KR101070184B1 - System and method for blocking execution of malicious code by automatically crawling and analyzing malicious code through multi-thread site-crawler, and by interworking with network security device - Google Patents

Abstract

The present invention relates to a malicious code access collection system using a multi-thread site-crawler, to a malicious code access blocking system through the automatic analysis engine and security equipment interworking, and more specifically, to a web file secured by a site-crawler After extracting the external ugly eye, collecting the link part with the external ugly eye, tracking the unexcepted external address, securing the suspected malicious code sample by the automatic collector, and analyzing the malware analyzed by the advanced automatic analyzer The process of extracting the signature of the interworking form with the security equipment is performed together so that the security equipment can be used, so that the general users protected by the security equipment are blocked to access malware.
For this, Multi-Thread Site-Crawling Engine, Selective Fuzzer, Sample Auto Collector, Sample Auto Analyzer, Security Device Interlock Engine and Data Repository, Domain Database (Domain DB), Sub Domain Database (Sub Domain DB), External URI Database (External) URI DB), Exception URI Database (Exception URI DB), Malware Database (Malware DB), Malware Database (Malware DB), Signature Database (Signature DB).

Description

SYSTEM AND METHOD FOR BLOCKING EXECUTION OF MALICIOUS CODE BY AUTOMATICALLY CRAWLING AND ANALYZING MALICIOUS CODE THROUGH MULTI-THREAD SITE- CRAWLER, AND BY INTERWORKING WITH NETWORK SECURITY DEVICE}

The present invention relates to a malicious code access blocking system that enables fast and accurate detection of DDoS hosts and malware distribution sites, and enables distribution management, rapid collection, and accurate analysis of malicious codes spread in real time. Real-time crawling for domains existing on the Internet network enables quick detection of DDoS hosts and malicious code distribution sites, rapid acquisition of malicious code samples, and analysis by automatic analysis engines, which enables interoperability with security equipment. By extracting signatures and updating in real time, it is an invention that can fundamentally block the malicious code exposure of general users. In addition, it is an engine that finds the final malicious code by precisely tracking the distribution path of malware using Site-Crawler and Select Fuzzer.It manages numerous web sites at the system level, overcoming the limitations of the existing distribution site detection system, and multi- It is an invention that makes it possible to check a large amount of Web-Site by realizing the speed of detection by using the threading method.

As the Internet becomes more common and the center of people's lives moves from off-line to on-line, the issue of information security is being emphasized. In addition, with the spread of smart phones, the active spread of Wireless-LAN, and 3G networks, the Internet's dependence on domestic life is growing wildly, and as is commonly seen in public places such as subways and squares, most people are on-line. I'm spending time.

As the Internet entered the center of life, the WWW service, which provides visible and life-friendly services, provided various contents at a rapid rate. For the malicious attacker who develops and distributes the malicious code, this universal WWW is a good means of distributing the malware efficiently and easily.

In the early days of the Internet's spread, most of the basic social engineering methods in the public archives tricked malicious programs into normal commercial programs and executed on the user's local computer. Recently, however, forgeries are made by inserting data from <iframe> and <script> sources that link to malicious code uploaded to another server occupied by the attacker and linked to the actual web page. In other words, an evolved method is used to automatically infect normal users who access the Web site normally. In addition, the method of distributing malicious code through the form of server via the server so that the path is connected in the 2nd, 3rd, and 4th steps is also used.

In this way, a large number of casual users can easily be infected with malicious code, and potentially exposed to the threat of the second 1.25 Internet and 7.7 DDoS attacks.

As mentioned above, security firms and public organizations have made a lot of efforts in the background of the times raised, but the reason why general users cannot be free from threats spreading on the network is because of the convenience of the medium of the web. Various conveniences lead to the convenience that malicious malicious attackers can distribute their own malware anywhere.

In this situation, in order to effectively detect malicious code existing on the web, it is necessary to detect / analyze the malicious code targeting all web site information, and even extract link information to an unbroken foreign web site. There is a need for a system that can detect / analyze malicious codes existing on Web sites. However, there are about 1.8 million domains in Korea (an estimate based on domains using '.kr'), and it can be a very difficult task to detect malwares that exist here through common methods.

The present invention for solving the above problems is to use the high-performance Multi-Thread Site-Crawling engine Site-Crawling for domestic domain ('.kr') (including foreign domains including ".com", if necessary) The primary purpose is to analyze files existing on the web site first and track and analyze the presence of external links in the web site. .

After downloading suspected malware files by fast and accurate analysis, it extracts the signatures that can be recognized by the security device for the inspection of the file, and then enables the signatures to be linked with the security device. The objective is to design and build a system that blocks access natively.

The present invention for achieving the above object, the multi-threaded site crawling engine unit is provided so that the information on the sub-domain of the target website, and the information on the external URL described in the target website or sub-domain is extracted and stored. (20, Multi-thread Site Crawling Engine) and the information extracted and stored by the multi-threaded site crawling engine unit 20, and by analyzing the information to continuously analyze whether or not there is an external eye The site tracer 30 is provided to store the site information on the external UL eye waypoint, and analyzes the information on the external UL eye, and the corresponding website analyzed by the site tracer 30 or the web of the external UL eye. Cell that analyzes the file to see if the file download path exists and allows the download URI information of the file download to be stored. The file download path malicious code suspected by the fuzzer 40 and the selective fuzzer 40 are downloaded as the corresponding download URI information, and the downloaded malicious code suspected file is analyzed, but the hash value of the malicious code suspected file is analyzed. Calculate and check whether the data of hash value exists and determine whether or not to duplicate analysis based on the existence of the data of the hash value, Automatic screening for malicious code suspect files to be analyzed without duplicate analysis, and suspected malicious code files The sample automatic collector 50 allows the information including the waypoint information to be stored and the malicious code suspicious file information included in the target web site, subdomain, or different domains to be dynamically analyzed. An automatic dynamic analysis engine (60) provided to store the analyzed information and the error information generated during the dynamic analysis; By receiving the dynamic analysis information about the suspicious file that has been dynamically analyzed through the automatic dynamic analysis engine (60), the signature information on the suspicious file that can be linked to the security equipment (75) can be extracted for the suspicious file. The security equipment interlocking engine unit 70 is included, and the different domain is provided with a malware access blocking system, characterized in that the domain having a different address from the target website or subdomain.

