KR101790761B1 - Process evaluation method based on user actions - Google Patents

Abstract

A process evaluation method based on user behavior is disclosed. A method for evaluating security for a process performed in a computer device according to an aspect of the present invention includes: confirming that an executed process is not registered in a preset whitelist; Performing a user action determination for determining whether or not the execution process is executed by a user action, and a user confirmation for checking whether the execution process is an intended execution by inquiring the user; And calculating the process evaluation score using the action score according to the action judgment and the feedback score according to the user's confirmation.

Description

[0001] The present invention relates to a process evaluation method based on user actions,

The present invention relates to a process evaluation method based on user behavior for selecting a malicious process.

In recent years, personal users' computers have become large-capacity as well as processing speeds have increased, resulting in personal work such as technical data, design drawings, development data, test data, sales data, production data, military classified data, Public work data are stored and managed on personal computers.

However, in recent years, not only malicious codes that prevent some of the computing devices or hardware of the computing device from functioning properly, but also to prevent leakage of important data to the outside or to encrypt the files, Modifying malicious code is becoming a problem. Such a malicious code, regardless of the user's command, drives the process itself and forge or leaks the file. As a result, not only personal information but also business-critical data is damaged or leaked.

Korean Patent Publication No. 10-2016-0030385 (Published Date March 17, 2016) Process evaluation for detecting malware in a virtual machine

SUMMARY OF THE INVENTION Accordingly, the present invention has been made keeping in mind the above problems occurring in the prior art, and an object of the present invention is to provide a process evaluation method based on a user's behavior in order to select a malicious process that performs leakage or corruption of information.

Other objects of the present invention will become more apparent through the following preferred embodiments.

According to an aspect of the present invention, there is provided a method for evaluating security for a process performed in a computer device, comprising: confirming that an executed process is not registered in a preset whitelist; Performing a user action determination to determine whether the execution process is executed by a user action and a user confirmation to inquire a user to confirm whether the execution process is an intended execution; And calculating a process evaluation score using an action score in accordance with the action judgment and a feedback score in accordance with the user's confirmation, and a program for performing the process evaluation method and method, / RTI >

Here, the action score can be calculated by checking whether the execution process is executed by at least one of a UI interaction, a window sub-process, or a predetermined automatic connection program.

Further, the calculation of the feedback score may include: outputting an interface screen for confirming the user including information on the execution process; And calculating the feedback score according to input information from a user. The time required until the input information is input after outputting the interface screen can be used to calculate the feedback score.

In addition, the feedback score may be weighted according to a user class received from a preset management server.

Furthermore, the user rating can be determined according to the accuracy calculated based on the evaluation history.

In addition, the risk degree according to whether the execution process has accessed or forged the predetermined object file can be calculated and reflected in the process evaluation score.

In addition, the present invention provides a method for evaluating a process performed by a management server, the method comprising: managing a whitelist for a safety process and providing related information to predetermined computing devices; Each of the computing devices confirms that the execution process is not registered in the preset whitelist, and judges whether the execution process is executed by the user action, Receiving evaluation information including the normally executed process information and the process evaluation score when the process evaluation score is calculated using the feedback score according to the user confirmation for confirming whether or not the process execution score is an intended execution; Calculating a final evaluation score according to the evaluation target process based on the evaluation information received from the computing devices; And determining whether to register the evaluation subject process in the whitelist according to the final evaluation score. A computer-readable recording medium on which a program for performing the process evaluation method is provided is provided.

Here, the final evaluation score can be calculated by reflecting the weight of each user information of the plurality of computing devices providing evaluation information on the process to be evaluated to the respective process evaluation scores.

In addition, the user class can be determined according to the accuracy calculated based on the evaluation history.

In addition, the computing device may calculate the action score by checking whether the execution process is executed by at least one of a UI interaction, a window shell subprocess, or a predetermined automatic connection program.

The computing device outputs an interface screen for confirming the user including information on the execution process, calculates the feedback score according to input information from the user, and outputs the interface screen, The time required until the input of the information can be used for calculating the feedback score.

