KR101274348B1 - Anti-Malware Device, Server and Pattern Matching Method - Google Patents

Abstract

An anti-malware device, server and malware pattern matching method are disclosed. The hash value generator generates a hash value for the malware and target data of the malware patterns constituting the malware pattern DB by using a hash function having at least one hash coefficient, and the hash matcher is configured to hash values of the malware patterns, The hash value of the target data is matched, and if the matching by the hash matcher succeeds, the matching unit matches the malware patterns with the target data.

Description

Anti-Malware Device, Server and Pattern Matching Method

The present invention relates to an anti-malware device, a server and a malware pattern matching method, and more particularly, to an anti-malware device, a server and a malware pattern matching method that can minimize hash collisions during virus pattern matching.

Malware is a generic term for all software that can harm your computer, including computer viruses, Trojan horses, and malicious code. Malware goes beyond the conventional notion of opening attachments, downloading and installing software, and simply clicking on a link or image on a popular search page installs unwanted software and the system can be hijacked.

On the other hand, due to the relationship between the operating system and the file system is less than the computer, and the importance of the data used is relatively low, the recognition and damage of the mobile virus to the wireless communication system is not yet large.

However, as the hardware of the portable terminal is advanced and the applications executed in the portable terminal are diversified and complicated, the malware that attacks the existing computer is likely to cause serious damage to the portable terminal. In particular, in accordance with the proliferation of wireless portable Internet services such as WiBro, applications and services for mobile terminals such as Bluetooth and Multimedia Messaging System (MMS), in addition to malicious codes that attack vulnerabilities of existing computer applications. Mobile malware is emerging that attacks vulnerabilities. These various malicious codes can cause serious damage such as inducing malfunction of the mobile terminal, deleting data or leaking user's personal information.

The present invention performs an operation of calculating a hash coefficient or a hash function to prevent a hash collision in the server, and the anti-malware device, server that can minimize the hash collision by transmitting the calculated hash coefficient or hash function to the anti-malware device And a malware pattern matching method.

Another object of the present invention is to provide an antimalware device, a server, and a malware pattern matching method capable of preventing a hash collision from a client by calculating a hash coefficient in a server of the antimalware system.

According to an embodiment of the present invention, a hash value generator for generating hash values for malware patterns and hash values for target data using a hash function having at least one hash coefficient; A hash matcher which matches a hash value of the target data with hash values of the malware patterns; And a matching unit for matching the malware patterns with the pattern of the target data when the matching by the hash matcher succeeds.

According to an embodiment of the present invention, selecting the hash coefficient with reference to the malware patterns so as to minimize the probability that the hash values of the malware patterns mutually conflict; Calculating hash values for the malware patterns using the predetermined hash coefficient; And matching the malware patterns with a pattern of the target data when at least one of the hash values for the malware patterns and the hash value for the target data are matched with each other. A method of performing a pattern matching operation is provided.

According to an embodiment of the present invention, calculating hash values of malware patterns using a hash function; Calculating a hash value for target data using the hash function; If the hash values for the malware patterns and the hash value for the target data match, matching the malware patterns with the pattern of the target data; And determining whether hash values of the calculated malware patterns are collided with each other. A malware pattern matching method using a hash function is provided.

According to one embodiment of the invention, the communication unit for receiving at least one hash coefficient and data from the server; A hash value generator configured to generate hash values for malware patterns and hash values for target data using a hash function having the at least one hash coefficient; And a processor comprising a hash matcher for matching the hash values of the target data and the hash values of the malware patterns, and a matching unit for matching the malware patterns with the target data when matching by the hash matcher is successful. Malware devices are provided.

According to an embodiment of the present invention, in a server for transmitting malware pattern data to an anti-malware device performing a malware pattern matching using a hash function having a hash coefficient, when the malware patterns are transmitted to the anti-malware device It is provided with a server comprising; an update unit for transmitting the hash coefficient to the anti-malware device.

According to the present invention, by using the server-side computing environment to work to minimize the hash collision in the server to configure the optimal hash coefficient (Hash Coefficient) value to the client (Signature) to deliver to the client with the signature (DB) Therefore, there is an effect of solving the problems caused by the limited memory storage space and the computing power of the conventional client side.

By doing so, in the present invention, the client can greatly reduce the load consumption, and only the resulting portion can be processed, so that the improvement in performance can be expected.

In addition, in the present invention, since the hash collision is minimized, there is an effect that can be processed quickly at the time of pattern detection.

In addition, in a small computer device, the smaller the hash collision, the less the memory is accessed, thereby reducing the battery consumption due to the high speed and the low memory usage.

1 is a diagram illustrating an anti-malware system according to an embodiment of the present invention;
2 is a view for explaining the form of a packet and / or file of malware pattern data transmitted to the anti-malware device according to an embodiment of the present invention,
FIG. 3 is a schematic diagram illustrating a series of processes in which a hash value generator generates a hash value for virus pattern data among first malware pattern data; FIG.
4 is a diagram illustrating an example of a first hash matcher table and a first sub matcher table;
5 is a view illustrating an example of a pattern DB unit;
6 is a diagram illustrating an example of a second hash matcher table and a second sub matcher table;
7 is a diagram illustrating an anti-malware system according to another embodiment of the present invention;
8 is a flowchart illustrating an operation of a server in a malware pattern matching method according to an embodiment of the present invention;
9 is a flowchart illustrating a malware pattern matching method of an anti-malware device according to an embodiment of the present invention;
10 is a flowchart illustrating an update method of a malware pattern matching method of an anti-malware system according to an embodiment of the present invention;
11 is a diagram illustrating an anti-malware system according to another embodiment of the present invention;
12 is a flowchart illustrating a basic process of performing a hash collision prevention method in an anti-malware system according to another embodiment of the present invention;
13 is a flowchart for explaining a block generation process in step S1209 according to another embodiment of the present invention;
14 is a flowchart for explaining a collision avoidance process of step S1211 according to another embodiment of the present invention;
15 is a flowchart illustrating a hash function processing process of step S1411 according to another embodiment of the present invention;
16 is a flowchart illustrating an update process performed by a server according to another embodiment of the present invention; and
17 to 22 are views for explaining the effect of the SOC according to the embodiments of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features, and advantages of the present invention will become more readily apparent from the following description of preferred embodiments with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. Rather, the embodiments disclosed herein are provided so that the disclosure can be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. In this specification, when an element is referred to as being on another element, it may be directly formed on another element, or a third element may be interposed therebetween.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. The terms "comprises" and / or "comprising" used in the specification do not exclude the presence or addition of one or more other elements.

Hereinafter, the present invention will be described in detail with reference to the drawings. In describing the specific embodiments below, various specific details have been set forth in order to explain the invention in greater detail and to assist in understanding it. However, those skilled in the art can understand that the present invention can be used without these various specific details. In some cases, it is mentioned in advance that parts of the invention which are commonly known in the description of the invention and which are not highly related to the invention are not described in order to prevent confusion in explaining the invention without cause.

1 is a diagram illustrating an anti-malware system according to an embodiment of the present invention.

Referring to FIG. 1, an antimalware system includes a server 100 and an antimalware device 200. The server 100 and the anti-malware device 200 may be connected to communicate with each other via the network 10.

The server 100 transmits a malware pattern DB (Database) and at least one hash coefficient to the antimalware device 200. Malware Pattern DB consists of malware patterns. Malware patterns are data that damages files such as viruses, Trojans, infected files, and malicious code.

The malware patterns are reference data used by the anti-malware device 200 to detect whether or not the target data is infected with malware. The malware patterns may include virus patterns for virus scanning and rule patterns for firewall filtering. The virus pattern and the rule pattern will be described later.

The hash coefficient is a coefficient used when calculating the hash value in the anti-malware device 200. Preferably, the hash coefficient is chosen to be one that can prevent hash collision as much as possible. According to an embodiment of the present invention, the hash coefficient may include a virus hash coefficient selected by referring to virus patterns among malware patterns and a rule hash coefficient selected by referring to rule patterns.

When the update malware pattern occurs, the server 100 reselects the hash coefficient, and transmits the update malware pattern DB including the update malware pattern and the reselected hash coefficient to the anti-malware device 200.

