KR20080074271A - Apparatus and method for detecting malware in mobile hand-held devices - Google Patents

Abstract

A device and a method for processing malware in a mobile terminal are provided to reduce battery consumption largely by minimizing CPU, memory, and communication overhead without degrading malware detection performance. A first detector(12) detects information suspected as malware by analyzing the information inputted to a mobile terminal. A second detector(14) verifies whether the detected suspected information is the malware or not by receiving the information needed for verifying the malware from a central processing center connected with the mobile terminal through the wired/wireless network. A display unit displays a detection result of the first detector and/or a verification result of the second detector. The central processing unit includes a database storing the information needed for verifying the malware and a processor. The processor receiving the information suspected as the malware from the mobile terminal, extracts the information needed for verification for determining whether or not the received suspected information corresponds to the malware by referring to the database, and transmits the extracted information to the mobile terminal.

Description

Apparatus and method for detecting malware in mobile hand-held devices}

1 is a schematic diagram of a mobile terminal malware processing system according to a preferred embodiment of the present invention;

2 and 3 are block diagrams of a malicious code processing apparatus and a central processing center according to a first embodiment of the present invention;

4 and 5 are block diagrams of a malicious code processing apparatus and a central processing center according to a second embodiment of the present invention;

6 and 7 are block diagrams of a malicious code processing apparatus and a central processing center according to a third embodiment of the present invention;

8 and 9 are block diagrams of a malicious code processing apparatus and a central processing center according to a fourth embodiment of the present invention;

10 illustrates an embodiment of a malware database.

11 is a flowchart illustrating a malicious code processing method according to an embodiment of the present invention;

12 is a flowchart illustrating a malicious code processing method according to another embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

10: mobile device malware processing device 20: central processing center

12, 32: first detector 14, 46: second detector

16, 36: detection processing unit 24, 44: database

The present invention relates to various mobile terminals such as smart phones, personal digital assistants (PDAs), WiBro terminals, and the like, and specifically detects various malware such as viruses, worms, spyware, spam, hacking tools, etc. The present invention relates to a mobile terminal malware processing apparatus for processing and a processing method thereof.

Recently, as smartphones, PDAs, WiBro terminals, and the like become more common, portable terminals have become an indispensable tool in modern life. Many people use mobile terminals to talk about each other, exchange information, and exchange business-critical information through voice and data communications.

On the other hand, as the hardware of the mobile terminal is advanced and the applications executed in the mobile terminal are diversified and complicated, the malicious code that attacks the existing computer is likely to cause serious damage to the mobile terminal. In particular, with the proliferation of wireless mobile Internet services such as WiBro, in addition to malicious code that attacks vulnerabilities of existing computer applications, the vulnerability of mobile applications and services such as Bluetooth and MMS (Multimedia Messaging System) Attacking mobile malware is emerging. These various malicious codes can cause serious damage such as inducing malfunction of the mobile terminal, deleting data or leaking user's personal information. Therefore, a countermeasure for effectively protecting a mobile terminal from various malicious codes is required.

A signature-based detection scheme is typical of conventional malware detection techniques. This approach is widely used in anti-virus software running in the Internet environment. More specifically, the signature-based detection method stores some patterns of known malware (hereinafter referred to as 'signatures') in a database, compares the input information with the malware signature data stored in the database, and checks whether there is a matching signature. By detecting malicious code.

However, the signature-based detection method described above has serious problems as follows. First, as the number of known malicious codes increases, the size of the signature database inevitably increases rapidly, which causes problems such as CPU overhead, memory overhead, and battery consumption surge. In particular, if the signature-based detection method is applied to a mobile terminal with extremely limited battery resources, the performance of the terminal is seriously degraded. Second, there is a problem in that real-time detection and treatment of the malicious code is impossible due to the time difference between the spreading time of the malicious code and the updating time of the signature database.

In order to solve this problem, US Patent Publication No. 2003-0162575 proposes an invention in which the signature-based detection method described above is improved to be suitable for a mobile terminal environment. The present invention aims to mount a large-capacity signature database and malicious code detection means in an information processing apparatus separate from the mobile terminal. The portable terminal receives the detection result from a separate information processing apparatus without any malicious code detection means. Accordingly, the portable terminal transmits all the input data to the above-described information processing apparatus and receives the detection result to determine whether the malicious code is infected.

However, according to the above-described invention, since all data input to the mobile terminal must be transmitted to a separate information processing apparatus, there is a problem that excessive communication overhead occurs. Excessive communication overhead eventually leads to an increase in data transmission costs and a surge in battery consumption, which is also very inefficient for the mobile terminal environment.

On the other hand, Japanese Laid-Open Patent Publication No. 2003-216447 pays attention to the fact that the CPU and memory capacity of the mobile terminal are not sufficient to store the signature database, so that only specific signature data of a part of the signature database is downloaded from the server to detect malicious code in the mobile terminal. We suggest constitution to make. For example, assuming that 10,000 signature data is stored in the entire signature database, only 1,000 signature data recently found are selectively downloaded to detect malware in the mobile terminal.

However, in the above-described invention, since pattern matching is performed using only some signature data, the detection performance of the malicious code is deteriorated.

The present invention has been made to solve the problems of the prior art as described above, ultra-light malicious for the mobile terminal to significantly reduce the battery consumption by minimizing the CPU, memory and communication overhead without degrading malware detection performance An object of the present invention is to provide a code processing apparatus and a processing method thereof.

