KR100991807B1 - System and method for detecting and managing malicious code in computer systems using microsoft windows operating systems - Google Patents

Abstract

The present invention relates to a system and method for detecting and processing malware in a computer system using a Microsoft Windows operating system. More specifically, after a database for Win32 Subsystem API analysis information called by malicious codes is established, A system and method for detecting and processing whether a file is malicious by extracting a Win32 API used by an executable file executed on a system or a file stored in a file system and comparing the extracted Win32 API with information stored in the database. It is about. According to the present invention, it is possible to detect not only malicious code that has already been found, but also malware that has not yet been found or modified code that has already been found, and can effectively cope with unknown malware that may have malicious behavior. have.

Malware, Cheat code, Security, Hacking, Online Game, Win32 Subsystem API

Description

System and method for detecting and processing malware on computer systems using Microsoft Windows operating system {SYSTEM AND METHOD FOR DETECTING AND MANAGING MALICIOUS CODE IN COMPUTER SYSTEMS USING MICROSOFT WINDOWS OPERATING SYSTEMS}

The present invention relates to a system and method for detecting and processing malware in a computer system using a Microsoft Windows operating system. More particularly, the present invention analyzes a Win32 Subsystem API (hereinafter, referred to as a "Win32 API") mainly called by malicious codes. After establishing a database of information, extracting the Win32 API used by an executable file executed on a computer system or a file stored in the file system and comparing the extracted Win32 API with the information stored in the database, whether the file is malicious code The present invention relates to a system and method for detecting and processing the same.

Recently, as internet service is diversified, the internet usage rate is increasing. As a result, malicious codes such as computer viruses and internet worms are widely spread through the internet, causing a lot of damage to users. In particular, in the case of online games, cheat codes that interfere with the fairness of online games are distributed through the Internet, causing damage to many well-intentioned online game users. Therefore, several security solutions have been developed and sold to prevent the introduction of malware into computers using the Microsoft Windows operating system.

1 is a block diagram of a conventional malware detection and processing system, the conventional malware detection and processing system 100 is a pre-built specific binary pattern in the process or file (10, 20) that requires malware inspection The binary pattern comparison unit 110 to compare the binary pattern database 140 of the malicious code, the malicious code determination unit 120 to determine whether the malicious code of the process or program file, the driver according to the binary pattern comparison result, and It consists of a malicious code processing unit 130 for stopping the process determined to correspond to the malicious code and delete the file.

As such, the conventional malware detection and processing system 100 relies on binary pattern comparison to determine whether the malicious code is appropriate, and thus, a certain diagnosis rate can be expected for the malicious code already known and registered in the binary pattern database of the malicious code. However, there is a disadvantage that the diagnosis itself is impossible for the unknown malware. In addition, security solution companies must constantly collect and analyze samples of new malware and reflect them in their malware binary pattern database. Internet users should update to the latest malware binary pattern database that reflects the binary pattern of new malware. There is discomfort.

Meanwhile, a method of blocking the operation of malicious code by hooking a specific Win32 API to detect and process malicious code is also used. However, this method is to determine whether malicious code is applicable by hooking specific Win32 API only. Therefore, detection effect of malicious code is inferior, and if hooking is used in kernel layer, it may cause serious failure due to system malfunction. .

Therefore, the present invention is to solve the above problems of the prior art, and after building a database for Win32 API analysis information that is mainly called by malicious codes, an executable file or a file stored in a file system used on a computer system is used. It is an object of the present invention to provide a system and method for detecting whether a file is malicious code by processing the extracted Win32 API and comparing the extracted Win32 API with information stored in the database.