The anti-malware device 200 performs malware pattern matching using a hash function having at least one hash coefficient. At least one hash coefficient is a coefficient selected by the server 100. To this end, the anti-malware device 200 uses the hash coefficient included in the malware pattern DB received from the server 100 as a coefficient of the hash function, and substitutes the malware patterns into variables of the hash function. The anti-malware device 200 may correspond to a mobile electronic device such as a system on chip, a notebook, a desktop computer, a smart phone, a smart card, and an asset chip (IP) for a semiconductor.

Hereinafter, the "malware pattern or malware patterns" is often referred to as "malware pattern data", and the "malware pattern data to be transmitted to the anti-malware device 200" or the "anti-malware device 200" Malware pattern data 'is referred to as' first malware pattern data', and 'hash coefficient to be transmitted to the anti-malware device 200' is referred to as' first hash coefficient 'and has a' first hash coefficient '. Hash function 'is referred to as a' first hash function '.

In addition, in the following description, if the first malware pattern data transmitted from the server 100 to the antimalware device 200 is virus pattern data, the first hash coefficient transmitted together with the virus pattern data may be a virus hash coefficient. have. In addition, if the first malware pattern data transmitted from the server 100 to the anti-malware device 200 are rule pattern data, the first hash coefficient transmitted together with the rule pattern data may be a rule hash coefficient. In addition, when the first malware pattern data transmitted from the server 100 to the anti-malware device 200 includes both virus pattern data and rule pattern data, the first hash coefficient transmitted together is a virus hash coefficient and a rule hash. In an embodiment of the present invention, the server 100 includes a hash coefficient selecting unit 110 and an update unit 120.

When the hash coefficient selecting unit 110 applies the hash functions to the first malware pattern data, the hash coefficient selecting unit 110 selects the first hash coefficient to be transmitted to the antimalware device 200 based on a hash function that generates a minimum hash collision result. do.

As an example, the hash coefficient selecting unit 110 may select the first hash coefficient by using an algorithm that minimizes the probability that the hash values derived when the first malware pattern data is applied to the hash function are minimized. In detail, the hash coefficient selecting unit 110 may obtain hash values of the first malware pattern data using the prepared candidate hash groups GN, N = 1, 2,... Each candidate hash group consists of at least one candidate hash coefficient. For example, assume that the first candidate hash group G1 includes candidate hash coefficients {a1, b1, c1}, and the second candidate hash group includes candidate hash coefficients {a2, b2, c2}. The hash coefficient selecting unit 110 may calculate the hash values for each of the candidate hash groups by applying the candidate hash coefficients of the candidate hash groups G1, G2,... To the hash function. In this case, the hash coefficient selecting unit 110 may calculate hash values by referring to the first malware pattern data used in the anti-malware device 200. The hash coefficient selecting unit 110 may count the number of collisions (ie, the number of hash collisions) of the hash values for each candidate hash group, and select a hash coefficient of the candidate hash group having the least hash collision as the first hash coefficient.

Alternatively, the hash coefficient selecting unit 110 may select a hash coefficient that minimizes a variance of hash values derived when the first malware pattern data is applied to the hash function as the first hash coefficient. That is, when the hash values for each of the candidate hash groups are calculated, the hash coefficient selecting unit 110 calculates a variance value of the hash values for each candidate hash group. The hash coefficient selecting unit 110 may check a candidate hash group for calculating a minimum variance value among variances calculated for each candidate hash group, and select the hash coefficient of the identified candidate hash group as the first hash coefficient. have.

When the updater 120 transmits the first malware pattern data to the anti-malware device 200, the updater 120 may transmit the selected first hash coefficient together with the malware pattern data. The first hash coefficient transmitted by the updater 120 may be used to calculate hash values of the first malware pattern data transmitted to the anti-malware device 200.

2 is a view for explaining the form of a packet and / or file of malware pattern data transmitted to the anti-malware device according to an embodiment of the present invention.

Referring to FIG. 2, the packet and / or file includes a header item 310, a hash item 320, and a data item 330. The updater 120 describes the header information in the header item 310, the first hash coefficient in the hash item 320, and records the first malware pattern data in the data item 330. When data is described in the items 310, 320, and 330, the updater 120 may transmit the packet and / or file to the antimalware device 200 in the SVD format.

A case where there is data to update the first malware pattern data will be described below. Hereinafter, 'updated data of the first malware pattern data' is referred to as 'malware pattern data for updating', and a hash coefficient that is redefined by further referring to the malware pattern data for updating is referred to as a 'second hash coefficient'. , 'Hash function with second hash coefficient' is called 'second hash function'.

The hash coefficient selecting unit 110 uses a second hash using an algorithm that minimizes the probability that the hash values derived when applying both the update malware pattern data and the first malware pattern data to the hash function are minimized. The coefficient can be selected. Alternatively, the hash coefficient selecting unit 110 may generate a hash coefficient to minimize the variance of the hash value derived when applying both the update malware pattern data and the first malware pattern data to the hash function. Can be selected.

The updater 120 may transmit the calculated second hash coefficient and the update malware pattern data together to the antimalware device 200. Referring to FIG. 2, the updater 120 writes the header information in the header item 310, the changed second hash coefficient in the hash item 320, and the update malware in the data item 330. The pattern data may be described to transmit a packet and / or a file to the anti-malware device 200.

Referring back to FIG. 1, the antimalware device 200 according to an embodiment of the present invention may include a pattern DB 210, a hash value generator 220, a pattern hash value table 230, and a table generator 240. , The first hash matcher table 250, the first sub matcher table 255, the second hash matcher table 260, the second sub matcher table 265, the hash matcher 270, and the matching unit 280. It may include.

The anti-malware device 200 receives the malware pattern DB including the first malware pattern data and the first hash coefficient from the server 100 in the SVD form as shown in FIG. 2. The first malware pattern data of the malware pattern DB is stored in a memory (not shown) in the form of a pattern DB 210, and the first hash coefficient is input to the hash value generator 220.

The pattern DB 210 stores the first malware pattern data received from the server 100. The first malware pattern data may be used when the matching unit 280 performs a matching operation with the target data to detect whether the target data is infected with malware.

When the first malware pattern data received from the server 100 includes both virus pattern data and rule pattern data, the pattern DB 210 may include a virus pattern DB and a rule pattern DB. The virus pattern DB and the rule pattern DB may be stored in a memory (not shown) provided in a system-on-chip (SoC).

The virus pattern DB is a collection of virus pattern data and is used when performing a virus scanning operation on the target data. That is, the virus pattern data is used to detect whether the target data is virus infected.

The rule pattern DB is a database that stores rule pattern data. The rule pattern data is used for filtering packet data introduced from the outside, that is, to determine whether to block or allow the packet data. Rule pattern data may be directly set by the user or set by default in the server 100 and transmitted to the user device.

The hash value generator 220 uses the at least one first hash coefficient received from the server 100 and the first malware pattern data stored in the pattern DB 210 to generate a hash value HP for the first malware pattern data. ) Can be created. That is, the hash value generator 220 may generate hash values HV for virus pattern data or generate hash values HR for rule pattern data. Therefore, in the following description, the hash value HP may mean a hash value HV or a hash value HR.

The first hash coefficient is selected by the server 100 based on the minimum hash collision result through the hash function for the first malware pattern data. In addition, the first hash function is a function determined to minimize the probability of collisions between the hash values derived when randomly deriving hash values for the first malware pattern data to be transmitted to the anti-malware device 200.

The hash value generator 220 may generate a hash value for the first malware pattern data by using a first hash function having a first hash coefficient.

First, a process in which the anti-malware device 200 generates a hash value for virus pattern data using virus pattern data and a virus hash coefficient and performs virus scanning will be described with reference to FIGS. 3 to 5. do.

FIG. 3 is a schematic diagram illustrating a process of generating a hash value for virus pattern data among the first malware pattern data by the hash value generator.

