WO2024005490A1 - Behavior scan service system, and method for providing behavior scan service - Google Patents

Abstract

In the present invention, a hash value for behavior data is generated and a scan request using same is transmitted so that analysis results of the behavior data specified by the hash value is queried, and thus a novel behavior scan service is implemented to detect cloud-based malicious code even for behavior data.

Description

Behavior scan service system and method of providing behavior scan service

The present invention relates to analysis techniques for behavior. More specifically, it relates to technology that enables the provision of cloud-based behavior scanning services for behavior data.

This application claims priority to Korean Application No. 10-2022-0081418, filed on July 1, 2022, and the entire contents of this application are incorporated herein by reference for all purposes.

Malicious code detection technology uses various methods such as signature-based detection, rule-based detection, and dynamic behavior-based detection.

In particular, cloud-based malware detection technology has emerged to overcome the limitations of performing all procedures for malware detection in a detection engine stored and installed on the user's PC.

Cloud-based malware detection technology uses a method of transmitting the file to be analyzed to a server or transmitting the signature value of the file to be analyzed to the server.

The method of sending a file to a server is to send a file to the server and request a scan, and then the server performs all procedures to determine whether the file is malicious or not and delivers the determination result.

Meanwhile, the method of transmitting the signature value of a file to the server is to extract/generate the signature value for the file and transmit a scan request using the signature value to the server, and the server then sends the remaining information to determine whether it is malicious according to the scan request. It is a method of performing a procedure and delivering the determination result.

In this way, cloud-based malware detection for files was previously possible through methods such as transmitting the file to the server or transmitting the signature value for the file to the server.

Meanwhile, it is necessary to detect maliciousness not only for files but also for actions that occur on the user's PC, but cloud-based malicious code detection technology for action data is not provided.

The reason for this is that the volume of behavior data is large.

Another reason is that in the case of behavior data collected in the user's PC environment, the collection environment is reflected in the behavior data, so even for the same behavior, the content of the data may vary depending on the collection environment, so data collected in different collection environments One technical limitation is that it is difficult to judge behavioral data as the same behavior.

Accordingly, the present invention proposes a technical solution that enables cloud-based malware detection even for behavioral data.

The technical problem to be solved by the present invention is to provide a behavior scan service system and a method of providing a behavior scan service that enables cloud-based malicious code detection even for behavior data.

A method of providing a behavior scan service according to an embodiment of the present invention includes a data generation step of generating prepared data by performing preprocessing on behavior data; A hash value generation step of generating a hash value for the prepared data; and a scan service providing step of providing a behavior scan service that can query analysis results of the behavior data using the generated hash value.

Specifically, the preprocessing may be defined to include a data conversion operation that allows the same Prepared data to be generated in the case of behavior data collected from the same behavior.

Specifically, the preprocessing is a process of selecting feature data that the analysis model used in the behavior scan service uses when learning and predicting, from the meta information of the behavior data, and using the selected feature data to select the Prepared feature data. It may include the process of generating data.

Specifically, the process of generating the prepared data within the preprocessing performs a data conversion operation to convert data that varies depending on the collection environment in which the behavior data was collected from the selected feature data into data unrelated to the collection environment, The prepared data is generated using the characteristic data after performing the data conversion operation, so that the same prepared data can be generated in the case of behavior data collected from the same behavior.

Specifically, the data that varies depending on the collection environment includes data defined as a string related to the personal environment, and the data conversion operation converts the string related to the personal environment from the selected feature data into a predefined general It may be an operation to convert to a string.

Specifically, in the hash value generation step, a hash value can be generated in block units after blocking all of the prepared data, and the hash values in block units can be concatenated to generate a hash value for the prepared data.

Specifically, the scan service provision step provides a cloud-based behavior scan service by linking with a DB (Data Base) built to query the analysis results of behavior data mapped using the hash value as the key. can be provided.

Specifically, in the scan service provision step, when receiving a meta scan request using the hash value, the analysis result of the behavior data to which the hash value is mapped is searched and retrieved from the DB through a hash value-based query. By returning the results as a scan response, the Meta Scan function can be provided.

Specifically, in the scan service provision step, upon receiving a Full Scan request using the hash value and the Prepared data, analysis of the Prepared data is performed using a pre-built analysis model, and the resulting analysis results are performed. is returned as a scan response, providing a Full Scan function, and the analysis results according to the analysis can be stored in the DB as the analysis results of behavior data mapped to the hash value.

Specifically, in the event that the hash value mapped to the analysis result of specific behavior data in the DB changes, information linking the hash value generated after the event and the hash value before the event is managed to scan the behavior. Even if the service uses the hash value before the event, it may further include a step of enabling the analysis result of the specific behavior data to be searched based on the connection information.

A behavior scan service system according to an embodiment of the present invention includes a preprocessing unit that generates prepared data by performing preprocessing on behavior data; A hash value generator that generates a hash value for the prepared data; and a scan service provider that provides a behavior scan service that can query analysis results for the behavior data using the generated hash value.

