KR101234063B1 - Malicious code, the system automatically collects - Google Patents

Abstract

According to the present invention, an automatic malware collection system includes: a management unit for extracting URL analysis information and un-analyzed lists detected from a route / distribution site detection system through malicious code, extracting URL analysis information, and managing and storing the extracted information; And a collection stage for collecting files and file information generated by the management stage, wherein the collection stage includes a process policy and a list of reparsing target objects, a request for inquiry and setting of an operating environment, and before a driver is started. SecureFS management module for processing the process information settings of the Reparsing target object, and converts the target path, the SecureFS driver module for processing the access control function for the execution operation of the reparsing target path, and manages data Provides automatic malware collection system.

Description

Malicious code, the system automatically collects}

The present invention relates to a system for automatically collecting malware, and processes a process policy and a list of a reparsing target object, processes an inquiry and setting of an operating environment, and processes a process information setting before a driver is started. The present invention relates to an automatic malicious code collection system including a SecureFS driver module for converting a target path of the reparsing target object, processing an access control function for an execution operation of the reparsing target path, and managing data.

Recently, as cyber attack response time is shortened due to malware, it is necessary to secure proactive technologies. Various malwares used in most cyber attacks, such as DDoS attacks and personal information takeovers, are rapidly increasing. As can be seen from the frequently intimidating DDoS attacks and infringement incidents, the damages are gradually increasing.

Therefore, there is a problem in that it is necessary to construct a system that can prevent cyber attacks in advance through a technology of early collecting malicious codes that may pose a deadly threat and generating / distributing corresponding signatures from the analyzed results.

Accordingly, the present invention relates to a system for automatically collecting malware, processing a process policy and a list of reparsing target objects, requesting an inquiry and setting of an operating environment, and managing SecureFS to process process information settings before a driver is started. By including a module and a SecureFS driver module that converts the target path of the object to be reparsed, handles the access control function for the execution operation of the reparsing object path, and manages data, it is possible to preempt malicious code that may pose a deadly threat. Its purpose is to provide an automated malware collection system that can prevent cyber attacks by collecting and generating corresponding signatures from the analyzed results.

In the present invention for achieving the above object, in the automatic malicious code collection system, the URL / information distribution and un-analyzed list detected from the route through the malicious code / distribution site detection system is received to extract URL analysis information and manage the extracted information A management unit for storing; And a collection stage for collecting files and file information generated by the management stage, wherein the collection stage includes a process policy and a list of reparsing target objects, a request for inquiry and setting of an operating environment, and before a driver is started. SecureFS management module for processing the process information settings of the Reparsing target object, and converts the target path, the SecureFS driver module for processing the access control function for the execution operation of the reparsing target path, and manages data The purpose is to provide an automatic malware collection system.

In addition, the SecureFS management module manages a reparse point policy for processing a request, add, modify, and delete a request for a path, a target path, and a process policy of the target object to be reparsed, and processes an inquiry and a setup request for an operating environment. It may include a SecureFS management subsection that processes the process information setting before the driver is started and drives the existing SecureFS management module driver.

The SecureFS management module may include an audit management subunit which collects file information generated by the SecureFS management module and collects execution file blocking logs generated by the SecureFS management module.

In addition, the SecureFS driver module converts a path into the reparsing destination path for the read, create, and execute operations of the subject process for the reparsing target object and returns it to the IO Manager, thereby providing the reparsing function and providing the reparsing purpose. Access control function for the execution operation of the path, and includes a kernel management sub-unit for managing the reparsing target list, process list, operating mode, violation audit log, file creation information, file generation information generation, violation audit log generation data can do.

In addition, the SecureFS driver module may include a file generation management sub unit for resetting the file path received from the IO Manager or block file execution.

In the above description, the present invention provides a SecureFS management module for processing a process policy and a list of a reparsing target object, processing a query and setting of an operating environment, and processes a process information setting before a driver is started, and an object of the reparsing target object. It includes a SecureFS driver module that converts paths, handles access control functions for execution operations of the reparsing destination paths, and manages data so that malicious code that can pose a critical threat is collected early and responded from the analyzed result. By creating / distributing signatures, it is possible to prevent cyber attacks in advance.

1 is a block diagram of an automatic malicious code collection system according to an embodiment of the present invention.
2 is a block diagram of a collecting stage employed in the automatic malware collection system according to an embodiment of the present invention.
Figure 3 is a block diagram of a SecureFS management sub-unit employed in the automatic malware collection system according to an embodiment of the present invention.
4 is a block diagram of an audit management sub-unit employed in the automatic malware collection system according to an embodiment of the present invention.
5 is a block diagram of the kernel management sub-unit employed in the automatic malware collection system according to an embodiment of the present invention.
6 is a block diagram of a file generation management sub-unit employed in the automatic malicious code collection system according to an embodiment of the present invention.

