KR101267953B1 - Apparatus for Preventing Malicious Codes Distribution and DDoS Attack through Monitoring for P2P and Webhard Site - Google Patents

Abstract

The present invention discloses a device and method for collecting / distributing a malicious code distribution site URL. Malicious code distribution site URL collection / distribution device according to an aspect of the present invention, the collection unit for receiving a list of the management target URL and the unclassified URL list from the plurality of user panel; A management target updating unit that selects a new management target URL list not previously registered from the unclassified URL list; The plurality of verification sites are queried as to whether a URL included in the new management target URL list is a malicious code distribution site URL, and the malicious one having validity among URLs identified as at least one verification site URL by the malicious code distribution site URL. Distribution target updating unit for selecting the code distribution site URL; And a distribution unit for distributing a list of the valid malicious code distribution site URLs, wherein the verification site is a service site of an enterprise having a database including the malicious code distribution site URLs.

Description

Apparatus for Preventing Malicious Codes Distribution and DDoS Attack through Monitoring for P2P and Webhard Site}

The present invention relates to a method for preventing malicious code distribution, and more particularly, to an apparatus and method for collecting / distributing a malicious code distribution site URL that can prevent distribution of malicious code by analyzing an Internet access URL.

In general, PCs are infected by malicious code via 1) physical removable storage media such as USB, or 2) network. In recent years, PC infections are more frequent than mobile storage media.

Infection via the network can be classified as 1) NetApps (Network Applications) such as e-mail, messenger, or P2P installed on a PC, or 2) access to a website that distributes malicious code. Infections by connections are more frequent.

Malware or program files can be downloaded to a PC through explicit consent or "Drive By Download". In recent years, the high security features of web browsers and the high social interest can make explicit consents most of them blocked or denied. Therefore, recently, malicious codes have been downloaded in a "Drive By Download" manner.

Similarly, zombie PCs that are the basis of the Distributed Denial of Service Attack (DDoS) attack also have a DDoS attack program caused by malware when a user's PC connects to a peer-to-peer file sharing service (P2P) or web hard site that distributes malware. Drive by Download "is installed automatically, mass production.

Zombie PCs are used for DDoS attacks that attack specific sites at specific times after a certain period of infection, and also cause additional damage to delete the PC's hard disk after the attack.

While P2P and Webhard sites are used by many users, they are often used as zombie PCs because of their weak security infrastructure.

Moreover, Korea's high-speed Internet infrastructure is the world's best, so large files such as movies and music are distributed and shared more than other countries. The main paths are P2P and web hard sites.

In fact, Sharebox, which distributed numerous malicious codes by mass-producing zombie PCs in the previous 3.4 DDoS attack, was a web hard site with tens of thousands to hundreds of thousands of visitors per day.

In contrast to P2P and Webhard sites, portal sites such as NAVER and DAUM have more visitors and data traffic, but continuously manage pornography and illegal works to be posted, and manage the system by professional personnel. By constantly monitoring and supplementing security vulnerabilities, it can be relatively safe from malicious code.

However, small web hard and P2P sites are in the blind spot of law regulation because they have illegal characteristics such as copyright infringement, and it is difficult to manage them by creating and closing tens or hundreds of them a week. As a result, sites such as Webhard and P2P have become hotbeds of malware distribution, and this trend will continue.

Therefore, additional DDoS attacks and their damages will continue to occur unless the webhard and P2P sites are continuously tracked and analyzed and reflected to the harmful site blocking system in real time to properly control access to the site. Self-explanatory

In addition, if a PC infected with a zombie PC is a business PC of an enterprise or an institution, not only a direct loss such as a loss of a work file, but also an unpredictable level of additional loss may occur due to a decrease in the brand value of the company or an institution. As a result, companies and organizations are faced with the need to invest and pay attention to prevent internal PCs infected with zombies.

Conventional network security devices such as firewalls, intrusion prevention systems (IPS), and anti-DDoS use technology to protect internal systems in the event of DDoS attacks.