In order to achieve the above object, the present invention is characterized by configuring a malicious code detection system through mutual cooperation between the malicious code processing apparatus mounted on a mobile terminal and the central processing center. In particular, a primary detection process that detects information (including programs or data) suspected of malicious code to harm a mobile terminal, and a second detection that confirms that the information suspected of the first detected malicious code is actually malicious code. We propose a mobile terminal malware processing system that implements a two-step detection process that includes a process. In this case, the mobile terminal malware processing system according to the present invention may be implemented in various embodiments depending on whether the second detection process is performed in the malware processing apparatus mounted in the mobile terminal or the central processing center.

More specifically, according to an aspect (first embodiment) of the present invention, the above-described object is a first method for detecting information suspected of malicious code that may cause damage to a mobile terminal by analyzing information input to the mobile terminal. And a second detector configured to receive information necessary for verifying malware from a central processing center connected to a mobile terminal and a wired / wireless network and verify whether information detected as suspected malicious code is actually malicious code. It is achieved by the terminal malware processing device.

In this case, the first detection unit preferably detects information suspected to be malicious code by applying a computer immune system-based detection technology, and the second detection unit applies signature-based detection technology to detect information suspected of malicious code as the actual malicious code. It is particularly desirable to verify whether it is.

Meanwhile, according to another aspect of the present invention, the above object is a central processing center connected to a mobile terminal and a wired or wireless network, receiving information suspected of malicious code from a database and a mobile terminal for storing information necessary for verifying malicious code, and the database By the central processing center comprising a processing unit for extracting the information necessary for the verification of the malicious code to determine whether the received information suspected malicious code corresponds to the actual malicious code to the mobile terminal; Is achieved.

In this case, the information required for malicious code verification is used for signature-based detection technology, and preferably, signature data representing a pattern of malicious code.

On the other hand, according to an aspect (second embodiment) of the present invention, the above object is the first detection unit for detecting information suspected of malicious code that may cause harm to the mobile terminal by analyzing the information input to the mobile terminal and The detection processing unit transmits the information suspected of the detected malicious code to the central processing center connected to the mobile terminal and the wired / wireless network, and receives the result of verifying whether the information suspected of the malicious code transmitted from the central processing center is the actual malicious code. It is achieved by a mobile terminal malware processing device comprising a.

On the other hand, according to another aspect of the present invention, the above object, in the central processing center connected to the mobile terminal and wired and wireless network, suspected malicious code received from the mobile terminal with reference to the database and database for storing information necessary for malicious code verification It is achieved by the central processing center, characterized in that it comprises a second detection unit for verifying whether the information is actually malicious code.

On the other hand, according to another aspect (third embodiment) of the present invention, the above-described object is the first detection unit for detecting information suspected of malicious code that may cause harm to the mobile terminal by analyzing the information input to the mobile terminal The second detection unit transmits information suspected of the detected malicious code to the central processing center connected to the mobile terminal and the wired / wireless network, and receives information necessary for verifying the malicious code corresponding to the information suspected of the detected malicious code from the central processing center. And a second detection unit which verifies whether the information suspected of the detected malicious code is an actual malicious code by using a detection processor for transmitting the information and necessary information for verifying the received malicious code. Is achieved by

At this time, the detection processor transmits the version information of the detection engine mounted on the second detection unit to the central processing center, and when it is determined that the update of the detection engine is necessary based on the version information, the detection engine program of the latest version from the central processing center. It is preferable to update the detection engine mounted on the second detection unit by receiving.

According to another aspect of the present invention, the above object is a database for storing information necessary for malicious code verification, latest version information of a detection engine, and a latest version detection engine program in a central processing center connected to a mobile terminal and a wired or wireless network. And receiving information suspected of malicious code from the mobile terminal and extracting necessary information to verify whether the received suspected malicious code corresponds to the actual malicious code by referring to a database and transmitting the information to the mobile terminal. Receiving the version information of the detection engine mounted on the portable terminal from the terminal, and referring to the database to determine whether the update of the detection engine is necessary, and if the update is necessary to include a processing unit for transmitting the latest version detection engine program to the mobile terminal Achieved by a central processing center.

On the other hand, according to an aspect (fourth embodiment) of the present invention, the above-described object is a first detection unit for detecting information suspected of malicious code that may harm the mobile terminal by analyzing the information input to the mobile terminal And detecting information suspected of the detected malicious code to a central processing center connected with a mobile terminal and a wired or wireless network, and receiving a result of verifying whether the information suspected of the malicious code transmitted from the central processing center is an actual malicious code. It includes a processing unit and a storage unit for storing information verified as not the actual malicious code of the information suspected of the transmitted malicious code according to the received verification result, the detection processing unit suspected of the detected malicious code before communicating with the central processing center Check if the information is stored in the storage, and if it is stored, the suspected detected malware is not the actual malware. It is achieved by the mobile terminal malware processing device, characterized in that judged as.

On the other hand, according to another aspect of the present invention, the above object, in the central processing center connected to the mobile terminal and wired and wireless networks, suspected malicious code received from the mobile terminal with reference to a database database that stores information necessary for malicious code verification A processing unit characterized in that it receives information suspected of malicious code from the second detection unit and the mobile terminal for verifying whether the information is actually malicious code and transmits the information to the second detection unit and transmits the verification result of the second detection unit to the mobile terminal. It is achieved by a central processing center comprising a.

On the other hand, according to an aspect of the present invention, the above object, in the method of processing a malicious code of a mobile terminal, by analyzing information input to the mobile terminal to suspect information that may be harmful to the mobile terminal 1 Step of detecting difference Transmitting information suspected as detected malicious code to central processing center connected with mobile terminal and wired / wireless network Receiving information necessary for verification of malicious code corresponding to detected information suspected as malicious code from central processing center And secondly verifying whether the detected suspected malicious code is the actual malicious code by using the information necessary for verifying the received malicious code.