Referring to FIG. 3, when the hash function format is f (H) = ax + by + cz, (a, b, c) is a hash coefficient and (x, y, z) is a variable. Therefore, when the first hash coefficient received from the server 100, that is, the virus hash coefficient is (a1, b1, c1), the hash value generating unit 220 selects (a1, b1, c1) from (a, By substituting b, c) we can create a first hash function of f (H) = a1x + b1y + c1z. The hash value generator 220 may generate hash values HV for each of the virus pattern data by inputting the values of the virus pattern data stored in the pattern DB 210 to (x, y, z). . The value entered as a variable can have any number of cases that can be entered from virus pattern data. That is, if the number of cases that can be input is 100, a maximum of 100 hash values for one virus pattern data may be generated.

When the hash values HV for all the virus pattern data are generated, the hash value generator 220 may generate the pattern hash value table 230.

The pattern hash value table 230 may be loaded into a memory (not shown) as a table in which patterns of the virus pattern data corresponding to the hash value HV and the hash value HV generated by the hash value generator 220 are mapped. Can be. In FIG. 3, when the hash value of any one of the virus pattern data is 'X', the pattern of the virus pattern data corresponding to the one has 'abcdefg'.

The table generator 240 may generate the first hash matcher table 250 and the first sub matcher table 255 with reference to the pattern hash value table 230.

4 is a diagram illustrating an example of a first hash matcher table and a first sub matcher table.

Referring to the table illustrated on the right side of FIG. 4, the table generator 240 may determine all hash values HVs generated from the first hash function as the index INDEX. can do. That is, when the table generator 240 inputs all the virus pattern data that can be input as the first hash function, the table generator 240 uses all generated hash values as indexes. Therefore, the index item of FIG. 4 includes hash values X and Y of the virus pattern data generated in FIG. 3.

The table generator 240 compares the hash values HV of the pattern hash value table 230 with all indices, and sets the same index to “1” if there is an index equal to the hash value HV. Value '0' is used when there is no index equal to hash value HV, and '1' is used when there is an index equal to hash value HV. Since the pattern hash value table 230 of FIG. 3 includes X and Y as hash values HV, the first hash matcher table 250 of FIG. 4 has '1' in the indexes 'X' and 'Y'. It is checked.

In addition, the table generator 240 may generate the first sub matcher table 255 using the pattern hash value table 230 and the first hash matcher table 250. The first sub matcher table 255 may be used by the matching unit 280 to perform at least one of LPM (Light Pattern Matching) and EPM (Exact Pattern Matching) for virus scanning. The LPM and the EPM will be described later.

Referring to FIG. 5, the table generator 240 may include a first sub matcher based on indexes (including X and Y) that match the hash value HV among all the indexes of the first hash matcher table 250. Table 255 may be created. Hereinafter, 'indexes that match the hash value (HV) of all indexes' will be referred to as 'matching indexes'.

The table generator 240 generates the first sub matcher table 255 using the middle and tail values of the virus pattern data corresponding to the matching indexes and the address where the virus pattern data are stored. Can be generated. The median and end values of the virus pattern data corresponding to the matching indices may refer to the pattern hash value table 230. For example, when the matching index is 'X', the pattern of 'X' is 'abcdefg'. The table generator 240 may check the intermediate value 'd' and the end value 'g' among the 'abcdefg' in the pattern hash value table 230.

 'Virus Pattern Data Address' of FIG. 4 means an address where virus pattern data are stored. 'offset1' is the offset between the beginning and the middle of the pattern, and 'offset2' is the offset between the beginning and the end of the pattern.

If two or more hash values HV equal to the index are found in the first hash matcher table 250, a hash collision is considered to have occurred. 'Offset of the collision pattern' refers to a matching index assigned to one of two hash values HV when two hash values HV identical to the index are found in the first hash matcher table 250, for example. it means. Since the virus pattern data corresponding to the two hash values (HP) are different from each other, the median and end values for both hash values (HV) may also be different. Accordingly, the table generator 240 generates the first sub matcher table 255 by assigning a different matching index to one of the two hash values HV. In the case of FIG. 5, the collision pattern offset of the matching index 'X' is 'Z'. This means that the same hash value HV is mapped to the matching index 'Z'.

Referring back to FIG. 1, the hash value generator 220 may further receive a target data that is a virus scanning target and generate a hash value for the target data. The target data may be composed of sub data S1, S2, S3,... Which are divided into a predefined size. In this case, the hash value generator 220 may sequentially receive the sub data and generate hash values HS for each sub data. The hash value generator 220 may provide a hash value HS for the generated sub data to the matching unit 280. Hereinafter, the first sub data S1 and the hash value HS1 of the first sub data will be described as an example.

The hash matcher 270 may receive a hash value HS1 for the first sub data from the hash value generator 220. The hash matcher 270 may match the hash value HS1 of the first sub data to matching indexes (eg, X and Y) in which '1' is checked in the first hash matcher table 250. have. Matching indices of which '1' is checked are some of hash values (HVs) of virus pattern data.

The success of the matching may be determined by hardware (not shown) that cooperates with the hash matcher 270. If the matching indexes (eg, X and Y) of the first hash matcher table 250 are checked, for example, X and Y, the matching index matches the hash value HS1 of the first sub data. It can be judged that it was successful. For example, when the hash value HS1 of the first sub data is 'X', when the matching indexes include 'X', the hardware determines that the matching is successful.

If the matching by the hash matcher 270 is successful, the matching unit 280 may match the pattern of the first sub data with at least one of the virus pattern data. In detail, the matching unit 280 may perform an operation of matching the pattern of the virus pattern data corresponding to the matching index (eg, X) and the first sub data corresponding to the hash value HS1. This is because the 'matching index matching the hash value HS1 of the first sub data' is a hash value generated by substituting the virus pattern data into the first hash function. The result of matching the pattern of the virus pattern data and the first sub data affects whether the malware is infected.

To this end, the matching unit 280 may use an LPM method and an EPM method.

The LPM method is a method of matching a pattern using an intermediate value and an end value of the virus pattern data and the first sub data. In detail, the matching unit 280 checks the intermediate value and the end value of the matching index (eg, X) that matches the hash value HS1 of the first sub data in the first sub matcher table 255. In addition, the matching unit 280 checks the intermediate value and the end value of the input first sub data. The matching unit 280 matches the median value of the identified matching index with the median value of the first sub data, and matches the end value of the matching index with the end value of the first sub data.

As a result of using the LPM method, if the intermediate values do not coincide with each other or the end values do not coincide with each other, it means that there is no pattern of virus pattern data in the first sub data. Therefore, the first sub data can be determined as normal data not infected by the malware.

On the other hand, as a result of using the LPM method, if the intermediate values match each other and the end values match each other, the matching unit 280 may apply the EPM method to perform a pattern matching operation. In detail, the matching unit 280 may match the pattern by using the values of all positions of the virus pattern data and the first sub data when the intermediate values and the end values of the LPM method match.

To this end, the matching unit 280 checks the address of the virus pattern data mapped to the matching index X by referring to the first sub matcher table 255. The matching unit 280 reads a pattern of virus pattern data stored at the identified address from a memory (not shown). The pattern DB 210 or the pattern hash value table 230 may be loaded in the memory. 5 is a diagram illustrating an example of the pattern DB 210. The matching unit 280 matches the entire pattern 'abcdefg' of the virus pattern data stored at the corresponding address with the entire pattern of the first sub data.

Hereinafter, a process in which the anti-malware device 200 generates a hash value for the rule pattern data using the rule pattern data and the rule hash coefficient and performs filtering will be described with reference to FIG. 6.

6 is a diagram illustrating an example of a second hash matcher table and a second sub matcher table.

First, the hash value generator 220 may generate a first hash function by applying a rule hash coefficient received from the server 100 to a previous hash function. The hash value generator 220 may generate hash values HR for each rule pattern data by inputting at least some values of the rule pattern data stored in the pattern DB 210 to the first hash function. . This is similar to the hash value HR generation described with reference to FIG. 3.

When hash values HR for all rule pattern data are generated, the hash value generator 220 may generate a rule pattern hash value table (not shown). The rule pattern hash value table (not shown) is a table that maps patterns of the hash value HR generated by the hash value generator 220 and the rule pattern data corresponding to the hash value HR to a memory (not shown). Can be loaded.

When the hash values HR for all the rule pattern data are generated, the table generator 240 refers to the rule pattern hash value table (not shown) and the second hash matcher table 260 and the second sub matcher table (not shown). 265).

