WO2020189823A1

WO2020189823A1 - Device and method for dealing with malicious programs by using technique of checking validity of redirection file

Info

Publication number: WO2020189823A1
Application number: PCT/KR2019/003223
Authority: WO
Inventors: 황규민; 한관석; 김의탁
Original assignee: 주식회사 하우리
Priority date: 2019-03-20
Filing date: 2019-03-20
Publication date: 2020-09-24

Abstract

According to the present invention, a monitoring filter (130) checks whether a program (110) accessing a computer system and making a file open request is a program to be monitored, and after being checked, if the program is not a program to be monitored, the program is permitted to normally modify an original file held in an original data storage means (150), but if the program making a file open request is identified as a program to be monitored, the monitoring filter (130) creates a new redirection file, which is a copy of the original file stored in the original data storage means (150), and stores the created file in a redirection data storage means (160), which has a path different from the path to where the original file is stored, wherein the program to be monitored is permitted to modify only the redirection file stored in the redirection data storage means (160). After the validity of the redirection file has been checked, if valid, the redirection file is merged with the original file, but if invalid, the redirection file is deleted from the redirection data storage means (160).

Description

Malware processing device and processing method based on the validation method of the redirection file

This application is the result of a study (No. 2016-0-00078, Cloud-based intelligent security technology development to provide customized security services) conducted with the support of the Korea Information and Communication Planning and Evaluation Agency with the funding of the Government of the Republic of Korea (Ministry of Science and ICT) in 2018. It is filed by.

The present invention relates to a malicious program processing apparatus and a processing method, and in particular, a file modified by the monitoring target program when a file accessed to a computer system is a monitoring target program that needs monitoring because it is suspected as a malicious program infected with malicious code, etc. The present invention relates to a malicious program processing apparatus and a processing method according to a method of validating a redirection file that safely protects the system from malicious programs by managing them in a redirection path.

It is a detection method of so-called malicious programs that infiltrate and damage computer systems without the user's knowledge, such as computer viruses, worms, Trojan horses, or spyware. A signature-based static detection method and behavior based on the behavior of malicious programs There is a base detection method.

Among these methods, there are various detection methods described in Patent Documents 1 and 2 as an action-based detection method that detects malicious or not by analyzing the behavior of an executed program.

In Patent Document 1, by analyzing the API and parameters that are called when the file (program) to be analyzed is executed, the risk score of the action is measured, and the risk score of the file is calculated by summing the measured risk score. It checks whether it is a malicious program.

In addition, Patent Document 2 creates a feature vector using feature factor information collected during the execution of a process (program), and detects whether the process contains malicious code using the generated feature vector. .

However, in the known behavior-based detection methods including Patent Documents 1 and 2, it is not possible to cure or restore actions performed before the program being executed is identified as a malicious program, for example, modifying or deleting the original file, or changing the path. There is a problem that it is difficult.

{Prior technical literature}

{Patent Literature}

(Patent Document 1) Registered Patent No. 10-1404882 (announced on June 11, 2014)

(Patent Document 2) Publication No. 10-2017-81386 (published on July 12, 2017)

The present invention has been made in view of the above problems of the prior art, and manages system resource manipulation actions of a suspected program separately from the original system resource, and when the program is identified as a malicious program, it is managed separately. An object of the present invention is to provide a malicious program processing apparatus and a processing method based on a method of validating a redirection file that maintains the system in the environment before the malicious program was executed by removing the old resources.

The malicious program processing apparatus of the present invention for solving the above problem includes a monitoring filter that checks whether a program that accesses a computer system and requests a file open is a program to be monitored as a malicious program, and whether the program to be monitored is It includes a monitoring target item database holding a monitoring target item for determination, and the monitoring filter determines that the program requesting the file open corresponds to any one or more of the monitoring target items, and , A redirection file is created by copying the original file of the file requested to be opened by the monitoring target program, and the generated redirection file is stored in a redirection path that is different from the file path of the original file.

