KR101265530B1 - Malicious program blocking apparatus and method - Google Patents

Abstract

An apparatus and method for blocking malicious programs are disclosed. The embodiments of the present invention detect only I (Input) / O (Output) generated when an application program accesses a file system storage through a file system driver and writes a file, thereby recording a file according to the I / O. By comparing a request location with a storage location of a file to be protected stored on the file system storage unit and blocking the recording of the file according to the I / O when the recording request location matches the storage location, It is an invention that can protect the system from malicious programs.

Description

Malware Blocking Device and Method {MALICIOUS PROGRAM BLOCKING APPARATUS AND METHOD}

An apparatus and method for blocking malicious programs are disclosed. In particular, embodiments of the present invention are directed to a technique for blocking malicious programs that directly modify and modify files to be protected by accessing the file system storage unit directly.

Typically, application programs request writing of a file to a file system in order to write a file to a file system storage, and the file system writes the file to the file system storage in response to the request.

Among these applications, malicious programs exist. These malicious programs often adversely affect the system by performing actions such as writing wrong files in the file system storage.

In general, malicious programs can write a file to the file system storage using a security program.

However, among recently discovered malicious programs, the file system storage unit is used to modify data such as unspecified protected files or operating system (OS) files without being detected by real-time scans or file protection functions of security programs. There are programs that access and record data directly.

These malicious programs directly access the file system storage by making a request to the file system to write the file to a specific location of the file system storage.

In other words, typical applications request the writing of a file to the file system regardless of where the file is written to the file system storage, while malicious programs that directly access the file system storage store the file system for the file system. Request the file to be written to a specific location in the negative.

Currently, since the real-time monitoring or file protection function of the security program is composed of a general file system filter driver, modification of a protected file by directly accessing the file system storage unit may not be detected.

Therefore, there is a need for a technique for blocking malicious programs that directly access file system storage and modify files.

The embodiments of the present invention do not sense I (Input) / O (Output) for all files, but rather the I / O that occurs when an application writes a file by directly accessing the file system storage through a file system driver. By detecting only O and blocking modifications to protected files, system performance can be prevented from being deteriorated, and the protected files are saved by detecting the I / O through a file system filter driver belonging to a higher layer than the file system. By requesting the file system for the exact location, it is intended to provide a technique to prevent file corruption due to bad I / O blocking.

An apparatus for blocking malicious programs according to an embodiment of the present invention includes an information storage unit storing storage location information associated with a storage location of a protected file recorded in a file system storage unit, and an application program storing the file system through a file system driver. I / O sensing unit for detecting I (Input) / O (Output) generated when a file is accessed by directly accessing the unit, and when the I / O is detected, the I / O based on the storage location information A matching determination unit that determines whether the recording request position of the file and the storage location of the file to be protected match with each other; and when the recording request position and the storage location coincide with each other, And a recording blocker for blocking the recording operation.

In addition, the malicious program blocking method according to an embodiment of the present invention comprises the steps of managing a database in which the storage location information associated with the storage location of the protected file recorded in the file system storage unit, the application program through the file system driver Detecting an I / O generated when a file is accessed by directly accessing the file system storage, and when the I / O is detected, recording the file according to the I / O based on the storage location information Determining whether a request location matches a storage location of the protected file, and if the recording request location matches the storage location, blocking recording of the file according to the I / O. .

The embodiments of the present invention do not sense I (Input) / O (Output) for all files, but rather the I / O that occurs when an application writes a file by directly accessing the file system storage through a file system driver. By detecting only O and blocking modifications to protected files, system performance can be prevented from being deteriorated, and the protected files are saved by detecting the I / O through a file system filter driver belonging to a higher layer than the file system. By asking the file system for the correct location, you can prevent file corruption due to bad I / O blocking.

1 is a diagram showing the structure of a malicious program blocking device according to an embodiment of the present invention.
2 is a diagram for describing storage location information according to an embodiment of the present invention.
3 is a flowchart illustrating a malicious program blocking method according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

Normally, I (Input) / O (Output) directly accessing file system storage can be monitored through the disk I / O monitoring driver. The I / O monitoring method through the disk I / O monitoring driver is mainly used for mirroring or real-time volume backup of the disk, and the mirroring or real-time volume backup of the disk is used to cover a certain sector area of the disk. It can be implemented by designating and detecting the write I / O occurring in the area and writing the same to other disks.

