KR101044275B1 - Method for curing malicious site, method for gathering information of malicious element, apparatus, system, and recording medium having computer program recorded - Google Patents

Abstract

The present invention relates to a method for treating a malicious site, a method for collecting malicious site information, a recording medium in which a device, a system, and a computer program are recorded. The present invention relates to distributing a malicious compatible program between a site and an application through a data communication network such as the Internet, or to a malicious process. Scan and execute malicious site information and / or malicious site code information to extract and remove malicious elements so that the malicious site can be accessed after treatment. By inspecting and cleaning, even if a newly created web page is visited, you can see whether it is malicious. If the contents of the server are changed, it can be applied immediately, and the site using malicious compatibility programs can be scanned. To provide web documents that change dynamically Can also scan and clean malicious code on the site, and because the browser's exploits will continue to change, but will determine the maliciousness of the binaries that run through the exploit, it has the advantage of collecting and treating variant or suspected exploit code. .

Malicious Sites, Malicious Processes, Malicious Code, ActiveX, Exploit Code

Description

METHOD FOR CURING MALICIOUS SITE, METHOD FOR GATHERING INFORMATION OF MALICIOUS ELEMENT, APPARATUS, SYSTEM, AND RECORDING MEDIUM HAVING COMPUTER PROGRAM RECORDED}

The present invention relates to the treatment of malicious sites, and more particularly, malicious site treatment method for distributing malicious compatible programs between sites and applications through data communication networks such as the Internet, or for treating sites executing malicious processes, and collecting malicious site information. The present invention relates to a recording medium on which a method, a malicious site treatment device, a malicious site information collection device, a malicious site treatment system, and a computer program for performing the malicious site treatment method are recorded.

It is no exaggeration to say that the Internet age has been spreading hacking through the Internet. An attacker hacks a web server and then changes the site's content to his or her purpose. Visiting such a site runs malicious code that the attacker has planted or visits an unwanted site. The number of websites is exploding, but keeping all websites at a constant level is practically difficult, so crackers hack into vulnerable websites to hide malicious code and visit websites. Visitors to sites linked to or linked to websites are infected with malware. In particular, malicious codes are designed to destroy a system or leak confidential information on a user's computer or network, which can cause a serious damage to a user's computer system or security. Malware is software that is intentionally designed to perform malicious activities, such as destroying the system or leaking information, contrary to the user's intentions and interests. Such malicious code types include hacking tools such as viruses, worms, trojans, backdoors, logic bombs, and trap doors, and malicious spywares. spyware and ad-ware. They are equipped with self-replicating or auto-propagating functions, leaking personal information such as IDentification (ID) and password, controlling target system, changing / deleting files, destroying system, denying service of application / system, leaking key data. It causes problems such as installing other hacking programs, and the damage is very diverse and serious.

Others use solutions such as web firewalls to prevent hacking for these web servers. However, these web firewall devices are expensive and are not essential to the web server.

In most cases, newly created malicious code cannot be scanned or repaired with existing computer vaccines. Therefore, if the user is not paying attention, the malicious code spreads rapidly through the network without the administrator of the website server and the visitor of the site not feeling the malware infection.

However, until now, it has been common for website server administrators or users who have been substantially damaged by malicious code to report it to hacked victim sites or vaccine manufacturing sites, so that follow-up actions have been taken. In other words, the detection and response of malicious code is entirely user-reported, and therefore, it was not possible to quickly find an infringing site and prevent the spread of malicious code.

Therefore, in most cases, the malicious code has already spread rapidly until the victim is aware of the damage. Therefore, it is practical to find and punish the original distributor, and to heal and repair all computer systems and servers infected with the malicious code. It was impossible. Therefore, in order to prevent the spread of the damage caused by the malicious code infection, it is urgent to develop a system capable of quickly blocking the malicious code infection and blocking it quickly.

The malicious site inspection technique according to the prior art includes a proxy method and a network filtering method.

The conventional proxy method is a method of receiving and parsing a web document instead of inspecting the web document. The performance is severely degraded because the web document is received and sent to a browser after analysis, and the parser analyzes all web documents. There is a problem that cannot be done.

The conventional network filtering method is a method of filtering all data at an intermediate level of a network, by parsing data or finding a pattern. However, since all data has to be examined, performance is severely degraded, and there is a problem in that malicious code cannot be found for newly created patterns or modified patterns.

In particular, the conventional proxy method and the network filtering method have a problem in that they cannot treat malicious sites because they cannot collect or remove the risk factors included in the malicious sites as well as problems related to the inspection of the malicious sites.

The present invention collects malicious site information and / or malicious site code information by extracting malicious site information and / or malicious site code information by distributing malicious compatible programs between sites and applications or executing malicious processes through a data communication network such as the Internet. Remove

According to the present invention, a site visited by a user and code executed in the site can be inspected by a data communication terminal connected to a data communication network such as the Internet. It monitors the behavior of the browser in real time, examines the code that is about to run on the site that the browser visits, determines whether it is malicious, and removes the code if it is malicious. Since the data communication terminal inspects and treats the site visited by the browser in real time, all sites can be visited safely.

According to a first aspect of the present invention, a malicious site treatment method includes: acquiring site page information when a browsing event of the site is detected by a browser activated for accessing a site provided through a communication network, and the site and application program. Checking whether the compatible program is malicious while acquiring information of the compatible program when the browser loads the interoperable program is detected; and extracting and removing the compatible program when the compatible program is identified as malicious, and then treating it. And acquiring the site page information, the information of the compatible program, and the treatment information of the site as malicious site information.

The treatment method may include setting an environment for monitoring an event of the browser to obtain the site page information, and monitoring a load of the compatible program by the browser to obtain information of the compatible program. The method may further include setting an environment.

The event may be generated and monitored by a connection program called and executed by the browser.

The connection program may be a browser helper object.

The load can be monitored by hooking the identifier of the dynamic link library file.

The compatible program is ActiveX, the dynamic link library file is URLMon.dll, and the identifier may be a CoGetClassObject function.

In the treatment method, when the search event is detected, the malicious site information may be used before the acquisition of the site page information to determine whether the malicious site is malicious.

The treatment method may store the malicious site information or transmit the information through the communication network.

The site page information can be obtained by using thread identification information as a key.

Acquiring the site page information, after checking whether the thread has a web link node in the acquired site page information, registers as a main web link node if there is no web link node, but if the thread has the web link node, a frame web link You can register as a node.

