KR20210039212A - Efficient ransomware detection method and system using bloom-filter - Google Patents

Abstract

Disclosed are an efficient ransomware detection method using a Bloom filter and a system thereof. According to one embodiment, the ransomware detection method performed by the ransomware detection system includes the following steps of: storing a logic block address for a read request occurring from a NAND flash memory, in a bloom-filter; inspecting whether overwrite has occurred with respect to the Bloom filter storing the logic block address for the read request as a write request occurs from the NAND flash memory; and detecting whether ransomware is active by using a characteristic value used for ransomware detection as the overwrite is determined to have occurred in the Bloom filter. Therefore, the present invention is capable of eliminating the need for installing a separate program to protect against ransomware.

Description

Efficient ransomware detection method and system using bloom filter {EFFICIENT RANSOMWARE DETECTION METHOD AND SYSTEM USING BLOOM-FILTER}

The description below relates to a technology for efficiently detecting ransomware, which has been a problem continuously.

Ransomware is a malicious program that encrypts and renders valuable files such as photos, programs, and business data existing on the user's desktop unusable, and then demands a cost for decryption. It first appeared in 1989 and began to appear again in 2005. Recently, as time passes, the types of ransomware increase and attack methods are diversified, and the number of victims and damage continues to increase. Since it can attack not only individuals and companies, but also public institutions and countries, it can cause great social confusion, so it is necessary to prevent ransomware through thorough management and a rapid detection and recovery system.

To solve this problem, a ransomware that collects read and write request information for the logical block address (LBA) at the block layer, and detects ransomware using the frequency of overwrites written to the same LBA after reading a specific LBA. Wear detection technology has been proposed. At this time, to determine overwrite, all read LBAs are stored using one hash table per second, and when a write LBA request is received, all n hash tables are checked. In addition, six characteristic values, such as the frequency of overwrite occurrence and the average of the number of writes, are collected every second, and based on the binary decision tree, it is determined whether or not ransomware is suspected in the second. If suspicion is accumulated and exceeds a certain threshold, it is finally determined that the ransomware is running. However, although the conventional technology is guaranteed to be safe from attacks by LAN software, it has a disadvantage in that the memory usage is large and the execution time is long.

It is possible to provide a method and system for efficiently detecting ransomware using a bloom filter.

The ransomware detection method performed by the ransomware detection system includes: storing a logical block address for a read request generated from a NAND flash memory in a bloom filter; Checking whether an overwrite has occurred in the bloom filter in which the logical block address for the read request is stored as a write request occurs in the NAND flash memory; And detecting whether ransomware is active by using a feature value used to detect ransomware as it is determined that the overwrite has occurred in the bloom filter.

The storing step includes generating a plurality of bloom filters having a bit arrangement, wherein the plurality of bloom filters include the plurality of bloom filters in order to add an element related to a logical block address to the read request. In each case, k hash values are calculated using the same k hash functions, all bits corresponding to each calculated hash value are set to 1, and k to check the elements related to the logical block address for the write request. The k hash values may be calculated using a hash function, and it may be checked in each of the plurality of bloom filters whether all bits corresponding to each calculated hash value are 1.

The ransomware detection method stores a logical block address for the read request in the bloom filter, and performs a specific process on the bloom filter in order to control an execution speed of checking whether the overwrite has occurred. The step of performing an element check is performed at the same k bit positions of each of the plurality of bloom filters, and a logical block address is added to an integer two-dimensional array having a size of k * block length. It may include storing the hash value calculated by the block length with k hash functions.

The performing step is Non-Cryptographic Hashing of obtaining k hash functions using a non-cryptographic hash function with k hash functions when adding an element to the Bloom filter and performing an element check. It may include the step of performing.

The storing may include collecting time information, start address, and size information at which the read request occurs as a read request occurs in the NAND flash memory, and a logical block address for the read request based on the collected time information. It may include storing (LBA) in the bloom filter.