However, since the I / O monitoring technique through the disk I / O monitoring driver monitors I / O for all files, when the number of files to be protected is large or large, the I / O performance of the disk is degraded to reduce the overall system. Performance and stability may be compromised.

In addition, since the disk I / O monitoring driver belongs to a lower layer than the file system driver, the file system driver cannot request the sector position where the protected file is stored. Sometimes file writing I / O may be blocked.

Therefore, embodiments of the present invention do not detect I / O for all files, but only detect I / O that occurs when an application writes a file by directly accessing a file system storage through a file system driver. By blocking modifications to protected files, system performance can be prevented, and the correct location where the protected files are stored by detecting the I / O through a file system filter driver belonging to a higher layer than the file system By requesting the file system, we want to provide a technique to prevent file corruption due to bad I / O blocking.

1 is a diagram showing the structure of a malicious program blocking device according to an embodiment of the present invention.

Referring to FIG. 1, the malicious program blocking device 110 according to an embodiment of the present invention includes an information storage unit 111, an I / O detecting unit 112, a match determining unit 113, and a recording blocking unit ( 114).

The information storage unit 111 stores storage location information associated with a storage location of a file to be protected, which is recorded in the file system storage unit.

According to an embodiment of the present invention, the storage location information may include information about a location of a sector along a path in which the target file is stored for each of at least one storage device configuring the file system storage.

2 illustrates a structure of the storage location information stored in the information storage 111.

2 is a diagram for describing storage location information according to an embodiment of the present invention.

As illustrated in FIG. 2, the information storage unit 111 may include each of the at least one storage device 211, 212, 213 constituting the file system storage unit according to each path 221, 222 in which the protected file is stored. The storage location information including the information on the locations 231, 232, 233, and 234 of the sectors may be stored.

The I / O detecting unit 112 detects I / O generated when an application program accesses the file system storage unit directly through a file system driver and writes a file.

In other words, the I / O detector 112 may detect I / O that occurs when an application program attempts to record the file by designating a specific location of the file system storage through a file system driver.

In this case, according to an embodiment of the present invention, the I / O detecting unit 112 detects the I / O through a file system filter driver, thereby requesting the request of the application program associated with the I / O from the file system. You can get it first.

In addition, according to an embodiment of the present invention, the I / O detecting unit 112 may detect I / O requested by a direct access storage device (DASD) I / O or a RAW file system. .

In this case, according to an embodiment of the present invention, the I / O detecting unit 112 checks the FLAG information of the FILE_OBJECT included in the I / O, and if the FO_VOLUME_OPEN information is included in the FLAG information, the I / O May be detected as the DASD I / O, and if the FLAG information in the VOLUME PARAMETER BLOCK of the FILE_OBJECT included in the I / O is included, the VPAG_RAW_MOUNT information is included in the FLAG information in the VOLUME PARAMETER BLOCK. May be detected as I / O requested to the RAW file system.

When the I / O is detected by the I / O detecting unit 112, the matching unit 113 determines whether the I / O is based on the storage location information stored in the information storing unit 111. It is determined whether the recording request position of the file and the storage location of the protected file are identical.

In other words, the match determination unit 113 compares the location on the file system storage where the application program requests the file recording with the storage location of the file to be protected stored in the information storage 111 to record the file. It is determined whether the request location and the storage location match.

At this time, the coincidence determining unit 113 checks the sector position on the file system storage unit in which the protected file is stored from the information storage unit 111 to determine the sector position where the protected file is stored and the recording request. It may be determined whether the positions match.

If the recording request location and the storage location of the file to be protected match, the recording blocking unit 114 blocks the recording of the file according to the I / O.

As a result, when the malicious program blocking device 110 according to an embodiment of the present invention detects the I / O associated with the direct access to the file system storage of the application program, the I / O detection unit 112 matches, If the determination unit 113 compares the recording request position of the file according to the I / O with the storage position of the file to be protected, and if the recording request position and the storage position coincide, the recording blocking unit 114 determines the By blocking the recording operation of the file due to I / O, it is possible to prevent the file from being modified or changed by a malicious program.

