KR100910761B1 - Anomaly Malicious Code Detection Method using Process Behavior Prediction Technique - Google Patents

Abstract

The present invention relates to a pattern detection / detection method and system for detecting an attack by an unknown malware and effectively blocking the same, wherein the malicious code known through the system configuration of the present invention is first executed by a DB filtering module. It is filtered first, and then unknown malware is detected by comparing the behavioral behavior pattern after monitoring and the malicious behavior characteristic value (prediction pattern) that has been pre-learned and constructed. It is generated and transmitted to the DB filtering module so that it can be detected as known malware later.

Malware, Process Behavior Monitoring, Behavior Characteristics Extraction, Malicious Behavior Prediction, Atypical Malware Detection

Description

Anomaly Malicious Code Detection Method using Process Behavior Prediction Technique

The present invention monitors a system to detect an attack by unknown malware, and detects and executes a pre-malignant behavior characteristic value (prediction pattern) by combining, reprocessing and learning all behaviors in the system caused by the malware. The present invention relates to a pattern detection / detection method and system for effectively blocking an attack compared to a behavior pattern generated by a code.

As the dependence on information and communication technology increases, the risk of electronic infringement and cyber threats using vulnerabilities existing in major facilities of society increases. In recent years, the technology of malware from social engineering hacking attacks using phishing and pharming, through the adware and spyware, from simple leakage of personal information to achieving political or economic purposes. Combined with these other areas, they are more organized, specialized and targeted. In addition, Internet worms and viruses are shifting from attacking local PCs to exploiting vulnerabilities inherent in ICTs to attacking telecommunications infrastructures such as the Internet or services based thereon.

To protect personal information from this trend of malware, most information protection systems, including antivirus products, rely on signature-based methods. However, the existing signature-based method has a limitation in dealing with malicious codes using a new type of attack technique.

To overcome this, various types of malware detection techniques have been developed, and behavior-based atypical attack detection techniques have been studied in order to detect unknown malware attacks. However, these behavior-based atypical detection techniques must distinguish malicious and normal behaviors by analyzing various types of code behaviors. Because the code behaviors that are analyzed generate a lot of system behaviors, the error or policy of behavior analysis There is a high false positive rate due to the setting error, and there is a difficulty in setting a policy to classify the behavior.

In order to reduce such false detection rate in atypical detection technique, intrusion detection field has been developing intrusion detection technology using data mining technology since the late 1990s. However, all behaviors of executable code in the system are proposed as proposed in the present invention. Atypical detection techniques for events have not been proposed.

In order to detect unknown malicious code, Korean Patent Application No. 2002-0013994 proposes a method of preventing infection by computer virus by grasping and prohibiting or notifying the writing operation of malicious code. . However, the Korean Patent Application No. 2002-0013994 is a technique for detecting and detecting a write operation when a parasitic virus among file viruses tries to attach a virus program before or after an executable file to infect an executable file. It is not a method for detecting all kinds of malicious code, but only a virus that performs a limited form of behavior. In addition, Korean Patent Registration No. 2006-0063342 proposes a real-time attack pattern detection system for an unknown network attack, but extracts an unknown attack pattern limited to a network attack, and finds a suspicious packet in all initial packets. Suspicious indicator is given, but there is a limit that it can act to increase false positive rate when generating signatures by missing suspicious attack pattern or adding suspicious indicator to normal pattern.

Korean Patent Registration No. 2004-0056998 uses an action-based malware detection technique by monitoring execution code in the system similarly to the present invention, but the proposed technique imposes a predefined risk score on the action. I'm using the way. To this end, the administrator had to perform the task of assigning a risk score to the execution code behavior.

In the present invention to solve the above-mentioned conventional problems, an object of the present invention is to monitor all the behavior in the system caused by the normal executable code and malicious code to combine the relevant events to create a behavior characteristic pattern and relearn this Input to the algorithm to generate malicious behavior feature values (prediction patterns). Thereafter, a behavior characteristic pattern is generated from new executable code, and a method and system for detecting malicious code are provided by identifying whether a pre-generated malicious behavior characteristic value (prediction pattern) exists in the pattern.

In order to achieve the object of the present invention, a method and system for detecting atypical malware using a process behavior prediction technique monitor a behavior event generated when a process is executed for a process for which a prior execution is not authorized, thereby proactively identifying the process as malicious. If a predicted behavior characteristic value (predictive pattern) is shown, it is detected as a malicious behavior and the execution is stopped.