In addition, the conventional network access control (NAC) equipment uses a technology that detects abnormally excessive traffic from a zombie PC infected with malware and blocks the network.

Conventional antivirus cannot detect the program used for the DDoS attack when the program used for the DDoS attack impersonates a normal program, and thus, there is no great benefit in the prevention of the zombie PC.

Of course, some conventional firewalls and IPSs also provide manual registration and blocking of URL distribution site URLs. However, network security performance is degraded when the function is provided, and since P2P and web hard sites that are continuously created and closed are not tracked and analyzed in real time, they are not used to prevent zombie PCs. It can be said.

It is thought that the technology to prevent the creation of zombie PCs in parallel with the conventional network security equipment can be minimized to prevent additional DDoS attacks, but to minimize the level of attack or the damage level. The development of technology that can prevent this is insufficient.

The present invention has been made in the technical background as described above, collecting / distributing a malicious code distribution site URL that can determine whether the URL collected by the user panel through the at least one of the plurality of verification sites is the URL of the malicious code site It is an object of the present invention to provide an apparatus and method.

It is another object of the present invention to provide a malware distribution site URL collection / distribution apparatus and method for storing URLs of newly identified malware sites in a list of URLs collected by a user panel and distributing them to a harmful site blocking system. do.

Malicious code distribution site URL collection / distribution device according to an aspect of the present invention, the collection unit for receiving a list of the management target URL and the unclassified URL list from the plurality of user panel; A management target updating unit that selects a new management target URL list not previously registered from the unclassified URL list; The plurality of verification sites are queried as to whether a URL included in the new management target URL list is a malicious code distribution site URL, and the malicious one having validity among URLs identified as at least one verification site URL by the malicious code distribution site URL. Distribution target updating unit for selecting the code distribution site URL; And a distribution unit for distributing a list of the valid malicious code distribution site URLs, wherein the verification site is a service site of an enterprise having a database including the malicious code distribution site URLs.

According to another aspect of the present invention, there is provided a method for collecting / distributing a malicious code distribution site URL, the method comprising: receiving a list of unclassified URLs and a classified management target URL list classified by applications installed in a plurality of user panel terminals; Selecting a new unlisted management target URL list from the unclassified URL list; Querying a plurality of verification sites whether a URL included in the new management target URL list is a malicious code distribution site URL; Selecting a valid malicious code distribution site URL from at least one of the verification site URLs identified as the malicious code distribution site URL; And distributing the list of the valid malicious code distribution site URLs to at least one of a harmful site blocking system and the plurality of user panel terminals, wherein the verification site includes the malicious code distribution site URL. Characterized in that it is a service site of a company having a database.

According to the present invention, continuously search, analyze and identify URLs of managed and malicious code distribution sites including P2P sites and webhard categories, which are hotbeds of malicious code distribution, and list new target URLs and malicious codes in the harmful site blocking system. You can update the code distribution site URL list continuously for distribution.

Therefore, the present invention can support the harmful site blocking system to block or warn the access of the management target site and malicious code distribution site high risk of malware infection.

In addition, the present invention can prevent the distribution of malicious code to all PCs in the management area by checking whether or not to access the malicious code distribution site URL by installing applications provided by a plurality of verification sites in one server. .

In addition, the present invention by suppressing the generation of the zombie PC that is a means of DDoS attack, it is possible to prevent the DDoS attack to minimize the size of the attack, or to disable the DDoS attack.

Furthermore, the present invention is equipped with a full-range DDoS attack defense infrastructure in addition to network security equipment such as fire prevention, IPS, and Anti-DDoS, thereby protecting the nation nationally and improving the nation through national competitiveness and image enhancement. I can contribute.

