WO2012023657A1

WO2012023657A1 - Network-based harmful-program detection method using a virtual machine, and a system comprising the same

Info

Publication number: WO2012023657A1
Application number: PCT/KR2010/007133
Authority: WO
Inventors: 최병호; 임철수
Original assignee: 주식회사 이세정보
Priority date: 2010-08-16
Filing date: 2010-10-18
Publication date: 2012-02-23

Abstract

The present invention relates to a method and system for detecting harmful programs on a network by simultaneously monitoring the network and individual user terminals as a whole, and the invention comprises a network-based harmful-program detection method using a virtual machine, the method comprising the steps of: (a) analysing all network data by using packet mirroring; (b) blocking unnecessary packets by filtering by means of a filtering engine; (c) generating statistical data specific to each IP whereby packets are sent and received; and (d) recording, on a database, files that have been collected through a filtering engine, then transmitting a suspect file to a virtual machine controller, and having the virtual machine controller transmit the transmitted suspect file to one of a plurality of virtual machines, that are on stand-by, for analysis in an analyser of the virtual machine, and the invention also comprises a system for the method.

Description

Network based malicious program detection method and system using virtual machine

The present invention relates to a network-based malicious program detection method and system using a virtual machine for monitoring the network and the entire individual user terminal at the same time to detect malicious programs on the network.

In the conventional network security equipment, since the main subject of the malicious code is mainly a packet of the network, the network security equipment determines whether the malicious code is the only event in the network area. Therefore, in case of excessive traffic, DDos attack, IP / MAC / ARP tampering attack by zombie PC, there is a limit that you cannot directly control the PC or malicious code existing in the network.

In the past, it took some time for new and variant malicious programs to emerge and spread. Nowadays, new or variant attacks are taking place within a day, including zero-day attacks.

In addition, the recent attacks proceed as a form of unknown as the techniques are increasingly intelligent. Therefore, there is a problem that the network security equipment can not discern this without directly analyzing the malicious code.

In the conventional signature-based network security equipment, malicious codes were collected by collecting malicious codes and analyzing these malicious codes by applying them to individual PCs.

However, since it takes a long time to collect malicious code and time to analyze and apply the collected malicious code to the user's PC, it is not a fundamental solution to block these attacks.

In addition, the existing security devices capture and analyze the information flowing through the network in one direction only, analyze the collected files through simple pattern comparison method without dynamic heuristic function, and do only the traffic based analysis.

On the other hand, agent-based security solutions operating on conventional PCs can obtain the pattern information or files of malicious codes at the process level by monitoring the status of individual PCs, but it is difficult to know the status of the entire network and agents. The disadvantage is that all must be installed.

In order to solve the above problems, the present invention detects and monitors not only traffic and packets on the network, but also zombies operating in the client and worms affecting the network, in conjunction with agents in the client, thereby ensuring organic security between the network and the client. The present invention aims to provide a network-based malicious program detection method using a virtual machine capable of system and a system thereof.

In addition, the present invention provides a network-based malicious program detection method and system using a virtual machine capable of bidirectional capture of packets flowing through a network and reducing false positive rates when analyzing collected data.

In addition, the present invention is to provide a network-based malicious program detection method and system using a virtual machine that can prevent the zombie PC and zero-day attack by real-time monitoring and updating the various traffic or files of the network and individual PC.

The present invention relates to a method and system for detecting harmful programs on a network by simultaneously monitoring the entire network and individual user terminals.

A network-based malicious program detection method using a virtual machine includes: (a) analyzing all data of a network by packet mirroring; (b) filtering and blocking unnecessary packets by the filtering engine; (c) generating statistical data for each IP at which packet transmission and reception occurs; And (d) writes the collected files through a filtering engine to a database and transfers the suspect files to the virtual machine controller, and the virtual machine controller delivers the received suspicious files to one of a plurality of waiting virtual machines. Analyzing at the analyzer; Characterized in that comprises a.