In addition, the malicious program processing method of the present invention for solving the above problem includes the step a) of determining whether a program requesting a file open request by accessing a computer system is a monitoring target program suspected of being a malicious program, and the step a ), if the program that requested to open the file is a program to be monitored, step b) of creating a redirection file by copying the original file of the file requested to be opened by the program, and the redirection file generated as a file of the original file And storing c) in a redirection path that is a path different from the path.

As described above, the present invention separates and stores a file modified by a normal program and a file modified by a monitoring target program suspected as a malicious program in different paths. The file and the file modified by the normal program can be managed separately from each other, and when the validation of the redirection file turns out to be ineffective, it can be easily processed by deleting the invalid redirection file from the system. The system can be safely protected from malicious programs.

1 is a block diagram showing a malicious program processing apparatus according to a preferred embodiment of the present invention.

2 is a flowchart showing the flow of a malicious program processing method according to a preferred embodiment of the present invention;

3 is a flowchart showing the flow of a file validity verification method for validating a file.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First, a malicious program processing apparatus according to a preferred embodiment of the present invention will be described. 1 is a block diagram showing a malicious program processing apparatus according to a preferred embodiment of the present invention.

The malicious program processing apparatus 100 in this embodiment uses a redirection technique that separates and manages a resource used by a normal program and a resource used by a malicious program. The monitoring filter 130 is configured by adding a redirection function to the filter that monitors the behavior between the program 110 running in the user mode and the actual data in the kernel mode. By separating and managing the actual data and the resources used by the malicious program according to (130), the resources in the computer system can be safely protected.

The malicious program processing apparatus 100 of the present embodiment that executes the above functions is installed in a computer system, and as shown in FIG. 1, the monitoring filter 130, the monitoring target item database 140, and the original data storage means 150 ) And a redirection data storage unit 160 and a redirection information memory 170.

The monitoring filter 130 adds a redirection function to the mini filter provided by the Windows OS (Windows Operating System), and all programs that request file open to execute certain tasks by accessing the computer system ( 110), the program 110 determines whether it is a program that is suspected of being infected with malicious code, that is, a program to be monitored, and in the case of a program to be monitored, the redirection file from which the original file is copied is different from the path of the original file. It is stored in the redirection path, which is the path, and the modification of the file by the monitoring target program is executed only for the redirection file.

In more detail, in general, a program 110 that accesses a resource for file modification, etc., obtains a handle of a file to be modified in kernel mode to modify the file, and the monitoring filter 130 All programs or threads accessed in user mode for file modification, etc.(In this specification, the term ``program'' is used as a term encompassing all programs or threads accessed in user mode for file modification, etc. On the other hand, the program 110 may be a malicious program infected with malicious code or the like, and thus a program to be monitored (in this specification, this program is referred to as a "monitoring target program", and a program other than the monitoring target program is referred to as "normal" Program”).

To this end, the malicious program processing device 100 has a monitoring target item database 140, and has a plurality of monitoring target items in the monitoring target item database 140, and the malicious program processing device 100 is in a user mode. If the accessing program 110 corresponds to one or more of the monitoring target items held in the monitoring target item database 140, the program is set as a monitoring target program.

Hereinafter, an example of the monitored items held by the monitored item database 140 will be briefly described.

-Presence of digital signature: Most programs have a digital signature of the manufacturer who made the program, so if there is a digital signature in the program 110 accessed in the user mode, it may be regarded as a normal program. However, in recent years, digital signatures are altered due to leakage of digital signature files, and the existence of a digital signature is not always reliable. Therefore, preferably, the presence or absence of a digital signature and the existence of the signer or signature of the certificate The credibility can be further increased by checking other information together.

-Validity of Executable File Property Information: Since property information of a file such as file version, maker name, and file description exists in a general commercial program, such property information is not included in the program 110 accessed in the user mode, or Or, if the program file does not match the attribute information, it is set as the monitoring target program.

-Path where files are executed: In the case of malicious programs, a method that is downloaded and executed from a remote location is mainly used, so if the program 110 that accesses the user mode is a program that is executed in a specific path such as the Internet Temp folder or the Downloads folder There is a possibility that it is a malicious program, so it is a program to be monitored.