Specifically, the preprocessing is a process of selecting feature data that the analysis model used in the behavior scan service uses when learning and predicting, from the meta information of the behavior data, and using the selected feature data to select the Prepared feature data. It may include the process of generating data.

Specifically, the process of generating the prepared data within the preprocessing performs a data conversion operation to convert data that varies depending on the collection environment in which the behavior data was collected from the selected feature data into data unrelated to the collection environment, The prepared data is generated using the characteristic data after performing the data conversion operation, so that the same prepared data can be generated in the case of behavior data collected from the same behavior.

Specifically, the data that varies depending on the collection environment includes data defined as a string related to the personal environment, and the data conversion operation converts the string related to the personal environment from the selected feature data into a predefined general It may be an operation to convert to a string.

Specifically, the hash value generator may block all of the prepared data, generate a hash value in block units, and connect the hash values in block units to generate a hash value for the prepared data.

Specifically, the scan service provider provides a cloud-based behavior scan service in conjunction with a DB (Data Base) built to query the analysis results of behavior data mapped using the hash value as the key. can do.

Specifically, when receiving a meta scan request using the hash value, the scan service provider searches the DB for the analysis result of the behavior data to which the hash value is mapped through a hash value-based query and searches for the result of the search. It provides a Meta Scan function by replying as a scan response, and when receiving a Full Scan request using the hash value and the Prepared data, performs analysis on the Prepared data using a pre-built analysis model. The analysis results can be returned as a scan response, providing a full scan function.

According to embodiments of the present invention, a hash value for behavior data is generated and a scan request using this is sent to query the analysis results of behavior data specified by the hash value. Cloud-based behavior data is also provided. A new type of behavior scanning service can be implemented that enables detection of malicious code.

For this reason, according to embodiments of the present invention, a cloud-based behavior scanning service can be provided even for behavior data that has problems in which the content of data may be different even for the same behavior depending on capacity issues and collection environments. Derive the effect.

Figure 1 is a configuration diagram showing the configuration of a behavior scan service system according to an embodiment of the present invention.

Figure 2 is an example diagram conceptually diagramming the process of generating Prepared Data and Hash Value for behavior data in the proposed technology of the present invention.

Figure 3 is an example diagram conceptually diagramming the method of generating Hash Value in the proposed technology of the present invention.

Figure 4 is an example diagram schematically illustrating the behavior scan service provided by the proposed technology of the present invention.

Figure 5 is a flowchart showing the service flow according to a method for providing a behavior scan service according to an embodiment of the present invention.

Since the present invention can make various changes and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all changes, equivalents, and substitutes included in the spirit and technical scope of the present invention. While describing each drawing, similar reference numerals are used for similar components.

When a component is said to be “connected” or “connected” to another component, it should be understood that it may be directly connected to the other component or may be connected with another component in the middle. something to do. On the other hand, when it is mentioned that a component is “directly connected” or “directly connected” to another component, it should be understood that there are no other components in between.

The terms used in this application are only used to describe specific embodiments and are not intended to limit the invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, terms such as “comprise” or “have” are intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features. It should be understood that this does not exclude in advance the possibility of the existence or addition of elements, numbers, steps, operations, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the technical field to which the present invention pertains. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and unless explicitly defined in the present application, should not be interpreted in an ideal or excessively formal sense. No.

Hereinafter, the present invention will be described with reference to the attached drawings.

The present invention relates to behavior analysis technology, and more specifically, to technology that enables cloud-based malware detection of behavior data.

Malicious code detection technology uses various methods such as signature-based detection, rule-based detection, and dynamic behavior-based detection.

In particular, cloud-based malware detection technology has emerged to overcome the limitations of performing all procedures for malware detection in a detection engine stored and installed on the user's PC.

Cloud-based malware detection technology uses a method of transmitting the file to be analyzed to a server or transmitting the signature value of the file to be analyzed to the server.

The method of sending a file to a server is to send a file to the server and request a scan, then the server performs all procedures to determine whether the file is malicious or not and delivers the determination result.

Meanwhile, the method of transmitting the signature value of a file to the server is to extract/generate the signature value for the file and transmit a scan request using the signature value to the server, and the server then sends the remaining information to determine whether it is malicious according to the scan request. It is a method of performing a procedure and delivering the determination result.

In this way, cloud-based malware detection for files was previously possible through methods such as transmitting the file to the server or transmitting the signature value for the file to the server.

Meanwhile, it is necessary to detect maliciousness not only for files but also for actions that occur on the user's PC, but cloud-based malicious code detection technology for action data is not provided.

The reason for this is that the volume of behavior data is large.

Another reason is that in the case of behavior data collected in one user's PC environment, the collection environment is reflected in the behavior data, so even for the same behavior, the content of the data may vary depending on the collection environment, so data is collected in different collection environments. One technical limitation is that it is difficult to determine that the generated behavior data is the same behavior.

Accordingly, the present invention proposes a technical solution that enables cloud-based malware detection even for behavioral data.

In other words, the key to the present invention is to realize a new type of behavior scanning service that enables cloud-based malware detection for behavior data.