On the other hand, according to another aspect of the present invention, the above object, in the method of processing a malicious code of a mobile terminal, by analyzing the information input to the mobile terminal to suspect information that is suspected of malicious code that may harm the mobile terminal The first step of detecting and transmitting the information suspected of the detected malicious code to the central processing center connected with the mobile terminal and wired and wireless network, and the second whether the information suspected of the malicious code transmitted from the central processing center is the actual malicious code. It is achieved by a malicious code processing method comprising the step of receiving a verified result.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention. In the following description of the present invention, if it is determined that detailed descriptions of related well-known functions or configurations may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the present invention, which may vary according to intention or custom of a user or an operator. Therefore, the definition should be made based on the contents throughout the specification.

1 is a schematic diagram of a mobile terminal malware processing system according to a preferred embodiment of the present invention.

Referring to Figure 1, the mobile terminal malicious code processing according to the invention, characterized in that the effective detection of the malicious code through the cooperation between the malicious code processing apparatus 10 and the central processing center 20 mounted on the mobile terminal The system is shown.

The portable terminal may include various portable terminal devices such as a smart phone, a personal digital assistant (PDA), a WiBro terminal, and the malware processing apparatus 10 may be implemented in the form of software or hardware mounted on the portable terminal. The central processing center 20 refers to at least one central server in which various mobile terminals are integrated and managed through a plurality of base stations.

As shown, digital data is continuously input to the mobile terminal through various services such as digital multimedia broadcasting, Bluetooth, wireless mobile Internet service (WiBro), USB, e-mail, and multimedia message service. In order to effectively detect malicious code from the inputted information, the present invention provides a first detection process for inexpensively detecting information (including a program or data) suspected of causing malicious code to harm a mobile terminal, and a first detected malicious code. It provides a mobile terminal malware processing system having a two-step detection process, including a second detection process to accurately determine whether the suspected information is actually malicious code.

In addition, it is possible to implement an ultra-light malware processing system that reduces the load of the mobile terminal by sharing the role between the malicious code processing device 10 and the central processing center 20 mounted on the mobile terminal. In particular, according to whether the second detection process is performed by the malware processing apparatus 10 or the central processing center 20 mounted on the mobile terminal, the mobile terminal malware processing system according to the present invention may be implemented in various ways as will be described later. You can implement it with examples.

For example, the first embodiment according to the present invention is illustrated in FIGS. 2 and 3 as a mobile terminal malware processing system when the malicious code processing apparatus 10 performs the first detection process and the second detection process.

The second embodiment according to the present invention is a mobile terminal malware processing system when the malicious code processing apparatus 10 performs the first detection process and the central processing center 20 performs the second detection process. 5 is shown.

The third embodiment according to the present invention is a mobile terminal malware processing system in the case of extending the first embodiment described above, and is shown in FIGS. 6 and 7.

The fourth embodiment according to the present invention is a mobile terminal malware processing system in the case of extending the above-described second embodiment is shown in Figs. 8 and 9.

However, these embodiments are merely illustrative of one embodiment of the present invention for convenience of description and those skilled in the art to which the present invention pertains modified without departing from the essential characteristics of the present invention. It will be appreciated that it may be implemented in a form.

The first embodiment according to the present invention is a mobile terminal malware processing system when the malicious code processing apparatus 10 performs a first detection process and a second detection process.

2 is a block diagram of a malicious code processing apparatus according to a first embodiment of the present invention. Referring to FIG. 2, the malicious code processing apparatus 10A according to the present invention includes a first detector 12 and a second detector 14.

The first detection unit 12 performs a primary detection function of detecting and analyzing all information input to the mobile terminal to detect information “suspected” by malicious code that may damage the mobile terminal. That is, the first detection unit 12 is configured to be able to significantly reduce the CPU, memory and battery overhead, although the detection accuracy is inferior as compared with the conventional signature-based detection method described above.

As an embodiment of the present invention, the first detection unit 12 may be implemented to detect information suspected of malicious code by applying a computer immune system-based detection technology. That is, information having a different characteristic from the resident program among the information input to the mobile terminal is detected as suspected malicious code by referring to the characteristic information of the resident program in the mobile terminal previously stored.

The second detection unit 14 receives information necessary to verify the malicious code from the central processing center 20A connected to the mobile terminal and the wired or wireless network, and secondly verifies whether the information suspected as the detected malicious code is the actual malicious code. Output the verification result. The mobile terminal displays a warning message to the user when it is identified as a malicious code as a result of the second verification, or blocks access to a source from which input information identified as malicious code is introduced or to clean up the identified malicious code. Various applications can be performed to protect the mobile terminal from malicious code such as running an application program.

In particular, the malicious code processing apparatus 10A according to the present invention may further include a display unit (not shown). The display unit may display the first detection result and / or the second verification result to the user. In addition, it is possible to determine whether to proceed with the secondary detection by displaying the primary detection result and confirming whether or not to continue the secondary detection from the user, and can be variously applied as a user interface such as displaying the secondary detection result.

On the other hand, as an embodiment of the present invention, the second detection unit 14 may be implemented to verify whether the information suspected of malicious code is actually malicious code by applying a signature-based detection technique for more accurate verification. In other words, the signature data indicating the pattern of the malicious code is received from the central processing center 20A as the information required for the malicious code verification, and it is accurately verified whether the information suspected as the first detected malicious code is the actual malicious code.

As such, the second detector 14 downloads and uses only some of the signatures required for verification from the central processing center 20A instead of using a conventional large-capacity signature database, thereby minimizing the memory usage of the mobile terminal and significantly reducing CPU overhead. Can be reduced.