-Injected thread: If the malicious program is not an executable file such as EXE or COM, it uses a method of loading it into another running process (this is called'DLL injection'), and a program that accesses in user mode (110) It checks whether it is an injected thread by monitoring the creation of a thread of, and if it is an injected thread, it is set as a monitoring target program.

-Script type program: There are script execution programs such as VBScript, WScript, powershell, php, etc., or malicious programs in the form of interpreters such as java programs, so that a process or interpreter that can execute a script is a monitoring target program.

When the program 110 accessing the user mode is determined as the monitoring target program, the monitoring filter 130 stores a redirection file previously redirected by the monitoring target program in the redirection data storage means 160 Check whether there is.

As a result of checking, if there is a redirection file previously redirected, file information of the redirection file is obtained from the redirection information memory 170, the file information of the obtained redirection file is applied, and the handle of the redirection file is obtained from the kernel and returned to the program. Accordingly, a file modification of the redirection file previously stored in the redirection data storage unit 160 is performed.

Conversely, as a result of checking, if the redirection file redirected by the previous file open request from the monitoring target program is not stored in the redirection data storage unit 160, the monitoring filter 130 is stored in the original data storage unit 150. A redirection file, which is a copy file from which an existing original file is copied, is generated and stored in the redirection data storage unit 160, and file information of the generated redirection file is stored in the redirection information memory 170.

Thereafter, the monitoring filter 130 applies the file information of the newly created redirection file, obtains the handle of the redirection file from the kernel, and returns it to the program, and thereby, the redirection file newly created and stored in the redirection data storage means 160 File modification is made.

On the other hand, when the program 110 accessing the user mode is the monitoring target program, the monitoring filter 130 obtains the handle of the original file stored in the original data storage means 150 and returns it to the program, thereby storing the original data. The original file stored in the means 150 is modified.

The monitoring target item database 140 holds a monitoring target item for determining whether the program 110 accessed in the user mode is a monitoring target program, and the monitoring target item is the same as described above.

The original data storage means 150 is a data storage means for storing an original file created or modified by a normal program, for example, storage of a known configuration such as a hard disk, a CD-ROM, an electronic storage device such as RAM or ROM. You can use means.

The redirection data storage means 160 is a data storage means for storing a redirection file that is a copy copied from the original file stored in the original data storage means 150 by the monitoring filter 130, for example, a hard disk, a CD- A storage means of a known configuration, such as an electronic storage device such as ROM, RAM, or ROM, can be used. In addition, the redirection data storage means 160 may use the same storage means physically as the original data storage means 150 for storing the original file, or may use other storage means, but the original data storage means 150 and The access path must be different, and modification of the file by the program determined by the monitoring filter 130 as the monitoring target program is possible only for the redirection file stored in the redirection data storage unit 160.

The redirection information memory 170 is a memory that stores file information of the redirection file when the monitoring filter 130 creates a redirection file that is a copy copied from the original file stored in the original data storage means 150. , The file information of the redirection file is, for example, the file path of the original file, the copy date and time when the file was first copied, and the name of the redirection file.

Next, a malicious program processing method according to a preferred embodiment of the present invention will be described with reference to FIG. 2. Fig. 2 is a flow chart showing the flow of a malicious program processing method according to a preferred embodiment of the present invention.

First, if there is a file open request for modification of a file from the program 110 accessing the malicious program processing apparatus 100 in the user mode (step S11), the monitoring filter 130 makes a file open request in step S12. Check whether the program is a program to be monitored.

As a result of checking in step S12, if the program requesting to open the file is not a monitoring target program (step S12 = NO), the process proceeds to step S13, and in step S13, the monitoring filter 130 obtains a handle of the original file from the kernel and the program 110 ), opens the original file requested in step S18, and executes a task such as modifying the file contents or deleting or changing the file, and then ends.

