KR101169014B1 - System for detecting landing, hopping and distribution sites of malicious code - Google Patents

Abstract

Provided is a malicious code via-distribution detection system capable of systematic detection of malicious code via-distributions. Malicious code via-distribution detection system collects potential malware via-distribution address information from seed information collection channel, and uses the potential malware via-distribution address information to collect web source code of potential malware via-distribution Information collection module, through the malicious code through which the web source code of a specific address is received and signature detection is performed to detect whether a specific address is through the malware-distribution site. -The web source code of the distribution site is provided, and through the malicious code-Web source code analysis module for providing it to the distribution site detection module, via at least one or more malicious code-The address information and connection relationship information of the distribution site are provided, and via each malicious code -Evaluate the risk of distributing sites, and pass reputation information of each distributing site via malicious code. Visualize the connection relationship between at least one malware via-distribution and the concentration of connection by each malware via-distribution using the generated malware passing-distribution evaluation module and at least one malicious code via-distribution relationship information It includes via the malware-distribution visualization module.

Description

System for detecting landing, hopping and distribution sites of malicious code}

The present invention relates to a malicious code via-distribution detection system.

Malware is a collection of malicious or exploitable software that refers to all software that is potentially dangerous to users and computers, including viruses, worms, spyware, and malicious adware. In a lexical sense, malware is an abbreviation of "malicious software," which is software that is intentionally designed to perform malicious activities, such as destroying the system or leaking information against the user's intentions and interests. . In Korea, this is translated as 'malware code'. It's a broader concept that includes viruses that are characterized by self-replicating and file infections.

Such malware has a characteristic of being widely distributed and spread through the network. If a systematic understanding of the distribution and spread of such malware is provided, the malware can be effectively prevented from spreading and reducing the damage. There is a need for research.

The technical problem to be solved by the present invention is to provide a system through the malicious code via-distribution detection that can be systematically detected through the malicious code via-distribution.

Technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

In one aspect of the present invention, the malicious code route-distribution detection system for collecting the potential malware route-distribution address information from the seed information collection channel and the potential malware route-distribution address information is provided. Seed information collection module that collects web source code of potential distribution via potential malicious code, and receives malicious code of web address of specific address and performs signature detection to detect whether specific address is through distribution of malicious code Code source-distribution detection module, web source code analysis module which receives web malware of potential distribution via seed information collection module, and provides it to malware source-distribution detection module, via at least one malicious code- Received address information and connection relation information of distribution site, and through each malware At least one malicious code via-distribution site, using the malicious code via-distribution evaluation module for evaluating risk and generating reputation information of each via-malware distribution site, and linkage information of at least one malicious code via-distribution site It includes a visualization method through the malicious code via-distribution to visualize the connection concentration of each malicious code via-distribution.

Specific details of other embodiments are included in the detailed description and the drawings.

Malicious code via-distribution detection system according to an embodiment of the present invention has the following advantages.

First, since the malicious code via-distribution detection system according to an embodiment of the present invention periodically collects social issue keywords and detects potential malicious code via-distribution based thereon, actively detects via the malicious code via-distribution site. It is possible.

Second, the malicious code via-distribution detection system according to an embodiment of the present invention classifies the detected malicious code via-distribution into a source, a waypoint, and a dissemination site and visualizes it systematically. Therefore, the user of the system can grasp the route-distribution information for a specific malicious code at a glance, and thus can systematically respond to the specific malicious code.

Third, the malicious code via-distribution detection system according to an embodiment of the present invention performs life cycle management on the detected malicious code via-distribution site, thereby real-time information on the distribution through the malicious code via-distribution according to the situation change. Keep it. Therefore, users of this system can immediately respond to malicious code at any time.