Below, we will describe specific configurations for realizing the technical solution proposed in the present invention, that is, the cloud-based behavior scanning service.

First, Figure 1 shows the configuration of a behavior scan service system 100, which realizes the cloud-based behavior scan service proposed in the present invention.

In Figure 1, each component in the behavior scan service system 100 that realizes the cloud-based behavior scan service of the present invention is conceptually schematized. In actual implementation, each component can be distributed and implemented on the client and server. .

Described with reference to FIG. 1, the behavior scan service system 100 according to an embodiment of the present invention will include a preprocessing unit 110, a hash value generation unit 120, and a scan service provider 130. You can.

Ultimately, the behavior scan service system 100 according to an embodiment of the present invention can realize the technical solution proposed by the present invention, that is, the cloud-based behavior scan service, through the above-described configuration.

Below, each component in the behavior scan service system 100 for realizing the proposed technology of the present invention will be described in more detail.

Prior to detailed description, each component in the behavior scan service system 100 of the present invention may all be implemented on a remote server.

Alternatively, as mentioned above, each component in the behavior scan service system 100 of the present invention includes a client mounted/operated in the form of a program or application on a user system (e.g., PC, terminal, etc.), It can also be distributed and implemented on remote servers.

For example, as shown in FIG. 4, in the behavior scan service system 100 of the present invention, the preprocessing performing unit 110 and the hash value generating unit 120 are implemented in the client, and the scan service providing unit ( 130) can be implemented on the server.

Of course, in addition to the implementation example shown in FIG. 4, the form in which each component in the behavior scan service system 100 of the present invention is distributed and implemented on the client and server may vary.

However, for convenience of explanation, the following will refer to an implementation example in which the preprocessing unit 110 and the hash value generation unit 120 are implemented in the client, and the scan service provider 130 is implemented in the server.

We will continue with a detailed explanation of the functions performed by each component in the behavior scan service system 100 of the present invention.

The preprocessing unit 110 is responsible for generating prepared data by performing preprocessing on behavior data.

The hash value generation unit 120 is responsible for generating a hash value for the prepared data generated in the preprocessing unit 110.

Figure 2 is an example diagram conceptually diagramming the process of generating Prepared Data and Hash Value for behavior data in the proposed technology of the present invention.

To be more specific, behavior data is data about interconnected actions that occur in a user system (e.g., PC, terminal, etc.) to which the behavior scan service system 100 of the present invention is applied, and is data about interconnected actions that occur in the user system (e.g., PC, terminal, etc.).

Here, when and to what extent behavior data is collected, if a behavior requiring analysis is detected by a separate detection rule within the user system (e.g. PC, terminal, etc.), the data may be collected for the behavior.

Additionally, the timing and target at which behavior data is collected may be collected for behaviors selected according to predefined collection criteria, among behaviors not detected by a separate detection rule.

Accordingly, the preprocessing unit 110 may generate prepared data by performing preprocessing on behavior data collected from a user system (e.g., PC, terminal, etc.).

At this time, the preprocessing performed by the preprocessing unit 110 may be defined to include a data conversion operation that allows the same Prepared Data to be generated in the case of behavior data collected from the same behavior.

As explained earlier, in the case of behavior data collected from user systems (e.g. PC, terminal, etc.), the collection environment is reflected in the behavior data, so even for the same behavior, the content of the data may vary depending on the collection environment. Therefore, there is a problem that it is difficult to determine that behavioral data collected in different collection environments are the same behavior.

In the present invention, through preprocessing during the process of generating Prepared Data from behavior data, the same Prepared Data is generated in the case of behavior data collected from the same behavior, thereby preventing the problem of behavior data, that is, the problem of the same behavior depending on the collection environment. It can solve problems where the content of the data may be different.

To be more specific, the preprocessing performed by the preprocessing unit 110 selects feature data that the analysis model used in the behavior scan service uses for learning and prediction from the meta information of the behavior data. It can be defined as including the process of generating the Prepared Data using the selected Feature Data.

At this time, the process of generating the Prepared Data within the preprocessing is performed by performing a data conversion operation to convert data that varies depending on the collection environment in which the behavior data was collected from the selected Feature Data into data unrelated to the collection environment. Prepared Data is created so that the same Prepared Data can be created in the case of behavior data collected from the same behavior.

To describe a specific embodiment in this regard, in the behavior scanning service of the present invention, an analysis model can be used to analyze whether behavior data is malicious.

For example, in the behavior scan service of the present invention, pre-specified feature data is learned for the behavior data of the learning target, and based on this learning, predicted analysis results for the behavior data (e.g., maliciousness, possibility of maliciousness, etc. ) can be used to derive/provide a behavior-based ML (Machine Learning) model (reference number 20 in FIG. 4).

In this case, according to the preprocessing, the preprocessing unit 110 selects the features that the analysis model (e.g., behavior-based ML model) used in the behavior scan service uses for learning and prediction from the meta information of the behavior data collected this time. The process of selecting data can be performed.

In addition, the preprocessing unit 110 may perform the process of generating prepared data using feature data selected from the meta information of the behavior data collected this time, according to the preprocessing performance.