More specifically, the computer immune system-based detection technology is a technique in which the viral immune system of the biological immune system is applied to a computing device such as a personal computer, and the basic concept is described in An Immune System for Cyberspace by Jeffrey O. Kephart et al. in IEEE, 1997, pp. 879-884. In brief, the concept is a method of applying the self / non-self distinction mechanism of the human body to construct a resident file with safe files and is not sensitive to the resident file but is not a non-resident file. This is a method of generating features that react sensitively to non-self and using it as an immune database.

Computer immune system-based detection technology requires only a small amount of resident file feature information, eliminating the need to store a large malware signature database, significantly reducing CPU, memory, and battery overhead. In addition, there is no case in which the resident code is mistaken as an intrusion code, and even if an unknown new or modified malicious code is invaded, it can be detected as an intrusion code in real time without having to update the database. However, it is possible to detect input data that is not infected with malicious code as non-magnetic file and detect it as malicious code. Therefore, the detection accuracy is lower than that of signature-based detection technology.

In order to solve this problem, the mobile terminal malware processing system according to the present invention is characterized by performing a two-step detection process. That is, the primary detection unit 12 detects in real time all input information that may be malicious code, including unknown new or variant viruses, using a computer immune system-based detection technology using a small amount of feature information. In order to confirm whether the information suspected of the detected malicious code is actually malicious code, the second detection unit 14 performs signature-based detection technology to perform more accurate secondary verification by comparing the signatures with the actual malicious codes. do.

This minimizes the probability of false positives by compensating for the weaknesses of computer immune system detection technology, while significantly reducing CPU, memory and battery overhead, and real-time detection of unknown new or modified malware in real time. Taking advantage of the advantages, it is possible to implement an efficient mobile terminal malware processing system.

The above-described computer immune system-based detection technology for primary detection or signature-based detection technology for secondary detection are only one embodiment for implementing the malware processing system according to the present invention, and various detection technologies are applied. The mobile terminal malware system according to the present invention can be implemented. For example, in the case of signature-based detection technology for secondary detection, a technology for determining whether or not malicious code is executed by executing an input code in a virtual machine and monitoring the execution thereof may be used. Of course, this may be applied to the case where the second detection unit described later has sufficient resources as the central processing center. As such, the second detection unit may be implemented using various malicious code detection methods known or found in the related art.

On the other hand, the present invention is to reduce the mobile terminal or communication load by lightening the first detection unit in the mobile terminal and to simplify the relatively heavy second detection unit in the mobile terminal or to place the heavy second detection unit in the central processing center. Characterized in that the malicious code detection. Accordingly, the first detection unit or the second detection unit may be implemented by applying two or more detection techniques, and the first detection unit and the second detection unit according to the system designer's consideration, without departing from the core idea of the invention. Various applications are possible, such as having a separate third detector in addition to the second detector.

Hereinafter, for convenience of explanation, the present invention will be described by taking a computer immune system-based detection technique and a signature-based detection technique as an example.

3 is a block diagram of a central processing center according to the first embodiment of the present invention.

Referring to FIG. 3, the central processing center 20A connected to a mobile terminal and a wired or wireless network includes a database 24 and a processing unit 22.

The database 24 stores information necessary for malicious code verification. For example, when the second detection unit 14 uses a signature-based detection technique, signature data indicating a pattern of malicious code is stored in the database 24 as information necessary for malicious code verification. The detailed configuration of the database 24 will be described later.

The processing unit 22 receives information suspected of being primarily detected malicious code from the malicious code processing apparatus 10A of the mobile terminal, and the information suspected of receiving malicious code by referring to the database 24 is converted into actual malware. Extract information necessary for malicious code verification to determine whether it is applicable and send it to the mobile terminal. Information necessary for malicious code verification may be the above-described signature data.

As described above, the malware detection means is placed in the mobile terminal, but the CPU, memory and the mobile terminal are stored in the central processing center 20A without storing the large database 24 storing the information necessary for malicious code verification in the mobile terminal. The battery overhead can be greatly reduced.

On the other hand, the second embodiment according to the present invention is a mobile terminal malware processing system when the malicious code processing apparatus 10 performs the first detection process, the central processing center 20 performs the second detection process.

4 is a block diagram of a malicious code processing apparatus according to a second embodiment of the present invention.

4, the malicious code processing apparatus 10B according to the present invention includes a first detection unit 32 and a detection processing unit 36. The first detection unit 32 analyzes the information input to the mobile terminal to detect information suspected of malicious code that may damage the mobile terminal. As described above with reference to FIG. 2, the first detection unit 32 may be implemented to first detect information suspected of malicious code by applying a computer immune system-based detection technology. Since the 1st detection part 32 is the same as the structure mentioned above in FIG. 2, it abbreviate | omits description.

The detection processing unit 36 receives the suspected malicious code detected by the first detection unit 32 and transmits the suspected malicious code to the central processing center 20B connected to the mobile terminal via a wired or wireless network, and transmits the malicious information transmitted from the central processing center. It receives and outputs the result of the second verification whether the information suspected of the code is actually malicious code. The mobile terminal may display a warning message to the user when it is identified as a malicious code, block access to a source from which input information identified as malicious code, or to cure the identified malicious code. Various applications can be performed to protect the mobile terminal from malicious code such as running an application program. )

In particular, the malicious code processing apparatus 10B according to the present invention may further include a display unit (not shown). Through the display unit, the primary detection result and / or the detection processing unit 36 may display the secondary verification result received from the central processing center 20B to the user.

5 is a block diagram of a central processing center according to a second embodiment of the present invention.

Referring to FIG. 5, the central processing center 20B includes a database 44 and a second detection unit 42.

The database 44 stores information necessary for malicious code verification. For example, when the second detection unit 14 uses a signature-based detection technique, signature data indicating a pattern of malicious code is stored in the database 44 as information necessary for malicious code verification.