Effects of the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a diagram showing the configuration between networks of the malicious code via-distribution detection system according to an embodiment of the present invention.
2 is a block diagram of a malicious code via-distribution detection system according to an embodiment of the present invention.
3 and 4 are diagrams for describing the reputation information for each malicious code via-distribution generated by the malicious code via-distribution evaluation module of the malicious code via-distribution detection system according to an embodiment of the present invention.
5 to 8 are diagrams for explaining a visualization operation of the malicious code via-distribution visualization module of the malicious code via-distribution detection system according to an embodiment of the present invention.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various forms, and only the present embodiments are intended to complete the disclosure of the present invention, and the general knowledge in the art to which the present invention pertains. It is provided to fully convey the scope of the invention to those skilled in the art, and the present invention is defined only by the scope of the claims. The size and relative size of the components shown in the drawings may be exaggerated for clarity of explanation.

Like reference numerals refer to like elements throughout the specification, and "and / or" includes each and every combination of one or more of the mentioned items.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. As used herein, the terms "comprises" and / or "made of" means that a component, step, operation, and / or element may be embodied in one or more other components, steps, operations, and / And does not exclude the presence or addition thereof.

Although the first, second, etc. are used to describe various components, it goes without saying that these components are not limited by these terms. These terms are used only to distinguish one component from another. Therefore, it goes without saying that the first component mentioned below may be the second component within the technical scope of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used in the present specification may be used in a sense that can be commonly understood by those skilled in the art. Also, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise.

1 to 8, a light oil-diffuse detection system according to an embodiment of the present invention will be described.

1 is a diagram showing the configuration between networks of the malicious code via-distribution detection system according to an embodiment of the present invention, Figure 2 is a block diagram of a malicious code via-distribution detection system according to an embodiment of the present invention .

In the present specification, the malicious code route-distribution site may be a concept meaning at least one of a landing site, a hopping site, or a distribution site of the malicious code. Specifically, the source of the malicious code may be, for example, a site where the malicious code is generated, and the route of the malicious code may be an intermediate process site connected to the distribution site at the source, and the distribution of the malicious code is the actual malicious code. It can mean a site that is distributed to users. In addition, in the present specification, a potential malicious code via-distribution site may refer to a site that may be at least one of a source, a transit site, or a distribution site of such malicious code.

First, referring to FIG. 1, a diesel transit-distribution detection system 100 according to an embodiment of the present invention may include a seed information collection channel 10, an external sharing system 200, an external malware analysis system 300, and various networks. Can be connected via. First, a seed information collection channel that collects a seed address (SEED URL), a public malicious code via-distribution address (public malicious URL), a public malicious web source code, a general web source code, and is connected to a DNS search server (WHOIS DNSLOOKUP). 10 may be connected via, for example, HTTP / TCP. In addition, the external sharing system 200 and the external malware analysis system 300 sharing the detection information on the distribution via the malicious code may be connected via TCP.

Next, referring to FIG. 2, the malicious code via-distribution detection system 100 according to an embodiment of the present invention may include a seed information collection module 105, a web source code analysis module 110, and a malicious code via-distribution detection. Module 115, signature generation module 120, storage unit 130, malware via-distribution evaluation module 135, malware via-distribution visualization module 140, policy management module 145, statistical report generation Module 150 and detection information sharing module 155.

First, the seed information collection module 105 collects the potential malware via-distribution address information from the seed information collection channel, and collects the web source code of the potential malware via-distribution using the potential malware via-distribution address information. May be a module. In particular, the seed information collection module 105 of the diesel transit-distribution detection system 100 according to an embodiment of the present invention collects a social issue keyword from the seed information collection channel 10 and collects the social issue keywords. It may be a module for collecting potential malware via-distribution address information from social issue keywords. Here, the social issue keyword may mean a keyword expressing an issue that is a subject of public interest for a specific period, and the potential malware via-distribution address information may be, for example, a potential malware via-distribution. It may be information including at least one of a URL or an IP of a site.

Specifically, the seed information collection module 105 may be provided by at least one or more Internet search engines (eg, major Internet search engines currently provided in South Korea may include Naver, Daum, Yahoo, Google, etc.). Using an API (Application Programming Interface), a social issue keyword can be collected by referring to a real-time search term list of a corresponding internet search engine. At this time, the policy management module 145 provides a policy on the collection target of the seed information collection module 105 and the seed information collection module so that the collection operation is continued for a predetermined time (for example, 10 minutes). The collection policy of 105 may be managed.

