KR100954356B1 - Detection system for malicious program considering code protection method and method thereof - Google Patents

Abstract

The present invention discloses a malicious program detection system and method thereof considering a code protection technique. That is, the detection control module outputs a control signal for starting a malicious code detection operation on a memory in which the arbitrary program is executed at a preset time point when the arbitrary program is executed; And a list of a specific API (Application Program Interface) group called by the malicious code, and comparing the stored API group list with an API called by any of the executing programs according to the control signal. By including a detection module that detects code, if the original is largely transformed in a simple way by execution compression, encryption, simple encryption, etc., in the same situation, it is possible to perform a check at the point of time when the original is restored in memory, and then use multiple signatures as one signature. Corresponds to the transform file.

Code protection technique, program detection

Description

Malware detection system and method thereof considering code protection technique {DETECTION SYSTEM FOR MALICIOUS PROGRAM CONSIDERING CODE PROTECTION METHOD AND METHOD THEREOF}

The present invention relates to a malicious program detection system and a method thereof, and more particularly, an important API that checks the presence or absence of malicious code on a memory in which the program is executed immediately after the program is executed, and executes the malicious code while executing the program. The present invention relates to a malicious program detection system and method considering a code protection technique for detecting a malicious program through monitoring a group.

Current malware trends are in the author's superiority, while malware authors can generate a large amount of variations in a short time by introducing simple code modifications or encryption, whereas in terms of diagnosis, a large number of samples are obtained and processed or modified. Implementing algorithms to determine whether they are modified requires dozens or hundreds of times.

The current system monitors in this regard apply a method of checking the action object, such as a program to be executed, or a file to be opened, rather than checking the performing agent (the executed program).

At this time, for the file whose target object is executed or compressed or modified, the modified code should be analyzed and responded regardless of the difficulty of the original. In this case, the difficulty of the modified code is high and the response takes a long time. It is difficult to take countermeasures against the variant code where the transformation occurs.

More specifically, the characteristics of current system monitors are to check file A to be opened for execution by the file system hooking function, and to check file A when program A is opened for execution by program B. It has a passive inspection form.

In addition, in the conventional method, if the contents of the file A are modified by a protected execution compression or encryption, the diagnosis is difficult, and the diagnosis must be performed in an inefficient manner such as 1: 1 matching.

As described above, it is inefficient to inspect an object in a situation where a large amount of modified code is realized by a simple deformation, and in particular, as the technical difficulty to perform the code protection technique is exacerbated, the code modification and There is an urgent need for techniques to overcome code protection techniques such as encryption.

 The present invention was created to solve the problems inherent in the prior art as described above, and an object of the present invention is to identify the presence or absence of malicious code on the memory in which the program is executed at a predetermined time point immediately after the program is executed. An object of the present invention is to provide a system for detecting code malware and a method using the time difference inspection method.

Another object of the present invention is to detect a malicious code code applying an action point detection method of diagnosing a program calling an API on a memory at the point of time when the API is called by monitoring an important API group performed by a malicious code during program execution. A system and method are provided.

According to an aspect of the present invention for achieving the above object, there is provided a malicious program detection system in consideration of a code protection technique: the system on a memory in which the arbitrary program is executed at a predetermined time point when any program is executed; A detection control module that outputs a control signal for starting a malicious code detection operation of the device; And a list of a specific API (Application Program Interface) group called by the malicious code, and comparing the stored API group list with an API called by any of the executing programs according to the control signal. And a sensing module for detecting a code.

Preferably, when the malicious code is detected by the detection module, the system further comprises a process blocking module for storing the process in the block list and block the stored process.

Preferably, the sensing control module outputs the control signal immediately after the arbitrary program is executed and at the time when the code protection scheme for the malicious code on the memory is released.

Preferably, the detection module detects malicious code on the memory when the currently running process according to the execution of the arbitrary program allocates a memory of a form or another process that implements a remote thread. It is characterized by.

Preferably, the sensing module is configured to limit the sensing operation based on a predetermined limiting factor including the number of calls and the importance of the API called by any executing program.

Preferably, the detection module is characterized in that to store the inspection caching information for any of the running program to prevent duplicate inspection.

Advantageously, the process blocking module prohibits execution and access to a corresponding process stored in the block list, and sets a priority according to execution to a malware protection system in consideration of a code protection technique.

According to yet another aspect of the present invention, there is provided a malicious program detection method in consideration of a code protection scheme: a) malicious code on a memory in which the arbitrary program is executed at a predetermined point in time when any program is executed; Initiating a sensing operation; b) monitoring an application program interface (API) called by any of the running programs; And c) detecting malicious code in the memory by comparing the API called by the executing program with a pre-stored list of a specific API group called by the malicious code.

Preferably, the method further comprises d) storing the process in a block list and blocking the stored process when malicious code is detected through step 'c)'.