In particular, the present invention seeks to solve the problem that the content of data may be different even for the same action depending on the collection environment through a data conversion operation during the process of creating prepared data using feature data.

Specifically, the preprocessing unit 110 performs a data conversion operation to convert data that varies depending on the collection environment in which the behavioral data was collected from the previously selected Feature Data into data unrelated to the collection environment, according to the preprocessing performance. do.

To describe a specific embodiment, data that varies depending on the collection environment may include data defined as a string related to the personal environment.

Examples of strings related to personal environment may be strings corresponding to personal names or IDs in path data, as in Example 1 below, or may be strings containing internal IPs, as in Example 2 below.

Of course, in addition to the examples described, strings related to personal environments may be defined in various forms/types/types.

Example 1) C:/Users/Nam.kwon/documents/report.doc

Example 2) telnet 172.21.xxx.xxx 22

According to this embodiment, the preprocessing unit 110 searches for a string related to the personal environment in the previously selected Feature Data according to the preprocessing, and converts the string into a predefined general string as data unrelated to the collection environment. You can perform data conversion operations.

That is, according to the preprocessing, the preprocessing unit 110 selects Feature Data from the meta information of the behavior data collected this time and performs a data conversion operation to convert a string related to the personal environment from the selected Feature Data into a general string. By creating Prepared Data after execution, the same Prepared Data can be created in the case of action data collected from the same action.

As such, in the present invention, when performing preprocessing to generate Prepared Data from behavior data, a data conversion operation is performed so that the same Prepared Data can be generated in the case of behavior data collected from the same behavior, so that the same behavior can be generated depending on the collection environment. It is possible to solve problems where the content of data may be different.

As mentioned earlier, the hash value generation unit 120 is responsible for generating a hash value for the prepared data generated in the preprocessing unit 110.

To explain more specifically, the hash value generator 120 blocks the entire prepared data, generates a hash value in block units, and connects the hash values in blocks to generate a hash value for this prepared data. You can.

That is, in the present invention, when creating a Hash Value from Prepared Data of behavior data, the Hash Value can be created using the Piecewise Hash technique.

To explain one embodiment, the hash value generator 120 processes the entire prepared data into a string based on the CTPH (Context-Trigger Piecewise Hash) method, finds the boundary (context) in the entire string, blocks it, and then blocks each string. Hash Value can be created in block units.

And, the hash value generator 120 can connect the Hash Value in block units and generate it as a Hash Value for this Prepared Data.

To describe a more specific embodiment, the hash value generator 120 processes the entire prepared data into a string based on the FLC (Fixed Length Chunking) method, blocks the entire string to a predetermined size, and then generates a hash for each block. By creating a Value and connecting the Hash Value in block units, it can be created as a Hash Value for this Prepared Data.

Figure 3 shows a simplified process of generating a hash value using the Piecewise Hash technique as in the above-described embodiments of the present invention.

Of course, the present invention is not limited to the hashing method according to the above embodiment, and various methods can be used as long as it is a hashing method that can generate a Hash Value for Prepared Data by hashing Prepared Data in block units and connecting Hash Values in block units. You will be able to use it.

As such, in the present invention, the Hash Value is generated using the Piecewise Hash technique in generating Hash Value from Prepared Data of behavior data, and the analysis result of the behavior data specified by using this Hash Value as a key is generated. A scanning service can be provided for the inquiry.

For this reason, in the present invention, in addition to querying the analysis results of behavior data specified using Hash Value as a key, inquiry/confirmation of similar behavior data and analysis of similar behavior data based on similarity measurement between Hash Values It will also be possible to provide results inquiry.

Continuing the explanation again, the scan service provider 130 uses the Hash Value generated by the hash value generator 120 to provide a behavior scan service that allows you to check the analysis results of the current behavior data. is in charge of

That is, in the present invention, a cloud-based behavioral scan service can be provided by the scan service provider 130.

Specifically, the scan service provider 130 uses a DB (Data Base, the behavior meta information DB of FIG. 4) that is built to query the analysis results of behavior data mapped using Hash Value as a key. In conjunction with (see (10)), a cloud-based behavior scanning service can be provided.

Referring to FIG. 4, as described above, the behavior-based ML model 20 learns feature data that is pre-specified for the behavior data to be learned and learns about the behavior data based on this learning. Predicted analysis results can be derived/provided.

Accordingly, the behavior meta information DB 10 stores/manages the analysis results of each behavior data analyzed by the behavior-based ML model 20 by mapping them to the Hash Value of the behavior data, and requests a query based on Hash Value ( Query), the analysis result mapped to the same Hash Value as the corresponding Hash Value can be delivered as a search result.

At this time, the Hash Value mapped to the analysis result of the behavior data in the behavior meta information DB 10 is pre-processed and hash value generated in the same manner as the above-described pre-processing unit 110 and hash value generation unit 120. It can be created.

Accordingly, hereinafter, an embodiment of the cloud-based behavior scan service provided by the present invention will be described with reference to FIG. 4.

