KR101031786B1 - Malicious code prevention apparatus and method using level classification of suspicious behavior and isolated execution, and computer-readable medium storing program for method thereof - Google Patents

Abstract

The present invention relates to a malicious code countermeasure apparatus and method for protecting a system by classifying suspicious actions performed by a program according to levels, and executing the malicious code in an isolation space according to a classification result, and a computer readable computer readable medium storing a program for executing the method To a recording medium. One aspect of the present invention monitors the actions performed by the program in the system, classifies the actions according to the characteristics of the malicious code and the normal code, classifies the malicious code and the malicious code, And a malicious code preliminary countermeasure method of isolating an action classified as an action to be executed from the system. According to the present invention, zero-day attacks are disabled on the basis of an action without user's reporting afterwards, and the suspicious actions are classified and processed at the level without requiring a query to the user, It is possible to protect the user.

Malicious code, proactive, behavior based, level classification, quarantine execution

Description

[0001] The present invention relates to a malicious code pre-coping apparatus, method and system for classifying suspicious behavior and performing quarantine, and a computer-readable recording medium on which a program for executing the method is recorded. isolated execution, and computer-readable medium storing program for the < RTI ID = 0.0 >

The present invention relates to a device, a method, and a computer-readable recording medium on which a program for executing the method is classified. Specifically, the present invention relates to a malicious code countermeasure apparatus and method for protecting a system by classifying suspicious actions performed by a program according to levels, and executing the malicious code in an isolation space according to classification results, and a computer The present invention relates to a recording medium readable by a computer.

Today, many websites are exposed to malicious code attacks. Malicious code is performing various forms of attacks, such as phishing or drive-by-download, against not only the Web site itself, but also other users who visit the Web site they attack.

Security programs and systems are being developed to prevent users from harming malicious code. At present, widely used drive-by-download type attack prevention techniques have various methods such as signature-based countermeasures and proactive prevention methods.

The signature-based countermeasure is a technology that identifies websites that distribute malicious code by blocking Web sites reported by users or by examining downloaded files with AV engine (Anti-Virus engine). This method collects samples by post-notification of victims victimized by malicious code attacks or extracts signatures that can identify malicious code through honey pot. Therefore, a signature-based malicious code countermeasure has a problem in that a certain number of victims can not be avoided until after the user's report is made. It is impossible to defend against the zero-day attack that occurs before the existence of a security problem on the system is announced.

The proactive prevention method judges whether or not the malicious code is based on the action performed by the program. This method can not be 100% sure whether the malicious code is detected because the detected behavior is suspicious, but the normal code can often perform such an operation. Therefore, this method asks the user through the notification window whether or not to continue executing the code when a suspicious behavior is found. In a system protected by the proactive prevention method, such a notification window is frequently generated, and the user feels inconvenience. Even if the notification window warns the execution of suspicious behavior, it is practically difficult for ordinary users other than the computer security specialist to judge whether or not malicious code is being executed and to continue execution of suspicious behavior.

In order to solve the above problems, it is an object of the present invention to enable a defense against a zero-day attack by processing a malicious code based on an action without collecting vulnerability information by a user's post-notification.

In addition, it aims to provide real-time protection that does not require a query to the user through a notification window by sorting suspicious behavior based on the characteristics of malicious code and normal code.

It also aims to disable malicious code attacks by protecting the system by executing suspicious actions in a limited isolation space.

According to a first aspect of the present invention, there is provided a program for causing a computer to function as: a behavior monitoring unit for monitoring an action performed by a program in a system; a behavior classifying unit for classifying the behavior into levels based on characteristics of malicious code and normal code; And a quarantine executor for isolating an activity classified as an activity occasionally used in malicious code but also occasionally in normal code from the system.

Further, the present invention provides a malicious code proactive device, further comprising a log recorder for storing the behavior information of the program as log records.

Further, the malicious code pro- viding apparatus may further include a behavior restoration unit restoring the pre-malicious behavior state based on the log record when the program performs a malicious act.

Further, the present invention provides a malicious code proactive device further comprising a whitelist storage unit for storing a list of safe programs in a whitelist.

A malicious code analysis system for analyzing whether a malicious code is received by receiving a sample of a program not registered in the whitelist; and a malicious code analysis system And a white list management unit for updating the whitelist.

The access control apparatus may further include an access destination copy storage unit for storing a copy of data accessed by an action executed by the isolation execution unit in a state isolated from the system.

