KR101444141B1 - Malicious Thread Handling System and Method - Google Patents

Abstract

The present invention relates to a malicious thread handling system without stopping a process which is executed and a method thereof. The malicious thread handling system according to the present invention includes a real-time file monitoring unit which monitors the input and output of a module in a computer system, a malicious code inspecting unit which extracts a malicious module by inspecting whether the malicious code is included in the module, and a malicious file-connected malicious thread inactivating unit which collects and stores information which is connected to the module, the thread, and the process executed in the computer system, extracts the malicious thread information connected to the malicious module which is extracted in the malicious code inspecting unit, and inactivates the malicious thread information.

Description

{Malicious Thread Handling System and Method}

The present invention relates to a malicious thread processing system and method, and more particularly, to a system and method for processing a malicious thread without suspending a running process.

A malicious module refers to a program that is intentionally created to harm a computer system and includes viruses, worms, Trojans, or hacking programs. Generally, a malicious module creates a separate thread in a running process to perform a malicious action. However, since a thread generated by a malicious module uses various modules included in the process, it is very difficult to detect only a malicious thread.

Therefore, when a malicious module is detected, the entire process including the malicious module should be terminated, not only the thread generated by the malicious module should be terminated, the malicious module must be removed, and then the computer system must be rebooted or the process must be re-executed.

However, a computer user can suffer a great deal of damage if the process execution is ended by ending the entire process. In particular, when a malicious module exists in a server system, a service provided by the server system must be interrupted, so that a server system operator can suffer financial damages, and a client may experience a lot of inconvenience.

To solve such a problem, Korean Patent Publication No. 2004-0104112, "malicious thread detector and method" proposed a method of detecting a thread generated by a malicious module by tracing execution code of a thread. The malicious thread detector according to the present invention includes malicious module checking means for checking whether a malicious module exists in a module of a running process and for extracting a memory address of the malicious module, an IP (Instruction Pointer) If the IP address does not indicate the memory address of the malicious module, extracts the data stored in the stack area of the thread in a stack storage unit And return address checking means for detecting a malicious thread by checking whether the stack data corresponding to the memory address of the malicious module among the extracted stack data is a return address.

In this prior art, it is checked whether an IP (Instruction Pointer) of a thread to be tested indicates a memory address of a malicious module, whether a return address of the thread's stack data matches a memory address of the malicious module, Therefore, there is a problem that the hidden malicious thread can not be detected. In addition, the prior art has a problem that the execution process is delayed because the thread to be inspected is paused for all threads in execution and the malicious thread is detected based on the IP of the thread.

SUMMARY OF THE INVENTION It is an object of the present invention to solve the above-mentioned problems of the prior art and to provide a malicious thread processing system and method capable of detecting and processing all malicious threads generated by a malicious module without suspending execution processes and threads . Another object of the present invention is to provide a malicious thread processing system and method capable of detecting and processing a concealed malicious thread.

According to an aspect of the present invention, there is provided a malicious thread processing system comprising: a real-time file monitoring unit for monitoring input / output of a module in a computer system; A malicious code checking unit for checking whether the malicious code is included in the module and extracting the malicious module; A malicious file-linked malicious thread for collecting and storing processes, threads and module linkage information executed in the computer system, extracting malicious thread information associated with the malicious module extracted from the malicious code checking unit based on the linkage information, And a neutralizing part.

The malicious thread processing method according to the present invention collects process information and thread information executed by a malicious thread processing system in a computer system, and associates the process, the thread, and the module with each other based on the collected process information and thread information A first step of collecting; A second step of the malicious thread processing system monitoring input / output of a module in the computer system and checking whether the malicious code is included in the module to extract a malicious module; A third step of the malicious thread processing system extracting malicious thread information associated with the malicious module based on the association information; And a fourth step of the malicious thread processing system deactivating the malicious thread.