Malware detection and processing system in a computer system using the Microsoft Windows operating system according to an aspect of the present invention for achieving the above object, Win32 API for extracting the Win32 API used by the process or file that is the target of malware inspection Extraction unit; A Win32 API analyzer for extracting Win32 API analysis information by analyzing the Win32 API extracted by the Win32 API extractor; A malicious code determination unit determining whether a malicious code of the process or file to be inspected is based on the Win32 API analysis information extracted by the Win32 API analysis unit; And a malicious code processor configured to process a test target process or file determined as malicious code by the malicious code determiner.

Preferably, the system further includes a Win32 API database that is built by collecting and analyzing Win32 API information called by known malicious codes, wherein the malicious code determination unit analyzes the Win32 API extracted by the Win32 API analysis unit. The information is compared with the information stored in the Win32 API database to determine whether the inspection target process or file is malicious code.

Specifically, when the similarity degree comparing the Win32 API analysis information with the information stored in the Win32 API database exceeds a predetermined threshold, the malicious code determination unit determines the inspection process or file as malicious code.

Meanwhile, the Win32 API analysis information extracted by the Win32 API analyzer comprises one or more of the type of the called Win32 API, the Win32 API call sequence, the Win32 API call method, and the Win32 API call argument. In addition, the malicious code processing unit stops the process when the malicious code scan target is a running process, and deletes the file when the malicious code scan target is a file stored in the file system.

In addition, the method for detecting and processing malware in a computer system using the Microsoft Windows operating system according to another aspect of the present invention includes the steps of: (a) extracting a Win32 API used by a process or file that is a target of malware inspection; Analyzing (b) the extracted Win32 API; (C) determining whether the inspection target process or file is malicious code based on the Win32 API analysis information of step (b); And (d) processing the inspection target process or file determined as malicious code by step (c).

Preferably, the step (c) comprises comparing the Win32 API analysis information with information stored in a Win32 API database that is constructed by collecting and analyzing Win32 API information called by known malicious codes. If the similarity of comparing the Win32 API analysis information with the information stored in the Win32 API database exceeds a predetermined threshold, determine the process or file to be scanned as malicious code .

In addition, the step (b), by analyzing the extracted Win32 API, extracts the type of Win32 API, Win32 API call order, Win32 API call method and Win32 API call argument information, and the step (d), If the malicious code scan target is a running process, stop the process. If the malicious code scan target is a file stored in the file system, delete the file.

On the other hand, step (a), the step of analyzing the import address table (IAT) in which the addresses of the functions used statically in the program executable file is recorded; Retrieving a string of functions; And disassembling the file loaded into the memory to identify a function to be used.

By using the malicious code detection and processing system and method according to the present invention, it is possible to detect not only the malicious code that has already been found, but also the malicious code that has not yet been discovered or the modified code of the previously discovered malicious code. It can also respond effectively to potentially unknown malware.

Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings. In the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

The Application Programming Interface (API) is an interface that allows applications to use the functionality provided by the operating system. The Win32 API allows applications to use the thousands of functions provided by the Microsoft Windows operating system. If these functions are classified according to their use and usage method, it can be seen that the Win32 API mainly used in malicious code is biased to some functions, and the order of execution of the Win32 API used in malicious code also has a predetermined rule. Therefore, in the present invention, the malicious code to detect the malicious code based on the Win32 API analysis information mainly called by the malicious code, such as the type, call order, call method and arguments of the Win32 API mainly used.

2 is a block diagram of a malicious code detection and processing system according to the present invention.

The malicious code detection and processing system 200 according to the present invention includes a Win32 API extraction unit 210, a Win32 API analysis unit 220, a malicious code determination unit 230, a malicious code processing unit 240, and pre-built malicious code. The Win32 API database 250.

The Win32 API extractor 210 extracts a Win32 API used by a process or file that is a target of malware inspection, that is, a normal process or file 10 or malicious code 20.

The Win32 API analyzer 220 extracts Win32 API analysis information from the Win32 API extracted by the Win32 API extractor 210. In detail, the Win32 API analyzer 220 analyzes the Win32 API received from the Win32 API extractor 210 and extracts information such as the type, call order, calling method, and arguments of the Win32 API, which is extracted Win32 API. To compare with the information stored in the Win32 API database 250 of the pre-built malicious code.