In addition, the above-mentioned classification result is classified into a first-level action used only in the normal code, a second-level action mainly used in the normal code but occasionally used in the malicious code, and a second level action used mainly in the malicious code, 3-level behavior, and 4-level behavior used only in malicious code.

Further, the present invention provides a malicious code proactive device further including a control unit that permits normal execution of the first level action and the second level action, and suspends or blocks execution of the fourth level action.

In addition, the isolation execution unit provides a malicious code proactive device that isolates and executes an interlocking program used for executing the classified action from the system.

The normal verification code storage unit may further include a normal verification code storage unit for storing a normal verification code that has been confirmed not to perform any suspicious activity at all. A malicious code pre-countermeasure apparatus that isolates and blocks or isolates the malicious code from the system.

According to a second aspect of the present invention, there is provided a program for causing a computer to function as: monitoring an action performed by a program in a system; classifying the actions according to a level of malicious code and normal code; The malicious code preliminary countermeasure method is provided which isolates an action classified as an action occasionally used even in normal code but isolates it from the system.

In addition, the present invention provides a malicious code advance response method of storing behavior information of the program as log records.

In addition, when the program performs a malicious action, the malicious code preliminary response method for restoring the pre-malicious behavior state based on the log record is provided.

It also provides a malicious code proactive method to store a list of safe programs in a white list.

Also, a malicious code preliminary response method of storing a sample of the program, analyzing whether or not the sample of the program not registered in the whitelist is received, and analyzing the result of the analysis to update the whitelist do.

In addition, the present invention provides a malicious code preliminary countermeasure method of isolating a copy of data accessed by an isolated and executed operation from the system.

In addition, the above-mentioned classification result is classified into a first-level action used only in the normal code, a second-level action mainly used in the normal code but occasionally used in the malicious code, and a second level action used mainly in the malicious code, 3-level behavior, and 4-level behavior used only in malicious code.

Further, the present invention provides a malicious code proactive method that permits normal execution of the first level behavior and the second level behavior and suspends or blocks the execution of the fourth level behavior.

Further, the present invention provides a malicious code advance handling method that isolates and executes an interlocking program used for executing the classified action from the system.

It also provides a malicious code proactive response method that isolates and blocks the action from the system when the normal verification code that has been confirmed as not doing any suspicious activity performs an action sometimes used in malicious code.

In addition, when the program belonging to the normal verification code performs an action sometimes used in the malicious code, the program checks the behavior information of the program, detects a malicious code executed from the detection result, Provides a malicious code proactive method to report samples to the analysis system.

According to a third aspect of the present invention, there is provided a computer-readable recording medium having recorded thereon a program for executing any one of the above methods.

According to the present invention, it is possible to disable the zero-day attack based on an action without reporting the user's post.

In addition, there is an effect that real-time execution can be guaranteed by classifying suspicious actions according to levels without inquiring about users and processing them.

Further, the system can be safely protected by the execution in the isolation space.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions of the present invention, and these may be changed according to the intention of the user, the operator, or the like. Therefore, the definition should be based on the contents throughout this specification.

1 is a block diagram showing a schematic configuration of a malicious code proactive device of the present invention.

The behavior monitoring unit 110 monitors various kinds of behavior information generated by a user PC (personal computer). May be implemented by a monitoring tool installed in the behavior monitoring tool installer according to the embodiment, or may be implemented to be interlocked with the log record storing unit 130 that stores various behavior information to be monitored. The monitoring tool can be a hook, or a filter driver, installed in each part of the operating system. The action information to be monitored is transmitted to the action classifying unit 120 and classified.

The action classifying unit 120 classifies the monitored action information into levels according to characteristics of the malicious code and normal code. The result of classification by level shows the first level behavior that is used only in normal code and the second level behavior which is mainly used in normal code but is sometimes used even in malicious code and the third level behavior which is mainly used in malicious code, , And a fourth level behavior used only in malicious code. In this embodiment, although classified into four levels, there is no intermediate level between the malicious code and the normal code, and conversely, the malicious code may be divided into a very detailed one. Also, when a list of normal codes that seem to be suspicious but actually proven to be safe is managed as a separate whitelist, when the behavior classifier 120 searches the whitelist and, as a result, It may be implemented to be processed at a level lower than the result of the classification. The category classification in the behavior classifying unit 120 will be described in detail later.

