KR101487476B1 - Method and apparatus to detect malicious domain - Google Patents

Abstract

The present invention can quickly collect information about a file that is input from an external network into an internal network using at least one security device, and one malicious code management device performs malicious code checking on the collected files The result is transmitted to all the security devices in the system so that the malicious code can be detected quickly and the detected malicious code can be blocked from all the security devices in the system to provide a quick and unified security service. In particular, even if a malicious code inspection result received from a malicious code management device is contaminated by a malicious code before applying the malicious code detection result to the blocking policy, the malicious code of the malicious code (for example, , C & C server), and distributes it to the security device, thereby allowing the security device to fundamentally block malicious behavior by the malicious code.

Description

[0001] METHOD AND APPARATUS TO DETECT MALICIOUS DOMAIN [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security technology, and more particularly, to a technique for providing a quick and integrated security service for detecting a malicious domain.

In recent years, the use of the Internet has increased the number of malicious software or malicious code infected through the communication network, and the damage caused by the malicious software or malicious code is increasing every year. Malicious code, a so-called bot, is an abbreviation of a robot, which means a malicious program that can control a system infected with a bot.

These malicious codes can be used in various forms such as information gathering, spam mail sending, phishing, malicious code distribution, DDoS (Distributed Denial of Service) attack, etc. by the command of an attacker or bot master . Botnets will adversely affect network infrastructures such as routers and domain name system (DNS) servers as well as Internet users.

If you look at the path where Internet users' terminals are infected with malicious code, botmaster first hacked the update server or web site of programs used by many people and planted malicious code. Thereafter, when the user accesses the website or executes the update while executing the program, a malicious code is installed in the user's system. Subsequently, when a bot agent installed in the user's system accesses a command-and-control (C & C) server of the bot master, the bot master acquires control of the system. Therefore, the bot master can execute various malicious actions such as vulnerability attack through execution of commands on the system that has acquired the control right.

Malware detection technology is evolving and information about detected malware is distributed, but it protects systems that are not yet infected by malicious code, but it does not protect systems already infected by malicious code from malicious commands It was hard. In order to achieve this, the C & C server is mainly operated in the IP form, and the connection to the C & C server is blocked. However, the current C & C server is operated as a domain in order to avoid blocking the server. By setting the time to live (TTL) value of the DNS to be short and continuously changing the IP of the name server, And the IP blocking function.

Therefore, in order to prevent the spread of the malicious code infection, it is required to prevent the malicious behavior that may occur after blocking the connection to the C & C server.

An object of the present invention is to provide a security service capable of blocking a connection bypassing a security device by blocking a query when a domain of a malicious code C & C server exists among DNS query traffic.

According to an embodiment of the present invention, a method for blocking malicious code is disclosed. The method includes recording network activity by a malicious code; Extracting the domain from the DNS query traffic if the generation of DNS query traffic for connection to a domain is included in the network activity; Comparing the domain with a list of normal domains; And detecting the malicious domain by determining the domain as a malicious domain if the domain is not included in the normal domain list.

According to an embodiment of the present invention, an apparatus for detecting malicious domains is disclosed. The apparatus includes a file execution unit for recording a network activity by a malicious code; A domain extracting unit for extracting the domain from the DNS query traffic when the file execution unit includes generation of DNS query traffic for connection to a domain in a network action by the file execution unit; And a malicious domain detection unit for detecting the malicious domain by comparing the domain extracted by the domain extraction unit and the normal domain list and judging the domain as a malicious domain if the domain is not included in the normal domain list, .

The present invention can provide a fast and integrated security service by collecting malicious code inspection objects from all the security devices in the system, and detecting and distributing malicious codes and malicious domains therefrom. In addition, the present invention detects and distributes not only malicious codes but also malicious domains, thereby allowing the security device to fundamentally block malicious acts by malicious codes.

BRIEF DESCRIPTION OF THE DRAWINGS A brief description of each drawing is provided to more fully understand the drawings recited in the description of the invention.
1 shows an example of a malicious code detection and blocking system according to an embodiment of the present invention.
2 illustrates a method for collecting malware inspection objects according to an embodiment of the present invention.
3 illustrates a method for performing malicious code checking according to an embodiment of the present invention.
4 illustrates a method for performing malicious code checking according to another embodiment of the present invention.
5 illustrates a method for detecting malicious code in accordance with one embodiment of the present invention.
6 shows an example of an ASCII character string used in a malicious code.
7 shows an example of an API used in a malicious code.
Figure 8 illustrates a method for detecting malicious domains according to an embodiment of the present invention.
9 illustrates a method for blocking access to a malicious domain according to an embodiment of the present invention.
10 illustrates a security device in accordance with an embodiment of the present invention.
Figure 11 illustrates a malicious code management device in accordance with one embodiment of the present invention.