In the present invention, in order to construct a behavior prediction pattern for atypical malware, first, normal processes and malicious processes are executed to extract behavior events represented by the processes by file, network, registry, service, and process. The extracted event information is reprocessed into a form that can be input to the learning algorithm in order to generate a behavior characteristic value (prediction pattern) predicted by learning from the learning algorithm. It is a process behavior event log reconstructed into 76 record fields that organize file, network, registry, service and process information. The reconstructed behavior event data is converted into atypical malicious behavior feature values (prediction patterns) through a learning algorithm. It is used to detect atypical malware.

In order to detect the behavior of atypical malware, the monitoring module's behavior is monitored by six monitor modules such as file monitor, network IM monitor, registry monitor, TDI monitor, and process monitor. In the meantime, if a characteristic value equal to the characteristic value of the malicious code behavior (predictive pattern) appears, it is defined as a malicious code to be detected.

Atypical malware detection system using the process behavior prediction technique according to the present invention, DB filtering module for performing the primary malicious code filtering for the executable code running in the system; A system resource monitor module for performing system resource monitoring to collect individual event information generated by executable codes executed in the system; A reprocessing module for reprocessing the individual event information collected by the system resource monitor module and reconstructing it into one unified log representing relevant behavior property values of the executable codes; A behavior prediction information processing module for extracting atypical malicious behavior feature values (prediction patterns) by inputting a reconstructed integrated log from the reprocessing module into a learning algorithm; And an atypical malicious behavior detection module for detecting malicious behavior by comparing the atypical malicious behavior characteristic value (prediction pattern) extracted from the behavior prediction information processing module with the behavior characteristic value data configured in the reprocessing module. do.

The system resource monitor module collects individual event information about a file system, a process, a registry, a service, and a network item.

The system resource monitor module may extract a file monitor for extracting information such as a detection time, a PID, a path, a system directory, and the like, and extract information such as a packet unit detection time, PID, S / D-IP, and packet length. It should be expressed in process units through IM monitor, process monitor extracting information such as process detection time, PID, thread count, registry monitor detecting information such as detection time, PID, registry path, current status, size, and TDI driver. TDI_P monitor that extracts network information-information such as detection time, PID, local IP address, remote IP address, average length of packets, protocol, fragment count, transmission size, and reception size-and session unit through TDI driver. Including a TDI_S monitor that extracts network information-information such as detection time, PID, local IP address, remote IP address, protocol, transmission size, and reception size. It is.

The reprocessing module configures the relevant behavior property value data of the execution codes into one record based on the event occurrence time upon reconstruction of the integrated log.

On the other hand, the atypical malware detection method using the process behavior prediction technique, the first step of performing the primary malware filtering on the executable code running in the system; A second step of performing system resource monitoring to collect individual event information generated by executable codes executed in the system; A third step of reprocessing the individual event information collected in the second step and reconstructing it into one unified log representing the relevant behavior property value of the execution codes; A fourth step of extracting atypical malicious behavior feature values (prediction patterns) by inputting the integrated log reconstructed from the third step into a learning algorithm; And a fifth step of detecting malicious behavior by comparing the atypical malicious behavior feature value (prediction pattern) extracted in the fourth step with the behavior feature value data configured in the third step.

In the second step, it collects individual event information for file system, process, registry, service and network item.

In the third step, the relevant behavior characteristic value data of the execution codes may be configured as one record based on an event occurrence time when reconstructing the integrated log.

In the record configuration, a value of a record field without an event is described in a recent event valid time range, and a null value is recorded when out of the recent event valid time range.

As described above, according to the present invention, the malicious behavior characteristic value (prediction pattern) is searched for the behavior of the executable code generated in the system, and then the malicious behavior is discriminated by comparing with the behavior characteristic value of the newly unknown malicious code. You can do it.

What has been described above is only one embodiment for implementing the atypical malware detection method and system using the process behavior prediction technique according to the present invention, the present invention is not limited to the above embodiment, the following claims Without departing from the gist of the present invention claimed in the scope, anyone of ordinary skill in the art belongs to the technical spirit of the present invention to the extent that various modifications can be made.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram conceptually illustrating execution code monitoring, generation of a data set, learning performance, and verification of learning results according to the present invention.