The storing may include storing a logical block address for the read request in the bloom filter based on a preset time range, and when the read request exceeds the preset time range, a logical block for the read request It may include storing an address in a block filter following the block filter.

The step of checking whether the overwrite has occurred may include collecting information on the start address and size of the write request, as a write request is generated in the NAND flash memory, and responding to the read request from a plurality of bloom filters. It may include examining a bloom filter including a logical block address.

The detecting whether the ransomware is active may include determining that overwriting has occurred in the bloom filter including the logical block address for the read request when there is a bloom filter including a logical block address for the read request. It may include steps.

The characteristic value is OWIO indicating the number of overwrites occurring during a predefined time slice, and the total number of write requests occurring during a time window based on the time slice. OWST, which indicates the ratio of overwrites to the number of blocks, PWIO, which indicates the number of overwrites that occurred during the time window, and the average length of continuously overwritten blocks in the current time window. AVGWIO representing (length), OWSLOPE representing the ratio between the number of average overwrites in the previous time window versus the number of overwrites in the current time slice, and average writes in the previous time slice Including a value calculated from IO indicating a ratio of the number of times to the number of overwrites in the current time slice, and detecting whether the ransomware is active, the overwrite is used to calculate a feature value used for detection of the ransomware. It may include determining whether the ransomware is active based on the binary decision tree based on the feature value calculated from the number of writes.

The ransomware detection system includes: a logical block address storage unit that stores a logical block address for a read request generated from a NAND flash memory in a bloom-filter; An overwrite checker for checking whether an overwrite has occurred in a bloom filter in which a logical block address for the read request is stored as a write request occurs in the NAND flash memory; And a ransomware detection unit configured to detect whether ransomware is active by using a feature value used to detect ransomware as it is determined that the overwrite has occurred in the bloom filter.

In the present invention, if the ransomware detection algorithm is an environment that can be installed inside the SSD firmware or it is difficult to install on the SSD, the user needs to install a separate program to protect the ransomware because it can be made and operated as a general application program. none.

Since the present invention consumes less memory and has a very fast execution time, it hardly affects the performance of the SSD, so that manufacturers and users can expect the same performance as the existing SSD in an SSD equipped with a detection algorithm.

As the present invention consumes less memory, if a memory of the same size as before is used, a longer time can be observed using p bloom filters larger than n, through which ransomware, which was previously difficult to detect, can also be observed. It can be detected normally.

1 is an example showing a plurality of bloom filters used in an annular shape according to an embodiment.
2 is a block diagram illustrating a configuration of a ransomware detection system according to an embodiment.
3 is a flowchart illustrating a method of detecting ransomware in a ransomware detection system according to an exemplary embodiment.
4 is a flowchart illustrating a method of performing optimization in a ransomware detection system.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

1 is an example showing a plurality of bloom filters used in an annular shape according to an embodiment.

Bloom filters are probabilistic data structures devised by Burton Howard Bloom in 1970 to determine whether an element exists in a set. Although the Bloom filter judged that an element exists in a set, in reality, a false-positive that does not belong to the set may occur, and the opposite, false-negative, never occurs. There are four parameters of the bloom filter: the number of incoming elements n, the probability of collision p, the number of bits of the bloom filter m, and the number of hash functions k. When the number of elements n and the collision probability p are determined, optimal values of the remaining parameters m and k can be calculated using Equation 1.

Equation 1:

The bloom filter can be used after initializing all m bit arrays to 0. When adding an element to the bloom filter, it can be performed by calculating k hash values with k hash functions for the value of the element to be added, and then setting all the bits corresponding to each of the k hash values to 1. . When examining an element, k hash values can be calculated using k hash functions for the values of k elements, and the bits corresponding to each of the calculated k hash values can be checked. In this case, it may be checked whether all bits corresponding to k hash values calculated using k hash functions are 1. It is determined that an element belongs to the set only when all the bits are 1, and when any of the bits are not 1, it can be determined that the element has not been added to the bloom filter. Since bits are used and multiple hash functions are used, the possibility of collision can be adjusted and minimized while saving memory.

