KR20070049511A - Analysis system for malicious code and method thereof - Google Patents

Abstract

The present invention relates to a malware analysis system and method.

A malicious code analysis system according to an embodiment of the present invention includes a computer terminal having an operating system for executing code; And a malicious code analysis unit for determining whether the code is malicious code, wherein the malicious code analysis unit monitors execution characteristics related to system calls and device calls that are called from the operating system while the code is executed in the operating system. By comparing with the calling characteristics of the malicious code stored in the memory, characterized in that it comprises a malicious code analysis unit for determining whether or not malicious code.

According to an embodiment of the present invention, the malware analysis system analyzes the code quickly and accurately, and checks whether the analyzed code is a malicious code, a variant or a subtype of the malicious code, and updates the malware database, thereby creating a richer database. In addition to the destroyer, by quickly and accurately screening the malicious code, it is possible to minimize the spread, movement and attack size of the malicious code.

 Malware, Computer Terminal, Analysis System, Method, Trojan, Backdoor, Worm, Virus

Description

ANALYSIS SYSTEM FOR MALICIOUS CODE AND METHOD THEREOF

1 is a block diagram showing a conventional malware analysis system.

Figure 2 is a block diagram showing a malware analysis system according to an embodiment of the present invention.

3 is a diagram illustrating an example of an operating system of FIG. 2;

4 is a detailed block diagram showing the malicious code main system of FIG.

5 is a flowchart illustrating a malicious code analysis method according to an embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

100: code 200: operating system

300: malware analysis unit 310: system call inspection unit

320: device call inspection unit 330: comparison unit

340: Database

The present invention relates to a system and method for analyzing malicious codes, and in particular, by analyzing various malicious codes and variants thereof, determining whether the malicious codes are based on the analyzed data, and storing the determined malicious codes in a new database. The present invention relates to a malware analysis system and method capable of quickly and accurately detecting malware.

Due to the remarkable development of memory and communication technology, the performance of computer has almost unlimited ability. In addition, the spread of the Internet according to the development of network infrastructure is expanding all over the world. This dissemination of the Internet has not only brought the concept of global villages into cyberspace, but also creates new cultures in various forms. In particular, the Internet is based on information sharing, and the world's leading and outstanding programs are spreading through the Internet. This Internet, together with its positive effects, is creating destructive and intrusive dysfunction problems. In particular, this problem has emerged as a serious problem in society as it is being illegally and deliberately hacked into another Internet user's information without permission, or illegally encroaching on another Internet user's computer terminal or server. It is becoming. For example, attacks of other systems using worm viruses and malware, and information destruction of other devices are occurring frequently and seriously, which seems to be a common problem today.

Among them, the malware is used to send large amounts of data to other people's computers, to make adult pornography sites appear continuously, or to suddenly slow down computer use, and to set up the wrong sites as Internet sites. This can cause problems such as changing the internal system registry. Such malware may include spyware, adware, worms, and the like. The malware's path is usually installed on the user's computer through file programs easily available on the Internet, or through malicious adware distributors who plant codes on the user's computer for advertising purposes. The current trend of malware is that every three computers are infected when they scan their computers for monitoring software such as Trojan horses and spyware.

However, until now, data on the extraction, tracking, and analysis of such malicious codes are insufficient, and even if there is data, the rapid analysis and accurate determination of the malicious codes are not made. It is impossible to recover quickly. In particular, malicious code has many variants and subtypes, and manual work is used to determine whether the collected code is malicious code. For example, if a worm virus is found, and after warning and caution notice about such a worm virus, and a variant of the found worm virus is found, the detected worm virus is a new type or an existing one. It is not immediately possible to determine whether it is a variant of a worm or a specific type of program, and after executing the collected code and virus on the computer, it checks whether the registry value is changed or changes the malicious behavior. It must be monitored manually, and this monitoring determines whether the collected code is malicious. Specifically, when malicious code including a worm virus invades the user's computer, as illustrated in FIG. 1, four or more types of malware analysis systems for checking each characteristic of the malicious code are used. By analyzing each change characteristic, malicious code is analyzed. For example, FileMon to track the creation or deletion of new files on the system, RegMon to track the creation, modification, and deletion of the registry, and the volume and characteristics of attack traffic on the network. By using the sniffer (Sniffer) to measure the, Netstat (Netstat) to detect the back door, and the like to analyze the malware according to each characteristic. However, such a conventional malware analysis system for each type requires not only to analyze a specific code that is actually inspected, but also to check the characteristics of each tool only by operating a plurality of types of malware analysis systems for a specific code. Because it can only be monitored for a new type of threat, it cannot find a new kind of threat.

