution cycle for the second signature. A malicious script detection and blocking device for analyzing a first script included in a web page using first or second signatures, determining whether a malicious script exists in the first script, ; And
A malicious script signature management apparatus for generating and storing the first or second signature and providing the first or second signature to the malicious script detection interception apparatus upon request,
Wherein the first signature includes code pattern information of a maliciously-detected script,
Wherein the second signature is generated by computing a detection hit ratio of the first signature based on first detection information about the first script,
The detection hit rate is calculated according to a formula (a / (a + b)) * 10 using the detection frequency information about the first signature, and a is the detection frequency information between the current time and the first past time And b is the detection frequency information between the current time and the second past time point, and the second past time point is before the first past time point. 9. The method of claim 8,
Wherein the malicious script signature management apparatus includes a detection information analysis unit, a signature generation unit, and a signature distribution management unit,
The detection information analyzing unit receives the first detection information, calculates a detection hit ratio of the first signature, generates second detection information,
Wherein the signature generator generates the second signature by receiving the second detection information,
Wherein the signature distribution management unit receives the second signature, distributes the second signature to the malicious script detection blocking apparatus, and manages a distribution cycle for the second signature. delete 10. The method of claim 9,
Wherein the signature generation unit includes a script clustering unit, a combining signature generation unit, a signature refinement unit, and a signature type conversion unit,
The script clustering unit clusters the first script newly detected as a malicious code and the second script detected as a malicious code to generate a cluster,
Wherein the combining signature generation unit generates a combining signature based on the cluster,
The signature refiner may refine the binding signature to reduce the code length of the binding signature,
Wherein the signature type conversion unit converts the combined signature having a reduced code length into the second signature operating in a specific module. 10. The method of claim 9,
Wherein the signature distribution management section includes an active signature inquiry module and a signature distribution module,
Wherein the active signature inquiry module receives the second signature from the active signature store,
Wherein the signature distribution module inquires of the system information storage unit to determine a distribution cycle of the second signature. delete delete delete

Images