In order to fully understand the present invention, operational advantages of the present invention, and objects achieved by the practice of the present invention, reference should be made to the accompanying drawings and the accompanying drawings which illustrate preferred embodiments of the present invention.

Embodiments of the present invention will now be described more fully hereinafter with reference to the accompanying drawings, in which exemplary embodiments of the present invention are shown. The present invention is not limited to these embodiments. Rather, these embodiments are provided so that this disclosure will be more thorough and complete, and will fully convey the concept of the invention to those skilled in the art to which the present invention pertains.

Hereinafter, the present invention will be described in detail with reference to the embodiments of the present invention with reference to the accompanying drawings.

FIG. 1 illustrates an example of a malicious code detection and blocking system 100 in accordance with one embodiment of the present invention.

The system 100 may include at least one security device 111 to 11n and a malicious code management device 120. [ 1, the security device 111 is located at a place where traffic between the network to be protected (i.e., the internal network 130) and the untrusted network (i.e., the external network 140) By contrasting the traffic between the traffic and the security policy, it is possible to block the traffic that is against the policy and to provide the security service that selectively passes only the traffic conforming to the policy. Although only the networks 130 and 140 to which the security device 111 is connected are shown in FIG. 1, other security devices 112 to 11n may also connect the internal network and the external network, respectively. Although many firewalls have been widely used as the security devices 111 to 11n in recent years, many other devices such as an intrusion detection system and an intrusion prevention system have been widely used. The malicious code management device 120 is a device for managing malicious code information applied to a blocking policy used to block malicious codes. As shown in the figure, the malicious code management device 120 is connected to each of the security devices 111 to 11n, and can provide information on malicious codes applied to the security policies of the security devices 111 to 11n.

In detail, according to the present invention, each of the security appliances 111 to 11n transmits information on the URL of a file that flows from the external network to the internal network to the malicious code management equipment 120. The malicious code management device 120 obtains a file based on the information about the URL received from each of the at least one security device 111 to 11n, and performs malicious code checking on the file. Malicious code checking performed by the malicious code management device 120 can be performed by detecting a malicious code and / or a malicious domain from the obtained file. Thereafter, the malicious code management device 120 transmits the result of the malicious code inspection to the security devices 111 to 11n. Here, the malicious code detection result includes a file identified as a malicious code, an identification value of the file, A distribution URL, and information regarding a malicious domain. The security devices 111 to 11n may receive malicious code checking results and reflect them in the security policy. For example, each security device 111 to 11n can apply a URL of a file determined to be malicious code to the URL blocking policy, and apply the identification value of the file to the file blocking policy. Also, for example, each of the security devices 111 to 11n may apply the information on the malicious domain to the domain blocking policy to block the DNS query regarding the malicious domain.

That is, the present invention can quickly collect information about a file that flows from an external network to an internal network using at least one security device, and when one malicious code management device detects a malicious code And sends the result to all the security devices in the system so that it can quickly detect malicious code and provide a quick and integrated security service that will block the detected malicious code from all security devices in the system have. In particular, even if a malicious code inspection result received from a malicious code management device is contaminated by a malicious code before applying the malicious code detection result to the blocking policy, the malicious code of the malicious code (for example, , C & C server), and distributes it to the security device, thereby allowing the security device to fundamentally block malicious behavior by the malicious code.

In FIG. 1, the security devices 101 to 11n that perform the security policy and the malicious code management device 120 that manages the information related to the malicious code applied to the blocking policy are shown as individual components, Various configurations can be applied according to the embodiment to which the present invention is applied. For example, malware management and security appliances can be integrated into one integrated device. The number of such integrated equipment is not limited. For example, one or more integrated devices may be used, and all the devices that make up the system may be integrated devices. However, for simplicity of explanation, it is described that the embodiments of the present invention are performed by each of malicious code management equipment and security equipment.

Figure 2 illustrates a method 200 for collecting malware inspection objects in accordance with an embodiment of the present invention.