In addition, the network-based malicious program detection system using a virtual machine includes a mirroring module for mirroring data on the network; A filtering module for blocking unnecessary packets from the packets passing through the mirroring module by filtering the filtering engine; A data generation module for forming statistical data for each IP in which packet transmission and reception occur in a network; A file collection engine for collecting data passing through the filtering engine; A virtual machine controller controlling copying, destroying, and running of the virtual machine, transferring suspicious files among collected files to the virtual machine, and transferring suspicious file analysis results of the virtual machine to a database; A plurality of virtual machines having an analyzer configured to analyze a suspicious file received from the virtual machine controller, and transferring the suspicious file analysis result to the virtual machine controller; And a database storing statistical data for each IP, a file collected through a file collection engine, and a file analysis result of a virtual machine. Characterized in that it comprises a.

According to the present invention as described above can collect a file containing a command delivered to the suspect file and malicious code on the network through a packet combination and analyze it in a virtual machine. In other words, network equipment performs traditional traffic-based tasks, and virtual machines perform process-based PC-based analysis of executing and inspecting the corresponding files, securing security to the PC area that IPS or IDS could not fully satisfy. can do. Thus, an organic security scheme is possible between the network and the client.

Particularly, in the present invention, all the traffic flowing through the network can be monitored by performing bidirectional capture during mirroring.

In addition, unlike the existing network security equipment through the dynamic heuristic engine, it is possible to reflect the behavior patterns of the malicious code in detail to reduce the false positive rate.

In addition, in the present invention, dynamic heuristic signatures and traffic pattern signatures are automatically updated in real time according to various traffic or file analysis of the network and individual PCs, monitoring and results thereof. Therefore, when a file detected as a harmful program moves on the network, it can be immediately determined without further analysis. That is, it detects unknown DDos attack tools and malicious codes used in DDos attacks using the present invention, generates the details of the actions (C & C server IP, use port, communication type, etc.) as signatures and applies them to the security products that are built. This enables an integrated security system against large-scale DDos attacks and zero-day attacks.

1 and 2 are a flow chart of a network-based malicious program detection method using a virtual machine of the present invention.

Figure 3 is a detailed flowchart of the data passed through the filtering engine in the network-based malicious program detection method using a virtual machine of the present invention.

4 is a table showing a list of monitorable behaviors and their underlying data through dynamic heuristics.

5 is a conceptual diagram illustrating an embodiment in which a dynamic heuristic engine matches a policy based on process behavior.

6 is a flowchart illustrating an embodiment of a signature auto-update process of the virtual machine analyzer.

7 is a flow chart illustrating an embodiment for adding, changing, and deleting signatures in a virtual machine analyzer.

8 is a flow diagram illustrating an embodiment for signature auto-update of a packet filtering engine.

9 is a flow chart showing the order in which file downloads are blocked when collecting malicious files using the present invention.

10 is a block diagram of a network-based harmful program detection system using a virtual machine of the present invention.

10: Router 20: L4 Switch

30: Firewall 40: Tab

50: user terminal 60: management console program

100: mirroring module 120: filtering engine

130: data generation module 140: file collection engine

150: virtual machine controller 160: virtual machine

162: Analyzer 170: Database

180: detection and blocking module 190: notification module

200: process blocking module 210: inspection module

220: backup and recovery module 230: web manager

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings and preferred embodiments.

1 and 2 are flowcharts of a network-based malicious program detection method using the virtual machine 160 of the present invention.

The present invention relates to a network-based malicious program detection method using a virtual machine 160 to monitor the network and the entire individual user terminal 50 at the same time to detect malicious programs on the network. Analyzing the data; (b) filtering and blocking unnecessary packets by the filtering engine 120; (c) generating statistical data for each IP at which packet transmission and reception occurs; And (d) records the collected file through the filtering engine 120 in the database 170 and then transfers the suspicious file to the virtual machine controller 150, and the virtual machine controller 150 waits for the received suspicious file. Passing the data to one of the plurality of virtual machines 160 being analyzed so that the analyzer 162 of the virtual machine 160 analyzes the virtual machine 160; Characterized in that comprises a.

