KR101256439B1 - Information update apparatus and method, client terminal device and malicious code treatment method - Google Patents

Abstract

An apparatus and method for updating corresponding information, a client terminal device, and a method for treating malware are disclosed. According to the embodiments of the present invention, when the update server classifies the corresponding information on the malicious code into the basic response information and the active response information to the client terminal, the client terminal may passively respond to the malicious code based on the basic response information. After the predetermined time has elapsed, the client terminal performs an active response to the malicious code on the basis of the positive response information, so that there is a possibility of damage and misunderstanding that may occur in the process of diagnosing and treating the malicious code. Can be minimized.

Description

Responding information update device and method, client terminal device and malicious code treatment method {INFORMATION UPDATE APPARATUS AND METHOD, CLIENT TERMINAL DEVICE AND MALICIOUS CODE TREATMENT METHOD}

An apparatus and method for updating corresponding information, a client terminal device, and a method for treating malware are disclosed. In particular, embodiments of the present invention are directed to a technology that can reduce the possibility of misunderstanding and misunderstanding that may occur in the diagnosis and treatment of new or variant malware.

Recently, as the high-speed Internet environment has been established, the damage caused by malicious codes distributed through programs and e-mails has increased rapidly.

Usually, malware can slow down your computer, pin a web browser's initial page to an unhealthy site, use your computer as a spam server, or be a base for distributed denial of service attacks (DDoS) attacks. It can be used as a PC and can leak user's personal information.

There are various ways that malicious code is installed and harmed on user's computer, such as ActiveX, Java Applet, Java WebStart, .NETClickOnce, Flash, UCC, etc., but most of them have common point that they receive original file from web server using HTTP protocol. .

Recently, researches on various defense devices have been conducted to prevent the spread of such malicious codes.

In general, an installed security program for preventing malware is a program installed on a client terminal and detects the execution of malicious codes, viruses, and unwanted files, and works to cure an already infected client terminal. Corresponds to

When a new or variant malicious code occurs, the security program continuously provides the corresponding information to each client terminal about the new or variant malicious code in order to quickly respond to it.

However, in the process of promptly providing the corresponding information to the client terminal, the update server may often determine that the normal file is a new or modified malicious code.

Therefore, it is necessary to study a method for minimizing the possibility of misdiagnosis and damage that judges a normal file as malicious code while being able to respond quickly to new or modified malicious code.

According to the embodiments of the present invention, when the update server classifies the corresponding information on the malicious code into the basic response information and the active response information to the client terminal, the client terminal may passively respond to the malicious code based on the basic response information. After the predetermined time has elapsed, the client terminal performs an active response to the malicious code based on the positive response information, thereby minimizing the possibility of the misunderstanding that may occur in the process of diagnosing and treating the malicious code. I would like to.

Corresponding information updating apparatus according to an embodiment of the present invention includes a basic response information generation unit for generating basic response information associated with the diagnosis of malicious code, an active response information generation unit for generating active response information associated with the treatment of the malicious code; And a correspondence information transmitter configured to transmit the basic correspondence information and the active correspondence information to at least one client terminal, wherein the at least one client terminal performs diagnosis and selects the malicious code based on the basic correspondence information. When a predetermined time elapses, the malicious code is treated based on the positive response information.

In addition, the client terminal device according to an embodiment of the present invention is a response information receiver for receiving basic response information associated with the diagnosis of malicious code and positive response information associated with the treatment of the malicious code from the update server, based on the basic response information A diagnosis performing unit for performing a diagnosis on the malicious code and a treatment performing unit for performing treatment on the malicious code based on the corresponding response information when a predetermined time elapses after the diagnosis on the malicious code is performed. Include.

In addition, the method for updating a corresponding information according to an embodiment of the present invention includes generating basic response information associated with a diagnosis of malicious code, generating active response information associated with the treatment of the malicious code, and at least one client terminal. And transmitting the basic correspondence information and the active correspondence information, wherein the at least one client terminal performs diagnosis on the malicious code based on the basic correspondence information, and when a predetermined time elapses, the active The malicious code is treated based on the corresponding information.

In addition, the malicious code treatment method according to an embodiment of the present invention receiving the basic response information associated with the diagnosis of malicious code and the active response information associated with the treatment of the malicious code from the update server, based on the basic response information And performing a diagnosis on the malicious code, and performing a treatment on the malicious code based on the active response information when a predetermined time elapses after the diagnosis on the malicious code is performed.