The malicious code determiner 230 compares the Win32 API analysis information extracted by the Win32 API analyzer 220 with the information stored in the Win32 API database 250 of the malicious code to determine whether the process or file 10 or 20 to be scanned is determined. Determine whether it corresponds to malicious code. In detail, the malicious code determiner 230 compares the Win32 API analysis information with the information stored in the Win32 API database 250 of the malicious code, and when the similarity exceeds the predetermined threshold, the process or file 20 to be scanned. Is considered to be malicious code.

The malicious code processing unit 240 processes the scan target process or file 20 determined by the malicious code determination unit 230 to be malicious, specifically, when the scan target is a running process, the corresponding process is stopped. If the scan target is a file saved in the file system, delete the file.

Win32 API database 250 of malicious codes is a database that collects and analyzes Win32 API information mainly known by known malicious codes and builds them, and serves as a criterion for determining whether a process or file to be scanned corresponds to malicious code. .

The Win32 API function classifications and functions included in the malware are known and used as follows.

Process navigation ( PS Class )

Toolhelp32 family of functions to get the currently running process

PSAPI family of functions to get the currently running process and the modules associated with it

FindWindow and FindWindowEx family of functions to find a window or the process ID that created it

EnumWindow and GetWindow functions for getting more information about creating other windows

Process handle acquisition ( PA Class )

OpenProcess and NtOpenProcess functions to get the process handle from the process ID (PID)

Memory forgery / modulation ( MM Class )

ReadProcessMemory and WriteProcessMemory functions for reading and writing data to memory areas of processes other than themselves

CreateRemoteThread function to run code in another process

GetThreadContext and SetThreadContext functions to get or change information for a specific thread.

KeStackAttachProcess function to freely read and write the memory space by concatenating the address space of a specific thread with itself

certain API Hooking  ( HK Class )

SetWindowsHookEx function to intercept a message from another process or inject a DLL into that process

KeServiceDescriptorTable function for hooking kernel native functions

Keyboard and mouse random operation ( MC Class )

Keybd_event, mouse_event, and SendInput functions to raise keyboard and mouse events

ClipCursor and SetCapture functions to limit mouse movement or to intercept mouse movement

GetKeyboardState and SetKeyboardState functions for getting or setting the current keyboard state.

Screen Detection ( SC Class )

GetPixel function to read the color of a specific location on the screen

The above-mentioned Win32 API is an enumeration of Win32 API functions mainly used by malicious codes known to date, which are exemplary, and Win32 API information stored in the Win32 API database 250 is not limited thereto.

3 is a flowchart illustrating a malicious code inspection process according to the present invention.

Once the malicious code detection and processing system according to the present invention is started, the malicious code detection and processing system is loaded into the memory (S310) and becomes a waiting state for malicious code inspection. Thereafter, when receiving a malicious code scan command (S320), the malicious code scan is executed. If the malicious code scan target is a running process (S330), the running process is imported (S340), and the malware is detected and targeted. Processing (S370) is performed. On the other hand, if the malicious code scan target is a file stored in the file system (S350), the corresponding file is imported (S360) and the malicious code is detected and processed (S370).

4 is a flowchart illustrating a detailed process of malware detection and processing.

In the above-described malicious code inspection process, if a malicious code detection and processing process for a file stored in a running process or a file system is started, the malware detection and processing system according to the present invention is a Win32 used by the process or file. The API is extracted (S410) and the extracted Win32 API is analyzed (S420) to determine whether malicious code is applicable. If it is determined that the scan target process or file corresponds to the malicious code (S430), it is determined whether the scan target is a running process or a file stored in the file system (S440). In operation S450, if the inspection target is a file stored in the file system, the corresponding file is deleted in operation S460.

