KR101063010B1 - Process management method and device that can detect malware - Google Patents

Abstract

A process management method capable of detecting a malicious program in a system, the method comprising: collecting the process information; Transmitting the collected process information to a remote server; And detecting whether a malicious program is installed by receiving a risk determination result for the process from the remote server. The malware is generated by the malicious program by a process management method capable of detecting a malicious program performed on a computer. In addition to being able to detect malicious code that is being generated, it is also possible to know which process was generated, thereby fundamentally identifying the cause of the malicious program.

Process, malware, remote

Description

Method and Apparatus for Managing Malware Detection Methods and Apparatus for managing of process

The present invention relates to a process management method of a computer, and more particularly, to a process management method capable of detecting malicious programs in a system.

With the spread of computers and the Internet, various application software or contents are shared among users. As a result, malicious codes including virus programs are rapidly spreading, and the leakage of personal information is becoming more serious.

In general, malware is installed on a user's computer in an illegal manner and used for commercial purposes. The malicious code intercepts various pop-up advertisements, intercepts keyword / URL (Uniform Resource Locator), composes a start page, and sends spam mail through the user's computer. It refers to a program that harms users by performing various illegal activities. When such malicious code is installed in a computer, the system resources are randomly accessed and not only affect the computer system but also damage the system resources.

The conventional malware detection and removal program for detecting and removing malicious code checks whether the malicious code is installed in the computer by referring to the malicious code list and deletes or cleans the malicious code. However, such a conventional malware detection and removal program does not fundamentally prevent malicious code from accessing system resources.

The present invention is derived from such a background, and an object thereof is to provide a process management method capable of detecting a malicious program generation method.

Moreover, when a malicious process is detected, it aims at providing the process management method which can restore a system state to the state before execution of the process.

The technical problem is a process management method performed in a computer, comprising: collecting the process information; Transmitting the collected process information to a remote server; Detecting whether a malicious program is installed by receiving a stability level given according to a risk determination result of the process from the remote server; And applying a different period according to the safety level assigned to the process, periodically requesting the remote server to determine whether the process is dangerous. It is achieved by a process management method capable of detecting malicious programs performed on a computer comprising a.

The method further comprises obtaining history information about the process from the remote server.

On the other hand, the technical problem is a process information collection unit for collecting process information in the computer; And transmits the collected process information to a remote server, receives a risk determination result for the process, monitors the risk for the process in the computer, detects whether a malicious program is installed, and according to the stability level given to the process. It is also achieved by the process management apparatus capable of detecting a malicious program, including a malicious program detection unit for applying a different cycle, periodically requesting the remote server to determine the risk of the process.

According to the present invention, it is possible not only to detect the malicious code generated by the malicious program, but also to identify the process by which the malicious code is generated, thereby fundamentally identifying the cause of the malicious program.

In addition, when a malicious program is detected, it is possible to restore the system state to the state before the process in which the malicious program was installed, thus reducing the effort and time required to recover a file or system damaged by the malicious program. It has an effect.

The foregoing and further aspects of the present invention will become more apparent through the preferred embodiments described with reference to the accompanying drawings. Hereinafter, the present invention will be described in detail so that those skilled in the art can easily understand and reproduce the present invention through these embodiments.

1 is a block diagram illustrating a process management system according to an embodiment of the present invention.

As shown, the process management system according to the present invention includes a computer system 10 on which a process is executed, a process management apparatus 20 for performing malicious program detection by a process performed on a computer system, and a computer system. And a remote file management server 30 that stores and manages information about the files performed at 10.

The computer system 10 is a personal computer of a user, and the process management apparatus 20 according to the present embodiment may be implemented as an application installed and executed in the computer system 10.

The process management apparatus 20 collects information on a process executed in the computer system 10 and transmits the information to a remote file management server 30. In response, the process management device 20 receives a result from the file management server 30 as a result of determining whether there is a risk for the process running in the computer system 10.