The present invention begins with analyzing all data of the network in a packet mirroring manner (step (a)).

The present invention uses a mirroring concept in which the tap 40 equipment is installed on the top of the network instead of the inline mode to capture all data flowing through the network in real time and use it for analysis. Therefore, it operates without overloading the network and does not cause any problem to the network even if a failure occurs.

In the present invention, by modifying the network device driver by using a technique capable of performing the communication between the driver and the application to achieve the highest speed, it is possible to allow the mirroring to achieve a sufficient capture performance. In addition, bidirectional capture can occur simultaneously, allowing both traffic to be monitored.

After the mirroring step is completed, an unnecessary packet is filtered and blocked by the filtering engine 120 (step (b)).

The filtering engine 120 skips all unnecessary surveillance targets and data other than the surveillance region, and has surveillance IP / PORT and unmonitored IP / PORT target information.

The filtering engine 120 proceeds with pattern analysis by signatures to discover malicious packets that attempt to invade. The address information and matching signature information of the packet are recorded in the database 170 log.

As shown in the flowchart of FIG. 3, in step (b), an unnecessary inspection object in the list is excluded from the inspection by using a white list.

In addition, it detects known harmful traffic in comparison with the pattern signature of the traffic, and detects that harmful file transmission and reception occurs, and transmits a rejection signal to the harmful file transmission / reception target to cause transmission and reception blocking. At this time, the harmful traffic detection history can be stored separately in the database (170).

Next, the user is notified of whether harmful file transmission or reception is blocked by a warning web page, and the like. Before this step, the blocking dedicated process of the harmful traffic generating PC is instructed to block the process generating the harmful traffic. Steps may be selectively performed by the user. Agents are the minimum modules for performing blocking and can optionally be installed.

Next, statistical data for each IP where packet transmission and reception occur is generated (step (c)).

In the step (c), statistical information is generated by analyzing all IP, PORT, and PROTOCOL information in which packet transmission and reception occur.

Such statistical data may be stored separately in the database 170, and the data recorded in the database 170 may view the real-time traffic status by the web manager 230. By viewing the packet transmission and reception contents, it is possible to identify specific PCs that increase traffic, and identify transmission paths of harmful traffic or suspicious files.

Therefore, information can be generated to centrally monitor the desired sub IP or group.

After the step (c), after (d) the file collected through the filtering engine 120 is recorded in the database 170, the suspect file is transferred to the virtual machine controller 150, and the virtual machine controller 150 The received suspicious file is delivered to one of the plurality of waiting virtual machines 160 and analyzed by the analyzer 162 of the virtual machine 160.

In the step (d), among the files passing through the filtering engine 120, executable files or files of a desired format are collected by the file collection engine 140. At this time, the malware signature file can be extracted by comparing the pattern signature.

That is, a file is collected from the packet information passing through the filtering engine 120, and the name and detailed information of the collected file are continuously recorded in the database 170 as a log.

The collected suspicious file is transferred to the virtual machine controller 150, and the virtual machine controller 150 delivers the suspicious file to the virtual machine 160.

The suspicious file is transmitted to the analyzer 162 which is a program for analyzing whether the suspicious file is malicious code by the virtual machine controller 150 and analyzed. When the analysis is completed, the analysis result is received by the virtual machine controller 150. It is delivered and stored in the database 170 again.

In this case, the files collected from the network may be the same file. In this case, the file analyzed once can extract unique information, and the same file can be skipped without further analysis, thereby reducing unnecessary performance.

Here, the database 170 is a file-based database 170 that can operate at a higher speed than the general database 170, and provides a function of storing and retrieving various data. In the present invention, the database 170 stores not only file collection details, but also harmful traffic detection details, statistical data details by IP, and malware analysis details, which can be viewed through the web manager 230.

Meanwhile, in the present invention, the virtual machine controller 150 copies, destroys, and operates the virtual machine 160 so that the collected suspect files can be inspected in the virtual machine.