The second detection unit 36 verifies whether the information suspected of the malicious code received from the mobile terminal is the actual malicious code by referring to the signature data stored in the database, and transmits the verification result to the malicious code processing apparatus 10B. In this case, the second detection unit may verify whether the information suspected of the malicious code received from the mobile terminal is the actual malicious code by applying the signature-based detection technology.

According to the mobile terminal malicious code processing system according to the above-described second embodiment, the malicious code processing apparatus 10B primarily detects information suspected to be malicious code and transmits the information to the central processing center 20B to actually perform malicious information. It is configured to perform secondary verification of code. Therefore, compared to the first embodiment in which the malicious code processing apparatus 10A mounted in the mobile terminal receives the signature data necessary for the second verification from the central processing center 20A and performs the second verification, the CPU, memory, and battery overload are more severe. The head can be reduced and the communication overhead is also reduced.

On the other hand, the third embodiment according to the present invention is a mobile terminal malware processing system in the case of extending the above-described first embodiment.

6 is a block diagram of a malicious code processing apparatus according to a third embodiment of the present invention.

Referring to FIG. 6, the malicious code processing apparatus 10C according to the present invention includes a first detection unit 12, a second detection unit 14, and a detection processing unit 16, and further includes a storage unit 18. It can be provided.

The first detection unit 12 performs a primary detection function by analyzing information input to the mobile terminal to detect information suspected of malicious code that may cause damage to the mobile terminal. The first detection unit 12 is configured to be able to significantly reduce the CPU, memory and battery overhead, although the detection accuracy is lower than that of the conventional signature-based detection method.

The detection processor 16, in cooperation with the central processing center 20C, checks whether or not the information suspected to be a malicious code is an actual malicious code, thereby erroneously detecting normal input information of the first detection unit 12 as a malicious code. It aims to eliminate the possibility. To this end, the detection processing unit 16 transmits information suspected as the first malicious code detected by the first detection unit 12 to a central processing center connected by a mobile terminal and a wired or wireless network, and suspects the malicious code detected by the central processing center. Information necessary to verify the malicious code corresponding to the received information is received and transmitted to the second detection unit 14.

At this time, the communication between the mobile terminal and the central processing center is performed only when information suspected of infection is detected, so only a part of the information input to the portable terminal is transmitted to the central processing center. Therefore, it is possible to drastically reduce the communication overhead compared to US Patent Publication No. 2003-0162575, which is referred to as the prior art which transmits all data input to the portable terminal.

In addition, the detection processing unit 16 transmits all or part of the information suspected as the first detected malicious code, or all of the information suspected as the first detected malicious code to reduce the communication overhead with the central processing center 20C. Alternatively, a portion may be compressed and transmitted, or a feature may be analyzed, extracted, and transmitted from information suspected as primary detected malicious code, or may be compressed and transmitted.

The second detection unit 14 verifies whether the information suspected as the detected malicious code is the actual malicious code by using the received information necessary for verifying the malicious code and outputs the verification result.

On the other hand, the detection processing unit 16 transmits the version information of the detection engine mounted on the second detection unit 14 to the central processing center 20C, and when it is determined that the detection engine needs to be updated based on the version information, The detection engine program of the latest version can be received from the processing center to update the detection engine mounted on the second detection unit. That is, the detection processing unit 16 is responsible for requesting and receiving the signature data and the latest version detection engine program necessary for the secondary detection from the central processing center 20C.

Furthermore, the malicious code processing apparatus 10C according to the present invention may further include a storage unit 18, and the storage unit 18 may include information suspected to be firstly detected malicious code through the first detection unit 12. And information necessary to verify the malicious code corresponding thereto. Accordingly, the detection processing unit 16 stores the information necessary for the malicious code verification corresponding to the information suspected as the first detected malicious code in advance in the storage unit 18 before requesting the information necessary for the verification to the central processing center. You can check.

If the information necessary to verify the malicious code is stored, the detection processing unit 16 transmits the information necessary for verifying the stored malicious code to the second detection unit 14. Accordingly, the information suspected once detected as malicious code can reduce communication overhead by using information stored in the local storage unit 18 directly without communication with the central processing center 20C.

In particular, the malicious code processing apparatus 10C according to the present invention may further include a display unit (not shown). The display unit may display the first detection result and / or the second verification result to the user.

7 is a block diagram of a central processing center according to a third embodiment of the present invention.

Referring to FIG. 7, the central processing center 20C according to the present invention may include a database 24 and a processor 22, and may further include a database updater 26.

The database 24 stores information necessary for malicious code verification, the latest version information of the detection engine, and the latest version detection engine program. An example of the data structure of the database 24 is shown in FIG. Referring to FIG. 10, the database 24 stores input information and corresponding information (eg, signature data) necessary for verifying malicious codes, and includes version information and a detection engine of a detection engine capable of detecting the malicious code. The program may be further included.

The processor 22 receives information suspected of malicious code from the mobile terminal and extracts and carries information necessary for verifying whether the information suspected of received malicious code corresponds to the actual malware by referring to the database 24. Transmission to the malware processing apparatus 10C of the terminal. The information required for verification may be signature data representing a malicious code pattern when using signature-based detection technology.

In addition, the processor 22 receives the version information of the detection engine mounted on the portable terminal from the portable terminal, determines whether the update of the detection engine is necessary by referring to the database 24, and when the update is necessary, the portable terminal downloads the latest version detection engine program. To send.

If the database update unit 26 cannot find the information necessary for the verification of the malicious code corresponding to the information suspected as the malicious code from the database 24, it is not registered in the database 24 as a new virus or a variant virus, for example. If not, the database 24 may be updated by generating new signature data or a detection engine program for detecting the malicious code.

