KR100959277B1 - A system for preventing mbr(master boot record) attack of malicious codes using a control list at the kernel level and the computer-readable recording medium having recording the program thereof - Google Patents

Abstract

PURPOSE: A system for preventing MOR(Master Boot Record) attack using a control list in a kernel level and a computer readable recording medium recording the same are provided to virtually record MBR change information even if a suspicious process does not change MBR, thereby accurately analyze whether all suspicious process including hidden process is malicious or not in advance. CONSTITUTION: A system call hooking controller(310) hooks a system call which requests the change of MBR(Master Boot Record) in a OS(Operating System). A control list manager(320) stores a control list including a allowance and denial list. A virtually changing unit(350) record a MBR modification information to a virtually changing storage according to MBR modification information of the system call. A malicious process determiner(340) determines a allowance and denial of the hooking system call based on the control list.

Description

A system for preventing MBR (Master Boot Record) attack of malicious codes using a control list at the kernel level and the computer- readable recording medium having recording the program clearly}

The present invention records the MBR attack blocking system and the program that virtually process the change request and record the change information in the virtual change repository even when the suspect process requests the MBR (master boot record) change request. The present invention relates to a computer-readable recording medium.

In addition, the present invention backs up the MBR information when the MBR change system call of the process is allowed, and checks the malicious code of the changed MBR and restores to the backed up MBR if it exists. The present invention relates to a readable recording medium.

In general, as shown in the Distributed Denial of Service Attack (DDoS), malicious processes use personal computer (PC) resources to attack and then damage the hard disk or destroy the MBR (Master Boot Sector) to delete the evidence of attack. This prevents it from booting.

The Master Boot Record (hereinafter referred to as the MBR) is information that identifies where and how the operating system is located so that it can be loaded into the main memory of the computer and stored on the first sector of the hard disk or diskette. It is. The MBR is also called the "partition sector" or "master partition table" because it contains information about the location of each partition that is divided when the hard disk is formatted. In addition, the MBR contains a program that can read the boot sector record of the partition where the operating system to be loaded into memory is stored, which in turn contains the program that loads the rest of the operating system into memory. So when the computer enters the boot process, it starts by booting from the data stored in the Master Boot Record (MBR). Therefore, if the MBR is destroyed, the system will not be able to boot.

Malicious processes that attack MBR can be divided into known MBR attack malware and unknown new or modified MBR attack malware, and known MBR attack malware can be detected and removed by security programs such as vaccines.

As described above, an example of a technique for inspecting and treating a malicious code infection for MBR is described in Korean Patent Laid-Open Publication No. 2006-0109520 (October 23, 2006), "Determining and treating a virus infection of a master boot record at a changed location. Device and method "] (hereafter Prior Art 1). The prior art 1 includes a first storage unit in which a master boot record is stored and a virus checker for searching a storage location of the master boot record in the first storage unit, and determining and treating a virus infection of the master boot record. The technology is presented.

However, in the case of unknown new or variant MBR attack malware, if the MBR attack malware infects someone's computer and damages it, the user finds an abnormal symptom on his computer and finds the program that caused the problem. Report to the business. Vaccine company analyzes the file received and produces and distributes the diagnosis and blocking vaccine for the malicious code, and blocks and cures the MBR attack malware so that it does not flow into the computer system of other computer users.

Therefore, it takes some time from the time of infection of the new or modified MBR attack malware to the time of treatment with the anti-virus program, and during that time, the malware not only destroys resources in the terminal but also downloads the file containing the malware to other terminals. There is a problem in spreading malicious code to other terminals such as transmitting a large amount.

To overcome this, vaccine companies have been proposed to secure new and altered malware early rather than relying on user notifications. That is, techniques for inspecting a process when specific events occurring in the system kernel, for example, writing of a specific file, execution or installation of a specific program, etc. occur.

An example of such a technique is disclosed in Korean Patent Laid-Open Publication No. 2007-0121195 (published on December 27, 2007), "a hidden process detection system and method using system event information" (hereinafter, referred to as Prior Art 2). The prior art 2 extracts a process list using system event information provided when accessing real-time system resources in the kernel layer, and compares the process provided only to the kernel layer as a hidden process through comparison with the process list provided to the user in the application layer. The technology is proposed to detect and eliminate the hidden processes present in the system in real time.