1 is a block diagram showing a system for preventing malicious code distribution according to an embodiment of the present invention.
2 is a diagram illustrating a data flow of a distribution target updater according to an embodiment of the present invention.
3 is a flowchart illustrating a method of providing information of a malicious code distribution site according to an embodiment of the present invention.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. As used herein, the terms " comprises, " and / or "comprising" refer to the presence or absence of one or more other components, steps, operations, and / Or additions.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. 1 is a block diagram showing a system for preventing malicious code distribution according to an embodiment of the present invention.

As shown in Figure 1, the malware distribution prevention system 10 according to an embodiment of the present invention is a plurality of user panel terminal 100, URL collection / distribution server 200, harmful site blocking system (300, 300) Include ').

The plurality of user panel terminals 100 are one or more terminals selected for the plurality of Internet access interfaces so as to represent all the Internet networks used at home and abroad by individuals, companies, institutions, and ISPs.

The plurality of user panel terminals 100 are provided with a terminal agent application program used for aggregation and transmission of a list of the aggregated universal resource locators (URLs) of the Internet access sites. Here, the terminal agent application program may be provided by the URL collection / distribution server 200.

When the user panel terminal 100 executes the terminal agent application program, each user panel terminal 100 includes a list of pleasant management target URLs and other unclassified URLs included in the management target category among URL lists stored and aggregated in a predetermined time unit or daily unit. To be transmitted to the URL collection / distribution server 200.

Here, the management target URL may be a URL included in a high-risk website category, such as a P2P site, a web hard site, a lewd site, a gambling site, or a web mail site.

The URL collection / distribution server 200 may include a collection unit 210, a management target updater 220, a distribution target updater 230, a management target list DB 250, a distribution target list DB 260, and a distribution unit 240. ).

The collection unit 210 transmits the unclassified URL list received from at least one of the plurality of user panel terminals 100 to the management target update unit 220.

In addition, the collection unit 210 transmits the mood management target URL list received from at least one of the plurality of user panel terminals 100 to the distribution target updating unit 230.

The management target updating unit 220 provides a list of unclassified URLs to professionals through an interface such as screen, print, copy & paste, and the like, and is not registered new management target URLs classified by the professionals. The list is transmitted to the update target distribution unit 230.

At this time, the management target updating unit 220 may distinguish the new management target URL list from the list of URLs unclassified by the application program without the manual labor of the expert (user).

The management target updating unit 220 manages a list of URLs that are identified as being URLs that are not malicious code distribution site URLs or URLs that are not valid URLs among the list of new management target URLs and the list of favorite managed URLs. Update to 250.

The distribution target updater 230 queries the plurality of verification sites whether each URL included in the management target URL list (that is, the new management target URL list and the desired management target URL list) is a malicious code distribution site URL. Here, the verification site may be a site providing malware domain information, such as service sites such as Ahnlab, MacAfee, Symantec, Google, Brower Defender, WebSecuriry Guard, MalwareDomainList, or WebOfTrust.

The distribution target updating unit 230 checks responses from the plurality of verification sites and selects a malicious code distribution site URL from a list of management target URLs. In this case, the distribution target updater 230 classifies the URL identified as the malicious code distribution site URL from at least one of the plurality of verification sites as the malicious code distribution site URL.

The distribution target updater 230 queries the validity of the malware distribution site URL classified in "Client Honeypot". Here, when malware and malware program files are downloaded in the "Drive By Download" method, there is a feature that attempts to change the shape of the PC (process, system files, registry, etc.), and "Client Honeypot" uses these features. Check the validity of the malware distribution site URL.

The distribution target updater 230 updates the malicious code distribution site URL that is currently improved and invalidated to the management target list DB 250, and updates the valid malicious code distribution site URL to the distribution target list DB 260. do.

The distribution unit 240 distributes the updated malicious code distribution site URL list and the management target URL list to the harmful site blocking system 300 or 300 'in real time.

The distribution unit 240 distributes the updated management target URL list to the terminal agent application programs of the plurality of user panel terminals 100 in real time. Thereafter, the plurality of user panel terminals 100 use the distributed management target URL list for URL classification.

