KR101047382B1 - Method and system for preventing file takeover using malicious code and recording medium - Google Patents

Abstract

The file deodorization method according to the present invention comprises the steps of: inserting a first code into the restriction files for restriction files that exist in the system and need to be protected; Inserting a second code into the files if files existing in the system are to be transferred out of the system; And filtering files recognized as malicious code by inserting both of the first code and the second code transmitted to the outside of the system.

Malware, File Capture, Security

Description

Method and System reverse-using Malicious Code for Preventing File-Seizure, and Recording Medium}

The present invention relates to a file deodorization prevention method, a file deodorization prevention system and a recording medium recording the file deodorization prevention method, and more particularly, to a file deodorization prevention method and a file deodorization prevention system for preventing file deodorization by using malicious code in reverse. And a recording medium recording the file deodorization prevention method.

The security of a computer system is based on the integrity and confidentiality of the data. Data integrity refers to preventing data from being changed (added, deleted, modified, etc.) by an unauthorized user or application, etc. Data confidentiality means blocking data access by unauthorized users. Say.

Security is a very important issue for most computer users. Memory lock systems, such as hard disk drives on computers, contain valuable information that is very vulnerable to data theft. Huge amounts of money and effort are spent to protect the confidential information of individuals, businesses and governments.

Now, security has become a universal concern for computer users. The use of viruses, worms, Trojan horses, identity theft, software and media content theft, and data destruction threats are rampant. The OS system provides a variety of security features to prevent such attacks. For example, recent OS systems and various applications have enhanced security functions such as encrypting and storing data in memory.

In particular, due to the development of computer technology, maintaining the security of the network is a high priority. As dependence on these networks continues to grow, it will become more important to protect digital assets within these networks. For example, significant damage will occur if a malicious hacker gains access to the network and destroys / modifies sensitive or confidential data within the network.

In addition, the existing security system did not provide a simple and effective countermeasure when a hacker intentionally transmits data to the outside of the system.

Accordingly, it is an object of the present invention to provide a file deodorization prevention method and system and a recording medium for protecting restricted files / restricted materials that a user does not want to be transmitted outside the system.

It is also an object of the present invention to provide a file deodorization prevention method and a system and a recording medium for protecting the restricted files / restricted data that should be restricted when the system is exposed by hacking to contribute to the completeness of security. .

The method for preventing file takeover according to the present invention comprises the steps of: inserting a first code into the restriction files for restriction files existing in the system and that need to be protected; Inserting a second code into the files if files existing in the system are to be transferred out of the system; And filtering the files recognized as malicious code by inserting both the first code and the second code transmitted to the outside of the system.

In addition, the malicious code may be composed of the first code and the second code.

In addition, the first code and the second code may correspond to a malicious code detection signature.

The step of inserting the second code into the files may further include inserting the second code into the files when the files are transmitted outside the system by a hacker who invades the system. can do.

The method may further include detecting / detecting a hacker who invades the system when files in which both the first code and the second code are inserted are filtered.

In addition, the first code and the second code may correspond to codes constituting the malicious code.

In addition, the file takeover prevention system according to the present invention includes a first signature insertion unit for inserting a first code into the restriction files for the restriction files that need to be protected in the system; And a second signature insertion unit for inserting a second code into the files when files existing in the system are transmitted to the outside of the system.

In addition, both the first code and the second code transmitted to the outside of the system are inserted through at least one component for transmitting the files to another communication network to filter files recognized as malicious codes.

In addition, when there is a command to remove the first code of the restriction files, the first signature inserter may block the command and protect the first code from the restriction files.

The second signature inserter may insert the second code into the files when the files are transmitted to the outside of the system by a hacker who invades the system.

The file deodorization prevention system may further include a detector configured to track / detect a hacker who invades the system when the filter filters files in which both the first code and the second code are inserted. .

Since the general file is transmitted by inserting only the second code, general transmission is possible.