First, the security device can extract a URL (Uniform Resource Locator) of a file that is input through the web server (step 210). In general, malicious code is installed and harmful to the user's terminal in various ways such as "ActiveX", "Java Applet", "Java Webstart", ".NETClickOnce", "Flash", "UCC" It is the same in that the original file is downloaded from the web server using the HTTP protocol. In step 210, the URL of the file that is input from the web server can be extracted. Here, the URL is a URL for specifying the location of files on each server that provides services on the web, including the type of service to be accessed, the location of the server (domain name), the location of the file, syntax) can consist of a computer name / directory name / file name with protocol: // information.

The security device may generate a list of URLs related to the extracted URL by extracting the URL of a file that is input from the web server through step 210 (step 220). In one embodiment, the URL list may include the URL of all files coming from the web server. In another embodiment, the URL list may include a URL of a file corresponding to an executable file or a document file among URLs of files that are input from the web server. Because the malicious code must be invaded and executed inside the system, a file with an executable extension such as an executable file or a document file is likely to contain malicious code. Whether it corresponds to an executable file or a document file can be judged based on the file extension in the URL of the file. Here, the file extension of the executable file may include, for example, "exe", "dll", and the file extension of the document file may be, for example, "pdf", "hwp", "xls" , "txt ", and the like.

The security device may then continue to send the URL list to the malicious code management device (step 230). The transmission may be periodic / aperiodic.

The method 200 shown in FIG. 2 is illustrative, and various configurations can be applied according to the embodiment to which the present invention is applied. For example, the method 200 may transmit the URL of a file that the security device receives from the web server to the malicious code management device. However, according to the embodiment of the present invention, Malicious code management equipment.

Figure 3 illustrates a method 300 for performing malicious code checking in accordance with one embodiment of the present invention.

First, the malicious code management device may obtain a file for performing malicious code checking (step 310). Step 310 is performed by the malicious code management device by receiving a list of URLs related to a file that flows through the web server and downloading the files according to the URLs included in the URL list or by performing malicious code checking By receiving a file from the security device.

Subsequently, the malware management device may detect malicious code from the file obtained via step 310 (step 320). Step 320 may be performed by analyzing the attributes and behavior of the file and comparing the analysis results with features of the malicious code.

Subsequently, the malware management device may detect a malicious domain from a file determined to be malicious at step 320 (step 330). Step 330 may be performed by detecting a malicious domain that attempts to connect by malicious code while recording network activity by malicious code.

Subsequently, the malicious code management device may transmit the malicious code scan result to the security device (step 340). The malicious code detection result may include at least one of a malicious code detection result according to step 320 and a malicious domain detection result according to step 330. The transmission may be periodic / aperiodic.

The method for performing the malicious code checking shown in FIG. 3 is illustrative, and various configurations can be applied according to the embodiment to which the present invention is applied. In FIG. 3, step 330 is shown performed subsequent to step 320, but step 320 and step 330 may be performed concurrently, depending on the embodiment. For example, the analysis results generated by analyzing the attributes and behaviors of a file in step 320 may include network actions upon execution of the file. In addition, although the step 330 is shown to target a file determined to be a malicious code in step 320, according to the embodiment, the malicious domain inspection according to step 330 is not a file determined as a malicious code It can also be done for files. In addition, one of the steps 320 and 330 may be omitted according to the embodiment to which the present invention is applied.

Figure 4 illustrates a method 400 for performing malicious code checking in accordance with another embodiment of the present invention. The method 400 is added to the method 300 of FIG. 3 in addition to the configuration for determining whether malicious code has been previously tested for a malicious code inspection target file.

The malicious code management device can determine whether malicious code checking has been performed on a file for malicious code checking after acquiring a file for performing malicious code checking (step 310) (Step 410). Step 410 may be performed by referring to the malicious code inspection history based on the identification value of the file for malicious code inspection by the malicious code management device. Here, the malicious code inspection history may include information on a file in which the malicious code management device has performed the malicious code inspection, and information about at least one of the identification value of the file in which the malicious code has been inspected and the URL of the file. That is, the step 410 may be performed by comparing the identification value of the file for malicious code inspection with the identification value of the malicious code inspection file included in the malicious code inspection history. Where the identification value may be, for example, the hash value of the file.

When the information on the file having the same identification value as the identification value of the file for performing the malicious code inspection exists in the history of the malicious code inspection, it is determined that the malicious code inspection has been performed It means that there is an enemy, so no further malicious code checking is performed. However, even if the file has the same identification value, the malicious code management device may store the malicious code inspection history having the same identification value and the URL of the file for malicious code inspection, The URL of the file may be compared (step 420). As a result of the comparison, if the URLs are different from each other, the malicious code management device can update the malicious code checking history by adding the URL of the malicious code checking file to the malicious code checking history (step 430).