In the present invention, the virtual machine 160 which analyzes the suspicious file and delivers the analysis result to the virtual machine controller 150 is destroyed.

At this time, the virtual machine controller 150 duplicates the virtual machine 160 as many times as the number of the destroyed virtual machine 160 so that the number of the virtual machine 160 remains the same.

The number of virtual machines 160 waiting is maintained to n, and when a collection file is added to a waiting queue to generate a virtual machine 160 that can be analyzed, several suspicious files may be delivered and analyzed up to n at the same time.

The virtual machine 160 is operated by a set number. When the virtual machine 160 is damaged, the virtual machine 160 is automatically generated and the virtual machine 160 is further operated. The analyzer 162 automatically resets the virtual machine 160 after completing the test, and always waits to recreate the clone to check the suspicious file.

On the other hand, the analyzer 162 existing in the virtual machine 160 is an agent program for analyzing whether the transferred suspicious file is malicious code, and is automatically operated when the virtual machine 160 is executed.

The analyzer 162 executes and analyzes the suspicious file and transmits the suspect file to the virtual machine controller 150.

The analyzer 162 includes an engine that monitors the use of native functions of the OS based on behavior and analyzes harmful programs by dynamic heuristic techniques.

Therefore, the suspicious file matched by the dynamic heuristic decision policy terminates the analysis, and transmits the policy content and suspicious file information that detects the suspicious file to the virtual machine controller 150.

On the other hand, the suspicious file which is not detected by the policy transmits the detailed behavior history and process information by the behavior-based native function usage monitoring to the virtual machine controller 150 and finishes the analysis.

The communication between the virtual machine controller 150 and the virtual machine analyzer 162 is a path directly connected to the OS, not a path of the existing malicious code, and the malware cannot move through this path. Therefore, the virus cannot be spread to the outside of the virtual machine 160, so it is safe.

In the present invention, since the malicious code is executed in the virtual machine 160 such as a PC environment, the behavior and characteristics of the malicious code at the time of execution can be analyzed.

The dynamic heuristic engine monitors the series of actions shown in FIG. 4, and a combination of these actions creates a policy. The process of performing a combination of these actions is matched to the policy upon detection, matching not only a single action but also the nature of the scenario in which the actions are combined.

In combination with actions, policies can be used to reduce false positives that are detected by normal processes as compared to detecting single actions, and to reflect in detail the behavior patterns of malware.

Detects processes matching with the dynamic heuristic policy set when the behavior monitoring policy is operated. At this time, the path, which is additional information for each behavior, is acquired and used as detailed analysis data of malicious code.

5 is a conceptual diagram of a dynamic heuristic engine matching a policy based on process behavior.

First, [action A, action B, action C] is the policy set in the dynamic heuristic engine. When the collected file arrives at the analyzer 162 of the virtual machine 160, the file is executed, from which the behavior of the process is compared in real time.

In FIG. 5, the harmful program 1, variant 1-1, variant 1-2, and new species 1 differ in some degree from each other, but include all of the above policies. Therefore, they all match.

This behavior-based detection / matching technique can detect newly emerging malware with one policy because its behavior does not change well even if the simple pattern signature of malicious code changes or variants appear.

As mentioned earlier, this policy is basically a concept of combination, so normal programs that don't match the combination are not detected. Therefore, the false positive rate can be reduced.

Subsequently, the analysis result of the virtual machine 160 of step (d) may be transmitted to the virtual machine controller 150 and then stored in the database 170 (step (e)).

Network-based malicious program detection method using the virtual machine 160 of the present invention is the pattern signature of the suspect file extracted from the virtual machine 160 after the step (e) of the filtering engine 120 and the virtual machine 160 And automatically updating the analyzer 162 (step (f)).

In other words, suspicious files analyzed as malicious programs automatically generate pattern signatures from the files, and signatures for traffic monitoring and dynamic heuristics for analyzers and signatures for detection through behavior combinations are automatically extracted and filtered. 120 and update the pattern of analyzer 162.

