KR101110308B1 - Apparatus and method for detecting malicious code using packed file properties - Google Patents

Abstract

The present invention relates to an apparatus and method for detecting malware using execution compression characteristics. Malware detection apparatus and method using the execution compression characteristics according to the present invention, by analyzing the file header of the target file, to determine whether to compress the execution, if the target file is executable compression, the header compression method and compression method The compression method is detected using the analysis method using the signature of. The compression method used for the execution compression is compared with the compression method database for malicious code compression to determine whether the target file is malicious code. Therefore, even in the case of running compressed malicious code, it is possible to determine whether the malicious code is without decompression.

Malware, Malware, Malware Detection, Compression Method Detection, Execution Compression, PE Header

Description

Apparatus and method for detecting malicious code using packed file properties}

The present invention relates to a malicious code detection technology, when the executable executable (PE) file, which is a Windows-based executable file, is compressed, detects a compression method and detects malware using an execution compression characteristic that determines whether the file is malicious code. An apparatus and a method thereof are provided.

The present invention is derived from the research conducted as part of the IT growth engine technology development of the Ministry of Knowledge Economy and the Ministry of Information and Communication Research and Development. [Task management number: 2006-S-042-03, Task name: Countering Zero-Day Attack of Network Threat Development of Real Time Attack Signature Generation and Management Technique

The reason for compressing the execution of malware is to bypass the search of the malware search engine or to prevent the analysis of malware through reverse engineering. The Black Hat 2006 Society reported that 92 percent of Wildlist-registered malware was compressed, and PandaLab's report found that 79 percent of new malware was compressed. In addition, there are statistics that more than 50% of newly appeared malicious codes are compressed by other compression methods. The reason why the compressed malicious code is increased is that the source code of the compression method is disclosed and anyone can easily modify the algorithm or the source code to create various kinds of compression methods.

In general, the malware search engine detects compressed compressed code and performs additional analysis. The executable file before the decompression process can pass the malware signature check, so it must be scanned after the decompression process. Manual decompression requires a lot of time and effort, and automatic decompression requires complex decompression routines for all compression methods, making it very complex and difficult to implement completely.

An object of the present invention is to detect the compression method of the file using the PE header analysis method and the signature analysis method for the detection of malicious code, and then compare the compression method without decompression process to determine the execution compression characteristics to determine whether or not malicious code The present invention provides a malware detection apparatus and method thereof.

The object of the present invention is a PE file determination unit that analyzes a file header of a target file to determine whether the target file is a PE file, and if the target file is a PE file, whether or not to execute compression through section header analysis of the target file. Compression method detection unit for detecting a method, and a first database for indicating whether or not malicious code for each compression method, comprising a comparison of the first database and the compression method, malicious to determine whether the target file malicious code It is achieved by a malware detection apparatus using the execution compression characteristics including a code determination unit.

In addition, a PE file checking step of receiving a target file, and checking whether the target file is a PE file, and if the target file is a PE file, analyzing a section header name and a characteristic item of the target file and detecting a compression method. Detecting a compression method, a malicious code detection step for detecting malicious code compared to the first database that stores the compression method and whether the malicious code for each compression method, and outputting whether the target file malicious code It is achieved by the malware detection method using the execution compression characteristic.

According to the present invention, it is possible to determine whether or not malicious code without decompressing the execution compressed target file. In addition, if the present invention is applied to a search engine to which the existing malware search method is applied, it is possible to increase the speed and accuracy of malware search.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

An apparatus and method for detecting malicious codes using the present compression characteristics are described as follows. First, check the file header of the target file to verify that it is a PE file. If the target file is a PE file, the section header's Name and Characteristic items are examined to detect the compression method used. At this time, if the detected compression method is a compression method for compressing malicious codes, the target file is determined as malicious code. However, if it is not possible to determine the malicious code of the target file only by the compression method, extract MD5 and file size from the target file, and compare the target file with the malicious code compression method, MD5, and the malicious code database. Determine if malicious code

1 is a structural diagram of a PE file which is an executable file of Microsoft.

The PE file is composed of an MS-DOS MZ header 101, an NT header 110 including a PE file header 113 including a PE signature 111 and a PE Optional header 115, a section header 120 and section data. 130.

MS-DOS MZ header 101 is a file header for compatibility with Microsoft's previous operating system, MS-DOS, characterized in that the "MZ" string is present at the beginning of the header.