On the contrary, when the information about the file having the same identification value as the identification value of the file for performing the malicious code inspection does not exist in the malicious code inspection history, this means that the file for malicious code inspection is detected The malicious code management device updates the malicious code inspection history by adding the identification value of the file and the URL to the malicious code inspection history (step 440). Then, the malicious code management device updates the malicious code inspection history Code checking can be performed.

Figure 5 illustrates a method 500 for detecting malicious code in accordance with one embodiment of the present invention.

First, the malicious code management device can generate analysis information on attributes and behaviors of the file by executing a file to be subjected to the malicious code inspection (step 510). Such analysis information may include at least one of a type of a packer used in a file, an ASCII character string in a file's memory, and an API called in a file.

Subsequently, the malicious code management device may determine whether the file is malicious code based on the analysis information generated in step 510 (step 520). In the case of a malicious code, the malicious code has properties and behaviors different from those of the normal code due to the characteristics of the malicious code, and the malicious code may be determined in step 520 based on the difference in attribute and behavior. Specifically, step 520 may be performed by comparing at least one of the type of packer, the ASCII character string, and the API in the analysis information to the packer, ASCII character string, or API used by the malicious code.

As a result of the comparison, if at least one of the type of the packer in the analysis information, the ASCII character string, and the API is the same as at least one of the packer, the ASCII character string, and the API used by the malicious code, the malicious code can be determined as a malicious code (step 530) . This is because packers, ASCII strings, and APIs that can be used in malicious code are different from normal code. Conversely, if at least one of the type of packer, the ASCII character string, and the API in the analysis information is not the same as at least one of the packer, the ASCII character string, and the API used by the malicious code as a result of the comparison in the step 520, (Step 540).

Packers refer to a program that performs packing that encrypts or compresses a file so that the source code can not be easily viewed. It is a program that distributes malicious code to other terminals more quickly, takes a long time to reverse Packing can be used for malicious code to do so. As such, the packers used by malicious code may include "FSG", "upack", "aspack", "ASProtect", "nspack", "y0da's Crypter" 6 shows an example of an ASCII character string used in a malicious code. It is considered that a bypass attack using an ASCII string expressed in a way that is difficult to identify easily can be used for malicious code. 7 shows an example of an API used in a malicious code. Malicious code takes into account the fact that a specific API can be called for its operation. The specific configuration of the packer used in the malicious code, the ASCII string used in the malicious code, and the API used in the malicious code are illustrative, and various configurations can be applied according to the embodiment to which the present invention is applied.

In accordance with an embodiment to which the present invention is applied, various security techniques commonly used in the art for detecting malicious code can be used in addition to or in the alternative to step 520.

Figure 8 illustrates a method 800 for detecting malicious domains in accordance with an embodiment of the present invention.

The method 800 is for detecting a malicious domain included in malicious code in order to block the connection to the malicious domain. The bot agent installed on the malicious code infected user's system sends the domain name of the C & C server existing in the malicious code to the DNS server to access the C & C server, and queries the DNS of the C & C server's IP address. In response to this, when the DNS server transmits the IP address of the C & C server, the bot agent accesses the C & C server using the bot agent, and the bot master acquires control of the user system infected with the malicious code. Using this, the method 800 can extract the domain to be accessed from the DNS query traffic generated by the malicious code, and determine whether the extracted domain corresponds to a malicious domain.

First, in step 810, the malicious code management device can record network activity by malicious code. Step 810 may record a network activity by the file by executing a file containing malicious code in a virtual environment.

The malicious code management device then extracts the domain, i.e., the query name, from the DNS query traffic if the malicious code management device includes the generation of DNS query traffic for connection to the domain among the network actions recorded in step 810 (Step 820). Here, the DNS query traffic refers to the traffic for querying the DNS server with the IP address of the domain to access a specific domain. For example, the DNS query traffic may be traffic whose protocol is UDP and whose destination port is 53 times.

Subsequently, the malware management device may compare the domain extracted in step 820 with the list of normal domains. Herein, the normal domain list may include a normal domain that is determined not to be a malicious domain. Accordingly, malicious domains can be detected in accordance with the comparison result of step 830.

Specifically, if the extracted domain does not match the normal domain list (that is, if the extracted domain is not included in the normal domain list), the malicious code management device may determine the extracted domain as a malicious domain )). Conversely, if the extracted domain matches the normal domain list (i.e., the extracted domain is included in the normal domain list), the malicious code management device may determine the extracted domain as a normal domain (step 850).