The malicious site information may be obtained by connecting the site page information and the information of the compatible program.

The malicious site information, when the compatible program is identified as malicious, finds the web link node in the site page information by referring to the thread identification information that loads the compatible program by referring to the information of the compatible program. Parsing the web document of the node to check whether the corresponding compatible program tag exists, and if the compatible program tag exists, the corresponding web link node can be obtained as the malicious site information.

The malicious site information may acquire the malicious site information for a child web link node when the compatible program tag is not present in the corresponding web link node.

Acquiring site code information together with the site page information when the search event is detected; and, in the treatment method, checking whether the file is malicious while acquiring process information when a file load is detected; If it is confirmed that the abnormal execution of the file, and if the abnormal execution of the file is confirmed by extracting and removing the file while the site page information, the site code information, the process information and the treatment of the site The method may further include obtaining information as malicious site code information.

According to a second aspect of the present invention, there is provided a method for treating a malicious site, the method comprising: acquiring site page information and site code information when a detection event of the site is detected by a browser activated for access to a site provided through a communication network; Checking whether the file is malicious while acquiring process information when the load of the file is detected; checking whether the file is abnormally executed when the file is identified as malicious; and if abnormal execution of the file is confirmed; The method may include obtaining the site page information, the site code information, the process information, and the treatment information of the site as malicious site code information while extracting and removing a file and treating the file.

The treatment method may include setting an environment for monitoring an event of the browser for obtaining the site page information and site code information, and setting an environment for monitoring the loading of the file for obtaining the process information. It may further comprise the step.

The event may be generated and monitored by a connection program called and executed by the browser.

The connection program may be a browser helper object.

The load may be monitored by hooking an identifier of the browser process.

The treatment method may hook the identifier of the new browser process if the file is found to be not malicious.

The identifier may be a CreateProcess function.

In the treatment method, when the search event is detected, the malicious site code information may be used before the acquisition of the site page information and the site code information to determine whether the malicious site is malicious.

The abnormal execution may determine whether the file is executed by a compatible program between the site and an application program or by a user.

The treatment method may store or transmit the malicious site code information through the communication network.

The site page information and site code information can be obtained by using thread identification information as a key.

Acquiring the site page information and site code information, after confirming whether the thread has a web link site code node in the acquired site code information, registers as a main web link site code node if there is no web link site code node, but the thread If the web link site code node is present, the web link site code node may be registered as a frame web link site code node.

The malicious site code information includes, as the malicious site code information, the site page information and site code information having a thread identification information as a key in the parent information together with the parent information of the current process in the process information. Can be obtained.

The treatment method may further include acquiring the site page information as malicious site information when the normal execution of the file is confirmed.

According to a third aspect of the present invention, it is possible to provide a recording medium on which a computer program for performing the above-described malicious site treatment method is recorded.

The malicious site information collection method according to the fourth aspect of the present invention is a method of collecting malicious site information by using a method of treating a malicious site that distributes a malicious compatible program between a site and an application program through a communication network. The method may include acquiring site page information when a search event of the site is detected by a browser activated for accessing the site, and when the load of the browser is detected for a compatible program between the site and an application program. Checking whether the compatible program is malicious while acquiring information of a compatible program; and if the compatible program is identified as malicious, extracting and removing the compatible program, and treating the site program information and information of the compatible program and the site. Treatment of the malignant remind And a step of acquiring a byte information, and wherein the collecting is, by collecting the malicious site information through the communication network can databasing.

The malicious site information collection method according to the fifth aspect of the present invention is a method of collecting malicious site code information by using a method of treating a malicious site that executes a malicious process, and the treating method includes accessing the site. Acquiring site page information and site code information when a browsing event of the site is detected by a browser that is activated for the purpose of detecting the site; and confirming whether the file is malicious while acquiring process information when a load of the file is detected; Determining whether the file is abnormally executed if the file is identified as malicious; and extracting and removing the file and treating the file if the file is abnormally executed, and treating the site page information, the site code information, the process information, and the Malicious site code information of the site's treatment information And a step of obtaining, the method for the collection, it is possible to collect the malignant site code information through a communication network databasing.

Malicious site treatment apparatus according to a sixth aspect of the present invention, the browsing event of the site by the browser is activated for access of the site provided through the communication network and the load of the browser for the compatible program between the site and the application program An event monitoring unit for detecting and detecting a load of the compatible program when the event monitoring unit detects the malicious program, and removes and removes the compatible program when the malicious program is detected as malicious, and the event Acquire site page information when the search event is detected by the monitoring unit, obtain information of the compatible program when the load of the compatible program is detected by the event monitoring unit, and obtain the information of the compatible program by the malicious element removing unit. Once site is extracted and removed And the information and treatment information of the site of the compatible programs can include information management to obtain information to a malicious site.

Here, the event monitoring unit may generate a connection program called and executed by the browser to monitor the event.

The connection program may be a browser helper object.

The event monitor may hook an identifier of a dynamic link library file to monitor the load.

The compatible program is ActiveX, the dynamic link library file is URLMon.dll, and the identifier may be a CoGetClassObject function.

When the search event is detected by the event monitoring unit, the malicious element removal unit may use the malicious site information to check whether the malicious element is malicious, and, when the malicious element is malicious, treat the corresponding site.

The treatment apparatus may further include an information storage unit which stores the malicious site information.

The treatment apparatus may further include a data communication unit configured to transmit the malicious site information through the communication network.

The information manager may acquire the site page information by using thread identification information as a key.

The information manager, after checking whether the thread has a web link node in the acquired site page information, registers as a main web link node if there is no web link node, but registers as a frame web link node if the thread has the web link node. can do.

The information manager may obtain the malicious site information by connecting the site page information and the information of the compatible program.

If the compatible program is identified as malicious by the malicious element removal unit, the information manager refers to the web link node in the site page information by referring to the thread identification information that loads the compatible program by referring to the information of the compatible program. Find and check whether the compatible program tag exists by parsing the web document of the web link node, and if the compatible program tag exists, the web link node may be obtained as the malicious site information.

If the corresponding web link node does not have the compatible program tag, the information manager may acquire the malicious site information for a child web link node.