In addition, the process management apparatus 20 constructs a database of process information executed at least once in the computer system 10 from the file management server 30 in a database. In this way, by storing the process execution history in a database, the process management apparatus 20 can check which process has created a new file. Therefore, when the process management device 20 receives the fact that the malicious program has been generated from the file management server 30, it is possible to detect a process of generating the malicious program by which process.

In addition, the process management apparatus 20 according to an embodiment monitors and analyzes the usage of the central processing unit (CPU) that controls the overall operation of the computer system 10, and variably adjusts the usage of the central processing unit. It is possible. For example, when resource usage of the central processing unit is large, it is possible to reduce resource usage for process management and to perform process management using minimum resources.

The file management server 30 stores files based on the Windows operating system installed in the computer system 10 and information about the files. In the present embodiment, the file management server 30 checks the risk of files newly registered by the process of the computer system 10 in various ways to determine the risk. For example, it can be scanned using a malware search engine such as Virus Total.

In one embodiment, the file management server 30 may reconstruct regularly stored file information. It is also possible to receive and update this information when a file without a previously installed history is installed by a newly executed process from the computer system 10.

In addition, the file management server 30 determines whether there is a risk for the periodically stored files. Since the malicious code must respond in a post-response manner, even though the malicious code is not classified as a malicious code at a specific time, the malicious code may be identified as a malicious code according to an update of the vaccine database. Therefore, even in the case of a process file that has already been inspected, it is possible to secure higher stability through periodic re-inspection.

In the present embodiment, the file management server 30 assigns a safety level for reflecting the result of the risk test on the process execution file on which the risk test is performed.

For example, the safety level of a file that is determined to be safe as a result of a risk test is raised by one level, and the file is considered to be the lowest in the case of a file that is determined to be a high-risk malicious code. The risk determination cycle may be set differently according to the safety level of the stored files. For example, files with high safety ratings are significantly less likely to be malicious code, so they are scanned for risk every long period of time. On the contrary, a file with a low safety rating or a first-found file has a relatively high probability of being a malicious code, and thus is implemented to perform a risk check at shorter intervals. In other words, it is possible to increase the efficiency of the risk test by assigning a safety level and thus performing the risk test at different intervals.

2 is a block diagram of a process management apparatus capable of detecting a malicious program according to an embodiment of the present invention.

Process management apparatus according to an embodiment of the present invention server recovery unit 200, process information collection unit 210, malware detection unit 230, history information management unit 240, process information DB 250 and system restoration The unit 220 is included.

The server communication unit 200 performs data communication with an external remote server, that is, a file management server. The present invention is not limited to a wired or wireless method and may be interpreted to cover all communication configurations capable of transmitting and receiving information.

The process information collecting unit 210 collects process information executed in the computer system. Monitors the processes running on the computer system to determine the file information generated by the processor.

The malicious program detecting unit 230 transmits the process information collected by the process information collecting unit 210 to a remote file management server. In this case, when transmitting process information to the file management server, it is preferable to transmit unique identifier information of the file. At this time, the unique identifier of the file may be a hash file. The file management server and the process management apparatus identify the file based on the unique identifier information of the file transmitted between each other.

Then, in response, the risk determination result for the process is received from the remote file management server. In addition, it is possible to detect whether a malicious program is installed by monitoring a risk for a process running in a computer system based on the received information. At this time, the malicious program detection unit 230 further obtains information on the safety level for the process execution file from the remote file management server. And, even in the case of a file that has previously completed safety inspection, the safety inspection may be requested at different intervals according to the safety level.

For example, process executables with higher safety ratings perform safety checks at longer intervals, while process executables with lower safety ratings execute safety checks at shorter intervals.