In addition, the database updater 26 may update the database by generating the latest version detection engine program together with the version information when the latest version detection engine program for the malicious code is developed.

In this case, when information suspected of unregistered malicious code is received, an analysis module (not shown) for newly generating signature data as information necessary for verification may be separately configured from the database updater 26. In this case, the analysis module (not shown) may newly generate not only the signature data but also the secondary detection engine program.

In the above-described embodiment, a computer immune system-based detection technique may be applied for the primary detection and a signature-based detection technique may be applied for the secondary detection. In addition, various types of detection techniques may be applied to the mobile terminal malware according to the present invention. Of course, the system can be implemented.

On the other hand, the fourth embodiment according to the present invention is a mobile terminal malware processing system in the case of extending the above-described second embodiment. That is, the central processing center 20D performs the secondary detection function and transmits the result to the malicious code processing apparatus 10D of the portable terminal. In particular, if the input information is determined to be normal information as a result of the secondary detection, information suspected to be malicious code corresponding to the input information is stored separately in the storage unit of the mobile terminal, and when similar input information is subsequently input, secondary detection is performed. It can be configured by adding a function to determine the normal input immediately.

More specifically, Figure 8 is a block diagram of a malicious code processing apparatus according to a fourth embodiment of the present invention.

Referring to FIG. 8, the malicious code processing apparatus 10D according to the present invention may include a first detection unit 32 and a detection processing unit 36, and may further include a storage unit 38.

The first detection unit analyzes the information input to the mobile terminal to detect information suspected of malicious code that may harm the mobile terminal.

The detection processor 36 transmits the information suspected as the first detected malicious code to the central processing center 20D connected with the mobile terminal and the wired / wireless network, and the information suspected as the malicious code transmitted from the central processing center is the actual malicious code. Receive and output the result of verifying whether

In addition, the storage unit 38 stores information verified as not the actual malicious code among the information suspected to be malicious codes transmitted according to the verification result received from the central processing center 20D.

The detection processing unit 36 sends the information suspected as the first detected malicious code to the central processing center 20D, before performing the second detection, the actual malicious code among the information suspected as the corresponding malicious code in the storage unit 38. Verify that the information verified as not is stored. If stored, the information suspected as the first detected malicious code without performing the second detection can be determined as not the actual malicious code, thereby reducing communication overhead.

In particular, the malicious code processing apparatus 10D according to the present invention may further include a display unit (not shown). Through the display unit, the primary detection result and / or the detection processing unit 36 may display the secondary verification result received from the central processing center 20D to the user.

9 is a block diagram of a central processing center according to a fourth embodiment of the present invention.

Referring to FIG. 9, the central processing center 20D according to the present invention includes a database 44, a processing unit 42, and a second detection unit 46.

The database 44 stores information necessary for malicious code verification.

The second detection unit 42 secondly verifies whether the information suspected of the malicious code received from the mobile terminal is the actual malicious code by referring to the database 44.

The processor 42 receives the suspected malicious code from the portable terminal, transmits the suspected malicious code to the second detector, and transmits the verification result of the second detector to the portable terminal. At this time, the processor 42 extracts the information verified as not the actual malicious code from the information suspected of the malicious code received from the mobile terminal according to the second verification result and transmits the information to the mobile terminal to transmit the information to the malicious code processing device ( 10D) can be stored in the storage unit 38.

Further, when the malicious code processing apparatus 10D of the portable terminal does not recognize the specific input information as normal information, the processing unit 42 provides the portable terminal with information necessary to update the storage unit 38 in the malicious code processing apparatus 10D. May be transmitted to the malware processing apparatus 10D.

Meanwhile, in the above-described embodiment, computer immune system-based detection technology may be applied for primary detection and signature-based detection technology may be applied for secondary detection. However, various types of detection techniques may be applied to the mobile terminal malicious according to the present invention. Of course, you can implement a code system.

Hereinafter, the mobile terminal malicious code processing method according to the present invention will be described based on the configuration of the mobile terminal malicious code processing system according to the present invention described above.

11 is a flowchart illustrating a malicious code processing method according to an embodiment of the present invention and is an example described based on the system configuration of the third embodiment.

Referring to FIG. 11, the malicious code processing apparatus 10C mounted on the portable terminal analyzes the information input to the portable terminal and primarily detects suspected malicious code that may cause damage to the portable terminal (S100). ).

At this time, the malicious code processing apparatus 10C checks whether or not the information suspected as the first detected malicious code has previously received the second verification result that the malicious code is not the malicious code by using the data stored in the storage unit 18 and confirms that it is the case. When the detection result of the normal input information rather than malicious code (S180).

In addition, by using the data stored in the storage unit 18 of the malicious code processing apparatus 10C, it is checked whether there is signature data corresponding to the information suspected of the primary detected malicious code (S110). If the signature data already exists, the second verification is performed using the stored signature data without having to communicate with the central processing center 20 (S160). On the other hand, if there is no stored signature data, the central processing center 20C transmits information suspected as the first detected malicious code and version information of the detection engine (S120).

The central processing center 20C extracts signature data corresponding to the suspected malicious code information from the database 44 (S130) and transmits the signature data to the malware processing apparatus 10C (S150). At this time, when it is determined that there is a latest version detection engine program stored in the database 44 using the version information of the detection engine, the corresponding latest version detection engine program is also transmitted (S150). On the other hand, when signature data corresponding to information suspected of being received malicious code does not exist as in the case of a new or variant virus, new signature data may be generated to update the database 44 (S140).

The malicious code processing apparatus 10C performs second verification on whether the information suspected as the first detected malicious code is the actual malicious code by using the received signature information (S160). As a result of the verification, when it is confirmed that the input is not a malicious code, the corresponding information is stored in the storage unit 38 inside the malware processing apparatus 10C and used for information suspected of being the same or similar primary detected malware later ( S170). Output the verification result and take the necessary measures (S180).