According to the embodiments of the present invention, when the update server classifies the corresponding information on the malicious code into the basic response information and the active response information to the client terminal, the client terminal may passively respond to the malicious code based on the basic response information. After the predetermined time has elapsed, the client terminal performs an active response to the malicious code on the basis of the positive response information, so that there is a possibility of damage and misunderstanding that may occur in the process of diagnosing and treating the malicious code. Can be minimized.

1 is a diagram illustrating the structure of an apparatus for updating correspondence information according to an embodiment of the present invention.
2 is a diagram illustrating a structure of a client terminal device according to an embodiment of the present invention.
3 is a flowchart illustrating a method of updating correspondence information according to an embodiment of the present invention.
4 is a flowchart illustrating a method for treating malware according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

As described above, due to the recent spread of new malicious codes, security companies quickly analyze new or modified malicious codes and provide corresponding information to client terminals through an update server.

However, in the process of quickly responding to new or modified malicious codes, security companies often identify normal files as new or modified malicious codes, and generate response information that allows even normal files to be diagnosed and repaired on the client terminal. It happens.

In this case, when the client terminal receives wrong correspondence information from the update server, the normal file may also be diagnosed as a malicious code to perform treatment, thereby causing damage.

Therefore, in the embodiments of the present invention, when the update server classifies the corresponding information on the malicious code into the basic response information and the active response information to the client terminal, the client terminal is passive on the malicious code based on the basic response information. After the predetermined time elapses, the client terminal performs an active response to the malicious code based on the positive response information, thereby identifying a possibility of misdiagnosis that may occur in the process of diagnosing and treating the malicious code. Minimize.

1 is a diagram illustrating the structure of an apparatus for updating correspondence information according to an embodiment of the present invention.

Referring to FIG. 1, a corresponding information update apparatus 110 and at least one client terminal 121, 122, and 123 are illustrated.

The correspondence information updating apparatus 110 includes a basic correspondence information generator 111, an active correspondence information generator 112, and a correspondence information transmitter 113.

The basic response information generation unit 111 generates basic response information associated with the diagnosis of malicious code.

The active response information generation unit 112 generates active response information associated with the treatment of the malicious code.

The correspondence information transmitter 113 transmits the basic correspondence information and the active correspondence information to at least one client terminal 121, 122, and 123.

In this case, the at least one client terminal 121, 122, 123 performs a diagnosis on the malicious code based on the basic correspondence information, and when a predetermined time elapses, based on the aggressive response information Perform treatment for malware.

Here, the basic correspondence information is information associated with the diagnosis of the malicious code, and when at least one client terminal 121, 122, 123 diagnoses the malicious code based on the basic correspondence information, the at least one client terminal ( 121, 122, and 123 may perform a passive level of warning of this or blocking execution of a file diagnosed as malicious code or notifying the corresponding information update server 110 of whether malicious code is present.

The active response information is information associated with the treatment of the malicious code, and at least one client terminal 121, 122, 123 is diagnosed as a malicious code based on the active response information after the predetermined time elapses. Active actions such as modifying or deleting files can be performed.

As a result, embodiments of the present invention first perform passive correspondence based on the basic correspondence information received by the at least one client terminal 121, 122, and 123 from the correspondence information update apparatus 110, and the predetermined time is determined. After the elapsed time, if the normal file and the malicious code are clearly distinguished, the active response to the malicious code based on the active response information can be minimized, thereby minimizing the possibility of damage to the normal file and the misdiagnose.

According to an embodiment of the present invention, the correspondence information updating apparatus 110 may further include a database 114.

The database 114 stores state change time information differently set for each of the at least one client terminal 121, 122, 123.

In this case, the correspondence information transmitter 113 may transmit the state change time information to at least one client terminal 121, 122, 123.

In this case, the at least one client terminal (121, 122, 123) is based on the state change time information after the diagnosis of the malicious code based on the basic correspondence information at least one client terminal (121, 122, 123) When the state change time set differently for each elapses, the malicious code may be treated based on the positive response information.

In other words, embodiments of the present invention are based on the corresponding information for each of the at least one client terminal (121, 122, 123) in consideration of the type or characteristic of the at least one client terminal (121, 122, 123). The execution time of the active action of performing the treatment for malware can be set differently.

For example, suppose that client terminal 1 121 is a personal computer having a relatively low importance of a file and frequently introduces new files, and client terminal 2 122 is an enterprise server having a high importance of a file.