According to the embodiment shown in FIG. 4, behavior data collection, preprocessing, and Hash generation are performed in the client (eg, 110, 120), and behavior scan service provision can be performed in the server (eg, 130).

First, to describe an embodiment, when receiving a meta scan request using Hash Value, the scan service provider 130 retrieves the behavioral meta information DB 10 through a Hash Value-based query. The Meta Scan function can be provided by querying the analysis results of the behavioral data to which Hash Value has been mapped and returning the query results as a Scan response.

In other words, as described above, when behavioral data for actions requiring analysis are collected, the client (e.g. 110, 120) performs preprocessing on the behavioral data and generates Hash (Prepared Data -> Hash Value), Hash Value. You can request a meta scan from the server (e.g. 130) using .

In this case, the server that received the Meta Scan request, that is, the scan service provider 130, transmits a Hash Value-based Query to the behavior meta information DB 10 to check the analysis results of the behavior data to which the Hash Value is mapped. do.

At this time, the scan service provider 130 can obtain “Scan Information_Behavior Data Analysis Result” as a harmonization result if an analysis result mapped to the same Hash Value as the corresponding Hash Value exists in the behavior meta information DB 10. .

Meanwhile, the scan service provider 130 may obtain “not found” as a harmonization result if the analysis result mapped to the same Hash Value as the corresponding Hash Value does not exist in the behavior meta information DB 10.

And, the scan service provider 130 may return the inquiry result to the client as a Scan response (e.g., Scan Information_behavioral data analysis result, or not found).

Accordingly, the user system (e.g., PC, terminal, etc.) can use the cloud-based behavior scan service provided by the scan service provider 130 through a client (e.g., 110, 120) to which the present invention is applied. Through this, security measures can be taken, such as blocking actions analyzed as malicious.

Next, to explain another embodiment, when receiving a Full Scan request using Hash Value and Prepared Data, the scan service provider 130 utilizes the previously built behavior-based ML model 20 to Full Scan function can be provided by performing analysis on Prepared Data and returning the analysis results as a Scan response.

In addition, the scan service provider 130 stores the analysis results of the analysis using the behavior-based ML model 20 in the behavior meta information DB 10 as a result of analysis of behavior data mapped to the Hash Value. Can be saved (Hash Value/result).

For example, if the client (e.g., 110, 120) confirms not found in the scan response received for the previously requested Meta Scan, it can request a full scan using Hash Value and Prepared Data from the server (e.g., 130). .

Of course, when the client (e.g. 110, 120) collects behavioral data for an action that requires analysis, it performs pre-processing on the behavioral data and generates Hash (Behavior Data -> Prepared Data -> Hash Value) and then immediately generates the Hash. You can also request a full scan using Value and Prepared Data from the server (e.g. 130).

In this case, the server that received the Full Scan request, that is, the scan service provider 130, uses the behavior-based ML model 20 to analyze the Prepared Data according to this Full Scan request, and the analysis result accordingly. can be returned to the client as a Scan response (e.g., behavioral data analysis result).

Accordingly, the user system (e.g., PC, terminal, etc.) can use the cloud-based behavior scan service provided by the scan service provider 130 through a client (e.g., 110, 120) to which the present invention is applied. Through this, security measures can be taken, such as blocking actions analyzed as malicious.

At this time, the scan service provider 130 returns the analysis result of this analysis to the client as a Scan response, and uses the analysis result of this analysis as behavioral meta information as a result of the analysis of behavior data mapped to the Hash Value. It can be stored in DB (10) (Hash Value/result).

Furthermore, the scan service provider 130 requests delivery of the original behavior data while replying to the client with a Scan response according to this Full Scan request, collects the original behavior data from the client and stores it in the behavior collection Data Store 30. You can.

In this way, the scan service provider 130 collects and stores the original behavior data in the behavior collection Data Store 30, allowing it to be used to increase the performance of the behavior-based ML model 20 or to provide various and accurate data in a cloud environment. It can also be used to provide behavior analysis results.

Of course, in the present invention, the scan service provider 130 collects and stores original behavior data that is determined to require collection of original behavior data according to various standards, in addition to the behavior data requested for Full Scan, and operates the Behavior Collection Data Store (30). You may also be able to save it in .

Meanwhile, the preprocessing process may change, such as changing the code used in the process of generating Prepared Data from behavior data, or the process of generating Hash Value from Prepared Data may change.

In this way, when the pre-processing process and/or the Hash Value generation process is changed, the Hash Value for the same behavior data may be different from the one generated before the process change and the one generated after the process change.

Accordingly, in the present invention, even if the pre-processing process and/or the hash value generation process changes, it is intended to be able to view and provide consistent analysis results for the same behavior data.

For this purpose, in the present invention, when an event occurs in which the hash value mapped to the analysis result of specific behavior data in the behavior meta information DB 10 changes, the difference between the Hash Value generated after the event and the Hash Value before the event is changed. You can manage information that connects.

This event can be recognized when the pre-processing process and/or the Hash Value generation process are changed (e.g., updated) in terms of operating the cloud-based behavior scan service of the present invention.

