KR101508577B1 - Device and method for detecting malware - Google Patents

Abstract

A device for detecting malicious code according to the present invention comprises: a sample information collection unit for collecting sample information from malicious samples and normal samples which are stored or input in advance; a sample information refining unit for removing, from the malicious sample and the normal sample, code information existing in common in at least one sample information of at least one malicious sample and at least one normal sample, to generate unique information of the malicious sample and the normal sample; a weight calculation unit for calculating the percentages of the malicious samples and the normal samples which have each unique information and assigning the percentage to each unique information; and a malicious code detection unit for detecting whether a target application is malicious code by determining which malicious sample of the malicious samples is most similar to the target application, based on the percentages.

Description

[0001] DEVICE AND METHOD FOR DETECTING MALWARE [0002]

The present invention relates to a malicious code detection apparatus and method, and more particularly, to an apparatus and method for detecting a malicious code using similarity with unique information of a malicious code.

Android includes an operating system and middleware for handheld devices including mobile phones, a user interface and standard applications such as a web browser, an email client, a short message service (SMS), a multimedia message service (MMS) (STACK), which is a mobile operating system that includes a large portion of the global mobile operating system market. As the use of mobile devices using Android increases, the number of malicious codes targeted by them also increases rapidly, which is pointing to the main operating environment of malicious codes in mobile devices.

The malicious code running in the Android environment can access the personal information of the user stored in the portable device, and can be transmitted to the outside by modulating, deleting or using the network function of the device. In addition, Storage devices, arithmetic devices, and communication devices arbitrarily useful for attacking other networks or computers.

Most of the known Android malicious codes have been identified as similar species, and many of the newly discovered malicious codes are reported as variants belonging to known species. Android malware authors can quickly create and update many variants, reducing the detection efficiency of malicious code-based applications by reusing once-used code, or modifying, deleting, or adding only a portion of a feature or structure Alternatively, a large number of variants can be created by changing only the application containing the malicious code using repackaging technology. Therefore, in order to efficiently respond to Android malicious code, it is an efficient approach to judge whether the malicious code is similar to the known malicious code, and techniques for researching it have been proposed.

The representative Android malicious code detection technology has the technology to detect and represent representative unique information which is a criterion for judging a specific species by using the same approach as that of desktop environment, from expert analysis and to detect it. In the proposed technique to deal with the variant, there is a method of comparing the similarity between the applications without the definition of the reference specific information and detecting the variant.

Android malicious code detection technology, which is commonly used in commercial devices or applications, can not detect highly variants because of the very narrow range covered by representative proprietary information that is a criterion for determining a specific species, or information that covers an excessively wide range Or using the similarity comparison method between applications without defining the reference specific information, there is a disadvantage that the false rate is high and the time / space efficiency is low.

In this regard, Korean Patent Publication No. 10-2010-0069135 (entitled "Malicious Code Classification System") is used to measure the similarity of malicious codes to easily identify the type and degree of association between existing malicious codes and new malicious codes Which describes the malicious code classification system.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems of the prior art, and it is an object of the present invention to provide a malicious code detection apparatus for detecting malicious code by defining unique information for judging similarity between a malicious sample and a detection target application, And methods.

It is another object of the present invention to provide a malicious code detection apparatus and method for detecting a malicious code by detecting similarity through comparison between malicious samples and unique information of a detection target application.

According to a first aspect of the present invention, there is provided an apparatus for detecting malicious code, comprising: an information extracting unit for collecting sample information from a previously stored or inputted malicious sample and a normal sample; A sample information refinement unit which removes code information common to one or more sample information of one or more normal samples and malicious samples and normal samples to generate unique information of malicious samples and normal samples, And a ratio calculating unit for calculating a ratio of normal species containing each specific information and giving a ratio to each unique information, and a weight calculating unit for calculating, based on the ratio, And a detection unit for detecting that the detection target application is a malicious code by judging it to be similar to a malignant sample species.