Here, the pattern updated in the filtering engine 120 is a malicious code signature or a harmful traffic signature, and the signature of the malicious code itself is set so that the malicious code detection is completed immediately without having to check again in the analyzer 162. If a traffic pattern signature is detected, the file is not analyzed by analyzer 162 and detection is completed with traffic detection.

6 is a flowchart illustrating an embodiment of a signature automatic update process of the virtual machine analyzer 162.

Here, the file collection engine 140 may collect a file having a set format. After file collection is completed, the file collection engine 140 may analyze the virtual machine 160 to know whether the file is malicious.

That is, the malicious file is operated in the virtual machine 160 to analyze the malicious behavior by comparing with the dynamic heuristic signature, and when it is determined to be a malicious file, the signature for the malicious file is automatically obtained and automatically registered in the database 170 next time. If detected, it is detected immediately, and the virtual machine clone is deleted and then restored.

If the same malicious file is collected, the signature for the file is obtained. If the same signature exists in the database 170, the virtual machine 160 immediately detects the malicious program without detecting an action.

7 is a flowchart illustrating an embodiment of adding, changing, and deleting signatures of the virtual machine analyzer 162.

In the present invention, the signature update of the analyzer 162 may be enabled only for the dynamic heuristic signature, except for the already verified signature value and the static heuristic signature attached to the analyzer engine.

At this time, a scenario that is a dynamic heuristic signature may be manually added, changed, or deleted according to a user's request.

That is, a new scenario (dynamic heuristic signature) can be added if there is a misdetection of a suspected file, and a scenario can be changed or deleted if a misdetection occurs when detecting using an existing scenario. .

Here, the scenario is composed of various types of actions, and the action can be added with parameters to further refine the scenario.

8 is a flowchart illustrating an embodiment of signature automatic update of the packet filtering engine 120.

The built-in signature of the packet filtering engine 120 is encrypted and stored as a file, and is used for real-time detection of malicious packets by parsing during initial operation. This signature can detect DDos and Exploit attacks.

The attack packet detected by the virtual machine 160 automatically updates the signature in the database 170 when the simulation attack succeeds, recovers the damage caused by the simulation attack to its original state, and waits for the simulation attack of another malicious packet.

When attack packets such as signatures detected in the virtual machine 160 are collected, the malicious packet is reported to be detected immediately without rescanning in the virtual machine 160.

Network based malicious program detection method using the virtual machine 160 of the present invention to determine the location of the transmission and reception of harmful traffic by monitoring the traffic status in real time between the step (c) and (d) And / or periodically performing a Taint check to determine whether a system file is damaged, and if a damaged system file is found, recovering the system to a backup file using the system backup and recovery module 220. It is done.

Taint test keeps data such as checksum of OS modules and periodically checks whether the file of the system is damaged or inoperable.

If a damaged system file such as a file is broken or changed through a Taint scan is found, it is a case of a problem with the operation of the entire system. Therefore, the system backup and recovery module 220 is used to backup the entire system to the original backup version. After recovery, reboot and return to normal.

To do this, back up system-wide information at initial startup and periodically check it to see if major module files are corrupted or inoperable.

The backup file backs up the current state when the system is running, always keeping the latest version. The original backup file can be stored in a compressed format and can be configured to operate according to the backup cycle.

The present invention is characterized in that the administrator can check each step through the web manager (230).

Web manager 230 is a management tool that allows you to see the contents of the present invention from mirroring to file analysis and action results at a glance.

The web manager 230 provides network statistics for IP / PORT / PROTOCOL for the packets monitored by mirroring to distinguish each PC, and outputs real-time file collection details and analysis results on the screen.

In addition, the signature analysis and analysis added by the virtual machine 160 and harmful traffic detection history detected at the traffic level and the target information for transmitting and receiving the traffic is also provided.

The analyzed file is provided to the administrator through the web manager 230 for further analysis and action at national agencies and cyber control centers. The report on the detailed data of the entire system from the past to the present can be output to a screen or a printer, or as a file. Provides the ability to save.