As shown, the device driver (300) for monitoring the file system, registry system, network, and services monitors system resources, collects event logs generated by the executable code for each monitor, and then creates a data set. Send to module 301.

The data set generation module 301 generates a log file for the logs transmitted from the device drivers 300 and monitors whether a process is executed by operating a process monitoring thread.

In addition, the data set reconstruction module 400 reconstructs and stores the log files created for each device driver 300 into one file. At this time, one record having 76 fields based on the generated packet expresses information (characteristic value) of the corresponding packet. The record contains process information, file information, registry information, and network information. Each information collected individually configures one record to represent the overall behavioral event characteristics by allowing associated information to be included in the record configuration. .

This record information is input to the data mining algorithm and learning is performed (510), and the result value represents the behavior characteristic value (prediction value) for the corresponding execution code.

The executable code behavior feature value is stored in a file form, and then it is determined whether the malicious code is 520 through a comparison using pattern matching after behavior analysis of the new executable code.

Figure 2 shows the overall configuration of the system for detecting atypical malware according to the present invention implementing the concept of FIG.

As shown, executable code downloaded from the network 100 and executed in the system passes through the DB filtering module 200 for filtering primarily known malicious codes. Here, the malicious code signature DB 700 detects the first known malicious code using a filtering method of the same pattern matching method as the existing method.

Unknown new executables that have passed through the DB filtering module 200 are executed in the system. At this time, each process performs file read / write, network packet send / receive, registry read / write, service registration and execution. For example, six monitors (3101, 3201) can be used to monitor all related actions. 3301, 3401, 3501, and 3601 constitute a system resource monitor module 3001.

The system resource monitor module 3001 detects event logs of file systems, processes, registries, services, and network items, monitors the status of running processes and threads, and monitors network, file based on process information. Monitor access to systems, registries, services and drivers.

The file monitor 3101 extracts information such as detection time, PID, path, system directory presence, and the like, and the IM monitor 3201 detects packet-specific detection time, PID, S / D-IP, packet length, and the like. Extract information from

The process monitor 3301 extracts information such as process detection time, PID, thread count, and the like, and the registry monitor 3401 detects information such as detection time, PID, registry path, current state, size, and the like.

The TDI_P monitor 3501 extracts network information to be expressed in units of processes through the TDI driver. Such information includes detection time, PID, local IP address, remote IP address, average length of packet, protocol, and fragment. Information such as the number, transmission size, and reception size is provided.

Finally, the TDI_S monitor 3601 extracts the network information of the session unit through the TDI driver. The information includes the detection time, PID, local IP address, remote IP address, protocol, transmission size, and reception size. Detect information.

This information is configured in the form of temporary files for each of the six monitors, and then reconstructed into a single consolidated log representing behavior characteristic values of the process in the reprocessing module 4001 (described in detail below with reference to FIG. 4). .

Configuring the integrated log in the reprocessing module 4001 is to configure the event information for each monitor detected from each individual collection log into one record of relevant information, and then input it to the behavior prediction information processing module 500.

Through this, the behavior prediction information processing module 500 may extract malicious behavior feature values (prediction patterns) from the relevant log information.

The extracted malicious behavior characteristic value (prediction pattern) is input to the malicious code behavior prediction pattern DB 600, and if new unknown code is not known malware at the time of execution, the system resource monitor module 3001 as described above. ), And by comparing with the execution code behavior characteristic value processed through the reprocessing module 4001 can determine whether malicious.

Finally, if it is determined to be malicious, the signature of the malicious code is extracted and then entered into the malicious code signature DB 800.

3 is a flowchart illustrating a malicious code filtering method by diagramming a processing sequence of executable code executed in a system.

First, before the execution code is executed in the system, primary filtering is performed by DB filtering (S100).

The DB filtering is performed with the malware signature DB 800a and the normal signature DB 800b, and filters known malware before execution. At this time, the known normal code is excluded from the monitoring target in the subsequent monitoring step (S110) to reduce the load that may occur by monitoring all the execution code.

In the system resource monitoring step (S110), when new unknown code that is neither known normal code nor known malicious code is executed in the system, it is monitored.

Through system resource monitoring, after collecting the first temporary log for the execution code, the association process for the entire log is performed in the reprocessing step (S120) to extract the behavior characteristic values for each process in the form of records. This information represents the action generated by the process by subdividing it into information such as file, registry, network, and service. When the training is performed again using the data mining algorithm through the behavior prediction information processing step (S130), the characteristic value (prediction pattern) of the malicious behavior is displayed from the overall granular behavior characteristics.