Further, as a result of the confirmation in step S12, if the program requesting the file open is a program to be monitored (step S12 = YES), the process proceeds to step S14, and in step S14, the monitoring filter 130 is stored in the redirection information memory 170. By checking information such as the file path of the original file, which is the file information of the redirection file, the copy date and time when the file was first copied, and the name of the redirection file, the redirection file that was redirected before the file requested to be opened by the monitoring target program is Check whether there is.

As a result of the confirmation of step S14, if there is no redirection file previously redirected (step S14 = NO), the monitoring filter 130 copies the original file stored in the original data storage means 150 to create a new redirection file, and generates a After the redirection file is stored in the redirection data storage unit 160, the process proceeds to step S16. In step S16, the monitoring filter 130 stores the file information of the redirection file stored in the redirection data storage unit 160 into the redirection information memory 170 ) And then proceeds to step S17. As described above, the file information of the redirection file includes the file path of the original file, the copy date and time when the file was first copied, and the name of the redirection file.

In addition, if there is a file that has been redirected previously (step S14 = YES) as a result of the confirmation in step S14, the process proceeds to step S17, and in step 17, the monitoring filter 130 applies the file information of the redirection file to the kernel to handle the redirection file. Is returned to the program, and the process proceeds to step S18. In step S18, a file modification operation such as modification, deletion, or change of the redirection file is executed, and the process ends.

As described above, in the present embodiment, the monitoring filter 130 checks whether the program 110 that accesses in the user mode and requests the file to be opened is a monitoring target program, and when it is not the monitoring target program, the original data storage means The original file held by 150 can be modified normally, and on the contrary, when the program requesting to open the file is determined to be a monitoring target program, the monitoring filter 130 is stored in the original data storage means 150. A redirection file, which is a copy of the original file, is newly created and stored in a redirection path (redirect data storage means 160) that is different from the path of the original file, and the monitoring target program only modifies the file for the redirection file stored in the redirection path. To be able to do it.

Simultaneously with such processing or after processing is performed, verification of whether the redirection file stored in the redirection path is a file modified by a malicious program infected with malicious code or the like is verified, that is, file validation is performed. When it is found that the file has been modified and is not valid, the malicious program processing apparatus 100 performs a process such as deletion of the redirection file, and conversely, if it is found to be a valid file, the redirection file is stored in the original data storage means ( 150) and merge with the original file.

File validity verification of the redirection file stored in the redirection path is performed through a normal validation procedure, which will be briefly described below. 3 is a flowchart showing a validity verification method for verifying the validity of a program.

First, the file data of the redirection file is read in step S21, and the process proceeds to step S22. In step S22, the file header value of the read-out file data of the redirection file is verified.

Files commonly used in application programs are, for example, jpg, exe, docx,… A file with a specific extension such as, and such a specific extension, has a unique value, that is, a file header value, at the entry part of the file, and malicious programs usually modulate this file header value. File validity can be verified by checking the header value.

If it is determined that the redirection file is valid as a result of the verification in step S22 (step S22 = YES), the process proceeds to step S23 to execute instruction verification.

Some malicious programs leave the header of the file as it is and modulate the file from a specific offset position. In this case, complete file validation cannot be performed only by checking the file header value. Therefore, even if the file header value is recognized as valid as a result of the verification in step S22, the validity of the file is verified once more by applying the command-type verification code to check the data contained in the file.

If the verification result of step S23 is also found to be valid, the redirection file proceeds to step S24 to merge the verified redirection file with the original file and terminate.

In addition, if the verification result of the file header value in step S22 or the command-type verification result in step S23 is found to be invalid, the process proceeds to step S25 to delete the redirection file that is not valid from the system. Proceed and finish.

As described above, in this embodiment, a file modified by a normal program and a file modified by a monitoring target program suspected of being a malicious program are stored separately in different paths, thereby being modified by a program suspected as a malicious program. It is possible to separate and manage the changed file and the file modified by the normal program, and at the same time, when the validation of the redirection file turns out to be invalid, it can be easily processed by deleting the invalid redirection file from the system. Therefore, the system can be safely protected from malicious programs.