When the social issue keyword is collected in this way, the seed information collection module 105 may query the collected social issue keyword to at least one or more Internet search engines to collect the searched site address information as potential route-distribution address information via malicious code. . In detail, the seed information collection module 105 may be selected from N search results of Internet search engines in which the creation date of each region or each subject is in descending order or similarity order (N is an arbitrary number that can be determined by the administrator). ) 'S site address information can be collected as potential malware-distribution address information. At this time, this collection policy of the seed information collection module 105 may be provided by the policy management module 145.

On the other hand, the seed information collection module 105 of the diesel pass-through site detection system 100 according to an embodiment of the present invention may also collect the malware address information that has already been published from the seed information collection channel 10. At this time, the policy management module 145 likewise provides a policy for the collection target of the seed information collection module 105, and manages the collection policy of the seed information collection module 105 so that the collection operation continues for a predetermined time unit. can do.

After the collection of the address information, the seed information collection module 105 uses the collected potential malware via-distribution address information or published malware address information to generate a web source of the potential malware via-distribution or public malware address. You can collect the code. Web source code collection of the seed information collection module 105 may be performed by visiting a potential malicious code via-distribution or published malware address, downloading HTML content there, and parsing it. .

Next, the web source code analysis module 110 receives the web source code of the potential malware via-distribution from the seed information collection module 105, and detects whether the potential malware via-distribution is the actual malware via-distribution. In order to do so, it may be a module for providing the web source code of the potential malicious code via-distribution to the malicious code via-distribution detection module 115.

On the other hand, the malicious code via-distribution detection module 115 may be a module that receives a web source code of a specific address and performs signature detection on it, thereby detecting whether the provided specific address is via the malicious code-distribution, The signature generation module 120 may be a module for generating a corresponding signature for malicious web source code. Therefore, the malware via-distribution detection module 115 generates a signature based on the signature generated by the signature generation module 120 for the web source code of the potential malware via-distribution provided from the web source code analysis module 110. Perform detection

At this time, when the potential malicious code via-distribution is detected as the actual malicious code via-distribution as a result of the detection, the malicious code via-distribution detection module 115 detects the detection information on the distribution via the malicious code via the storage unit 130. Store in the information DB. However, when the signature generated by the signature generation module 120 does not detect the web source code of the potential malicious code via-distribution, the malicious code via-distribution detection module 115 detects the web source code of the potential malware via-distribution. Re-provides the web source code analysis module 110 to request an analysis to the external malware analysis system 300.

Malware via-distribution detection module 115 cannot detect whether potential malware via-distribution is actually via malware-distribution, so the web source of potential malware via-distribution from 115 via malware-distribution detection module 115 Upon receiving the code, the web source code analysis module 110 requests the external malicious code analysis system 300 to analyze only suspicious web source code through source code analysis of the provided web source code.

That is, the web source code analysis module 110 performs a check as shown in Table 1 below on the source URL and IP form of the provided web source code, and when the provided web source code is detected as suspicious web source code. Only request it to the external malware analysis system 300.

check list Explanation Registration time Malicious domain registration time averaged 49.5 hours Domain reputation Determine whether to include the EMAIL address in the URL / IP to trust the destination URL Determine whether to append a trusted URL to the URL / IP to trust the destination URL Encoded Host Name Determine if there is an Encoded (especially% encoded) host name Dashes in host name Determine if dash (-) sign exists in hostname External domain Determine if you are requesting an external domain for links to domain internal references, such as images

Referring to Table 1, first, the web source code analysis module 110 detects the suspected web source code when the domain registration time of the provided web source code is less than a predetermined time. In general, since the malicious domain is generated only for the purpose of distributing malicious code, the registration time is not long. Therefore, when the domain registration time of the provided web source code is less than a predetermined time, the web source code analysis module 110 detects this as suspicious web source code.

Next web source code analysis module 110 checks the form of the source address of the provided web source code. Specifically, the web source code analysis module 110 encodes whether the source address form of the web source code leads to trust the destination URL including the EMAIL address, or adds a trusted URL to trust the destination URL. Determine if there is a host name (especially% encoded), if there is a dash (-) in the host name, and if you are finally requesting an external domain for links to domain internal references such as images. Detects web source code as suspicious web source code.