Finally, this behavior feature value (prediction pattern) is detected as malicious behavior of the executable code having the behavior feature value (prediction pattern) as the actual malware detection policy (S140).

4 is a diagram illustrating in detail the integrated log data generated by the reprocessing module of FIG. 2.

In the reprocessing module 4001 of FIG. 2, the file monitor 3101, the IM monitor 3201, the process monitor 3301, the registry monitor 3401, the TDI_P monitor 3501, and the TDI_S monitor 3401 are generated. A total of 76 pieces of data are aggregated into one record, and these records are again classified by the generation process to generate a comprehensive log file 410.

First, the log generated for each monitor is saved in a temporary file combining the name and time of each module.

At the end of log collection, the log data of each temporary file collected for each monitor is created as a DB file. At this time, the contents of some fields are calculated and filled in to create one record.

When creating information from a single record, the reference is the module with the most events in one second.

When recorded data is generated as one record, the time is expressed in units of 1 second. That is, if the time is 2.500000 ~ 3.4999999, all are expressed as 3 seconds.

In addition, when attaching the generated information of the remaining modules in the reference information, the value of the field without an event is written in the range of the latest event valid time, and when it is out of this range, a null value is recorded.

That is, assuming that the file system generates 100 events in one second and the registry event has generated 50 events, the log records a total of 100 records. The 50 missing registry events record the previous value within the last event valid time range. Here, the latest event valid time is to set a valid time range when the previous event value is recorded so that the user's setting is input.

1 is a block diagram conceptually illustrating execution code monitoring, generation of a data set, learning performance, and verification of learning results according to the present invention;

2 is an overall configuration diagram of a system for detecting atypical malware according to the present invention, which implements the concept of FIG.

3 is a flowchart illustrating a malicious code filtering method by diagramming a processing sequence of executable code executed in a system.

4 is a diagram illustrating in detail the integrated log data generated by the reprocessing module of FIG. 2.

Claims (8)

A DB filtering module for performing primary malware filtering on executable codes executed in the system; A system resource monitor module for performing system resource monitoring to collect individual event information generated by executable codes executed in the system; A reprocessing module for reprocessing the individual event information collected by the system resource monitor module and reconstructing it into one unified log representing relevant behavior property values of the executable codes; A behavior prediction information processing module for extracting atypical malicious behavior feature values (prediction patterns) by inputting a reconstructed integrated log from the reprocessing module into a learning algorithm; And And an atypical malicious behavior detection module for detecting malicious behavior by comparing the atypical malicious behavior characteristic value (prediction pattern) extracted from the behavior prediction information processing module with the behavior characteristic value data configured in the reprocessing module. Atypical malware detection system using behavior prediction technique. The method of claim 1, The system resource monitor module collects individual event information about file systems, processes, registries, services, and network items. delete The method of claim 1, The reprocessing module is an atypical malware detection system using a process behavior prediction technique, characterized in that the reconstruction of the integrated log comprises a single record of the relevant behavior property value data of the execution codes based on the event occurrence time. A first step of performing primary malware filtering on executable codes executed in the system; A second step of performing system resource monitoring to collect individual event information generated by executable codes executed in the system; A third step of reprocessing the individual event information collected in the second step and reconstructing it into one unified log representing the relevant behavior property value of the execution codes; A fourth step of extracting atypical malicious behavior feature values (prediction patterns) by inputting the integrated log reconstructed from the third step into a learning algorithm; And And a fifth step of detecting malicious behavior by comparing the atypical malicious behavior characteristic value (prediction pattern) extracted in the fourth stage with the behavior characteristic value data configured in the third stage. Atypical malware detection method using. The method of claim 5, In the second step, the atypical malware detection method using the process behavior prediction technique, characterized in that collecting individual event information for the file system, process, registry, service and network items. The method of claim 5, In the third step, the atypical malware detection method using the process behavior prediction method, characterized in that the behavioral characteristic value data of the execution codes are composed of one record based on the event occurrence time when the integrated log is reconstructed. . The method of claim 7, wherein When configuring the record, the value of the record field without an event is described in the recent event validity time range, and if it is out of the recent event validity time range, a null value is recorded. Code detection method.

Images