According to a second aspect of the present invention, there is provided a malicious code detection method comprising the steps of: collecting sample information from a previously stored or inputted malicious sample and a normal sample; detecting one or more sample information of one or more malicious samples; Generating unique information of a malicious sample and a normal sample by removing code information common to the sample information from the malicious sample and the normal sample to generate unique information of the malicious sample and the normal sample, Calculating a proportion of normal specimens to give a ratio to each unique information, and determining, based on the ratio, whether the detected application is similar to one of the malignant specimens of at least one of the malignant specimens so that the detected application is malicious code .

 According to the above-mentioned problem solving means of the present invention, the malicious sample of the detection target application can be defined by extracting the unique information of the malicious sample whose unique information of the normal sample is purified.

Further, according to the above-mentioned problem solving means of the present invention, it is possible to detect the similarity by probably calculating the similarity of a detection target application with the extracted unique information, and to define a malignant sample species based on the similarity have.

According to the above-mentioned problem solving means of the present invention, the malicious code detecting apparatus is capable of detecting malicious code using the similarity of malicious code unique information, and at the stage of implementing the malicious code or the code in an intended variant such as code reuse, repackaging, Detect new malicious code using some unique information.

1 is a block diagram of a malicious code detection apparatus according to an embodiment of the present invention.
2 is a flowchart of a method for detecting malicious code according to an embodiment of the present invention.
FIG. 3 shows in detail the process of refining and calculating the ratio of sample information.
FIG. 4 shows an example for explaining the process of refining and calculating the ratio of sample information.
5 is an example of a method of detecting malicious samples similar to the detection target application using the calculated ratio of the malicious code detection device.
FIG. 6 is a performance chart for calculating an average detection success rate and an average false rate using a malicious code detection apparatus according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout this specification, when an element is referred to as "including " an element, it is understood that the element may include other elements as well, without departing from the other elements unless specifically stated otherwise. The word " step (or step) "or" step "used to the extent that it is used throughout the specification does not mean" step for.

According to an embodiment of the present invention, the malicious code detection device can initially store malicious samples and normal samples of the Android, and performs three steps of extracting sample information, purifying sample information, calculating ratio of unique information, and detecting malicious code. Malicious samples are classified as malicious codes, and can be grouped into "species" according to certain criteria. The white list is a sample of normal codes that can not be malignant specimens, and can be grouped into "species" according to certain criteria. However, according to one example of a normal specimen, all specimens form one species.

1 is a block diagram of a malicious code detection apparatus according to an embodiment of the present invention.

The malicious code detection apparatus according to an exemplary embodiment of the present invention may include an information extraction unit 110, a sample information refinement unit 120, a weight calculation unit 130, and a detection unit 140 .

First, the information extracting unit 110 collects their sample information from previously stored or inputted malicious samples and normal samples.

The sample information refinement unit 120 removes code information common to one or more specimen information of one or more malignant specimens and one or more specimen information of one or more normal specimens from malignant specimens and normal specimens, Information. That is, since the code information including both the malignant sample and the normal sample can not be a definite standard for distinguishing the malignant sample or the normal sample, all sample information of one or more normal samples and all sample information of one or more malignant samples are compared Common code information is removed, and unique information resulting from elimination of such code information is generated.

The weight calculation unit 130 calculates the ratio of the malignant sample species containing the unique information of the purified malignant sample or the purified normal sample or the ratio of the normal sample species. According to an embodiment of the present invention, the weight calculation unit 130 obtains the number of malicious samples including any one unique information in one malignant sample relative to the number of malicious samples including any one unique information in all malignant samples The ratio can be calculated. The ratio can be similarly calculated for the normal sample. If, for example, all normal samples form a species, the ratio may be a normal sample number that includes any unique information within the entire normal sample versus the total number of normal samples. This ratio can be expressed as a " weight " for each unique information, and such ratio or weight can be given to each unique information.

The detection unit 140 determines whether the detection target application is a malicious code by judging whether the detection target application is similar to one of the malicious one or more malignant sample species. At this time, the detection unit 140 can determine whether the similarity based on the ratio calculated by the weight calculation unit 130 is similar. According to an embodiment of the present invention, the detection unit 140 detects the probability that the unique information included commonly in the detection target application and the malicious sample paper exists in the malicious sample species, and the probability that the detection target application and the normal sample are common It is possible to judge whether the detected application is similar to one of the malignant specimens by using the probability that the unique information contained therein does not exist in the normal specimen. The probability calculation method of the detection unit 140 can be expressed by Equation (1).