NT header 110 includes a PE signature 111, a PE file header 113, and a PE Optional header 115.

The PE signature 111 is composed of a string of "PE00", indicating that the file is a PE file. PE signature 111 is characterized in that present in the start position of the NT header (110).

The PE file header 113 includes information on file characteristics, such as the number of sections, the type of executable computer, the last modification time of the file, and the like. The PE Optional header 115 contains information for executing a program, such as an entry point of program code.

The section header 120 is located after the NT header 110, and the NT header 110 includes basic information of the section header. The section header 120 includes information about a section name, section size, and section characteristics of each section.

The section data 130 is located behind the section header 120 and is used as program code or data storage space for each section characteristic.

2 is a block diagram of a malicious code detection apparatus using an execution compression feature that is an embodiment of the present invention.

The malware detection apparatus 200 using the execution compression characteristic includes a PE file detection unit 210, a compression method detection unit 220, a malicious code detection unit 230 and a compression method database 240.

The PE file detection unit 210 checks the header of the target file to see if it starts with the "MZ" string. When the header of the target file starts with "MZ", the PE file detection unit 210 of the target file checks the NT header 110 existing after a certain bit from the start position. The NT header starts with the PE signature 111 and, in the case of a PE file, the NT header 110 with "PE00". The header starts with "MZ" and the PE signature "PE00" string in the NT header indicates that the file is executable on the Microsoft operating system.

The compression method detector 220 includes a section header analyzer 221 and a signature searcher 223.

When the target file is a PE file, the section header analyzer 221 analyzes the section name and the section characteristic information of the section header 120 of the target file to detect a compression method.

Executables generated by common compilers use standard section names. For example, .text, .data, .rsrc, .reloc, .rdata, .idata, CODE, DATA, and so on. However, if the PE file is compressed, use a unique section name for each compression method. For example, the compression method ASPack uses .aspack as the section name, UPX uses UPX0, UPX1, UPX2, Upack uses Upack and Yoda's Crypter yC. Therefore, analyzing the section name can detect the execution compression method.

Also, a section property item is set with a value indicating whether the section can be read, written, or executed. In general, when the executable is compressed, the section property is set to be both writeable and executable because the section must be decompressed when the actual file is executed.

Therefore, by analyzing the section name and the section characteristics, it is possible to detect whether the target file is executed or not and how to compress it.

The signature search unit 223 searches whether a specific string pattern exists in the header of the target file. The general execution compression method leaves a unique fingerprint in the header of the target file, so that the compression method can be detected by detecting it.

The malicious code detection unit 230 compares the compression method detected by the compression method detection unit 220 with the compression method database 240 and checks whether the corresponding file is malicious code.

The compression method database 240 includes a first database 241 storing a compression method of malicious codes, and a second database 243 including a compression method of malicious codes, MD5 of malicious codes, and file sizes of malicious codes. .

The first database 241 stores the compression method into blacklist, whitelist, and graylist. Blacklists include compression methods used to compress malware, and whitelists include commercial compression methods that are not commonly used to compress malware. Compression methods used for malware include Upack, NsPack, Mew, Pex, Yoda's Crypter, PolyCryptPE, and commercial compression methods include Themida, Armadillo, AsProtect, UPX, PeCompact, AsPack, and others. However, the compression method that can be used for both normal and malicious code is stored in the gray list, and the compression methods include FSG and Morphine.

In the case of the compression method included in the gray list of the first database 241, it is not possible to determine whether the target file is a malicious code only by comparing with the first database. Therefore, it is finally determined whether or not the target file is malicious code as compared with the second database 243 including the malicious code compression method, MD5, and the size of the malicious code.

MD5 receives the target file, changes it to a 128-bit fixed-length output, and represents a unique value representing the target file.

3 is a flowchart illustrating a malicious code detection method using an execution compression feature that is an embodiment of the present invention.

When the test target file is input to the PE file detection unit 210 (S100), the header of the target file is analyzed to check whether the PE file is present (S101).

If the target file is a PE file, the compression method detection unit 220 analyzes the section header of the target file and extracts the section name and the characteristic item (S103). The compression method detection unit 220 analyzes the extracted section name and characteristic items and detects whether the target file is executed or not and compresses the execution file. However, if the compression method cannot be detected through the analysis of the extracted section name and the characteristic item, the compression method detection unit 220 detects whether the header file of the target file includes a fingerprint unique to the compression method, and detects the compression method. (S105).

