WO2018194198A1

WO2018194198A1 - Method and system for detecting application of obfuscation to and evaluating security of pe file

Info

Publication number: WO2018194198A1
Application number: PCT/KR2017/004243
Authority: WO
Inventors: 안성범; 전상훈; 정명주; 김태우; 정상민; 임성열; 한광희; 류주현; 서동필
Original assignee: 라인 가부시키가이샤
Priority date: 2017-04-20
Filing date: 2017-04-20
Publication date: 2018-10-25

Abstract

Provided are a method and a system for detecting application of obfuscation to and evaluating the security of a PE file. A method for evaluating security may comprise the steps of: registering a package file for installing and running an application; identifying a portable executable (PE) file included in the registered package file; extracting a body instruction of a method from a text section included in the PE file by using a metadata table included in the PE file; and analyzing the extracted body instruction to determine whether obfuscation has been applied to the method.

Description

Method and system for detection and security evaluation of PE file obfuscation

The following description relates to a method and system for detecting and evaluating the application of obfuscation of a PE file and to a computer program stored in a computer readable recording medium in combination with a computer for executing the security evaluation method on a computer. .

The App store is an online content marketplace that sells various applications that can be mounted on a terminal such as a smartphone. For example, the developer of an application registers a file (for example, an Android Application Package (Apk)) for installing a developed application on a terminal in an app store, and users of the application are required through the app store. By downloading a file for the application it is possible to install and run the application on their terminal. In addition, there are cases where various game applications such as game publishers are distributed to users. As such, there are application publishers that register various applications that are not developed by themselves, and distribute the registered applications to users.

At this time, the risk of the application can be described from various viewpoints.

For example, the first risk of an application is that the application contains information developed by malicious intentions, such as malicious code, to perform malicious functions on the terminal of the application publisher or the user on which the application is installed and run. There is a risk in the case. Korean Patent Laid-Open No. 10-2014-0098025 relates to a system and method for security evaluation of an application uploaded to an app store, and when an application to be registered in an app store detects a malicious function, the application Disclosed is a technique for rejecting entry into an app store.

As another example, the second risk of an application is the risk to the security of the application itself. As the source code of the application is changed or modified through analysis of the deployed application, the application performs a function other than the function originally intended by the developer, thereby reducing the reliability of the service to be provided through the application. This exists. Therefore, there is a need for application publishers to provide a certain level of security for applications in distributing various applications (installation files of applications) that they did not develop directly.

However, with respect to the second risk of such applications, there is a difference in the level of security provided for each registered application. For example, each application may be equipped with security solutions of different security levels and may not include any security measures. In addition, there are differences in the security levels provided by the security solutions mounted in each application.

In the prior art, only a Java-level vulnerability check can be performed at the programming language level (for example, Android Application Package (Apk)), and from the application publisher's point of view, each of the numerous registered applications There is a problem that it is difficult to provide security that is maintained above a certain level.

From the point of view of the application publisher, the level of security applied to the registered application is analyzed and identified in an objective manner in terms of obfuscation, vulnerability, and / or security solution, and the analyzed information is provided to provide security for the application. It provides a method and system for evaluating security that can be used to improve gender.

Provides a security evaluation method and system that can detect whether obfuscation is applied to PE (Portable Executable) files such as DLL (Dynamic Linking Library).

A method of evaluating security of an application, the method comprising: registering a package file for installing and running an application; Identifying a portable executable file (PE) file included in the registered package file; Extracting a body instruction of a method from a text section included in the PE file by using a metadata table included in the PE file; And analyzing the extracted body instructions to determine whether to apply obfuscation to the method.

A computer program for recording a computer program for executing the security evaluation method is provided.

A computer program stored in a computer readable recording medium for executing the security evaluation method in a computer in combination with a computer is provided.

A system for evaluating the security of an application, comprising: at least one processor implemented to execute computer readable instructions, the at least one processor registering a package file for installation and running of the application, Identify a PE (Portable Executable) file included in a registered package file, and use a metadata table included in the PE file to use a body instruction of a method in a text section included in the PE file. Extracting and analyzing the extracted body instructions to determine whether to apply obfuscation to the method.

From the point of view of the application publisher, the level of security applied to the registered application is analyzed and identified in an objective manner in terms of obfuscation, vulnerability, and / or security solution, and the analyzed information is provided to provide security for the application. Can be used to improve sex.