Referring to FIG. 6, the second hash matcher table 260 includes an index (key value) and an item indicating presence or absence. The table generator 240 may set all hash values HR that can be generated from the first hash function as indexes. The table generator 240 may generate the second hash matcher table 260 by comparing the hash values HR generated from the rule pattern data with all indexes. In FIG. 6, the presence or absence of an item has a hash value HR equal to the index and '0' means that there is no hash value HR equal to the index. This is similar to the generation of the first hash matcher table 250 described with reference to FIG. 4.

Since the index 'X' is checked for '1' in the second hash matcher table 260 of FIG. 6, it can be seen that 'X' exists in the hash values HR of all generated rule pattern data. have.

In addition, the table generator 240 may generate the second sub matcher table 265 using the rule pattern hash value table (not shown) and the second hash matcher table 260.

The table generator 240 generates the second sub matcher table 265 based on the indexes (including X and A) that match the hash value HR among all the indexes of the second hash matcher table 260. can do. Hereinafter, 'indexes that match the hash value HR among all the indexes' will be referred to as 'matching indexes'.

The second sub matcher table 265 has Sub only for IP and port, and each sub is composed of different values.

IP subs are indexes, mids, tails, the presence of rule patterns that apply to all protocols (ispro), the presence of rule patterns that apply to all ports (isport), the actual pattern memory address, and the following: It consists of a value such as an address next.

The port sub consists of values such as index, IP hash value, protocol hash value, actual pattern memory address, next address (next), and the like.

The middle value of the IP sub has the third byte value of the IP address, and the end value has the last byte value of the IP address. In the case of IPv4 based on such byte location selection, the hash matcher 270 may perform verification on the IP address with the first two bytes, the median value, and the end value of the IP. The intermediate value and the end value of the rule pattern data corresponding to the matching index may be identified from the header of the packet which is the rule pattern data.

The ispro value indicates the existence or absence of a rule pattern applied to all protocols. If one protocol is ALL among the actual rule patterns of the index value, it is 1, or 0.

If you have an element called ispro, you can reconfigure the range of flags (IP, Protocol, Port) according to the rules of the IP. For example, when there are two rule patterns such as [in, 202.131.29.71, TCP, 80, Allow], [in, 202.131.29.70, ALL, 80, Allow], the flag (IP, Protocol, Port) is Not all, ALL, Not all. At this time, since there is no rule pattern of ALL for 202.131.29.71, ispro becomes 0 and later, the protocol flag is changed to Not all.

The isport value means isport existence of a rule pattern applied to all ports. If one port is ALL among the actual rule patterns of the corresponding index value, it is 1, or 0 otherwise. This is similar to the role of ispro.

The actual pattern memory address has a memory address where the rule pattern data is actually stored, and the next address (next) may have several rule patterns gathered in one hash value which is an index of the second sub matcher table 265. When you go to the next pattern sub. The next address next is similar to the 'offset of the collision pattern' of the first sub matcher table 255.

In the present invention, the IP hash value and the protocol hash value of the port sub are used to give an association between the port, IP, and protocol of the corresponding rule. If there is no element having an association here, the rule pattern must be searched around the port.

Referring back to FIG. 1, the hash value generator 220 may receive target data, which is a filtering target, and further generate a hash value HF for the target data and provide the hash value HF to the matching unit 280. The hash value generator 220 may generate a hash value HF for each of various pieces of information such as an IP address, a port, and a protocol of the packet of the target data.

When the second hash matcher table 260 and the second sub matcher table 265 are generated, the hash matcher 270 may receive the hash values HF for the target sub data from the hash value generator 220. have. The hash matcher 270 may match the hash values HF of the target data to matching indexes (eg, X and A) in which the '1' is checked in the second hash matcher table 260.

If the matching by the hash matcher 270 succeeds, the matching unit 280 matches the pattern of the rule pattern data corresponding to the matching index (for example, X) and the target data with the hash value HF. Filtering can be performed. For pattern matching, the matching unit 280 may use the LPM method and the EPM method with reference to the second sub matcher table 265. Since this is the same as the method described in the pattern matching of virus pattern data, a detailed description thereof will be omitted. The hash matcher 270 and the matcher 280 may be implemented in hardware logic. If the pattern of the rule pattern data and the target data is matched by the pattern matching, the target data may be blocked. Meanwhile, referring again to FIG. 1, when the first malware pattern data is updated, that is, when there is update malware pattern data, a first hash coefficient and a first hash function are also based on characteristics of the update malware pattern data. can be changed. This is because the server 100 regenerates a hash coefficient based on a minimum hash collision result through a hash function for updating malware pattern data. The hash coefficient to be regenerated or the modified first hash function is the second hash coefficient described above. Therefore, the second hash coefficient provided from the server 100 is included in the update malware pattern data.

When the hash value generator 220 receives the update malware pattern data from the server 100, the hash value generator 220 may regenerate the hash value by using the second hash coefficient transmitted together with the update malware pattern data. That is, the hash value generator 220 may regenerate the hash value by using a second hash function having a second hash coefficient received from the server 100 together with the update malware pattern data. Accordingly, the update malware pattern DB including update malware pattern data may include a header item 310 in which header information is described and a hash item 320 in which a second hash coefficient is described. In addition, the update malware pattern data may be added to the pattern DB (210). Subsequently, operations of the hash value generator 220, the table generator 240, the hash matcher 270, and the matching unit 280 are similar to those in which the first malware pattern data are input, and thus detailed description thereof will be omitted. .

According to an embodiment of the present invention described above, the server 100 may transmit malware pattern data including hash coefficients to the anti-malware device 200. The anti-malware device 200 may determine a hash function using the hash coefficient received from the server 100 and perform pattern matching.

7 is a diagram illustrating an anti-malware system according to another embodiment of the present invention.

Referring to FIG. 7, an anti-malware system includes a server 600 and an anti-malware device 700. In the anti-malware system, the server 600 and the anti-malware device 700 may be connected to communicate with each other via the network 20. Since the server 600 and the anti-malware device 700 illustrated in FIG. 7 are similar to the server 100 and the anti-malware device 200 described with reference to FIGS. 1 to 6, detailed descriptions thereof will be omitted.

However, the server 100 of FIG. 1 selects a hash coefficient and transmits the hash coefficient to the antimalware device 700. In contrast, the server 600 illustrated in FIG. 7 may select a hash function to which the hash coefficient is applied and transmit the hash function to the antimalware device 700. The anti-malware device 700 may generate a hash value of the first malware pattern data and a hash value of the target data using the received hash function.

To this end, the server 600 according to another embodiment of the present invention includes a hash function selecting unit 610 and the update unit 620.

The hash function selecting unit 610 selects a function that can quickly search while detecting all the pattern data in the anti-malware engine based on the first malware pattern data, and converts an optimal coefficient value for the selected function into a hash coefficient. The first hash function to be transmitted to the anti-malware device 700 may be determined.

For example, the hash function selecting unit 610 selects a function for optimal pattern detection and quick search among a plurality of hash functions for the given first malware pattern data. The hash function selecting unit 610 selects the first hash coefficient by using the algorithm used by the hash coefficient selecting unit 110 of FIG. 1, updates the first hash coefficient to an existing hash function, and then applies the first hash function. And the first hash coefficient can be selected.

Alternatively, the hash function selecting unit 610 selects the first hash coefficient by using the variance calculated by the hash coefficient selecting unit 110 of FIG. 1, updates the first hash coefficient to the existing hash function, and then selects the first hash coefficient. You can select a hash function.

Even when there is data to update the first malware pattern data, the hash function selecting unit 610 may perform a second hash by using the new malware pattern data for updating and the first malware pattern data transmitted to the anti-malware device 700. You can reselect the function.

When the updater 620 transmits the first malware pattern data to the anti-malware device 700, the updater 620 may transmit the selected first hash function together with the malware pattern data. The transmitted first hash function may be used to generate hash values of the first malware pattern data transmitted to the anti-malware device 700.

In addition, upon request from the anti-malware device 700, the server 600 transmits an update hash function to the anti-malware device 700 together with necessary update malware pattern data.