The log recorder 130 stores various kinds of behavior information generated in the user PC as a log record. According to the embodiment, the module generating the action can be implemented by managing each program or module by identifying the thread information and the stack back tracing method. This managed behavior information is used to roll back any actions performed by the module if the module later performs a malicious action.

Based on the log record stored in the log record storage unit 130, the behavior restoration unit 135 restores all actions performed by the module after the suspicious action of the already executed specific module is found to be a malicious action, Restore.

The isolation execution unit 140 isolates and executes an action classified as a third level action that is mainly used in malicious code but is often used even in normal code by the action classifying unit 120. [ Even if an executed action proves to be an actual malicious code, the main system is completely theoretically protected from malicious code, since it is only executed in isolation. The action performed by the isolation execution unit 140 will be described later in more detail.

The access object copy storage unit 145 is a space in which a copy of the file is stored when a module performing a third level action accesses important data such as a system file. The isolation execution unit 140 stores a copy of the access target file in a redirection folder or the like, and causes the suspicious action to be performed only on the copy. The access target copy storage unit 145 may be implemented as a space physically or logically separated from the main system or isolated by a virtualization technique or the like. The access target copy storage unit 145 may store an access target in an internal redirection folder. A copy of various data such as a redirection key, a redirection path, or an IP and a port number may be stored according to the type of the access object.

The whitelist management unit 150 allows a safe program to be stored in the whitelist storage unit 155 through a sample analysis of the malicious code analysis system 170 after the action-based dictionary response. And the white list is updated in accordance with the result of the sample analysis.

The whitelist storage unit 155 stores the list in a whitelist so as to allow execution of a secure program.

The sample storage unit 160 stores vulnerability information of the system or samples of a program or module that performs suspicious actions. Such a sample may be transmitted to the malicious code analysis system 170 or the like.

The malicious code analysis system 170 receives a sample of the program not registered in the whitelist and analyzes whether or not the malicious code is malicious code. Through the request of the user PC, the analysis of the malicious code is started and the analysis result is fed back to the user PC. The malicious code analysis system 170 may be implemented inside or outside the user PC according to an embodiment.

The normal verification code storage unit 180 stores all or part of the normal verification code, which is a verified module that does not have any suspicious behavior at all. The code stored in the normal verification code storage unit 180 is regarded as a secure program consisting of only the first level actions performed by only the normal code. For example, the normal verification code storage unit 180 may store a list of programs that perform only first-level behavior as well-known software such as an office program, an operating system service, a word processor program, and the like. If a program classified as a normal verification code executes an action that is sometimes performed by malicious code, it is only the case that it is hacked. Therefore, when the code classified by the normal verification code executes a little suspicious activity, that is, when performing the action of the second level or more other than the first level, the quarantine execution unit 140 executes the quarantine execution do. For example, a word processor document file containing malicious code, an injected DLL, and the like may correspond to such a case. The action performed by the isolation execution unit 140 will be described later in more detail.

FIG. 2 is a flowchart illustrating a process in which a malicious code advance response method of the present invention is performed.

The malicious code advance response method of the present invention may first install an action monitoring tool in the user PC (S210). Thereafter, various pieces of action information performed in the user PC are monitored (S220).

As the monitoring progresses, the actions are classified according to the level of the malicious code and the normal code (S230). In the present embodiment, the first level classified as the normal code behavior to the fourth level classified as the malicious code behavior is classified into four levels, but various classification and processing at the middle level are possible. The most secure first level behavior allows normal execution (S248). The second level of action, which is somewhat suspicious but can not rule out the possibility of misjudging, permits normal execution (S246) and then white list processing (S260) is performed through the white list existence judgment (S250). A third level of action that is highly suspect but can not rule out the possibility of misjudging is limited to allow execution in the isolation space (S244) and then white list processing is performed (S250) . The most suspicious behavior of the fourth level is to suspend or block the execution itself (S242), to determine whether the whitelist exists (S250), and to pass through the whitelist process (260).

FIG. 3 is a flowchart showing a process of sorting and processing an action by level.

First, it is determined whether the action is used only in malicious code (S232). (Y), this is a fourth level action, so execution is suspended or blocked (S242). If it is not an action that is used only in malicious code (N), the next step S234 is processed.

Next, it is judged whether it is an action occasionally used in malicious code, but in normal code (S234). (Y), which is mainly used in malicious code but is occasionally used even in normal code. This is a third-level action, and thus allows limited execution in the isolation space (S244). The isolation process is reviewed in detail. If it is not an occasionally used action in the malicious code but is also used in the normal code (N), the next step S236 is performed.