The method 800 is based on the fact that the domain to which a malicious code is intended to access corresponds to a malicious domain. It can quickly detect a malicious domain, and in addition, it can compare a normal domain with a malicious domain list, It is possible to prevent misinterpretation as a domain.

FIG. 9 illustrates a method 900 for blocking a connection to a malicious domain according to an embodiment of the present invention.

First, the security device may extract DNS query traffic among traffic destined for the internal network to the external network (step 910). The DNS query traffic is traffic for querying the DNS server with the IP address of the domain to connect to a specific domain. For example, the DNS query traffic may be traffic whose UDP is the protocol and whose destination port is 53 times.

Subsequently, the query name in the DNS query traffic extracted in step 910 may be compared with the malicious domain list (step 920). Here, the query name is a host name of a query target by the DNS query traffic, which means a name of a domain to be accessed by DNS query traffic for connection to a domain. The malicious domain list is a malicious domain list, Domain.

As a result of the comparison in step 920, if the query name matches the malicious domain list (i.e., the query name is included in the malicious domain list), the DNS query traffic is for connection to the malicious domain, (Step 930). Conversely, if the query name does not match the malicious domain list (i.e., the query name is not included in the malicious domain list), the DNS query traffic is not intended for connection to the malicious domain, (Step 940).

FIG. 10 illustrates a security device 1000 in accordance with an embodiment of the present invention.

The security device 1000 includes a URL extracting unit 1010; A URL list generation unit 1020; Interface 1030; And a blocking policy unit 1040.

The URL extracting unit 1010 can extract the URL of a file that is input through the web server.

The URL list generation unit 1020 can generate a URL list related to the URL extracted by the URL extraction unit 1010. [ The URL list may include a URL of a file corresponding to an executable file or a document file.

The interface 1030 may transmit the URL list generated by the URL list generation unit 1020 to the malicious code management device. In addition, the interface 1030 may receive malicious code checking results from the malicious code management equipment.

The blocking policy unit 1040 may apply the malicious code checking result received by the interface 1030 to the security policy. For example, the blocking policy unit 1040 can apply a URL of a file determined to be malicious code to a URL blocking policy, apply an identification value of a file included in the malicious code blocking list to a file blocking policy, Information about malicious domains can be applied to the domain blocking policy to block DNS queries for malicious domains.

11 illustrates a malware management device 1100 in accordance with one embodiment of the present invention.

The malicious code management equipment 1100 includes an interface 1110; An inspection history determination unit 1120; A file execution unit 1130; A malicious code detection unit 1140; A domain extracting unit 1150; And malicious domain detection unit 1160. [

The interface 1110 may obtain a file for performing malicious code checking. The acquisition of the file may be performed by receiving a URL list from the security device, downloading the file according to the URL included in the URL list, or receiving a file for performing malicious code checking from the security device. Also, the interface 1110 may transmit the malicious code inspection result to the security equipment so that the security equipment may apply the malicious code inspection result to the security policy.

The inspection history determination unit 1120 can determine whether malicious code has been inspected for the file acquired by the interface 1110. The determination may be performed by referring to a malicious code inspection history including information on at least one of an identification value of a file on which malicious code is inspected and a URL of the file.

The malicious code detection unit 1140 can determine whether the file acquired by the interface 1110 corresponds to a malicious code. Specifically, the malicious code detection unit 1140 generates analysis information of the file including at least one of a type of a packer used in the file, an ASCII character string in the file's memory, and an API called in the file, At least one of a packer type, an ASCII character string, and an API in the analysis information is used in the malicious code, If it matches at least one of the packer, the ASCII string, and the API specified by the user, the file can be determined as a malicious code.

The file execution unit 1130 can record a network behavior by the file by executing a file including a malicious code in a virtual environment.

The domain extracting unit 1150 can extract the domain from the DNS query traffic if the DNS executing unit 1150 includes the generation of the DNS query traffic for connection to the domain in the network action recorded by the file execution unit 1130.

The malicious domain detection unit 1160 can detect a malicious domain included in the malicious code. More specifically, the malicious domain detection unit 1160 compares the domain extracted by the domain extraction unit 1150 with the normal domain list, and if the domain is not included in the normal domain list, the malicious domain determination unit 1160 determines the domain as a malicious domain, Domain can be detected. In contrast, if the domain is included in the normal domain list, the malicious domain detection unit 1160 can determine the domain as a normal domain.