Another example is Korean Patent Laid-Open Publication No. 2007-0107840 (published on November 08, 2007), "Real-time harmful program blocking method and explorer initialization method, and a recording medium recording a program for sequentially executing such a method."] Technology 3). In the prior art 3, when an event such as file input / output, a specific process execution, etc. occurs inside a computer system, the event is based on a harmful program that adversely affects the computer system. The present invention relates to a method of blocking the execution of the malicious program and further detecting and detecting the parent program that provided the harmful program and removing the parent program as well.

However, the prior arts 2 and 3 have a problem that the load on the system can be increased because the process is checked at the kernel layer where a system event occurs. In other words, if you increase the inspection precision of the process, you can find the unidentified malicious process. However, the weighting of the process increases the load on the system.

On the other hand, when the system is not booted due to the infection of new or modified MBR attack malware, when the PC (personal computer) is turned on using a curable vaccine, the date is changed to one day before booting the PC in safe mode, After rebooting, it is recommended to check the latest vaccine before using it. MBR attack In case of being severely attacked by malware, a reboot may not occur.

In order to solve the above problems, an example of a technique for backing up and restoring a computer system is disclosed in Korean Patent No. 10-0545689 (published on January 12, 2006), "Backup and Restoration Method of a Computer System, and a Recording Media Recording the Program. "] (Hereafter Prior Art 4). The prior art 4 has a program for backing up and restoring a computer system embedded in a booting medium of a hard disk, and selectively booting the computer system by modifying and changing the booting order of the booting medium. When backing up the computer system by executing a backup and restore program, back up the master boot record (MBR) and the partition table of each drive necessary for booting, and restore only the MBR and partition table if the MBR and partition table are destroyed. Discloses a technique.

However, even when the computer system is backed up, restored, and rebooted, even though the computer terminal is recovered, there is no data to analyze the MBR attack malware, which makes it difficult to analyze the malware.

In addition, when a malicious process spreads and attempts to change and destroy the MBR at each computer terminal, the MBR of the computer system is not destroyed unless the user permits the change. In this case, however, there is still the potential for damage caused by malicious processes.

If the malicious process is found to be inherently untreated and deleted, it will attempt to destroy it again by changing the MBR. In this case, the user may allow the MBR change, and in particular, the computer terminal may be allowed by other users when the computer terminal is used by several people.

More importantly, if the user does not allow the destruction of the MBR, the potential malicious process will not be discovered for a long time, which may cause further problems later on.

An object of the present invention is to solve the problems described above, if the suspect process requests the MBR (Master Boot Record) change, even if the user refuses to install the change request to virtually process the change information To provide a computer-readable recording medium that records the MBR attack blocking system that records the change storage and the program.

In addition, the object of the present invention is to back up the MBR information if the MBR change system call of the process is allowed, and to check the malicious code of the changed MBR, and if present, the malicious process installation blocking system and the computer recording the program to restore to the backed MBR To provide a recording medium that can be read by.

In order to achieve the above object, the present invention relates to an MBR (Master Boot Record) attack blocking system installed in a computer terminal, and a system call hooking a system call requesting an MBR (Master Boot Record) change to an operating system of the computer terminal. Hooking control unit; A control list manager which stores in advance a control list including an allow list for registering allowed processes and a reject list for registering rejected processes; A virtual change processor for virtually recording MBR change information in a virtual change repository according to an MBR change request of a system call; And a malicious process of determining whether to allow or reject the system call according to the request process of the hooked system call belonging to the allow or deny list of the control list, and registering the suspect list of the control list if the allow or deny cannot be determined. And a determination unit, wherein the malicious process determination unit requests the user to allow the system call if the user cannot determine whether to allow or deny, and causes the virtual change processing unit to virtually process the MBR change request if it is denied by the user. It features.

In addition, the present invention MBR attack blocking system, the control list management unit receives the update list from the prevention server connected to the computer terminal to store or update the control list, and the suspicious list and MBR change information to the defense server Characterized in that the transmission.

In addition, according to the present invention, in the MBR attack blocking system, if the system call is allowed, the system backs up the information stored in the MBR (hereinafter referred to as MBR), and checks the changed MBR with the content signature list of the control list. If it is determined that the malicious code is included in the changed MBR, characterized in that it further comprises an MBR recovery unit for recovering the backup MBR before the change.