9 is a flowchart showing the order in which file downloads are blocked when collecting malicious files using the present invention.

In the present invention, by downloading again the files detected as malicious files to prevent the spread of malicious files.

FIG. 9 shows a situation in which a PE header of executable files detected as a malicious file is stored for this purpose, and when a file matching the PE header is downloaded, a TCP RST signal is sent to the server to block the file transfer. .

Next, the present invention relates to a system for detecting harmful programs on a network by simultaneously monitoring the entire network and individual user terminals 50, the mirroring module 100 for mirroring data on the network; A filtering module for filtering out unnecessary packets from the packets passing through the mirroring module 100 by the filtering engine 120; A data generation module 130 for forming statistical data for each IP in which packet transmission and reception occur in a network; A file collection engine 140 for collecting data passing through the filtering engine 120; It controls the copying, destruction, and operation of the virtual machine 160, and transfers suspicious files among the collected files to the virtual machine 160, while transferring suspicious file analysis results of the virtual machine 160 to the database 170. Virtual machine controller 150; A plurality of virtual machines 160 having an analyzer 162 therein that analyzes the suspicious file received from the virtual machine controller 150, and transmits the suspicious file analysis result to the virtual machine controller 150; And a database 170 storing statistical data for each IP, a file collected through the file collection engine 140, and a file analysis result of the virtual machine 160. It includes a network-based harmful program detection system using a virtual machine 160, characterized in that it comprises (see Figs. 1 and 10).

Here, the filtering module extracts harmful traffic in comparison with the pattern signature of the traffic, and detects and blocks a module 180 which transmits a reject signal to a harmful file transmission / reception target and blocks transmission and reception; And a notification module 190 for notifying a user of blocking transmission and reception of harmful files. Although consisting of, the database 170 is characterized in that further stores the harmful traffic detection history.

In addition, the filtering module is a process blocking module 200 for instructing the blocking of the process of generating harmful traffic to the agent dedicated to blocking of harmful traffic generating PC; Can be installed by user's choice.

In addition, the present invention provides a check module 210 for checking whether a system file is damaged by Taint test; A backup and recovery module 220 for recovering a damaged system file using the backup file; And a web manager 230 that monitors all data and operations on the system in real time. An update module for automatically updating the filtering engine 120 and the analyzer 162 of the virtual machine 160 with the pattern signature of the suspect file extracted from the virtual machine 160; It characterized in that it further comprises.

The web manager 230 performs a function of logging in and logging off a system, a function of viewing an on / off state or operating state of each module, and an entire system operation log, and storing and outputting data desired by an administrator.

Description of each module in the network-based malicious program detection system using the virtual machine 160 of the present invention includes the above-described information in each step of the network-based malicious program detection method using the virtual machine 160.

While the invention has been described in connection with the preferred embodiment as mentioned above, various modifications and variations are possible without departing from the spirit of the invention. Therefore, the claims of the present invention include modifications and variations that fall within the true scope of the invention.

Claims

The present invention relates to a method of detecting harmful programs on a network by simultaneously monitoring a network and an entire user terminal 50.

(a) analyzing all data of the network in a packet mirroring manner;

(b) filtering and blocking unnecessary packets by the filtering engine 120;

(c) generating statistical data for each IP at which packet transmission and reception occurs; And

(d) records the collected file through the filtering engine 120 in the database 170 and then transfers the suspicious file to the virtual machine controller 150, and the virtual machine controller 150 is waiting for the received suspicious file. Delivering to one of the plurality of virtual machines 160 for analysis by the analyzer 162 of the virtual machine 160; Network-based harmful program detection method using a virtual machine 160, characterized in that comprises a.
In claim 1,

Step (b) is

Using the white list to exclude objects in the list from the inspection;

Detecting harmful traffic in comparison with the pattern signature of the traffic and transmitting a rejection signal to the harmful file transmission / reception target to block transmission and reception, and storing the harmful traffic detection history in the database 170; And