That is, the present invention can quickly collect information about a file that flows from an external network to an internal network using at least one security device, and when one malicious code management device detects a malicious code And sends the result to all the security devices in the system so that it can quickly detect malicious code and provide a quick and integrated security service that will block the detected malicious code from all security devices in the system have. In particular, even if a malicious code inspection result received from a malicious code management device is contaminated by a malicious code before applying the malicious code detection result to the blocking policy, the malicious code of the malicious code (for example, , C & C server), and distributes it to the security device, thereby allowing the security device to fundamentally block malicious behavior by the malicious code.

As described above, an optimal embodiment has been disclosed in the drawings and specification. Although specific terms have been employed herein, they are used for purposes of illustration only and are not intended to limit the scope of the invention as defined in the claims or the claims. Therefore, those skilled in the art will appreciate that various modifications and equivalent embodiments are possible without departing from the scope of the present invention. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

Claims (14)

As a method for blocking malicious code,
Recording a network activity by a malicious code;
Extracting the domain from the DNS query traffic if the generation of DNS query traffic for connection to a domain is included in the network activity;
Comparing the domain with a list of normal domains;
Detecting the malicious domain by determining the domain as a malicious domain if the domain is not included in the normal domain list; And
Further comprising the step of detecting a malicious code from a file coming from a web server,
The step of detecting the malicious code includes:
Generating analysis information of the file including at least one of a type of a packer used in the file, an ASCII character string in a memory of the file, and an API called in the file;
Comparing the analysis information of the file with at least one of a packer, an ASCII character string, and an API specified to be used in the malicious code; And
Judging the file as a malicious code if at least one of the type of the packer, the ASCII character string, and the API in the analysis information coincides with at least one of a packer, an ASCII character string, and an API specified to be used by the malicious code, / RTI >
A method for detecting a malicious domain. The method according to claim 1,
Wherein the recording of the network activity is performed by recording a network activity by the file by executing a file including a malicious code in a virtual environment,
A method for detecting a malicious domain. delete The method according to claim 1,
Wherein the file received from the web server is obtained by downloading according to a URL of a file received from at least one security device,
A method for detecting a malicious domain. delete The method according to claim 1,
Further comprising the step of determining whether malicious code has been inspected for a file coming from the web server by referring to the identification value of the malicious code-inspected file and information about the URL of the file,
Wherein the detecting of the malicious code is performed when it is determined that malicious code checking has not been performed on a file coming from the web server,
A method for detecting a malicious domain. The method according to claim 1,
Further comprising transmitting at least one detected malicious domain to the at least one security device so that at least one security device applies the detected malicious domain to the security policy.
A method for detecting a malicious domain. An apparatus for detecting a malicious domain,
A file execution unit for recording network activity by malicious code;
A domain extracting unit for extracting the domain from the DNS query traffic when the file execution unit includes generation of DNS query traffic for connection to a domain in a network action by the file execution unit;
A malicious domain detection unit for detecting the malicious domain by comparing the domain extracted by the domain extraction unit with a normal domain list and determining the domain as a malicious domain if the domain is not included in the normal domain list; And
And a malicious code detection unit for detecting a malicious code from a file inputted from a web server,
The malicious code detection unit,
Generating analysis information of the file including at least one of a type of a packer used in the file, an ASCII character string in a memory of the file, and an API called in the file,
Compares the analysis information of the file with at least one of a packer, an ASCII character string, and an API designated to be used in the malicious code,
Determining that the file is a malicious code if at least one of a type of a packer, an ASCII character string, and an API in the analysis information coincides with at least one of a packer, an ASCII character string, and an API specified to be used in the malicious code,
A device for detecting a malicious domain. 9. The method of claim 8,
Wherein the file execution unit records a network action by the file by executing a file including a malicious code in a virtual environment,
A device for detecting a malicious domain. delete 9. The method of claim 8,
Wherein the file received from the web server is obtained by downloading according to a URL of a file received from at least one security device,
A device for detecting a malicious domain. delete 9. The method of claim 8,
Further comprising an inspection history determination unit for determining whether malicious code has been inspected for a file that has been infiltrated from the web server by referring to the identification value of the file subjected to the malicious code inspection and the information about the URL of the file and,
Wherein the malicious code detection unit detects malicious code when the determination unit determines that the malicious code has not been inspected with respect to the file inputted from the web server,
A device for detecting a malicious domain. 9. The method of claim 8,
Further comprising an interface for transferring the detected malicious domain to the at least one security device so that at least one security device applies the detected malicious domain to the security policy,
A device for detecting a malicious domain.

Images