KR101306656B1 - Apparatus and method for providing dynamic analysis information of malignant code - Google Patents

Abstract

Conventional dynamic analysis requires an effort to skip code at the analyst's discretion when debugging detection, anti-debugging techniques, etc. are included in the code. In other words, debugging is executed while checking the execution decompression or anti-debugging code while executing the code one by one through a debugging utility. As a result, analysts may face difficulties if they do not know anti-debugging techniques and debugging-detection techniques. Accordingly, in the embodiment of the present invention, by performing the dynamic analysis of the malicious code based on the call point of the malicious code operation, monitor the occurrence of the malicious code in the absence of debugging, and check the code of the program that generated the malicious code In this paper, we propose a dynamic analysis technique for malware that enables the analyst to perform debugging at the desired time.

Description

Apparatus and method for providing malware dynamic analysis information {APPARATUS AND METHOD FOR PROVIDING DYNAMIC ANALYSIS INFORMATION OF MALIGNANT CODE}

The present invention relates to a technique for providing malicious code dynamic analysis information, in particular, even when dynamic analysis is difficult due to an anti-debugging technique or a code obfuscation technique. The present invention relates to a method and apparatus for providing dynamic analysis information suitable for identifying a code of a computer.

For example, in order to analyze malicious codes in a personal computer (PC) environment having an operating system such as Windows, a separate analysis program must be executed to check the result or the process thereof.

Malware analysis can be divided into static analysis and dynamic analysis. Static analysis is the analysis of program code as it is, and dynamic analysis is the process of executing some code or analyzing malware during code execution. .

In the case of static analysis, it is possible to cope with the case where the analysis is interrupted by debugging detection or virtual environment detection, but the code before protection should be restored in case of code modification, execution compression or encryption.

On the other hand, when dynamic analysis is performed due to execution compression or code modification problem, the code is executed to generate the restored code to check the code, and additionally executed to confirm the malicious function, and the result and the code are judged. In other words, if the code is executed or compressed for the purpose of interfering with the analysis, and in the case of the malicious code including the debugging detection code, the code for the analysis must be analyzed separately.

Such dynamic analysis requires an effort to skip code at the analyst's discretion when debugging detection and anti-debugging techniques are included in the code. In other words, debugging is executed while checking the execution decompression or anti-debugging code while executing the code one by one through a debugging utility. As a result, analysts may face difficulties if they do not know anti-debugging techniques and debugging-detection techniques.

In addition, it is necessary to monitor the function performance of a specific program (application). In this case, when finding the code that calls the program in the malicious code, it is cumbersome to check the entire code. In addition to checking the timing of execution, in the case of dynamically loading a DLL (Dynamic Linking Library) in an operating system such as Windows, a process of hooking and analyzing an API (Application Programming Interface) included in the DLL is necessary. .

Korea Patent Registration 10-1083311, Malicious script analysis system and malicious script analysis method using the same, November 8, 2011 registration Korea Patent Registration No. 10-0926115, Apparatus and method for automatic analysis of program for detecting malicious code for Windows operating under specific events / conditions, registered November 3, 2009 Korean Patent Publication No. 2011-0057297, Malicious Bot Dynamic Analysis System and Method, published June 1, 2011

Accordingly, in the embodiment of the present invention, by performing the dynamic analysis of the malicious code based on the call point of the malicious code operation, monitor the occurrence of the malicious code in the absence of debugging, and check the code of the program that generated the malicious code This paper proposes a technique for providing dynamic analysis information on malicious code that enables an analyst to perform debugging at a desired time.

The apparatus for providing dynamic analysis information for malicious code according to an embodiment of the present invention includes a monitoring unit for monitoring the operation of a malicious code or a network in units of threads, a specific API (Application Programming Interface) or an event handler installed in the monitoring unit. and a call point detection unit for detecting a call point from an event handler, and a controller for displaying and controlling a result of dynamic analysis of malicious code according to the call point detected through the call point detection unit.

Here, the monitoring unit may include a system monitoring unit for monitoring an API used by the malicious code, and a network monitoring unit for monitoring network-related input / output (I / O) generated by the malicious code.

In addition, the malicious code dynamic analysis result may include at least one of code information, a stack information, or reference data at the time of the malicious code operation.

In addition, the reference data may include at least one of API input / output data or network transmission / reception data.

The controller may temporarily store the result of the dynamic analysis of the malicious code in a storage unit, and record a thread address space according to the thread size when the malicious code operation occurs in the storage unit.

In addition, the controller may store the malicious code dynamic analysis result including the status information for each call point of the malicious code in the storage unit at predetermined time intervals.