The ransomware detection system may be allocated space for using the bloom filter. At this time, one bloom filter may store a read request address for 1 second, and m MB of memory may be required. Basically, ransomware can be detected by observing n seconds using n (n is a natural number) bloom filter. In addition, in order to improve the detection accuracy of ransomware, ransomware can be detected by observing p seconds using p bloom filters more than n.

The ransomware detection system can operate on NAND flash memory. In this case, the NAND flash memory may represent a solid state drive (SSD). As a read request occurs in the SSD, time information, a start address, and size information of the read request occurrence may be collected, and the logical block address for the read request may be stored in the bloom filter based on the time information at which the read request occurred. The ransomware detection system may store a logical block address for a read request in the bloom filter based on a time range set in the bloom filter. In the ransomware detection system, a time range for storing a logical block address may be set in a block filter. For example, if the currently used bloom filter (Nth bloom filter) stores addresses for read requests that occurred in 3 seconds or more and less than 4 seconds, and the next read request occurs in 4 seconds or more, the bloom filter (Nth bloom filter) Based on order information set in relation to the bloom filter), a logical block address for a read request may be stored by moving to a bloom filter (N+1) following the bloom filter (Nth bloom Peter).

Assuming that n bloom filters are used as shown in FIG. 1, a logical block address for a read request is stored by rotating n bloom filters in an annular shape, and all bits of the bloom filter after n seconds are made 0, and then a new read is entered. You can store the logical block address for the request. In other words, after all bits of the bloom filter after a certain period of time are reset to 0, a logical block address for a read request newly requested from the bloom filter may be stored.

As a write request occurs, the ransomware detection system may collect information on the start address and size of the write request and check whether a logical block address for a read request exists for n bloom filters. If a block address for a read request exists in one or more bloom filters, the ransomware detection system may determine that overwriting has occurred by performing a write on the logical block address for the read request within the last n seconds. The ransomware detection system can increase the number of overwrite occurrences so that six characteristic values used for ransomware detection can be calculated.

The ransomware detection system can optimize the bloom filter. Multiple hash functions can be used when storing addresses in the bloom filter and when checking addresses. Therefore, in order to optimize the execution speed, all n bloom filters use the same k hash functions, and through this, duplicate hash calculations are not performed when checking the bloom filter when a write request is made. In addition, since there is no need to use cryptographic hashes such as SHA-256 or MD5 when performing a hash operation on an address, a non-cryptographic hash function with relatively short execution time was used. Finally, using a read speed faster than writing to memory, check if the bit at the location obtained as k hash values is 0 when storing the address in the bloom filter, and write the bit as 1 only when it is 0.

The ransomware detection system may obtain a result value indicating whether the ransomware is active by setting a plurality of characteristic values calculated from the number of overwrites and the number of writes as an input parameter of the binary decision tree. The ransomware detection system may acquire each feature value by calculating feature values corresponding to each of a plurality of features in a counting table. For example, the ransomware detection system may acquire six feature values. In this case, for example, six feature values may be calculated based on the counting table. The counting table may store information for obtaining a feature value according to each feature. The ransomware detection system may obtain whether or not ransomware is determined at a corresponding time (eg, seconds) by transferring six feature values to a binary pseudo tree. In other words, the output of the Euijin decision tree may correspond to a result value indicating whether the ransomware is active. If the determination of whether the ransomware detection system is 0, the possibility of being attacked by ransomware at a corresponding time is low, and if it is 1, the possibility of being attacked by ransomware is high. In other words, for example, if the ransomware is active (i.e., active), a value of 1 is output as a result value, and if the ransomware is not active, a value of 0 is output as the result value of the tree. Can be. The ransomware detection system may determine that the ransomware is active if the sum value output as 1 as a result of observing for a preset time is greater than a threshold value (eg, 3).