Accordingly, an object of the present invention is to analyze the code quickly and accurately, to determine whether the analyzed code is a malicious code, a variant or subclass of the malicious code, and to update the malicious code database, thereby establishing a richer database and providing malicious code. The present invention provides a malware analysis system and method that can minimize the spread, movement, and attack size of malicious codes by quickly and accurately selecting them.

Another object of the present invention is based on the information that the existing information related to the malicious code itself based on the information that is analyzed by the system based on the external information, malicious code capable of establishing the preventive measures for damage caused by the malicious code and malicious code, etc. An analysis system and method are provided.

Another object of the present invention is to provide a malicious code analysis system and method that can provide real-time and fast accurate analysis information on the malicious code actually infected by the systems of the test network for collecting the code.

In order to achieve the above object, the malware analysis system according to an embodiment of the present invention comprises a computer terminal having an operating system for executing the code; And a malicious code analysis unit for determining whether the code is malicious code, wherein the malicious code analysis unit monitors execution characteristics related to system calls and device calls that are called from the operating system while the code is executed in the operating system. By comparing with the calling characteristics of the malicious code stored in the memory, characterized in that it comprises a malicious code analysis unit for determining whether or not malicious code.

The malicious code analysis unit includes a system call check unit that checks a system call generated when the code is executed in the operating system; A comparison unit for comparing the characteristics of the code checked by the device call inspection unit and the system call inspection unit with the characteristics of the malicious code; And it characterized in that it comprises a database for storing the malicious code and the characteristics of the malicious code.

The system call checker checks at least one of process and thread generation, file creation and deletion, registry creation and modification and deletion, process termination, and network status while the code is executed in the operating system.

The apparatus may further include a device call checker configured to check a device call generated when the code is executed in the operating system when the operating system is a Windows series.

The comparison unit determines that the similarity between the calling characteristics of the code and the malicious code calling characteristics is 50% or more, and determines one of the malicious codes and the variants of the malicious codes.

If the code is determined as the malicious code, it is characterized in that it is additionally registered in the database.

The operating system is at least one of a Unix-based or Windows-based operating system.

The malware analysis unit further includes a public network to which the computer terminal is connected, and determines the code as a malicious code according to a network traffic characteristic that generates a network traffic of a predetermined level or higher among codes flowing into the computer terminal from the public network. It is characterized by.

The malicious code analysis method according to an embodiment of the present invention includes a first step of executing a code for generating network traffic of a predetermined level or more on a computer terminal; Monitoring at least one of a system call and a device call generated by the code execution to analyze a characteristic of the code; And a third step of determining whether or not the malicious code is compared by comparing the characteristics of the analyzed code with the characteristics of the pre-stored malicious code.

The second step may include monitoring at least one of a process and a thread generation generated by the code execution, file creation and deletion, registry creation and modification and deletion, process termination, and network change.

In the third step, when the similarity between the code characteristic and the malicious code characteristic is 80% or more, the third step is determined as one of a malicious code or a variant of the malicious code.

If the code is determined to be malicious code, it is characterized in that it further comprises a sub-step newly registered in the database.

The above and other objects and features and advantages of the present invention will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram illustrating a malicious code analysis system according to an embodiment of the present invention.

In the malware analysis system according to an embodiment of the present invention, the operating system is basically described using Windows 2000 as an example. However, due to the characteristics of the Windows operating system, the malware analysis unit may be ported to other windows. The same concept can also be applied to Linux, Unix, and Unix. That is, the malware analysis unit according to an embodiment of the present invention, regardless of the operating system, each call that occurs when a program is executed on a specific operating system, for example, instruction usage, branching, function calls, processes and threads generation and Calls for deletion, etc. are monitored, and the type of code is determined by comparing the monitored data with existing data. Equally, the following descriptions are classified into device calls and system calls, but are not limited thereto.

2, the malware analysis system according to an exemplary embodiment of the present invention receives a code sample collected from a code collection system and calls a system from the operating system 200 and the operating system 200 in which the code sample 100 is executed. And a malicious code analysis unit 300 for checking an instruction and a function call generated during a device call and transmitting the analysis result to the code management system.

The operating system 200 has a user mode 201 and a system mode 202 for supporting the user mode 201 as shown in FIG. 3.

User mode 201 may include system support processes 210, service processes 220, application processes 230, environment subsystems 240, and It has a system interface (Ntdll.dll) for passing system calls from each process to system mode 202. Here, the environmental subsystem 240 is a separate process provided to support user programs if they need system calls.