Accordingly, the present invention, the multi-threaded site crawling engine unit 20, the site structure information extraction unit 21 for extracting the site structure information of the target website connected to the Internet, and the site structure extracted for the target website The information of the subdomain search unit 22 for searching the subdomain information among the information, and the external URL information stored as the normal URL information in the domain searched for the target website or the subdomain are stored in the exception UID storage unit ( 153, and if not stored in the exception U eye storage unit 153, a U ID detection engine unit 23, which is stored in the external U eye storage unit 154, includes the URI detection engine, The information of the normal eye is information of the eye known as the normal advertisement or the normal portal address that has been known and verified, and the eye that has been used stably for several times. Information on the sub-domain of the target website, and the information about the external URL described in the target website or sub-domain is provided to extract and store a malware access blocking system is provided. .

In addition, the present invention, the web file storage unit 151 (Web file DB) for storing the site structure information of the target website extracted from the site structure information extraction unit 21 and the sub-domain search unit 22 retrieved An exceptional Ul eye storage unit for storing external domain eye information having the normal U eye information by the sub domain storage unit 152 (Sub Domain DB) storing sub domain information and the U ID detection engine unit 23 ( 153, an Exception URI DB), and an external UD storage unit 154 for storing external UD information without information in the exception UD storage unit 153 by the UD identification engine unit 23; External URI DB) is provided that includes a malicious code access blocking system.

And the present invention is provided with a malicious code distribution route storage unit 155 for storing the site information for the external WIA waypoint described in the web file analyzed by the site tracer 30, the selective fuzzer 40 The web file is analyzed by the site tracer 30 to determine whether a file download path exists by analyzing a web file of the web site or an external URL, and the web file for storing the download URI information of the file for the file download path. Analyzer 41 is provided, and is provided so that the download URI information for the suspected malicious code file to determine whether the malicious code is analyzed, the download URI information for the malicious code suspect file analyzed by the selective fuzzer 40 Is provided with a download storage unit (156, Download DB) for storing the, the sample automatic collector 50, the selective fuzzer 40 Download the malicious code suspect file analyzed and stored as the corresponding download URI information and analyze the downloaded malicious code suspect file, calculate the hash value of the malicious code suspect file and check whether the data of the hash value exists and check the data of the hash value. Whether the file is duplicated or not, and if the file is suspected of malicious code analysis, path analysis information, download information, and sample analysis information including the MD5 hash value of the file are analyzed. The malicious code storage unit 157 is provided for storing the analysis information of the suspected malicious code file analyzed by the sample automatic collector 50, and the signature for the suspected malicious file by the security device interlocking engine 70 At the time of blocking access to malicious code, the signature storage unit 159 is provided to receive and store information. The system is provided.

In addition, the present invention, the automatic dynamic analysis engine 60 receives the information on the malicious code suspect file from the sample automatic collector 50 so that the data is transmitted to the virtual analysis system manager 62, which can be virtually analyzed. And, the analysis engine master 61 for receiving the analysis information on the suspected malicious code file has been analyzed from the virtualization analysis system manager 62 and stored in the analysis system 158, and the analysis engine master (61) Receives information on the malicious code suspicious file from) to be transmitted to one or a plurality of analysis agents (63), and receives the analysis information of the malicious code suspect files from the analysis agent (63) Analysis Engine Master (61) The virtualization analysis system manager 62 to be transmitted to the side, and the information on the malicious code suspect file is received from the virtualization analysis system manager 62, Dynamic analysis is performed on the suspicious code file, and includes one or more analysis agents 63 for transmitting dynamic analysis information to the virtualization analysis system manager 62 along with information on an error during the dynamic analysis process. It is provided to store the dynamic analysis information and error information generated during the analysis of the malicious code suspicious file information included in the target Web Site, sub-domain or different domains, and malicious from the automatic dynamic analysis engine 60 A malicious code access blocking system is provided, characterized in that an analytic storage unit 158 is provided in which dynamic analysis information about a code suspicious file is transmitted and stored.

Furthermore, the present invention, in the multi-threaded site crawling engine unit 20 of the malicious code access blocking system 10, the information on the sub-domain of the target website 13 connected to the Internet 11, the target website or A multi-threaded site crawling step (S01) configured to extract information about the external yul eye described in the subdomain, and store the extracted information in the database 15 in the multithreaded site crawling engine unit 20; The information extracted and stored by the multi-threaded site crawling step (S01) is taken from the site tracer 30, and the information is analyzed to continuously analyze whether or not there is another external eye. Site information is provided so as to be stored in the database 15, the external eye eye maintenance information analysis step (S02) to analyze the information about the external eye by the site tracer (30); Analyzing whether the download path of the file exists by analyzing the information of the corresponding website or the web file of the external UL eye analyzed by the external UL eye maintenance information analysis step (S02), and analyzing whether the file download path exists. A malicious code sim file U eye information analysis step of allowing the download URI information to be stored in the database 15 (S03); The file download path and the information about the suspected file of the malicious code of the file download analyzed by the malicious code sim file U eye information analysis step (S03) are taken from the sample automatic collector 50, and the sample automatic collector 50 is used. Download the suspected malicious code file as the relevant download URI information and analyze the suspected malicious code file, calculate the hash value of the suspected malicious code file and check whether the data of the hash value exists or not. Determining the duplicate analysis, and collecting the malicious code file of the malicious code (S04) so that the analysis information including the waypoint information about the malicious code suspect file is stored in the database 15; The analysis information analyzed by the malicious code core file collection step (S04) is taken from the automatic dynamic analysis engine 60, and the malicious code described in the target web site, sub domain, or different domain by the automatic dynamic analysis engine 60. Simultaneous dynamic file analysis step (S05) of the malicious code provided to be stored in the database 15, the dynamic analysis information and the error information generated during the dynamic analysis for the information of the suspicious file; Receive dynamic analysis information about the malicious code suspicious file dynamically analyzed through the malicious file sim file dynamic analysis step (S05), and suspect the malicious code in the security equipment interlocking engine unit 70 Security device interlocking signature extraction step (S06) is provided to extract the signature information on the suspected malicious code file that can be linked to the security device 75 for the file, the different domain is different from the target website or sub-domain Malicious code access blocking method is provided, characterized in that provided in the domain having the address.

The present invention, which is configured as described above, detects and analyzes malicious code information in advance before accessing malicious code existing on the Internet, which is potentially exposed to all malicious codes, and blocks them through security equipment in advance. Has an excellent effect.

The simple malware distribution system analyzes the client's resources by detecting the presence of malicious code only for the relevant site before attempting to access the web site from the client. It cannot be a proper system for site management in terms of operation. In addition, since it manages access to malicious code in the form of individual installation for each client, it is difficult to manage the entire web site company-wide, and it is necessary to identify the existence of malicious code existing in the web site for each client. There are drawbacks to the limitations of the analysis.