It can detect whether obfuscation is applied to a portable executable file (PE) such as a dynamic linking library (DLL).

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention.

2 is a block diagram illustrating an internal configuration of an electronic device and a server according to an embodiment of the present invention.

3 is a block diagram of a security evaluation system according to an embodiment of the present invention.

4 is a diagram illustrating an example of a PE file included in a registered package file according to one embodiment of the present invention.

FIG. 5 is a diagram for one example of a process of determining whether to apply obfuscation to a PE file in which an entire binary is encrypted according to an embodiment of the present invention.

6 illustrates an example of a PE file in which a specific class or a specific method is encrypted according to an embodiment of the present invention.

7 is a block diagram illustrating an example of components that may be included in a processor of a server according to an embodiment of the present invention.

8 is a flowchart illustrating an example of a security evaluation method that can be performed by a server according to an embodiment of the present invention.

9 is a flowchart illustrating an example of a method of extracting a body instruction according to an embodiment of the present invention.

FIG. 10 is a diagram illustrating an example of determining whether to apply obfuscation to a PE file according to an embodiment of the present invention. FIG.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings.

The security evaluation system according to the embodiments of the present invention may be implemented through a server to be described later, and the security evaluation method according to the embodiments of the present invention may be performed through the server described above. For example, a computer program according to an embodiment of the present invention may be installed and run on a server, and the server may perform a security evaluation method according to an embodiment of the present invention under control of the driven computer program. have. The computer program described above may be stored in a computer-readable recording medium in combination with a computer-implemented server to execute a security evaluation method on a computer.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention. The network environment of FIG. 1 illustrates an example including a plurality of

electronic devices

110, 120, 130, and 140, a plurality of

servers

150 and 160, and a network 170. 1 is an example for describing the present invention, and the number of electronic devices or the number of servers is not limited as shown in FIG. 1.

The plurality of

electronic devices

110, 120, 130, and 140 may be fixed terminals or mobile terminals implemented as computer devices. Examples of the plurality of

electronic devices

110, 120, 130, and 140 include a smart phone, a mobile phone, a navigation device, a computer, a notebook computer, a digital broadcasting terminal, a personal digital assistant (PDA), and a portable multimedia player (PMP). Tablet PC). For example, although FIG. 1 illustrates the shape of a smart phone as an example of the electronic device 1 110, in the embodiments of the present invention, the electronic device 1 110 may use a wireless or wired communication method to substantially connect the network 170. It may mean one of various physical devices that can communicate with other

electronic devices

120, 130, 140 and / or

servers

150, 160.

The communication method is not limited, and may include not only a communication method using a communication network (for example, a mobile communication network, a wired internet, a wireless internet, a broadcasting network) that the network 170 may include, but also a short range wireless communication between devices. For example, the network 170 may include a personal area network (PAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN), and a broadband network (BBN). And one or more of networks such as the Internet. The network 170 may also include any one or more of network topologies, including bus networks, star networks, ring networks, mesh networks, star-bus networks, trees, or hierarchical networks, but It is not limited.

Each of the

servers

150 and 160 communicates with the plurality of

electronic devices

110, 120, 130, and 140 through the network 170 to provide a command, code, file, content, service, or the like. It may be implemented in devices. For example, the server 150 may be a system that provides a first service to a plurality of

electronic devices

110, 120, 130, and 140 connected through the network 170, and the server 160 may also have a network ( It may be a system that provides a second service to the plurality of

electronic devices

110, 120, 130, and 140 connected through the 170. As a more specific example, the server 150 may be at least some of the devices constituting the system of the application publisher, and receives a package file of an application installed and operated on the plurality of

electronic devices

110, 120, 130, and 140. The service to be distributed can be provided as the first service. As another example, the server 160 may provide a service associated with the application as the second service to a plurality of

electronic devices

110, 120, 130, and 140 that install and run the application through the distributed package file. . According to an embodiment, the server 150 may be implemented as a dedicated system for evaluating the security of a package file to be registered to provide information about the evaluated security for the package file to be registered.

2 is a block diagram illustrating an internal configuration of an electronic device and a server according to an embodiment of the present invention. 2 illustrates an internal configuration of the electronic device 1 110 and the server 150 as an example of the electronic device. In addition, the other

electronic devices

120, 130, 140, or the server 160 may also have the same or similar internal configuration as the aforementioned electronic device 1 110 or the server 150.