Next, it is determined whether the malicious code is used occasionally (S236) although it is mainly used in the normal code. If it is an action that is mainly used in normal code but is sometimes used even in malicious code (Y), this is a second level action, and therefore, normal execution is allowed once (S246). If it is not used occasionally in the malicious code (N), this is a first-level malicious code, so normal execution is allowed (S248).

The behavior characteristics of the first to fourth levels used in the present embodiment can be summarized as follows.

Since the first-level action is not a question at all, it can be processed to allow normal execution as it is with normal normal code.

Level 2 behavior is a somewhat suspicious activity, allowing it to run, but it can be processed to log and collect samples. Examples of second level behaviors include access to an office file, such as a Word file (extension doc, docx), an Excel file (extension xls, xlsx), a PowerPoint file (extension ppt, pptx) hooking).

Third-level behavior is a fairly suspicious activity, so you can redirect the target of the suspicious activity, allowing it to run itself, but restrict it to run in isolation space and process it to collect logs and collect samples. It is suspected that it is malicious code, but there is a possibility of misjudging, so it is possible to restore only the limited amount of time after securing the possibility of recovery to the main system. Examples of third-level behaviors include automatic run registry writes.

Level 4 behavior is not necessary unless it is a malicious purpose, so you can pause or block execution, process the logs, and collect samples. In general, a program or module that performs malicious acts in spite of the existence of other processing methods may be regarded as malicious code. Examples of level 4 behaviors include raw access to a hard disk or physical memory by a service program such as svhost.exe, installation of a driver without user intervention, And external transmission of personal information such as.

The isolation of the third level behavior is accomplished through the following process. First, the target is redirected by changing the location of the subject of the suspicious activity. For files, create a redirection folder in a separate location and change the destination path to a subdirectory of the redirection folder. In the case of the registry, prepare a redirection key at a separate location, and designate the path of the destination as a subordinate of the redirection key. For a kernel object, create a redirection path in a separate location, and change the destination path to a subordinate of the redirection path. In the case of a network, IP and port numbers are similarly reallocated.

At this time, when a suspicious activity classified as a third-level action accesses data important for security such as a system file, it copies this file to the subordinate or inside of the redirection folder of the access destination copy storage unit 145 To create isolation space. The isolation execution unit 140 limits the execution environment so that the suspicious action opens and executes the copy in the isolation space. As a result, the data in the main system, which is the original access target, is not protected from being opened or executed. In this way, it is possible to reduce the possibility of leakage of important data by defending the system's access to suspicious activity.

The isolation execution unit 140 may be implemented to isolate an interworking program used for execution from the system when the module performing the suspicious activity classified as the third level action is not an execution file (such as an extension exe) . For example, if the subject who is suspicious is a dll file, the linked rundll is used. If the file is an ActiveX (Active X) file, the linked program and the web browser are used. If the file is an office file (doc, xls, ppt, doc), Excel (xls), and PowerPoint (ppt) into an isolated space, and load the corresponding file in the interlocking program. A batch file, a registry file, and a script file can be verified in a similar manner using a corresponding engine.

On the other hand, when the code classified by the normal verification code executes a little suspicious activity, the program is mainly executed in the malicious code but is occasionally used in the normal code as described above, and executes the program in isolation (S244 ). In this case, based on the program's action information record, it is possible to find the code that performed the malicious action and to report it to the internal or external analysis system. Such action information may include a file in which the program is opened, a module in which the program is loaded, and the like. Based on these records, it is to find the code that performed the malicious act.

FIG. 4 is a flowchart showing a processing procedure when it is not present in the whitelist.

First, a log record to be used for a later rollback is left (S262), and a sample to be used for malicious code analysis is stored (S264). Then, the sample is transmitted to an internal or external malicious code analysis system to analyze malicious code (S266). If it is determined as a safe program, the white list is updated (S268).

The modules, functional blocks or means of the present embodiment may be implemented by various known devices such as an electronic circuit, an integrated circuit, and an ASIC (Application Specific Integrated Circuit), and they may be implemented separately or two or more may be integrated into one .

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be construed as limited to the specific embodiments set forth herein; And can be replaced, modified and replaced. For example, the technique of the present invention can be applied to pictures, images, etc., which can be displayed by a display such as other LCDs instead of characters. Accordingly, it is intended to cover in the appended claims all such changes and modifications that fall within the true spirit and scope of the invention.