In this case, the state change time information may be defined as 5 hours for the client terminal 1 121 in the database 114, and the state change time information may be defined as 3 days for the client terminal 2 122. have.

After the basic correspondence information generation unit 111 generates basic correspondence information, the active correspondence information generation unit 112 generates active correspondence information, and then the correspondence information transmission unit 113 performs the client terminal 1 121 and the client terminal 2. When the basic correspondence information, the active correspondence information, and the state change time information are transmitted to the 122, the client terminal 1 121 and the client terminal 2 122 first diagnose a malicious code based on the basic correspondence information. Do this.

In this case, the client terminal 1 121 may perform treatment for the malicious code based on the positive response information when 5 hours have elapsed after the diagnosis of the malicious code is performed based on the basic response information.

In addition, when 3 days have passed since the diagnosis of the malicious code is performed based on the basic correspondence information, the client terminal 2 122 may perform treatment on the malicious code based on the aggressive response information. .

Here, since the client terminal 1 (121) is relatively insignificant in file importance, but is a personal computer that frequently introduces new files, the damage caused by delayed treatment of the malicious code may be greater than the degree of damage caused by the malicious code diagnosis error. Therefore, the corresponding information update apparatus 110 may shorten the state change time information.

In addition, since the client terminal 2 122 may have a large damage due to a malicious code diagnosis error in terms of an enterprise server having a relatively high importance of a file, the corresponding information update apparatus 110 sets the state change time information to be long. For example, the malware diagnosis function can be provided while minimizing the possibility of error on the normal file.

As a result, embodiments of the present invention provide different state change time information for each of the at least one client terminal 121, 122, 123 based on the type or characteristic of the at least one client terminal 121, 122, 123, or the like. By setting, appropriate correspondence can be made according to the characteristic of a client terminal.

In addition, according to an embodiment of the present invention, the user of the at least one client terminal (121, 122, 123) is the at least one client terminal (121, 122, 123) the treatment of malicious code based on the active response information The state change time information for performing can be arbitrarily set.

That is, the user of the at least one client terminal (121, 122, 123) by setting the state change time information arbitrarily by himself, whether to prioritize the treatment of malicious code or minimize the possibility of misunderstanding damage according to the situation Can be selected.

According to an embodiment of the present invention, the database 114 may store active time information set differently for each diagnosis method of the malicious code.

In this case, the correspondence information transmitter 113 may transmit the active time information to at least one client terminal 121, 122, 123.

At this time, the at least one client terminal (121, 122, 123) after the diagnosis of the malicious code on the basis of the basic correspondence information, the activity set differently for each diagnostic method for the malicious code based on the active time information If time elapses, the malicious code may be treated based on a diagnosis method included in the corresponding response information.

For example, it is assumed in the database 114 that the active time information is defined as 3 hours for the diagnostic method 1 and the active time information is defined as 1 day for the diagnostic method 2.

When the correspondence information transmitter 113 transmits the basic correspondence information, the active correspondence information, and the active time information to at least one client terminal 121, 122, 123, at least one client terminal 121, 122, 123. ), After the diagnosis of the malicious code is performed based on the basic correspondence information, when the active time set for each diagnosis method has elapsed, the treatment of the malicious code is performed using each diagnosis method included in the active response information. can do.

In other words, the at least one client terminal 121, 122, 123 performs the diagnosis on the malicious code based on the basic correspondence information, and after 3 hours, the diagnosis method 1 included in the active response information is included. The malware may be treated by using the treatment, and after one day, the treatment of the malware may be performed using the diagnosis method 2 included in the corresponding information.

As a result, embodiments of the present invention can adjust the response strength according to the risk of malicious code by setting the active time information differently for each diagnostic method for the malicious code.

According to an embodiment of the present invention, the database 114 may store a white list including the feature information of the normal file.

In this case, the corresponding information transmitter 113 may transmit the white list to at least one client terminal 121, 122, 123.

In this case, the at least one client terminal 121, 122, 123 may not perform the treatment using the positive correspondence information on the normal file with reference to the white list.

In more detail in this regard, the correspondence information updating apparatus 110 collects feature information on a normal file from at least one client terminal 121, 122, 123, generates a common white list, and then generates a database 114. Can be stored in

In this case, the correspondence information updating apparatus 110 transmits the common white list to at least one client terminal 121, 122, 123, and the at least one client terminal 121, 122, 123 is based on basic correspondence information. After the diagnosis of the malicious code is performed, treatment may be performed based on the positive response information only for abnormal files other than normal files with reference to the common white list.