The controller may control display by checking a changed region of the code according to the malicious code dynamic analysis result.

In addition, the controller may control the display of the debugging screen so that debugging can be linked from a time point of a specific operation.

In addition, the specific operation may include at least one of execution after generation of a file, automatic execution registry generation, remote thread generation, or network connection attempt.

In the method for providing dynamic analysis information for malicious code according to an embodiment of the present invention, when a search engine is activated, a process of monitoring a system operation and a network operation of the malicious code in units of threads, and when a call point is detected in the monitoring process, And displaying a result of the dynamic analysis of the malicious code at the time of operation including the call point.

Here, the monitoring may include monitoring an API used by the malicious code, and monitoring a network-related I / O generated by the malicious code.

The call point may be a call point from a specific API of the monitoring process.

In addition, the result of the dynamic analysis of the malicious code may include any one of a code region, a stack region, or a reference data region at the point of operation including a call point.

The reference data area may include at least one of API input / output data or network transmission / reception data.

The malicious code dynamic analysis information providing method may further include displaying at least one of a code region, a stack region, or a reference data region at the time of the specific operation when a specific operation occurs, and delaying or delaying the specific operation. The process may further include stopping.

The malicious code dynamic analysis information providing method may further include providing screen information capable of interlocking with debugging from a time point of the specific operation.

In addition, the specific operation may include at least one of execution after generation of a file, automatic execution registry generation, remote thread generation, or network connection attempt.

The computer readable recording medium may also include a computer readable program for executing the method for providing malicious code dynamic analysis information according to an exemplary embodiment of the present invention.

According to the present invention, since the operation of the malicious code can be found through the system monitoring and the code at the time of the operation occurrence can be debugged at the time of the operation occurrence. In addition, by checking the input and output data of the operation status after the malicious code operation occurs, it is possible to clearly identify the items that are difficult to determine only by the operation during the analysis.

1 is a block diagram illustrating an apparatus for providing malware dynamic analysis information according to an embodiment of the present invention;
2 is a flowchart illustrating a process of providing malicious code dynamic analysis information according to an embodiment of the present invention;
3 is a diagram illustrating a monitoring result output screen of the apparatus for providing malicious code dynamic analysis information according to an embodiment of the present invention;
4 and 5 are examples of the output screen to grasp the call point code region in the apparatus for providing dynamic analysis information of malicious code according to an embodiment of the present invention;
6 is a diagram illustrating a code display screen in the apparatus for providing dynamic analysis information for malicious code according to an embodiment of the present invention.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like numbers refer to like elements throughout.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

Each block of the accompanying block diagrams and combinations of steps of the flowchart may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which may be executed by a processor of a computer or other programmable data processing apparatus, And means for performing the functions described in each step are created. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram. Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

Also, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order according to the corresponding function.

Prior to the description of the embodiment, the present invention performs the dynamic analysis of the malware based on the call point of the malicious code operation, thereby monitoring the occurrence of the malicious code in the absence of debugging, and at the time of invoking the operation in which the malicious code is generated. By allowing the program code to be checked so that the analyst can perform debugging at the desired time, it is easy to achieve the object of the present invention from this technical idea.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a malicious code dynamic analysis information providing apparatus according to an embodiment of the present invention, the system monitoring unit 100, the network monitoring unit 102, the call point detection unit 104, the control unit 106, The storage unit 108 and the display unit 110 may be included.

As shown in FIG. 1, the system monitoring unit 100 may serve to monitor an operation of a malicious code, for example, an API used by the malicious code. For such monitoring, it is possible to hook APIs related to files, registries, memory, etc., for example.

The network monitoring unit 102 may perform a role of monitoring network operation, for example, network related input / output (I / O) generated by malicious code.

Such a system monitoring unit 100 and the network monitoring unit 102 is characterized in that for monitoring the execution and operation of processes, files, etc. in units of threads according to an embodiment of the present invention. As in the embodiment of the present invention, when monitoring in units of threads, it is possible to efficiently deal with a remote thread as compared to the case of monitoring in units of processes.

The call point detector 104 detects a call point from a specific API or an event handler installed in the system monitoring unit 100 or the network monitoring unit 102 and provides the detected call point to the controller 106. can do.

The controller 106 temporarily stores the malware dynamic analysis result according to the call point detected by the call point detector 104 in the storage unit 108 and controls the display unit 110 to display the dynamic analysis result to the outside. can do. Here, the dynamic analysis result may include, for example, code information, stack information, reference data, etc. at the time of the malicious code operation. The reference data may include, for example, transmission data or reception data.