Detecting malware through simple security equipment only-When blocking is seen as a primary blocking means of access by a malicious attacker, the present invention provides a web server and a server with 0-day vulnerabilities that were not detected by the security equipment. Malware suspicious files exist in sub-domains, which can be a secondary defense in situations that threaten general users. In addition, by interlocking with existing security equipment, additional blocking policies are enabled, enabling more robust security management.

Security management of a simple system tends to be heavily focused on subjective tendencies such as security awareness of administrators and users, but it is an automated security system according to the present invention, which is spread to objective security management, enterprise-wide site management, and even national threats. By preventing preventive access from DDoS hosts, there is an excellent effect of preventing dangerous conditions such as the second 7.7 Internet disruption.

1 is an illustration of a network structure combined with a malicious code access blocking system according to the present invention.
Figure 2 is a flow chart of the entire deployment in a state combined with a malicious code access blocking system according to the present invention.
Figure 3 is a flow chart by the Site-Crawling Engine of the malware access blocking system according to the present invention.
Figure 4 is a flow chart for the process of extracting the external yul eye information by the malware access blocking system according to the present invention.
5 is a flow chart for Site-Tracing, Selective Fuzzer in the malware access blocking system according to the present invention.
Figure 6 is a flow chart for the automatic collection process of malicious code suspect files by the malware access blocking system according to the present invention.
7 is an exemplary configuration diagram for an automatic dynamic analysis engine of a malicious code access blocking system according to the present invention.
8 is a flow chart for the operation in the analysis engine master of the malware access blocking system according to the present invention.
Figure 9 is a flow chart for the processing of the analysis results in the analysis engine master of the malicious code access blocking system according to the present invention.
10 is a flow chart for the operation in the virtualization analysis agent in the malware access blocking system according to the present invention.
11 is a signature extraction operation flow diagram in the security equipment interlocking engine of the malicious code access blocking system according to the present invention.
Figure 12 is an illustration of the overall configuration for a malicious code access blocking system according to the present invention.
Figure 13 is a flow chart for the overall configuration in a malicious code access blocking system according to the present invention.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 to 13, the present invention relates to a malicious code automatic collection using a multi-thread site-crawler, a malicious code access blocking system and a malicious code access blocking method through an automatic analysis engine and security equipment interworking. .

For this purpose, the Multi-Thread Site-Crawling Engine, Selective Fuzzer, Sample Auto Collector, Sample Auto Analyzer, Security Device Interlocking Engine and Data Repository, Domain Database (hereafter Domain DB), Sub Domain Database (hereafter Sub Domain DB), External URI Database (Hereinafter, referred to as External URI DB), Exception URI Database (hereinafter referred to as Exception URI DB), Malware Database (hereinafter referred to as Malware DB), Malware Database (hereinafter referred to as Malware DB), and Signature Database (hereinafter referred to as Signature DB).

In the present invention prepared as described above, the present invention relates to a malicious code automatic collection system using a multi-thread site-crawler, an automatic analysis engine and a security device interworking system through a linkage with security equipment, and a method thereof. It consists of the entire system that enables continuous site monitoring based on domains, automated collectors, automated analyzers, signature extraction for malicious codes and interlocking of security equipment. In other words, after extracting external URL from web file secured by Site-Crawler, collecting link part with external URL, tracking trace of unexcepted external address and securing suspected malicious code sample by automatic collector, advanced automated analyzer Through the analysis of the malware analysis result, it is configured to perform the process of extracting the signature of the interworking form with the security device so that it can be used in the security device, thereby providing access to the malware to the general users protected by the security device. It is designed to block the source.

In the present invention, the members named '~', '~ engine', '~ engine', or '~ Database', '~ DB', 'database', 'storage', etc. It refers to the components for processing or storing a specific function or operation such as physical component configuration for processing, configuration of processing apparatus, configuration of logical processing, configuration of processor, configuration of control flow, hardware configuration, software It may be provided and implemented in various state configurations, such as a compositional configuration or a combination of a hardware configuration and a software configuration, and may be interpreted as being limited to any one form. It may be a configuration that can be applied, operated and implemented in. In addition, when any one or more of these are provided together with the configuration of the Internet or the internal network, the respective configurations may be applied as individual servers, or may be made of individual members of individual servers, and further, physical configuration associated with the server or server. Or it may be provided to be configured as a software related to this, the form or combination of the components may be determined according to the situation to be implemented.

Looking at the configuration of the malicious code access blocking system 10 through the automatic collection of malicious code using the Multi-Thread Site-Crawler, the automatic analysis engine and the security equipment in accordance with the present invention prepared as described above are as follows.

First, a multi-threaded site crawling engine 20 configured to extract and store information about a sub domain and an external URI related to a target web site. Could be prepared.

The multi-threaded site crawling engine unit 20 includes a site structure information extracting unit 21 (a site of a target website) for extracting site structure information of a target website connected to the Internet 11. Extracting structure information) and a subdomain search unit 22 (subdomain search of extracted site structure information for the target website) for searching for sub domain information among the site structure information extracted for the target website; ) Is provided. Here, subdomains are referred to as subdomains related to domains used to operate multiple sites with one domain. For example, for a domain named naver.com, mail.naver.com, In the case of blog pages, blog.naver.com is prepared, and mail and blog will be subdomains of naver.com.

In addition, the information of the external external eye in the domain searched for the target website or the sub domain is stored in the exception U DB (153 URI DB) (reliable URI information storage, and the external external eye information may exist hereafter). If not stored in the exception U eye storage unit 153, the external U eye storage unit (154, External URI DB) (untrusted URI information storage, the URI to be actually analyzed The URI Detection Engine unit 23, which allows the information to be stored, may be configured as a URI detection engine (which may be a URI specified as an absolute address rather than a relative address as external UL eye information used in a page). There will be.

That is, the multi-threaded site crawling engine unit 20 performs a multi-threaded site crawling step (S01) provided to extract and store web information about the subdomain and the external UI related to the target website.

Thus, the information on the subdomain and the external UI related to the target website is extracted and stored.

The web file storage unit 151 (Web file DB) storing the site structure information of the target website extracted by the site structure information extracting unit 21 and the sub domain information retrieved by the sub domain search unit 22 are stored. Sub domain storage unit 152 (Sub Domain DB) (sub domain information is stored) to be stored, and the exception ID eye storage unit 153 for storing normal external UL eye information by the ID detection engine 23. Exception URI DB) and an external URI eye storage unit 154 for storing external UL eye information for which no information exists in the exception UL eye storage unit 153 by the UL ID engine 23. DB) may be included.