Notifying the user of blocking harmful files; Network based harmful program detection method using a virtual machine, characterized in that consisting of.
In claim 2,

Instructing the blocking dedicated agent of the malicious traffic generating PC to block the harmful traffic before the user notification step; Network-based harmful program detection method using a virtual machine, characterized in that the addition.
In claim 1,

Between step (c) and step (d)

Monitoring the traffic status in real time with the web manager 230 to determine a location for transmitting and receiving harmful traffic; And / or

Periodically performing a Taint check to determine whether a system file is damaged, and recovering the system to a backup file using the system backup and recovery module 220 when a damaged system file is found; Network based malicious program detection method using a virtual machine, characterized in that is performed.
In claim 4,

The backup file is a network-based malicious program detection method using a virtual machine (160), characterized in that for backing up the current state when the system is running.
In claim 1

After step (d)

(e) storing the analysis result of the virtual machine 160 in the database 170 through the virtual machine controller 150; And

(f) automatically updating the filtering engine 120 and the analyzer 162 of the virtual machine 160 with the pattern signature of the suspicious file extracted from the virtual machine 160; Network based malicious program detection method using a virtual machine, characterized in that is performed.
In claim 6,

And analyzing the suspicious file and transmitting the analysis result to the virtual machine controller (150). The virtual machine (160) using the virtual machine (160) is characterized in that it is destroyed.
In claim 7,

The virtual machine controller 150 replicates the virtual machine 160 as many times as the number of the destroyed virtual machine 160 to maintain the same number of the virtual machine 160 using the virtual machine 160. Network based malicious program detection method.
The compound according to any one of claims 1 to 8,

Each step is a network-based malicious program detection method using a virtual machine 160, characterized in that the administrator can check through the web manager (230).
The present invention relates to a system for detecting harmful programs on a network by simultaneously monitoring a network and an entire user terminal 50.

A mirroring module 100 for mirroring data on a network;

A filtering module for filtering out unnecessary packets from the packets passing through the mirroring module 100 by the filtering engine 120;

A data generation module 130 for forming statistical data for each IP in which packet transmission and reception occur in a network;

A file collection engine 140 for collecting data passing through the filtering engine 120;

It controls the copying, destruction, and operation of the virtual machine 160, and transfers suspicious files among the collected files to the virtual machine 160, while transferring suspicious file analysis results of the virtual machine 160 to the database 170. Virtual machine controller 150;

A plurality of virtual machines 160 having an analyzer 162 therein that analyzes the suspicious file received from the virtual machine controller 150, and transmits the suspicious file analysis result to the virtual machine controller 150; And

A database 170 storing statistical data for each IP, a file collected through the file collection engine 140, and a file analysis result of the virtual machine 160; Network-based harmful program detection system using a virtual machine 160, characterized in that it comprises a.
In claim 10,

The filtering module

A detection and blocking module 180 for extracting harmful traffic compared to the pattern signature of the traffic and transmitting a reject signal to the harmful file transmission / reception target to block transmission and reception; And

Notification module 190 for notifying the transmission and reception of harmful files to the user; Although, the database 170 is a network-based harmful program detection system using a virtual machine 160, characterized in that further stores the harmful traffic detection history.
In claim 11,

The filtering module may include a process blocking module 200 for instructing a blocking dedicated agent of a malicious traffic generating PC to block a process of generating harmful traffic; Network-based malicious program detection system using a virtual machine 160, characterized in that it further comprises.
In claim 10,

A inspection module 210 for checking whether a system file is damaged through a Taint test;

A backup and recovery module 220 for recovering a damaged system file using the backup file; And

A web manager 230 that monitors all data and operations on the system in real time; Network-based harmful program detection system using a virtual machine 160, characterized in that it comprises a.
In claim 10,

An update module for automatically updating the filtering engine 120 and the analyzer 162 of the virtual machine 160 with the pattern signature of the suspect file extracted from the virtual machine 160; Network-based malicious program detection system using a virtual machine 160, characterized in that it further comprises.