Preferably, the step a) is characterized in that the detection operation is started immediately after the execution of the arbitrary program, when the code protection scheme for the malicious code on the memory is released.

Preferably, the step c), when the currently running process according to the execution of the arbitrary program forms a remote thread or allocates memory of another process, detecting malicious code on the memory Characterized in that.

Preferably, the step c) is characterized in that the sensing operation is limited based on a predetermined limiting factor including the number of calls and the importance for the API called by any executing program.

Preferably, the step c) is characterized in that to prevent the inspection of the duplicate by storing the check caching information for any of the running program.

Preferably, step d) is to prohibit execution and access to the corresponding process stored in the block list, and to set the priority according to the lowest.

The malware detection system and its method considering the code protection technique according to the present invention perform the inspection at the point of time when the original is restored in memory when the original is largely modified in a simple manner by execution compression, encryption, simple encryption, etc. in the same situation. Thus, one signature can correspond to multiple transform files.

In addition, according to the present invention, since the code is restored to the original, it is possible to drastically reduce the time required for execution decompression and decryption with high difficulty.

In addition, the present invention can solve the user inconvenience according to the time required for the test as the test is performed within a short time so that the user does not feel that the compression is released at the time of execution on the memory.

In addition, the present invention can increase the efficiency of the vaccine by checking only the executed program, not a plurality of files.

In addition, since the present invention is restored during inspection, the present invention can further increase its useful value as it can be applied to modification diagnosis routines through algorithms in addition to memory signature diagnosis.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a schematic block diagram of a malicious program detection system considering a code protection scheme according to an embodiment of the present invention.

As shown in FIG. 1, the system includes a detection control module 100 outputting a control signal for starting a malicious code detection operation; A detection module 200 for detecting malicious code on a memory in which an arbitrary program is executed according to the control signal; And a process blocking module 300 for blocking a corresponding process when malicious code is detected by the detection module.

The detection control module 100 outputs a control signal for starting a malicious code detection operation on a memory in which an arbitrary program is executed at a preset time point when an arbitrary program is executed. More specifically, the detection control module 100 is a time point at which the code protection technique for the malicious code on the memory in which any program is executed is released, for example, execution compression, encryption, PE-PATCH malware, polymorphic virus, and encryption virus. The control signal is output when the modified code is restored.

The detection module 200 stores a list of specific API groups called by the malicious code to detect malicious code on a memory in which any program is executed according to a control signal output from the detection control module 100. do. Here, the list for the API group may include, for example, a general virus group accompanied by opening and writing a file to be infected; A worm including a file creation and writing for storing a worm file, an API such as a network socket and a packet transmission, and a writing for registry registration, allocating memory to another process, and creating a remote thread; The list is written considering specific functions performed by malicious code, including registry writes for continuous execution, Trojan horses that perform network sockets, packet transfers, and the like.

Based on this, the sensing module 200 compares an API called by any of the executing programs with the stored API group list according to a control signal output from the sensing control module 100, and based on a match, the malicious code in memory. Check for existence.

In addition, the detection module 200 may limit the detection operation based on a predetermined limiting factor including the number of calls and the importance of the API called by any executing program to determine the inspection limit or the overall permission. .

In addition, the sensing module 200 is preferably configured to prevent the redundant check of the storage of the check caching information for any program running.

On the other hand, the detection module 200 is a malicious code through the above-described configuration on the memory, when the currently running process according to the execution of any program, the form of implementing a remote thread or allocates the memory of another process To be detected.

When the malicious code is detected by the detection module 200, the process blocking module 300 stores the corresponding process in a blocking list and blocks the stored corresponding process. That is, when the malicious code is detected by the detection module 200, the process blocking module 300 prohibits execution and access to the corresponding process stored in the blocking list, and executes by setting the priority according to the lowest. Stops.

Hereinafter, a malicious program detection method considering a code protection technique according to an embodiment of the present invention will be described with reference to FIG. 2. 2 is a schematic flowchart illustrating a malicious program detection method considering a code protection technique according to an embodiment of the present invention.

First, a malicious code detection operation is started on a memory in which the arbitrary program is executed at a preset time point when the arbitrary program is executed (S110-S120). Preferably, the detection control module 100 outputs a control signal for starting a malicious code detection operation on a memory in which any program is executed at a preset time point when any program is executed. More specifically, the detection control module 100 is a time point at which the code protection technique for the malicious code on the memory in which any program is executed is released, for example, execution compression, encryption, PE-PATCH malware, polymorphic virus, and encryption virus. And a time point at which the modified code is restored, and accordingly outputs the control signal for starting the detection operation.

Thereafter, the API called by any program being executed is monitored (S130). Preferably, the sensing module 200 monitors an API called by any program executing in accordance with a control signal output from the control module 100.