That is, a plurality of users 12 and users connected to the Internet 11 may access one or more target websites 13 and web sites through the Internet 11 to obtain desired materials and use them freely.

In this case, some malicious users may include malicious code information or virus information, URI information for interworking with such information, etc., in a web file or a linked file included in a website.

Therefore, the multi-threaded site crawling engine unit 20 according to the present invention will extract Web information, URI information, etc. that may be related to these malicious code information, virus information, and the like.

The site structure information extracting unit 21 of the multi-threaded site crawling engine unit 20 extracts web site structure information of a range corresponding to the entire search area, and the extracted information is stored in a web file of the database 15. Will be stored in section 151.

In addition, it is determined whether or not there is a sub domain among the Web site structure information stored in the web file storage unit 151, and the corresponding sub domain information is retrieved by the sub domain search unit 22 and stored in the sub domain storage unit 152. .

In addition, whether or not the site information, such as the target web site or subdomain, contains external yul information other than the target web site or subdomain, the URI detection engine unit 23 extracts and stores the external yul eye DB. It is.

In this case, the U-ID detection engine unit 23 receives exception URI for storing normal URI information about the known or verified normal advertisement or portal address among the external U-ID information searched or the external U-ID information that has been used stably several times. The storage unit 153 is to be stored in the exception URI DB.

On the other hand, since external ID information other than external ID information classified as normal URI information needs to be determined again, their external URI information is separately stored in the external URL information storage unit 154 (External URI DB). By doing so, a more in-depth structural analysis or path analysis may be performed in a later process.

Next, by taking the information extracted and stored by the multi-threaded site crawling engine unit 20, and analyzing the information to determine whether there is another external URI, continue to analyze the external URI for the other URI of the lower Site tracer (30, Site Tracer) (Site-Crawler extracted from Site-Crawler) which is equipped to store the site information about the analyzed external URI waypoint, is recursed based on the site structure and link information. Can be an analytical navigator that tracks and detects malware distribution sites.

In addition, the malicious code distribution route storage unit 155 (Storage address analyzed as the final malicious code may be stored in the site information stored in the site information about the external URI waypoint associated with the web file analyzed by the site tracer 30, and later May be used by sample auto collection).

That is, after the multi-threaded site crawling step S01 according to the multi-threaded site crawling engine unit 20 is performed, the site tracer 30 retrieves the extracted stored information, analyzes the information, and provides other external URI waypoint information. In order to determine whether there exists, it is provided to store the site information on the analyzed external URI waypoint by continuously analyzing the external URI waypoints for the other URIs of the lower, and the external eyeeye waypoint that analyzes the information on the external URI. Information analysis step (S02) is to be performed.

Thus, for the external URI information that is stored in the external real eye storage unit 154 and needs analysis, other external URI information that is normally determined by the site tracer 30 is displayed. It analyzes whether there is external URI waypoint information or download waypoint information of a file, and if there is continuous download waypoint information or external URI waypoint information, it analyzes the waypoint information continuously. The URI waypoint information of the file which is the download path information of the file will be stored in the malware distribution waypoint storage unit 155.

Next, by analyzing the web file associated with the corresponding website or external URI analyzed by the external yul eye maintenance information analysis step (S02) and analyzes whether the file download path exists, malicious to allow the download URI information of the file download is stored Code suspicious file information analysis step (S03) is performed.

For this purpose, a selective fuzzer 40 may be provided. The selective fuzzer 40 analyzes whether the corresponding URI present in the website and the web file analyzed by the site tracer 30 is valid. Valid URI information may be provided to be stored in the external URL storage unit.

In this regard, the URI information applied to "normal", "valid", "trust", etc. described in the present invention is known as a normal advertisement or a normal portal address that is already known and verified among the external URI information, and has been stabilized many times. This will lead to information about the external URI information used.

 Alternatively, the web file associated with the external URI may be analyzed to determine whether a file download path exists, and the download URI information of the file download may be stored.

In particular, the selective fuzzer 40 analyzes a web file related to a corresponding website or an external URI analyzed by the site tracer 30 to determine whether a file download path exists and determines a file URI for a file download path. The web file analyzer 41 may be provided to allow the information to be stored in the external Ul storage unit, so that valid URI information about the suspected malicious code file to be determined as malicious code may be analyzed.

In addition, a download storage unit 156 (download DB) (storage of malicious code suspicious file path tracking information) may be provided to store download URI information of the suspicious malicious code file analyzed by the selective fuzzer 40.

That is, the web file information is fetched according to the external URI information stored in the external U eye storage unit 154, the malicious code dissemination and maintenance storage unit 155, and then the web information of the external URI is precisely analyzed again. Through a web file analyzer 41 such as an analyzer (multi-threaded type), it determines whether a file download path exists under a suspicious string or code base in each web file and stores the download path in the download storage. The file URI information, which is the download path of the suspicious file to be analyzed by analyzing whether there is a suspicious string or a file download path under the code base, is stored in the download storage unit 156.

In this way, basic information can be collected and stored to analyze suspicious files including information such as malicious code or the route of malicious code hidden more deeply.As a sequential process, more in-depth path analysis is performed. By downloading the suspected malicious code file and analyzing the downloaded malicious code suspect file, the data is converted into a security device compatible form, and the process of malware analysis by the security device may be performed.

First of all, the malicious code suspect file corresponding to the file download path analyzed in the malicious code suspicious file information analysis step (S03) is downloaded as the corresponding download URI information, and the downloaded malicious code suspect file is analyzed to determine duplicate analysis. In addition, the malicious code core file collection step (S04) is performed so that the analysis information including the waypoint information for the malicious code suspect file is stored.

Accordingly, the file download path malicious code analyzed by the selective fuzzer 40 is downloaded as the corresponding download URI information, and the downloaded malicious code suspect file is analyzed and the duplicate file is determined. Sample auto-collector (50) that automatically selects suspected malicious files to be analyzed and stores information including waypoint information of suspected malicious code files (pathway information and malicious information that has been tracked until the relevant malicious code samples are downloaded). Code download URI, MD5 value, and the like).

That is, the sample automatic collector 50 downloads the malicious code suspect file analyzed and stored by the selective fuzzer 40 as the corresponding download URI information, analyzes the downloaded malicious code suspect file, and duplicates the analyzed file. It is determined whether or not. If the suspected malicious code file is not analyzed, sample analysis information including path information, download information, and MD5 hash value for the file is stored.