In this case, a is the detection application, Fi is the union of the sample information included in the i-th malignant specimen, k is the unique information, p _k is the ratio of malignant specimen containing the unique information k, The union of sample information contained in one or more normal samples, S (a, Fi), means the similarity between the detection target application and the i-th malignant specimen. A detailed description related to Equation 1 will be described later with reference to FIG.

According to another embodiment of the present invention, when the degree of similarity is equal to or greater than a predetermined threshold value, the detection unit 140 can detect that the detection target application is a malicious code belonging to the malicious sample species, and the threshold value can be adjusted differently have.

Hereinafter, a method for detecting a malicious code by the malicious code detection apparatus will be described with reference to FIGS. 2 to 5. FIG.

2 is a flowchart of a method for detecting malicious code according to an embodiment of the present invention.

First, the malicious code detection apparatus collects species specimen information from the malignant specimen and the normal specimen (S210). For example, the malicious code detection device may detect malicious code or four types of information from the normal sample, namely, a string, a class name, a method name, an API call section, and a bytecode command section as sample information for detecting malicious code Collect. This is because the executable code file (Dalvik Executable (DEX)) of the application used in Android is collected using standard structure information existing in the form of "classes.dex" in the compressed "application name.apk" file (1) ASCII string, (2) Class, Method name string, (3) API call binary string, and (4) Method implementation binary string in the malicious or normal sample. do.

Subsequently, the malicious code detection device refines the sample information and calculates (calculates) the ratio of the unique information (S220, S230). At this time, the malicious code detection device reports one malicious sample inputted or one malicious sample inputted or one or more sample information found in the normal sample as one sample information when there is a plurality of the same kind of sample information, I see it as a bell.

FIG. 3 shows the process of refining and calculating the sample information in more detail.

In the case of purifying the sample information (S220), for example, when there are four malicious samples included in the species 1, all the sample information included in the normal sample is removed from the samples 1 to 4 included in the species 1. That is, the sample information included in the union of the sample information included in one or more normal samples and the union of the sample information included in one or more malicious samples is removed. A more detailed description will be given later with respect to Fig. A malicious sample that has removed this common sample information contains unique information. The same is true for the normal sample.

Next, the ratio of the malignant sample species including each unique information and the ratio of the normal sample species including each unique information are calculated (S230). That is, the ratio is calculated by using the number of malicious samples including unique information in a malignant sample with respect to the number of malicious samples including any one unique information in the entire malignant sample (ratio = (The number of samples in which the information A in the whole sample exists)). For normal specimens, if all normal specimens form one species, the ratio may be a normal specimen count containing any unique information within the entire normal specimen versus the total number of normal specimens. In this case, the ratio can be a weight for each unique information of a species. The ratio (or weight) thus calculated is assigned to each unique information.

FIG. 4 shows an example for explaining the process of refining sample information and calculating the ratio.

One or more malignant specimens (Species 1, 2 and 3) include malignant specimens belonging to each species (malignant specimen 1 and malignant specimen 2), and normal specimens (normal specimen 1 and normal specimen 2) It forms one species. Malicious samples and normal samples include sample information (A, B, C, D, E, F, G, H, I, J, K).

The malicious code detection device removes all the sample information E, F, I, J, and K from at least one normal sample 1 or the normal sample 2 from the malicious sample to generate unique information of the malicious sample at step S220. Therefore, the sample information (E, F) existing in the normal sample is removed from the sample information (A, B, C, D, E, F, G, H) existing in all the malignant sample species. Similarly, all sample information (A, B, C, D, E, F, G, H) existing in one or more malignant specimens is removed from the normal specimen to generate unique information of the normal specimen. Therefore, the sample information (E, F) existing in the normal sample is removed from the sample information (E, F, I, J, K) existing in all the normal sample species. That is, all malicious samples and code information common to all normal samples are removed from each species. As a result, the malignant specimen 1 has unique information (A, D, G), malignant specimen 2 has unique information (B, D, H) Species include unique information (I, J, K).