12 is a flowchart illustrating a malicious code processing method according to another embodiment of the present invention and is an example described based on the system configuration of the fourth embodiment.

Referring to FIG. 12, it can be seen that most procedures are similar to the example shown in FIG. 11. However, the central processing center 20D instead of the malicious code processing apparatus 10C mounted on the mobile terminal performs a second verification process that uses the extracted signature data to confirm whether the first suspected malicious code is the actual malicious code. There is a difference in performing at (S240).

A brief summary of the malicious code processing method according to the present embodiment is as follows.

The malicious code processing apparatus 10D analyzes the information input to the mobile terminal and primarily detects suspected malicious code that may damage the portable terminal (S200), and detects suspected information as the detected malicious code. The mobile terminal transmits to the central processing center connected to the wired or wireless network (S220). The central processing center 20D secondly verifies whether the information suspected of the detected malicious code is an actual malicious code using a database (S240). The malicious code processing apparatus 10D receives the secondary verification result transmitted from the central processing center (S250) and outputs the detection result (S270).

As described above, according to the present invention, there is provided an ultralight malware processing apparatus and a processing method thereof for minimizing battery consumption by minimizing CPU, memory and communication overhead without degrading malicious code detection performance.

That is, the present invention is characterized by configuring a malicious code detection system through mutual cooperation between the malicious code processing apparatus mounted on the mobile terminal and the central processing center. In particular, a primary detection process that inexpensively detects information (including programs or data) suspected of causing malicious code to harm the mobile terminal, and accurately confirms whether the information suspected of the first detected malicious code is actually malicious code. Provided is a mobile terminal malware processing system implementing a two-step detection process including a second detection process.

As a result, the CPU, memory, and battery overhead of the mobile terminal can be reduced and communication overhead can be reduced while increasing the detection accuracy. In addition, it is possible to detect unknown new malicious code or variant malicious code in real time.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

Claims (40)