In addition, in the MBR attack blocking system, when the malicious process determination unit registers the request process of the system call to the suspicious list, it requests the user to allow the system call and allows the request process according to the user's permission. Or to register in the reject list.

In addition, in the MBR attack blocking system, the control list management unit transmits the process information registered in the suspicious list to the anti-virus server, the process information to the MBR change information or the virtual change storage changed by the system call Characterized in that the MBR change information is transmitted to the quarantine server.

In addition, in the MBR attack blocking system, the system stops or deletes the request process of the system call when the system call is rejected, and stops or deletes the process included in the reject list when an update list is received. It characterized in that it further comprises a malicious process blocking unit.

In addition, the present invention relates to a computer-readable recording medium installed on a computer terminal and recording a program for executing an MBR attack blocking method by creating a virtual change storage on the computer terminal, and (a) an allow list for registering an allowed process. And storing in advance a control list including a reject list for registering the rejected process; (b) hooking a system call requesting an MBR (master boot record) change to an operating system of the computer terminal; (c) allowing or rejecting the system call by determining whether to allow or reject the system call as the request process of the hooked system call belongs to the allow or deny list of the control list; (d) registering the request process on a suspicious list of control lists if it is not possible to determine an allow or deny; (e) requesting the user to allow the system call if it cannot determine whether to allow or deny, processing the MBR change request virtually if rejected by the user, and recording the MBR change information in the virtual change repository. It is characterized by.

In addition, the present invention is a computer-readable recording medium recording a program for performing the MBR attack blocking method, the method, (g1) if the system call is allowed to back up the information stored in the MBR (hereinafter MBR before change) Making; (g2) delivering the system call to an operating system; (g3) checking the modified MBR with the content signature list of the control list; And (g4) if it is determined that the malicious code is included in the changed MBR, the method further includes recovering the backed up MBR.

In addition, the present invention provides a computer-readable recording medium recording a program for performing the MBR attack blocking method, wherein step (d) comprises: (d1) registering the request process in a suspicious list; (d2) requesting the user to decide whether to accept or reject the system call; And (d3) registering the request process on the allow or deny list according to the user's permission.

In addition, the present invention is a computer-readable recording medium recording a program for performing the MBR attack blocking method, the method comprises the steps of (f) transmitting the process information registered in the suspicious list to the quarantine server connected to the computer terminal The method may further include the step, wherein in the step (f), the process information is transmitted to the anti-breathing server together with the MBR change information changed by the system call or the MBR change information recorded in the virtual change repository.

As described above, according to the MBR attack blocking system and a computer-readable recording medium recording the program according to the present invention, even if the suspected process does not actually change the MBR, by virtually recording the MBR change information, The effect of performing more precisely early and more malicious analysis of all suspicious processes is obtained.

In addition, according to the MBR attack blocking system and a computer-readable recording medium recording the program according to the present invention, even if the MBR is changed, it is backed up and recovered when it is determined that the malicious code is included, thereby accidentally attacking the MBR Even if it is allowed, the effect of defending against catastrophic system destruction is obtained.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the drawings.

In addition, in describing this invention, the same code | symbol is attached | subjected and the repeated description is abbreviate | omitted.

First, the entire system for implementing the present invention will be described with reference to FIG.

As shown in Figure 1, the entire system for implementing the present invention is composed of a plurality of computer terminals 10, defense server 30, network 20. Prevention information DB 40 for storing the prevention information may be further included. Meanwhile, the MBR attack blocking system 300 is installed and executed in the computer terminal 10.

The computer terminal 10 is a conventional computing terminal used by a user. The computer terminal 10 includes a personal computer (PC), a notebook computer, a netbook, a PDA, and the like. The computer terminal 10 may be provided with an operating system (OS) for operating a computer system, and application programs may be installed on the operating system (OS).

The computer terminal 10 is connected to a network 20 such as the Internet, and the computer terminal 10 is provided with a network adapter (or network interface card, NIC) for connecting to the network 20. The operating system (OS) of the computer terminal provides a system call service that performs file writing, registry writing, program execution (opening), driver execution, network data transmission, MBR change, and the like.