As described above, according to the present invention, since at least two thread detection methods collect process information and thread information to be executed in a computer system, it is possible to detect hidden processes and threads in various ways, Module information is stored as a table, and when a malicious module is detected, the malicious thread associated with the malicious module is disabled based on the table, thereby detecting and processing the malicious thread without pausing.

1 is a block diagram showing a malicious thread processing system according to the present invention.
FIG. 2 is a diagram illustrating an example of a table storing association information between a process and a thread according to the present invention.
3 is a flowchart illustrating a malicious thread processing method according to the present invention.

The malicious thread processing system and method according to the present invention will now be described in more detail with reference to the accompanying drawings.

1 is a block diagram showing a malicious thread processing system according to the present invention.

The malicious thread processing system according to the present invention includes a real-time file monitoring unit 110, a malicious code checking unit 120, and a malicious file-related malicious thread disabling unit 130. The real-time file monitoring unit 110 monitors input / output of a file or a registry in a computer system. The malicious code checking unit 120 checks whether a malicious code is included in a new file or registry.

The malicious file-related malicious thread disabling unit 130 includes a process thread information collecting unit 131 for collecting process information and thread information executed in a computer system, a process information collecting unit 131 for collecting process information and threads collected by the process thread information collecting unit 131, A linkage information collecting unit 132 for collecting linkage information of a process, a thread and a module (DLL) on the basis of the information, a malicious code checking unit 120 A malicious thread extracting unit 133 for extracting malicious thread information associated with the detected malicious module, and a malicious thread deactivating unit 134 for deactivating the malicious thread.

The malicious file linked malicious thread disabling unit 130 detects a malicious thread executed by the malicious module and disables the malicious thread. At this time, if the malicious thread is hidden, even if the malicious module is detected, the malicious thread executed by the malicious module is not detected, thereby preventing the malicious thread from being terminated or stopped. Accordingly, the present invention proposes a method for detecting all threads executed in a computer system including a hidden thread.

The process thread information collector 131 of the present invention collects process information and thread information by using a detection method based on PspCidTable investigation, a detection method based on ObjectTable investigation, a detection method based on memory scan, and a detection method based on SwapContext function hooking do. Each of these detection methods may not be able to detect some hidden processes or threads that are disabled by a malicious program that uses the corresponding detection method. Accordingly, in the present invention, process information and thread information are collected and duplicated by using at least two detection methods among the various detection methods described above to obtain unique process information and thread information.

Each of the detection methods will be described in detail.

Detection via PspCidTable probe : PspCidTable is a global variable used by the kernel to manage object information about processes and threads. You can examine the PspCidTable to determine the object address for the process and the thread. The process object and the thread object thus confirmed are the loaded address information in the memory of the process structure and the thread structure, respectively. Therefore, process structure and thread structure information can be obtained from PspCidTable. Further, a process structure may be additionally obtained through the process identifier information of the obtained thread structure. A process structure contains a process identifier, a parent process identifier, and a file name. The thread structure includes the process identifier, the thread identifier, and the start address of the thread.

Detecting through an ObjectTable of an arbitrary process : A process structure manages all the objects used by the process in an ObjectTable. Therefore, the ObjectTable exists as many as the number of processes. The ObjectTable member is a handle table (HANDLE_TABLE) structure type, and each process's ObjectTable includes HandleTableList information and a process structure. The HandleTableList contains all the ObjectTable list information. Thus, an ObjectTable is obtained from a process structure of any one process (e.g., a system process), the ObjectTable list of another process is obtained by referring to the HandleTableList of the ObjectTable, and a process structure is obtained from each ObjectTable of the obtained list. This allows you to obtain the process structure of running processes.