In an embodiment of the present invention, if the first malware pattern data transmitted from the server 600 to the anti-malware device 700 is virus pattern data, the first hash function transmitted together with the virus pattern data may be a virus hash function. . In addition, if the first malware pattern data transmitted from the server 600 to the anti-malware device 700 is rule pattern data, the first hash function transmitted together with the rule pattern data may be a rule hash function. In addition, when the first malware pattern data transmitted from the server 600 to the anti-malware device 700 includes both virus pattern data and rule pattern data, the first hash function transmitted together is a virus hash function and a rule hash. It can contain a function.

Meanwhile, the anti-malware device 700 according to another embodiment of the present invention includes a pattern DB 710, a hash value generator 720, a pattern hash value table 730, a table generator 740, and a first hash matcher. Table 750, first sub-matcher table 755, second sub-matcher table 760, second sub-matcher table 765, hash matcher 770, matcher 780, and update requester 790 ) May be included.

The pattern DB 710 of FIG. 7, the pattern hash value table 730, the table generator 740, the first hash matcher table 750, the first sub matcher table 755, and the second hash matcher table 760. The second sub matcher table 765, the hash matcher 770, and the matcher 780 include the pattern DB 210, the pattern hash value table 230, the table generator 240, and the first hash of FIG. 1. It is the same as the matcher table 250, the first sub-matcher table 255, the second hash matcher table 260, the second sub-matcher table 265, the hash matcher 270, and the matching unit 280.

However, the hash value generator 720 generates a hash value of the first malware pattern data and a hash value of the sub data using the first hash function received from the server 600. For example, if the first malware pattern data is virus pattern data, the hash value generator 720 generates a hash value for the virus pattern data using a virus hash function.

The update request unit 790 updates the first hash coefficient or the first hash function when the number of times that hash values of the first malware pattern data generated by the hash value generator 720 collide with each other exceeds a reference value. May be requested to the server 600. In addition, the update request unit 790 may request the server 600 to update not only the first hash coefficient but also the first malware pattern data. The update request unit 790 may optionally be provided.

The update request unit 790 may monitor the first sub matcher table 755 to count the number of hash collisions. For example, the update requester 790 may use the number of matching indices described in the 'collision pattern offset' item of the first sub matcher table 755 as the number of hash collisions. Alternatively, the hash collision count may be counted by a counter (not shown).

According to another embodiment of the present invention described above, the server 600 may transmit malware pattern data including a hash function to the anti-malware device 700. The anti-malware device 700 may generate a hash value using the hash function received from the server 600 and perform pattern matching.

8 is a flowchart illustrating an operation of a server in a malware pattern matching method according to an embodiment of the present invention.

The operation of FIG. 8 may be performed by any one of the servers 100 and 600 described with reference to FIG. 1 or 7.

In operation S810, the server may select a plurality of candidate hash groups GN, N = 1, 2,... For example, the first candidate hash group G1 may include {a1, b1, c1} as candidate hash coefficients, and the second candidate hash group may include {a2, b2, c2} as candidate hash coefficients.

In operation S820, the server may calculate hash values for each of the candidate hash groups. That is, the server may calculate hash values for each candidate hash group by applying candidate hash coefficients of the candidate hash groups G1, G2,... To the hash function. At this time, the server may calculate the hash values by substituting the malware pattern data used in the anti-malware device into the hash function.

In operation S830, the server may compare hash values calculated for each candidate hash group and check the number of hash collisions that have occurred for each candidate hash group.

In operation S840, the server may identify the candidate hash group having the least hash collision, and select the candidate hash coefficient of the identified candidate hash group as the hash coefficient to be transmitted to the antimalware device.

In operation S850, the server may transmit the malware coefficient data selected in operation S840 and the malware pattern data referenced in calculating the hash value in operation S820 to the anti-malware device.

On the other hand, when the server selects the hash coefficient using the variance value, the server may perform steps S860 and S870 instead of steps S830 and S840.

In operation S860, the server may calculate the variance value of the hash values calculated in operation S820 for each candidate hash group.

In operation S870, the server may identify the candidate hash group that has calculated the minimum variance value among the variances calculated for each candidate hash group, and select the hash coefficient of the identified candidate hash group as a hash coefficient to be transmitted to the antimalware device. have.

As a result, the server may select a hash coefficient that minimizes the probability that the hash values derived when the malware pattern data is applied to the hash function are mutually collided. In addition, when the malware pattern data is virus pattern data, the server may select a virus hash coefficient in consideration of the virus pattern data, and when the malware pattern data is rule pattern data, the server may select a rule hash coefficient in consideration of the rule pattern data. have.

9 is a flowchart illustrating a malware pattern matching method of an anti-malware device according to an embodiment of the present invention.

The operation of FIG. 9 may be performed by any one of the anti-malware devices 200 and 700 described with reference to FIG. 1 or 7.

In operation S905, the anti-malware device may receive a malware pattern DB from the server. The malware pattern DB includes malware pattern data and hash coefficients used for pattern matching to determine whether the target data is infected with malware. If the malware pattern data received in step S905 are virus pattern data for virus scanning, the hash coefficient is a virus hash coefficient selected in consideration of the virus pattern data. In addition, when the received malware pattern data is rule pattern data, the hash coefficient may be a rule hash coefficient selected in consideration of the rule pattern data. In addition, when the received malware pattern data includes both virus pattern data and rule pattern data, the hash coefficient transmitted together may include a virus hash coefficient and a rule hash coefficient.

In operation S910, the anti-malware device stores or updates the received malware pattern data in the pattern DB.

In operation S915, the anti-malware device may change the hash coefficient of the hash function to the received hash coefficient.

In step S920, the anti-malware device generates hash values for each of the malware pattern data by inserting malware pattern data into a hash function to which the received hash coefficient is applied, and updates the pattern hash value table using the generated hash values. Can be. If there is no pattern hash value table previously, a new pattern hash value table may be newly created using the generated hash values.

In operation S925, the anti-malware device may update the hash matcher table and the sub-matcher table with reference to the pattern hash value table. If there is no existing hash matcher table and sub-matcher table, the anti-malware device may create a new hash matcher table and sub-matcher table. This is described in detail with reference to FIGS. 4 and 5.

In operation S930, the anti-malware device may receive target data in sub data units and generate a hash value for the sub data. The anti-malware device may generate a hash value by assigning sub data to the updated hash function in operation S915.

In step S935, the anti-malware device performs a matching operation of the hash values. That is, the anti-malware device may match the hash value of the generated subdata to matching indexes (ie, an index of which '1' is checked in the hash matcher table) of the hash matcher table.

In operation S940, the anti-malware device may determine whether one of the matching indices matches the hash value of the sub data.

As a result of determination, if the hash value of the sub data matches one of the matching indexes (S940-Y), in operation S945, the anti-malware device may perform an LPM operation. The LPM method is a method of matching patterns by using an intermediate value and an end value of malware pattern data and sub data.

In operation S950, the anti-malware device may determine whether the middle values of the malware pattern data and the sub data match and the end values of the malware pattern data and the sub data match.

As a result of the determination, when both the intermediate values and the end values match (S950-Y), in operation S955, the anti-malware device may perform an EPM operation. The EPM method is a method of matching a pattern by using values of all positions of malware pattern data and sub data.

In operation S960, the anti-malware device may determine whether the malware pattern data and the entire sub data match.

As a result of the determination, if the whole matches (S960-Y), in step S965, the anti-malware device may determine that the sub data corresponds to the malware pattern.

On the other hand, if any value of the whole does not match (S960-N), in step S975, the anti-malware device may determine that the sub data corresponds to the normal pattern.

On the other hand, if the results in steps S940 and S950 do not match, in step S975, the anti-malware device determines whether the currently processed sub data is the last sub data of the target data.

If it is not the last sub data, the anti-malware device enters step S935 to perform pattern matching on the next sub data.

10 is a flowchart illustrating an update method of a malware pattern matching method of an anti-malware system according to an embodiment of the present invention.

The operation of FIG. 10 may be performed by any one of the servers 100 and 600 described with reference to FIG. 1 or 7 and by any one of the anti-malware devices 200 and 700.