The event monitoring unit detects the load of the file, and the malicious element removing unit checks whether the file is malicious when the load of the file is detected by the event monitoring unit, and when the file is identified as malicious, abnormal of the file. Check whether it is executed, and the information manager acquires site code information together with the site page information when the search event is detected by the event monitor, and when the load of the file is detected by the event monitor, When the information is obtained and abnormal execution of the file is confirmed by the malicious element removing unit, the site page information, the site code information, and the process information may be obtained as malicious site code information.

Malicious site treatment apparatus according to a seventh aspect of the present invention, the event monitoring unit for detecting the load of the browsing events and files of the site by the browser is activated for access to the site provided through the communication network, and the event monitoring unit When the load of the file is detected by checking whether the file is malicious, if the file is identified as malicious, after checking whether the file is abnormally executed, and if it is determined to be abnormally executed, extracts and removes the file and removes the malicious component. When the search event is detected by the event monitoring unit, the corresponding site page information and site code information are obtained. When the load of the file is detected by the event monitoring unit, the process information is obtained. When the file is extracted and removed by the remover, the site page Information and treatment information for the site code information, said process information, and the site may contain information management to obtain code information to a malicious site.

Here, the event detector may generate a connection program called and executed by the browser to monitor the event.

The connection program may be a browser helper object.

The event detector may hook an identifier of a browser process to monitor the load.

The event detection unit may hook an identifier of a new browser process when the malicious code detection unit determines that the file is not malicious.

The identifier may be a CreateProcess function.

When the search event is detected by the event detection unit, the malicious element removal unit checks whether or not the malicious site is malicious by using the malicious site code information, and, in the case of malicious, may treat the corresponding site.

The malicious element removal unit may check whether the file is abnormally executed by checking whether the file is executed by a compatible program between the site and an application program or by a user.

The treatment apparatus may further include an information storage unit which stores the malicious site code information.

The treatment apparatus may further include a data communication unit configured to transmit the malicious site code information through the communication network.

The information manager may acquire the site page information and the site code information by using thread identification information as a key.

The information manager checks whether the thread has a web link site code node in the acquired site code information, and if the web link site code node is not present, registers as a main web link site code node, but the web link site code node in the thread. If present, the site page information and site code information can be obtained by registering as a frame web link site code node.

The information manager may acquire the site page information and the site code information using the thread identification information as a key from the parent information together with the parent information of the current process among the process information as the malicious site code information. Can be.

The information management unit may acquire the site page information as malicious site information when the normal execution of the file is confirmed by the malicious element removing unit.

The malicious site information collecting device according to the eighth aspect of the present invention is a device for collecting malicious site information by using a device for treating malicious sites distributing malicious compatible programs between sites and applications through a communication network. If the compatible program loaded by the browser activated for access to the site is identified as malicious, the device extracts and removes the compatible program, and then treats the malicious page information, the information of the compatible program, and the treatment information of the corresponding site. Acquiring the site information, the collecting device may include a data collection server for collecting the malicious site information through the communication network, and a malicious site database for storing the database of malicious site information.

A malicious site information collecting device according to a ninth aspect of the present invention is a device for collecting malicious site code information by using a device for treating a malicious site that executes a malicious process, wherein the treating device is configured to access the site. If the file loaded by the browser activated by the browser is identified as malicious and abnormally executed, the file is extracted, removed, and cleaned, and the site page information, site code information, process information, and the site's cleaning information are converted into malicious site code information. The acquiring and collecting device may include a data collection server that collects the malicious site code information through a communication network, and a malicious site database that stores the malicious site code information in a database.

The malicious site treatment system according to the tenth aspect of the present invention is a system for distributing a malicious compatible program between a site and an application through a communication network or for treating a malicious site executing a malicious process. When the compatible program loaded by the browser is identified as malicious, the file which acquires or loads the corresponding site page information, the information of the compatible program and the site cleaning information as malicious site information is identified as malicious while extracting and deleting the compatible program and treating it. A data communication terminal including a malicious site treatment device which extracts and deletes the file and treats the site page information, the site code information, the process information, and the site treatment information as malicious site code information when it is determined to be abnormally executed; barrel And a malicious site information collecting device including a malicious data collection server for collecting the malicious site information or the malicious site code information through a trust network, and a malicious site database for storing the malicious site information or the malicious site code information. Can be.

According to an embodiment of the present invention, while acquiring and collecting malicious site information and / or malicious site code information by inspecting a site for distributing malicious compatible programs between sites and applications or executing a malicious process through a data communication network such as the Internet, etc. By extracting and removing malicious elements, the malicious site can be accessed after treatment.

In addition, by inspecting and treating malicious sites with a data communication terminal equipped with a browser, it is possible to know whether or not even newly created web pages are malicious by simply visiting them, and when the contents of the server are changed, the contents can be immediately applied. It can also scan sites that use malicious-compatible programs, and even scan and repair malicious code for sites that deliver dynamically changing web documents (such as ajax).

In addition, browser exploits continue to change, but because they determine the malicious nature of binaries executed through exploits, they can collect and disinfect variants or suspect exploit code.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims.

In describing the embodiments of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the embodiments of the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be based on the contents throughout this specification.

Combinations of each block of the accompanying block diagram and each step of the flowchart may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flow chart step of the block diagram. Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative embodiments, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

1 is a network configuration diagram of a malicious site treatment system according to an embodiment of the present invention, Figure 2 is a detailed configuration diagram of a malicious site treatment apparatus according to an embodiment of the present invention, Figure 3 according to an embodiment of the present invention Detailed configuration diagram of a malicious site information collection device.

1 to 3 is a malicious site treatment system according to an embodiment of the present invention, a browser that is a client program that requests data from or receives data from a web server through a data communication network 200 such as the Internet ( 110) and a data communication terminal 100 including a malicious site treatment apparatus 120 for distributing malicious compatible programs between sites and applications in a web environment or inspecting and treating sites executing malicious processes, and a malicious site treatment apparatus. The malicious site information collecting device 300 collects malicious site information and malicious site code information through the data communication network 200 according to the malicious site inspection result by 120.

The malicious site treatment apparatus 120 includes an event monitoring unit 121, a malicious element removing unit 123, an information managing unit 125, an information storing unit 127, a data communication unit 129, and the like.

Event monitoring unit 121 is a site navigation event by the browser 110 is activated for access to the site provided through the data communication network 200, the load of the browser 110 for the compatible program between the site and the application, Detect load of file, etc. To this end, we set up a monitoring environment, which creates a linked program called and executed by the browser 110 to monitor the event, hooking the identifier of the dynamic link library file to monitor the loading of the compatible program, Hook the identifier of the browser process to monitor the loading of the file.