Detection via memory scan : When a process and a thread are running, they reside in memory. That is, if there is only a unique identifier of an object existing in memory, it can be found through scanning. However, there is no identifier that specifies a process structure and a thread structure. Therefore, you need to check the process structure and the thread structure type to make sure that each parameter that constitutes each structure is filled with valid values. Here is how to detect a process (or thread) structure through a memory scan. First, the scan range (area) of the kernel memory is determined, and the kernel memory is scanned in an appropriately small unit (e.g., 4 bytes). Verify that the arguments of the process (or thread) structure (eg, ObjectTable, ActiveProcessLinks, ThreadListHead, etc.) have valid values at the address being scanned. If the arguments for determining each valid structure in the address being scanned are greater than the threshold value, the address is determined as the address of the structure (process or thread). If the valid arguments are less than the threshold value, the next area is scanned. Because the process and thread objects reside in the kernel memory pool, additional pool tag information may be needed to detect the process and thread structures.

The SwapContext function is called when the context of the thread currently being operated on by the CPU is swapped to the context of the next thread to be computed. This SwapContext function has the following information: The thread information to be operated on is stored in the register. Therefore, the SwapContext function is hooked to collect the thread information (thread structure), and the process structure of the thread structure is identified to detect the process structure.

Next, the linkage information collection unit 132 includes a process-thread linkage information collection unit that collects linkage information between the process and the thread, a process-module linkage information collection unit that collects linkage information between the process and the module, And a linkage information combining unit for linking the linkage information between the process and the module to collect linkage information between the process and the thread and the module.

The process-thread linkage information collection unit collects linked thread information by using ThreadListHead information of the process structure for each process or scans the memory to collect linkage information between the process and the thread. Next, the process-module linkage information collection unit examines the bad route (VadRoot) of the process structure and collects information about the virtual address space. The information on the virtual address space includes attribute information for each area (page unit) of the virtual address space of the memory allocated to the process, and path information of the file (module) mapped to the corresponding area. The process-module linkage information collection unit collects path information of a module file associated with the process and memory area information allocated to the module file. The association information combining unit determines that the process, the thread, and the module are linked if the start address of the thread associated with the arbitrary process is included in the memory area allocated to the module file associated with the process. The association information combining unit detects a module file associated with the thread if the start address of the thread is included in an area where the attribute of the virtual address space is executable, and if the start address of the thread is an executable EXECUTE), the module file associated with the thread is not detected. FIG. 2 is a diagram illustrating an example of a table storing association information between a process and a thread according to the present invention.

Process-thread linkage information collection unit Each method will be described in detail below.

How to use ThreadListHead information of a process structure : A process uses a linked list to manage information about threads that are the actual execution subject ThreadListHead is a linked list head of type LIST_ENTRY. A process maintains a thread list through the ThreadListHead of the process structure. ThreadListHead is associated with ThreadListEntry in the thread structure. Each time you look up ThreadListHead, you can get the address of that thread structure by subtracting the offset from the corresponding entry address to the ThreadListEntry of the thread structure. You can iterate over all the entries to collect all the thread structures associated with the process structure.

To scan a memory and collect the linkage information between a process and a thread : After detecting a process structure and a thread structure through a memory scan, the process identifier of the process structure and the process identifier of the thread structure and the thread identifier information are used You can collect a list of all managed threads.

The process-thread-government collecting unit 131 and the linkage-information collecting unit 132 are operated while the computer system is running, and maintain the linkage information between the process, the thread and the module as the latest information.

When a malicious module is detected by the malicious code checking unit 120, the malicious thread extracting unit 133 extracts a malicious thread associated with the malicious module based on the process created in the association information collecting unit 132 and the association information between the thread and the module Extracts thread information and provides it to the malicious thread inactive section 134. Next, the malicious thread deactivation unit 134 deactivates the malicious thread extracted by the malicious thread extracting unit 133. [ At this time, if there are two or more malicious threads associated with one malicious module, all the related malicious threads are deactivated.

3 is a flowchart illustrating a malicious thread processing method according to the present invention.

The malicious thread processing system according to the present invention collects process information and thread information executed in the computer system, and collects linkage information between the process and the thread based on the collected process information and thread information (S31). The malicious thread processing system collects linkage information between the process and the module (S32), and combines linkage information between the process and the thread and linkage information between the process and the module (S33). On the other hand, the malicious thread processing system monitors real-time file input / output (S34) and checks the malicious code against the new module (S35).

