KR100673200B1 - Method and system for detection of mobile viruses in a wireless terminal - Google Patents

Abstract

The present invention discloses a method and system for monitoring a mobile virus in a wireless terminal capable of monitoring a virus infection of a file input and output to a wireless terminal in real time in conjunction with the mobile platform and treating an infected mobile virus. The method for monitoring a mobile virus in the wireless terminal may include: a) registering a system notification table to the mobile platform by a real-time monitoring unit when a file is inputted or outputted to a mobile platform of the wireless terminal; and b) the registered system notification table. Delivering the system notification message to the real-time monitoring unit in the mobile platform; and c) calling the vaccine engine in response to the transmitted message in the real-time detection unit, and checking the virus of the file in the vaccine engine. And d) if the virus is not detected as a result of the scan, execute the file normally on the mobile platform, and if the virus is detected, stop the execution of the file on the mobile platform and detect the virus to the user. Notifying the user, and e) If you choose to clean or delete a step to treat or remove the virus from the vaccine engine.

Wireless terminal, mobile virus, mobile platform, vaccine engine

Description

Method and system for detecting mobile viruses in wireless terminal

1 is a block diagram showing a mobile virus monitoring system in a wireless terminal according to an embodiment of the present invention

2 is a block diagram showing a system notification table registered in the mobile platform of FIG.

3 is a diagram illustrating a system notification message according to the system notification table of FIG. 2.

4 is a flowchart showing a mobile virus monitoring method in a wireless terminal according to an embodiment of the present invention in order

<Description of Reference Symbols for Main Parts of Drawings>

110: input and output file 120: platform

130: real-time monitoring unit 140: vaccine engine

150: vaccine providing server

The present invention relates to a method and system for monitoring a mobile virus in a wireless terminal, and more particularly, to a mobile terminal in a wireless terminal capable of monitoring in real time whether a file is inputted or outputted to a wireless terminal in real time, and treating an infected mobile virus. The present invention relates to a virus monitoring method and a system thereof.

In general, a computer virus is a combination of instructions that modify a computer program or executable part and copy itself or its modifications to it to damage the computer's operation. It is a type of computer program that infiltrates data, destroys data, or destroys other programs. A virus works when you start your computer with an infected disk or when you run a specific program, which destroys data, interrupts your computer's operation, and replicates itself to infect other computers.

Infection paths of these computer viruses have a very diverse and complex structure, the most common ones are illegal copying, computer communication, computer co-use, LAN or the Internet. Using pirated software diskettes or working on a computer that is shared by several people is more likely to cause a virus infection, and you will be infected with the diskette or program without your knowledge. If you use these infected diskettes or programs on your computer, The computer is also infected. Recently, as the use of computer communication increases, viruses spread rapidly when sending and receiving data.

On the other hand, due to the relationship between the operating system and the file system is less than the computer, and the importance of the data used is relatively low, the recognition and damage of the mobile virus to the wireless communication system is not much.

However, wireless terminals are now adopting the functions of computers and are developing into smart phones. As the wireless network of wireless terminals has expanded to the same level as the wireless Internet, the virus damages occurring in computers are soon reproduced in wireless networks of wireless terminals. It is likely to be.

In reality, damages to mobile viruses are appearing. As a specific example of mobile virus damages, in Japan's representative mobile phone Internet service, I-Mode, Japan, hundreds of mobile phones in Japan were sent to police emergency numbers due to malware stored in software. There was an incident that made the phone call.

In addition, mobile viruses are expected to increase gradually as securities and bank transactions are possible using wireless terminals, and the explosive increase in users of wireless terminals is expected to have a greater impact than the damage of computer viruses. Security and safety have become one of the most important issues.

Accordingly, an object of the present invention is to check and block in real time the virus infection of the file input and output to the mobile platform of the wireless terminal before the damage from the mobile virus in the wireless terminal in order to solve the above-mentioned problems. The present invention provides a method and system for monitoring a mobile virus in a wireless terminal.