When the malicious component removal unit 123 detects a load of a compatible program or file by the event monitoring unit 121, the malicious component removal unit 123 checks whether the compatible program or the file is malicious. Extract and remove malicious elements.

The information manager 125 acquires the corresponding site page information when the search event is detected by the event monitor 121, and obtains the corresponding program information when the load of the compatible program is detected by the event monitor 121. When the load of the file is detected by the event monitoring unit 121, process information is acquired. When the malicious element is extracted and removed by the malicious element removing unit 123, site page information, compatible program information, process information, and site cleaning information. Etc. are obtained as malicious site information.

The information storage unit 127 stores site page information, compatible program information, process information, site treatment information, and the like obtained by the information management unit 125. The information storage unit 127 stores the relevant data by using the internal memory or the like, or when the information management unit 125 transmits the related data in real time between the malicious site information collecting apparatus 300 through the data communication unit 129. May be omitted.

The data communication unit 129 collects malicious site information, such as site page information, compatible program information, process information, and site treatment information, obtained by the information manager 125 through the data communication network 200. Send to. When the malicious site treatment apparatus 120 is independently driven without mutually transmitting related data such as malicious site information between the malicious site treatment apparatus 120 and the malicious site information collection apparatus 300, the data communication unit 129 may be driven independently. May be omitted.

The malicious site information collecting device 300 collects malicious site information and the like from the malicious site treating apparatus 120 through the data communication network 200 and makes a database. The malicious site information collecting device 300 includes a data collection server 310 and a malicious site database 320.

The data collection server 310 collects malicious site information and the like from the malicious site treatment apparatus 120 through the data communication network 200, and the malicious site database 320 is a malicious site databased by the data collection server 310. Store information and more.

4 and 5 are diagrams for explaining a method for treating a malicious site for distributing a malicious compatible program between a site and an application in a web environment by the apparatus for treating a malicious site according to the present invention. FIG. 4 is a flowchart. 5 is a conceptual diagram.

Referring to FIGS. 1 to 5, the process of treating malicious sites distributing malicious compatible programs between sites and applications in a web environment is as follows.

First, the malicious site treatment apparatus 120 is installed and mounted on the data communication terminal 100 that drives the browser 110, and the browser 110 is installed on a website through a data communication network 200 of a web environment such as the Internet. When connected, malicious sites that distribute malicious compatibility programs between the site and the application are scanned and repaired.

To this end, the event monitoring unit 121 of the malicious site treatment apparatus 120 is called and executed by the activated browser 110 to monitor the occurrence of events by the browser 110 to monitor the events of the browser 110. Create a connection program that you can. For example, when the browser 110 is an explorer of Microsoft, a browser helper object is created (S401).

In addition, the event monitor 121 hooks the identifier of the dynamic link library file to monitor the browser 110 loading a compatible program between a site and an application program such as ActiveX. For example, the CoGetClassObject function of URLMon.dll is monitored (S403).

As such, when the event that the browser 110 finds an arbitrary URL occurs while the event monitoring unit 121 monitors the event (S405) (S407), for example, when the NavigateComplete is called, the event monitoring unit 121 makes an event. The event is detected, and the event monitoring unit 121 informs the information management unit 125 of the malicious site treatment apparatus 120 of the occurrence of the event.

Then, the information management unit 125 checks whether there is a web link node in the thread in the site page list information stored in the information storage unit 127 of the malicious site treatment apparatus 120, and if there is no web link node, If there is a node in the US thread that registers the top node as the web link node, it registers as a frame web link node to update the site page list information of the information storage unit 127 (S413).

On the other hand, if the browser 110 attempts to load (execute or download a compatible program) between the site and the application, the identifier of the dynamic link library file, for example, the CoGetClassObject function is called, and the event monitoring unit 121 that detects the compatible program is compatible. The loading state of the program is notified to the malicious element removing unit 123 and the information managing unit 125 of the malicious site treating apparatus 120 (S415).

Then, the information manager 125 updates the compatible program information stored in the information storage 127. For example, the ActiveX list information is updated (S417).

In addition, the malicious element removal unit 123 drives a malicious code inspection engine to check whether the compatible program is malicious code (S419).

If the compatible program is determined to be malicious code, the malicious element removing unit 123 informs the information management unit 125 that the compatible program to be loaded by the browser 110 is malicious code (S421).

Then, the information manager 125 finds the web link node in the site page list information by using the thread identification information for loading the compatible program as a key by referring to the compatible program information stored in the information storage unit 127. The web document of the web link node (eg, hypertext markup language (HTML)) is parsed to check whether there is a corresponding compatible program tag, for example, an ActiveX tag. If there is a compatible program tag, this weblink node is the malicious weblink node that attempts to load the malicious compatible program. If the current node is not present, malicious site information is acquired by searching for the child node as described above (S423).

In this way, when the information manager 125 acquires malicious site information, the information manager 125 may store the malicious site information in the information storage 127. Alternatively, the malicious site information is transmitted to the data communication unit 129, and the data communication unit 129 transmits the malicious site information to the malicious site information collecting device 300 through the data communication network 200 (S425).

Then, the data collection server 310 of the malicious site information collecting device 300 collects malicious site information transmitted from the malicious site treating apparatus 120, and makes a database and stores the malicious site information in the malicious site database 320.

In addition, the malicious element removal unit 123 extracts and removes a malicious compatible program and then, when the page including the corresponding compatible program determined as malicious code is loaded, repairs the corresponding site (S427), and removes the malicious element 123. ), The site treatment information is obtained by the information management unit 125 (S429) and stored in the information storage unit 127 (S431).

Alternatively, the information manager 125 transmits the acquired site treatment information to the data communication unit 129, and the data communication unit 129 transmits the site treatment information to the malicious site information collecting device 300 through the data communication network 200. It transmits (S431).

Then, the data collection server 310 of the malicious site information collecting device 300 collects the site treatment information transmitted from the malicious site treatment device 120, and makes a database and stores the database in the malicious site database 320.

Therefore, the browser 110 accesses a site from which the malicious code has been removed by the malicious site treatment apparatus 120, that is, a site from which the malicious compatible program has been removed, and the information and screen of the corresponding site through the data communication terminal 100. It provides (S433).