A first detector for analyzing information input to the mobile terminal and detecting information suspected of malicious code that may damage the mobile terminal; And a second detection unit configured to receive information necessary for verifying malicious code from a central processing center connected to the portable terminal via a wired or wireless network and verify whether the detected suspected malicious code is an actual malicious code. Terminal malware processing device. The method of claim 1, wherein the first detection unit A mobile terminal malware processing device, characterized in that for detecting information suspected as the malicious code by applying a computer immune system based detection technology. The method of claim 1, wherein the first detection unit The mobile terminal malicious code, characterized by detecting information having a different characteristic from the resident program as suspected malicious code among information inputted to the mobile terminal with reference to characteristic information on the resident program in the mobile terminal previously stored. Processing unit. The method of claim 1, wherein the second detection unit A mobile terminal malware processing apparatus characterized by verifying whether the information suspected as the malicious code is a real malware by applying a signature-based detection technology. The method of claim 1, wherein the second detection unit The mobile terminal malicious code processing apparatus, characterized by verifying whether the information suspected of the malicious code is an actual malicious code by using signature data indicating a pattern of malicious code as the information necessary for the malicious code verification. The method of claim 1, And a display unit for displaying the detection result of the first detection unit and / or the verification result of the second detection unit. In the central processing center connected to a mobile terminal and wired or wireless network, Databases that store information needed to verify malware, and Receiving information suspected of malicious code from the mobile terminal, and extracts the information necessary for verifying the malicious code to determine whether the information suspected of the received malicious code corresponds to the actual malicious code with reference to the database; Central processing center comprising a processing unit for transmitting to a mobile terminal. The method of claim 7, wherein the information necessary for verifying the malicious code is The central processing center, which is used for signature-based detection technology and is signature data representing a pattern of malicious code. A first detector for analyzing information input to the mobile terminal and detecting information suspected of malicious code that may damage the mobile terminal; The information suspected as the detected malicious code is transmitted to a central processing center connected with the mobile terminal and a wired / wireless network, and the result of verifying whether the information suspected as the transmitted malicious code is from the central processing center is a real malicious code. Mobile terminal malware processing device comprising a detection processing unit for receiving. The method of claim 9, wherein the first detection unit A mobile terminal malware processing device, characterized in that for detecting information suspected as the malicious code by applying a computer immune system based detection technology. The method of claim 10, wherein the first detection unit The mobile terminal malicious code, characterized by detecting information having a different characteristic from the resident program as suspected malicious code among information inputted to the mobile terminal with reference to characteristic information on the resident program in the mobile terminal previously stored. Processing unit. The method of claim 9, And a display unit for displaying the detection result of the first detection unit and / or the verification result received by the detection processing unit. In the central processing center connected to a mobile terminal and wired or wireless network, Databases that store information needed to verify malware, and And a second detection unit which verifies whether the information suspected of the malicious code received from the mobile terminal is an actual malicious code by referring to the database. The method of claim 13, wherein the second detection unit The central processing center, characterized in that by applying the signature-based detection technology to verify whether the information suspected of malicious code received from the mobile terminal is the actual malicious code. The method of claim 13, wherein the second detection unit And a central processing center for verifying whether information suspected of malicious code received from the mobile terminal is actually malicious code by using signature data representing a pattern of malicious code as information required for malicious code verification. A first detection unit analyzing information input to the mobile terminal to detect information suspected of malicious code that may damage the mobile terminal The information suspected as the detected malicious code is transmitted to a central processing center connected with the mobile terminal and a wired / wireless network, and information necessary for verifying a malicious code corresponding to the information suspected as the detected malicious code is received from the central processing center. A detection processor transferring the second detection unit to the second detection unit; And a second detection unit which verifies whether the information suspected of the detected malicious code is an actual malicious code by using information necessary for verifying the malicious code received from the detection processing unit. The method of claim 16, wherein the detection processing unit When the version information of the detection engine mounted on the second detection unit is transmitted to the central processing center, and it is determined that an update of the detection engine is necessary based on the version information, the latest version of the detection engine program is transmitted from the central processing center. And receiving and updating a detection engine mounted on the second detection unit. The method of claim 16, Further comprising a storage unit for storing the information suspected of the detected malicious code, and the information required for verifying the received malicious code, The detection processing unit checks whether the information necessary for the malicious code verification corresponding to the suspected malicious code is previously stored in the storage unit before communicating with the central processing center, and if necessary, the detection processing unit is required to verify the malicious code stored in the storage unit. The mobile terminal malicious code processing device, characterized in that to transmit information to the second detection unit. The method of claim 16, And the detection processing unit transmits all or a part of information suspected of the detected malicious code to the central processing center. The method of claim 16, And the detection processing unit compresses all or a part of information suspected of the detected malicious code and transmits it to the central processing center. The method of claim 16, And the detection processing unit extracts a feature from information suspected of the detected malicious code and transmits the feature to the central processing center. The method of claim 16, And the detection processing unit extracts a feature from information suspected of the detected malicious code, compresses the extracted feature, and transmits the extracted feature to the central processing center. The method of claim 16, And a display unit for displaying the detection result of the first detection unit and / or the verification result of the second detection unit. In the central processing center connected to a mobile terminal and wired or wireless network, Database that stores information necessary for malicious code verification, latest version information of detection engine and latest version detection engine program, and Receive information suspected of malicious code from the mobile terminal and extract the necessary information to verify whether the information suspected of the received malicious code corresponds to the actual malicious code by referring to the database and transmit the information to the mobile terminal. Receiving version information of the detection engine mounted in the mobile terminal from the mobile terminal, referring to the database to determine whether the detection engine needs to be updated, and transmitting the latest version detection engine program to the mobile terminal when the update is necessary. Central processing center comprising a processing unit. The method of claim 24, If the information necessary for the verification of the malicious code corresponding to the information suspected of the received malicious code is not found in the database, information necessary to verify whether the information suspected of the received malicious code is an actual malicious code is generated. Central processing center further comprises a database updating unit for storing in the database. The method of claim 24, wherein the database update unit And generating the latest version information of the detection engine and the latest version detection engine program stored in the database and storing the latest version information in the database. The method of claim 24, wherein the information necessary for verifying the malicious code is Central processing center, characterized in that the signature data representing the malware pattern used in signature-based detection technology. A first detector for analyzing information input to the mobile terminal and detecting information suspected of malicious code that may damage the mobile terminal; The information suspected as the detected malicious code is transmitted to a central processing center connected with the mobile terminal and a wired / wireless network, and the result of verifying whether the information suspected as the transmitted malicious code is from the central processing center is a real malicious code. A detection processor for receiving and And a storage unit for storing information verified as not the actual malicious code among the information suspected of the transmitted malicious code according to the received verification result, The detection processing unit checks whether the information suspected of the detected malicious code is stored in the storage unit before communicating with the central processing center, and if it is stored, the information suspected of the detected malicious code is not an actual malicious code. Mobile terminal malware processing device, characterized in that judging. The method of claim 28, And the detection processing unit transmits all or a part of information suspected of the detected malicious code to the central processing center. The method of claim 28, And the detection processing unit compresses all or a part of information suspected of the detected malicious code and transmits it to the central processing center. The method of claim 28, And the detection processing unit extracts a feature from information suspected of the detected malicious code and transmits the feature to the central processing center. The method of claim 28, And the detection processing unit extracts a feature from information suspected of the detected malicious code and compresses the extracted feature to transmit the extracted feature to the central processing center. The method of claim 28, And a display unit for displaying the detection result of the first detection unit and / or the verification result received by the detection processing unit. In the central processing center connected to a mobile terminal and wired or wireless network, Database that stores information required for malware verification A second detection unit which verifies whether the information suspected of the malicious code received from the mobile terminal is an actual malicious code by referring to the database; And a processing unit for receiving information suspected of a malicious code from the mobile terminal, transmitting the suspected malicious code to the second detection unit, and transmitting the verification result of the second detection unit to the mobile terminal. The method of claim 34, wherein And the processing unit extracts the information verified as not the actual malicious code from the information suspected of the malicious code received from the portable terminal according to the verification result, and transmits the verified information to the portable terminal. The method of claim 34, wherein The information required for the malicious code verification is a central processing center, characterized in that the signature data representing the pattern of the malicious code. In the malicious code processing method of the mobile terminal, Firstly detecting information suspected of malicious code that may harm the mobile terminal by analyzing the information input to the mobile terminal Transmitting information suspected of the detected malicious code to a central processing center connected to the mobile terminal through a wired or wireless network; Receiving information necessary for verifying a malicious code corresponding to the information suspected of the detected malicious code from the central processing center; And a second step of verifying whether the information suspected as the detected malicious code is an actual malicious code by using the information necessary for verifying the received malicious code. A computer-readable information storage medium having recorded thereon a program capable of executing the method described in claim 37 on a computer. In the malicious code processing method of the mobile terminal, Firstly detecting information suspected of malicious code that may harm the mobile terminal by analyzing the information input to the mobile terminal Transmitting information suspected of the detected malicious code to a central processing center connected to the mobile terminal through a wired or wireless network; and And receiving a second verification result from the central processing center whether the information suspected of the transmitted malicious code is an actual malicious code. A computer-readable information storage medium having recorded thereon a program capable of executing the method described in claim 39 on a computer.

Images