Another object of the present invention is to register a system notification table on the mobile platform of the wireless terminal, in a wireless terminal that can monitor and treat the virus infection of the input and output files in accordance with the system notification message registered in the system notification table in real time To provide a mobile virus monitoring method and system thereof.

Another object of the present invention is to monitor in real time the virus infection of the file downloaded to the wireless terminal or the file executed on the mobile platform of the wireless terminal in real time in conjunction with the mobile platform, and to treat the infected mobile virus in the mobile terminal The present invention provides a method and system for monitoring a mobile virus in a wireless terminal that can prevent damage caused by a virus.

In order to achieve the above object, a mobile virus monitoring method in a wireless terminal according to the present invention, in a method for monitoring a mobile virus in a wireless terminal in real time, a) a file is input and output to the mobile platform of the wireless terminal If the real-time monitoring unit registers a system notification table on the mobile platform, b) transmitting a system notification message according to the registered system notification table on the mobile platform to the real-time monitoring unit, c) the real-time The detection unit calls the vaccine engine in response to the delivered message, and the virus scan the virus of the file in the vaccine engine, and d) if the virus is not detected as a result of the scan, the mobile platform to retrieve the file If it runs normally and a virus is detected, Stopping execution of the file on the existing mobile platform, notifying the user of virus detection, and e) treating or deleting the virus in the vaccine engine when the user selects a virus treatment or deletion.

The system notification table includes a system notification message delivered when a file is executed, a callback function pointer for processing the system notification message, and a real-time monitoring application name.

The mobile platform is made using at least one of WIPI, GVM, SK-VM, WI-TOP, BREW, KittyHawk and JINOS.

The real-time monitoring unit includes a real-time monitoring program for registering a system notification table in the mobile platform, and in real time to monitor the virus infection of the file input to the mobile platform by calling the vaccine engine when the system notification message delivery. .

The system notification message may be at least one of a FILE_OPEN message delivered when a file is opened, a FILE_CLOSE message delivered when a file is closed, a FILE_READ message delivered when a file is read, or a FILE_WRITE message delivered when a file is written.

The vaccine engine includes a database storing a mobile antivirus program for detecting and treating mobile viruses, and is updated periodically or at the request of the wireless terminal to detect and treat new mobile viruses.

In addition, before step a), the user of the wireless terminal, characterized in that it further comprises the step of setting the mobile virus real time monitoring mode.

In addition, after step c), the vaccine engine further comprises the step of delivering the test results to the real-time monitoring unit, the real-time monitoring unit further comprises the step of delivering the test results to the mobile platform.

In order to solve the above technical problem, the mobile virus monitoring system in a wireless terminal according to the present invention, in the system for monitoring the mobile virus in a wireless terminal in real time, the file that is input and output to the wireless terminal or download the file The mobile platform is used to execute and registers a system notification table, a real-time monitoring unit that monitors whether or not a virus is infected by a file input and output to the mobile platform according to a notification message of the system notification table, and input and output to the mobile platform. Includes a vaccine engine that detects and treats viruses in files.

The apparatus further includes a vaccine providing server that provides a mobile antivirus program to the vaccine engine periodically or at the request of the wireless terminal for detection and treatment of new mobile viruses.

The mobile virus monitoring system is operable when the user sets the state of the wireless terminal to the mobile virus real time monitoring mode.

The mobile platform executes the file if a virus is not detected from the vaccine engine, and stops executing the file if a virus is detected from the vaccine engine.

The real-time monitoring unit monitors the virus infection of the file input and output to the wireless terminal in real time in conjunction with the mobile platform.

The vaccine engine may detect a mobile virus from the input / output file, and treat or delete the detected mobile virus by a user's selection.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. The descriptions in the various embodiments are only shown and limited by way of example and without intention other than the intention to help those of ordinary skill in the art to more thoroughly understand the present invention, and thus the scope of the present invention. It should not be used as a limitation.

1 is a block diagram illustrating a mobile virus monitoring system in a wireless terminal according to an embodiment of the present invention. Referring to the accompanying FIG. 1, a mobile virus monitoring system in a wireless terminal according to an embodiment of the present invention will be described in detail. As follows.