When the provided web source code is detected as suspicious web source code, the web source code analysis module 110 requests the analysis to the external malware analysis system 300, and the signature generation module 120 receiving the analysis result is Based on this, the corresponding signature is generated for the web source code requested for analysis. Meanwhile, the signature generated by the signature generation module 120 may be stored in the signature DB of the storage 130.

Referring back to FIG. 2, the malicious code route-distribution evaluation module 135 is provided with address information and connection relationship information of at least one or more malicious code route-distribution stores stored in the storage 130, and passes through each malicious code-distribution site. It can be a module for evaluating the risk of the malicious code, and generating reputation information of each route through the malicious code.

Specifically, the malicious code via-distribution evaluation module 135 is provided with the address information and connection information of the malicious code via-distribution from the detection information DB of the storage unit 130 in which at least one malicious code via-distribution is stored, You can assess the risk of each malware via-distribution site. Then, the DNS search server 230 may be queried using the address information of each malicious code via-distribution site to generate reputation information of each malicious code via-distribution site.

Here, the connection information of the distribution via the malicious code may include in-degree information, out-dgree information, malicious code information, previous malicious code via-distribution information, and next. It may include information via malware-distribution site. In detail, the inward concentration refers to the number of sites introduced through each malicious code via-distribution site, and the outward concentration refers to the number of outgoing sites through each malicious code via-distribution site. Meanwhile, the malicious code information is information related to the malicious code transmitted from each malware code-distribution site to the other malware code-distribution site or distributed to the user, and all malware code-distribution information is transferred to the selected malware code-distribution site. The information on the site, and the post-malware via-distribution information is information about a site going out from the selected malware via-distribute.

In this case, the risk of each of the malicious code via-distribution assessed by the malware passing-and-distribution evaluation module 135 may be the sum of the inward concentration and the outward concentration, and the risk of the passing through the malicious code and the distribution is inward and outward. It increases as the sum of concentration increases. The high concentration of inwards and outwards is due to the high possibility of active sites via malicious code.

Meanwhile, the reputation information of each malicious code via-distribute generated by the malicious code via-distribution evaluation module 135 includes the number of malicious hosts in the domain to which the malicious code passes through-distribute, and the registration of the domain through which the malicious code passes through-distribute. It may include the date and reputation information of external malware counterparts for each malware distribution and distribution site. Hereinafter, this will be described in more detail with reference to FIGS. 3 and 4.

3 and 4 are diagrams for describing the reputation information for each malicious code via-distribution generated by the malicious code via-distribution evaluation module of the malicious code via-distribution detection system according to an embodiment of the present invention.

First, the malicious code route-distribution evaluation module 135 calculates the number of malicious hosts in a domain to which each malicious code route-distribution belongs. That is, the malicious code via-distribution evaluation module 135 determines the number of sites belonging to the same domain among the plurality of malicious code via-distribution sites. This can be done, for example, by identifying the number of different domain names (DOMAIN of ② NET_LOC) while the remainder (① SCHEME, ③ DIRECTORY, ④ RESOURCE) are the same in the malicious code via-distribution address information such as FIG. 3.

Next, the malicious code route-distribution evaluation module 135 queries the DNS search server 230 using the address information of each malicious code route-distribution, thereby passing through each malware as illustrated in FIG. 4. Collect the date of registration of the distribution site. As described above, in general, the malicious code via-distribution is generated for distributing through the malicious code, so the domain generation time is not very long. Therefore, such registration date information may be one reputation information for the distribution via the malicious code.

Finally, the malware transit-distribution evaluation module 135 collects reputation information of each malware transit-distribution from an external malware counterpart (for example, URLVoid.com may be used as such at present). do. The collected information becomes reputation information that can systematically evaluate the distribution through each malicious code.

On the other hand, the malicious code via-distribution evaluation module 135 of the malicious code via-distribution detection system 100 according to an embodiment of the present invention, the malicious code via-distributors stored in the detection information DB of the storage unit 130 Life cycle management can be performed for.