2 is a block diagram illustrating a configuration of a ransomware detection system according to an embodiment, and FIG. 3 is a flowchart illustrating a method of detecting ransomware in a ransomware detection system according to an embodiment.

The processor of the ransomware detection system 100 may include a logical block address storage unit 210, an overwrite inspection unit 220, a ransomware detection unit 230, and a bloom filter optimization unit 240. Components of such a processor may be expressions of different functions performed by the processor according to a control command provided by a program code stored in the ransomware detection system 100. The processor and components of the processor may control the ransomware detection system 100 to perform steps 310 to 330 included in the ransomware detection method of FIG. 3. In this case, the processor and the components of the processor may be implemented to execute an instruction according to the code of the operating system included in the memory and the code of at least one program.

The processor may load the program code stored in the program file for the ransomware detection method into the memory. For example, when a program is executed in the ransomware detection system 100, the processor may control the ransomware detection system 100 to load a program code from a program file into a memory under the control of an operating system. At this time, the processor and the processor included in the processor are each of the logical block address storage unit 210, the overwrite inspection unit 220, the ransomware detection unit 230, and the bloom filter optimization unit 240 among program codes loaded into the memory. It may be different functional representations of the processor for executing the subsequent steps 310 to 330 by executing an instruction of the corresponding portion. The operation of the bloom filter optimization unit 240 will be described with reference to FIG. 4.

In operation 310, the logical block address storage unit 210 may store a logical block address for a read request generated from the NAND flash memory in a bloom filter. The logical block address storage unit 210 may generate a plurality of bloom filters having a bit arrangement. At this time, the plurality of bloom filters calculate k hash values using the same k hash functions in each of the plurality of bloom filters in order to add an element related to the logical block address for the read request, and to each calculated hash value. All corresponding bits are set to 1, k hash values are calculated using k hash functions to check the elements related to the logical block address of the write request, and all the bits corresponding to each calculated hash value are It may be checked in each of the plurality of bloom filters whether it is 1 or not. As a read request occurs in the NAND flash memory, the logical block address storage unit 210 collects time information, start address, and size information at which the read request occurs, and based on the collected time information, the logical block address for the read request ( LBA) can be stored in the bloom filter. The logical block address storage unit 210 stores the logical block address for the read request in the bloom filter based on a preset time range, and when the read request exceeds the preset time range, the logical block address for the read request is stored. It can be stored in the next block filter.

In step 320, the overwrite inspection unit 220 may check whether an overwrite has occurred in the bloom filter in which the logical block address for the read request is stored as a write request occurs in the NAND flash memory. . As a write request occurs in the NAND flash memory, the overwrite inspection unit 220 collects information on the start address and size of the write request, and inspects the bloom filter including the logical block address for the read request address from the plurality of bloom filters. I can. When the bloom filter including the logical block address for the read request address exists, the overwrite checker 220 may determine that overwriting has occurred in the bloom filter including the logical block address for the read request address. At this time, according to the write request, the logical block address for the write request is overwritten by performing element checks for k bit positions from each of the plurality of block filters using the same k hash functions in each of the plurality of bloom filters. Overwrite can be checked.

In step 330, as the ransomware detection unit 230 determines that the bloom filter has been overwritten, it may detect whether the ransomware is active using a feature value used to detect ransomware. The ransomware detection unit 230 may determine whether the ransomware is active based on the binary decision tree based on the feature value calculated from the number of overwrites for calculating the feature value used for detecting the ransomware. At this time, the feature value is overwritten to prevent the user from recovering the original data by deleting the user's original file and recording new data (e.g., random data or original data encrypted by a hacker) in the deleted location. ) As a value indicating the characteristics of ransomware, indicating the number of overwrites occurring during a predefined time slice, and a write request occurring during a time window based on the time slice OWST indicating the ratio of overwrite blocks to the total number of (write requests), PWIO indicating the number of overwrites that occurred during the time window, and blocks with continuous overwrites in the current time window (continuously AVGWIO indicating the average length of the overwritten block), OWSLOPE indicating the ratio between the average number of overwrites in the previous time window versus the number of overwrites in the current time slice, previous It may include a value calculated from IO indicating a ratio of the average number of writes in the time slice to the number of overwrites in the current time slice. For example, the ransomware detection unit 230 may acquire whether to determine ransomware at a specific time. If the determination is 0, the ransomware detection unit 230 determines that the possibility of being attacked by ransomware at the current time (for example, the determined time) is low, and if it is 1, the possibility of being attacked by ransomware is high. I can. The ransomware detection unit 230 may finally determine that the ransomware is active if the sum value output as 1 is greater than the threshold value (set as 3 in the current program) as a result of observation for n seconds.

