KR20180106430A - Network and host-based malware infection prevention system - Google Patents

Abstract

The present invention relates to a system for preventing a malicious code infection based on a network and a host, which comprises: an electronic recording medium for enabling a user to perform an Internet or network communication; a first scan server for generating a first hash map of an Internet domain; a second scan server for generating a second hash map and transmitting an analysis request based on the second hash map; and a third scan server for performing JavaScript rendering.

Description

[0001] NETWORK AND HOST-BASED MALWARE INFECTION PREVENTION SYSTEM [0002]

The present invention relates to a network and host-based malicious code infection prevention system and method, and more particularly, to a network and host-based malicious code infection prevention system capable of protecting a network and a host from malicious code.

In general, personal information is information about a living individual, which can be identified through a name, resident registration number, and images. In addition, if the information alone can not identify an individual but can be easily identified by combining other information, it can be considered to be included in personal information. That is, if one information or two or more pieces of information can be gathered to identify an individual, it can be called personal information.

In the past, the scope of personal information meant simple identification information such as name, resident registration number, date of birth, address, and so on. Today, however, it has become very wide to include personal information such as personal location information, bio information and personal preferences, inclinations, beliefs and ideas. If such personal information is exposed and abused, it may cause enormous financial and mental harm. Therefore, it is necessary to take special care to prevent exposure through the homepage.

In recent years, as Internet technology continues to develop and the use of the Internet has become commercially available all over the world, the online access activity of people has been increasing and the convenience of living has been increasing, have.

In addition, as the activity and infringement technology of Internet hackers increase, cyber damages of netizens and corporations are increasing due to leak of personal information and confidential company information. Such personal information and corporate confidentiality are caused by cyber attacks using malicious code.

Malicious code refers to code that can be executed automatically for malicious purpose. It is classified into virus, worm, Trojan horse, spyware, adware, Ransomware, and keylog, depending on the ability to self-replicate and the target of infection. In recent years, the symptoms and distribution methods of malicious codes have become complicated and intelligent, so that existing antivirus programs and dedicated anti-virus programs are being developed as integrated security programs capable of diagnosing and treating various malicious codes.

Especially, since the confidential documents possessed by corporations and the information of secretly developed technologies, sales information and databases are damaged, it is necessary to implement a corporate security system that can cope with cyber attacks against corporations There is a need.

However, the conventional security system or technology is composed of two security systems classified into a network area and a host area in a security system area. A security system that manages only a network area or a security system that manages only a host area There are many inconveniences that are difficult for the security system administrator to manage, and there is a problem that the personnel cost and the security management system are confused when the system is checked or the malfunction is restored.

Korean Patent Publication No. 10-2016-0142268 (December 12, 2016) Korean Patent Publication No. 10-2012-0078016 (Jul. 10, 2012)

It is an object of the present invention to provide a network and host-based malicious code infection prevention system capable of integrally managing a network area and a host area, and preventing malicious code from being distributed or accessed. do.

The problems to be solved by the present invention are not limited to the above-mentioned problems, and other problems to be solved by the present invention, which are not mentioned here, As will be appreciated by those skilled in the art.

According to a solution of the above-mentioned problem, the network and host-based malicious code prevention system of the present invention is an electronic recording medium in which a user enables Internet or network communication; A first hash map (Hashmap) of the Internet domain is transmitted to the Internet domain when the user transmits collection request information to the Internet domain to collect information of the Internet domain accessed by the user via the electronic record medium, A first scan server for generating a first scan request; Receives the first hash map from the first scan server, requests a URL (Uniform Resource Locator) from the Internet domain, terminates collection of the URL if the request is not answered, and receives the URL Extracts a link on a page-by-page basis of the received URL by performing crawling, generates a second hash map based on the extracted information of the link, and transmits an analysis request based on the second hash map A second scan server; And receiving the analysis request and the second hash map transmitted from the second scan server and checking whether the received information is obfuscated with Hyperlink Text Markup or JavaScript, And a third scan server for performing JavaScript rendering to decode the obfuscated code if the obfuscated code is found.

In addition, the malicious code DB is input through a plurality of malicious code DB domains, the engine version of the malicious code DB is constantly updated, and the engine data of the malicious code DB is interlocked with the network of the electronic record medium, And a monitoring server for transmitting the data to the medium.

Also, the electronic record medium may include an agent program for checking the integrity of data of the removable recording medium in cooperation with the malicious code DB when a removable recording medium using at least one of an electronic mail or a removable storage medium is used .

Also, the agent program records the API (Application Programming Interface) call frequency of the electronic record medium, and always stores the check result of the integrity and transmits the result to the electronic record medium.

In addition, the first scan server is connected to a switch hub having at least four connection layers and transmits an execution command to perform packet mirroring in the switch hub.

In addition, the control unit receives the external-homepage access record to which the user has accessed the area of the switch hub that has performed the packet mirroring, and transmits the external homepage access record to the electronic record medium.