Meanwhile, malicious site information is accumulated in the information storage unit 127 or the malicious site database 320 by performing steps S415 to S431. In this case, according to the preferred embodiment, after step S407, a malicious test using pre-stored malicious site information is performed without performing step S413 immediately (S409). When the navigation event of the browser 110 is detected by the event monitoring unit 121, the malicious element removing unit 123 receives the malicious site information stored in the information storage unit 127 or the malicious site database 320, and the browser ( When 110 is not determined to be malicious after comparing the web link information and the malicious site information to be accessed, the process is performed from step S413. If it is determined as malicious, the process is performed from step S427.

6 and 7 are diagrams for explaining a method for treating a malicious site executing a malicious process in a web environment by the apparatus for treating a malicious site according to the present invention. FIG. 6 is a flowchart and FIG. 7 is a conceptual diagram.

Referring to FIGS. 1 to 3, 6, and 7, a process of checking a malicious site executing a malicious process in a web environment will be described below.

First, the malicious site treatment apparatus 120 is installed and mounted on the data communication terminal 100 driving the browser 110, the browser 110 is a website through a data communication network 200 of a web environment, such as the Internet Scans and repairs malicious sites running malicious processes when connected to

To this end, the event monitoring unit 121 of the malicious site treatment apparatus 120 is called and executed by the activated browser 110 to monitor the occurrence of events by the browser 110 to monitor the events of the browser 110. Create a connection program that you can. For example, when the browser 110 is an explorer of Microsoft, a browser helper object is created (S501).

In addition, the event monitor 121 hooks an identifier of a browser process to monitor a process executed by a compatible program between a site and an application program such as ActiveX. For example, the CreateProcess function of the browser process is monitored (S503).

As such, when an event in which the browser 110 finds an arbitrary URL occurs while monitoring the event of the browser 110 (S505), the event is detected by the event monitoring unit 121 when NavigateComplete is called. The event monitoring unit 121 informs the information management unit 125 of the malicious site treatment apparatus 120 of the occurrence of the corresponding event (S507).

Then, the information manager 125 checks whether there is a web link node in the corresponding thread in the site page list information stored in the information storage unit 127 of the malicious site treatment apparatus 120. At this time, if there is no web link node, the top node is registered as the main web link node, but if there is already a node in the thread, it is registered as a frame web link node to update the site page list information of the information storage unit 127. In addition, the information management unit 125 checks whether there is a web link site code node in the corresponding thread in the site page code list information stored in the information storage unit 127, and if there is no web link site code node, it registers as a main web link site code node. If the thread has a web link site code node, it is registered as a frame web link site code node to update site page code list information of the information storage unit 127 (S515).

On the other hand, when a new process is to be created or a file is loaded (executed or downloaded) by a compatible program between a site and an application program such as ActiveX, the identifier of the browser process being hooked, for example, the CreateProcess function is called. Then, the event monitoring unit 121 which detects this informs the process execution situation to the malicious element removing unit 123 and the information managing unit 125 of the malicious site treatment apparatus 120 (S517).

Then, the information management unit 125 checks the thread identification information of the target invoking the identifier of the browser process, and finds the same thread identification information using the thread identification information as a key in the site page code list information stored in the information storage unit 127. Check the top-level weblink code node for that thread. In addition, the process node is added to the process list stored in the information storage unit 127, and the highest web link node identified above is connected as a related web link node of the added process node (S519).

In addition, the malicious element removal unit 123 determines whether a process that is about to be executed by driving a malicious code inspection engine (S521) according to the process execution situation informed by the event monitoring unit 121, and the corresponding process is malicious code. If not, the result is notified to the event monitoring unit 121 (S523).

Then, the event monitor 121 hooks the identifier of the newly created browser process. For example, the CreateProcess function of the browser process is monitored (S525).

Therefore, when a process created by the browser 110 tries to create a new process again, an identifier of a browser process that is hooking, for example, a CreateProcess function is called. Then, the event monitoring unit 121 which detects this informs the process execution situation to the malicious element removing unit 123 and the information managing unit 125 of the malicious site treatment apparatus 120.

Then, the information management unit 125 finds the process calling the identifier of the browser process in the process list stored in the information storage unit 127 and adds a process node to be newly created as a child node.

In addition, the malicious element removal unit 123 checks whether the process to be executed according to the process execution situation informed by the event monitoring unit 121 is malicious code, and if the corresponding process is not malicious code, steps S525 and S517 to The process of S523 is performed again. The processes of steps S525, S517 to S523 are repeatedly performed each time the process is executed.

If the process executed in step S523 is determined to be a malicious process, the malicious element removing unit 123 checks whether the current file execution is a normal file execution or an abnormal file execution. In this case, normal file execution refers to execution by a compatible program such as ActiveX or direct execution by the user, and abnormal file execution refers to execution by a browser exploit. Therefore, if it is confirmed that the execution by the compatible program is not executed by the compatible program after checking whether the execution by the user again, if it is not already determined that the browser exploit is executed, that is, abnormal execution. The malicious element removal unit 123 informs the information management unit 125 of the determination result of the file execution (S527).

If the current file execution is determined to be abnormal file execution, the information management unit 125 obtains malicious site code information connected to the malicious process by referring to the web link code information stored in the information storage unit 127, and obtains the obtained malicious site code. The site code information is stored in the information storage unit 127 or transmitted to the data communication unit 129. Then, the data communication unit 129 transmits the malicious site code information to the malicious site information collecting device 300 through the data communication network 200 (S529).

If the current file execution is determined to be normal file execution, the information management unit 125 acquires malicious site information and stores it in the information storage unit 127 or collects malicious site information as in steps S423 and S425 described with reference to FIG. 4. It transmits to 300 (S531).

Then, the data collection server 310 of the malicious site information collecting device 300 collects malicious site information and / or malicious site code information transmitted from the malicious site treating apparatus 120, and forms a database to form a malicious site database ( Save to 320).

In addition, the malicious element removal unit 123 extracts and removes a malicious file to treat the corresponding site when loading a page including the corresponding file determined as malicious (S533), and by the malicious element removal unit 123 The site treatment information is obtained by the information manager 125 (S535) and stored in the information storage unit 127 (S537).

Alternatively, the information manager 125 transmits the acquired site treatment information to the data communication unit 129, and the data communication unit 129 transmits the site treatment information to the malicious site information collecting device 300 through the data communication network 200. It transmits (S537).