The electronic device 1 110 and the server 150 may include

memories

211 and 221,

processors

212 and 222,

communication modules

213 and 223, and input /

output interfaces

214 and 224. The

memories

211 and 221 may be computer-readable recording media, and may include a permanent mass storage device such as random access memory (RAM), read only memory (ROM), and a disk drive. In this case, the non-volatile mass storage device such as a ROM and a disk drive may be included in the electronic device 1 110 or the server 150 as a separate permanent storage device that is separated from the

memories

211 and 221. In addition, the

memory

211, 221 includes an operating system and at least one program code (for example, a browser installed and driven in the electronic device 1 110 or an application installed in the electronic device 1 110 to provide a specific service). Code) can be stored. These software components may be loaded from a computer readable recording medium separate from the

memories

211 and 221. Such a separate computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, disk, tape, DVD / CD-ROM drive, memory card, and the like. In other embodiments, software components may be loaded into the

memory

211, 221 through a

communication module

213, 223 that is not a computer readable recording medium. For example, at least one program is a computer program that is installed by files provided by a file distribution system (for example, the server 160 described above) through the network 170 to distribute installation files of developers or applications. It may be loaded into the

memories

211 and 221 based on (for example, the above-described application).

Processors

212 and 222 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input / output operations. Instructions may be provided to the

processors

212, 222 by the

memory

211, 221 or the

communication modules

213, 223. For example, the

processors

212 and 222 may be configured to execute a command received according to a program code stored in a recording device such as the

memory

211 and 221.

The

communication modules

213 and 223 may provide a function for the electronic device 1 110 and the server 150 to communicate with each other through the network 170, and the electronic device 1 110 and / or the server 150 may communicate with each other. May provide a function for communicating with another electronic device (eg, electronic device 2 120) or another server (eg, server 160). For example, a request generated by the processor 212 of the electronic device 1 110 according to a program code stored in a recording device such as the memory 211 may be controlled by the server 170 through the network 170 under the control of the communication module 213. 150). Conversely, control signals, commands, contents, files, and the like provided according to the control of the processor 222 of the server 150 are transmitted to the communication module of the electronic device 1 110 via the communication module 223 and the network 170 ( It may be received by the electronic device 1110 through 213. For example, the control signal, command, content, file, etc. of the server 150 received through the communication module 213 may be transmitted to the processor 212 or the memory 211, and the content, file, etc. may be transferred to the electronic device 1. 110 may be stored as a storage medium (permanent storage described above) that may further include.

The input / output interface 214 may be a means for interfacing with the input / output device 215. For example, the input device may include a device such as a keyboard or a mouse, and the output device may include a device such as a display or a speaker. As another example, the input / output interface 214 may be a means for interfacing with a device in which functions for input and output are integrated into one, such as a touch screen. The input / output device 215 may be configured as one device with the electronic device 1110. In addition, the input / output interface 224 of the server 150 may be a means for interfacing with an apparatus (not shown) for input or output that may be connected to or included in the server 150. As a more specific example, the processor 212 of the electronic device 1110 uses data provided by the server 150 or the electronic device 2 120 in processing a command of a computer program loaded in the memory 211. The service screen or the content may be displayed on the display through the input / output interface 214.

Also, in other embodiments, the electronic device 1 110 and the server 150 may include more components than those of FIG. 2. However, it is not necessary to clearly show most of the prior art components. For example, the electronic device 1 110 may be implemented to include at least some of the above-described input / output devices 215 or other components such as a transceiver, a global positioning system (GPS) module, a camera, various sensors, a database, and the like. It may further include elements. More specifically, when the electronic device 1 110 is a smartphone, an acceleration sensor, a gyro sensor, a camera module, various physical buttons, a button using a touch panel, an input / output port, and vibration for a smartphone generally include Various components such as a vibrator may be implemented to be further included in the electronic device 1 110.

3 is a block diagram of a security evaluation system according to an embodiment of the present invention. The security evaluation system 300 of FIG. 3 may be implemented through the server 150 described above. In this case, the server 150 includes the package decomposition module 310, the file identification module 320, the parsing module 330, the analysis module 340, and the report module 350 included in the security evaluation system 300. May be representations of the different functions of the processor 222. For example, the package disassembly module 310 may be used as a function of the processor 222 in which the processor 222 of the server 150 disassembles a package file according to a control command included in a computer program. In this case, the vulnerability detection module 342 included in the analysis module 340 may be implemented as a core module for vulnerability detection.