The MBR attack blocking system 300 is installed in the computer terminal 10 and is executed on an operating system (OS). The MBR attack blocking system 300 hooks a system call requested by the processes, and allows or rejects the system call by determining whether the hooked system call is allowed or not. At this time, the system call service hooked by the MBR attack blocking system 300 is an MBR change request.

Allowing the system call is to pass the system call to the OS as it is, and rejection of the system call means to drop the system call without passing it to the OS. In addition, the MBR attack blocking system 300 collects information on the request process (hereinafter suspicious process) of the system call that can not determine whether to allow or not.

In addition, the information collected about the suspicious process is information about the program code, the system call request contents of the process, the status of the execution process, MBR change information, and the like. These pieces of information are used to determine whether the suspicious process is a malicious process.

The MBR attack blocking system 300 accesses the anti-virus server 30 through the network 20 to transmit a list of suspicious processes and information on the collected suspicious processes to the anti-virus server 30, and updates the malicious or normal processes. The received judgment criteria are received from the prevention server 30.

Criteria for malicious or normal processes are stored in a control list. Specifically, the control list includes an allow list, a deny list, and a suspicion list, and registers an allowed process in the allow list and a process denied in the deny list. The suspicious list registers suspicious processes. In addition, the control list further includes a content signature list. The content signature list includes a content signature that determines whether malicious code is included in the contents of the MBR. That is, if a specific pattern (signature) is included in the contents of the MBR, it is determined that malicious code is included.

On the other hand, when the MBR attack blocking system 300 transmits the collected suspicious process information to the anti-breathing server 30, the anti-breathing server 30 receives these information to accurately check whether the malicious code for the suspicious process. At this time, the information about the suspicious process is very useful survey data for overhaul. The suspicious process is determined to be normal or malicious according to the investigation result of the prevention server 30, and classified into a permit or deny process.

The anti-virus server 30 collects suspicious process information from a plurality of computer terminals 10 to determine whether the process is malicious. If the process is determined to be malicious, the anti-virus server 30 distributes this fact to all computer terminals 10 and transmits it.

The MBR attack blocking system 300 receives the process information classified as described above as an update list (or a control list) from the prevention server 30, and stores or updates the control list based on the latest judgment. The MBR attack blocking system 300 blocks or allows the system call by monitoring the process of requesting the system call with reference to the updated control list.

Therefore, even if a malicious process is first installed in one computer terminal 10, the information about the malicious process is transmitted to the anti-virus server 30, the anti-virus server 30 is all other computers that the process is a malicious process Transmission to the terminal 10. This prevents the spread of malware.

The term "process" has the meaning of "program to be executed", but the term "program" is used to include the broader meaning. That is, in the following, the term of process will be used as the meaning of "program".

Next, the configuration of the MBR attack blocking system according to an embodiment of the present invention will be described with reference to Figs. The MBR attack blocking system 300 is installed in the computer terminal 10, and the operating system of the computer terminal 10 provides a service for executing a process request such as changing an MBR.

2 and 3, the MBR attack blocking system 300 includes a system call hooking control unit 310, control list management unit 320, malicious process determination unit 340, virtual change processing unit 350 do. Additionally, the malicious process blocking unit 330 or the MBR recovery unit 360 may be further included. It may also include a data store 400 for storing data.

The system call hooking control unit 310 hooks the system call 210 requesting the MBR change to the operating system of the computer terminal 10. The system call hooking control unit 310 determines whether malicious by hooking all the system call 210 for writing or execution, but the present invention relates to the MBR change system call in the double, MBR in the following for convenience of description The following description will be limited to the change system call 210.

The system call hooking control unit 310 uses a system call hooking technique. That is, the system call hooking control unit 310 directly modifies the vector content of the system call table (sys_call_table) having a list of the entire system call routines, and thus is a function routine implemented in the system call hooking control unit 310. After executing, execute the system call routine. That is, the original system call routine is replaced with a function in the system call hooking control unit 310, and the function in the system call hooking control unit 310 performs an operation required for hooking control and then performs the original system call routine. do.

As shown in FIG. 3, in the computer terminal 10, programs are divided into a user layer and a kernel layer. Application applications (or processes) are executed in the user layer, and system programs in the operating system (OS) are executed in the kernel layer. The operating system (OS) provides a system call service (hereinafter referred to as MBR change system call) for MBR change.