Referring to FIG. 1, a mobile virus monitoring system in a wireless terminal according to the present invention includes a mobile platform 120 that is used to download or execute a file 110 that is input and output to a wireless terminal. A vaccine providing server 150 including a real-time monitoring unit 130 for monitoring the virus input and output of the input and output files, and a vaccine engine 140 for detecting and treating a virus, and provides a mobile antivirus program to the vaccine engine It further includes.

The wireless terminal includes a mobile communication terminal such as a mobile phone, PDA, smart phone, or Palm PC, and is connected to the vaccine providing server 150 via a communication network capable of data transmission and reception.

The mobile platform 120 is a kind of middleware embedded in a wireless terminal, and is used when executing or downloading various application programs such as an operating system (OS) of a computer in the wireless terminal. In the present invention, the mobile platform 102 registers the system notification table 160 for the file input and output, and when the file is input and output, the system notification message according to the system notification table to deliver to the real-time monitoring unit to the mobile It is responsible for notifying the platform of the file input and output.

The mobile platform 120 may be a mobile standard platform, WIPI (Wireless Internet Platform Interoperability, hereinafter referred to as 'WIPI'), a C-based GVM developed by Shinji Soft, and a Java VM developed by XCE SK. -VM can be used, and C-based WI-TOP that can support additional services as well as content can be used. In addition, the platform may be mounted separately on the wireless terminal, or two or more platforms may be mounted together.

In addition, it may be BREW, a C-based platform provided by Qualcomm, KittyHawk, a mobile Java VM developed by Aromasoft, or JINOS developed by Belox to improve speed and environment. .

The real-time monitoring unit 130 has a built-in real-time monitoring program 132, when the user sets the state of the wireless terminal in the virus real-time monitoring mode, the fact that the file is input and output to the mobile platform 120 The system notification table 160 is registered in the mobile platform.

In addition, when a file is input and output to the mobile platform 120 and a system notification message is transmitted from the mobile platform, the vaccine engine 140 is called to check whether the files inputted and output are infected with a virus.

Therefore, the real-time monitoring unit 130 allows the file downloaded to the wireless terminal and the file executed on the mobile platform through the wireless Internet, cable or IrDA to be linked with the mobile platform to scan and repair the virus in real time. .

The vaccine engine 140 includes a database 142 storing a mobile antivirus program for detecting and treating a virus invading the wireless terminal, and is composed of a dynamic link library (DLL) program. Therefore, since the vaccine engine 140 is not loaded in the RAM together with the main program, the ram space can be saved, and it is configured to be called and executed only when necessary.

The vaccine engine 140 is responsible for checking whether the file 110 input / output by the call of the real-time monitoring unit 130 is infected with a virus. In addition, if a virus is detected as a result of the test, the virus detection fact is transmitted to the real-time monitoring unit 130, and the user treats or deletes the detected virus as the user selects a virus treatment or deletion command. The mobile antivirus program may be V3 mobile, which is a vaccine for WIPI, the mobile standard platform, and is configured to be updated periodically or upon request from the wireless terminal.

The vaccine providing server 150 updates the vaccine engine 140 periodically or by a request from the wireless terminal to detect and treat new mobile viruses.

FIG. 2 is a diagram illustrating a system notification table registered in the platform of FIG. 1, and FIG. 3 is a diagram illustrating a system notification message according to the system notification table of FIG. 2.

Referring to FIG. 2, the system notification table 160 is configured in the mobile platform to manage a system notification message, a system notification message 162 which is a notification message transmitted when a file is executed, and a corresponding message. Callback Function Pointer (164) to handle the, and real-time monitoring application (or program) name (166, Application Name).

As shown in FIG. 3, the system notification message 162 includes a FILE_OPEN message delivered when a file open occurs, a FLIE_CLOSE message delivered when a file close occurs, and a FLIE_READ message and file delivered when a file read occurs. Contains a message such as a FLIE_WRITE message to be delivered when a write occurs.