Meanwhile, the controller 106 may shorten the name of the module to, for example, a cyclic redundancy check (CRC) 32 and record only the loaded address. The location of the API is easy to see in the file, but the address being loaded can change from process to process. If you only need to know the module and the loaded address without having to record all the APIs, then there is no problem in interpreting the address at the time of analysis.

In addition, the controller 106 may determine the thread size when the malicious code operation occurs, and then record the thread address space. The size of a thread can be limited to a certain size, and in the case of code areas, only addresses can be provided without copying memory.

In addition, the control unit 106 may read the storage unit 108 with respect to the thread call address and the memory reference codes before and after the code, and store the values together.

The storage unit 108 may store the results of dynamic analysis at any call point under the control of the control unit 106. For example, the storage unit 108 may store a predetermined time interval when each analysis target operation occurs, for example. For example, the dynamic analysis result including the situation information at the time of the call may be stored at intervals of 2 to 3 seconds. As a result, the administrator can grasp the code, stack, and module status at the time of the malicious code operation.

The display unit 110 may display a result of monitoring through the system monitoring unit 100 and the network monitoring unit 102 under the control of the control unit 106, for example, malicious code operation information, call point information, and the like.

In addition, the display unit 110 may display the call point code analyzed by the control unit 106 and provide a debugging screen for interlocking debugging from a specific operation time point. Accordingly, when a specific operation occurs during monitoring, the administrator may delay or stop the specific operation and perform debugging. Herein, the specific operations may include operations that are limited in general programs such as execution after creation of a file, automatic execution registry generation, remote thread creation, and network connection attempt.

On the other hand, when the main operation occurs, the code is checked as the changed area so that only the corresponding part is displayed. In this case, if there is a code region previously displayed, the code may be displayed only when the CRC32 values are compared in units of blocks with respect to the entire code region.

Hereinafter, with reference to the above-described configuration, with reference to the flowchart of Figure 2 attached to the process of providing malicious code dynamic analysis information according to an embodiment of the present invention will be described in detail.

As shown in FIG. 2, when the search engine (not shown) is activated (S200), the system monitoring unit 100 may monitor an operation of any malicious code, for example, an API used by any malicious code. The network monitoring unit 102 may monitor network operation, for example, network related I / O generated by malware (S202).

The system monitoring unit 100 and the network monitoring unit 102 may monitor execution and operation of a process, a file, etc. in units of threads according to an exemplary embodiment of the present invention. In an embodiment of the present invention, a countermeasure for a remote thread can be efficiently performed as compared with the conventional technique of monitoring in a process unit.

3 exemplarily illustrates a result output screen monitored through the system monitoring unit 100 and the network monitoring unit 102. The monitoring result output screen may be processed by the display unit 110 or the like under the control of the controller 106, and this fact will be easily understood by those skilled in the art.

First, the system monitoring unit 100 and the network monitoring unit 102 may monitor processes executed by a file name, for example, "drivefix.exe", which is assumed to be the first malicious code to be executed.

For example, as shown in the highlighted portion of FIG. 3, when "drivefix" is executed, memory is forcibly allocated to "explorer.exe" and the code is recorded and executed through "CThread (Createthread)". You can code injection into "explorer.exe", create a thread, and monitor the actions executed by the injected thread.

At this time, the control unit 106 determines whether the call point is detected by the monitoring result of the system monitoring unit 100 and the network monitoring unit 102 through the call point detection unit 104 (S204), and if the call point is detected The controller 106 may control the display unit 110 to display a stack region, a reference data (transmit / receive data) region, etc., at the time of operation including the call point for each situation of the malicious code (S206).

This is as shown in the example screens of FIGS. 4 and 5.

In addition, in the case of a code requiring confirmation, the control unit 106 may control the display unit 110 to display a code area for knowing the address returned after the call, as illustrated in FIG. 6.

Accordingly, the administrator can identify the call point in each situation, and can also identify the code area including the call point.

Meanwhile, the controller 106 determines whether a specific operation occurs (S208), and when a specific operation occurs, displays the code region, the stack region, the reference data region, etc. at the specific operation point as described above, and displays the specific operation. It may be delayed or stopped (S210). At this time, the specific operation may include operations that are limited in general programs such as execution after creation of a file, automatic execution registry generation, remote thread creation, network connection attempt, and the like.

Thereafter, the controller 106 may provide a debugging screen for interlocking debugging from a specific operation time point. Accordingly, when a specific operation occurs during monitoring, an administrator may delay or stop a specific operation and perform debugging.