On the other hand, the system call hooking control unit 310 waits for the hooked system call 210 once. The waiting hooking system call is delivered to the operating system (OS) or dropped according to the result of the acceptance of the system call. That is, if allowed, the hooked system call is delivered to the operating system (OS), and if rejected, the hooked system call is dropped without being delivered to the operating system (OS).

Next, the control list management unit 320 stores the control list that sets the criteria for determining whether to allow or reject the system call, and receives the update list from the prevention server 30 to update the control list.

As shown in FIG. 4, the control list 410 includes an allow list 411, a deny list 412, and a suspicious list 413. It is a process that is registered in the list. That is, if the process of the system call is registered in the allow list 411, the system call is allowed, and if it is registered in the reject list 412, the system call is rejected. The suspicion list 413 registers processes that do not correspond to either allow or deny. That is, a process registered in the suspicion list 412 is a process that is not confirmed.

Meanwhile, the control list 410 further includes a content signature list 414. As described above, the content signature list includes a content signature that determines whether malicious code is included in the content of the MBR.

The virtual change processor 35 virtually processes the MBR change request of the system call, and records the change information in the virtual change repository 420. That is, the virtual change processing unit 35 performs the same as if the operating system performs the operation for changing the MBR, as if the operating system itself, and responds to the request process. However, the virtual change processing unit 35 records the changed MBR in the virtual change storage 420 instead of the actual system MBR location.

The virtual change storage 420 is a separately allocated storage space, which does not affect the system of the computer terminal 10 at all, but the MBR information recorded in the virtual change storage 420 is recorded in the same manner as the MBR form of the actual system. . In addition, the virtual change storage 420 stores the suspicious process and the information of the MBR to be changed by the suspicious process. This allows the computer terminal system to obtain the same MBR information as it did without changing the actual MBR.

The malicious process determination unit 340 determines whether the system call is allowed or denied according to the allow or deny list of the control list 410, and registers it on the suspicious list when the allow or deny cannot be determined.

Specifically, the malicious process determination unit 340 determines that the system call is allowed or denied if the request process of the system call is registered in the allow list or the deny list, and the request process allows the allow list 411 and the deny list 412. If it is not registered, it is classified as a suspicious process and registered by collecting it on a suspicious list.

That is, the malicious process determination unit 340 determines whether to allow or deny only by determining whether it is registered in the control list 410. Anything not allowed or denied is treated as suspect. Malicious process determination unit 340 is very simple, so the system load is significantly reduced.

On the other hand, if the request process is not registered in the allow list 411 and the deny list 412, the malicious process determination unit 340 requests the user to allow or disallow the request process and allows the user according to whether the request is allowed. Or rejected. In addition, the malicious process determination unit 340 registers the request process in the allow list 411 or the deny list 412 according to the user's permission.

That is, if it is not clear whether the system call is allowed or not, the user is requested to allow or deny the call, and the result selected by the user is reflected in the control list and registered in the allow or deny list. Therefore, when the same system call related to the request process is requested next, the malicious process determination unit 340 will allow or reject the system call by the control list. As it is clear by the user, the second is not considered suspicious.

On the other hand, if the system call is allowed by the user, the MBR change related thereto is actually performed on the system of the computer terminal 10. Therefore, the changed MBR information can be obtained from the MBR information of the computer system.

However, when rejected by the user, the malicious process determination unit 340 virtually processes the MBR change request. If it is dropped immediately by the user's rejection, since the suspicious process cannot know what it is trying to do, the MBR is virtually changed and the MBR change information is recorded in the virtual change repository 420.

That is, when the system call is rejected by the user, the MBR change of the system call is not actually changed on the system of the computer terminal 10, but instead is changed to the virtual change storage unit 420 by the virtual change processing unit 350. This is recorded. Therefore, even in this case, the change information can be obtained from the information recorded in the virtual change storage 420.