The history information management unit 240 stores information about a process that has been executed at least once in the corresponding computer system in a process information DB 250 to be described later. In this embodiment, the information on the process includes at least one of information such as the date when the process was first discovered, the last time of termination, file information created by the process, and the IP address with which the process communicated. In addition, the history information management unit 240 preferably stores the safety grade information for the process. Safety rating information can be used as a measure of how many safety tests the process has passed. Files with high safety ratings are less likely to be malicious code. Conversely, files with low or first safety ratings are more likely to be high-risk files.

The process information DB 250 is implemented as a local storage device and stores process information managed by the history information manager 240.

When the system restorer 220 detects the execution of a new process based on the information collected by the process information collector 210, the system restorer 220 sets a state immediately before the execution of the new process to a restore point. In this case, the setting of the restore point may be to identify information on basic files when the operating system is running. That is, it may be to grasp existing form information about a file that may be changed by a malicious program.

In addition, when the malicious program detection unit 230 determines that the new process is dangerous, the system restoration unit 220 restores the system state to the set restoration time point. In this case, restoring to a restore point is to restore the damaged file or code to the state before the dangerous process was executed.

3 is a flowchart illustrating a malicious program detection method according to an embodiment of the present invention.

First, when an application for executing a process management method capable of detecting malicious programs is executed (S300), process information running in a computer system is collected (S310).

After this, the collected process information is transmitted to a remote file management server (S320). In response to the response, a risk determination result for the process is received from the remote file management server (S330).

In this case, the file management server may determine whether a malicious program is installed by inspecting a file generated by a process running on a computer system in various ways based on the received information. It is possible to detect whether or not the malicious program is installed by obtaining information on whether the malicious program is installed from the file management server.

When the risk is detected in the processor according to the reception result (S340), the dangerous process information is reported to the user (S350). For example, it can be displayed through a message window on the screen. Then, the process history information received from the remote server (S360) is stored in a database (S370).

In this case, the process history information may include at least some of information such as a date when the process is first discovered, a time when the process is recently finished, file information generated by the process, and an IP address with which the process communicated.

And, until the application for executing the process management method capable of detecting malicious programs is terminated (S380), the process management method that collects process information executed in the system and performs detection of malicious programs is repeatedly performed.

4 is a flowchart illustrating a process management method capable of detecting a malicious program executed in a file management server according to an exemplary embodiment of the present invention.

When the file management server receives information about newly registered process files from the computer system (S400), the file management server determines whether the risk is dangerous by checking whether there is a risk thereof (S410).

At this time, the unique identifier information of the process file received from the computer system is received together. At this time, the unique identifier of the file may be a hash file. The file management server and the process management apparatus identify the file based on the unique identifier information of the file transmitted between each other.

Determining the risk can be done using a malware search engine such as Virus Total, for example.

In addition, in one embodiment, the file management server may reconstruct regularly stored file information. It is also possible to receive and update this information when a file without a previously installed history is installed by a newly executed process from a computer system.

In addition, the file management server periodically determines whether there is a risk for the stored files. Since the malicious code must respond in a post-response manner, even though the malicious code is not classified as a malicious code at a specific time, the malicious code may be identified as a malicious code according to an update of the vaccine database. Therefore, even in the case of a process file that has already been inspected, it is possible to secure higher stability through periodic re-inspection.

Thereafter, the file management server assigns a safety level to reflect the result of the risk test on the process execution file on which the risk test is performed (S420).

For example, the safety level of a file that is determined to be safe as a result of a risk test is raised by one level, and the file is considered to be the lowest in the case of a file that is determined to be a high-risk malicious code. The risk determination cycle may be set differently according to the safety level of the stored files. For example, files with high safety ratings are significantly less likely to be malicious code, so they are scanned for risk every long period of time. On the contrary, a file with a low safety rating or a first-found file has a relatively high probability of being a malicious code, and thus is implemented to perform a risk check at shorter intervals. In other words, it is possible to increase the efficiency of the risk test by assigning a safety level and thus performing the risk test at different intervals.