The malicious code storage unit 157 is provided to store sample analysis information of the malicious code suspect file analyzed by the sample automatic collector 50.

As described above, after the malicious code suspect file that needs to be analyzed precisely is subjected to a duplicate search determination process, a target web site, subdomain or different domain (domain having a different address from the target web site or subdomain). Automatic dynamic analysis engine (60) (the information analyzed through the dynamic analysis process, which is provided to store the dynamic analysis information and error information generated during the analysis through the malicious code dynamic analysis process for the malicious code suspicious file information) Log storage).

In other words, the malicious code suspicious file is provided to store the dynamic analysis information and error information generated during the analysis of the malicious code suspicious file information related to the target web site, sub domain, or different domains. Dynamic analysis step (S05) is performed. In the case of different domains, if there is an external link on the website, it is tracked and analyzed, and if it is determined that a malicious code file exists, the file is downloaded and analyzed recursively. In the step S05 of malicious code dynamic analysis, the similarity with the previously analyzed files may be performed by a precise analysis by actual dynamic analysis.

The automatic dynamic analysis engine 60 receives information on the malicious code suspect file from the sample automatic collector 50, and analyzes the malicious code suspect file that has been analyzed by the analysis agent and the analysis agent. The analysis engine master 61 (virtualization analysis system) for receiving the analysis information from the virtualization analysis system manager 62 and storing the analysis information in the analysis system 158 (storing the dynamic analysis information of the suspected malicious code file). It is provided to the analytics storage unit to store the analysis information provided from the manager.

In addition, the malicious code suspect file is received from the analysis engine master 61 so as to be transmitted to one or more analysis agents 63 (transmitting dynamic analysis information about the malicious code suspect file to the virtualization analysis system manager). A virtual analysis system manager 62 having an intermediate role that receives dynamic analysis information about a malicious code suspicious file from the analysis agent 63 and transmits the analysis information to the analysis engine master 61 is provided.

Thus, information and analysis dynamically analyzed from the automatic dynamic analysis engine 60 for malicious file suspicious files related to the target web site, subdomain or different domains (domains having a different address from the target website or subdomain). The generated error information is provided to be stored in the analytic storage unit 158.

That is, for a plurality of malicious code suspect files that are many search targets, an individual analysis agent (Agent) 63 is provided to enable a plurality of analyzes. In such an agent 63, the file is capable of distributing malicious code or functions. It will be determined whether or not included, and classified the suspected malicious code files will be analyzed by the security equipment afterwards whether the malicious code.

In order to distribute such a large amount of suspected malicious files to a plurality of individual agents, a virtualization analysis system manager 62 is provided. The virtualization analysis system manager 62 detects an agent whose analysis is completed among a plurality of individual agents. Information about the suspected malware file will be sent. In addition, the analysis information of the suspected malware file that has been analyzed is transmitted to the analysis engine master 61 again, and the analysis engine master 61 transmits the analyzed data to the analysis DB. In fact, since various modified forms of malicious codes are mostly obfuscated and planted in the malicious code file, the process of de-obfuscating them in various ways and analyzing the contents of the de-obfuscated files to determine whether they are suspected of malware or viruses Then, the extracted dynamic analysis data will be extracted the signature for interworking security equipment that can be processed by the security equipment in the subsequent process.

Accordingly, by receiving the analysis information on the suspected malicious code file analyzed through the automatic dynamic analysis engine 60, the signature information on the suspected malicious code file interoperable with the security equipment 75 is extracted for the suspected malicious code file. The security equipment interlocking engine unit 70 is provided.

Then, the signature storage unit 159 is provided to receive and store the signature information on the suspected malicious code file by the security device interlocking engine unit 70.

In other words, the signature information on the suspected malicious code file that can be linked with the security device 75 is received by receiving analysis information on the suspected malicious code file analyzed through the malicious code SIM file dynamic analysis step (S05). Security equipment interlocking signature extraction step (S06) to be extracted is performed.

Thus, the signature information extracted through the security equipment interlocking engine unit 70 is used to detect whether or not the malicious code through the general security equipment 75, so that the detection block suitable for the malicious code can be performed. General malware processing is performed.

The malware access blocking system 10 and the malware access blocking method through the automatic collection of malware using the multi-thread site crawler according to the present invention, an automatic analysis engine, and a security device are interlocked according to the present invention. With respect to, with reference to the accompanying Figures 1 to 13, it will be described as follows for the configuration and preferred implementation method of the preferred embodiment possible.

Attached Figure 1 is a schematic diagram of the overall system configuration of the malware access blocking system 10 according to the present invention, Figure 12 is a control block diagram of the malware access blocking system 10 according to the invention, Figure 13 shows a flow chart of the malware blocking method. And FIG. 2 shows the order of the entire configuration in the data processing flow of the present invention.

The malware access blocking system 10 according to the present invention is a configuration connected to the Internet 11, a high-performance Multi-Thread Site-Crawling engine, Selective Fuzzer and Site-Trace, sample automatic collector, sample automatic analyzer, security It may be configured as an equipment interlocking engine.

Multi-Thread Site-Crawler is an engine used in search sites, and it is a technology that collects necessary information by tracking web documents existing on the Internet, and Selective Fuzzer is a site tracer that can track a valid malware distribution path. It is to have a function.

In addition, Site-Tracing (Site-Trace) has the function of tracking the final malware distribution site by recursively tracking the distribution of malicious code based on the site structure and link information extracted through Site-Crawler.

The data processed by the Multi-Thread Site Crawling engine is further analyzed by Selective Fuzzer, and when it is determined as a malicious code as a result of the deep analysis, the trace file is downloaded to the final location of the malicious code (Site Tracer).

Downloaded malicious code suspicious file is analyzed by sample automatic analyzer and extracts signature that can be linked with security equipment. The extracted signature is registered in the pre-installed security equipment through the security equipment interlocking engine, and then detects / blocks activities related to the malicious code.

Looking at the embodiment of the process in more detail for this series of processes as follows.

First, referring to FIG. 3, a multi-thread site crawling engine 20 will be described. A plurality of users 12 and 12 are connected to the Internet 11 to use services. By extracting the site structure information of the target website 13, the extracted Web file information may be stored. Data handled by a number of engines or processing members described below, including the multi-thread site-crawling engine, may be stored in related databases (Data base, DB, storage), and these databases may be separately It may be provided as a data server connected to the Internet, or may be provided as a part of the internal network connected to the processing members and individual network means, and further provided in various forms such as a storage configuration installed inside the processing members. It could be.