As described above, the server 150 may provide a service for distributing package files of applications registered by developers to users.

In this case, the package disassembly module 310 may disassemble the registered package files. For example, an Android application package (Apk) is a file format of a package file used for distributing software and middleware of Android, which is a mobile operating system, and has a '.apk' extension. In the following embodiments, embodiments of the present invention will be described based on a package file such as an APK, but it will be readily understood by those skilled in the art that the same or similar features may be applied to other kinds of package files through this description. .

In addition, since the APK is already well known, the description of the APK file or the files themselves included in the APK file will be easily understood by those skilled in the art through the conventional arts, and thus, the APK file or the files included in the APK file itself. Detailed descriptions thereof will be omitted.

The file identification module 320 may identify files included in the disassembled package file. The extensions shown in Figure 3 ('dex', 'so', 'dll', 'json', 'ini', 'apk', 'xml', 'cert') as described previously, It will be readily understood by those skilled in the art.

The parsing module 330 may parse the identified files. To this end, the parser 331 may parse files of a specific extension (eg, 'dex', 'so', 'dll') among the identified files, and the collector 332 may parse a specific extension (eg, You can collect the necessary information from the files of 'json', 'ini', 'apk', 'xml', and 'cert').

For example, the parsing module 330 may identify each of the classes and methods included in the 'dex' file, and track a number of masses by instructing the instructions contained in the method. Can be identified by separating. The mass of instructions can be divided based on branch instructions such as the 'goto' statement, the 'switch' statement, or the 'if' statement. In addition, the parsing module 330 may generate and manage information on call relationships between these instruction masses. For example, the call relations between the instruction masses may be managed in a tree structure, and the information on the call relations may include information on a method called by a specific instruction mass. The generation and management of such information may be processed for each of files included in a package file such as an APK file, and the parsing method may vary according to the characteristics of the file.

The parsed information and the collected information may be passed to the analysis module 340.

The analysis module 340 obfuscates a corresponding package file (or an application installed and driven in a user terminal such as the electronic device 1 110 through the package file) based on the information transmitted from the parsing module 330. It can generate and provide analysis information from an obfuscation point of view, a vulnerability point of view, and a security solution point of view.

For example, the obfuscation detection module 341 may generate analysis information on the level of obfuscation applied to files of a specific extension (eg, 'dex', 'so', 'dll'). Can be. To this end, the obfuscation detection module 341 may determine whether obfuscation is applied for each preset item according to the type of file.

In addition, the vulnerability detection module 342 generates analysis information on whether there are any vulnerabilities in files of a specific extension (for example, 'dex', 'so', or 'config' which is a configuration file extension). can do. To this end, the security evaluation system 300 may manage information about known vulnerabilities, and the vulnerability detection module 342 uses information about these vulnerabilities to determine which vulnerabilities exist in which files. Analyze information can be generated.

In addition, the platform detection module 343 may extract information about the platform on which the corresponding application is developed and / or the platform on which the corresponding application operates. For example, the security evaluation system 300 may use different analysis methods depending on which platform the application is developed on, for example, a development tool such as Unity or Cocos.

Alternatively, the security evaluation system 300 may use a different analysis method for each platform because the file format included in the package file may vary for each platform on which the application operates.

To this end, the security evaluation system 300 may extract information about the platform for the package file, and may analyze the package file or provide information about the extracted platform to the outside based on such information.

The security tool detection module 344 can detect the security solution that the developer of the package file has inserted into the package file. For example, a first security tool provided in a library form by a third party may be added to a corresponding package file by a developer. As another example, a second security tool developed by the developer may be added to the package file by the developer. In other words, the security tool detection module 344 may generate analysis information about whether the security tool is applied to the package file.

The relationship analysis module 345 may generate analysis information about a reference relationship between files included in the package file. For example, when the first file includes code for calling the second file, the analysis information may be generated such that the information about the reference relationship between the first file and the second file is included in the analysis information.