If the malicious module is not detected (S36), steps S31 to S33 are repeated to maintain the linkage information between the process, the thread and the module as the latest information, and the steps S34 and S35 are repeatedly performed, ≪ / RTI >

If the malicious module is detected (S36), the malicious thread information associated with the malicious module is extracted based on the association information between the process, the thread and the module (S37), and the extracted malicious thread is deactivated (S38).

In step S31, the malicious thread processing system detects the process information through at least two detection methods among a detection method by PspCidTable investigation, a detection method by ObjectTable investigation, a detection method by memory scan, and a detection method by SwapContext function hooking, And thread information, and then duplicates and removes unique process information and thread information.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiments, it is to be understood that the invention is not limited to the disclosed embodiments. In addition, it is obvious that various modifications and variations can be made without departing from the scope of the technical idea of the present invention by anyone having ordinary skill in the art.

110: real-time file monitoring unit 120: malicious code checking unit
130: malicious thread linking malicious file
131: Process thread information collecting unit 132:
133: malicious thread extraction unit 134: malicious thread deactivation unit

Claims (9)

A malicious code checking unit for checking whether malicious code is included in a module included in the computer system and extracting the malicious module; A malicious file-linked malicious thread disabling process for collecting malicious file information associated with a malicious thread extracted from the malicious code checking unit based on the association information, ≪ / RTI >
The malicious file-related malicious thread disabling unit includes a process thread information collecting unit for collecting process information and thread information executed in the computer system, and a processor and a thread based on the process information and the thread information collected by the process thread information collecting unit. A malicious thread extracting unit for extracting malicious thread information associated with the malicious module detected by the malicious code checking unit based on the linkage information collected by the linkage information collecting unit; And a malicious thread deactivation section for deactivating the malicious thread,
The linkage information collection unit includes a process-thread linkage information collection unit that collects linkage information between the process and the thread, a process-module linkage information collection unit that collects linkage information between the process and the module, And a linkage information combining unit for linking the process and the linkage information between the module and the module to collect linkage information between the process and the thread and the module. delete The method according to claim 1, wherein the process thread information collecting unit collects the process thread information through at least two detection methods among a detection method by PspCidTable investigation, a detection method by ObjectTable investigation, a memory scanning method, and a SwapContext function hooking detection method Wherein the process information and the thread information are collected and then duplicated. delete The method according to claim 1, wherein the process-thread linkage information collector collects linked thread information by using ThreadListHead information of the process structure for each process, or collects linkage information between the process and the thread by scanning the memory. Thread processing system. 2. The method according to claim 1, wherein the process-module linkage information collector collects information on the virtual address space by examining a bad route (VadRoot) of the process structure, and stores path information of the module file associated with each process, And collects the allocated memory area information. The information processing apparatus according to claim 1, wherein the linkage information combining unit judges that the process, the thread, and the module are linked if the start address of the thread associated with the arbitrary process is included in the memory area allocated to the module file associated with the process The malicious thread processing system comprising: A malicious thread processing system collects linkage information between a process and a thread executed in a computer system, collects linkage information between the process and the module, combines the linkage information between the collected process and the thread and linkage information between the process and the module, A first step of collecting linkage information between modules and a module;
A second step of the malicious thread processing system extracting a malicious module by checking whether malicious code is included in the module included in the computer system;
A third step of the malicious thread processing system extracting malicious thread information associated with the malicious module based on the association information collected in the first step;
And the malicious thread processing system includes a fourth step of deactivating the malicious thread. 9. The method of claim 8, wherein in the first step, the malicious thread processing system collects the process information and thread information executed in the computer system by using a detection method by PspCidTable investigation, a detection method by ObjectTable investigation, Wherein the process information and the thread information are collected through at least two detection methods among the detection method by the detection method, the detection method, and the detection method by the SwapContext function hooking method, respectively.

Images