The system support process 210 includes a service controller, a winlogon, and a session manager.

The service controller controls program calls and corresponding function calls to support various services provided by Windows, for example, video, audio functions, and video.

Winlogon is responsible for logging on to the Windows operating system.

The session manager completes the boot process by allowing the actual first user process to be created at the final stage of program execution.

The service process 220 includes a replicator, a remote process cell (RPC), an alerter, an event logger, and a first subsystem DLL.

The RPC (Remote Process Cell) performs a function of a communication service generated from a process or a remote computer terminal in an operating system.

Alerter sends administrative alerts to users and computers.

Event Logger manages the log of event occurrence.

The first subsystem DLL (Subsysterm DLL) is a shared library. When the application is linked, the linker recognizes the DLL library function used and writes this information in the header section of the executable. The first subsystem DLL is a copy of a DLL mapped to physical memory for supporting the service processor 220.

Application process 230 includes at least one user application and a second subsystem DLL.

At least one user application is various programs executed by the user.

The second subsystem DLL is another copy of the DLL mapped to physical memory to support execution of the application processor 230.

The environment subsystem 240 supports three application program interfaces: OS / 2, Posix, and Win32. Each interface provides a list of library functions that programmers can call. Here, the Posix environment supports minimal functionality for Unix applications, while the Win32 environment supports functionality for running Windows applications.

The system mode 202 is a process in which calls generated from the user mode 201 are received and executes program execution according to the received call. The system mode 202 communicates with an execution application program interface and an execution application program interface. Cache manager, Process & Threads, Security, Virtual Memory (VM), Call Manager (CM), First Filter & File Systems ), A second filter and input / output system, and an object manager and execution RTL / LPC (Object Management / Executive RTL / LPC), an object manager and an execution RTL to manage and run each device. Kernel and device drivers that communicate with / LPC, and between the hardware layer and the kernel and device drivers to run kernel and device drivers in a hardware-independent structure. The subordinate has a hardware abstraction layer.

An executable application program interface has a language or message format that is used when an application communicates with a system program such as an operating system or database management system. The application program interface provides a function that provides a link to a specific subroutine for execution within the program. Implemented by calling Thus, an application program interface has several program modules or routines that must already exist or be linked in order to perform the work requested by the function call.

The cache manager remembers which of the most recently used disk blocks reside in memory to improve access speed.

A process is a running program, and one process has at least one thread. These processes can be grouped together to perform resource management as a task.

Call managers provide an efficient way of communicating between processes and subsystems. That is, the call manager provides a communication method other than interprocess communication.

In the first filter and file systems, file systems include FAT (File Allocation Table) and NTFS (NT File System), which are independent of each other and control different disk parts. And all FAT file systems are managed by one driver. Technically, a file system can be classified as one of the device drivers managed by an I / O system.

In the second filter and I / O system, the I / O system provides a basis for managing input / output devices and provides a unified input / output service. In addition, the I / O system provides device-independent input and output functions and calls the appropriate driver for the actual input and output.

Object Manager and Execution for Managing and Running Each Device In Object Management / Executive RTL / LPC, the object manager manages all objects that system mode 202 can recognize. Examples of such objects are processes, threads, files, directories, semaphores, I / O devices, and timers. The object manager is responsible for all aspects of object management, such as allocating virtual memory blocks in the kernel address space to create objects and returning them to the free space list when the virtual memory blocks are over. Register Transfer Level (RTL) performs logical operations between registers, and Low Pin Count (LPC) is responsible for executing I / O.

Kernel makes each process part independent of hardware and makes portability high. It implements all parts except hardware implementation layer.

The device driver may control one or more input / output devices, and may perform functions independent of hardware devices, such as encrypting data or accessing a kernel data structure. These device drivers are for devices that are visible to the naked eye, such as disks and printers, and for internal devices and chips.

The Hardware Abstraction Layer is a collection of routines that handle the hardware-dependent details needed to implement I / O interfaces, interrupt control, and multiprocessor communication.

In addition, in system mode 202, the execution application program interface receives and executes a call command from a system thread. It also provides Win32 User & GDI for Windows users.

As illustrated in FIG. 4, the malware analysis unit 300 includes a system call checker 310 for checking a system call of the operating system 200, a device call checker 320 for checking device related calls, and a system call checker. A comparison unit 330 for comparing the measured amount checked by the 310 and the device call inspection unit 320, and a database 340 to be compared with the comparison unit 330 are provided. Hereinafter, the malicious code analysis unit 300 according to an embodiment of the present invention describes the operating system 200 as an example of the Windows series, thereby explaining that a device call occurs.

