KR100645983B1 - Module for detecting an illegal process and method thereof - Google Patents

Abstract

A module and a method for detecting illegal processes are provided to detect and block illegal access to a protected application program by monitoring the application program in a kernel level, not a user level. An access detector(110) detects an API(Application Program Interface) function request of the process by linking with a kernel interface of an OS(Operating System). A function blocking processor(120) returns permission information for performing an intrinsic function to a kernel in case that a malicious component is not present by analyzing the detected function request and blocks the function by returning blocking information to the kernel in the case that the malicious component is present. The function blocking processor transmits a processing result to the protected process(10).

Description

Illegal process detection module and its method {MODULE FOR DETECTING AN ILLEGAL PROCESS AND METHOD THEREOF}

1 is a block diagram schematically illustrating an operation of an illegal process detection module according to the present invention in a computer system;

2A and 2B are flowcharts illustrating an illegal process detection method according to a preferred embodiment of the present invention.

<Description of Symbols for Main Parts of Drawings>

10: protection process

20: illegal process

100: illegal process detection module

110: access detection unit

120: function blocking processing unit

According to the present invention, when any process (malicious process or illegal process) running on a computer system attempts to access a specific process (process to be protected) through various means, it is an illegal process that can detect and block the access attempt. A detection module and a method thereof are provided.

In response to the recent development of network and Internet technology, the online game industry is also rapidly advancing and providing various fun to the clients (game users), but in proportion to the illegal or malicious means to take advantage of their own or illegal Increasingly, cases of damage to normal game users through trials are becoming a big problem. In the long term, this phenomenon impedes the development of a healthy game culture, depressing the user's motivation, and ultimately results in the game provider's willingness to operate and develop the game.

More specifically, in the online game, a hacking tool called the game hack, the game user's information, such as experience and level, as well as game tokens (cyber money) such as game tokens (cyber money) This hacking case frequently occurs. This leads to undesirable imbalances between game users. Therefore, there is an urgent need for a game security related technology to prevent such harm. The representative technologies are as follows.

First, it adds the pattern of hacking tool distributed by using Virus Engine, and inspects the process of application running on the game user's computer system and forcibly terminates the application program matching the registered pattern. There is a technique to let. Typical examples are 'Find Nuclear' and 'MFGS (MyFirewall For Game Service)' developed by AhnLab.

Second, there is a technology that examines all processes executed in a computer system and limits or blocks functions of important functions by using various hooking-related functions of an API (Application Programming Interface) provided by an operating system (OS).

Here, 'API Hooking' refers to a series of actions that first intercept and manipulate Kernel-based API function calls. In addition, unlike MessageHooking, which hooks a message handler when a message occurs in the operating system, certain APIs in the application, such as' CreateWindow (...) ',' OpenProcess (... When calling an API such as ',' it is a technique of moving to an arbitrary address instead of going to a memory address where an API routine is located. The executable file (* .exe) or dynamic library file (* .dll) in the operating system maintains a structure called 'import table' inside the file and contains information on which external APIs are 'imported'.

It holds the function name and address information per API, so this table information is referenced every time the API is called. Therefore, finding the API to be hooked in the 'import table' and replacing the address field with an arbitrary function address is the core of the 'API hooking' technology.

However, as is well known, the operating system basically uses a virtual memory system, and each process has its own independent memory address area and thus does not allow other processes to access it. Therefore, in order to manipulate the 'import table' of another process, a method of accessing the address area of another process (eg, a 'DLL injection' technique) must be implemented.

As a representative example in this regard, Korean Patent Registration No. 10-2003-0087149 (name of the invention: 'real-time process illegal access and manipulation blocking method for online game client security') is disclosed.

However, the former prior art has the disadvantage of constantly adding a pattern of new hacking tools, and furthermore, if the existing hacking tool is newly compiled or the executable itself is compressed, the pattern is modified so that it is not detected. It is a technically fatal loophole. In addition, the latter prior art has to hook the API by acquiring the right to access the process of the hacking tool, but there is a problem in that proper function implementation is impossible when the right is blocked.

The present invention has been made to solve the problems of the prior art, by monitoring the application (process) at the kernel mode level (Kernel Mode Level), not the user mode level (User Mode Level), An object of the present invention is to provide an illegal process detection module and a method for detecting and blocking illegal access to an application (process) to be protected.

The illegal process detection module 100 of the present invention for achieving the characteristic object, the access detection unit 110 for interworking with the kernel interface (Kernel Interface) of the operating system (OS) to detect the API function request by the process; And if it is determined that there is no malicious element by analyzing the function request detected by the access detection unit 110, return permission information to the kernel to perform the original function, and block information if it is determined that there is a malicious element. A function blocking processing unit 120 to return to the kernel to block a corresponding function; It includes.

Here, it is preferable that the function blocking processing unit 120 returns the blocking information to the kernel and transmits the processing result to the protection process 10.