The report module 350 collects the analysis information generated by the analysis module 340 and provides a report for the person of the security evaluation system 300 (for example, an administrator of the server 150 or a security inspection team of an application publisher). Can be generated. Such a report may be provided to terminals of related parties using Hypertext Markup Language (HTML) or eXtensible Markup Language (XML) as in the example of FIG. 3.

4 is a diagram illustrating an example of a PE file included in a registered package file according to one embodiment of the present invention. The package file registered in the security evaluation system 300 may include a PE file in which obfuscation is applied or a PE file in which obfuscation is not applied. In this case, the security evaluation system 300 may determine whether obfuscation is applied to the PE file included in the package file. The structure of the PE file is well known and will be readily understood by those skilled in the art without further explanation. For example, a DLL (Dynamic Linking Library) included in an Android application package (Apk) may be included as a PE file of a registered package file.

4 illustrates an example of the first PE file 410 to which obfuscation is not applied and the second PE file 420 to which obfuscation is applied by encrypting the entire binary included in the file. For example, if the registered package file includes the second PE file 420, the registered package file further includes information for decrypting the information encrypted in the second PE file 420 in another file. It may be. In this case, when an application is installed and driven in an electronic device (for example, the electronic device 1 110) through a package file, information for decrypting the encrypted information of the second PE file 420 is included in another file. As decrypted through the application, the application can run normally.

FIG. 5 is a diagram for one example of a process of determining whether to apply obfuscation to a PE file in which an entire binary is encrypted according to an embodiment of the present invention. When the entire binary is encrypted, such as the second PE file 420 described with reference to FIG. 4, a normal value (for example, a value always constantly included in the header of the PE file) may be extracted from the second PE file 420. Can't. For example, a header of a general PE file may be implemented as a dos header, a dos stub, a PE header, and a section table. In this case, the DOS header is composed of a total of 64 bytes, and the first part is defined to start with the signature of the DOS header called MZ. Accordingly, the security evaluation system 300 may recognize that the PE file is obfuscated when MZ, which is a predetermined value, is not extracted by attempting to extract the signature from the DOS header. In addition, a signature called BSJB is used in the .Net header.

5 illustrates an example in which the security evaluation system 300 attempts to extract a signature from the header of the second PE file 420 described with reference to FIG. 4. In this case, since the entire binary is encrypted (or obfuscated), the second PE file 420 does not extract the desired signature. Therefore, the security evaluation system 300 can confirm that obfuscation is applied to the second PE file 420.

According to an embodiment, the security evaluation system 300 may attempt to extract a plurality of different signatures. In this case, a score may be assigned according to whether each of the signatures attempted to be extracted is extracted, and a risk level for security of the PE file may be set based on the score. In this case, the lower the score, the higher the security of the PE file and conversely, the lower the risk level may be set. For example, if the signature of the DOS header is not extracted but the signature of the .NET header is extracted, it may be determined that encryption (or obfuscation) is applied to only some of the entire binaries of the PE file, in which case the entire binary is encrypted (or It may be set to be less secure and have a higher degree of risk than obfuscation).

On the other hand, obfuscation can be applied to PE files by encrypting by specifying only certain classes or specific methods in the executable code. Such executable code may be included in the '.text' section shown in FIG.

6 illustrates an example of a PE file in which a specific class or a specific method is encrypted according to an embodiment of the present invention. FIG. 6 shows an example of including a code 630 which is encrypted as a specific method is encrypted in the text section (.test, 620) of the PE file 610. FIG. Since the security evaluation system 300 does not know whether the obfuscation through encryption is applied to the PE file 610, a process for determining whether to apply the obfuscation needs to be performed.

Since the security evaluation system 300 does not know what classes and methods exist in the PE file 610, it may first parse and analyze the metadata table included in the PE file 610. For example, the security evaluation system 300 parses / analyzes the 'MethodDef' table, the 'ModuleRef' table, the 'TypeRef' table, and the 'TypeDef' table among a total of 42 metadata tables included in .NET 2.0 to analyze the class list. You can get it and map classes and methods. That is, the security evaluation system 300 may determine which classes exist in the PE file 610 and which methods are included in each class through analyzing the metadata table.

Accordingly, the security evaluation system 300 may identify the entire methods and determine whether encryption (or obfuscation) is applied to each of these entire methods. To this end, the security evaluation system 300 may obtain a RVA (Relative Virtual Address) representing a relative address value in the virtual memory of the method, and extract the body instruction of the method from the text section 620. .