Then, the data collection server 310 of the malicious site information collecting device 300 collects the site treatment information transmitted from the malicious site treatment device 120, and makes a database and stores the database in the malicious site database 320.

Therefore, the browser 110 accesses a site from which the malicious code is removed by the malicious site treating apparatus 120, that is, a site from which the malicious file has been removed, and displays information and a screen of the corresponding site through the data communication terminal 100. Provided (S539).

Meanwhile, malicious site information and malicious site code information are accumulated in the information storage unit 127 or the malicious site database 320 by performing steps S517 to S537. According to a preferred embodiment in this case, after step S507, the malicious inspection using the accumulated malicious site information and malicious site code information is performed without performing step S515 immediately. When the navigation event of the browser 110 is detected by the event monitoring unit 121, the malicious element removing unit 123 may download the malicious site information and the malicious site code information stored in the information storage unit 127 or the malicious site database 320. If not determined to be malicious after comparing the web link information and malicious site information and malicious site code information that the browser 110 attempts to access to check whether it is malicious, the process is performed from step S515, but if it is determined to be malicious Starting from S533.

In the above-described embodiments, the method of checking and treating malicious sites for distributing malicious compatible programs and the method of checking and treating malicious sites for executing malicious processes are separately described. The processes may be attributed to the process of scanning and treating malicious sites. For example, when the compatible program is not determined to be malicious in step S421, the malicious file is extracted and removed by performing steps S517 and subsequent steps. For this purpose, steps S503 and S515 should be executed first. In this case, the process of step S531 may be omitted, thereby preventing the malicious site information from being repeatedly collected.

1 is a network diagram of a malicious site treatment system according to the present invention;

2 is a detailed configuration diagram of a malicious site treatment apparatus according to the present invention;

3 is a detailed configuration diagram of an apparatus for collecting malicious site information according to the present invention;

4 is a flowchart illustrating a method for checking a malicious site for distributing malicious compatible programs between a site and an application in a web environment by the apparatus for treating a malicious site according to the present invention;

5 is a conceptual diagram illustrating a method of treating a malicious site for distributing malicious compatible programs according to the present invention;

6 is a flowchart illustrating a method of treating a malicious site executing a malicious process in a web environment by a malicious site treating apparatus according to the present invention;

7 is a conceptual diagram illustrating a method of treating a malicious site executing a malicious process according to the present invention.

<Explanation of symbols for main parts of the drawings>

100: data communication terminal 110: browser

120: malicious site treatment device 121: event detection unit

123: remove malicious elements 125: information management unit

127: information storage unit 129: data communication unit

200: data communication network 300: malicious site information collection device

310: data collection server 320: malicious site database

Claims (62)