In operation S1010, when a hash collision occurs, the anti-malware device may count or check the number of hash collisions in operation S1020. The anti-malware device may count the number of times that hash values of the malware pattern data generated in operation S920 collide with each other. The anti-malware device may know the hash collision count from the number of collision pattern offsets of the sub matcher table generated in operation S925.

In operation S1030, the anti-malware device may compare the hash collision count and the reference value identified in operation S1020.

As a result of the comparison, if the number of hash collisions identified in step S1020 exceeds the reference value (S1030-Y), in step S1040, the anti-malware device may request the server to update the malware pattern data and the hash coefficient.

In operation S1050, the server may reselect a hash coefficient or a hash function to minimize a probability of occurrence of a hash collision at the request of the anti-malware device. The server may reselect a hash coefficient or a hash function by referring to the previously referenced malware pattern data and the update malware pattern data. This may be similar to the process of FIG. 8.

In operation S1060, the server may transmit the updated malware pattern data and the reselected hash coefficient or hash function to the anti-malware device in operation S1050.

11 is a diagram illustrating an anti-malware system according to another embodiment of the present invention.

Referring to FIG. 11, an anti-malware system includes a server 1100 and a client 1200.

The server 1100 updates the malware pattern DB, calculates a hash coefficient that can prevent a hash collision, and prevents a hash collision in the process of detecting malware in the client 1200, and calculates the calculated hash coefficient. To the client 1200. The server 1100 may be one of or similar to the servers 100 and 600 described with reference to FIGS. 1 and 7. In addition, the malware pattern DB may be the malware pattern DB described with reference to FIGS. 1 and 7.

The client 1200 may download the malware pattern DB from the server 1100 and detect whether the malware is infected. The client 1200 may be one or similar to one of the antimalware devices 200, 700 described with reference to FIGS. 1 and 7. However, the client 1200 may be implemented in a system-on-chip (SOC) form.

In an embodiment of the present invention, if there is an update request from the client 1200, the server 1100 may transmit a hash coefficient to the client 1200 along with necessary update information. The update information may include a hash coefficient or a hash function and malware pattern data selected by the server 1100.

The server 1100 includes an update unit 1110 for updating the malware pattern DB, and a collision avoidance unit 1120 for calculating a hash coefficient.

The updater 1110 may further provide a function performed by at least one of the updaters 120 and 620 of FIGS. 1 and 7. The updater 1110 includes a malware pattern input processor 1111, a block generation processor 1112, and an update information constructer 1114.

The malware pattern input processor 1111 processes an input of malware pattern data to be transmitted to the client 1200.

The block generation processing unit 1112 generates a block, and the update information configuration unit 1114 configures update information. For example, the update information configuring unit 1114 may describe one of the hash coefficients selected by the hash coefficient selecting unit 1122 and the hash function selected by the hash function selecting unit 1123 in the hash item 320, and may include a malware pattern. The data may be described in the data item 330 to configure update information, that is, a malware pattern DB.

The collision avoidance unit 1120 includes a cumulative block DB 1121, a hash coefficient selecting unit 1122, and a hash function selecting unit 1123. The accumulated block DB 1121 stores the accumulated block information. The hash coefficient selecting unit 1122 selects a hash coefficient, and the hash function selecting unit 1123 selects a hash function.

The hash coefficient selector 1122 may perform the function of the hash coefficient selector 110 of FIG. 1. That is, the hash coefficient selecting unit 1122 may select a hash coefficient to be transmitted to the client 1200 based on a minimum hash collision result through a hash function for malware pattern data. For example, the hash coefficient selecting unit 1122 may select the hash coefficient by using an algorithm that minimizes the probability that the hash values derived when the malware pattern data is applied to the hash function are minimized. Alternatively, the hash coefficient selecting unit 1122 may select the hash coefficient by using variance values of hash values derived when the malware pattern data is applied to the hash function.

The hash function selector 1123 may perform a function of the hash function selector 610 of FIG. 7. That is, the hash function selecting unit 1123 selects a hash coefficient in a manner used by the hash coefficient selecting unit 1122, and selects a hash function to which the selected hash coefficient is applied.

The client 1200 may include an anti-malware application unit 1210 and an anti-malware system-on-chip unit 1220.

The anti-malware application unit 1210 may provide environment settings and drivers required for anti-malware. To this end, the anti-malware application unit 1210 includes an environment setting and DB update request unit 1211, a DB processing module 1212, an SOC call unit 1213, and a scan queue and driver module 1214.

The environment setting and DB update request unit 1211 may set an environment for anti-malware operation, and request the server 1100 to update the malware pattern DB. The environment setting and DB update request unit 1211 may further provide a function of the update request unit 790 of FIG. 7.

The DB processing module 1212 may manage a malware pattern DB, that is, malware pattern data and a hash function or hash coefficient. The SOC caller 1213 calls the SOC.

The scan queue and driver module 1214 may provide and / or drive various drivers required to perform pattern matching in the client 1200.

The anti-malware system on chip unit 1220 detects data infected with malware using a malware pattern DB. To this end, the anti-malware system on chip unit 1220 may include a search engine 1211, a pattern matching module 1222, a DB manager module 1223, a file data processing module 1224, a packet data processing module 1225, and a firewall rule. Manager module 1226 is included.

The search engine 1211 is responsible for searching for malware patterns. The search engine 1211 may be hardware that performs the functions of the hash value generators 220 and 720, the table generators 240 and 740, and the hash matchers 270 and 770 of FIGS. 1 and 7. Accordingly, the search engine 1211 may generate hash values of the malware pattern data and hash values of the sub data, generate a pattern hash value table, and perform hash value matching.

The pattern matching module 1222 performs pattern matching of malware pattern data and sub data. The pattern matching module 1222 may correspond to the matching units 280 and 780 of FIGS. 1 and 7.

The DB manager module 1223 manages a malware pattern DB. For example, the DB manager module 1223 may load malware pattern data into a memory (not shown) to generate a hash value in the search engine 1211.

The file data processing module 1224 processes file data, and the packet data processing module 1225 processes packet data. For example, the packet data processing module 1224 may divide target data into subdata having a predetermined unit. Each subdata is provided to search engine 1211 and used when generating a hash value for the subdata.

The firewall rule manager module 1226 manages firewall rules.

Hereinafter, a method for preventing a hash collision in an anti-malware system having a structure as illustrated in FIG. 11 will be described with reference to FIGS. 12 to 16. 12 to 16 are flowcharts illustrating a hash collision prevention method in an anti-malware system according to another embodiment of the present invention. The anti-malware system performing the hash collision prevention method of FIGS. 12 to 16 may be a system including the server 1100 and the client 1200 illustrated in FIG. 11.

12 is a flowchart illustrating a basic process of performing a hash collision prevention method in an anti-malware system according to another embodiment of the present invention.

Referring to FIG. 12, the server initializes by setting a base value for blocking the malware pattern DB (S1201).

When new malware pattern data, that is, update malware pattern data, is input, the server checks whether a new block operation is required (S1203 and S1205).

If a new block operation is required, the server converts the malware pattern data into a DB in a predetermined format and stores the malware pattern data in the malware pattern DB (S1207).

In operation S1209, the server generates a block by performing a new block generation process on the malware pattern data.

The server performs a collision avoidance process for avoiding hash collision for the block generated in step S1209 (S1211). Implementation of the collision avoidance process allows the server to select a hash coefficient. In addition, although not shown in step S1211, the server may select a hash function by the implementation of the collision reporting process.

Next, the server stores the hash coefficient or the hash function selected through the collision avoidance process (S1213).

13 is a flowchart for explaining a block generation process of operation S1209 according to another embodiment of the present invention.

Referring to FIG. 13, the server reads malware pattern data stored in a database in step S1207 (S1301).

In operation S1303, the server extracts data to be blocked from the malware pattern data. For example, the server may extract a block ID (BlockID) in the form of locationID_OSID_YYYYMMDD according to the location, OS information, and input time in the malware pattern data as the data to be blocked. If the same block ID as the extracted block ID already exists, the server may upgrade the version of the extracted block. After that, the server inputs the size and data for the block, the md5 value, the presence or absence, the inputter, and the input time.