In this case, the security evaluation system 300 may determine whether to apply obfuscation to a method corresponding to the extracted body instruction by analyzing the consistency of the operation code (operation code, opcode) included in the extracted body instruction.

In this case, there are 1 byte instructions and 2 byte instructions, and there is a conventional method for parsing these instructions. For example, in the conventional method, when 1 byte of data is read from a body instruction for parsing a method and the value is included in the range of '0x00 to 0xE0', it can be seen that the 1 byte of read data is a 1 byte instruction. If the value is not in the range of '0x00 ~ 0xE0', read the 2 byte data and check whether the value of the first byte is OxFE and whether the value of the second byte is in the range of '0x00 ~ 0x1E'. You can check it. At this time, when the value of the first byte is OxFE and the value of the second byte is included in the range of '0x00 ~ 0x1E', it can be seen that the read 2byte data is a 2-byte instruction. In addition, in the conventional method, the next instruction can be obtained by analyzing additional operation codes corresponding to each instruction. For example, if it is a 1 byte instruction and an instruction of 'int32 type', the next instruction can be obtained at a position 5 bytes behind (1 byte + 4 bytes (32 bits)).

However, if the method is encrypted, the instructions cannot be obtained in this way. Therefore, the security evaluation system 300 proceeds with general parsing on the extracted body instructions, and when normal parsing is not performed on at least one instruction, the security evaluation system 300 can determine that obfuscation is applied to the corresponding method. .

In this case, the security evaluation system 300 may perform such a parsing operation on each of the entire methods to determine the obfuscated methods among all the methods. In this case, the security evaluation system 300 may determine the security level of the PE file 610 based on the ratio of obfuscated methods among all the methods.

FIG. 7 is a block diagram illustrating an example of components that may be included in a processor of a server according to an embodiment of the present invention, and FIG. 8 is a security evaluation that may be performed by a server according to an embodiment of the present invention. A flowchart illustrating an example of the method.

The security evaluation system 300 according to the embodiments of the present invention may be implemented in the form of a computer device such as the server 150 described above. In addition, as shown in FIG. 7, the processor 222 of the server 150 is a package file register 710, a PE file identifier 720, and body instructions as components for implementing the security evaluation system 300. An extractor 730, an obfuscation determiner 740, a security determiner 750, and an information provider 760 may be included. The processor 222 and the components of the processor 222 may perform steps 810 to 860 included in the security evaluation method of FIG. 8. In this case, the processor 222 and the components of the processor 222 may be implemented to execute a control instruction according to a code of an operating system included in the memory 221 or a code of at least one program. Here, the components of the processor 222 may be representations of different functions of the processor 222 performed by the processor 222 according to a control command provided by a code stored in the server 150. . For example, the package file registration unit 710 may be used as a functional representation of the processor 222 in which the processor 222 registers the package file according to the above-described control command.

In operation 810, the package file registration unit 710 may register a package file for installing and driving an application. The package file can be registered with the application publisher for distribution to users of the application. As described above, the security evaluation system 300 may be implemented in a device that provides a service for distributing package files of applications for which an application publisher is registered, or as a separate system that communicates with the aforementioned device through the network 170. Can be implemented. For example, the security evaluation system 300 may receive and register a package file registered with an application publisher through the network 170. Such a package file may include an Android application package (Apk) as described above.

In operation 820, the PE file identification unit 720 may identify a portable executable file included in the registered package file. For example, when the package file is an Android application package, the PE file may be a DLL file. As described with reference to FIG. 3, the PE file to be identified may be identified through an extension of the file among the files identified through the package decomposition module 310 and the file identification module 320.

In operation 830, the body instruction extractor 730 may extract a body instruction of the method from a text section included in the PE file by using a metadata table included in the PE file. As already explained, the body instruction extractor 730 first recognizes the classes and methods contained in the text section of the PE file, and then obtains the RVA Relative Virtual Address (RVA) for each method, and then takes the necessary methods from the text section. Extract body instructions

In operation 840, the obfuscation determination unit 740 may analyze the extracted body instruction to determine whether to apply obfuscation to the method. As described above, whether or not obfuscation is applied to the method corresponding to the extracted body instruction may be determined by analyzing the consistency of the operation code (opcode) included in the extracted body instruction. Whether or not such obfuscation is applied may be determined for each of the entire methods to be identified.