4 is a flowchart illustrating a method of performing optimization in a ransomware detection system.

In step 410, the bloom filter optimizer 240 may perform a first optimization on the bloom filter. The first optimization refers to memory optimization to prevent the same hash operation. When a write request occurs, the same hash operation may occur in a situation in which an element check is performed on 10 bloom filters, that is, in a situation in which an overwrite check is performed. If 10 bloom filters each use k different hash functions, when a write request occurs, k hashing must be performed for 10 bloom filters as much as the block length of the requested LBA. If the number of times the hash operation is performed is expressed as an equation, it is shown in Equation 2.

Equation 2:

Since the logical block address added to each bloom filter is not related to the logical block address added to other bloom filters, there is no problem even if all the bloom filters use the same k hash functions. For example, a plurality of bloom filters may all use the same k hash functions, so that, during an overwrite check, all of the plurality of bloom filters may perform element checks at the same k bit positions for a logical block address. In addition, a hash value obtained by calculating a block length as much as a block length with k hash functions of a logical block address can be stored in an integer 2D array of size (k×block length). By using this, the hash value of a specific logical block address calculated to check one bloom filter is not duplicated in order to check another bloom filter. In the embodiment, the number of hash operations performed after applying the first optimization is equal to Equation 3, and compared to before optimization, the number of hash operations required for an overwrite check occurring when a write request is made may be reduced to 1/10.

Equation 3:

In step 420, the bloom filter optimizer 240 may perform a second optimization on the bloom filter. The second optimization may mean non-cryptographic hashing. The bloom filter optimizer 240 obtains a hash value using only a non-cryptographic hash function that is relatively faster than a cryptographic hash function with k hash functions when adding elements to the bloom filter and checking the elements. You can do it.

The ransomware detection system according to an embodiment may be installed in SSD firmware to detect ransomware independently of an operating system (OS). The ransomware detection system can be installed inside the SSD firmware by using a bloom filter without affecting the performance of the SSD. As a result, the manufacturer's point of view can reduce the concern of the increase in the unit price for maintaining the performance due to the mounting of the detection algorithm, and the user's point of view is the ransomware by using an SSD of the same performance with the detection algorithm even without installing a separate program. Can be protected from attacks from Accordingly, it can be provided so that the SSD can be safely used from the threat of ransomware.

The apparatus described above may be implemented as a hardware component, a software component, and/or a combination of a hardware component and a software component. For example, the devices and components described in the embodiments are, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA). , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions, such as one or more general purpose computers or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications executed on the operating system. Further, the processing device may access, store, manipulate, process, and generate data in response to the execution of software. For the convenience of understanding, although it is sometimes described that one processing device is used, one of ordinary skill in the art, the processing device is a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it may include. For example, the processing device may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of these, configuring the processing unit to behave as desired or processed independently or collectively. You can command the device. Software and/or data may be interpreted by a processing device or, to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. Can be embodyed. The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -A hardware device specially configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

Although the embodiments have been described by the limited embodiments and drawings as described above, various modifications and variations can be made from the above description to those of ordinary skill in the art. For example, the described techniques are performed in a different order from the described method, and/or components such as systems, structures, devices, circuits, etc. described are combined or combined in a form different from the described method, or other components Alternatively, even if substituted or substituted by an equivalent, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and those equivalent to the claims also fall within the scope of the claims to be described later.