According to the present invention, it is possible to efficiently construct a whitelist by evaluating a process based on a user's behavior, and more accurate evaluation can be performed based on the behavior of a plurality of users.

FIG. 1 and FIG. 2 are flowcharts illustrating a process of evaluating a process using a user action performed in a computing device according to each embodiment of the present invention.
3 is a schematic diagram illustrating an overall system for process evaluation based on the behavior of a plurality of users according to an embodiment of the present invention;
4 is an exemplary diagram illustrating a user rating in an embodiment of the present invention;
5 is a flowchart illustrating a process of evaluating a process using a plurality of user actions according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, terms such as a first threshold value, a second threshold value, and the like which will be described later may be previously designated with threshold values that are substantially different from each other or some of which are the same value, Because there is room, the terms such as the first and the second are to be mentioned for convenience of division.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like refer to the presence of stated features, integers, steps, operations, elements, components, or combinations thereof, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

It is to be understood that the components of the embodiments described with reference to the drawings are not limited to the embodiments and may be embodied in other embodiments without departing from the spirit of the invention. It is to be understood that although the description is omitted, multiple embodiments may be implemented again in one integrated embodiment.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

FIG. 1 and FIG. 2 are flowcharts illustrating a process of evaluating a process using a user action performed in a computing device according to each embodiment of the present invention.

First, referring to FIG. 1, when a certain process is executed, the computing device recognizes execution of a corresponding process (hereinafter referred to as an execution process) (S110) and checks whether the execution process is registered in a preset white list S120). In other words, the information about the processes without security risk is listed and managed as a whitelist. If there is an executed process, it is checked whether the execution process is registered in the whitelist.

If the execution process is registered in the whitelist, execution is allowed without proceeding with the process evaluation (S130).

Otherwise, when the execution process is not registered in the whitelist (i.e., unknown process), the user performs an action determination based on the user action and an inquiry to the user, and scored them.

The score of the action judgment (hereinafter referred to as the action score) can be calculated by checking whether the execution process is executed by at least one of a UI interaction, a window shell subprocess or a predetermined automatic connection program. More specifically, the user interface (UI) interaction is monitored to determine whether the user's intention is an action, such as a double-click of the mouse, a right-click menu, or a start menu. can do. In addition, if the operating system is MS Windows, all the child processes of explorer.exe, which are windows shells (for user graphical interface, for example), can be regarded as user's intended actions, And determines whether or not it is a sub-process of the same window shell, thereby calculating the action judgment and the action score corresponding thereto. In addition, the execution process according to the predefined autoconnect program in Windows, such as [* .hwp -> hwp.exe], [* xlsx -> excel.exe], [* .pptx -> powerpoint.exe] Process. If none of the three types mentioned above is true, the action score will be calculated to be low, and the action score will be calculated differently depending on which one or few of the three.

The score obtained by the user confirmation (hereinafter referred to as the feedback score) may be output on the interface screen for confirming the user including the information on the execution process, and may be calculated according to the input information input from the user. For example, the name of the execution process, execution contents (file attachment, modification of file, transmission out of file, etc.), related file information (for example, name, type, format, ), And displays the interface screen on which the user can select execution permission, disable, wait, and the like, thereby receiving user feedback. The feedback score can be calculated on the basis of the content selected by the user's input during the inquiry.

According to the example, it is possible to calculate the time required from the output of the interface screen to the input of the input information from the user to the feedback score. For example, the longer the time it takes to display the information of the execution process and until the user's feedback (for example, selecting one of the allowable, unavailable, or standby) is input, Therefore, at this time, the feedback score can be calculated to be low.

To summarize, the action score may be a score according to the execution process itself or whether the execution process was executed by the user, and the feedback score is a score according to the user feedback received by inquiring the user about the practical process. I can tell.

The process evaluation score is calculated using the calculated action score and feedback score (S150). According to one example, the sum of the action score and the feedback score can be used as the process score.

According to another example, weights may be added to the action scores and / or the feedback scores rather than simple summation.