Then, malicious code on the memory in which any program is executed is detected (S140-S150). Preferably, the detection module 200 compares the API called by any program running with a pre-stored list of specific API groups called by the malicious code, and checks for the presence of malicious code in memory depending on the match. Check it. In this case, the sensing module 200 may determine the inspection limit or the overall permission by limiting the sensing operation based on a preset limiting factor including the number of calls and the importance of the API called by any program executing. . In addition, the sensing module 200 is preferably configured to prevent the redundant check of the storage of the check caching information for any program running. On the other hand, the detection module 200 is a malicious code through the above-described configuration on the memory, when the currently running process according to the execution of any program, the form of implementing a remote thread or allocates the memory of another process To be detected.

After that, if a malicious code is detected, the process is blocked (S160-S170). Preferably, when the malicious code is detected by the detection module 200, the process blocking module 300 stores the process in a block list and blocks the stored process. That is, when the malicious code is detected by the detection module 200, the process blocking module 300 prohibits execution and access to the corresponding process stored in the blocking list, and executes by setting the priority according to the lowest. Stops.

Although the present invention has been described in detail with reference to the preferred embodiments, the present invention is not limited to the above-described embodiments, and the present invention belongs to the present invention without departing from the gist of the present invention as claimed in the following claims. Anyone skilled in the art will have the technical idea of the present invention to the extent that various modifications or changes are possible.

Malware detection system and method considering the code protection technique according to the present invention is easy to analyze and respond to the original code irrespective of the difficulty of the modified code to overcome the limitations of the existing technology that can only be vulnerable by the code protection technique According to the present invention, there is not only the use of the related technology but also the possibility of marketing or sales of the applied device as well as the degree to which it can be clearly realized in reality.

The following drawings, which are attached in this specification, illustrate preferred embodiments of the present invention, and together with the detailed description of the present invention, serve to further understand the technical spirit of the present invention. It should not be construed as limited to.

1 is a schematic configuration diagram of a malicious program detection system considering a code protection technique according to an embodiment of the present invention.

2 is a schematic flowchart illustrating a malicious program detection method considering a code protection technique according to an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

100: detection control module

200: detection module

300: process blocking module

Claims (14)

In the malware detection system considering the code protection technique, A detection control module configured to output a control signal for starting a malicious code detection operation on a memory in which the arbitrary program is executed at a preset time point at which the arbitrary program is executed; And Stores a list of a specific API (Application Program Interface) group called by the malicious code, and compares the API called by any of the executing programs with the stored API group list according to the control signal Includes a detection module for detecting The detection control module, Immediately after the execution of the arbitrary program, the malware protection system considering the code protection scheme, characterized in that for outputting the control signal when the code protection scheme for the malicious code on the memory is released. The system of claim 1, wherein the system is When the malicious code is detected by the detection module, the malware detection system in consideration of the code protection technique, characterized in that it further comprises a process blocking module for storing the process in the block list and block the stored process. delete The method of claim 1, wherein the detection module, Considering a code protection scheme, a malicious code is detected on a corresponding memory when the currently executing process according to the execution of the arbitrary program allocates a form of a remote thread or a memory of another process. Malware Detection System. The method of claim 1, wherein the detection module, Malware detection system in consideration of a code protection technique, characterized in that for limiting the detection operation based on a predetermined limiting factor including the number of calls and the importance of the API called by any running program. The method of claim 1, wherein the detection module, The malware detection system in consideration of a code protection technique, characterized in that for preventing the duplication check by storing the check caching information for the running any program. The method of claim 2, wherein the process blocking module, Prohibit execution and access to the process stored in the block list, and the malware detection system considering the code protection technique, characterized in that the priority setting according to the lowest. In the malware detection method considering the code protection technique, a) initiating a malicious code detection operation on a memory in which the arbitrary program is executed at a preset time point at which the arbitrary program is executed; b) monitoring an application program interface (API) called by any of the running programs; And c) detecting malicious code in the memory by comparing the API called by the running program with a pre-stored list of specific API groups called by the malicious code, Step a) is The detection method of the malicious program in consideration of the code protection method, characterized in that the detection operation is started immediately after the execution of the arbitrary program, the code protection method for the malicious code on the memory is released. The method of claim 8, wherein d) if the malicious code is detected through step 'c)', storing the process in a block list and blocking the stored process. delete The method of claim 8, wherein c) Considering a code protection scheme, a malicious code is detected on a corresponding memory when the currently executing process according to the execution of the arbitrary program allocates a form of a remote thread or a memory of another process. How to detect malware. The method of claim 8, wherein c) And a method for limiting the detection operation based on a predetermined limiting factor including a number of calls and an importance of an API called by any executing program. The method of claim 8, wherein c) The malware detection method in consideration of a code protection technique, characterized in that for preventing duplicated checks by storing the check caching information for the running any program. The method of claim 9, wherein the d) step, Prohibiting execution and access to the corresponding process stored in the block list, malicious program detection method considering the code protection technique, characterized in that the priority setting according to the lowest.

Images