According to the solution of the above problem, the network and host-based malicious code prevention system of the present invention has the effect of blocking the malicious code distribution site access by controlling the internet access of internal users such as an organization and a company.

In addition, a server having a malicious code distribution homepage detection engine is developed, and a database is constructed, thereby blocking malicious codes from intrusion attempts.

FIG. 1 is a diagram illustrating the overall structure of a network and host-based malicious code prevention system according to an embodiment of the present invention. Referring to FIG.
FIG. 2 is a diagram illustrating the overall structure of a network and host-based malicious code prevention system according to another embodiment of the present invention.
Figure 3 is a flow chart illustrating an example of a network and host based actual operational flow in accordance with one embodiment of the present invention.

The above and other objects, features and advantages of the present invention will be more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which: FIG. BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings.

In addition, in the entire specification, when a part is referred to as being 'connected' to another part, it may be referred to as 'indirectly connected' not only with 'directly connected' . Also, to "include" an element means that it may include other elements, rather than excluding other elements, unless specifically stated otherwise.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described in more detail with reference to the accompanying drawings.

FIG. 1 is a diagram illustrating a structure of a network and host-based malicious code prevention system according to an embodiment of the present invention.

Referring to FIG. 1, a network and host-based malicious code prevention system according to the present invention will be described in detail. Referring to FIG. 1, (40).

First, the electronic recording medium 10 is composed of a device capable of accessing the Internet or intranet such as a desktop, a notebook, a tablet PC, a mobile phone, a smart phone, a PDA and the like and capable of recording data inputted by a user.

Next, when the user attempts to access an online network such as the Internet using the electronic recording medium 10, the first scan server 20 transmits request information necessary for collection to the Internet domain The domain receives the request information transmitted in response to the request, and generates the first hash map to construct a data function suitable for analysis of the received information.

Next, the second scan server 30 receives the first hash map generated by the first scan server 20, generates a URL request code for collecting the URL of the domain accessed by the user, and transmits the generated URL request code to the domain . Then, the Internet domain that has received the URL request code terminates the reception of the URL in response to the request, the Internet domain receives the URL in response to the request, performs a crawling operation, The link is extracted in units.

Here, the method of extracting the received URL on a page-by-page basis uses a method of extracting a web page in a multi-step manner on the basis of a URL in a conventional method. This method is used to collect unnecessary contents, There is a problem that a memory resource for a page is wasted. Therefore, the present invention uses a method of extracting a unit of a page itself rather than a stepwise extraction method.

The second hash map is generated based on the extracted link information, and the analysis request is transmitted based on the second hash map. For example, when a request notification is generated, the request is transmitted to the analysis server or the multifunction server that performs analysis, and the analysis is performed, and another URL reception request is received in the same process.

Next, the third scan server 40 receives the analysis request transmitted from the second scan server 30, and analyzes HTML (Hyperlink Text Markup) or JavaScript included in the received information.

In addition, it checks whether the obfuscation has been made by searching the program codes of the received HTML (Hyperlink Text Markup) or JavaScript, and if the obfuscation code is found, performs JavaScript rendering to decode the obfuscation code to recover the code obfuscation . If the obfuscation code is not found, omit the JavaScript rendering operation.

In addition, malicious code often obfuscates code to hide its source or to interfere with script analysis and security instrument analysis.

In addition, code obfuscation can bypass detection through string reassembly and JavaScript obfuscation in script analysis of simple patterns and signature matching methods, and thus there is a problem that clear information can not be obtained. Therefore, decoding of code obfuscation for script analysis in tracking or detecting malicious code is very important technology, and reverse hacking technology such as code rendering or reverse engineering is widely used for decoding.

FIG. 2 is a diagram illustrating the overall structure of a network and host-based malicious code prevention system according to another embodiment of the present invention.

Referring to FIG. 2, the network and host-based malicious code prevention system includes a plurality of malicious code DBs, a monitoring server (not shown) for receiving a determination request from the third scan server 40 and determining whether the malicious code is infected 50).

In detail, the monitoring server 50 receives the analysis result data analyzed by the third scan server 40 and has undergone the script analysis or the script rendering operation, and detects a plurality of malicious codes And a malicious code DB collected from the code domain.

Also, the monitoring server 50 constructs a malicious code DB engine for checking against the analysis result data received from the third scan server 40 through the received malicious code DB, and updates the malicious code DB engine at all times do.

In addition, the monitoring server 50 updates the engine data of the malicious code DB to the latest in cooperation with the network of the electronic recording medium 10 used by the user, transmits the updated engine data to the electronic recording medium 10, The malicious code monitoring function of the medium 10 can be effectively enhanced.

Figure 3 is a flow chart illustrating an example of a network and host based actual operational flow in accordance with one embodiment of the present invention.