Next, the server generates a block using the data extracted in step S1303 (S1305).

In operation S1307, the server stores the generated block data in the malware pattern DB.

14 is a flowchart illustrating a collision avoidance process of step S1211 according to another embodiment of the present invention.

Referring to FIG. 14, the server checks block data in the malware pattern DB (S1401).

The server checks whether there is a newly added block through the block data (S1403).

If there is a newly added block, the server adds block data of the added block to the entire malware pattern DB (S1405).

The server initializes to calculate a hash coefficient for the malware pattern data in the malware pattern DB (S1407).

In operation S1409, the server selects a plurality of candidate coefficient values. The plurality of candidate coefficient values may have a form such as a plurality of candidate hash groups GN, N = 1, 2, ..., each having one or more candidate hash coefficients, described with reference to FIG. 1.

The server performs a hash function on the malware pattern data using the candidate coefficient values selected in step S1409 (S1411).

The server compares the result of the hash function processing in step S1411 to select a hash coefficient to minimize the hash collision (S1413).

15 is a flowchart illustrating a hash function processing process of step S1411 according to another embodiment of the present invention.

Referring to FIG. 15, the server initializes information including a size of a memory storage location and a range of count values (S1501).

The server constructs a coefficient matrix and a hash function table (S1503 and S1505). The coefficient matrix may be candidate hash groups having a plurality of candidate coefficient values selected in operation S1409. For example, the coefficient matrix is G1 = {a1, b1, c1}, G2 = {a2, b2, c2}, G3 = {a3, b3, c3},... It may be composed of a plurality.

The server reads the malware pattern data from the malware pattern DB (S1507).

The server converts the read malware pattern data into a form that can be applied to a hash function (S1509).

The server obtains hash values by applying candidate coefficient values of coefficient matrices and transformed malware pattern data to a hash function, and applies the obtained hash values to a hash function table (S1511). In step S1511, the server obtains hash values for each candidate hash group and applies the hash values to the hash function table.

The server calculates distribution values for the values of the hash function table (S1513). That is, when hash values for each of the candidate hash groups are calculated, the server calculates a variance value of the hash values for each candidate hash group.

Next, the server selects a coefficient matrix representing the minimum variance value among the variance values calculated for each candidate hash group (S1515). Candidate coefficients constituting the selected coefficient matrix are hash coefficients to be transmitted to the client.

Meanwhile, in the present invention, the client 1200 makes an update request to the server 1100 at the time of receiving the update. In this case, the server 1200 may transmit a checksum, a device execution environment, location information, and a version ID of the client 1200 to the server 1100. Based on the received information, the updater 1110 determines whether the client 1200 is changed, and when there is a change, the updater 1110 executes a locationdecider to set the correct location.

Subsequently, the server 1100 executes the update information configuration unit 1114 to block information required by the client 1200, a task type thereof (append / download / add / delete / replace), malware pattern data for update, and the like. Accordingly, the hash coefficient reselected is also transmitted to the client 1200.

After receiving the corresponding information, the client 1200 updates its block with the block and the work information, and then transmits the result to the server 1100, and the server 1100 stores the work and finishes the work.

16 is a flowchart illustrating an update process performed by a server according to another embodiment of the present invention.

Referring to FIG. 16, the server checks whether there is a change in the last update information from the client (S1601).

If there is a change, the server updates the client's update information (S1619).

If there is no change in the update information, the server checks whether a block exists in the client (S1603).

If a block exists in the client, the server checks whether the version ID is different or the number of blocks is different based on the block information (S1605).

If the version IDs are different, the server requests the client for information about the client blocks (S1613).

The server receives the block information from the client (S1615).

The server determines a task type (Add / remove / replace / update) for each block and configures information necessary for the task (S1617).

If the number of blocks is different in step S1605, the server configures block append information (S1607).

Then, the server reads the hash coefficient for the block to be transmitted to the client (S1609).

The server constructs final information to be updated for each block by using the read hash coefficient and transmits the final information to the client (S1611).

The server then returns to step S1601 to repeat the process.

If no block exists in the client 1200 in step S1603, the server proceeds directly to step S1609.

17 to 22 are views for explaining the effect of the SOC according to the embodiments of the present invention.

Referring to FIG. 17, when an anti-virus scanning engine using the same algorithm is subjected to a malware scanning test (hereinafter, referred to as 'TEST 1') at an application layer and a SoC-based anti-virus scanning engine is a malware scanning test. This shows the scanning speed of.

A bar in FIG. 17 represents a scanning speed of TEST 1, and those represented by a broken line are those for testing an SoC-based anti-virus engine. Among the broken lines, the below broken line is a malware scanning using an anti-virus engine composed of software and hardware logic in the SoC (hereinafter referred to as 'TEST 2'), and the above broken line is in the SoC. It is a malware scanning using an anti-virus engine implemented only in SW (hereinafter referred to as 'TEST 3').

On the other hand, in the results of Figure 17, TEST 1 is a case of using a 800 Mhz CPU, TEST 2 and TEST 3 is a test on a SoC FPGA board using a 50Mhz CPU. Therefore, if you test them using CPUs with the same speed, the scanning speed in the SoC stage (ie TEST 2 and TEST 3) will be much faster than in the application layer (TEST 1). Is expected.

In FIG. 17, the scanning time of TEST 2 takes longer than the scanning time of TEST 1, but considering the difference in the speed of the CPU, the scanning when the anti-malware engine consisting of SW is operated in the SoC stage is actually performed. The time is expected to be less than the scanning time when the anti-malware engine is scanned at the application layer.

On the other hand, TEST 3, despite the difference in the speed of the CPU, it can be seen that the scanning speed is much faster than the case of TEST 1. That is, as the number of files to be scanned exceeds 2000, it can be seen that TEST 3 is 1.5 times faster than TEST 1.

Referring to FIG. 18, a memory usage and a scanning time when malware is scanned using a mobile anti-virus engine implemented by a non-SOC based application is shown.

In FIG. 18, a bar indicates memory usage used for malware scanning, and a broken line shows time used for malware scanning, which uses an 800 MHz CPU. As can be seen in FIG. 18, the anti-virus engine implemented as a non-SOC-based application uses a lot of memory even when the number of files to be scanned is small.

On the other hand, in Fig. 18, the number of files is larger than about 320, the size of the bar (Bar) is shown to be smaller, but this is due to the swapping operation of the memory. When the number of files to be scanned becomes too large for the memory, the operating system performs a swapping operation of the memory. As such, when a swapping operation occurs, scanning time may increase, resulting in high battery consumption.

19 shows the power consumption of the anti-virus engine, which is a test result using commercially available products and an anti-virus engine according to an embodiment of the present invention.

Referring to FIG. 19, both Comparative Product 1 and Comparative Product 2 are anti-virus engines implemented only by software, not SOC-based, and Comparative Product 1 consumes about 160 mA and Comparative Product 2 consumes 200 mA. Can be. In contrast, it can be seen that the SOC AC engine according to the embodiment of the present invention consumes about 126.6 mA as an engine composed of software and hardware logic.

20 is a test result of commercialized products used in existing mobile phones and an SoC-based anti-virus engine according to an embodiment of the present invention, and shows the time taken to scan malware and the CPU usage time. .,

Referring to FIG. 20, commercially available products (P1, P2, P3, P4, P5, P6, P7, P8, P9, P10, P11, P12) and SoC based anti-according to an embodiment of the present invention The virus engine P13 has been tested twice with different numbers of files to be scanned.

Referring to FIG. 20, it can be seen that the CPU usage of the comparative products uses almost 100% and the CPU usage is much higher than that of the embodiment of the present invention (P13). Therefore, as the CPU usage and the scanning time increase, the battery consumption increases, so that the battery consumption can be reduced through the embodiment of the present invention.

  In addition, this embodiment (P13) was tested using an FPGA board with a 50Mhz CPU, and the above commercialized products used a CPU of several hundred Mhz to several Ghz, so if they were tested under the same conditions, It is expected that this embodiment P13 will be much superior in scanning time.

Figure 21 shows the operation by installing the actual commercial anti-virus software on the Android phone. There are three different AV softwares, which all show 100% CPU usage when scanning.