In addition, specific behavior data may refer to each behavior data that can be viewed as an analysis result in the behavior meta information DB 10.

In other words, the behavior meta information DB 10 recognizes an event when the pre-processing process and/or the hash value generation process changes (e.g., update), so each behavior can be viewed as an analysis result in the behavior meta information DB 10. You can manage information linking the Hash Value generated after the data event and the Hash Value before the event.

For example, in the behavior meta information DB 10, information (hereinafter referred to as query Result mapping information) can be managed.

In addition, in the behavior meta information DB 10, when the above-mentioned event is recognized, the search result mapping information generated after the event (right side of Table 1) can be managed by connecting it with the search result mapping information before the event (left side of Table 1). You can.

key(hash)	scanInfo	hash change 1 => 11	key(hash)	scanInfo
One	result #1		11	result #1
2	result #2		2	result #2
3	result #3		3	result #3
4	result #4		4	result #4

For convenience of explanation, Table 1 above shows four search result mapping information, but this is only an example.

As can be seen in Table 1, according to the present invention, in the case of the same behavior data where the Hash Value as a key is 1 before the event but is generated as 11 after the event, the same behavior data is generated as they are connected/managed to each other in the behavior meta information DB 10. Consistent analysis results can be viewed and provided for behavioral data.

That is, the scan service provider 130 returns the analysis result (Scan Information_result#1) of the behavior data to which Hash Value 1 is mapped as a Scan response even to the Meta Scan request using Hash Value 1 before the event, and responds to the Meta Scan request using Hash Value 1 before the event. Even in response to a Meta Scan request using Hash Value 11, the analysis result of the behavior data to which Hash Value 11 is mapped (Scan Information_result#1) is returned as a scan response, allowing consistent analysis results to be viewed and provided for the same behavior data. .

As described above, according to embodiments of the present invention, Prepared Data -> Hash Value for behavior data is created and a scan request using this is sent to query the analysis results of behavior data specified by the Hash Value. A new type of behavior scanning service can be implemented that enables cloud-based malware detection for data.

For this reason, according to the present invention, the user system (e.g. PC, terminal, etc.) can use the cloud-based behavior scanning service provided by the present invention and take security measures such as blocking behavior analyzed as malicious through this. You will be able to.

In particular, in the present invention, during the process of generating Prepared Data from behavior data, preprocessing is performed so that the same Prepared Data is generated in the case of behavior data collected from the same behavior, so that even behavior data for the same behavior can be divided depending on the collection environment. We are realizing a cloud-based behavior scanning service by improving the problem of data content being different.

In addition, in the present invention, the Hash Value is generated using the Piecewise Hash technique in generating Hash Value from Prepared Data of behavior data, and the Hash Value is generated by providing a behavior scan service that uses this Hash Value as a key. In addition to querying the analysis results of behavior data specified using a key, it will also be possible to provide inquiry/confirmation of similar behavior data based on similarity measurement between Hash Values, and even inquiry of analysis results of similar behavior data.

Furthermore, in the present invention, it is possible to provide inquiry/confirmation of similar behavior data and even inquiry of analysis results of similar behavior data based on similarity measurement between Hash Values as described above, so that user systems (e.g. PC, terminal, etc.) Although it is not yet known, it can be expected to have the effect of taking security measures by judging actions that are similar to malicious actions or even actions that have only partially changed from malicious actions.

In addition, in the present invention, the performance of behavior-based ML models can be improved by collecting original behavior data in various environments and using it for learning and analysis, and providing diverse and accurate behavior analysis results in a cloud environment to provide meaningful analysis results to users. can be provided.

Hereinafter, with reference to FIG. 5, a specific service flow embodiment of the method for providing a behavior scan service according to an embodiment of the present invention will be described.

For convenience of explanation, the method for providing a behavior scan service of the present invention will be described by referring to the behavior scan service system 100 as the operating entity.

According to the method for providing a behavior scan service proposed by the present invention, the behavior scan service system 100 can collect behavior data from a user system (eg, PC, terminal, etc.) (S10).

According to the method for providing a behavior scan service proposed by the present invention, the behavior scan service system 100 can generate prepared data by performing preprocessing on the collected behavior data (S20).

Specifically, the behavior scan service system 100 performs preprocessing, and the behavior-based ML model 20 used in the behavior scan service uses the feature data for learning and prediction from the meta information of the behavior data collected this time. Select .

Then, the behavior scan service system 100 performs preprocessing and generates prepared data using feature data selected from the meta information of the behavior data collected this time.

In particular, the present invention seeks to solve the problem that the content of data may be different even for the same action depending on the collection environment through a data conversion operation during the process of creating prepared data using feature data.

Specifically, the behavior scan service system 100 searches for a string related to the personal environment in the previously selected Feature Data according to preprocessing, and converts the string into a predefined general string as data unrelated to the collection environment. You can perform data conversion operations.

In this way, the behavior scan service system 100 selects feature data from the meta information of the behavior data collected this time according to preprocessing, and performs a data conversion operation to convert a string related to the personal environment from the selected feature data into a general string. By creating Prepared Data after performing , the same Prepared Data can be created in the case of behavior data collected from the same behavior.