In addition, the correspondence information updating apparatus 110 may individually whitelist each of the at least one client terminal 121, 122, 123 based on a history of malicious code diagnosis of each of the at least one client terminal 121, 122, 123. Can manage.

At this time, the at least one client terminal (121, 122, 123) receives the respective white list from the corresponding information update device 110, respectively, based on the individual white list, the active corresponding information only for abnormal files, not normal files Treatment can be performed on the basis of

2 is a diagram illustrating a structure of a client terminal device according to an embodiment of the present invention.

Referring to FIG. 2, an update server 210 and a client terminal device 220 are shown.

The client terminal device 220 includes a corresponding information receiving unit 221, a diagnosis performing unit 222, and a treatment performing unit 223.

The response information receiving unit 221 receives basic response information associated with the diagnosis of malicious code and positive response information associated with the treatment of the malicious code from the update server 210.

The diagnosis performing unit 222 performs a diagnosis on the malicious code based on the basic correspondence information.

The treatment execution unit 223 performs a treatment for the malicious code based on the positive response information when a predetermined time elapses after the diagnosis of the malicious code is performed.

As a result, when the client terminal device 220 according to an embodiment of the present invention receives basic response information and aggressive response information from the update server 210, the client terminal device 220 passively responds to diagnosis of malicious code based on the basic response information. After the selected time has elapsed, by performing a proactive response such as treating the malicious code based on the aggressive response information, the possibility of a misdiagnosis of the normal file can be minimized.

According to an embodiment of the present invention, the client terminal device 220 may further include a time information receiver 224.

The time information receiver 224 receives state change time information associated with the predetermined time from the update server 210.

At this time, the treatment performing unit 223 performs the treatment for the malicious code based on the active response information when the predetermined time elapses based on the state change time information after the diagnosis of the malicious code is performed. can do.

In addition, according to an embodiment of the present invention, the user of the client terminal device 220 may arbitrarily set the selected time.

Accordingly, the user of the client terminal device 220 may arbitrarily set the predetermined time, and determine whether to minimize the possibility of the occurrence of a misdiagnosis or to prioritize the treatment of the malicious code according to the situation.

According to an embodiment of the present invention, the time information receiver 224 may receive active time information set differently for each diagnosis method for the malicious code from the update server 210.

At this time, the treatment performing unit 223 is a diagnostic method included in the corresponding response information when the active time set differently for each diagnosis method for the malicious code elapses after the diagnosis of the malicious code is performed based on the active time information Based on the treatment can be performed for the malicious code.

In addition, according to an embodiment of the present invention, the client terminal device 220 may further include a white list receiving unit 225.

The white list receiver 225 receives a white list including feature information of a normal file from the update server 210.

In this case, the treatment performing unit 223 may not perform the treatment using the positive correspondence information on the normal file with reference to the white list.

3 is a flowchart illustrating a method of updating correspondence information according to an embodiment of the present invention.

In step S310, basic response information associated with the diagnosis of malicious code is generated.

In step S320, positive response information associated with the treatment of the malicious code is generated.

In step S330, the basic correspondence information and the active correspondence information are transmitted to at least one client terminal.

In this case, the at least one client terminal performs diagnosis on the malicious code based on the basic correspondence information, and when a predetermined time elapses, the at least one client terminal performs treatment on the malicious code based on the aggressive response information.

In this case, according to an embodiment of the present invention, the corresponding information updating method may include: managing a database in which state change time information, which is differently set for each of the at least one client terminal, is stored; The method may further include transmitting the change time information.

In this case, after the at least one client terminal diagnoses the malicious code based on the basic correspondence information, a state change time set differently for each of the at least one client terminal is based on the state change time information. When the elapsed time, the malicious code may be treated based on the positive response information.

The corresponding information updating method according to an embodiment of the present invention has been described above with reference to FIG. 3. Here, since the corresponding information update method according to an embodiment of the present invention may correspond to the configuration of the corresponding information update apparatus 110 described with reference to FIG. 1, a detailed description thereof will be omitted.

4 is a flowchart illustrating a method for treating malware according to an embodiment of the present invention.

In step S410, basic response information associated with the diagnosis of malicious code and positive response information associated with the treatment of the malicious code are received from the update server.

In step S420, the malicious code is diagnosed based on the basic correspondence information.

