KR100968120B1 - Detection system for malicious program considering code modification and method thereof - Google Patents

Abstract

The present invention discloses a code tamper detection system and method thereof. That is, when the specific code is executed by indicating an execution point (IP), which is an execution start address of a specific code, on the code memory area, the execution point (IP) is within a setting range on the code memory area during a setting period. A code deformation detection module for monitoring whether data recording is performed in the network and detecting whether the specific code is modified; And a restoration time detection module that monitors movement of the execution point during a setting cycle and detects a restoration time point for the transformation of the specific code, thereby compressing various codes including execution file compression, execution file encryption, and PE_PATCH. The recovery time point can be easily identified, and the same can be applied to the case where block encryption is accompanied by double compression and polymorphic viruses and encryption viruses.

Code transformation, restore

Description

CODE DETECTION SYSTEM FOR MALICIOUS PROGRAM CONSIDERING CODE MODIFICATION AND METHOD THEREOF

The present invention relates to detecting malicious code in which code modifications have been made, and more particularly, a code change detection system that checks whether various code modifications, such as execution compression, etc. are detected in diagnosing malicious code, and detects a time point at which a code is restored. And to a method thereof.

Techniques for detecting a specific code in which a conventional code transformation has been performed include software emulation or a break pointer method based on an original entry point (OEP), or a method of identifying an end point by implementing a dedicated algorithm. I use it.

However, the former is vulnerable to anti-debugging techniques, and the latter requires a lot of development time and requires high base knowledge, making it difficult to respond quickly and smoothly.

In addition, it implements a separate method (signature, algorithm) for judging whether a code is modified, and a modified method newly emerged as a dedicated judgment function that implements one method in virtually one algorithm. Cannot be used generically. In addition, the judgment function requires high knowledge, which is a big obstacle to quick response.

 The present invention was created to solve the problems inherent in the prior art as described above, an object of the present invention is to determine whether or not a variety of code modifications, including execution compression, etc. code modifications to detect the time when the code is restored The present invention provides a sensing system and method.

In accordance with an aspect of the present invention for achieving the above object, there is provided a code deformation detection system: The system is characterized in that the start point (EP, A code deformation detection module for detecting whether or not the specific code is modified by monitoring that data writing is performed within a setting range on the code memory area during a setting period when the specific code is executed by indicating an entry point; And a restoration time detection module for monitoring a movement of the execution point during a setting period and detecting a restoration time point for the deformation of the specific code.
Preferably, the code deformation detection module is further configured to execute the data by executing the specific code when the size of the recorded area on the code memory area is increased based on a recording start point on the code memory area. The size of the area where recording is made is characterized.
Preferably, the code deformation detection module detects that the specific code is deformed when the size of the code memory area in which the write operation is performed is greater than or equal to a preset value.
Preferably, the code deformation detection module detects that the specific code is deformed when a write operation on the code memory area is performed sequentially (forward and backward).
Preferably, the code deformation detection module detects that the specific code is deformed when a write operation on the code memory area is sequentially performed (forward and backward) based on an interval within a setting range.
Preferably, when the restoration point detection module is decompressed for the specific code by moving the execution point between a recording start point and a recording end point of the code memory area in which the recording operation is performed by the execution of the specific code, The movement time may be sensed as a restoration time for deformation of the specific code.
Preferably, the code deformation detection module monitors that data is written within a setting range based on the execution point located between a recording start point and a recording end point of the code memory area in which the writing operation is performed. It is characterized by detecting whether the deformation.
According to another aspect of the present invention, a method for detecting a code change is provided. The method includes: a) an entry point (EP) in which an execution point (IP) is an execution start address of a specific code on a code memory area Instructing to monitor, when the specific code is executed, data writing is made within a setting range on the code memory area during a setting period; b) determining the size of the area where the data has been written, according to a data write operation on the code memory area; c) detecting whether the specific code is deformed based on a characteristic of the write operation including the size of the code memory area in which the write operation is performed; And d) detecting a restoration point for the modification of the specific code by monitoring the movement of the execution point during a set period when a modification to the specific code is detected as a result of step 'c)'. It features.
Preferably, the method further comprises e) repeating steps a) to b) based on the moving position of the execution point in step “d).
Preferably, in the step b), when the size of the recorded area on the basis of the recording start point on the code memory area increases, the size of the area where the data is written is determined by execution of the specific code. It is done.
Preferably, the step c) is characterized in that, when the size of the code memory area in which the write operation is performed is greater than or equal to a predetermined value, detecting that the specific code is modified.
Preferably, the step c) is characterized in that, when the write operation on the code memory area is performed sequentially (forward, reverse), it is characterized in that the specific code has been modified.
Preferably, the step c) is characterized in that, when the write operation on the code memory area is sequentially (forward, reverse) based on the interval within the setting range, it is characterized in that the specific code is detected.
Preferably, the step d) is performed when the execution point is moved between a recording start point and a recording end point of the code memory area in which the writing operation is performed by the execution of the specific code, thereby decompressing the specific code. The movement time may be sensed as a restoration time for the deformation of the specific code.