The result of the risk determination on the process file is transmitted to the computer system together with the safety grade information (S430). In this case, it is preferable to transmit unique identifier information of the process file to the computer system.

On the other hand, the above-described malicious program detection method can be written as a computer program. The codes and code segments that make up the program can be easily deduced by a computer programmer in the field. In addition, the program is stored in computer readable media, and read and executed by a computer to implement a system resource protection and isolation method. The information storage medium includes a magnetic recording medium, an optical recording medium, and a carrier wave medium.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

1 is a block diagram illustrating a process management system according to an embodiment of the present invention;

2 is a block diagram of a process management apparatus capable of detecting a malicious program according to an embodiment of the present invention;

3 is a flowchart of a process management method capable of detecting a malicious program according to an embodiment of the present invention;

4 is a flowchart illustrating a process management method capable of detecting a malicious program executed in a file management server according to an exemplary embodiment of the present invention.

Claims (13)

In a process management method performed on a computer, Collecting the process information; Transmitting the collected process information to a remote server; Detecting whether a malicious program is installed by receiving a stability level given according to a risk determination result of the process from the remote server; And Requesting the remote server to determine whether there is a risk for the process by applying different cycles according to the safety level assigned to the process; Process management method capable of detecting a malicious program performed on a computer comprising a. The method of claim 1, Obtaining history information about the process from the remote server; Process management method capable of detecting a malicious program performed on a computer, characterized in that it further comprises. The method of claim 2, Detecting whether or not the malicious program is installed, the process management method capable of detecting a malicious program performed on a computer, characterized in that for receiving a risk determination result for the file generated by the process. The method of claim 1, If the execution of a new process is detected, setting a state immediately before execution of the new process as a restore point; And If it is determined that the new process is dangerous, restoring a system state to the set restoration time point. Receiving process information collected from a terminal computer; Determining whether the process is dangerous based on the received process information, and assigning a safety level based on a result of the determination of the risk; Transmitting a stability level according to a result of the determination of the risk to the terminal computer; And Determining whether there is a danger to the process by applying different cycles according to the stability grade given to the process; Process management method capable of detecting malicious programs running on the file management server comprising a. delete A process information collecting unit collecting process information in the computer; And By transmitting the collected process information to a remote server, receiving a risk determination result for the process to monitor the risk for the process in the computer to detect whether or not to install a malicious program, depending on the stability level given to the process And a malicious program detector for periodically requesting the remote server to determine whether the process is dangerous or not, by applying a period to the remote server. The method of claim 7, wherein And a history information management unit which transmits the collected process information to a remote server, obtains history information about the process, and makes a database of the obtained history information. The method of claim 7, wherein When the execution of a new process is detected, the state immediately before the execution of the new process is set to a restore point, and when the determination by the malicious program detection unit determines that the new process is dangerous, the system state is restored to the set restore point. Process management apparatus capable of detecting malicious programs, further comprising a system restorer. The method of claim 7, wherein The process information may include at least one of process initial discovery date information, latest end time information, file information generated by the process, and IP address information to which the process communicates. . The method of claim 1, In the step of requesting the remote server to determine whether or not the risk of the process periodically by applying a different period in accordance with the safety level granted to the process, Process execution method capable of detecting malicious programs, characterized in that the process executable file having a high stability level performs a stability check at a long cycle, and the process executable file having a low stability level is requested to perform a stability check at a shorter cycle. . The method of claim 5, In the step of determining whether there is a risk to the process periodically by applying a different cycle in accordance with the safety rating given to the process, Process execution method that can detect malicious programs running on the file management server, characterized in that the process executable file with a high stability rating performs a stability check in a long cycle, the process executable file with a low stability rating performs a stability check in a shorter cycle . The method of claim 7, wherein The malicious program detection unit may request that the remote server perform a stability check on a long cycle of a process executable file having a high stability level, and perform a stability check on a shorter cycle of a process executable file having a low stability level. Process management devices that can be detected.

Images