In addition, the malicious program blocking device 110 according to an embodiment of the present invention by the I / O detection unit 112 detects the I / O through a file system filter driver belonging to a higher layer than the file system driver When the file write request position of the file according to the I / O and the storage location of the file to be protected are matched, before the file system driver writes the file to the file system storage, the file according to the I / O. It is possible to block the recording behavior of the file.

According to an embodiment of the present invention, the malicious program blocking device 110 may further include a storage determining unit 115 and a storage control unit 116.

When the I / O is detected by the I / O detecting unit 112, the storage determining unit 115 determines whether the file matching request unit 113 records the location and the protection target according to the I / O. Before determining whether the storage locations of the files coincide with each other, it is first determined whether the storage location information associated with the storage location of the file to be protected is stored in the information storage unit 111.

If it is determined that the storage location information is not stored in the information storage unit 111, the storage control unit 116 checks the storage location of the file to be protected and stores the storage location information in the information storage unit 111. Save it.

Then, the coincidence determining unit 113 determines whether the recording request position of the file according to the I / O and the storage position of the file to be protected coincide with each other.

At this time, according to an embodiment of the present invention, the storage control unit 116 determines that the match request position of the file according to the I / O and the storage position of the protected target file match each other in the match unit 113. If so, the storage location of the protected file is reconfirmed.

Then, the coincidence determining unit 113 determines whether the recording request position and the storage position of the reconfirmed file to be confirmed coincide with each other.

If the recording request location and the re-confirmed storage location of the protected object file coincide with each other, the recording blocking unit 114 blocks recording of the file according to the I / O.

However, when the recording request location and the storage location of the reconfirmed protected file are not identical to each other, the storage control unit 116 stores the information stored in the information storage unit 111 based on the reconfirmed storage location. Update the location information.

As a result, when the I / O is detected by the I / O detecting unit 112, the malicious program blocking apparatus 110 according to an embodiment of the present invention, the recording request position of the file according to the I / O and the Even if the storage locations of the protected files coincide with each other, normal I / O is blocked by rechecking whether the storage location of the protected file is the correct storage location before blocking the recording of the file according to the I / O. The damage caused by this can be minimized.

Referring again to the operation of the malicious program blocking device 110 described above is as follows.

When the I / O detection unit 112 detects the I / O due to a malicious program, the storage determining unit 115 stores a storage location on the file system storage unit of the protected file in the information storage unit 111. It may be determined whether the storage location information associated with the is stored.

If the storage location information is not stored in the information storage unit 111, the storage control unit 116 may check the storage location of the file to be protected and store the storage location information in the information storage unit 111. have.

On the other hand, when the storage location information is stored in the information storage unit 111, the match determination unit 113 determines whether the recording request position of the file according to the I / O and the storage position of the protected file match with each other. It can be determined.

In this case, when it is determined that the recording request position of the file according to the I / O and the storage location of the file to be protected coincide with each other, the storage controller 116 may reconfirm the storage location of the file to be protected.

Then, the coincidence determination unit 113 determines whether the record request position and the reconfirmed storage position match each other, and if it is determined that the record request position and the reconfirmed storage position coincide with each other, recording is blocked. The unit 114 may block recording of the file according to the I / O.

However, when it is determined by the coincidence determining unit 113 that the recording request position and the reconfirmed storage position do not coincide with each other, the storage control unit 116 stores the storage position information stored in the information storage unit 111. May be confirmed to be wrong and update the storage location information based on the reconfirmed storage location.

The malicious program blocking device 110 described above is configured to block the recording of the file according to the I / O when the I / O detecting unit 112 detects the I / O. It was for the example.

However, the malicious program blocking apparatus 110 according to another embodiment of the present invention, the I / O detection unit 112 detects a file recording request for the file system driver of the application program associated with the I / O. In this case, the record blocking unit 114 may block the file recording request, thereby blocking the activity of the malicious program.

In other words, the I / O detector 112 may detect the I / O through a file system filter driver belonging to a higher layer than the file system driver, and thus the file of the application program associated with the I / O. By detecting a file write request for a system driver, the write blocker 114 blocks the file write request in advance before the file write request arrives at the file system driver, thereby blocking the malicious program's activity. .

3 is a flowchart illustrating a malicious program blocking method according to an embodiment of the present invention.