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

The code deformation detection system and method according to the present invention detects that there is a code change by checking whether the memory write has occurred sequentially within a certain range after the code is executed, and then executes an execution point (IP) in the recording area. Instruction Pointer detects restoration time when it enters, and it is easy to identify various code modification restoration points including executable file compression, executable file encryption, and PE_PATCH. The same applies to the case where block encryption is accompanied.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 shows a schematic configuration diagram of a code deformation detection system according to an embodiment of the present invention.

As shown in FIG. 1, the system records data when an execution point (IP) is moved to an entry point (EP), which is an execution start address of a specific code, on the code memory area, and the specific code is executed. A code deformation detection module (100) for monitoring whether this is done and detecting whether the specific code is modified; And a restoration point detection module 200 for monitoring a movement of the execution point to detect a restoration point for the deformation of the specific code.

The code deformation detection module 100 moves the execution point IP to the start point EP on the code memory area, that is, when the execution point indicates the start point of the specific code and executes the specific code, writes data during a setting cycle. By monitoring this, it detects whether or not the specific code is modified.

More specifically, the code deformation detection module 100 may monitor in a manner of detecting that the size of the recorded area is increased based on the corresponding recording start point when data is written on the code memory area by execution of the specific code. Can be.

In this case, the code deformation detection module 100 detects that the specific code is deformed when the size of the code memory area in which the write operation is performed is greater than or equal to a preset value, and terminates the detection operation when the size of the code memory area is less than the preset value. do. For example, if recording of data (or code) occurs within a certain period after starting execution from the start point (EP) and if it is more than 4 bytes continuous, the recording start point and the end point of recording are recorded in the range, and the size is at least. Program function configuration size of is usually more than 8KB will detect the code variant.

In addition, the code deformation detection module 100 detects that the specific code is deformed when the write operation on the code memory area is performed sequentially (forward and backward), whereas the write operation is not sequential or continuous write operation. If the interval between them exceeds the setting range, the detection operation is stopped. That is, the code deformation detection module 100 uses a feature of decompressing and decrypting forward or backward from the front or the back using a lot of OFB (Output FeedBack) forms that utilize previous data in the case of code compression or encryption. The sensing module 100 detects that the specific code is deformed when the write operation on the code memory area is performed sequentially (forward and reverse). For reference, in case of execution compression, LZW (Lempel-Ziv-Welch) method, which is a lexical compression with good compression ratio, is often used, and this method has the characteristic that the data released earlier is used for the next data release. It is not decompressed, but in turn. These characteristics are equally applied in Lossless Compression. In the case of the encryption tool, similar characteristics are used because OFB or Cipher Feedback (CFB), which restores data afterward by utilizing the result of the previous encryption or decryption, is similarly used.

The restoration point detection module 200 monitors the movement of the execution point IP during a set period to detect a restoration point for the deformation of the specific code. That is, the restoration point detection module 200 moves the execution point IP between the recording start point and the recording end point of the code memory area by the termination of execution of a specific code, that is, between the recording start point and the recording end point of the memory area. When the execution point indicates the address, the movement time is detected as a restoration time for the modification of the specific code, and the position of the execution point IP where the movement is completed is regarded as the position of the original entry point (OEP). do.

On the other hand, the code deformation detection module 100 in conjunction with the restoration time detection module 200, the execution point located between the original start point (OEP), preferably, the recording start point and the recording end point of the code memory area in which the writing operation is performed. By monitoring data recording within a set range based on (IP), double and triple code variations can also be detected. This can be applied not only by compressing the code, but also by verifying that the execution point (IP) is located within the recording range in the case of a coded or polymorphic virus.

Hereinafter, a code deformation detection method according to an exemplary embodiment of the present invention will be described with reference to FIG. 2. 2 is a schematic flowchart for describing a code deformation detection method according to an exemplary embodiment of the present invention.

First, when the execution point IP moves to the starting point EP on the code memory area according to execution of a specific code, the data recording is monitored (S110). Preferably, the code transformation detection module 100 moves the execution point IP to the start point EP on the code memory area, that is, the execution point indicates the start point of the specific code, so that the specific code is executed. Monitor the recording of data while it is taking place.

Next, according to the data write operation on the code memory area, the size of the area where the data is written is determined (S120). Preferably, when the data modification operation is performed on the code memory area by the execution of the specific code, the code deformation detection module 100 detects that the size of the recorded area is increased based on the corresponding recording start point.

Then, whether the specific code is deformed is detected based on the characteristic of the write operation including the size of the code memory area in which the write operation is performed (S130-S140). Preferably, the code deformation detection module 100 detects that the specific code is deformed when the size of the code memory area in which the write operation is performed is greater than or equal to a preset value, and detects when the size of the code memory area is less than the preset value. To exit. In addition, the code deformation detection module 100 detects that the specific code is deformed when the write operation on the code memory area is performed sequentially (forward and backward), whereas the write operation is not sequential or continuous write operation. If the interval between them exceeds the setting range, the detection operation is stopped.