1 is a block diagram showing a schematic configuration of a malicious code proactive device of the present invention.

FIG. 2 is a flowchart illustrating a process in which a malicious code advance response method of the present invention is performed.

FIG. 3 is a flowchart showing a process of sorting and processing an action by level.

FIG. 4 is a flowchart showing a processing procedure when it is not present in the whitelist.

Claims (22)

An activity monitoring unit for monitoring an activity of a program executed in the system, A behavior classifying unit classifying the behavior of the program according to the level based on the behavior when the malicious code and the normal code are executed, An isolation execution unit for isolating an action of the program from the system when the action of the program is relatively more used in malicious code than a normal code, A malicious code advance device. The method according to claim 1, A log recorder for storing the behavior information of the program as a log record, Further comprising: a malicious code precompliant device. 3. The method of claim 2, When the program performs a malicious action, restoring the malicious behavior state based on the log record, Further comprising: a malicious code precompliant device. The method according to claim 1, A white list storage unit for storing a list of safe programs in a white list; Further comprising: a malicious code precompliant device. 5. The method of claim 4, A sample storage unit for storing a sample of the program; A malicious code analysis system for analyzing whether or not a sample of a program not registered in the whitelist is malicious code, and A white list management unit for updating the white list by reflecting an analysis result of the malicious code analysis system, Further comprising: a malicious code precompliant device. The method according to claim 1, An access destination copy storage unit which stores a copy of data accessed by an action executed by the isolation execution unit in a state isolated from the system, Further comprising: a malicious code precompliant device. The method according to claim 1, The result of the classification by level includes a first level action used only in the normal code, a second level action used relatively more in the normal code than the malicious code, a third level action used relatively more in the malicious code than the normal code, And a fourth level behavior used only in malicious code Malicious code proactive device. 8. The method of claim 7, A control unit that permits the execution of the program when the action of the program is the first level action and the second level action and suspends or blocks the execution of the program when the action of the program is the fourth level action; Further comprising: a malicious code precompliant device. The method according to claim 1, Wherein the isolation execution unit isolates and executes an interlocking program used for executing the classified action from the system Malicious code proactive device. The method according to claim 1, And a normal verification code storage unit for storing a normal verification code, Wherein the quarantine execution unit isolates and executes the action to be executed from the system when the program having the normal verification code desires to execute an action used in the malicious code Malicious code proactive device. A malicious code advance response method of a device for monitoring an action of a program executed in a system, Monitoring the behavior of a program running on the system, Classifying the behavior of the program according to the level of malicious code and the behavior characteristic when the normal code is executed, And if the behavior of the program is an action that is relatively more frequently used in the malicious code than the normal code, the behavior of the program is isolated from the system and executed How to respond to malicious code. 12. The method of claim 11, Storing the behavior information of the program as a log record How to respond to malicious code. 13. The method of claim 12, When the program performs a malicious action, restores the pre-malicious behavior based on the log record How to respond to malicious code. 12. The method of claim 11, To whitelist a list of safe programs How to respond to malicious code. 15. The method of claim 14, Storing a sample of the program, A sample of a program not registered in the whitelist is received and analyzed to determine whether it is a malicious code, The white list is updated by reflecting the analysis result How to respond to malicious code. 12. The method of claim 11, A copy of the data accessed by the isolated and executed action is isolated from the system and stored How to respond to malicious code. 12. The method of claim 11, The result of the classification by level includes a first level action used only in the normal code, a second level action used relatively more in the normal code than the malicious code, a third level action used relatively more in the malicious code than the normal code, And a fourth level behavior used only in malicious code How to respond to malicious code. 18. The method of claim 17, Allowing execution of the program when the behavior of the program is the first level behavior and the second level behavior and suspending or blocking execution of the program if the behavior of the program is the fourth level behavior How to respond to malicious code. 12. The method of claim 11, And executing an interlocking program used for executing the classified action from the system How to respond to malicious code. 12. The method of claim 11, When a program having a previously defined normal verification code executes an action that operates in malicious code, isolates the action to be executed by the program from the system and executes or blocks the program How to respond to malicious code. 21. The method of claim 20, Wherein when the program having the normal verification code executes an action that operates in the malicious code, Detecting a malicious code executed from the result of the investigation, Reporting the sample of the detected code to the analysis system How to respond to malicious code. A program for executing the method according to any one of claims 11 to 21 is recorded A computer readable recording medium.

Images