As described above, the present invention has been described with reference to preferred embodiments, but the present invention is not limited to the above embodiments, and various changes and modifications are possible within the scope of the invention described in the claims.

In the above embodiment, it is determined whether the program to be monitored is by checking whether the program 110 accessing the user mode of the system corresponds to any one or more of the monitored items held in the monitored item database 140. Although described, for example, a program that was determined not to be infected with malicious code or the like during the validation process of the file described above or during other processes (in this specification, this program is called a ``normal program'', It is a term distinct from the indicated "normal program") by a separate database or the like, and if the program 110 accessing the user mode of the system is in this database, the program may be determined as a normal program.

In addition, a program determined as a malicious program in the above process may be managed by a malicious program database, and if the program 110 accessing the user mode of the system is in the malicious program database, the program may be determined as a monitoring target program. .

Moreover, the said embodiment and the said modified example may be implemented separately, and may be implemented in combination with each other.

{Explanation of sign}

100 Malware processing device

110 programs

130 Surveillance filter

140 Monitoring target item database

150 Original data storage means

160 Redirect data storage means

170 Redirect information memory

Claims

A monitoring filter that checks whether the program that accesses the computer system and requests to open a file is a program to be monitored that is suspected of being a malicious program;

It includes a monitoring target item database holding a monitoring target item for determining whether the monitoring target program exists,

The monitoring filter,

If the program requesting to open the file corresponds to one or more of the items to be monitored, the program is determined as the program to be monitored,

A redirection file is created by copying the original file of the file requested to be opened by the monitoring target program,

Store the generated redirection file in a redirection path that is different from the file path of the original file,

Modify a file using the redirection file stored in the redirection path,

The monitoring target item is at least one of the presence or absence of a digital signature, the validity of the attribute information of the executable file, the path through which the file is executed, and the presence of an injected thread.
The method according to claim 1,

The monitoring filter further checks whether there is a redirection file previously generated by the monitoring target program before generating the redirection file,

A malicious program processing device that allows files to be modified using the redirection file if there is a previously created redirection file.
The method according to claim 2,

Further comprising a redirection information memory for storing file information of the redirection file,

A malicious program processing device that checks the presence or absence of the previously generated redirection file based on file information of the redirection file.
The method according to claim 1,

The malicious program processing device further performs validation of the redirection file,

A malicious program processing device that deletes the redirection file when the verification result is an invalid file.
The method according to claim 1,

The malicious program processing device further performs validation of the redirection file,

A malicious program processing device that merges the redirection file with the original file when the verification result is a valid file.
A malicious program processing method by a malicious program processing device that has a monitoring target item to determine whether the program that accesses the computer system and requests to open a file is a monitoring target program suspected of being a malicious program.

Step a) determining whether the program that accesses the computer system and requests to open a file is a program to be monitored as a malicious program; and

Step b) of creating a redirection file by copying the original file of the file requested to be opened by the program as a result of the determination in step a), and

C) storing the generated redirection file in a redirection path that is different from the file path of the original file; and

And modifying the file using the redirection file stored in the redirection path,

The item to be monitored is at least one of the presence or absence of a digital signature, the validity of the attribute information of the executable file, the path to which the file is executed, and whether an injected thread is

In the step a), if the program requesting to open the file corresponds to one or more of the items to be monitored, the program is determined as a program to be monitored.
The method of claim 6,

Before generating the redirection file in step b), further comprising a step d) of checking whether there is a redirection file previously generated by the monitoring target program,

If there is a redirection file previously generated as a result of the confirmation in step d), a malicious program processing method in which the file is modified using the redirection file.
The method of claim 7,

A malicious program processing method in which the presence or absence of the previously generated redirection file is confirmed by file information of the redirection file held by the computer system.
The method of claim 6,

It is executed after the step c) and further comprises a step e) of performing validation of the redirection file,

The malicious program processing method of deleting the redirection file when the verification result of step e) is an invalid file.
The method of claim 6,

It is executed after the step c) and further comprises a step e) of performing validation of the redirection file,

A malicious program processing method of merging the redirection file with the original file when the verification result of step e) is a valid file.