5 is a flowchart showing the detailed process of extracting Win32 API in use by the program.

In order to extract the Win32 API being used in the program, first, an IAT (Import Address Table) is analyzed (S510). At this time, IAT is a table that records the addresses of functions used statically in the program executable file.

If Win32 API extraction is not possible through IAT analysis, search for a string of the function (S520). This is to extract the Win32 API directly from the function's string if it is not possible to extract it through IAT analysis because the program executable dynamically calls the function using a function such as GetProcAddress.

If Win32 API extraction is not possible even through a function string search, disassembly is performed (S530). This is to check the use function by directly disassembling a file loaded in a memory when the test target is a program executable file protected by a method such as execution compression.

If Win32 API extraction is successful by any one of the above IAT analysis (S510), function string search (S520) and disassembly (S530), or the Win32 API is not extracted by any of the above methods. If not, return the result.

6 is a conceptual diagram illustrating a malicious code inspection process according to the present invention.

Malware scanning is largely done in two areas. The first is a check of the application layer and the second is a check of the kernel layer. The application layer checks whether the general processes (640, 650, 660) currently running are malicious, and the kernel layer checks the currently running driver ( 680, 690) malware is checked.

Specifically, the operating environment of a program in a general Windows environment is largely divided into an application layer and a kernel layer. The application layer contains one or more processes (640, 650, 660), which are images of the operating program, and the Win32 API (630), which are necessary for the process to use the functions of the operating system. The kernel layer contains the Windows kernel 670 and one or more kernel drivers. (680, 690). In general, assuming that the Win32 API 630 and the Windows kernel 670 are safe, the targets to be checked for malicious code are processes and drivers. Therefore, the malware detection and processing system according to the present invention may be divided into an API checking module 610 for checking whether a malicious code of a process is applicable and a kernel checking module 620 for checking whether a malicious code of a driver is applicable. The API inspection module 610 may perform malware inspection on a currently running process and a driver with the help of the kernel inspection module 620.

7 is a conceptual diagram showing a malicious code inspection process being executed.

Generally, a program consists of a program itself image 641 and one or more dynamic link libraries (DLLs) 642, 643, 644. In this case, the dynamic libraries 642, 643, and 644 may be shared by a plurality of programs, and the program 641 and the dynamic libraries 642, 643 and 644 may be provided by the Windows kernel through the Win32 API 630. Call and use a function. The API inspection module 610 analyzes a call type of the Win32 API 630 called by the program 640 and the dynamic libraries 642, 643, and 644, and according to the above-described process, the corresponding program 640 and the dynamic library ( 642, 643, 644) to determine the possibility of malicious conduct or deception.

8 is a conceptual diagram illustrating a malicious code inspection process in a file system.

Generally, computer hard disks manage files and folders by an infrastructure called file system 800. There are a plurality of files and folders in the file system 800. The files are executable program files 810, 820, and 830 according to their purpose, driver files 840, 850, and 860 for device management, and data files. And the like. At this time, the files that can determine the malicious code by analyzing the Win32 API call forms are the program files (810, 820, 830) and the driver files (840, 850, 860). The API inspection module 610 analyzes the Win32 API call types used by the program files 810, 820, and 830 and the driver files 840, 850, and 860 to enable malicious behavior or deception of the program and driver files. Judge.

As described above, based on the Win32 API usage form, analyzing the known malicious code and normal code malicious code can obtain the results as shown in the following table. (A: frequency above 80%, B: 60% to 80% frequency, C: 40% to 60% frequency, a: frequency below 0.1%, b: 1.0% to 0.1% frequency, c: 2.0% to 1.0% frequency )

PS PA MM HK MC SC Malware Normal code ○ ○ ○ ○ ○ ○ C a ○ ○ ○ - - - B b - - - ○ - ○ B c - - - ○ ○ - C c ○ ○ - ○ - - B b - ○ - ○ - - A b Total A c

As shown in the above table, the PA class and the HK class alone can obtain a malicious code detection rate of 80% or more, and the false positive rate is 0.83%, which is very low. The analytical results are one application of the invention obtained from a limited sample. Therefore, by using each class in various ways, a higher diagnosis rate and a lower error rate can be obtained.