And, according to the method for providing a behavior scan service proposed by the present invention, the behavior scan service system 100 can generate a hash value for the prepared data generated in step S20 (S30).

To explain more specifically, the behavior scan service system 100 blocks the entire Prepared Data, generates Hash Value in block units, and connects the Hash Value in block units to generate Hash Value for this Prepared Data. You can.

Accordingly, according to the method for providing a behavior scan service proposed by the present invention, the behavior scan service system 100 uses the Hash Value generated in step S30 as a key to query the analysis results for the specified behavior data. Action scanning service can be provided to the user system (e.g. PC, terminal, etc.).

Below, an embodiment of providing a behavior scan service will be described with reference to FIG. 5 . The operating part of the server (e.g., 130), which provides the cloud-based behavior scanning service proposed in the present invention, is shown with a dotted line.

To describe a specific embodiment, the client (e.g., 110, 120) of the behavior scan service system 100 is a server (e.g., 130) that provides the cloud-based behavior scan service proposed in the present invention, and Hash Value You can request a meta scan using (S40).

That is, when the clients (e.g., 110, 120) of the behavior scan service system 100 collect behavior data for behavior requiring analysis (S10), they perform preprocessing on the behavior data and generate Hash (Prepared Data -> Hash Value, S20/S30), Meta Scan using Hash Value can be requested to the server (e.g. 130) (S40).

When receiving a Meta Scan request, the server (e.g., 130) of the behavior scan service system 100 transmits a Hash Value-based query according to the request to the behavior meta information DB 10 to retrieve the behavior data to which the Hash Value is mapped. Check the analysis results (S50).

At this time, the server (e.g., 130) of the behavior scan service system 100, if an analysis result mapped to the same Hash Value as the corresponding Hash Value exists in the behavior meta information DB 10, “Scan Information_Behavior Data” as the harmonization result. "Analysis result" can be obtained, and if the analysis result mapped to the same Hash Value as the corresponding Hash Value does not exist in the behavior meta information DB (10), "not found" can be obtained as the harmonization result.

And, the server (e.g., 130) of the behavior scan service system 100 may return the inquiry result to the client as a Scan response (e.g., Scan Information_behavioral data analysis result, or not found) (S50).

Accordingly, the client (e.g., 110, 120) of the behavior scan service system 100 receives a Scan response (e.g., Scan Information_behavioral data analysis result, or not found) according to the Meta Scan request from the server (e.g., 130) and Delivered to the user system (e.g. PC, terminal, etc.) (S60).

In this case, the user system (e.g. PC, terminal, etc.) can use the cloud-based behavior scanning service through the client to which the present invention is applied (e.g. 110, 120), and through this, the behavior analyzed as malicious can be blocked. Security measures may be taken.

Meanwhile, according to one example, when the client (e.g., 110, 120) of the behavior scan service system 100 confirms not found in the Scan response in step S60, it performs a Full Scan using Hash Value and Prepared Data to the server (e.g. : 130) can be requested (S70).

When receiving a Full Scan request, the server (e.g., 130) of the behavior scan service system 100 uses the behavior-based ML model 20 to analyze the Prepared Data according to this Full Scan request and the result of the analysis. can be returned to the client as a Scan response (e.g., behavioral data analysis result) (S80).

At this time, the server (e.g., 130) of the behavior scan service system 100 returns the analysis result of this analysis to the client as a Scan response, and converts the analysis result of this analysis into behavior data mapped to the Hash Value. As a result of the analysis, it can be stored in the behavior meta information DB (10) (Hash Value/result) (S80).

Accordingly, the client (e.g., 110, 120) of the behavior scan service system 100 receives a scan response (e.g., behavior data analysis result) according to the Full Scan request from the server (e.g., 130) and sends it to the user system (e.g., PC, terminal, etc.) (S90).

In this case, the user system (e.g. PC, terminal, etc.) can use the cloud-based behavior scanning service through the client to which the present invention is applied (e.g. 110, 120), and through this, the behavior analyzed as malicious can be blocked. Security measures may be taken.

Furthermore, the server (e.g., 130) of the behavior scan service system 100 returns a Scan response according to this Full Scan request to the client and requests delivery of the original behavior data to collect and collect the original behavior data from the client. By storing it in the Data Store (30) (S100), it can be used to increase the performance of the behavior-based ML model (20) or to provide diverse and accurate behavior analysis results in a cloud environment.

The method of providing a behavior scan service according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the medium may be specially designed and constructed for the present invention or may be known and usable by those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes optical media (magneto-optical media) and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware device may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with specific details such as specific components and limited embodiments and drawings, but this is only provided to aid understanding of the present invention, and the present invention is not limited to the above embodiments. Various modifications and variations can be made from this description by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be limited to the described embodiments, and the scope of the patent claims described later as well as all modifications equivalent to or equivalent to the scope of the claims will be considered to fall within the scope of the spirit of the present invention.