On the other hand, the illegal process detection method using the illegal process detection module 100 operating in the kernel mode level (Kernel Mode Level), (a) the illegal process detection module 100 is initialized; (b) determining whether the process that performed the API function request is the protection process 10; (c) when the determination result of step (b) is not the protection process 10 and the object of the function request is the protection process 10, returning blocking information to the kernel to block the requested function; And (d) if the protection process (10) results from the determination of step (b), returning permission information to the kernel to allow the requested corresponding function; Is implemented.

In this case, step (a) may include: (a-1) establishing a command channel between the initialization and protection process of the kernel service (10); (a-2) checking the address of the original function provided by the kernel and its index; (a-3) allocating kernel memory to store an address, an index, and a corresponding code of the original function; (a-4) replacing the function for detecting access with a kernel function; And (a-5) entering the standby detection function into a standby state; It includes.

Preferably, step (a-4) is implemented by replacing a part of an address of a kernel function table with an address of an access detecting function loaded in kernel memory, or modulating the code of the kernel function itself to detect access. It can be implemented in such a way that the function is executed.

The features and advantages of the present invention will become more apparent from the following detailed description based on the accompanying drawings. Prior to this, the terms or words used in the present specification and claims are defined in the technical spirit of the present invention on the basis of the principle that the inventor can appropriately define the concept of the term in order to explain his invention in the best way. It should be interpreted to mean meanings and concepts. In addition, when it is determined that the detailed description of the known function and its configuration related to the present invention may unnecessarily obscure the subject matter of the present invention, it should be noted that the detailed description is omitted.

1 is a block diagram schematically illustrating an operation of an illegal process detection module according to the present invention in a computer system.

First, when a user executes an application, a process for running the application is executed in an operating system (OS). As is well known, a number of processes may be executed on an operating system (OS), and for convenience of description, in the present invention, a malicious process that attempts to access a process (hereinafter, referred to as a 'protection process') 10 and a protection process 10 is intended to be protected. It is assumed that the illegal process 20 is running on an operating system (OS).

The protection process 10 installs the illegal process detection module 100 of the present invention which operates as described above and operates at a kernel mode level through a kernel interface of a kernel executive. do.

Here, the kernel mode level (Kernel Mode Level) refers to a high level of authority to directly access the resources (hereinafter, 'system resources') of the computer system, and the component (program type functional module that is executed at the kernel mode level). Are protected by the design of the CPU itself from intentional or unintentional external interference.

On the other hand, the User Mode Level is a relatively low privilege level that does not allow direct access to resources, which corresponds to applications running on an operating system (OS). These applications can access system resources through an application programming interface (API) provided by the operating system (OS), which is actually a Win32 subsystem (eg 'USER32.DLL', 'KERNEL32.') Included in the user mode level. DLL ',' GDI32.DLL ', etc.), and kernel execution units such as' NTOSKRNL.EXE' and 'WIN32K.SYS'. A more detailed description thereof will be omitted as it is the same as the well-known operating system structure (Windows ™).

Meanwhile, when the illegal process 20 calls an API or generates a keyboard event or a mouse event to access the protection process 10, the illegal process detection module 100 mounted at the kernel mode level according to a characteristic aspect of the present invention. ) Detects this, determines whether the access attempt is malicious, blocks the requested function, and sends the result to the protection process 10.

As illustrated in FIG. 1, the illegal process detection module 100 for performing this characteristic function is connected to a kernel interface to detect an access attempt of the illegal process 20. And analyze the access attempt detected by the detection unit 110 to perform the original function when it is determined that there is no malicious element, and to return the result (blocking information) when it is determined that there is a malicious element. Blocking the function and the function blocking processing unit 120 for transmitting the information according to the access attempt to the protection process (10).

For reference, the APIs used by the illegal process 20 to access the protection process 10 include 'OpenProcess', 'ReadProcessMemory', 'WriteProcessMemory', 'SendInput', 'SendMessage', 'PostMessage' and 'keydb_event'. and 'mouse_event', and their specific functions and parameters are described in detail in 'MSDN' provided by Microsoft Corporation.

The illegal process detection module 100 as described above may be implemented in the form of a kernel mode driver. Driver refers to a program consisting of predetermined codes executed at the kernel mode level. These drivers are basically a basic instruction channel between an application (protection process) 10 and kernel services, including dispatch, load, unload, create, etc., and the protection process 10. ). Implementation techniques related to this may be easily understood from the viewpoint of those skilled in the art, and thus a detailed description thereof will be omitted.

As described above, the conventional technique for blocking a malicious process (hacking tool) is a method of hooking an API to determine the malicious element, and the authority to access the process of the hacking tool should be obtained. However, more advanced hacking tools can block access to their processes from the outside, and as a result, the API hacking method cannot block these advanced hacking tools. However, the illegal process detection module 100 of the present invention can operate at the kernel mode level, detect access attempts coming through the kernel interface, and invalidate its corresponding function if there is a malicious element.

Hereinafter, the technical spirit of the present invention will be described more clearly with reference to FIGS. 2A and 2B. 2A and 2B are flowcharts illustrating an illegal process detection method according to a preferred embodiment of the present invention.