Claims (10)

In the ransomware detection method performed by the ransomware detection system,
Storing a logical block address for a read request generated in the NAND flash memory in a bloom-filter;
Checking whether an overwrite has occurred in the bloom filter in which the logical block address for the read request is stored as a write request occurs in the NAND flash memory; And
Detecting whether ransomware is active using a feature value used for ransomware detection as it is determined that the overwrite has occurred in the bloom filter
Ransomware detection method comprising a. The method of claim 1,
The storing step,
Creating a plurality of bloom filters with bit arrays
Including,
The plurality of bloom filters,
In order to add an element related to the logical block address for the read request, k hash values are calculated using the same k hash functions in each of the plurality of bloom filters, and all bits corresponding to each calculated hash value are 1 And, in order to check the elements related to the logical block address for the write request, k hash values are calculated using k hash functions, and whether the bits corresponding to each calculated hash value are all 1 Checked in each of the bloom filters
Ransomware detection method, characterized in that. The method of claim 1,
Storing a logical block address for the read request in the bloom filter, and performing a specific process on the bloom filter to control an execution speed of checking whether the overwrite has occurred
Including more,
The performing step,
An element check is performed at the same k bit positions of each of the plurality of bloom filters, and a hash value calculated by calculating the block length with k hash functions in an integer two-dimensional array of size k * block length is calculated. Steps to save
Ransomware detection method comprising a. The method of claim 3,
The performing step,
Performing non-cryptographic hashing to obtain k hash functions using a non-cryptographic hash function with k hash functions when adding elements to the Bloom filter and performing element checks.
Ransomware detection method comprising a. The method of claim 1,
The storing step,
As a read request occurs in the NAND flash memory, time information, start address, and size information of the read request occurs are collected, and a logical block address (LBA) for the read request is formed based on the collected time information. Steps to save to filter
Ransomware detection method comprising a. The method of claim 5,
The storing step,
Based on a preset time range, the logical block address for the read request is stored in the bloom filter, and when the read request exceeds the preset time range, the logical block address for the read request is next to the block filter. Steps to save in the block filter of
Ransomware detection method comprising a. The method of claim 1,
The step of checking whether the overwrite has occurred,
As a write request occurs in the NAND flash memory, collecting information on the start address and size of the write request, and checking a bloom filter including a logical block address for the read request from a plurality of bloom filters
Ransomware detection method comprising a. The method of claim 1,
The step of detecting whether the ransomware is active or not,
If there is a bloom filter including a logical block address for the read request, determining that overwrite has occurred in the bloom filter including the logical block address for the read request
Ransomware detection method comprising a. The method of claim 1,
The characteristic value is OWIO indicating the number of overwrites occurring during a predefined time slice, and the total number of write requests occurring during a time window based on the time slice. OWST, which indicates the ratio of overwrites to the number of blocks, PWIO, which indicates the number of overwrites that occurred during the time window, and the average length of continuously overwritten blocks in the current time window. AVGWIO representing (length), OWSLOPE representing the ratio between the number of average overwrites in the previous time window versus the number of overwrites in the current time slice, and average writes in the previous time slice Contains a value calculated from IO representing the ratio of the number of times to the number of overwrites in the current time slice,
The step of detecting whether the ransomware is active or not,
Determining whether ransomware is active based on a binary decision tree based on a feature value calculated from the number of overwrites for calculating a feature value used for detecting the ransomware
Ransomware detection method comprising a. In the ransomware detection system,
A logical block address storage unit for storing a logical block address for a read request generated from the NAND flash memory in a bloom-filter;
An overwrite checker for checking whether an overwrite has occurred in the bloom filter in which the logical block address for the read request is stored as a write request occurs in the NAND flash memory; And
Ransomware detection unit that detects whether ransomware is active by using a feature value used to detect ransomware as it determines that the overwrite has occurred in the bloom filter
Ransomware detection system comprising a.

Images