Claims (18)

1. A data generation step of generating prepared data by performing preprocessing on behavior data;

   A hash value generation step of generating a hash value for the prepared data; and

   A method of providing a behavior scan service, comprising a scan service providing step of providing a behavior scan service that can query analysis results of the behavior data using the generated hash value.
2. According to claim 1,

   The preprocessing is,

   A method of providing a behavior scan service, characterized in that it is defined to include a data conversion operation that allows the same Prepared data to be generated in the case of behavior data collected from the same behavior.
3. According to claim 1,

   The preprocessing is,

   A process of selecting feature data that the analysis model used in the behavior scan service uses for learning and prediction from the meta information of the behavior data,

   A method of providing a behavior scan service, comprising the step of generating the Prepared data using the selected feature data.
4. According to claim 3,

   The process of generating the prepared data within the preprocessing is,

   Performing a data conversion operation to convert data that varies depending on the collection environment in which the behavior data was collected from the selected feature data into data unrelated to the collection environment,

   A method of providing a behavior scan service, characterized in that the prepared data is generated using the characteristic data after performing the data conversion operation, so that the same prepared data can be generated in case of behavior data collected from the same behavior.
5. According to claim 4,

   Data that varies depending on the collection environment includes data defined as a string related to personal environment,

   The data conversion operation is,

   A method of providing a behavior scan service, characterized in that the operation of converting a string related to the personal environment from the selected feature data into a predefined general string.
6. According to claim 1,

   The hash value generation step is,

   A method of providing a behavior scan service, characterized in that the hash value is generated in block units after blocking all of the prepared data, and the hash values in block units are concatenated to generate a hash value for the prepared data.
7. According to claim 1,

   The scan service provision step is,

   A behavior scan service that provides a cloud-based behavior scan service by linking with a DB (Data Base) built to query the analysis results of behavior data mapped using the hash value as a key. How to provide.
8. According to claim 7,

   The scan service provision step is,

   When receiving a meta scan request using the hash value, the analysis result of the behavior data to which the hash value is mapped is searched from the DB through a hash value-based query and the search result is returned as a scan response, and Meta Scan A method of providing a behavior scanning service, characterized in that it provides a function.
9. According to claim 7,

   The scan service provision step is,

   When receiving a full scan request using the hash value and the prepared data, the prepared data is analyzed using a pre-built analysis model and the analysis result is returned as a scan response, thereby providing a full scan function. Provides,

   A method of providing a behavior scan service, characterized in that the analysis result according to the analysis is stored in the DB as an analysis result of behavior data mapped to the hash value.
10. According to claim 7,

    In the event that the hash value mapped to the analysis result of specific behavior data in the DB changes, information linking the hash value generated after the event and the hash value before the event is managed,

    A method of providing a behavior scan service, further comprising enabling the analysis result of the specific behavior data to be searched based on the connection information even if the behavior scan service uses a hash value before the event.
11. A preprocessing unit that generates prepared data by performing preprocessing on behavior data;

    A hash value generator that generates a hash value for the prepared data; and

    A behavior scan service system comprising a scan service provider that provides a behavior scan service that can query analysis results for the behavior data using the generated hash value.
12. According to claim 11,

    The preprocessing is,

    A process of selecting feature data that the analysis model used in the behavior scan service uses for learning and prediction from the meta information of the behavior data,

    A behavior scan service system comprising a process of generating the prepared data using the selected feature data.
13. According to claim 12,

    The process of generating the prepared data within the preprocessing is,

    Performing a data conversion operation to convert data that varies depending on the collection environment in which the behavior data was collected from the selected feature data into data unrelated to the collection environment,

    A behavior scan service system characterized in that the prepared data is generated using the characteristic data after performing the data conversion operation, so that the same prepared data can be generated in case of behavior data collected from the same behavior.
14. According to claim 13,

    Data that varies depending on the collection environment includes data defined as a string related to personal environment,

    The data conversion operation is,

    A behavior scan service system, characterized in that the operation of converting a string related to the personal environment from the selected feature data into a predefined general string.
15. According to claim 11,

    The hash value generator,

    A behavior scan service system that blocks all of the prepared data, generates a hash value in block units, and concatenates the hash values in block units to generate a hash value for the prepared data.
16. According to claim 11,

    The scan service provider,

    A behavior scan service system that provides a cloud-based behavior scan service in conjunction with a DB (Data Base) built to query the analysis results of behavior data mapped using hash values as keys. .
17. According to claim 16,

    The scan service provider,

    When receiving a meta scan request using the hash value, the analysis result of the behavior data to which the hash value is mapped is searched from the DB through a hash value-based query and the search result is returned as a scan response, and Meta Scan provide functionality,

    When receiving a full scan request using the hash value and the prepared data, the prepared data is analyzed using a pre-built analysis model and the analysis result is returned as a scan response, thereby providing a full scan function. A behavior scanning service system characterized in that it provides.
18. A data generation step that combines with hardware and generates prepared data by performing preprocessing on behavior data;

    A hash value generation step of generating a hash value for the prepared data; and

    A computer program stored in a medium for executing a scan service provision step of providing a behavior scan service capable of inquiring analysis results of the behavior data using the generated hash value.

Images