As a result, as shown below, even if the user permits or rejects, the request process is registered and collected in a suspicious list, and all of the MBR change information is also collected and transmitted to the prevention server 30 for detailed inspection. Since the inspection result is redistributed to all computer terminals 10 connected to the anti-virus server 30, it is possible to prevent the MBR is changed in the other computer terminals (10). That is, even if the MBR change request of the request process is rejected by the user and is not actually changed, the virtually recorded MBR change information may be immediately collected and inspected. Therefore, by detecting the MBR change attempt at the beginning of the malicious process and collecting the MBR change information, precise and fast detection can be performed.

The MBR recovery unit 360 backs up the MBR information if the system call is allowed, checks the changed MBR with the content signature list of the control list, and if it is determined that the changed MBR contains malicious code, the MBR information is returned to the backed MBR. Restore

That is, even when the system call is hooked, even if the system call is allowed by the control list or is allowed by the user, the MBR change request may be caused by a malicious process. In particular, when allowed by the user, it is often allowed to know whether the user is a malicious process.

To this end, first, the MBR recovery unit 360 backs up the state of the current MBR before sending a system call to the operating system. The MBR recovery unit 360 performs a system call to the operating system, and when the MBR is changed, the MBR recovery unit 360 performs a malicious code check on the changed MBR. At this time, the MBR is examined using the content signature list of the control list.

If it is determined that the changed MBR includes malicious code through the MBR check, the MBR recovery unit 360 recovers the copied MBR by copying the back to the MBR.

Meanwhile, the malicious process blocking unit 330 stops or deletes the request process of the system call when the system call is rejected. Rejection applies both to the case where the control list is already registered and the user registers as rejection.

In other words, to block malicious processes (malware), stop and delete processes if they are running, and delete them if you want to run them. Preferably, the user may be notified of this prior to the final suspension or deletion or may request permission for the suspension or deletion.

The malicious process blocking unit 330 may stop or delete a file, registry, and other processes related to the process in addition to the corresponding process.

Meanwhile, the update list received by the control list management unit 320 includes a criterion analyzed by the anti-virus server 30 about a suspicious process (process belonging to the suspicious list), but the suspicious process is classified into an allow list or a deny list. It is registered.

The control list manager 320 collects suspicious process information and transmits it to the anti-virus server 30, wherein the process information includes the MBR change information changed by the system call or the MBR change information recorded in the virtual change repository 420. Together with the prevention server 30 is transmitted.

The control list management unit 320 may schedule the transmission to the quarantine server 30, or may be transmitted whenever an event such as a suspicious process is newly registered.

The anti-virus server 30 collects suspicious process information collected from each computer terminal 10 and its MBR change information. The anti-virus server 30 examines all of the collected suspicious processes to determine whether it is a malicious process (malicious program), and if it is normal, classifies it as an allow list and registers it as a denied list to generate a final update list. At this time, the prevention server 30 analyzes whether or not malicious using the MBR change information.

The anti-virus server 30 distributes the generated update list to all connected computer terminals 10, and each computer terminal 10 receives the update list from the anti-virus server 30 and updates the control list.

When updating the control list 410, the control list manager 320 does not update the user registration process unless a registered process (hereinafter, referred to as a user registration process) is registered in the update list according to the user's permission.

The prevention server 30 collects and distributes the update list at regular time intervals. Therefore, the user may allow the suspicious process D, but may receive an update list before the suspicious process D is examined. In this case, the control list 410 received from the prevention server by the control list management unit 320 does not include information on the suspicious process D. At this time, the process D is preferably kept as user registration in the allow list, and it is also desirable to keep registered in the suspect list.

In addition, the malicious process blocking unit 330 stops or deletes a process included in the reject list when an update list is received.

In another embodiment, the control list manager 320 receives the entire control list from the anti-virus server 30 instead of the update list. The update list includes only the information to be updated from the control list possessed by the computer terminal 10, while the entire control list includes the entire information to be updated.

At this time, the control list management unit 320 can simply update the control list by replacing the control list received from the anti-virus server 30 with the existing control list. However, if any of the processes registered in the suspicion list are not updated, the contents of the allow or deny list by the user registration are also updated to ask the user to allow or deny again.

Next, the MBR attack blocking method according to an embodiment of the present invention will be described with reference to FIG.