The harmful site blocking system 300 or 300 ′ stores a list of malicious code distribution site URLs from the distribution unit 240, and blocks the access when a PC in the management area tries to access the malicious code distribution site URL.

Hereinafter, an operation algorithm of a distribution target updater according to an embodiment of the present invention will be described with reference to FIG. 2. 2 is a diagram illustrating a data flow of a distribution target updater according to an exemplary embodiment of the present invention.

As illustrated in FIG. 2, the distribution target updater 230 receives a list of new management target URLs classified as websites included in a category having a high risk of becoming a newly discovered malware distribution site (S210).

The distribution target updater 230 queries the plurality of verification sites whether each URL included in the new management target URL list is a malicious code distribution site URL (S220).

When the distribution target updater 230 receives a response from the plurality of verification sites that it is not a malicious code distribution site URL (S230), it updates the URL to the management target list DB 250 (S240).

When the distribution target updater 230 receives a response that the URL of the malicious code distribution site is received from at least one of the plurality of verification sites (S250), it queries the client honeypot for validity of the URL (S260).

When the distribution target updating unit 230 receives a response that the validity from the client Honeypot (S270), and updates the URL to the distribution target list DB (260) (S280).

When the distribution target updater 230 receives a response from the Client Honeypot that it is not valid (S290), it updates the URL to the management target list DB 250 (S240).

Meanwhile, the distribution target updating unit 230 performs the above-described steps (S220) to (S280) for all the URLs of the new management target URL list, and then the distribution target list DB 260 and the management target list DB 250. You can also update.

In FIG. 2, the distribution target updater 230 checks whether or not the distribution site URL is valid and valid only for the list of new management target URLs. For example, the distribution target updater 230 is confirmed. You can check whether the URL of all managed URL list is the URL of the malware distribution site and whether it is valid. Therefore, the present invention can support to defend against URLs of recently infected malware distribution sites.

Hereinafter, a method of providing information of a malicious code distribution site according to an embodiment of the present invention will be described with reference to FIG. 3. 3 is a flowchart illustrating a method of providing information of a malicious code distribution site according to an embodiment of the present invention. The malicious code distribution site URL collection / distribution apparatus of FIG. 3 may be the URL collection / distribution server 200 of FIG. 1.

Referring to FIG. 3, the malicious code distribution site URL collection / distribution apparatus selects a user panel terminal representing an Internet connection according to a user setting (S310).

The malicious code distribution site URL collection / distribution apparatus provides and installs an application program for automatically collecting and transmitting URLs of an Internet access site to the user panel terminal (S320).

The malicious code distribution site URL collection / distribution apparatus receives a management target URL list and an unclassified URL list from the user panel terminal (S330).

The malicious code distribution site URL collecting / distributing device classifies the unclassified URL list into a new management target URL list and other non-management URL lists (S340).

The malicious code distribution site URL collecting / distributing apparatus queries the plurality of verification sites whether each URL included in the management target URL list and the new management target URL list is the malicious code distribution site URL (S350).

The malicious code distribution site URL collection / distribution apparatus checks whether the URL identified as being the malicious code distribution site URL from the verification site is valid (S360).

If the malicious code distribution site URL collection / distribution apparatus is valid, the malicious code distribution site URL is updated to the distribution target list DB 260 (S370).

The malware distribution site URL collection / distribution apparatus distributes all or part of the updated malware distribution site URL list in real time (S380).

The malicious code distribution site URL collection / distribution apparatus is confirmed as not the malicious code distribution site URL or updates the management target URL that is determined to be a malicious code distribution site but not valid to the management target list DB 250 (S390).

As described above, the present invention continuously searches, analyzes and identifies URLs of managed and malicious code distribution sites including P2P sites and webhard categories that are hotbeds of malicious code distribution, and lists new target URLs in the harmful site blocking system. Malware distribution site URL list can be updated continuously for distribution.