Referring to FIG. 3, the network and host-based malicious code infection prevention system of the present invention is a malicious code infection prevention system in which when an electronic recording medium 10 is connected to a portable recording medium such as an electronic mail or a removable storage medium, And an agent program that performs interworking with the DB and checks the integrity of data on the removable recording medium.

In addition, the present invention is connected to the first scan server 20 and can be connected to at least one server of the second scan server 30 or the third scan server 40, And further comprises a switching hub that configures the media 10 as one platform.

Here, the removable recording medium may be a software such as an e-mail system running on the inside of the electronic recording medium 10, an e-mail ring system using an external mail account such as SNS, SMTP or POP3 and a hardware structure such as USB, SD card, MicroSD, Is used.

The agent program records the frequency of calling an API (Application Programming Interface) in the electronic recording medium 10 and performs an integrity check on the first scan server 20, the second scan server 30, the third scan server 40, and transmits the same to the electronic recording medium 10. In addition, if a risk factor is found when transmitting the integrity check result to the electronic recording medium 10, or if a notification is found to be surely checked by the user, a notification is transmitted to the electronic recording medium 10 to display a notification window.

The API is a language or message format used to communicate between an operating system and an application program, and is implemented by calling a function that provides a connection to a specific subroutine for execution within the program.

Referring to FIGS. 2 and 3, the first scan server 20 is connected to a switch hub and transmits an execution command to perform packet mirroring in the switch hub. In addition, the port mirroring execution command may be transmitted to perform port mirroring instead of packet mirroring. In order to monitor or observe packets passing through the network switch port connected to the switch hub, a task of copying the packets to the server is performed .

Also, although not described in the present invention, when it is difficult to connect the switch hub due to a structural problem, the second scan server 30 or the third scan server 40 may be connected instead of the first scan server 20 , And configure a recovery route that can be transmitted to the first scan server 20 through the connected server.

In the area of the switch hub that has performed packet mirroring or port mirroring, the first scan server 20 receives the access record of the external homepage or online network accessed by the user.

In addition, the first scan server 20 transmits the connection record or the monitoring status record to the electronic recording medium 10 so that the user can easily check the homepage access record on the web or the online network connection record or the surveillance status record It can provide convenience for users to efficiently manage malicious code monitoring.

Furthermore, the present invention provides customized consulting to various organizations and companies through vulnerability management such as security information and event management (SIEM) and integrated security management (ESM) A malicious code prevention system that can block malicious code in advance can be provided.

As described above, it is to be understood that the technical structure of the present invention can be embodied in other specific forms without departing from the spirit and essential characteristics of the present invention.

Therefore, it should be understood that the above-described embodiments are to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than the foregoing description, All changes or modifications that come within the scope of the present invention should be construed as being included within the scope of the present invention.

10: Electronic recording medium
20: First scan server
30: Second scan server
40: Third scan server
50: Monitoring Server
21: Switching hub

Claims (6)

An electronic recording medium (10) enabling a user to make Internet or network communication;
When the user transmits collection request information to the Internet domain to collect information of the Internet domain accessed by the user through the electronic recording medium 10 and receives response information in response to the request information, A first scan server 20 for generating a hashmap;
Receives the first hash map from the first scan server 20, requests a URL (Uniform Resource Locator) to the Internet domain, terminates collection of the URL if the request is not answered, Extracts a link in units of pages of the received URL by crawling after receiving a URL, generates a second hash map based on the extracted information of the link, and transmits an analysis request based on the second hash map A second scan server 30 for transmitting the first scan request; And
Receives the analysis request and the second hash map transmitted from the second scan server 30, confirms whether the HTML information (Hyperlink Text Markup) or JavaScript of the received information is obfuscated, A third scan server (40) for performing JavaScript rendering to decode the obfuscated code if an obfuscated code is found in the script;
And a host-based malware infection prevention system. The method according to claim 1,
The malicious code DB is received via a plurality of malicious code DB domains, the engine version of the malicious code DB is constantly updated, and the engine data of the malicious code DB is linked with the network of the electronic recording medium 10, And a monitoring server (50) for transmitting the malicious code to the recording medium (10). The method according to claim 1,
The electronic recording medium 10 includes an agent program for checking the integrity of data on the removable recording medium in cooperation with the malicious code DB when a removable recording medium using at least one of e-mail and a removable storage medium is used Wherein said malicious code is a malicious code. The method of claim 3,
The agent program includes:
A network and a host-based device for recording the API (Application Programming Interface) calling frequency of the electronic recording medium (10), storing the integrity test result at all times, and transmitting the result to the electronic recording medium Malicious code infection prevention system. The method according to claim 1,
The first scan server (20)
A network and a host-based malicious code infection prevention system connected to a switch hub formed of at least four or more connection layers, and transmitting an execution command to perform packet mirroring in the switch hub. 6. The method of claim 5,
Wherein the control unit receives the external homepage access record to which the user has accessed the area of the switch hub that has performed the packet mirroring and transmits the external homepage access record to the electronic record medium Malware infection prevention system.

Images