Matters regarding the operational effects including the technical configuration of the automatic malicious code collection system according to the present invention will be clearly understood by the following detailed description with reference to the drawings in which preferred embodiments of the present invention are shown.

1 and 6, in the automatic malicious code collection system 100 according to an exemplary embodiment of the present invention, a diesel / distributed list and unanalyzed list detected by the malicious / neutral / distributed site detection system are received. The management unit 120 may extract URL analysis information and manage and store the extracted information, and the collection unit 130 may collect files and file information generated from the management unit 120.

In this case, the malicious code route / distribution detection system 110 periodically uses malicious code route / distribution detection signatures to periodically scan the route / distribution list and unanalyzed list detected by the system 110 for detecting route / distribution. It transmits to the code automatic collection system 100. In addition, the automatic malicious code collection system 100 periodically transmits the collected malicious code information to the automatic malicious code analysis system 160.

As shown in FIG. 2, the collection unit 130 may largely include a SecureFS management module 140 and a SecureFS driver module 150. The SecureFS management module 140 may process a process policy and a list of a reparsing object, process an inquiry and setting of an operating environment, and process process information setting before a driver is started. The SecureFS driver module 150 may convert a target path of the reparsing target object, process an access control function for an execution operation of the reparsing target path, and manage data. At this time, the SecureFS management module 140 is composed of a SecureFS management subunit 141, an audit management subunit 142, the SecureFS driver module 150 is a kernel management subunit (151a, b), file creation management sub It is composed of a section 152 to be described in detail later.

As shown in FIG. 3, the SecureFS management module 140 manages a reparse point policy for processing an inquiry, addition, modification, and deletion request of a path, a target path, and a process policy of a target object to be reparsed, and an operation environment. It may include a SecureFS management subunit 141 that processes the inquiry and configuration request, processes the process information setting before the driver is started, and drives the existing SecureFS management module 140 driver.

The SecureFS management subunit 141 may call commands to the control system 100 for functions that need to interact with the SecureFS driver module, such as driver start, start, stop, process list setting, and reparsing point setting. Pass to SecureFS driver module. Reparsing point policy related data managed by the SecureFS management subunit 141 physically exists as a file in the user area of the system 100, but should be copied to the kernel memory area when the corresponding function is started.

In addition, the SecureFS management module 140 collects file information generated by the SecureFS management module 140 and collects execution file blocking logs generated by the SecureFS management module 140 as shown in FIG. 4. The audit management sub unit 142 may be included.

As shown in FIG. 5, the SecureFS driver module 150 converts a path into the reparsing destination path and returns to the IO manager for the read, create, and execute operations of the subject process for the reparsing target object. Provide a function, perform an access control function for the execution operation of the reparsing destination path, generate the reparsing target list, process list, operation mode, violation audit log, file generation information, file generation information, violation audit log generation data Kernel management sub-units (151a, b) for managing the may include.

The kernel management subparts 151a and b are responsible for starting and stopping the file generation management subpart 152 and managing the Reparsing Point policy DB stored in the kernel memory. It starts through. The SecureFS management subunit 141 calls the control system call to deliver functions and management tasks to the kernel management subunits 151a, b. Therefore, the functions of the kernel management subunits 151a and b correspond one-to-one with the security functions of the SecureFS management subunit 141.

In this case, the reparsing point policy DB is stored in the kernel memory and referred to the file generation management sub-module 152, but the policy DB does not exist when the SecureFS driver module 150 is mounted in the operating system. Therefore, the Reparsing Point policy DB managed by the SecureFS management subunit 141 as a file must be delivered to the kernel management subunits 151a and b using a control system call. The kernel management subparts 151a and b play a role of storing the received Reparsing Point policy DB on the kernel memory. The SecureFS management subpart 141 is responsible for notifying the kernel management subparts 151a and b according to the policy change and storing the same contents in a file.

The SecureFS driver module 150 may include a file generation management subunit 152 that resets a file path received from the IO Manager 145 or blocks file execution.

The file generation management subunit 152 performs a file path resetting process and a file execution control process according to the transmitted system call IRP_MJ_CREATE request. That is, the file generation management sub unit resets the file path by converting the file path into the destination path when the object path, that is, the file path is the path corresponding to the target path in the reparsing point policy. At this time, the file redirection policy converts the file path with respect to the accessing object based on the process identification accessing the object. You can also block the execution of a file if the file path is the destination path and executes.