In addition, since only the second code is inserted and transmitted, general file / data information is not deleted or corrupted by the security system on the network or the security system on the sender side.

In addition, according to the present invention, in the restriction file to which transmission is to be restricted, a first code is already inserted, and when a transmission request is generated from the outside, the second signature insertion unit inserts a second code, so that the first code and the first code are inserted. The restriction file inserted with the 2 code is recognized as a malicious file / program by the filter and deleted.

As described above, the files transmitted to the network can be protected by simple data insertion, and the restricted files to be restricted should be protected even when the system is exposed by hacking, thereby contributing to the perfection of security.

Specific structural to functional descriptions of the embodiments of the present invention disclosed in the specification or the application are only illustrated for the purpose of describing the embodiments according to the present invention, and the embodiments according to the present invention may be embodied in various forms. It should not be construed as limited to the embodiments described in this specification or the application.

Since the embodiments according to the present invention can be variously modified and have various forms, specific embodiments will be illustrated in the drawings and described in detail in the present specification or application. However, this is not intended to limit the embodiments in accordance with the concept of the present invention to a particular disclosed form, it should be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the present invention.

Terms such as first and / or second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another, for example, without departing from the scope of rights in accordance with the inventive concept, and the first component may be called a second component and similarly The second component may also be referred to as the first component.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between. Other expressions describing the relationship between components, such as "between" and "immediately between," or "neighboring to," and "directly neighboring to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. As used herein, the terms "comprise" or "having" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof that is described, and that one or more other features or numbers are present. It should be understood that it does not exclude in advance the possibility of the presence or addition of steps, actions, components, parts or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and are not construed in ideal or excessively formal meanings unless expressly defined herein. Do not.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Like reference numerals in the drawings denote like elements.

1 is a view showing a file deodorization system 100 according to an embodiment of the present invention. Referring to FIG. 1, the file deodorization prevention system 100 includes a first signature insertion unit 110, a second signature insertion unit 120, and a filter 130.

The first signature insertion unit 110 may insert a first code in the restriction files. In this case, the restriction files may exist in the system, and generally correspond to files that need to be protected without being transmitted outside the system, or may correspond to files that are set so that the user does not transmit the system. For example, the restriction files may correspond to user-created files in the system or files in which user's personal information is recorded.

In addition, when there is an internal or external command to remove the first code from the restriction files, the first signature insertion unit 110 blocks the internal or external command and blocks the first from the restriction files. 1 Code can be prevented from being removed.

The first code may correspond to a signature for detecting malicious code (eg, a virus or a worm), and the first signature insertion unit 110 may be implemented in software or hardware in a computer.

In addition, the first code may correspond to one code stored in a malicious code database (not shown) in which the malicious code inside the system is collected, but is not limited thereto. For example, the first code may correspond to a separate code predefined by a user.

Further, the first code does not cause any problem in the file deodorization system.

The second signature insertion unit 120 may insert a second code for all files transmitted to the outside of the system. For example, the second signature insertion unit 120 may insert the second code not only for the restriction files but also for general files that do not need to be protected.

More specifically, the second signature inserting unit 120 transmits the second code to the restriction files and the general files when the restriction files and the general files in the system exit through a port. Can be inserted.

For example, when the restriction files and the general files are transmitted to the outside of the system through the mail, messenger, or other path, the second signature insertion unit 120 sends the second code to the restriction files and the general files. Can be inserted.

On the other hand, the second signature inserter 120 does not insert the second code when the administrator (or user) of the system wants to transfer the restricted files to the outside of the system even if the restriction files correspond to the restricted files. It may be.

For example, in case of restricted files which are to be transmitted to the outside of the system through the configuration of the second signature inserting unit 120 of the administrator (or user) of the system, the second code may not be inserted.

The second code may correspond to a signature for detecting malicious code, and may appear as malicious code when configured with the first code.

The second signature inserting unit 120 may correspond to a separate code from the first code. The second signature inserting unit 120 may be implemented in software or hardware in a computer.