The callback function pointer 164 utilizes a function pointer to actually declare a function of a certain type in the form of a pointer, and executes a predetermined routine if the user specifies it, and if the user does not specify it (that is, the pointer is NULL). Do not run). Therefore, the callback function pointer 164 is responsible for delivering the system notification message to the real-time monitoring application (or program) 132 of the real-time monitoring unit when one of the system notification messages occurs in the mobile platform 120. .

Figure 4 is a flow chart showing a mobile virus monitoring method according to an embodiment of the present invention in order, the operation of the mobile virus monitoring system according to an embodiment of the present invention as follows.

4, when the user sets the state of the wireless terminal to the mobile virus real-time monitoring mode (S200), the mobile virus monitoring program is executed to operate the mobile virus monitoring system of the present invention.

When a file is downloaded or transmitted to the mobile platform 120 of the wireless terminal and input / output (S202), the real-time monitoring unit 130 registers a system notification table 160 with the mobile platform 120 (S204).

The system notification table 160 includes a system notification message 162 such as FLIE_OPEN, FLIE_CLOSE, FLIE_READ, and FLIE_WRITE, a callback function pointer 164 to process the system notification message, and a real-time monitoring application name ( 166).

Subsequently, the system notification message according to the registered system notification table is transferred from the mobile platform 120 to the real-time monitoring unit 130 (S206).

Therefore, a FLIE_OPEN message is transmitted to the real-time monitoring unit to open an input / output file, a FLIE_CLOSE message is transmitted to close an open file, a FLIE_READ message is transmitted to read a file, and a FLIE_WRITE message is used to write a file. Is passed.

Subsequently, the real-time detection unit 130 calls the vaccine engine 140 in response to the transmitted message (S208), and checks the virus of the file in the vaccine engine 140 (S210).

Subsequently, after the virus of the file is scanned by the vaccine engine 140, the scan result is transmitted to the real time monitoring unit 130, and the test result is transmitted to the mobile platform 120 by the real time monitoring unit 130. To pass.

If the virus is not detected as a result of the scan (S212), the file is normally executed in the mobile platform 120 (S214). If a virus is detected (S212), the file of the file is detected in the mobile platform 120 (S212). The execution is stopped (S216), and the user is notified of the virus detection (S218).

In this case, the user is notified of the virus detection on the display window of the wireless terminal so that the user can be aware of the virus infection, and also displays whether the virus is to be treated or deleted on the display window.

If the user selects virus treatment or deletion, the vaccine engine treats or deletes the virus (S220).

As described above, according to the mobile virus monitoring method and system in the wireless terminal according to the present invention, before the virus damage occurs in the wireless terminal, the virus infection of the file input and output to the mobile platform of the wireless terminal in real time Can be inspected and blocked

In addition, a system notification table may be registered in the mobile platform, and the virus infection of a file input / output in accordance with the system notification message registered in the system notification table may be monitored and treated in real time.

Therefore, according to the present invention, the virus infection of all files input and output from the wireless terminal can be monitored in real time in conjunction with the mobile platform, and the infected mobile virus can be cured to prevent damage caused by the mobile virus in the wireless terminal. There is a feature of the present invention.

The mobile virus monitoring method and system therefor in a wireless terminal according to an embodiment of the present invention are not limited to the above embodiments and may be variously designed and applied without departing from the basic principles of the present invention. It will be obvious to those of ordinary skill in the art.

As described above, the present invention has the effect of blocking and scanning in real time the virus infection of the file input and output to the mobile platform of the wireless terminal before the damage from the mobile virus in the wireless terminal.

In addition, the present invention has the effect of registering the system notification table on the mobile platform of the wireless terminal, and in real time to monitor and treat the virus infection of the file input and output according to the system notification message registered in the system notification table.

In addition, the present invention monitors in real time whether or not a virus infection of all files input and output from the wireless terminal in conjunction with the mobile platform, and has the effect of preventing damage caused by the mobile virus in the wireless terminal by treating the infected mobile virus.