As shown in Figure 5a, the MBR attack blocking method (a) receives the update list from the anti-virus server 50 to save as a control list or update the stored control list, the control list to allow or deny the process list To classify (S10); (b) hooking a system call requesting an MBR (master boot record) change to an operating system of the computer terminal (S20); (c) determining whether to allow or deny the system call according to the request process of the hooked system call belonging to the allow or deny list of the control list and allowing or denying (S30); (d) registering the request process in a suspicious list when it is not possible to determine whether to allow or deny (S40); (e) virtually processing the MBR change request and recording the change information in the virtual change repository if it cannot be determined or rejected by the user (S50); And (f) transmitting the suspicious list and the change information to the defense server 50 (S60).

In addition, if the system call is permitted in the step (c), the method includes (g) allowing the system call to transfer the system call to the operating system (S70), and (h) if the system call is not permitted, the system call. Blocking may further comprise a step (S80) to drop the system call (Drop).

In particular, as shown in Figure 5c, step (g), (g1) if the system call is allowed to back up the MBR information (S71); (g2) transmitting the system call to an operating system (S72); (g3) checking the modified MBR with the content signature list of the control list (S73); And (g4) if it is determined that the malicious code is included in the changed MBR, the method recovers to the backed up MBR (S74).

In addition, as shown in Figure 5b, the step (d) comprises the steps of (d1) registering the request process to the suspicious list (S41); (d2) requesting the user to decide whether to allow or reject the system call (S42); And (d3) registering the request process in the allow or deny list according to the user's permission (S44).

In addition, in step (f), process information registered in the suspicious list is transmitted to the anti-virus server 50, wherein the process information is recorded in the MBR change information or the virtual change storage 420 changed by the system call. The MBR change information is transmitted to the anti-virus server 50.

Next, a method of generating an update list by classifying the processes registered in the suspicious list by the anti-virus server 30 according to an embodiment of the present invention will be described with reference to FIG. 6.

As shown in FIG. 6, if a suspicious list and information are received from the computer terminal 10, a malicious code is analyzed (S91). At this time, the installation information of the process is also received and analyzed using it. It is determined whether or not malicious code (S92), if the normal code is added to the allow list (S95), and deleted from the suspect list, if the malicious code is added to the reject list (S93) and deleted from the suspect list. When the control list is updated (or an update list is generated), the control list is transmitted to all computer terminals 10 and a request for advance prevention is made (S96).

Next, a method of updating a control list by receiving an update list from an anti-virus server according to an embodiment of the present invention will be described with reference to FIG. 7.

As shown in FIG. 7, when the updated control list (or update list) is received from the anti-virus server 30, it is compared with the existing control list (S101). If there is an MBR recovery request (S108), the MBR attack blocking system 300 (or a computer terminal) recovers the MBR (S109).

If there is no change in the reject list (S102), and if there is no change, the control list is updated (S106). If there is a change in the reject list, the processes in the reject list (S103), the file and registry delete (S104) and the network driver delete (S105) are performed and the control list is updated (S106).

For a omitted part of the description of the MBR attack blocking, refer to the description of the MBR attack blocking system described above.

As mentioned above, although the invention made by this inventor was demonstrated concretely according to the said Example, this invention is not limited to the said Example and can be variously changed in the range which does not deviate from the summary.

The present invention is applied to the development of a system for determining whether to block the process by collecting the change information and sending the analysis information to the anti-breathing server and receiving the analysis results by the anti-virus server when the suspicious process is requested to change the master boot record (MBR) This is possible.

Particularly, in the present invention, if it is not clear whether the MBR change system call is allowed in the process, the system requests the user to allow the system call and records the change information while virtually handling the MBR change request of the system call even if the user rejects the call. It is applicable to system development.

1 is a diagram showing the configuration of an entire system for implementing the present invention.

2 is a block diagram of the configuration of the MBR attack blocking system according to an embodiment of the present invention.

3 is a diagram illustrating a system configuration for determining a malicious code and performing a virtual change by hooking an operating system of a computer terminal according to an embodiment of the present invention.

4 is a diagram illustrating a structure of a control list according to an embodiment of the present invention.

5 is a flowchart illustrating an MBR attack blocking method according to an embodiment of the present invention.

6 is a flowchart illustrating a method of generating an update list by classifying processes registered in a suspicious list by an anti-virus server according to an embodiment of the present invention.