Therefore, the present invention can support the harmful site blocking system to block or warn the access of the management target site and malicious code distribution site high risk of malware infection.

In addition, the present invention can prevent the distribution of malicious code to all PCs in the management area by checking whether or not to access the malicious code distribution site URL by installing applications provided by a plurality of verification sites in one server. .

In addition, the present invention by suppressing the generation of the zombie PC that is a means of DDoS attack, it is possible to prevent the DDoS attack to minimize the size of the attack or to disable the DDoS attack.

Furthermore, the present invention is equipped with a full-range DDoS attack defense infrastructure in addition to network security equipment such as fire prevention, IPS, and Anti-DDoS, thereby protecting the nation nationally and improving the nation through national competitiveness and image enhancement. I can contribute.

While the present invention has been described in detail with reference to the accompanying drawings, it is to be understood that the invention is not limited to the above-described embodiments. Those skilled in the art will appreciate that various modifications, Of course, this is possible. Accordingly, the scope of protection of the present invention should not be limited to the above-described embodiments, but should be determined by the description of the following claims.

Claims (10)

A collection unit configured to receive a list of managed object URLs and unclassified URLs from a plurality of user panels;
A management target updating unit that selects a new management target URL list not previously registered from the unclassified URL list;
The plurality of verification sites are queried as to whether a URL included in the new management target URL list is a malicious code distribution site URL, and the malicious one having validity among URLs identified as at least one verification site URL by the malicious code distribution site URL. Distribution target updating unit for selecting the code distribution site URL; And
It includes a distribution unit for distributing the list of the malicious code distribution site URL that is valid,
The verification site is a service site of an enterprise having a database including the URL of the malicious code distribution site,
And a terminal agent application program for classifying the aggregated Internet access URLs into the desired management target URL list and the other unclassified URL list to the plurality of user panels. The method of claim 1, wherein the distribution target update unit,
URL collecting / distributing device for checking whether the malware distribution site URL is valid through the Client Honeypot. The method of claim 1, wherein the distribution target update unit,
The URL collection / distribution apparatus of classifying the malicious code distribution site URL into one of the management target URL list and updating the URL to a management target URL list database. The method of claim 3, wherein the distribution unit,
And distributing the management target URL list updated in the management target URL list database to the plurality of user panels. The method of claim 1, wherein the distribution target update unit,
The plurality of verification sites are queried as to whether the URL included in the pleasant management target URL list is the URL of the malicious code distribution site, and validity among URLs identified as the malicious code distribution site URL from at least one verification site. URL collection / distribution device that screens the malware distribution site URL. delete Receiving a list of the un-classified URL and unclassified URL list, classified by the application programs installed in the plurality of user panel terminal;
Selecting a new unlisted management target URL list from the unclassified URL list;
Querying a plurality of verification sites whether a URL included in the new management target URL list is a malicious code distribution site URL;
Selecting a valid malicious code distribution site URL from at least one of the verification site URLs identified as the malicious code distribution site URL; And
Distributing the list of valid malicious code distribution site URLs to at least one of a harmful site blocking system and the plurality of user panel terminals;
The verification site is a service site of an enterprise having a database including the URL of the malicious code distribution site,
Selecting the plurality of user panel terminals each representing a plurality of internet connections; And
And providing the application program to aggregate and transmit URLs of an internet access site to the plurality of user panel terminals. delete The method of claim 7, wherein
The selecting of the malicious code distribution site URL may include classifying the malicious code distribution site URL into one of the management target URL lists, which is determined to be not the malicious code distribution site URL or invalid from the plurality of verification sites. When updating the management target URL list to include,
The distributing step includes distributing the updated management target URL list to the plurality of user panel terminals. The method of claim 9, wherein the distributing step,
Distributing the updated URL list to the harmful site blocking system and the plurality of user panel terminals;
URL collection / distribution method comprising a.

Images