Claims (15)

In a method for monitoring a mobile virus in real time in a wireless terminal, The wireless terminal includes a real-time monitoring unit for monitoring the mobile platform and mobile virus in real time, the method a) registering a system notification table to the mobile platform by the real-time monitoring unit when a file is inputted or outputted to the mobile platform of the wireless terminal; b) transmitting a system notification message according to the registered system notification table to the real-time monitoring unit in the mobile platform; c) calling a vaccine engine in response to the delivered system notification message by the real-time detection unit, and scanning the virus of the file in the vaccine engine; d) if the virus is not detected as a result of the scan, the mobile platform normally executes the file; if a virus is detected, stopping the execution of the file on the mobile platform and notifying the user of the virus detection; ; And e) when the user selects a virus treatment or deletion, the method comprising the step of treating or deleting a virus in the vaccine engine. The system notification table according to claim 1, A system notification message to be delivered when the file is executed; A callback function pointer to process the system notification message; And A mobile virus monitoring method in a wireless terminal, comprising a real-time monitoring application name. The method of claim 1, The mobile platform is a mobile virus monitoring method in a wireless terminal, characterized in that it comprises at least one of WIPI, GVM, SK-VM, WI-TOP, Brew (BREW), KittyHawk and JINOS, The method of claim 1, The real-time monitoring unit includes a real-time monitoring program for registering a system notification table on the mobile platform, and in real time to monitor the virus infection of the file input to the mobile platform by calling the vaccine engine when the system notification message delivery. A mobile virus monitoring method in a wireless terminal, characterized in that. The method of claim 1, The system notification message is at least one of a FILE_OPEN message delivered when opening a file, a FILE_CLOSE message delivered when a file is closed, a FILE_READ message delivered when a file is read, or a FILE_WRITE message delivered when a file is written. Surveillance Method. The method of claim 1, The vaccine engine includes a database storing a mobile antivirus program for detecting and treating mobile viruses. The method of claim 1, The vaccine engine is a mobile virus monitoring method for a wireless terminal, characterized in that for updating and periodically at the request of the wireless terminal to detect and treat a new mobile virus. The method of claim 1, Before the step a), the user of the wireless terminal further comprises the step of setting the mobile virus real-time monitoring mode mobile virus monitoring method in a wireless terminal. The method of claim 1, c) after the step, the vaccine engine further comprises the step of delivering a test result to the real-time monitoring unit, the real-time monitoring unit for transmitting the test result to the mobile platform mobile in the wireless terminal, characterized in that the. How to Monitor Viruses. A system for monitoring mobile viruses in real time in a wireless terminal, the system comprising A mobile platform used to download a file input or output to the wireless terminal or to execute the file, and register a system notification table; A real-time monitoring unit that monitors whether or not a virus is infected with a file input and output to the mobile platform according to a notification message of the system notification table; And It includes a vaccine engine for detecting and treating the virus of the file input and output to the mobile platform, When a file is inputted and outputted to the mobile platform of the wireless terminal, the real-time monitoring unit registers a system notification table to the mobile platform, and sends a system notification message according to the registered system notification table to the real-time monitoring unit in the mobile platform. The mobile virus monitoring system of a wireless terminal, wherein the real-time detection unit calls a vaccine engine in response to the delivered system notification message and checks the virus of the file in the vaccine engine. The method of claim 10, And a vaccine providing server providing a mobile antivirus program to the vaccine engine periodically or at the request of the wireless terminal for the detection and treatment of new mobile viruses. The method of claim 10, The mobile virus monitoring system operates when the user sets the state of the wireless terminal to the mobile virus real time monitoring mode. The method of claim 10, The mobile platform executes the file if no virus is detected from the vaccine engine, and stops the execution of the file if a virus is detected from the vaccine engine. The method of claim 10, The real-time monitoring unit mobile virus monitoring system for a wireless terminal, characterized in that for monitoring the virus infection of the file input and output to the wireless terminal in real time in conjunction with the mobile flat perm. The method of claim 10, The vaccine engine detects a mobile virus from the input and output files, and the mobile virus monitoring system for a wireless terminal, characterized in that for treating or deleting the detected mobile virus by the user's selection.

Images