The system call checker 310 checks system call commands and functions generated by the operating system 200. To this end, the system call checker 310 monitors the system interface (Ntdll.dll), and quantifies by counting the commands and functions generated by the system call.

The device call checker 320 checks device call commands and functions generated by the operating system 200. To this end, the device call inspecting unit 320 monitors an execution application program interface in the system mode 202 of the operating system 200, and counts and quantifies the commands and functions generated by the device call. Here, the device call is basically described in conjunction with the system call, and in the Windows-based operating system, the Win32 application program interface is responsible for the device call. This embodiment of the present invention represents the monitoring of the hard disk and network device calls.

As such, based on the count and record of the system call and the device call, it is determined whether the program is malicious. Malicious behaviors include direct damage such as termination of antivirus software, deletion and creation of files, creation, modification and deletion of registers, and indirect damage such as increased system load due to mass production of processes and mass production of threads. It is confirmed whether other systems attack due to mass production and how to attack.

The comparator 330 compares each measured amount inspected by the system call checker 310 and the device call checker 320 with a previous measured amount of a specific malicious code stored in the database 340. That is, the comparison unit 330 displays the matching rate of the currently inspected code and the stored specific malicious code by comparing the code of the specific malicious code stored in the database 340, and matches the specific ratio, for example, 80% or more. , Classified as malware. Here, the comparison unit 330 may be classified as a malicious code, the matching rate between the currently audited code and a specific malicious code, for example, the number of network traffic generation, file and registry creation and modification, process and thread creation, etc. And by comparing with the generation amount, the coincidence rate can be examined.

The database 340 executes malicious code including a virus such as a worm existing on the user's computer, and then generates behavior patterns of the malicious code, that is, network traffic generation and contents, file and registry creation and modification, and process. It also checks the creation and deletion of threads, the creation of backdoors, and saves the result. Thereafter, when the comparison unit 330 examines the collected code, the comparison unit 330 is provided as a comparison target, and when the code being checked matches more than a specific ratio, the database 340 is recognized as a new variant virus or a variant malicious code. You will be newly listed at.

With reference to FIG. 5, a method for analyzing malicious codes using a malware analysis system according to an embodiment of the present invention having such a structure will be described in detail.

Referring to FIG. 5, the malware analysis method according to an embodiment of the present invention first executes the code 100 collected on a user computer having an operating system 200.

By using at least one of the device call checker 320 and the system call checker 310 of the malware analysis unit 300 monitors system calls and device call-related commands and function calls generated in the operating system 200. (S2 step)

The malware analysis unit 300 checks the system call generated in the operating system 200 using the system call checker 310, and uses the device call checker 320 to call the device generated in the operating system 200. And system calls related to device calls. That is, the system call inspecting unit 310 checks process and thread generation amount measurement, file creation and deletion monitoring, registry creation and modification and deletion, process termination, network state, and the like. The device call check unit 320 checks the call when an application interface call occurs in the operating system. Application program interface calls are often accompanied by system calls.

In addition, programs showing typical characteristics of the malicious code among the features of the system inspected by the system call checker 310 and the device call checker 320 may be temporarily classified as malicious codes such as worms. These features include large amounts of network traffic and file deletion.

The comparator 330 may be configured to generate instructions and function calls according to the monitored system calls and device calls of programs classified as malicious codes, and other instructions for system calls and device calls of malicious codes stored in the database 340. Compare the occurrence and amount of function calls (step S3).

The database 340 quantifies and stores occurrences and amounts of system calls and device calls of malicious codes by executing the previously collected malicious codes on the operating system 200.

The comparator 330 compares the occurrence and the generation amount of the system call and the device call generated by the execution of the collected code with the characteristics of the malware stored in the database 340, and the similarity is a certain percentage, for example, 50 percent. If more than 80% or more appear, it is determined by the existing malicious code and the variant of the existing malicious code (step S4).

The characteristics of the malware include information leakage, information hacking, system file destruction, execution extension change, backdoor creation, and the like, and the occurrence of processes and threads is exploding, separate files are created and deleted, and the registry is created and changed. And the deletion may occur, and a status such as forcibly terminating the process in a situation where no user manipulation has occurred. In addition, the characteristics of the malicious code include the characteristic of exploding network traffic in a short time. Here, the comparator 330 may predict the attack power of the malicious code by monitoring the number of generation of the process and the thread.