The details of the detailed description and the drawings described above are only limited to the preferred embodiments of the present invention, but the present invention is not limited thereto. It will be possible to substitute, change or delete the components according to the present invention within the technical scope of the present invention.

Therefore, the scope of the present invention should be determined by the appended claims rather than by the foregoing description and drawings.

1 is a block diagram of a conventional malware detection and processing system,

2 is a block diagram of a system for detecting and processing malware according to the present invention;

3 is a flowchart illustrating a malicious code inspection process according to the present invention;

4 is a flowchart showing a detailed process of malware detection and processing;

5 is a flowchart showing the detailed procedure of the Win32 API extraction being used in the program;

6 is a conceptual diagram showing a malware inspection process according to the present invention;

7 is a conceptual diagram showing a malware inspection process being executed; and

8 is a conceptual diagram illustrating a malicious code inspection process in a file system.

Claims (11)

A Win32 API extracting unit which extracts a Win32 API used by a process or a file to be scanned for malware; Analyze the Win32 API extracted by the Win32 API extraction unit, Win32 API analysis including one or more selected from the group consisting of the type of Win32 API, Win32 API call order, Win32 API call method and Win32 API call argument Win32 API analysis unit for extracting information; A malicious code determination unit determining whether a malicious code of the process or file to be inspected is based on the Win32 API analysis information extracted by the Win32 API analysis unit; And Malicious code detection and processing system comprising a malicious code processing unit for processing the inspection target process or file determined as malicious code by the malicious code determination unit. The method of claim 1, It further includes a Win32 API database built by collecting and analyzing Win32 API information called by known malware. The malicious code determination unit compares the Win32 API analysis information extracted by the Win32 API analysis unit with the information stored in the Win32 API database to determine whether the malicious code corresponding to the process or file to be scanned is determined. Detection and processing system. The method of claim 2, The malware detection unit detects the malicious code, characterized in that if the similarity comparing the Win32 API analysis information with the information stored in the Win32 API database exceeds a predetermined threshold, the process or file to be inspected as a malicious code And processing system. delete The method of claim 1, The malicious code processing unit stops the process when the malicious code scanning target is a running process, and deletes the corresponding file when the malicious code scanning target is a file stored in the file system. (A) extracting a Win32 API used by a process or file that is the target of malware inspection; Analyzing the extracted Win32 API, extracting Win32 API analysis information including one or more selected from the group consisting of called Win32 API types, Win32 API call order, Win32 API call method, and Win32 API call argument; b); (C) determining whether the inspection target process or file is a malicious code based on the Win32 API analysis information extracted by step (b); And And (d) processing the inspection target process or file determined as malicious code by step (c). The method of claim 6, In the step (c), the Win32 API analysis information is compared with information stored in a Win32 API database that collects and analyzes Win32 API information called by known malicious codes and establishes the malware corresponding to the process or file to be scanned. Malware detection and processing method characterized in that it determines whether or not. The method of claim 7, wherein In the step (c), when the similarity of comparing the Win32 API analysis information with the information stored in the Win32 API database exceeds a predetermined threshold, the malicious process may be determined to determine the process or file to be scanned as malicious code. How to detect and handle code. delete The method of claim 6, In the step (d), if the malicious code scan target is a running process, the process is stopped, and if the malicious code scan target is a file stored in the file system, the malware is detected and processed. . The method of claim 6, Step (a) is, Analyzing an import address table (IAT) in which addresses of functions that are statically used in a program executable file are recorded; Retrieving a string of functions; And And disassembling the file loaded in the memory to identify a function to be used.

Images