Referring to FIG. 2 showing an example of this, when the computing device confirms an execution process not registered in the whitelist (S210). It is determined whether the execution process is associated with a preset target file. The target file may be an operating system file, a security file such as personal information, or a security file set by the user, which is important. And judges whether the target file is related to whether the execution process accesses the target file or makes a modification such as forgery or modification. If it is not related to the target file, a general evaluation as described with reference to FIG. 1 is performed (S230).

Alternatively, if the file is related to the target file, the risk is calculated (S240). The risk can be calculated according to whether the target file is simply executed, modified, or leaked to the outside. The risk may be higher if the forgery or falsification has a higher risk value than the simple execution and the target file is a security-critical file and the execution process attempts to leak the target file to the outside.

The calculated risk is reflected in the process score (S250). According to an example, the score may be applied in a form in which the risk score is weighted. For example, if the risk is 2, the action score may be multiplied by 2.

Weights may also be applied to the feedback score, which, according to one example, may utilize the user rating of the computing user. The user class will be described in more detail later.

Thus, according to one example, the process score can be calculated by the following equation.

[Equation 1]

Process Score = (Act Score) * a + (Feedback Score) * b,

{a: risk, b: user class}

FIG. 3 is a schematic diagram illustrating an overall system for evaluating a process based on an action of a plurality of users according to an embodiment of the present invention. FIG. 4 is an exemplary view showing a user class in an embodiment of the present invention And FIG. 5 is a flowchart illustrating a process of evaluating a process using a plurality of user actions according to an embodiment of the present invention.

Referring to FIG. 3, an overall system for evaluating a process using user behavior of a plurality of users includes a plurality of computing devices 10-1, 10-2, ..., 10-n, And a management server 30.

The management server 30 DBizes and manages the whitelist, and provides the whitelist to each computing device 10. Then, the management server 30 registers the execution process and information (hereinafter referred to as evaluation information) on the process evaluation score, which is an evaluation score, from each computing device 10, and calculates a final evaluation score for each process , And determines whether or not to register in the white list based on the calculated final evaluation score. That is, the management server 30 updates the whitelist (or may manage the blacklist) using the evaluation information received from each of the computing devices 10. According to this, the work for acquiring the initial white list is easy because the white list is converted into the DB by the evaluation of the actual computing devices 10, thereby facilitating the construction.

As described above, the management server 30 manages user information about users of each computing device 10, and can rank each user as user information. The concept of the rating referred to herein may be based on the user's position, but basically, the user's rating can be determined according to the reliability of the user's evaluation evaluated by each user. In other words, the user's rating is set by using the user's evaluation history. In addition, the history of the user's computing device usage (the use time, the number of times of use, etc.)

Referring to FIG. 4 illustrating an example according to this, the management server 30 may store user information on a user class as shown in the table. In the case of the user 0001, the usage time of the computing device 10 is 121 hours (H) for one month, whereas the usage time of the user 0002 is relatively short as 78 hours, which means that the reliability of the user evaluation is somewhat low. In the case of the user 0001, 92% is the accuracy with which the malicious process has been identified for the existing execution process (for example, it may be the rate of performing the user identification that selects [not executable] for malicious processes) Is only 61%, so the user grade is set low.

In this manner, the management server 30 provides information on the user class of the user to each computing device 10, and the computing device 10 can assign a weight using the user class when calculating the process evaluation score have.

Hereinafter, the process evaluation process of the whole system will be described.

5, the computing device 10 calculates the process evaluation score of the execution process (S510), and transmits the evaluation information including the execution process information and the process evaluation score (evaluation items, evaluation contents, etc.) to the management server 30 (S520). In this way, each computing device 10 reports its contents to the management server 30 when performing evaluation of the execution process.

The management server 30 stores the evaluation information received from the plurality of computing devices 10 for each evaluation target process (S530). In other words, the evaluation information corresponding to the process a is stored, and the evaluation information corresponding to the process b is stored.