If the characteristic of the collected code is determined to be a malicious code variant, it is newly registered in the database 340 (step S5).

Malware includes not only worm viruses, but also various variant viruses, and may also include pop-up program codes such as malicious adware.

If the characteristic of the code 100 collected in the step S3 is different from that of the previously stored malicious code, and the similar characteristic represents less than 50 percent of the characteristic, the characteristic of having the malicious code is, for example, information leakage, information hacking, and system file. The collected code 100 can be determined as malicious code by monitoring the destruction, execution extension change, and backdoor generation. On the other hand, if it exhibits similar characteristics of 50% or less, go to step S1 to execute another collected code 100 on the computer terminal, and then repeat the same process.

As described above, the malware analysis system and method according to an embodiment of the present invention by analyzing the code quickly and accurately, by identifying whether the analyzed code is a malicious code, a variant or subclass of the malicious code by updating the malware database In addition, by building a richer database and screening malware quickly and accurately, it is possible to minimize the spread, movement and attack size of malware.

The malware analysis system and method according to an embodiment of the present invention is based on information that is analyzed by itself in a system that previously relies on information related to malicious code, based on external information. Preventive measures can be established.

Malware analysis system and method according to an embodiment of the present invention can provide real-time and fast accurate analysis information on the malicious code actually infected by the systems of the test network for collecting the code.

In the malware analysis system and method according to an embodiment of the present invention, the device call inspection unit is provided with a disk device such as a hard disk and a network device, and the information about how destructive power of the code to be analyzed is analyzed and which file should be recovered. The number and method of code attacking other systems to spread itself by using the device call inspection unit attached to the network device, whether to wait for an external connection to leak important information stored in the system, etc. You can check the behavior.

Those skilled in the art will appreciate that various changes and modifications can be made without departing from the technical spirit of the present invention. Therefore, the technical scope of the present invention should not be limited to the contents described in the detailed description of the specification but should be defined by the claims.

Claims (12)

A computer terminal having an operating system for executing code; And It is configured to include a malicious code analysis unit for determining whether the code is malicious code, The malicious code analyzing unit monitors execution characteristics related to system calls and device calls that are called from the operating system while the code is executed in the operating system, and compares them with the calling characteristics of the malicious codes stored in a memory to determine whether malicious code is malicious. Malware analysis system comprising a code analysis unit. The method of claim 1, wherein the malicious code analysis unit, A system call checker that checks a system call generated when the code is executed in the operating system; A comparison unit for comparing the characteristics of the code checked by the device call inspection unit and the system call inspection unit with the characteristics of the malicious code; And Malicious code analysis system characterized in that it comprises a database for storing the malicious code and the characteristics of the malicious code. The method of claim 2, wherein the system call check unit, And at least one of process and thread generation, file creation and deletion, registry creation and modification and deletion, process termination, and network status while the code is running on the operating system. The method of claim 2, And a device call checker to check a device call generated when the code is executed in the operating system when the operating system is a Windows series. The method of claim 2, wherein the comparison unit, And if the similarity between the calling characteristic of the code and the calling characteristic of the malicious code is 50% or more, the malicious code analysis system, characterized in that it is determined as either a malicious code or a variant of the malicious code. The method of claim 5, wherein the code is, If it is determined that the malicious code, the malware analysis system, characterized in that further listed in the database. The method of claim 1, wherein the operating system, Malware analysis system, characterized in that at least one of the Unix-based or Windows-based operating system. The method of claim 1, wherein the malicious code analysis unit, It further comprises a public network to which the computer terminal is connected, The malicious code analysis system, characterized in that for determining the code as a malicious code according to the characteristics of the network traffic that generates a network traffic of a predetermined level or more from the code flowing into the computer terminal from the public network. A first step of executing code on the computer terminal that generates a certain level of network traffic; Monitoring at least one of a system call and a device call generated by the code execution to analyze a characteristic of the code; And And a third step of determining whether or not malicious code is compared by comparing characteristics of the analyzed code with characteristics of pre-stored malicious codes. The method of claim 9, wherein the second step, And monitoring at least one of processes and threads generated by the code execution, file creation and deletion, registry creation and modification and deletion, process termination, and network change. The method of claim 9, wherein the third step, And if the similarity between the code characteristic and the malicious code characteristic is greater than 80 percent, determine one of the malicious code or a variant of the malicious code. The method of claim 11, If the code is determined to be malicious code, the malware analysis method further comprises a sub-step newly registered in the database.

Images