delete delete delete Setting an environment for monitoring a browsing event of the site by a browser activated for access to a site provided over a communication network; Setting an environment for monitoring the load of the browser for a compatible program between the site and an application program; Acquiring site page information when the event is detected; Checking whether the compatible program is malicious while acquiring the information of the compatible program when the load of the browser is detected on the compatible program; If the compatible program is identified as malicious, extracting and removing the compatible program and then treating the site program, acquiring information of the compatible program and treatment information of the site as malicious site information; The event is generated and monitored by a linked program called and executed by the browser, The connection program is a browser helper object. How to treat malicious sites. The method of claim 4, wherein The load hooks and monitors the identifier of the dynamic link library file. How to treat malicious sites. The method of claim 5, The compatible program is ActiveX, the dynamic link library file is URLMon.dll, and the identifier is a CoGetClassObject function. How to treat malicious sites. The method of claim 4, wherein The treatment method, if the search event is detected before the acquisition of the site page information using the malicious site information to determine whether or not malicious to treat the corresponding site How to treat malicious sites. The method of claim 4, wherein The treatment method may include storing the malicious site information or transmitting the information through the communication network. How to treat malicious sites. Acquiring site page information when a browsing event of the site is detected by a browser activated for accessing a site provided through a communication network; Checking whether the compatible program is malicious while acquiring the information of the compatible program when the load of the browser for the compatible program between the site and the application is detected; If the compatible program is identified as malicious, extracting and removing the compatible program and then treating the site program, acquiring information of the compatible program and treatment information of the site as malicious site information; The site page information is obtained by using thread identification information as a key. How to treat malicious sites. The method of claim 9, Acquiring the site page information, after checking whether the thread has a web link node in the acquired site page information, registers as a main web link node if there is no web link node, but if the thread has the web link node, a frame web link Register as a node How to treat malicious sites. The method of claim 9, The malicious site information is obtained by linking the site page information with information of the compatible program. How to treat malicious sites. 11. The method of claim 10, The malicious site information, when the compatible program is identified as malicious, finds the web link node in the site page information by referring to the thread identification information that loads the compatible program by referring to the information of the compatible program. Parsing the web document of the node to check whether the corresponding compatible program tag exists, and if the compatible program tag exists, obtaining the corresponding web link node as the malicious site information. How to treat malicious sites. 13. The method of claim 12, The malicious site information may be configured to obtain the malicious site information for a child web link node if the corresponding program link node does not have the compatible program tag. How to treat malicious sites. The method of claim 9, When the search event is detected, the site code information is acquired along with the site page information. The treatment method, Checking whether the file is malicious while acquiring process information when a load of the file is detected; If the file is found to be malicious, checking whether the file is abnormally executed; Acquiring the site page information, the site code information, the process information, and the treatment information of the site as malicious site code information while extracting and removing the file and treating the file if abnormal execution of the file is confirmed; Malicious site treatment method comprising more. delete delete delete Setting an environment for monitoring a browsing event of the site by a browser activated for access to a site provided over a communication network; Setting up an environment to monitor the loading of files, Acquiring site page information and site code information when a navigation event of the site is detected; Checking whether the file is malicious while acquiring process information when a load of the file is detected; If the file is found to be malicious, checking whether the file is abnormally executed; Acquiring the site page information, the site code information, the process information, and the treatment information of the site as malicious site code information while extracting and removing the file and treating the file when abnormal execution of the file is confirmed, The event is generated and monitored by a linked program called and executed by the browser, The connection program is a browser helper object. How to treat malicious sites. The method of claim 18, The load hooks and monitors the identifier of the browser process. How to treat malicious sites. The method of claim 19, The treatment method hooks an identifier of a new browser process if it is determined that the file is not malicious. How to treat malicious sites. The method of claim 19, The identifier is a CreateProcess function How to treat malicious sites. The method of claim 18, The treatment method, if the search event is detected before the acquisition of the site page information and the site code information before using the malicious site code information to determine whether or not malicious to treat the corresponding site How to treat malicious sites. The method of claim 18, Whether or not the abnormal execution, whether the file is executed by a compatible program between the site and the application or executed by the user How to treat malicious sites. The method of claim 18, The treatment method may store the malicious site code information or transmit the information through the communication network. How to treat malicious sites. Acquiring site page information and site code information when a navigation event of the site is detected by a browser activated for access to a site provided through a communication network; Checking whether the file is malicious while acquiring process information when a load of the file is detected; If the file is found to be malicious, checking whether the file is abnormally executed; Acquiring the site page information, the site code information, the process information, and the treatment information of the site as malicious site code information while extracting and removing the file and treating the file if abnormal execution of the file is confirmed, The site page information and site code information are obtained by using thread identification information as a key. How to treat malicious sites. The method of claim 25, Acquiring the site page information and site code information, after confirming whether the thread has a web link site code node in the acquired site code information, registers as a main web link site code node if there is no web link site code node, but the thread If there is a web link site code node in the registration as a frame web link site code node How to treat malicious sites. Acquiring site page information and site code information when a navigation event of the site is detected by a browser activated for access to a site provided through a communication network; Checking whether the file is malicious while acquiring process information when a load of the file is detected; If the file is found to be malicious, checking whether the file is abnormally executed; Acquiring the site page information, the site code information, the process information, and the treatment information of the site as malicious site code information while extracting and removing the file and treating the file when abnormal execution of the file is confirmed, The malicious site code information includes, as the malicious site code information, the site page information and site code information having a thread identification information as a key in the parent information together with the parent information of the current process in the process information. Acquired How to treat malicious sites. 28. The method of claim 27, The treatment method may include acquiring the site page information as malicious site information when the normal execution of the file is confirmed. Malicious site treatment method comprising more. A recording medium having recorded thereon a computer program for performing the method for treating malignant sites according to any one of claims 4 to 14 or any one of claims 18 to 28. This method collects malicious site information by using a method of treating malicious sites that distribute malicious compatible programs between sites and applications through a communication network. The treatment method, Acquiring site page information when a browsing event of the site is detected by a browser activated for accessing the site; Checking whether the compatible program is malicious while acquiring the information of the compatible program when the load of the browser for the compatible program between the site and the application is detected; Acquiring the site page information, the information of the compatible program, and the treatment information of the site as the malicious site information while extracting, removing, and treating the compatible program if the compatible program is identified as malicious; Including; The collection method, Collecting the malicious site information through the communication network and making a database; The site page information is obtained by using thread identification information as a key. How to collect malicious site information. A method of collecting malicious site code information by using a method for cleaning up malicious sites that execute malicious processes. The treatment method, Acquiring site page information and site code information when a browsing event of the site is detected by a browser activated for accessing the site; Checking whether the file is malicious while acquiring process information when a load of the file is detected; If the file is found to be malicious, checking whether the file is abnormally executed; Acquiring the site page information, the site code information, the process information, and the treatment information of the site as malicious site code information while extracting and removing the file and treating the file if abnormal execution of the file is confirmed; Including; The collection method, The malicious site code information is collected and databased through a communication network, The site page information and site code information are obtained by using thread identification information as a key. How to collect malicious site information. delete delete An event monitoring unit for detecting a browsing event of the site by a browser activated for access of a site provided through a communication network and loading of the browser on a compatible program between the site and an application program; When the load of the compatible program is detected by the event monitoring unit, the malicious component removal unit for checking the malicious status of the compatible program and extracting and removing the compatible program if the malicious program is confirmed as malicious; When the search event is detected by the event monitoring unit, site page information is acquired. When the load of the compatible program is detected by the event monitoring unit, information of the compatible program is obtained. When the compatible program is extracted and removed includes an information management unit for acquiring the site page information, information of the compatible program and treatment information of the site as malicious site information, The event monitoring unit generates a connection program that is called and executed by the browser to monitor the event, The connection program is a browser helper object. Malicious site treatment device. 35. The method of claim 34, The event monitoring unit hooks an identifier of a dynamic link library file to monitor the load. Malicious site treatment device. 36. The method of claim 35, The compatible program is ActiveX, the dynamic link library file is URLMon.dll, and the identifier is a CoGetClassObject function. Malicious site treatment device. 