First, the protection process 10 enters the initial threading and scheduling on the operating system (OS) and simultaneously initializes the illegal process detection module 100 of the present invention (S210). More specifically, in step S210, as shown in FIG. 2B, the kernel service may be initialized and an instruction channel between the protection processes 10 may be set (S211), and an operating system (OS) may be used. Examining the address (Adress) and the index (Index) of the primitive functions provided by the kernel of the kernel (S212), and allocates the kernel memory to the address, index and the code of the original function Storing (S213), replacing the access detection function (access detection code) with the kernel function (S214), and entering the standby state (S215).

Here, in step S214, a part of the address of the kernel function table is replaced with the address of an access detection function loaded in the kernel memory, or the access function is modified by modulating the code of the kernel function itself without changing the address of the kernel function table. It may be implemented in such a way as to be executed.

After the above-described step S215, the access detection unit 110 is in a kernel event waiting state, and when the application (process) calls the API, the call information (request information) is automatically received (Peeping) through the kernel interface. For reference, the access detection function may preferably take an operation aspect of 'CallBack' type (similar to that of the filter hook driver), and through this, the access detection unit 110 may receive function request information of processes. Will be. On the other hand, when the protection process 10 is terminated, the address, the index and the code stored in the kernel memory are restored to their original state.

After the execution of the step S210, it is determined whether the process that performed the function request (function request using the API and the event) as described above is the protection process 10 (S220), and if the protection process 10 If not, it is regarded as a request by the illegal process 20, and it is determined whether the object (access target) of the function request is the protection process 10 (S230). If it is determined in step S230 that the target of the function request is the protection process 10, the blocking information is returned to the kernel to block the function from being performed, and the processing result is transmitted to the protection process 10. (S240).

On the other hand, if the function request by the protection process 10 as a result of the determination of step S220 returns the permission information to the kernel (Kernel) so that the corresponding function can be performed. If the target of the function request is not the protection process 10 as a result of the determination in step S230, the permission information is returned to the kernel so that the corresponding function can be performed as described above.

Thus, by analyzing the API function request through the illegal process detection module 100 operating at the kernel mode level, if the request contains malicious elements for the protection process 10, invalidating the requested function, The protection process 10 can be protected. Of course, the illegal process detection module 100 of the present invention performing such a characteristic function is implemented through programming, and its implementation manner (logic, logic) can be variously modified.

As described above and described with reference to a preferred embodiment for illustrating the technical idea of the present invention, the present invention is not limited to the configuration and operation as shown and described as described above, it is a deviation from the scope of the technical idea It will be understood by those skilled in the art that many modifications and variations can be made to the invention without departing from the scope of the invention. Accordingly, all such suitable changes and modifications and equivalents should be considered to be within the scope of the present invention.

According to the present invention described above, unlike the prior art by monitoring the application (process) at the kernel mode level (Kernel Mode Level), there is an effect that can detect and block malicious access to the protection process (10).

Claims (7)

In the illegal process detection module 100 of the protection process 10 mounted on the computer system to operate at the kernel mode level to block malicious access from the illegal process 20, An access detection unit 110 interworking with a kernel interface of an operating system (OS) to detect an API function request by a process; And If it is determined that there is no malicious element by analyzing the function request detected by the access detection unit 110, the permission information is returned to the kernel to perform the original function. A function blocking processing unit 120 to return to the kernel to block a corresponding function; Illegal process detection module, characterized in that comprising a. The method of claim 1, The function blocking processing unit 120, And returning the blocking information to the kernel and transmitting the result of the processing to the protection process (10). In the illegal process detection method using the illegal process detection module 100 operating at the kernel mode level (Kernel Mode Level), (a) initializing the illegal process detection module 100; (b) determining whether the process that performed the API function request is the protection process 10; (c) returning blocking information to the kernel to block the requested function when the determination result of step (b) is not the protection process 10 and the object of the function request is the protection process 10; And (d) if it is determined in step (b) that the protection process (10), returning the permission information to the kernel to allow the requested corresponding function; Illegal process detection method comprising a. The method of claim 3, wherein Step (a) is, (a-1) establishing a command channel between the initialization and protection process 10 of the kernel service; (a-2) checking the address of the original function provided by the kernel and its index; (a-3) allocating kernel memory to store an address, an index, and a corresponding code of the original function; (a-4) replacing the function for detecting access with a kernel function; And (a-5) entering the access detection function into a standby state; Illegal process detection method comprising a. The method of claim 3, wherein After step (c), Transmitting the processing result to the protection process after the blocking information is returned to the kernel; Illegal process detection method further comprises. The method of claim 4, wherein The (a-4) step, And a part of an address of a kernel function table is replaced with an address of an access detection function loaded in kernel memory. The method of claim 4, wherein The (a-4) step, The illegal process detection method, characterized in that the access detection function is executed by modulating the code of the kernel function itself.

Images