In operation 850, the security determiner 750 may determine a security level of at least one of a package file and a PE file based on whether obfuscation is applied. For example, the security determiner 750 may determine a security grade (or risk grade) based on a ratio of methods determined to be obfuscated among all methods included in the text section. At this time, the higher the ratio, the higher the security rating may be, and conversely, the risk rating may be lowered.

In operation 860, the information provider 760 may report information on whether obfuscation is applied and information on the determined security level. For example, for an identified PE file, whether or not obfuscation is applied to the method, the total number of classes, the number of obfuscated classes, the total number of methods, the number of obfuscated methods, the ratio, the security Information such as a rating (or risk rating) may be provided to an administrator or user of the security assessment system 300.

9 is a flowchart illustrating an example of a method of extracting a body instruction according to an embodiment of the present invention. Steps 910 to 930 of FIG. 9 may be included in step 830 described with reference to FIG. 8 and may be performed by the body instruction extractor 730.

In operation 910, the body instruction extractor 730 may obtain a class list by parsing the metadata table. As already mentioned as an example, the security evaluation system 300 parses / analyzes the 'MethodDef' table, the 'ModuleRef' table, the 'TypeRef' table, and the 'TypeDef' table among a total of 42 metadata tables included in .NET 2.0. You can get a list of classes, and map classes and methods. At this time, it is obvious that information about classes and methods in the PE file is included in the format of the metadata table in the header of the PE file, and the body instruction extractor 730 is included in the header of the PE file according to the form or structure of the PE file. Those skilled in the art will readily understand that information on classes and methods can be obtained by appropriately utilizing the information provided.

In operation 920, the body instruction extractor 730 may map a class and a method based on the class list. For example, if class A includes method a, method b, and method c, the body instruction extractor 730 may map such class A with method a, method b, and method c. If method a, method b and method c are all obfuscated (or encrypted), it may be interpreted that obfuscation (or encryption) is applied to class A. The number of obfuscated classes described above can be determined based on this interpretation.

In operation 930, the body instruction extractor 730 may parse the header of the PE file to extract the body instructions of each mapped method. The extraction of such body instructions can be handled by searching for the corresponding method in the text section through the RVA (Relative Virtual Address), which represents the relative address value in the virtual memory of the method.

FIG. 10 is a diagram illustrating an example of determining whether to apply obfuscation to a PE file according to an embodiment of the present invention. FIG. 4 and 5 illustrate an example in which the entire binary of the PE file is obfuscated (or encrypted). For example, a PE file, such as a .Net file, is not loaded by the linker, unlike an Executable and Linkable Format (ELF) file, so it is loaded through a mono file (for example, the mono.so file), so that the entire file is encrypted and obfuscated. It is possible to do 10 illustrates an embodiment in which step 1010 is executed between

steps

820 and 830 described with reference to FIG. 8, but step 1010 is another step after step 820. They can also be run in parallel. In addition, another embodiment of the security evaluation method may be implemented, including

steps

810, 820, and 1010.

In operation 1010, the obfuscation determiner 740 may determine that the obfuscation is applied to the PE file when the signature is not extracted by attempting to extract the signature from the header of the portable executable file. If obfuscation (or encryption) is done for the entire binary of the PE file, the signature cannot be extracted. Accordingly, the obfuscation determination unit 740 may determine whether obfuscation is applied to the PE file in a simple manner such as whether the signature is extracted. In addition, as described above, an attempt may be made to extract a plurality of predefined signatures, and a security level or a risk level may be set and provided through scoring the extracted signatures.

As described above, according to embodiments of the present invention, in the objective of the application publisher, the security level applied to the registered application is determined in an objective manner in accordance with obfuscation, vulnerability, and / or security solution. It can be used to improve the security of the application by analyzing and understanding and providing the analyzed information. In addition, it is possible to detect whether obfuscation is applied to a Portable Executable (PE) file such as a DLL (Dynamic Linking Library).

The system or apparatus described above may be implemented as a hardware component, a software component or a combination of hardware components and software components. For example, the devices and components described in the embodiments are, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors, microcomputers, field programmable gate arrays (FPGAs). Can be implemented using one or more general purpose or special purpose computers, such as a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of explanation, one processing device may be described as being used, but one of ordinary skill in the art will appreciate that the processing device includes a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that it may include. For example, the processing device may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as parallel processors.