Accordingly, based on one domain extracted from the Domain DB (Domain Storage) list in which Domain information of the target Web Site is stored, Brute Forcing may be performed to find a subdomain related to the relevant domain. After the domain structure is identified, the information is stored in the Sub Domain DB (subdomain storage unit 152).

For example, if the domain "Target.co.kr" exists in the domain DB to be analyzed, "webmail.target.co.kr" based on the domain name by the subdomain search unit 22, which is the engine. After checking whether the sub domains such as "home.target.co.kr" and "blog.target.co.kr" exist, the domain structure information based on the verified domain is subdomain storage unit (Sub Domain DB, 152). Based on the domain structure stored in the Sub Domain DB, the main page of "Target.co.kr" is searched and the external address information is extracted through the URI detection engine based on the source of the page. It will also find pages from other related domains and extract relevant external addresses.

Therefore, the main function of the UI Detection Engine 23 configured as shown in FIG. 4 is to crawl each start page such as index.html and index.jsp or related pages with respect to the extracted domain structure, and then, each Web Site. The structure of the Then open all web files that exist below, so that internal and external between <html> and </ html>, internal and external between <body> and </ body>, <iframe>, <script>, <a External URI information is extracted for tag parts such as href>.

The extracted external URI information is compared with the contents of the exception URI DB (exception U eye storage unit 153), and if there is no matching external URI information, the corresponding information is stored in the External URI DB (external U eye storage unit). ).

That is, the Exception URI DB stores URI information divided into normal information, such as a normal advertisement page, and is used to store an exception for a normal external URI. On the other hand, the exception is not handled in the External URI DB, and the information of the external URI that is further analyzed or abnormally exists is stored.

For example, if "http://Target.co.kr/index.php" exists, the URI Detection Engine analyzes the contents of index.php and references Web Pages (.html, .htm, In the case of .php, .asp, etc. ("./board/index.php" format), the UID Detection Engine thread will be created with the URI address as an argument. It will scan all web files within the same web site.

In the case of a URI referenced by an absolute address (for example, in the format of "http: // xxxx"), it is determined whether it exists in the exception URI DB (Exception URI DB). It is stored in the tunnel URI eye storage unit (External URI DB).

In more detail, the "http://target.com/index.php" file contains "<iframe src =" http://hacking.ro.cn/malicious/worm.php "width =" 0 " If it contains information such as height = "0"> "and" http://hacking.ro.cn/malicious/worm.php "corresponding to the URI address does not exist in the Exception URI DB, the URI is External It is stored in the URI DB and further analyzed by the Selective Fuzzer Engine.

In a typical normal web page, such as the tag format <iframe src = "http://hacking.ro.cn/malicious/worm.php" width = "0" height = "0"> mentioned in the example above, In this case, it may be an example of not being used, and an example may be used when a malicious attacker visits a home page where a user visits a lot, and causes a remote web server to be viewed without an unspecified number of users. Other web files could contain information that would allow such a malicious attacker to connect to another web server without the knowledge of an unspecified number of users, and this malicious content would have to be retrieved. In other words, the tool will detect the contents including attack signs.

Accordingly, as shown in FIG. 5, the selective fuzzer retrieves the created external URI DB data to obtain corresponding web file information. The contents of the imported file are analyzed to determine whether there is another external URI information, and the process can be repeated continuously until the malicious file download path does not exist or another external URI does not exist. . In addition, the process may be repeated by another external URI, and the site information and path information of the external URI used as waypoints will be stored in the malicious code distribution waypoint DB.

In addition, it can be analyzed in the form of multi-thread according to the identified site structure. Each web file can be analyzed by a web file analyzer such as an online analyzer. After determining whether a path exists, information such as a download path may be stored in a download storage unit (Download DB). Eventually, Download DB will store URI information of malicious suspect file to download.

In the above case, if information of another external page exists in "http://hacking.ro.cn/malicious/worm.php", a web file analyzer such as an online analyzer is created by creating a thread that takes the web page as an argument. Based on the suspicious string and code, the download path of the suspicious file is analyzed, and the address of an external web page such as <a href="http://redirect.cn/hack.js"> If present, it creates an online analyzer thread that takes the URI as an argument and repeats the task continuously. When the download URI information analyzed by the online analyzer comes out, the information is inserted into the Download DB.

Next, as shown in FIG. 6, the download engine (downloading suspected malicious files and monitoring the download path input) monitors the input of new data in the Download DB and withdraws the corresponding data when new data is input. By downloading the suspected malicious file in the path in the form of multi-thread.

If the download is completed normally, as a result of analyzing the suspected malicious file downloaded, it will be determined whether the corresponding malicious code suspected file is duplicated.

As an example of whether or not a duplicate analysis of the suspected malicious code file is performed, the MD5 hash value of the suspected malicious code file is calculated to check whether data having the same hash value exists in the malicious code DB. It can be prepared to prevent duplicate analysis. If there is no duplicate analysis, analysis information such as download time, MD5 hash value, download URI, download IP information, malware download path, etc. can be analyzed. DB) 157 will be stored.

As described above, after the process of screening and collecting the suspected malicious file for analyzing the malicious code, the signature extraction and inspection process for the detailed analysis and inspection of the suspected malicious code may be performed.

First, referring to the malicious code automatic dynamic analysis engine in FIG. 7, a plurality of agents (63, analysis agents) connected to the analysis engine master (61), the virtualization analysis system manager (Manager) 62, and the virtualization analysis system manager 62 are analyzed. Or a virtualization analysis engine) and the like, and the agent performs the information obtained through the automatic dynamic analysis of each malicious code to be delivered to the analysis engine master 61.

Therefore, referring to a preferred embodiment of the virtualization analysis engine, the virtualization analysis engine connected to the virtualization analysis system manager 62 is composed of N analysis agents (Agent), each Agent is a predefined constant of the transmitted samples. It may be implemented to be analyzed for the time of M.

Looking at the embodiment specifically illustrated through Fig. 7, Fig. 8, etc., the analysis engine master 61 monitors whether there is information related to the newly downloaded malicious code, and if there is the downloaded information, the corresponding file is analyzed You will be asked to check whether the sample is valid.

If it is confirmed that the sample has not been analyzed yet, it checks the current state of N virtualization analysis engines (Agents), detects the optimized path, selects the active virtualization engine engine, and sends the sample. Will be.