In step S430, if a predetermined time elapses after the diagnosis of the malicious code is performed, the malicious code is treated based on the positive response information.

At this time, according to an embodiment of the present invention, the malicious code treatment method may further include receiving state change time information associated with the predetermined time from the update server.

In this case, in step S430, when the predetermined time elapses based on the state change time information after the diagnosis of the malicious code is performed, the malicious code may be treated based on the positive response information. have.

In the above, the malicious code treatment method according to an embodiment of the present invention has been described with reference to FIG. Here, since the malicious code treatment method according to an embodiment of the present invention may correspond to the configuration of the client terminal device 220 described with reference to FIG. 2, a detailed description thereof will be omitted.

Corresponding information updating method and malicious code treatment method according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed by various computer means may be recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In the present invention as described above has been described by the specific embodiments, such as specific components and limited embodiments and drawings, but this is provided to help a more general understanding of the present invention, the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

110: response information update device
111: basic correspondence information generator 112: active correspondence information generator
113: correspondence information transmission unit
121, 122, 123: at least one client terminal
210: update server
220: client terminal device
221: corresponding information receiving unit 222: diagnostic performing unit
223: treatment performing unit 224: time information receiving unit
225: whitelist receiver

Claims (13)

delete A basic response information generator for generating basic response information associated with the diagnosis of malicious code;
An active response information generation unit for generating active response information associated with the treatment of the malicious code;
A database storing state change time information differently set for each of the at least one client terminal; And
And a correspondence information transmitter configured to transmit the basic correspondence information, the active correspondence information, and the state change time information to the at least one client terminal.
The at least one client terminal diagnoses the malicious code based on the basic correspondence information, and when the state change time set differently for each of the at least one client terminal elapses based on the state change time information, And responding to the malicious code based on the active response information. The method of claim 2,
The database has
Active time information set differently for each diagnosis method for the malicious code is stored,
The correspondence information transmitter transmits the active time information to the at least one client terminal.
If the at least one client terminal diagnoses the malicious code based on the basic correspondence information and then the active time set differently for each diagnosis method for the malicious code based on the active time information, the active response is performed. Corresponding information update device for performing the treatment for the malicious code based on the diagnostic method included in the information. The method of claim 2,
The database has
A white list containing the characteristic information of the normal file is stored.
The correspondence information transmission unit
Transmit the whitelist to the at least one client terminal,
And the at least one client terminal does not perform treatment using the active correspondence information on the normal file with reference to the white list. delete A corresponding information receiver configured to receive basic response information associated with the diagnosis of malicious code and positive response information associated with the treatment of the malicious code from an update server;
A time information receiver configured to receive state change time information associated with a predetermined time from the update server;
A diagnosis performing unit configured to diagnose the malicious code based on the basic correspondence information; And
And a treatment execution unit configured to perform treatment for the malicious code based on the active response information when the predetermined time elapses based on the state change time information after the diagnosis of the malicious code is performed. Client terminal device. The method according to claim 6,
The time information receiving unit
Receive active time information differently set for each diagnosis method for the malicious code from the update server,
The treatment performing unit, based on the diagnosis method included in the active response information when the activation time set differently for each diagnosis method on the basis of the active time information elapses after the diagnosis on the malicious code is performed, Client terminal device that performs the treatment for the code. The method according to claim 6,
White list receiving unit for receiving a white list containing the characteristic information of the normal file from the update server
Further comprising:
The treatment execution unit does not perform the treatment using the active corresponding information for the normal file with reference to the white list.
delete Generating basic response information associated with diagnosis of malicious code;
Generating active response information associated with the treatment of the malicious code; And
Managing a database in which state change time information is differently set for each of the at least one client terminal;
And transmitting the basic correspondence information, the active correspondence information, and the state change time information to the at least one client terminal.
The at least one client terminal diagnoses the malicious code based on the basic correspondence information, and when the state change time set differently for each of the at least one client terminal elapses based on the state change time information, And responding to the malicious code based on the active response information.
delete Receiving basic response information associated with the diagnosis of malicious code and positive response information associated with the treatment of the malicious code from an update server;
Receiving state change time information associated with a predetermined time from the update server;
Diagnosing the malicious code based on the basic correspondence information; And
And performing a treatment for the malicious code based on the active response information when the predetermined time elapses based on the state change time information after the diagnosis of the malicious code is performed. How to clean malware.
A computer-readable recording medium having recorded thereon a program for performing the method of claim 10.

Images