In addition, the second code may correspond to one code stored in a malicious code data base (not shown) in which the malicious code in the system is collected, but is not limited thereto. For example, the second code may correspond to a separate code predefined by a user.

The filter 130 may correspond to at least one component for transmitting the files to another communication network, and may filter some of the files transmitted to the outside of the system. For example, the filter 130 may be configured to transmit the restriction files to the outside of the system (eg, the hacker computer 150) through the communication network 140 when the restriction files are to be transmitted to the outside of the system by the hacker computer 150. The restriction files can be filtered out of the way.

More specifically, the filter 130 may select and filter only files in which both the first code and the second code corresponding to the malware detection signature are inserted among the files transmitted to the outside of the system. For example, when attempting to access the restriction files in the system from the outside and transmit the restriction files to the system, the filter 130 may filter the restriction files in which both the first code and the second code are inserted. Can be.

On the other hand, the filter 130 is the administrator (or user) of the system wants to send the restriction files to the outside of the system (for example, the second code is inserted by the environment setting of the second signature insertion unit is inserted) If not, the restriction files may not be filtered because the second code is not inserted with only the first code.

The filter may include a router and may filter the restriction files in which both the first code and the second code are inserted through firewall filtering.

In addition, the file deodorization system 100 may further include a detector (not shown). When the filter filters files in which both the first code and the second code are inserted, the detector may track / detect a hacker who invades the system.

When the restriction files are filtered, the detection unit (IP), an Internet address (IP address), a MAC address (MAC Address: Media Access Control Address), a network address (Network Address), and a subnet mask to track hackers. It may collect information (subnet mask), gateway (Gateway), the type and version of the operating system (OS).

When the detection unit (not shown) collects the information and tracks / detects the hacker, it is displayed on the monitor screen to the administrator (or user) of the system, or the administrator of the system through a mail and / or SMS (or MMS) service. (Or user) can be notified.

In addition, the detection unit (not shown) may store the information of the hacker as a log file for use in Computer Forensics, such as using as evidence of intrusion and backtracking.

2 is a diagram illustrating an example of malicious code. Referring to FIG. 2, the malicious code 200 includes a first code 210 and a second code 220.

The first code 210 and the second code 220 may correspond to a part of the malicious code 200 as the detection signature of the malicious code 200. For example, the first code 210 may correspond to an even code of the malicious code 200, and the second code 220 may correspond to an odd code of the malicious code 200. In a separate software or hardware for detecting malicious code, only files (eg, the restriction files) including both the first code 210 and the second code 220 may be recognized as malicious code.

3A is a diagram for illustrating a restriction file and a general file for inserting a first code through a first signature insertion unit. Referring to FIG. 3, the first signature insertion unit 110 inserts the first code 210 only into the restriction file 300.

The restriction file 300 may be distinguished from the general file 400 by inserting the first code 210 only into the restriction file 300, which is a file to which movement on the network should be restricted.

3B is a view for showing a restriction file and a general file for inserting the second code through the second signature insertion unit. Referring to FIG. 3B, the second signature insertion unit 120 includes the second code 220 in both the restriction file 300 'and the general file 400' including the first code 210. 2 cord 220 is inserted. In other words, the second signature insertion unit 120 may insert the second code 220 in all the files going out through the port.

4 is a flowchart illustrating a file takeover method according to an embodiment of the present invention. The file takeover method may be performed by the file takeover system of FIG. 1 or may be performed by software including the file takeover method.

Referring to FIG. 4, first, it is determined whether a restriction file exists in the system and needs to be protected (S41), and a first code corresponding to the malware detection signature is inserted only when the restriction file corresponds (S42). ).

Next, when files existing in the system are transmitted to the outside of the system, a second code corresponding to a malware detection signature is inserted into the files (S43). In this case, the files may include both the restriction file and the general file.