7 is a flowchart illustrating a method in which a computer terminal receives an update list from an anti-virus server and updates a control list according to an embodiment of the present invention.

Explanation of symbols on the main parts of the drawings

10: computer terminal 20: network

30: Defense server 40: Defense information DB

110: normal process 120: malicious process

210: System call 300: MBR attack blocking system

310: system call hooking control unit 320: control list management unit

330: malicious process blocking unit 340: malicious code determination unit

350: virtual change processing unit 360: MBR recovery unit

400: datastore 410: control list

411: whitelist 412: whitelist

413: Doubt List 414: Content Signature List

420: virtual change repository

Claims (10)

MBR (Master Boot Record) attack system installed on a computer terminal, A system call hooking control unit hooking a system call requesting an MBR (master boot record) change to an operating system of the computer terminal; A control list manager which stores in advance a control list including an allow list for registering allowed processes and a reject list for registering rejected processes; A virtual change processor for virtually recording MBR change information in a virtual change repository according to an MBR change request of a system call; And Determining whether to allow or reject the system call according to the request process of the hooked system call belongs to the allow or deny list of the control list, and determine the malicious process to register on the suspicious list of the control list if the allow or deny cannot be determined. Including wealth, The malicious process determination unit, If it is not possible to determine whether to allow or reject the system call to the user, and if rejected by the user, the virtual change processing unit MBR attack blocking system characterized in that to process the MBR change request virtually. The method of claim 1, The control list management unit receives the update list from the prevention server connected to the computer terminal to store or update the control list, and transmits the suspicious list and MBR change information to the prevention server. The system of claim 1, wherein the system is If the system call is allowed, the information stored in the MBR (hereinafter referred to as MBR) is backed up, the changed MBR is checked with the content signature list of the control list, and if it is determined that the changed MBR includes malicious code, MBR attack blocking system further comprises an MBR recovery unit for recovering to MBR. The method of claim 1, The malicious process determination unit registers a system call request process in a suspicious list, requests the user to allow the system call and registers the request process in the allow or deny list according to the user's permission. Blocking system. The method of claim 2, The control list management unit transmits the process information registered in the suspicious list to the prevention server, wherein the process information is transmitted to the prevention server along with the MBR change information changed by the system call or the MBR change information recorded in the virtual change repository. MBR attack blocking system, characterized in that. The system of claim 2, wherein the system is MBR attack blocking system further comprises a malicious process blocking unit for stopping or deleting the request process of the system call, and stopping or deleting the process included in the reject list when the system call is rejected. . In the computer-readable recording medium installed in the computer terminal and recording a program for performing the MBR attack blocking method by creating a virtual change storage on the computer terminal, (a) storing in advance a control list including an allow list for registering allowed processes and a deny list for registering rejected processes; (b) hooking a system call requesting an MBR (master boot record) change to an operating system of the computer terminal; (c) allowing or rejecting the system call by determining whether to allow or reject the system call as the request process of the hooked system call belongs to the allow or deny list of the control list; (d) registering the request process on a suspicious list of control lists if it is not possible to determine an allow or deny; (e) requesting the user to allow the system call if it cannot determine whether to allow or deny, processing the MBR change request virtually if rejected by the user, and recording the MBR change information in the virtual change repository. A computer-readable recording medium having recorded thereon a program for executing an MBR attack blocking method. The method of claim 7, wherein the method is (g1) if the system call is allowed, backing up information stored in MBR (hereinafter referred to as MBR); (g2) delivering the system call to an operating system; (g3) checking the modified MBR with the content signature list of the control list; And (g4) If it is determined that the modified MBR contains malicious code, the computer-readable recording medium having recorded the program for performing the MBR attack blocking method further comprising the step of recovering the backup MBR before the change. The method of claim 7, wherein step (d), (d1) registering the request process with a suspicious list; (d2) requesting the user to decide whether to accept or reject the system call; And and (d3) registering the request process on an allow or deny list according to the user's permission. The method of claim 7, wherein The method further includes the step of transmitting the process information registered in the suspicious list to the quarantine server connected to the computer terminal, In the step (f), the process information is a program for performing the MBR attack blocking method, characterized in that the MBR change information changed by the system call or MBR change information recorded in the virtual change storage is transmitted to the quarantine server. A computer-readable recording medium that records the data.

Images