When the compression method is detected by the compression method detection unit 220, the malicious code detection unit 230 determines whether or not the malicious code of the file by checking the use of the compression method for malicious code (S107).

When the compression method is detected by the compression method detection unit 220, the malicious code detection unit 230 first checks whether the safe compression method is included in the registered white list (S107). If the target file is included in the whitelist, the target file is determined to be a safe file. If the compression method of the target file is not registered in the white list, it is checked whether the compression method for malicious code is included in the registered black list (S109). If it is included in the blacklist, the target file is determined to be malicious code. If not registered in the black list, it is checked whether the detected compression method is included in the gray list (S111). The compression method registered in the gray list cannot determine whether the target file is malicious code only by the compression method. Therefore, the malware detection unit 230 extracts the MD5 and the file size of the target file (S113). By comparing the MD5 and the file size of the extracted target file with the stored malicious code, it is finally determined whether the malicious code (S115). Finally, the determination result of the malicious code detection unit 230 is output (S117).

While the preferred embodiments of the present invention have been shown and described, the present invention is not limited to the specific embodiments described above, and the present invention is not limited to the specific embodiments of the present invention, without departing from the spirit of the invention as claimed in the claims. Various modifications can be made by those skilled in the art, and these modifications should not be individually understood from the technical spirit or the prospect of the present invention.

1 is a structural diagram of a PE file defined by Microsoft;

2 is a block diagram of a malicious code detection apparatus using execution compression characteristics according to an embodiment of the present invention, and

3 is a flowchart illustrating a malicious code detection method using execution compression characteristics according to an embodiment of the present invention.

Claims (10)

A PE file determination unit that checks whether the file header of the file to be checked includes a PE signature that identifies the PE file; A compression method detector configured to detect whether or not an execution compression is performed and a compression method in a section header of the file header when the file header includes the PE signature; A first malicious file including a first list storing a compression method used only for a normal code and not a malicious code, and comparing the compression method of the file to be included in the first list to determine whether the file is malicious code; Code determination unit; And a second list for storing a compression method used only for malicious code, and if the compression method of the file is not included in the first list, comparing the file with the second list to determine whether the file is malicious code. A second malicious code determination unit; And A third list storing a compression method used for both malicious code and normal code, and if the compression method of the file is not included in both the first list and the second list, compares whether the file is included in the third list, and , If the compression method of the file is included in the third list, the third list database is extracted by extracting the MD5 and file size of the file from a second database including a compression method, an MD5 value of the file, a file size, and a malicious code flag. And a third malicious code determiner that determines whether the file is malicious in comparison with the malicious code. The method of claim 1, The compression method detecting unit extracts a section name and a feature item from the section header, and then checks whether the extracted section name is a section name used in a compression method not used in the malicious code, and writes and executes the feature item. And a section header analyzer for detecting the compression method by checking whether it is set to be enabled. The method of claim 1, The compression method detection unit, the signature detection unit for detecting the compression method by checking whether the file header includes a signature unique to each compression method; malware detection apparatus using the execution compression characteristics further comprising. delete delete Checking whether the PE file determination unit of the malware inspection apparatus includes a PE signature that identifies the PE file from the file header of the file to be scanned; When the file header includes the PE signature, detecting a compression method and a compression method in a section header of the file header by a compression method detector; A first malicious code determining unit determining whether the file is malicious code by comparing whether the compression method of the file is included in a previously stored first list; If the compression method of the file is not included in the first list, the second malicious code determination unit compares whether the compression method of the file is included in a second list that stores a compression method used only for malicious code. Determining whether a code; And If the compression method of the file is not included in either the first list or the second list, a third malicious code determination unit compares whether the compression method of the file is included in the third list, and if so, MD5 of the file. And extracting the file size and determining whether the file is malicious by comparing with a third list database including a compression method, an MD5 value, a file size, and a malicious code flag. Detection method. The method of claim 6, When the compression method cannot be detected in the section header, the compression method detection unit extracts a section name and a characteristic item from the section header and compares the section name with the section name used in the compression method not used in the malicious code. And detecting whether a compression method of the file is detected by checking whether the characteristic item is set to be writeable and executable. The method of claim 7, wherein And when it is impossible to determine the compression method by extracting the section name and the characteristic item, detecting the compression method by checking whether the compression method detection unit includes a signature specific to each compression method in the section header. Malware detection method using compression characteristics. delete delete

Images