In the process of analyzing the analyzed result data as shown in FIG. 9, when the sample analysis is completed in each virtualization analysis agent, the analyzed result is transmitted back to the virtualization analysis system manager 62 and the analysis engine master 61. The analysis engine master 61 receiving the value registers the Fuzzy-hash value for each sample in the Fuzzy-hash list, checks the similarity with the previously analyzed samples, and attaches the calculated similarity value (%) to the result. Done. Once a result unit is created, it can be implemented to save the result in Analysis DB.

For example, one analysis engine master 61, a virtualization analysis system manager 62, and three analysis agents 63 are provided, followed by A.exe, B.exe, C.exe, The following description will be given based on the assumption that the malicious code suspect files such as D.exe are down in order.

First, the analysis engine master 61 and the virtualization analysis system manager 62 allow A.exe to be delivered to the first agent, B.exe to be delivered to the second Agnet, and C.exe to be delivered to the third Agent. The analysis process may be performed so that the first agent completes the analysis of A.exe (or may be set to complete the analysis after a constant M time), and the analysis result is virtualized analysis system manager. (62), may be transmitted to the analysis engine master 61 and the information is stored in the Analysis DB.

Accordingly, the first agent informs its activation status information to the virtualization analysis system manager 62 and the analysis engine master 61, and the analysis engine master 61 and the virtualization analysis system manager 62 provide data of D.exe. It is sent to the first Agnet for continuous analysis. Of course, when the second Agent completes the analysis of B.exe, it will send another malicious code suspect file downloaded after D.exe to the second Agent for processing.

Accordingly, as shown in FIG. 10, the analysis agent 63, which is a virtual analysis engine, performs a dynamic analysis of malicious codes on malicious code suspect files. In fact, when a sample is sent from the analysis engine master using a virtual machine, each agent starts network sniffing and stores information such as network status, registry status, and file status before the sample is executed.

After that, the file structure such as PE structure of the file will be analyzed and the header information will be extracted. In the case where the execution is extruded by Protector or Packet, it may not be a normal PE header, so packing inspection may be performed to check execution compression information.

In case of executable type (eg, ".EXE", ".COM", etc.), it will be executed immediately, but in case of suspected malicious file type such as ".DLL", it will be based on predefined routines such as DLL injection. The analysis process can be performed.

In this way, after the sample is executed, it can be executed to continuously store a dump of the process memory by the sample, and DNS information can be detected for query verification of different domains. Registry filtering to detect changes by checking registry status after a predefined time of M, extract only data needed for malware analysis, sort by change / create / delete, filter file change history, network sniffing The process of eavesdropping traffic transmitted on the network), the file storage of sniffed traffic (Traffic), and important method parsing such as GET or POST may be performed in the sniffed traffic.

When the analysis is completed, the result is transmitted to the analysis engine master 61 and the virtualization analysis system manager 62. When an error occurs in each execution step, an error occurrence error log is recorded and the analysis engine master 61 ) And so on.

Next, referring to an embodiment of the security equipment interlocking engine 70 for interlocking with the security equipment 75 as shown in FIG. 11, the malicious code is mainly based on the information calculated by the automatic dynamic analysis engine 60. Malware URI DB according to the analysis of the suspicious file (Malware URI DB), malicious code distribution (IP standard), PE header information on the malware may be implemented to generate a signature that can be linked to the security equipment. And when the update request from the interlockable security equipment, it may be prepared to provide real-time updates.

The signature for enabling interoperability with security equipment may include malware distribution (IP standard), malware URI, and malware header information.In addition, the collected information is used to identify the exact mechanism by which malware operates. Could be used.

For example, the security equipment interworking engine unit 70 (monitoring new data input of the analytic storage unit and providing real-time updates when the security device requests an update) monitors the new data input in the Analysis DB. If it is added, it can be implemented to extract signatures that can be linked with security equipment based on the contents of suspicious malware distribution URI information, suspicious malware distribution IP, PE header information of suspicious malware file, etc. The information is stored in the signature DB.

In addition, each security device additionally detects the latest update contents of the signature DB, and if there is new data, the signature update may be performed.

The malware access blocking system performs a process such as automatic collection of malware using the Multi-Thread Site Crawler according to the present invention, an automatic dynamic analysis engine of malicious code suspect files, and a signature generation for interworking security equipment. (10) and malicious code suspicion detected by accurate detection of malicious code suspicious files distributed through target websites and related URIs that are accessed and used by a large number of users through the Internet. By converting the file to be easily analyzed by the security device, there is an advantage to maximize the detection performance and analysis efficiency of malicious code.

Although the embodiments of the present invention have been described in detail above, the embodiments have been described so that those skilled in the art to which the present invention pertains can easily carry out the present invention. The technical spirit of the invention should not be interpreted limitedly.

10: malicious code access blocking system 11: Internet
12: user 13: target website
15: Database 151: Web File Storage
152: sub domain storage unit 153: exception U eye storage unit
154: External U eye storage unit 155: Malicious code distribution and maintenance storage unit
156: download storage unit 157: malware storage unit
158: analysis storage unit 159: signature storage unit
20: multi-threaded site crawling engine
21: Site structure information extraction unit 22: Sub domain search unit
23: UID detection engine unit 30: Site tracer
40: Selective Fuzzer 41: Web File Analyzer
50: sample automatic collector 51: download engine
60: automatic dynamic analysis engine 61: analysis engine master
62: Virtualization Analysis System Manager 63: Analysis Agent
70: security equipment interlocking engine unit 75: security equipment

Claims (6)