In detail, the malicious code route-distribution evaluation module 135 provides the seed information collection module 105 with address information of the malicious code route-distributors stored in the detection information DB of the storage unit 130, thereby collecting seed information collection module ( 105) visits each distribution via the malware and collects web source code from it. In addition, the collected web source code is provided to the malicious code via-distribution detection module 115 through the web source code analysis module 110, so that the target malicious code via-distribution still performs the function of the malicious code via-distribution. Observe. In addition, in this process, the connection information of each route via the malicious code-distribution is updated to reflect the actual situation. The connection information of each route via the malicious code-distribution is updated in the visualization via the distributing malware-distribution module 140 which will be described later. To be visualized.

Referring back to FIG. 2, the malicious code via-distribution visualization module 140 uses the connection information between the malicious code and the distributors to determine the connection concentration between the malicious code and the distributors and the concentration of connection between each malicious code and the distributor. It may be a module to visualize.

Specifically, first, via the malicious code via-distribution visualization module 140 is provided with connection information between the malicious code via-distributors updated at regular intervals by the malicious code via-distribution detection module 115 and uses the malicious code by using the same. Light oil-distributions are classified as source, waypoint or dissemination. The classification process is as follows.

If the inward concentration of the distribution via the malware is 0 (ie, no site enters the distribution via the malicious code), but the outward concentration is greater than 0 (that is, outward from the distribution via the malware) If a site exists), the malware via-distribution visualization module 140 classifies the malware via-distribution as a landing site. However, if the malicious code via-distribution has the same conditions, but it is not clear whether the final access point of the malicious code via-distribution is a distribution site or a file download site, the malware via-distribution visualization module 140 may Classify the distribution via the same malware as an unknown site.

Next, if both the inward and outward concentration of the malware-distribution site are greater than zero (that is, there is a site that enters through the malware-distribution site, and there is a site outgoing from the malware-distribution site). In addition, the malicious code route-distribution visualization module 140 classifies the malware route-distribution site as a hopping site. At this time, if the malware transit-distribution satisfies these conditions equally and includes an exploit code or has a characteristic of redirecting to a distribution site, the visualization of malware transit-distribution is visualized. The module 140 separately classifies such malware via-distribution site as an exploit site.

Finally, the outward concentration of the malware-distribution site is zero (i.e., no site goes out of the malware-distribution site), but the inbound concentration is greater than zero (i.e. If there is a site), and if there is a characteristic of downloading a file when accessing the distribution via the malicious code, the malicious code via-distribution visualization module 140 classifies the distribution via the malicious code as a distribution site (distribution site).

The malicious code via-distribution visualization module 140 visualizes the connection relationship between the malicious code via-distribution and the concentration of connection by each malicious code via-distribution using the identified connection information between the distribution through the malicious code. Hereinafter, this will be described in more detail with reference to FIGS. 5 to 8.

5 to 8 are diagrams for explaining a visualization operation of the malicious code via-distribution visualization module of the malicious code via-distribution detection system according to an embodiment of the present invention.

FIG. 5 is a diagram illustrating connection relationship information between a distribution site and a malicious code expressed as a URL for convenience of description. Referring to FIG. 5, the inward concentration of 'www.abc123.com/index.html' is 0, the outward concentration is 1, and there is no former malware via-distribution (From), and after the malicious code via-distribution (To ) Is 'www.pes.com/file/img.php'. Meanwhile, the inward concentration and the outward concentration of 'www.pes.com/file/img.php', 'www.showme.net/index.php ′, and' www.dul.me/fly/index.jsp ′ are both 1 And, it can be seen that each through the pre-malware via-distribution (From) and the post-malware via-distribution (To). Finally, 'http://12.21.12.222/file/a.exe' has an inward concentration of 1, an outward concentration of 0, and all malicious code-distribution (From) is' www.dul.me/fly/ index.jsp ′, and it can be seen that there is no post-distribution via malware (To).