Referring to (a), (b), and (c) of Fig. 21, respectively, the CPU usage is shown by three graphs (①, ②, ③), which are in turn the total usage of the CPU (①), the user. CPU usage (②) used at the code level and CPU usage (③) used at the kernel code level are shown.

FIG. 22 illustrates the amount of CPU used when scanning for malware using an SoC-based anti-virus engine according to an embodiment of the present invention. Referring to Fig. 22, it can be seen that the CPU usage represents 3% to 30%. In this way, while using less CPU, if the processing is faster, the battery consumption is significantly reduced.

On the other hand, of the two signals in Fig. 22A, the linear signal represents the memory usage, and the remaining signals represent the CPU usage. In the case of FIG. 22B, the memory usage and the CPU usage are similarly shown.

On the other hand, since the embodiment of Figure 22 is a test using a 50Mhz CPU, if the same test using a CPU of several hundred Mhz ~ several Ghz like the conventional products, the effect of the present invention is much superior to the conventional products It is expected to do.

While the present invention has been described with reference to the particular embodiments and drawings, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. This is possible. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the equivalents of the claims, as well as the claims.

100, 600: server 200, 700: antimalware device
110: hash coefficient selection unit 120: update unit
210, 710: patterns DB 220, 720: hash value generation unit
230, 730: pattern hash value table 240, 740: table generation unit
250, 750: first hash matcher table 255, 755: first sub matcher table
260, 760: second hash matcher table 265, 765: second sub matcher table
270, 770: hash matcher 280, 780: matching part
790: update request unit 1100: server
1110: update unit 1120: collision avoidance skin
1210: Anti-malware application unit
1220: SOC section

Claims (28)

A hash value generator for generating hash values for malware patterns and hash values for target data using a hash function having at least one hash coefficient;
A hash matcher which matches a hash value of the target data with hash values of the malware patterns; And
And a matching unit matching the malware pattern with the target data when the matching by the hash matcher succeeds. The method of claim 1,
And the hash coefficient and / or hash function is determined based on a minimum hash collision result of each hash collision result generated from a plurality of hash functions applied to the malware patterns. The method of claim 1,
And said hash coefficient and / or hash function is received with said malware patterns from a server connected via a network. The method of claim 3,
The hash value generation unit,
And receiving the update malware patterns from the server, regenerating the hash value by using a hash coefficient transmitted together with the update malware patterns. The method of claim 1,
And when the malware patterns are updated, the hash coefficient and / or hash function is also changed based on a minimum hash collision result through the hash function for the update malware patterns. The method of claim 5,
The modified hash coefficient and / or hash function is included in the update malware patterns,
The hash value generator may generate a modified hash coefficient and / or a hash function included in the update malware patterns. And regenerating the hash value using the anti-malware device. The method of claim 5,
The update malware pattern DB comprising the update malware patterns includes a header item in which header information is described, and a hash item in which the changed hash coefficient and / or hash function are described. The method of claim 1,
The hash function is determined such that when the hash values for the malware patterns to be transmitted to the antimalware device are derived, the probability that the derived hash values collide with each other is minimized. The method of claim 1,
And an update request unit for requesting an update of the hash coefficient and / or a hash function when the number of hash values of the malware patterns generated by the hash value generator collide with each other exceeds a reference value. Anti-malware device, characterized in that. The method of claim 1,
The malware patterns include at least one of virus patterns for virus scanning and rule patterns for firewall filtering, wherein the hash coefficient is at least one of a virus hash coefficient for the virus scanning and a rule hash coefficient for the firewall filtering. Anti-malware device comprising a. The method of claim 1,
The anti-malware device,
An anti-malware device characterized by any one of a system on a chip, a notebook, a desktop computer, a smart phone, a smart card, and an asset chip (IP) for a semiconductor. A server for transmitting malware patterns to an anti-malware device that performs malware pattern matching using a hash function having a hash coefficient.
And an updater configured to transmit the hash coefficient together with the malware patterns when transmitting malware patterns to the anti-malware device. The method of claim 12,
The hash coefficient transmitted by the update unit is used to calculate hash values of malware patterns transmitted to the anti-malware device. The method of claim 12, wherein
A hash clock number selector configured to select the hash coefficient based on a minimum hash collision result through a hash function of malware patterns transmitted to the antimalware device; More,
The hash coefficient transmitted by the update unit is a server, characterized in that the hash coefficient selected by the hash coefficient selection unit. 15. The method of claim 14,
The sundial number selection unit,
When the malware patterns to be transmitted to the antimalware device are applied to the hash function, an algorithm is used to minimize the probability that the derived hash values collide with each other, or a hash coefficient is selected to minimize the variance of the derived hash values. Server characterized in that. 15. The method of claim 14,
The sundial number selection unit,
When there is data to update the malware patterns, when both the update malware patterns and the malware patterns previously stored by the anti-malware device are applied to a hash function, the probability that the derived hash value is mutually conflicted is minimized. And a hash coefficient for selecting a hash coefficient to minimize a variance of the derived hash value. The method of claim 12,
And a hash function selecting unit configured to select the hash function based on a result of the minimum hash collision through the hash function for the malware patterns transmitted to the antimalware device.
And the update unit transmits the hash function selected by the hash function selection unit to the antimalware device together with the malware patterns to transmit to the antimalware device. The method of claim 12,
The malware patterns include at least one of virus patterns for virus scanning and rule patterns for firewall filtering, wherein the hash coefficient is at least one of a virus hash coefficient for the virus scanning and a rule hash coefficient for the firewall filtering. Server comprising a. A method of performing a malware pattern matching operation using a hash coefficient,
Selecting the hash coefficient with reference to the malware patterns such that the probability of hash values of malware patterns colliding with each other is minimized;
Calculating hash values for the malware patterns using the predetermined hash coefficient; And
And matching the malware patterns with the target data when at least one of the hash values for the malware patterns and the hash value for the target data are matched. 20. The method of claim 19,
And reselecting a hash coefficient to minimize the probability that the hash values of the changed malware patterns collide with each other when the malware patterns are changed. 21. The method of claim 20,
Recalculating hash values for the modified malware patterns using the reselected hash coefficients;
And the reselected seawater coefficient is selected with reference to the changed malware patterns. The method of claim 19, wherein
The step of selecting the hash coefficient,
Obtaining hash values of the malware patterns using each of the prepared candidate hash coefficients; And
Selecting a candidate hash coefficient having the lowest variance of the hash values of the malware patterns obtained for each of the candidate hash coefficients as a hash coefficient for obtaining a hash value of the target data. Way. Calculating hash values of malware patterns using a hash function;
Calculating a hash value for target data using the hash function;
If the hash values for the malware patterns and the hash value for the target data match, matching the malware patterns with the target data; And
And determining whether or not the calculated hash values of the malware patterns are collided with each other. 24. The method of claim 23,
And reselecting the hash function or the hash coefficient constituting the hash function when the number of hash collisions of the malware patterns is greater than a preset reference number. 2. 25. The method of claim 24,
Reselecting the hash coefficient,
Selecting candidate hash coefficients;
Obtaining hash values for malware patterns to be used in the matching step using the candidate hash coefficients; And
Selecting a hash coefficient from the candidate hash coefficients to compare hash values obtained in the first step to minimize hash collisions. 25. The method of claim 24,
Reselecting the hash coefficient,
Selecting candidate hash coefficients;
A first step of obtaining hash values of malware patterns to be used in the matching step using the candidate hash coefficients; And
Obtaining a respective variance value of the hash values obtained in the first step, and selecting a hash coefficient having the smallest variance value among the candidate hash coefficients. A communication unit for receiving at least one hash coefficient and data from a server; A hash value generator configured to generate hash values for malware patterns and hash values for target data using a hash function having the at least one hash coefficient; And a processor comprising a hash matcher for matching the hash values of the target data and the hash values of the malware patterns, and a matching unit for matching the malware patterns with the target data when matching by the hash matcher is successful. Malware device. A server for transmitting malware pattern data to an anti-malware device that performs malware pattern matching using a hash function having a hash coefficient.
And an updater configured to transmit the hash coefficient to the anti-malware device when the malware patterns are transmitted to the anti-malware device.

Images