The management server 30 calculates the evaluation score using the related evaluation information received from the computing devices 10 for an arbitrary evaluation target process (S540). According to an example, the final evaluation time of each evaluation target process is a time when evaluation information of a predetermined number (for example, five, etc.) is received, or when a predetermined time has elapsed after the initial evaluation information is received For example, 12 hours, etc.), and the time may vary depending on the type of process being evaluated.

As a method for calculating the final evaluation score, an average value of each process evaluation score may be used, or a weight using a user class according to user information of the corresponding computing device 10, such as a method using the above- May be applied.

The management server 30 determines whether or not to register the evaluation target process as a whitelist according to the final evaluation score (S550). According to one example, if the score is more than 90 out of 100 points, the process to be evaluated is registered as a whitelist. Or a predetermined score (for example, 50 points) as shown in the figure, the evaluation target process may be registered as a black list. If a process registered in the black list is attempted to be executed in the computing device 10 in the future, the process may be blocked or suspended without evaluation.

The management server 30 provides the processing result at S550 to the computing device 10 (S560), and the computing device 10 uses the received result for controlling the execution process to be executed at a later time (S570). For example, if the white list is added to the whitelist, the computing device 10 may update the white list held in accordance with the received result so that the evaluation target process is added.

The above-described process evaluation method according to the present invention can be implemented as computer-readable code on a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording media storing data that can be decoded by a computer system. For example, it may be a ROM (Read Only Memory), a RAM (Random Access Memory), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, or the like. In addition, the computer-readable recording medium may be distributed and executed in a computer system connected to a computer network, and may be stored and executed as a code readable in a distributed manner.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the appended claims. It will be understood that various modifications and changes may be made.

10-1, 10-2, ..., 10-n:
30: Management server

Claims (8)

1. A process evaluation method for security performed in a computer device,
Confirming that the executed execution process is not registered in the preset white list;
Performing a user action determination to determine whether the execution process is executed by a user action and a user confirmation to inquire a user to confirm whether the execution process is an intended execution; And
Calculating a process evaluation score using the action score according to the action judgment and the feedback score according to the user confirmation, calculating a risk according to whether the execution process has accessed or forged the predetermined target file, 0.0 > a < / RTI > score.
The method according to claim 1,
Wherein the action score is calculated by checking whether the execution process is executed by at least one of a UI interaction, a window shell subprocess, and a predetermined automatic connection program.
1. A process evaluation method for security performed in a computer device,
Confirming that the executed execution process is not registered in the preset white list;
Performing a user action determination to determine whether the execution process is executed by a user action and a user confirmation to inquire a user to confirm whether the execution process is an intended execution; And
And calculating a process evaluation score using an action score according to the action judgment and a feedback score according to the user's confirmation,
The calculation of the feedback score includes:
Outputting an interface screen for confirmation of the user including information on the execution process; And
And calculating the feedback score according to input information from a user,
Wherein the time required until the input information is input after outputting the interface screen is used for calculating the feedback score.
delete A method for evaluating a process performed by a management server,
Managing the whitelist for the safety process and providing related information to the pre-established computing devices;
Each of the computing devices confirms that the execution process is not registered in the preset whitelist, and judges whether the execution process is executed by the user action, Receiving evaluation information including the normally executed process information and the process evaluation score when the process evaluation score is calculated using the feedback score according to the user confirmation for confirming whether or not the process execution score is an intended execution;
Calculating a final evaluation score according to the evaluation target process based on the evaluation information received from the computing devices; And
And determining whether to register the evaluation subject process in the whitelist according to the final evaluation score,
The computing device comprising:
Outputting an interface screen for confirming a user including information on the execution process, calculating the feedback score according to input information from the user, calculating a feedback time from the output of the interface screen to the input of the input information Is used for calculation of the feedback score.
The method of claim 5,
The computing device comprising:
Wherein the action score is calculated by checking whether the execution process is executed by at least one of a UI interaction, a window shell subprocess, and a predetermined automatic connection program.
delete A computer-readable recording medium on which a program for carrying out the method according to any one of claims 1 to 3, 5 and 6 is recorded.

Images