Applying the classification operation described above to this example, 'www.abc123.com/index.html' is classified as a source, and 'www.pes.com/file/img.php', 'www.showme.net/index .php 'and' www.dul.me/fly/index.jsp 'are classified as waypoints, and' http://12.21.12.222/file/a.exe 'is classified as a distribution site. The source sites' www.abc123.com/index.html 'and waypoints' www.pes.com/file/img.php' are connected to each other, and 'www.pes.com/file/img.php', 'www .showme.net / index.php ′ and „www.dul.me/fly/index.jsp ′ are connected to each other via a stop, and” www.dul.me/fly/index.jsp ′ is a distribution site ‘http: / /12.21.12.222/file/a.exe '.

The classified and connected malicious code via-distribution sites are visualized by the malicious code via-distribution visualization module 140 as shown in FIG. 6. That is, the malicious code via-distribution visualization module 140 visualizes the interconnection relationship between the malicious code via-distribution and the concentration of connection between each malicious code via-distribution. In FIGS. 5 and 6, a simple case is illustrated for convenience of understanding, but the actual visualized malware distribution-distribution sites may exhibit an aspect similar to that of FIG. 7 or 8.

FIG. 7 shows a visualization of three-dimensionally the malicious code via-distributions, and FIG. 8 shows a visualization of the location level of the visualized malware-distributions by visualizing the concentric circles at the same level. have. As illustrated in FIG. 7 and FIG. 8, the user can grasp the interconnected relationship between the malicious code via-distributing sites and the concentration of connection between each malicious code via-distributing site.

Referring back to FIG. 2, the policy management module 145 may be a module that provides a system policy to all modules constituting the malicious code via-distribution detection system 100 according to an embodiment of the present invention and manages the same. . The function of the policy management module 145 will be omitted as described above while explaining the function of each module.

The statistical report generation module 150 may be a module for generating detection information on the malicious code via-distribution site as statistical data in the form of graphs and tables. The statistical data generated through the statistical report generation module 150 may be visualized to be viewed by the user through the malware-distribution visualization module 140.

Detection information sharing module 155 may be a module for sharing the detection information for the distribution via the malicious code with the external sharing system 200. In particular, the detection information sharing module 155 of the malware via-distribution detection system 100 according to an embodiment of the present invention generates detection information regarding the malware-distribution via-distribution in the form of an XML document, and this is an external sharing system. Can share with 200. Since the XML document can be easily shared through the web, detection information on the distribution site via the malicious code can be easily shared with the external public view system 200 so that the newly generated malicious code or the previously recognized malicious code can be shared with each other. Cooperate quickly.

The malicious code via-distribution detection system 100 according to an embodiment of the present invention described so far has the following advantages.

First, since the malicious code via-distribution detection system 100 according to an embodiment of the present invention periodically collects social issue keywords and detects potential malware via-distribution based thereon, actively via the malware-distribution site. It is possible to detect.

Second, the malicious code via-distribution detection system 100 according to an embodiment of the present invention classifies the detected malicious code via-distribution into a source, a waypoint, and a distribution site and visualizes it systematically. Therefore, the user of the system can grasp the route-distribution information for a specific malicious code at a glance, and thus can systematically respond to the specific malicious code.

Third, the malicious code via-distribution detection system 100 according to an embodiment of the present invention performs life cycle management on the detected malicious code via-distribution site, so that the malicious code via-distribution site is changed according to a change in circumstances. Maintain information in real time. Therefore, users of this system can immediately respond to malicious code at any time.

Although the embodiments of the present invention have been described above with reference to the accompanying drawings, the present invention is not limited to the above embodiments but may be manufactured in various forms, and having ordinary skill in the art to which the present invention pertains. It will be understood by those skilled in the art that the present invention may be embodied in other specific forms without changing the technical spirit or essential features of the present invention. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

10: seed information collection channel
100: malicious code via-distribution detection system
105: seed information collection module 110: web source code analysis module
115: Malware pass-through distribution module
120: signature generation module 130: storage unit
135: Malware pass-through distribution evaluation module
140: Malware pass-through distribution visualization module
145: Policy Management Module 150: Statistical Report Generation Module
155: detection information sharing module

Claims (14)