In operation S310, a database in which storage location information associated with a storage location of a file to be protected, recorded in the file system storage unit, is stored.

In this case, according to an embodiment of the present invention, the storage location information may include information about a location of a sector along a path in which the protected file is stored for each of at least one storage device configuring the file system storage.

In operation S320, an application program detects I / O generated when a file is accessed by directly accessing the file system storage through a file system driver.

At this time, according to an embodiment of the present invention, in step S320, the I / O may be detected using a file system filter driver.

In addition, according to an embodiment of the present invention, in step S320, I / O requested by the DASD I / O or the RAW file system may be detected.

At this time, according to an embodiment of the present invention, in step S320, identifying the FLAG information of the FILE_OBJECT included in the I / O, and if the FO_VOLUME_OPEN information is included in the FLAG information, the I / O Detecting by DASD I / O.

According to an embodiment of the present invention, in step S320, the FLAG information in the VOLUME PARAMETER BLOCK of the FILE_OBJECT included in the I / O is checked, and the VPB_RAW_MOUNT information is included in the FLAG information in the VOLUME PARAMETER BLOCK. In this case, the method may include detecting the I / O as an I / O requested by the RAW file system.

As a result of the detection in step S320, if the I / O is not detected in step S330, the process ends.

However, when the I / O is detected in step S330 as a result of the detection in step S320, in step S340, a request position for recording the file according to the I / O is based on the storage location information. It is determined whether the storage locations of the protected files match.

As a result of the determination of step S340, if the recording request location and the storage location do not coincide with each other in step S350, the process ends.

However, when it is determined in step S340 that the recording request location and the storage location coincide with each other in step S350, in step S360, recording of the file according to the I / O is blocked.

According to an embodiment of the present disclosure, the malicious program blocking method may include determining whether the storage location information is stored in the database when the I / O is detected in step S330 before step S340. It may further comprise a step.

Then, when the storage location information is not stored in the database, the malicious program blocking method may further include checking the storage location of the file to be protected and storing the storage location information in the database. .

In addition, according to an embodiment of the present invention, the malicious program blocking method, if it is determined in step S350 that the recording request location and the storage location is the same before the step (S360), the storage of the file to be protected The method may further include reconfirming the position.

Then, the malicious program blocking method may determine whether the recording request location and the reconfirmed storage location match.

In this case, when the recording request location and the reconfirmed storage location coincide with each other, in step S360, recording of the file according to the I / O may be blocked.

However, if the recording request location and the reconfirmed storage location do not match, the malicious program blocking method may further include updating the storage location information stored in the database based on the reconfirmed storage location. Can be.

According to another embodiment of the present invention, in step S320, detecting a file write request for the file system driver of the application program associated with the I / O, and if the file write request is detected, And blocking the file recording request.

The malicious program blocking method according to an embodiment of the present invention has been described above with reference to FIG. 3. Here, since the malicious program blocking method according to an embodiment of the present invention may correspond to the configuration of the malicious program blocking device 110 described with reference to FIG. 1, a detailed description thereof will be omitted.

Malicious program blocking method according to an embodiment of the present invention is implemented in the form of program instructions that can be executed by various computer means may be recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In the present invention as described above has been described by the specific embodiments, such as specific components and limited embodiments and drawings, but this is provided to help a more general understanding of the present invention, the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

110: malware blocking device
111: information storage unit 112: I / O detection unit
113: match determination unit 114: record blocking unit
115: storage determining unit 116: storage control unit

Claims (20)