35. The method of claim 34, The malicious element removal unit checks whether the malicious event is malicious by using the malicious site information when the search event is detected by the event monitoring unit to treat the corresponding site when the malicious event is malicious. Malicious site treatment device. 35. The method of claim 34, The treatment device, an information storage unit for storing the malicious site information Malicious site treatment device further comprising. 35. The method of claim 34, The treatment device is a data communication unit for transmitting the malicious site information through the communication network. Malicious site treatment device further comprising. An event monitoring unit for detecting a browsing event of the site by a browser activated for access of a site provided through a communication network and loading of the browser on a compatible program between the site and an application program; When the load of the compatible program is detected by the event monitoring unit, the malicious component removal unit for checking the malicious status of the compatible program and extracting and removing the compatible program if the malicious program is confirmed as malicious; When the search event is detected by the event monitoring unit, site page information is acquired. When the load of the compatible program is detected by the event monitoring unit, information of the compatible program is obtained. When the compatible program is extracted and removed includes an information management unit for acquiring the site page information, information of the compatible program and treatment information of the site as malicious site information, The information management unit obtains the site page information by using thread identification information as a key. Malicious site treatment device. 41. The method of claim 40, The information manager, after checking whether the thread has a web link node in the acquired site page information, registers as a main web link node if there is no web link node, but registers as a frame web link node if the thread has the web link node. doing Malicious site treatment device. 41. The method of claim 40, The information management unit obtains the malicious site information by connecting the site page information and the information of the compatible program. Malicious site treatment device. 42. The method of claim 41 wherein If the compatible program is identified as malicious by the malicious element removal unit, the information manager refers to the web link node in the site page information by referring to the thread identification information that loads the compatible program by referring to the information of the compatible program. Finding and parsing the web document of the web link node to determine whether the compatible program tag (tag) exists and if the compatible program tag is present to obtain the web link node as the malicious site information Malicious site treatment device. 44. The method of claim 43, If the corresponding web link node does not have the compatible program tag, the information manager acquires the malicious site information for a child web link node. Malicious site treatment device. 41. The method of claim 40, The event monitor detects a load of a file, The malicious element removal unit checks whether the file is malicious when the load of the file is detected by the event monitoring unit, and checks whether the file is abnormally executed when the file is identified as malicious, The information manager acquires site code information together with the site page information when the search event is detected by the event monitor, and obtains process information when the load of the file is detected by the event monitor, When the malicious element removal unit confirms abnormal execution of the file, the site page information, the site code information, and the process information are acquired as malicious site code information. Malicious site treatment device. delete delete An event monitoring unit for detecting a browsing event of the site and loading of a file by a browser activated for accessing a site provided through a communication network; When the load of the file is detected by the event monitoring unit, it is checked whether the file is malicious. If the file is identified as malicious, after confirming whether the file is abnormally executed, if it is determined to be abnormal execution, the file is extracted and removed. Malicious element removal unit, When the search event is detected by the event monitoring unit, the corresponding site page information and site code information are obtained. When the load of the file is detected by the event monitoring unit, process information is obtained. If the file is extracted and removed includes an information management unit for obtaining the site page information, the site code information, the process information and the treatment information of the site as malicious site code information, The event detection unit generates a connection program called and executed by the browser to monitor the event, The connection program is a browser helper object. Malicious site treatment device. 49. The method of claim 48 wherein The event detecting unit hooks an identifier of a browser process to monitor the load. Malicious site treatment device. 50. The method of claim 49, If the event detection unit determines that the file is not malicious by the malicious code detection unit, hooking the identifier of the new browser process Malicious site treatment device. 50. The method of claim 49, The identifier is a CreateProcess function Malicious site treatment device. 49. The method of claim 48 wherein The malicious element removal unit, when the search event is detected by the event detection unit, checks whether the malicious site code information is malicious by using the malicious site code information to treat the corresponding site when the malicious event is malicious. Malicious site treatment device. 49. The method of claim 48 wherein The malicious element removal unit checks whether the file is executed by a compatible program between the site and an application or by a user to check whether the file is abnormally executed. Malicious site treatment device. 49. The method of claim 48 wherein The treatment device is an information storage unit for storing the malicious site code information. Malicious site treatment device further comprising. 49. The method of claim 48 wherein The treatment apparatus, the data communication unit for transmitting the malicious site code information through the communication network Malicious site treatment device further comprising. An event monitoring unit for detecting a browsing event of the site and loading of a file by a browser activated for accessing a site provided through a communication network; When the load of the file is detected by the event monitoring unit, it is checked whether the file is malicious. If the file is identified as malicious, after checking whether the file is abnormally executed, if it is determined to be abnormally executed, extracts and removes the file to be treated. Malicious element removal unit, When the search event is detected by the event monitoring unit, the corresponding site page information and site code information are obtained. When the load of the file is detected by the event monitoring unit, process information is obtained. If the file is extracted and removed includes an information management unit for obtaining the site page information, the site code information, the process information and the treatment information of the site as malicious site code information, The information management unit obtains the site page information and site code information by using thread identification information as a key. Malicious site treatment device. The method of claim 56, wherein The information manager checks whether the thread has a web link site code node in the acquired site code information, and if the web link site code node is not present, registers as a main web link site code node, but the web link site code node in the thread. If there is a frame web link to register the site code node to obtain the site page information and site code information Malicious site treatment device. An event monitoring unit for detecting a browsing event of the site and loading of a file by a browser activated for accessing a site provided through a communication network; If the load of the file is detected by the event monitoring unit, check whether the file is malicious or not.If the file is identified as malicious, check whether the file is abnormally executed, and if it is determined to be abnormally executed, extract and remove the file. Malicious element removal unit, When the search event is detected by the event monitoring unit, the corresponding site page information and site code information are obtained. When the load of the file is detected by the event monitoring unit, process information is obtained. If the file is extracted and removed includes an information management unit for obtaining the site page information, the site code information, the process information and the treatment information of the site as malicious site code information, The information management unit acquires the site page information and site code information using the thread identification information as a key in the parent information together with the parent information of the current process in the process information as the malicious site code information. Malicious site treatment device. The method of claim 58, The information management unit acquires the site page information as malicious site information when the normal execution of the file is confirmed by the malicious element removing unit. Malicious site treatment device. A device that collects malicious site information by utilizing a device that treats malicious sites that distribute malicious compatible programs between sites and applications through a communication network. The treatment device, If the compatible program loaded by the browser activated for access to the site is identified as malicious, the corresponding program page information, the information of the compatible program, and the treatment information of the corresponding site are extracted as malicious site information while extracting and removing the compatible program and treating it. Earned, The collecting device, A data collection server for collecting the malicious site information through the communication network; Malicious site database for storing the database of malicious site information, The site page information is obtained by using thread identification information as a key. Malicious site information collection device. A device that collects malicious site code information by using a device that cleans up malicious sites that run malicious processes. The treatment device, When a file loaded by a browser activated for access to the site is identified as malicious and abnormally executed, the file is extracted and removed, and the file is cleaned and the site page information, site code information, process information, and treatment information of the site are retrieved. Obtained through malicious site code information, The collecting device, A data collection server for collecting the malicious site code information through a communication network; A malicious site database for storing the malicious site code information, which is databased, The site page information and site code information are obtained by using thread identification information as a key. Malicious site information collection device. A system that distributes malicious compatible programs between sites and applications through a communication network, or repairs malicious sites that execute malicious processes. If the compatible program loaded by the browser activated for accessing the site is identified as malicious, the corresponding program page information, the information of the compatible program, and the site treatment information are obtained as malicious site information while extracting and deleting the compatible program and treating the malicious program. If the file to be loaded is identified as malicious and abnormally executed, the malicious site treatment device that extracts and deletes the file and cleans the site page information, site code information, process information, and site cleaning information as malicious site code information. A data communication terminal, And a malicious site information collection device including a data collection server for collecting the malicious site information or the malicious site code information through the communication network, and a malicious site database for storing the malicious site information or the malicious site code information. , The site page information and site code information are obtained by using thread identification information as a key. Malicious Site Treatment System.

Images