Collect social issue keywords from seed information collection channels, collect potential malware via-distribution address information from the collected social issue keywords, and use the potential malware via-distribution address information to use the potential malware via-distribution site Seed information collection module for collecting the web source code of;
A web source code analysis module receiving web source code of the potential malicious code via-distribution from the seed information collection module;
The web source code analysis module receives the web source code of the potential malicious code via-distribution from the web source code analysis module and performs a signature detection to detect whether the potential malicious code via-distribution is via the malicious code via-distribution, and as a result, Malicious code via-distribution detection module for storing the storage unit;
The address of the at least one malicious code via-distribution site and its connection relation information are received from the storage unit, the risk of each of the malicious code via-distribution site is evaluated, and the reputation information of each of the malicious code via-distribution site is generated. Through the malware-distribution evaluation module;
A malicious code via-distribution visualization module that visualizes the connection relationship between the at least one malicious code via-distribution and the concentration of connection by each malicious code via-distribution using at least one connection information of the distribution via the malicious code. ;
A policy management module for providing and managing system policies to the seed information collection module, malicious code via-distribution detection module, web source code analysis module, malicious code via-distribution evaluation module, and malicious code via-distribution visualization module;
A statistical report generation module for generating detection information on the malicious code via-distribution site as statistical data in the form of graphs and tables; And
Malicious code via-distribution detection system comprising a detection information sharing module for sharing the detection information on the distribution via the malicious code with an external sharing system. The method of claim 1,
The address information through the malicious code via-distribution detection system including at least one of the URL or IP. delete The method of claim 1,
It further includes a signature generation module for generating a corresponding signature for malicious web source code,
The malicious code route-distribution detection module performs signature detection based on the signature generated by the signature generation module for the web source code of the potential malicious code route-distribution provided from the web source code analysis module. When the web source code of the potential malicious code via-distribution is not detected by the signature generated by the generation module, the web source code of the potential malicious code via-distribution may be analyzed and requested to an external malware analysis system. Malicious code via-distribution detection system provided to the source code analysis module. The method of claim 4, wherein
When the web source code analysis module receives the web source code of the potential malicious code via-distribution from the malicious code via-distribution detection module, only the suspect web source code is analyzed through the source type analysis of the provided web source code. Malicious code via-distribution detection system that requests analysis to malware analysis system. 6. The method of claim 5,
The source type analysis comprises a domain registration time analysis and a source code analysis of the distribution through the malware. The method of claim 4, wherein
The signature generation module is via the malicious malware-generating a corresponding signature for the web source code of the potential malicious code-through the distribution based on the analysis result of the external analysis system for the web source code of the potential malicious code. Diffusion Site Detection System. The method of claim 1,
The connection information of the distribution via the malicious code includes: in-degree information, out-dgree information, malicious code information, prior malicious code via-distribution information, and next malicious information. Malicious code via-distribution detection system that contains code via-distribution information. The method of claim 8,
The malicious code via-distribution detection system increases the risk of each of the malicious code via-distribution increases as the inward concentration and the outward concentration increase. The method of claim 1,
The reputation information includes the number of malicious hosts in the domain to which each malicious code via-distribution belongs, the registration date of the domain to which the malicious code through-distribution belongs, and the reputation information of an external malicious code corresponding company for each of the malicious code via-distribution. Malicious code via-dissemination detection system comprising a. The method of claim 1,
The malicious code route-distribution evaluation module visits the at least one malicious code route-distribution site using the address information of the at least one malicious code route-distribution site, collects web source code therefrom, and collects the web source code therefrom. By performing signature-based detection on the generated web source code, the malicious code via-distribution detection system observes the state change of each of the via-distribution via the malicious code and updates the connection relationship information of the via-distribution through the malicious code. . The method of claim 1,
The malicious code route-distribution visualization module classifies the at least one malicious code route-distribution site as a source, a route site or a distribution site using the connection information of the route via the malicious code.
And a malicious code route-distribution detection system for visualizing the connection relationship and the concentration of the connection between the origin and the waypoint, between the different waypoints, and the waypoint and the dissemination site. delete The method of claim 1,
The malicious code via-distribution detection system, wherein the detection information for the malicious code via-distribution shared with the external sharing system is generated in the form of XML document.

Images