An information storage unit storing storage location information associated with a storage location of a file to be protected recorded in the file system storage unit;
An I / O detector for detecting I (Input) / O (Output) generated when an application program accesses the file system storage unit directly through a file system driver to record a file;
When the I / O is detected, whether the recording request position for recording the file according to the I / O and the storage position of the file to be protected according to the storage location information stored in the information storage unit coincide with each other. A match determination unit to determine a; And
A recording blocker which blocks a recording operation of the file according to the I / O when the recording request location and the storage location coincide with each other;
Malware blocking device comprising a. The method of claim 1,
A storage determining unit determining whether the storage location information is stored in the information storage unit when the I / O is detected; And
If the storage location information is not stored in the information storage unit, the storage control unit for storing the storage location information to determine the storage location of the file to be protected to the information storage unit
Malware blocking device further comprising. The method of claim 2,
The storage control unit
As a result of the determination of the match determination unit, when the recording request location and the storage location match, the storage location of the protected file is reconfirmed,
The match determination unit determines whether or not the recording request position and the re-confirmed storage location,
And the recording blocker blocks the recording of the file according to the I / O when the recording request location and the reconfirmed storage location match. The method of claim 3,
The storage control unit
When the record request location and the reconfirmed storage location do not coincide with each other, the malicious program block for updating the storage location information stored in the information storage unit is based on the reconfirmed storage location. Device. The method of claim 1,
The I / O detector
Malware blocking device that detects the I / O using a file system filter driver. The method of claim 5,
The I / O detector
Direct Access Storage Device (DASD) A malware blocking device that detects one or more of the I / Os or I / Os required by the RAW file system. The method according to claim 6,
The I / O detector
When the FLAG information of the FILE_OBJECT included in the I / O is checked and the FO_VOLUME_OPEN information is included in the FLAG information, the I / O is detected as the DASD I / O.
If the FLAG information in the VOLUME PARAMETER BLOCK of the FILE_OBJECT included in the I / O is checked and the FLAG information in the VOLUME PARAMETER BLOCK includes the VPB_RAW_MOUNT information, the I / O is the I / O requested by the RAW file system. Malware blocking device that detects. The method of claim 1,
The storage location information
And at least one storage device of the file system storage unit, the malicious program blocking device including information on a location of a sector along a path in which the protected file is stored. The method of claim 1,
The I / O detector
Detect a file write request for the file system driver of the application associated with the I / O,
The recording blocking unit is a malicious program blocking device that blocks the file recording request. Managing a database in which storage location information associated with a storage location of a protected object file recorded in the file system storage unit is stored;
Detecting an I (Input) / O (Output) that occurs when an application program directly accesses the file system storage through a file system driver to write a file;
When the I / O is detected, whether the recording request position for recording the file according to the I / O and the storage position of the file to be protected according to the storage location information stored in the information storage unit coincide with each other. Determining; And
Blocking recording of the file according to the I / O when the recording request location and the storage location coincide with each other;
Malware blocking method comprising a. The method of claim 10,
Determining whether the storage location information is stored in the database when the I / O is detected; And
If the storage location information is not stored in the database, checking a storage location of the protected file and storing the storage location information in the database
Malware blocking method comprising more. The method of claim 10,
Reconfirming the storage location of the file to be protected if it is determined that the recording request location and the storage location match; And
Determining whether the recording request location and the reconfirmed storage location match;
Further comprising:
The blocking step
And blocking the recording of the file according to the I / O when the recording request location and the reconfirmed storage location match. The method of claim 12,
If it is determined that the recording request location and the reconfirmed storage location do not coincide, updating the storage location information stored in the database based on the reconfirmed storage location;
Malware blocking method comprising more. The method of claim 10,
The sensing step
A malicious program blocking method that detects the I / O using a file system filter driver. 15. The method of claim 14,
The sensing step
A method of blocking malware that detects one or more of Direct Access Storage Device (DASD) I / Os or I / Os requested by the RAW file system. 16. The method of claim 15,
The sensing step
Checking FLAG information of FILE_OBJECT included in the I / O; And
Detecting the I / O as the DASD I / O when the FLAG information includes FO_VOLUME_OPEN information.
Malware blocking method comprising a. 16. The method of claim 15,
The sensing step
Checking the FLAG information in the VOLUME PARAMETER BLOCK of the FILE_OBJECT included in the I / O; And
Detecting the I / O as an I / O requested by the RAW file system when the FLAG information in the VOLUME PARAMETER BLOCK includes VPB_RAW_MOUNT information
Malware blocking method comprising a. The method of claim 10,
The storage location information
And at least one storage device constituting the file system storage unit, the malicious program blocking method comprising information on a location of a sector along a path in which the protected file is stored. The method of claim 10,
The sensing step
Detecting a file write request for the file system driver of the application program associated with the I / O; And
If the file recording request is detected, blocking the file recording request
Malware blocking method comprising a. A computer readable recording medium having recorded thereon a program for performing the method of claim 10.

Images