Next, files (eg, restriction files) in which both the first code and the second code transmitted to the outside of the system are inserted are filtered (S44). In this case, the files containing only the first code (eg, restricted files that the system administrator (or user) wants to transmit) or the files containing only the second code (eg, general files) are not filtered. You may not.

Next, when files in which both the first code and the second code are inserted are filtered, the hacker who invades the system is tracked / detected (S45). In this case, in order to track the hacker, information such as an internet address, a MAC address, a network address, a subnet mask, a gateway, a type and a version of an operating system, and the like can be collected. Display on the monitor screen to the administrator (or user) of the system, or notify the administrator (or user) of the system via mail and / or SMS (or MMS) service, and the hacker's information is used as evidence of intrusion and traceback. Save it as a log file for use in computer forensics.

The present invention can also be embodied as computer-readable codes on a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored.

Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like. The program code for performing the object information estimation method according to the present invention may be a carrier wave. It may also be transmitted in the form of (for example, transmission via the Internet).

The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. And functional programs, codes and code segments for implementing the present invention can be easily inferred by programmers in the art to which the present invention belongs.

Although the present invention has been described with reference to one embodiment shown in the drawings, this is merely exemplary, and those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

1 is a view showing a file deodorization prevention system according to an embodiment of the present invention.

2 is a diagram illustrating an example of malicious code.

3A is a diagram for illustrating a restriction file and a general file for inserting a first code through a first signature insertion unit.

3B is a view for showing a restriction file and a general file for inserting the second code through the second signature insertion unit.

4 is a flowchart illustrating a file takeover method according to an embodiment of the present invention.

Claims (9)

In the file deodorization system, Inserting a first code into the restriction files for the restriction files that exist in the system and need to be protected; Inserting a second code into the files when the files existing in the system are transferred out of the system; Filtering files recognized as malicious code by inserting both of the first code and the second code transmitted to the outside of the system; And And filtering or detecting hackers who invade the system when filtering files recognized as the malicious code. Inserting the second code is The second code is inserted into the remaining files except for some restricted files set by the administrator or the user to transfer out of the system among the files existing in the system, The first code and the second code is a file corresponding to a malware detection signature, respectively, any one of the codes stored in a database in which the malicious code is collected or a separate code predetermined by the user. The method of claim 1, wherein the step of inserting the second code into the files And the second code is inserted into the files when the files are transferred out of the system by a hacker who invades the system. The method of claim 1, wherein the step of tracking or detecting the hacker is Collecting information including at least one of an internet address, a MAC address, a network address, a subnet mask, a gateway, and a type and a version of an operating system of the hacker; Storing the collected information in a log file; And And notifying the user of the collected information. The method of claim 3, And the first code prevents problems with the system. A recording medium having recorded thereon a computer program for executing the method according to any one of claims 1 to 4. In the file deodorization system, A first signature inserter that inserts a first code into the restriction files for the restriction files that need to be protected in the system; A second signature inserter that inserts a second code into the files when files existing in the system are transmitted outside the system; A filter for filtering files recognized as malicious code by inserting both of the first code and the second code transmitted to the outside of the system by using at least one component for transmitting the files to another communication network; And In the case that the files recognized as the malicious code is filtered, the detection unit for tracking or detecting the hacker who invaded the system, The second signature insertion unit The second code is inserted into the remaining files except for some restricted files set by the administrator or the user to transfer out of the system among the files existing in the system, The first code and the second code is a file corresponding to a malware detection signature, respectively, any one of the codes stored in the database in which the malicious code is collected or a separate code predetermined by the user. The method of claim 6, wherein the first signature insertion portion And if there is a command to remove the first code of the restriction files, blocking the command and protecting the first code from the restriction files. The method of claim 6, wherein the second signature insertion portion And inserting the second code into the files when the files are transferred out of the system by a hacker invading the system. The method of claim 6, wherein the detection unit File deodorization prevention system that collects the information of the hacker and stores as a log file.

Images