The data structure of the collection stage 130 according to the present invention configured as described above is as shown in Table 1 below.

Data store Explanation Save Format Serve Installation environment Save setting path Registry
SecureFS Management
Operating mode Save operating mode Registry Reparsing Point Policy Reparsing Point Policy List File DB Violation log data Save violation audit record data File DB Audit Management
Generate file data Save generated file data File DB Reparsing Point Table Manage Reparsing Point Policies Kernel memory

Kernel Management
Process table Manage process information Kernel memory Violation log table Manage violation logs Kernel memory Sangsang file table Manage generated file data Kernel memory

The process table of the collection unit 130 does not have a process table when the SecureFS driver module 150 is mounted in the operating system. Therefore, SecureFS management sub-parts must deliver the process table with the structure as shown in [Table 2] below to kernel management sub-parts 151a, b using control system calls. After that, process information is received through the process creation / deletion callback function. When the process is created, it is stored in the process table. When the process is destroyed, the process information is deleted from the table.

Field type Explanation hProcID pid_t (8Bytes) process id hParentID pid_t (8Bytes) parent process id acProcName char [32] Process name

In addition, the Reparsing Point policy DB is stored in the kernel memory and referred to by the file generation management subunit 152. [Table 3] below is the table of Reparsing Point table structure.

Field type Explanation dwID ULONG (4) Rule ID (Max: 16) dwLastComp ULONG (4) Whether to apply subfolders
(TRUE: Apply subfolder)
(FALSE: Current folder only) dwReserved ULONG (4) Reserved dwProcLen ULONG (4) Process name Length dwPathLen ULONG (4) Destination Path Name Length dwReparseLen ULONG (4) Destination Path Name Length acProcName char [256] Process name acPath char [256] Destination path acReparsePath char [256] Destination path

As described above, the present invention processes the process policy and list of the object to be reparsed, processes the request and setting of the operating environment, and processes the process information setting before the driver is started, and the SecureFS management module 140 and the object to be reparsed. By including the SecureFS driver module 150 for converting the destination path of the destination path, processing the access control function for the execution operation of the reparsing destination path, and managing data, it collects malicious code that may pose a critical threat early, Corresponding signatures can be generated / distributed from the analyzed results to prevent cyber attacks in advance.

Although the preferred embodiments of the present invention described above have been described in detail, those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom.

Accordingly, the scope of the present invention should not be limited to the disclosed embodiments but should be regarded as belonging to various modifications and improvements of those skilled in the art using the basic concept of the present invention as defined in the following claims, or the scope of the present invention. .

100: Automatic malware collection system
110: malicious code via / dissemination system
120: management group 130: collection
140: SecureFS management module 150: SecureFS driver module
160: Automatic Malware Analysis System

Claims (5)

In the automatic malware collection system,
A management unit which receives URL analysis and distribution lists detected from the malware detection system and distribution site and the unanalyzed list, extracts URL analysis information, and manages and stores the extracted information;
It is configured to include; and a collection stage for collecting files and file information generated from the management stage,
The collection unit processes a process policy and a list of a reparsing target object, processes an inquiry and setting of an operating environment, and processes a process information setting before a driver is started, and a destination path of the reparsing target object. It includes a SecureFS driver module for converting and processing the access control function for the execution operation of the reparsing destination path, and manages the data,
The SecureFS management module manages a reparse point policy for processing a query, add, modify, and delete a request for a path, a target path, and a process policy of a target object to be reparsed, and processes a query and a setup request for an operating environment. An automatic malware collection system, comprising a SecureFS management sub-unit that processes process information settings before starting and drives the existing SecureFS management module driver.
delete The method of claim 1, wherein the SecureFS management module,
And an audit management sub-unit configured to collect file information generated by the SecureFS management module and collect execution file blocking logs generated by the SecureFS management module.
The method of claim 1,
The SecureFS driver module,
By converting the path into the reparsing destination path for the read, create and execute operations of the subject process for the reparsing target object and returning it to the IO Manager, the reparsing function is provided and the access control is executed for the execution operation of the reparsing destination path. It performs a function, malicious code, characterized in that it comprises a kernel management sub-unit for managing the reparsing target list, process list, operation mode, violation audit log, file generation information, file generation information generation, violation audit log generation data Collection system.
5. The method of claim 4,
The SecureFS driver module,
Automatically collect malware, characterized in that it comprises a file generation management sub-unit for resetting the file path received from the IO Manager or block file execution.

Images