On the other hand, as described above, the method for providing dynamic analysis information for malicious code according to the present invention, which provides various embodiments, may be implemented as a computer executable program on a computer readable recording medium. The recording medium may include any kind of recording device that stores data that can be read by a computer system. Such computer-readable recording media may include, for example, non-volatile memory such as ROM, flash memory, magnetic storage, and the like, volatile memory such as RAM, and the like. Computer-executable code or program may be stored in a client device for malware dynamic analysis according to an embodiment of the present invention or distributedly stored in a networked computer system.

In addition, the program capable of performing the malicious code dynamic analysis information providing service according to an embodiment of the present invention has been described as being stored in a recording medium in the client terminal device, but this is only illustrative for the description of the present invention. It does not limit the scope of rights. For example, the above-mentioned information may be permanently stored in the virtualization device (or server) on the network, and the client device may include a cloud computing environment in which the above-mentioned information is temporarily stored. In other words, it is necessary to store the above-described information in the virtualization device on the network, and that the information may be available anytime and anywhere through the client device.

As described above, according to an embodiment of the present invention, by performing the dynamic analysis of the malware based on the call point of the malware operation, by monitoring the occurrence of the malware in the absence of debugging, the malware is generated It is an implementation of dynamic malware analysis technology that enables the programmers to check the code of the program so that the analyst can debug when desired.

100: system monitoring unit
102: network monitoring unit
104: call point detector
106: control unit
108:
110:

Claims (18)

Monitoring unit for monitoring the operation of malware or network in units of threads,
A call point detection unit for detecting a call point from a specific API (Application Programming Interface) or a pre-installed event handler of the monitoring unit;
And a control unit configured to display and control a malicious code dynamic analysis result according to a call point detected through the call point detection unit, and to display and control a debugging screen so that debugging can be linked from a time point of a specific operation.
Malware dynamic analysis information providing device.
The method of claim 1,
The monitoring unit,
System monitoring unit for monitoring the API used by the malware,
Network monitoring unit for monitoring the network-related input / output (I / O) caused by malware
Malware dynamic analysis information providing device.
The method of claim 1,
The malware dynamic analysis results,
At least one of code information, stack information, or reference data at the time of malware operation.
Malware dynamic analysis information providing device.
The method of claim 3, wherein
The reference data includes:
At least one of API input / output data or network transmission / reception data
Malware dynamic analysis information providing device.
The method of claim 1,
The control unit,
While temporarily storing the result of the dynamic analysis of the malicious code in a storage unit, writing the thread address space according to the size of the thread when the malicious code operation occurs in the storage unit
Malware dynamic analysis information providing device.
The method of claim 5, wherein
The control unit,
Storing the dynamic analysis result of the malicious code including the status information for each time point of the malicious code is stored in the storage unit at a predetermined time interval.
Malware dynamic analysis information providing device.
The method according to claim 6,
The controller checks and displays the changed area of the code according to the malicious code dynamic analysis result to control the display.
Malware dynamic analysis information providing device.
delete The method of claim 1,
In the specific operation,
At least one of the creation and execution of a file, or an automatic execution registry creation, a remote thread creation, or a network connection attempt.
Malware dynamic analysis information providing device.
When the search engine is activated, the process of monitoring the system behavior of the malware and the behavior of the network on a per-thread basis,
If a call point is detected in the monitoring process, displaying a result of dynamic analysis of malicious code at an operation point including the call point;
Displaying at least one of a code region, a stack region, or a reference data region at the time of the specific operation when a specific operation occurs;
Delaying or stopping the specific operation;
How to provide malware dynamic analysis information.
11. The method of claim 10,
The monitoring process,
Monitoring the APIs used by malware,
Monitoring network-related I / O caused by malware
How to provide malware dynamic analysis information.
11. The method of claim 10,
The call point is
Call point from a specific API of the monitoring process, characterized in that
How to provide malware dynamic analysis information.
11. The method of claim 10,
The malware dynamic analysis results,
A code area of the operation point including a call point, a stack area, or a reference data area
How to provide malware dynamic analysis information.
The method of claim 13,
The reference data area is
At least one of API input / output data or network transmission / reception data
How to provide malware dynamic analysis information.
delete 11. The method of claim 10,
The malicious code dynamic analysis information providing method,
The method may further include providing screen information that enables debugging interoperation from the time point of the specific operation.
How to provide malware dynamic analysis information.
17. The method of claim 16,
In the specific operation,
At least one of the creation and execution of a file, or an automatic execution registry creation, a remote thread creation, or a network connection attempt.
How to provide malware dynamic analysis information.
A computer-readable recording medium having recorded thereon a program for executing the method for providing the dynamic analysis information of the malicious code according to claim 10, 11, 12, 13, 14, 14, 16, or 17.

Images