Multi-thread Site Crawling Engine (20), which is provided to extract and store information on the sub-domain of the target website, and the information on the external URL described in the target website or the sub-domain;
Imported and stored information extracted and stored by the multi-threaded site crawling engine unit 20, and analyzing the information to continue to analyze whether there is an external UL eye is provided so that the site information for the analyzed external UL eye waypoints are stored. And, the site tracer 30 to analyze the information about the external eye, and
A selective fuzzer 40 for analyzing whether a file download path exists by analyzing a web file of the corresponding website analyzed by the site tracer 30 or an external UI, and storing download URI information of the file download;
The file download path malicious code analyzed by the selective fuzzer 40 is downloaded as the corresponding download URI information, and the downloaded malicious code suspect file is analyzed, but the hash value data is calculated by calculating the hash value of the malicious code suspect file. Whether the data of the corresponding hash value exists or not is analyzed to determine whether it is duplicated or not, and automatically suspects malicious files to be analyzed because they are not duplicated, and includes information on the waypoints of the suspected malicious code files. Sample automatic collector 50 to be stored,
Automated dynamic analysis engine that stores dynamic analysis information and error information generated during dynamic analysis of malicious code suspicious file information in target web site, sub domain or different domains. 60,
Through the automatic dynamic analysis engine 60, receiving dynamic analysis information on the malicious code suspect file that has been dynamically analyzed, so that signature information on the suspected malicious code file interoperable with the security device 75 may be extracted. It is provided that includes a security equipment interlocking engine unit 70,
The different domain is a malicious code access blocking system, characterized in that provided with a domain having a different address than the target website or subdomain.
The method of claim 1,
The multi-threaded site crawling engine unit 20,
A site structure information extracting unit 21 for extracting site structure information of a target website connected to the Internet,
A subdomain searching unit 22 for searching subdomain information among the extracted site structure information for the target website;
The information of the external UL eye stored as the normal UL eye information among the searched domains for the target website or the sub domain is stored in the exception UL eye storage unit 153 and is not stored in the exception UL eye storage unit 153. If not, the UID detection engine unit 23, which is to be stored in the external U eye storage unit 154 is included,
The normal eye information includes information of a yual eye known as a normal advertisement or a normal portal address that has been known and verified, information of a yul eye that has been used stably many times already,
Malicious code access blocking system, characterized in that the information on the sub-domain of the target website, and the information on the external UI described in the target website or sub-domain is provided to be extracted and stored.
The method of claim 2,
A web file storage unit 151 (Web file DB) for storing site structure information of the target website extracted by the site structure information extracting unit 21;
A sub domain storage unit 152 (Sub Domain DB) in which the sub domain information retrieved by the sub domain search unit 22 is stored;
An exception UL eye storage unit 153 (Exception URI DB) for storing the external UL eye information having the normal UL eye information by the UL ID engine 23;
An external Ul eye storage unit 154 (External URI DB) for storing the external Ul eye information without information in the exception U eye storage unit 153 is included by the U ID detection engine unit 23. Malicious code access blocking system characterized in that.
The method of claim 1,
Malicious code distribution way storage unit 155 is provided that stores the site information for the external WIA waypoint described in the web file analyzed by the site tracer 30,
The selective fuzzer 40 determines whether a file download path exists by analyzing a web file of the corresponding website or an external UI analyzed by the site tracer 30, and download URI information of the file for the file download path. Is provided with a web file analyzer 41 to be stored, so that the download URI information for the suspected malicious code file to determine whether or not malicious code is analyzed,
There is provided a download storage unit (156, Download DB) for storing the download URI information on the suspicious file malicious code analyzed by the selective fuzzer 40,
The sample automatic collector 50 downloads the malicious code suspect file analyzed and stored by the selective fuzzer 40 as the corresponding download URI information and analyzes the downloaded malicious code suspect file, while analyzing the hash value of the malicious code suspect file. It calculates whether the data of hash value exists and checks whether the file is duplicated or not by analyzing whether or not the data of hash value exists. In case of suspicious file that has not been analyzed, path information and download information about the file , So that the sample analysis information including the MD5 hash value is analyzed,
The malicious code storage unit 157 is provided to store the analysis information of the suspected malicious code file analyzed by the sample automatic collector 50,
And a signature storage unit (159) configured to receive and store the signature information on the suspected malicious code file by the security device interlocking engine unit (70).
The method of claim 1,
The automatic dynamic analysis engine 60,
By receiving information on the suspected malicious code file from the sample automatic collector 50, data is transmitted to the virtual analysis system manager 62 capable of virtual analysis, and analyzing the analyzed information on the suspected malicious code file that has been analyzed. An analysis engine master 61 provided from the system manager 62 to be stored in the analysis storage unit 158,
Receives information about the suspected malicious code file from the analysis engine master 61 to be transmitted to one or more analysis agents 63, and receives the dynamic analysis information about the suspected malicious code file from the analysis agent 63. A virtualization analysis system manager 62 for transmitting to the analysis engine master 61;
Receives information on the suspected malicious code file from the virtualization analysis system manager 62, performs dynamic analysis on the suspected malicious code file, and analyzes the dynamic analysis information along with information on the occurrence of an error during the dynamic analysis process. One or more analysis agents 63 are transmitted to the system manager 62 to dynamically analyze and analyze the malicious code suspect files included in the target web site, subdomain, or different domains. It is provided to store the generated error information,
The malware analysis block system, characterized in that the dynamic analysis information for the malicious code suspect file from the automatic dynamic analysis engine 60 is transmitted and stored.
In the multi-threaded site crawling engine unit 20 of the malicious code access blocking system 10, information on the subdomain of the target website 13 connected to the Internet 11, and the external website described in the target website or subdomain. A multi-threaded site crawling step (S01) configured to extract information about the U-R, and store the extracted information in the database 15 in the multi-threaded site crawling engine unit 20;
The information extracted and stored by the multi-threaded site crawling step (S01) is taken from the site tracer 30, and the information is analyzed to continuously analyze whether or not there is another external eye. Site information is provided so as to be stored in the database 15, the external eye eye maintenance information analysis step (S02) to analyze the information about the external eye by the site tracer (30);
Analyzing whether the download path of the file exists by analyzing the information of the corresponding website or the web file of the external UL eye analyzed by the external UL eye maintenance information analysis step (S02), and analyzing whether the file download path exists. A malicious code sim file U eye information analysis step of allowing the download URI information to be stored in the database 15 (S03);
The file download path and the information about the suspected file of the malicious code of the file download analyzed by the malicious code sim file U eye information analysis step (S03) are taken from the sample automatic collector 50, and the sample automatic collector 50 is used. Download the suspected malicious code file as the relevant download URI information and analyze the suspected malicious code file, calculate the hash value of the suspected malicious code file and check whether the data of the hash value exists or not. Determining the duplicate analysis, and collecting the malicious code file of the malicious code (S04) so that the analysis information including the waypoint information about the malicious code suspect file is stored in the database 15;
The analysis information analyzed by the malicious code core file collection step (S04) is taken from the automatic dynamic analysis engine 60, and the malicious code described in the target web site, sub domain, or different domain by the automatic dynamic analysis engine 60. Simultaneous dynamic file analysis step (S05) of the malicious code provided to be stored in the database 15, the dynamic analysis information and the error information generated during the dynamic analysis for the information of the suspicious file;
Receive dynamic analysis information about the malicious code suspicious file dynamically analyzed through the malicious file sim file dynamic analysis step (S05), and suspect the malicious code in the security equipment interlocking engine unit 70 A security equipment interlocking signature extraction step (S06) is provided to extract the signature information on the suspected malicious code file that can be interlocked with the security equipment 75 for the file.
The different domain is a malicious code access blocking method, characterized in that provided in the domain having a different address from the target website or subdomain.

Images