The software may include a computer program, code, instructions, or a combination of one or more of the above, and configure the processing device to operate as desired, or process it independently or collectively. You can command the device. Software and / or data may be any type of machine, component, physical device, virtual equipment, computer storage medium or device in order to be interpreted by or to provide instructions or data to the processing device. It can be embodied in. The software may be distributed over networked computer systems so that they may be stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The method according to the embodiment may be embodied in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the media may be those specially designed and constructed for the purposes of the embodiments, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Such a recording medium may be various recording means or storage means in the form of a single or several hardware combined, and is not limited to a medium directly connected to any computer system, but may be distributed on a network. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

Although the embodiments have been described by the limited embodiments and the drawings as described above, various modifications and variations are possible to those skilled in the art from the above description. For example, the described techniques may be performed in a different order than the described method, and / or components of the described systems, structures, devices, circuits, etc. may be combined or combined in a different form than the described method, or other components. Or even if replaced or substituted by equivalents, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are within the scope of the claims that follow.

Claims

In the method of evaluating the security of an application,

Registering a package file for installing and running the application;

Identifying a portable executable file (PE) file included in the registered package file;

Extracting a body instruction of a method from a text section included in the PE file by using a metadata table included in the PE file; And

Analyzing the extracted body instructions to determine whether obfuscation is applied to the method;

Security evaluation method comprising the.
The method of claim 1,

Determining a security level of at least one of the package file and the PE file based on whether the obfuscation is applied;

Security evaluation method characterized in that it further comprises.
The method of claim 2,

Determining the security level,

And determining the security level based on a ratio of methods determined to be obfuscated among all methods included in the text section.
The method of claim 2,

Reporting information on whether obfuscation is applied and information on the determined security level;

Security evaluation method characterized in that it further comprises.
The method of claim 1,

Extracting the body instruction of the method from the text section,

Parsing the metadata table to obtain a class list;

Mapping a class and a method based on the class list; And

Parsing the header of the PE file to extract body instructions of each of the mapped methods

Security evaluation method comprising the.
The method of claim 1,

Determining whether or not obfuscation is applied to the method,

And determining whether or not obfuscation is applied to a method corresponding to the extracted body instruction by analyzing the consistency of an operation code (operation code, opcode) included in the extracted body instruction.
The method of claim 1,

Attempting to extract a signature from the header of the Portable Executable (PE) file and determining that the obfuscation is applied to the PE file when the signature is not extracted

Security evaluation method characterized in that it further comprises.
A computer-readable recording medium having recorded thereon a computer program for causing a computer to execute the method of any one of claims 1 to 7.
In the system for evaluating the security of the application,

At least one processor implemented to execute computer-readable instructions

Including,

The at least one processor,

Register the package file for installing and running the application,

Identify a PE (Portable Executable) file included in the registered package file, the body instruction of the method in the text section included in the PE file using a metadata table included in the PE file (body instruction) ),

Analyzing the extracted body instructions to determine whether obfuscation is applied to the method;

Security evaluation system characterized in that.
The method of claim 9,

The at least one processor,

And a security level of at least one of the package file and the PE file is determined based on whether obfuscation is applied.
The method of claim 10,

The at least one processor,

Determining the security rating based on a percentage of the total methods included in the text section that have been determined to be obfuscated.

Security evaluation system characterized in that.
The method of claim 10,

The at least one processor,

Reporting information on whether the obfuscation is applied and information on the determined security level

Security evaluation system characterized in that.
The method of claim 9,

The at least one processor,

To extract the body instruction of the method from the text section,

Parse the metadata table to obtain a class list,

Map classes and methods based on the class list,

Parsing the header of the PE file to extract body instructions for each of the mapped methods

Security evaluation system characterized in that.
The method of claim 9,

The at least one processor,

To determine whether obfuscation is applied to the method,

Determining whether to apply obfuscation to a method corresponding to the extracted body instruction by analyzing the consistency of an operation code (operation code, opcode) included in the extracted body instruction

Security evaluation system characterized in that.
The method of claim 9,

The at least one processor,

If the signature is not extracted by attempting to extract a signature from the header of the portable executable file, determining that obfuscation is applied to the PE file

Security evaluation system characterized in that.