Thereafter, when a deformation of the specific code is detected, the movement of the execution point is monitored during a set period to detect a restoration point of the deformation of the specific code (S150-S170). Preferably, the restoration point detection module 200 monitors the movement of the execution point IP during a set period to detect a restoration point for the modification of the specific code. That is, when the execution point IP moves between the recording start point and the recording end point of the code memory area in which the write operation is performed, the restoration time detection module 200 restores the movement time to the restoration point for the deformation of the specific code. It is regarded as the position of the original entry point (OEP) of the control right (IP) where the movement is completed.

Although the present invention has been described in detail with reference to the preferred embodiments, the present invention is not limited to the above-described embodiments, and the present invention belongs to the present invention without departing from the gist of the present invention as claimed in the following claims. Anyone skilled in the art will have the technical idea of the present invention to the extent that various modifications or changes are possible.

Code deformation detection system and method according to the present invention is not only corresponding to a specific type of deformation, but can be applied to most general code modifications, so as to overcome the limitations of the existing technology in that it can be used generically (generic) The invention has industrial applicability because not only the use of related technology but also the possibility of marketing or sales of the applied device is not only sufficient but also practically obvious.

The following drawings, which are attached in this specification, illustrate preferred embodiments of the present invention, and together with the detailed description of the present invention, serve to further understand the technical spirit of the present invention. It should not be construed as limited to.

1 is a schematic configuration diagram of a code deformation detection system according to an embodiment of the present invention.

2 is a schematic flowchart illustrating a code deformation detection method according to an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

100: code deformation detection module

200: restore point detection module

delete

Claims (14)

In the code deformation detection system, When an instruction point (IP) indicates an entry point (EP) which is an execution start address of a specific code on the code memory area and the specific code is executed, data is set within the setting range on the code memory area during a setting cycle. A code modification detection module for monitoring whether a recording is made and detecting whether the specific code is modified; And And a restoration time detection module for monitoring a movement of the execution point during a set period to detect a restoration time point for the deformation of the specific code. The method of claim 1, wherein the code deformation detection module, When the size of the recorded area on the code memory area is increased based on the recording start point on the code memory area, the size of the area where the data is written is determined by execution of the specific code. Code Deformation Detection System. The method of claim 2, wherein the code deformation detection module, And detecting that the specific code is deformed when the size of the code memory area in which the write operation is performed is larger than or equal to a preset value. The method of claim 2, wherein the code deformation detection module, And detecting that the specific code is deformed when the write operation on the code memory area is performed sequentially (forward and reverse). The method of claim 4, wherein the code deformation detection module, And detecting that the specific code is deformed when the write operation on the code memory area is performed sequentially (forward and reverse) based on an interval within a setting range. The method of claim 1, wherein the restore point detection module, When the execution point is moved between the recording start point and the recording end point of the code memory area in which the recording operation is performed by the execution of the specific code, and the compression of the specific code is released, the movement time is determined for the deformation of the specific code. Code transformation detection system, characterized in that the detection by the restore point. The method of claim 6, wherein the code deformation detection module, Code modification, characterized in that for detecting the modification of the specific code by monitoring that the data recording is made within a set range on the basis of the execution point located between the recording start point and the recording end point of the code memory area where the write operation is performed; Detection system. In the code deformation detection method, a) When the specific code is executed by indicating an execution point (IP, Entry Point) that is an execution start address of a specific code on the code memory area, it is within a setting range on the code memory area during a setting period. Monitoring a data record being made in the server; b) determining the size of the area where the data has been written, according to a data write operation on the code memory area; c) detecting whether the specific code is deformed based on a characteristic of the write operation including the size of the code memory area in which the write operation is performed; And and d) detecting a restoration point for the modification of the specific code by monitoring the movement of the execution point during a set period when a modification to the specific code is detected as a result of step 'c)'. Code transformation detection method. The method of claim 8, wherein and e) repeating steps a) to b) based on the moving position of the execution point in step "d). The method of claim 8, wherein b), And if the size of the recorded area on the basis of the recording start point on the code memory area increases, determining the size of the area where the data is recorded by executing the specific code. The method of claim 8, wherein c) And detecting that the specific code is deformed when the size of the code memory area in which the write operation is performed is greater than or equal to a preset value. The method of claim 8, wherein c) And detecting that the specific code is deformed when the write operation on the code memory area is performed sequentially (forward and reverse). The method of claim 12, wherein step c) And detecting that the specific code is deformed when the write operation on the code memory area is sequentially made (forward and reverse) based on an interval within a setting range. The method of claim 8, wherein the d) step, When the execution point is moved between the recording start point and the recording end point of the code memory area where the recording operation is performed by the execution of the specific code, the compression of the specific code is decompressed. Code transformation detection method characterized in that the detection by the restore point.

Images