Subsequently, the ratio of the malicious sample to each unique information existing in each malicious sample is calculated (S230). For example, the unique information D of all malicious samples is included in the unique information D of the malicious sample 1 The number of malignant specimens is 3 (malignant specimen 1 specimen 1 and specimen 2, malignant specimen 2 specimen 1), and malignant specimen specimen 1 contains 2 specimen malignant specimens (malignant specimen 1 Specimen 1 and Specimen 2 of species 1). Therefore, the ratio is calculated as 2/3. For example, the number of malicious samples including unique information H among all malignant specimens is 2 (sample 2 of malignant specimen 2, specimen 1 of malignant specimen 3) , The number of malignant specimens containing unique information H in malignant specimen 2 is 1 (specimen 2 of malignant specimen 2). The remaining information C, G, and H of the malicious sample 1's unique information A, G, malicious sample 2's unique information B, D, and malicious sample 3 are also calculated in the same manner. These ratios (or weights) are given to each unique information.

The normal sample can form one species regardless of the sample. Therefore, when calculating the ratio of the normal sample to the malignant sample, the total number of normal samples is 2 (normal sample 1 and normal sample 2) for the unique information J, and the number of normal samples including the unique information J is 1 Sample 1) Invar, the ratio to unique information J is calculated as 1/2. The remaining unique information I and K are also calculated in the same way. These ratios (or weights) are given to each unique information.

Then, based on the ratio given to each unique information, it is possible to detect that the detected application is a malicious code classified as the corresponding malicious sample by judging which malicious sample is similar to the malicious sample (S240).

According to one embodiment of the present invention, the malicious code detection device detects the probability that the unique information included commonly in the detection target application and the malicious sample paper exists in the malignant sample species, and the probability that the detection target application and the normal sample are included in common We can determine whether the target application is similar to a malignant specimen by using the probability that the unique information is not present in the normal specimen.

According to another embodiment of the present invention, the degree of similarity can be calculated using Equation (1), and it can be determined based on the degree of similarity that it is similar to a malignant sample species.

According to another embodiment of the present invention, when the calculated similarity degree is equal to or greater than a specific threshold value, the detection target application can detect that the similarity is a malicious code belonging to the calculated malignant sample species. This will be described later in detail with reference to FIG.

5 is an example of a method of detecting a malignant sample similar to a detection target application by using a ratio calculated by the malicious code detecting apparatus.

). 악성표본 종 1 및 종 3에 대해서도 이와 같이 유사도를 산출하면, 종 1에 대해서는 0.75, 종 3에 대해서는 0.19의 유사도가 산출된다. 따라서, 탐지대상 응용(a)은 이 중 가장 높은 유사도를 보이는 종 1로 탐지될 수 있다. 다만, 본 발명의 다른 실시예에 따르면, 유사도에 대하여 임계치를 기설정할 수 있고, 유사도가 일정 임계치를 초과한 경우에 대하여 탐지대상 응용(a)이 해당 악성표본 종으로 분류되는 악성코드임을 탐지할 수 있게 된다. According to the embodiment of the present invention, the sample information E and F included in the normal sample and common malicious sample are removed as described above, and based on the remaining sample information (i.e., unique information) It detects similarity with each malignant specimen. For example, in the case of using Equation 1, in detecting similarity with malicious sample 2, malicious sample 2 has a ratio of 2/2 (= 1) to unique information B, (= 0.33) for the characteristic information H, and a ratio of 1/2 (= 0.5) for the malicious sample 2 to the unique information H. The sum of the ratios is 1.83. The specific information contained in the detection target application (a) is A, D, G, and J, and the ratio of the unique information D common to the unique information 2 is 0.33. In order to use the non-similarity between the normal sample and the detection target application (a) in Equation (1), the sum of the ratios of the unique information (I, J, K) existing in the normal sample is 2, ), The ratio of the normal sample to J is 0.5. When this is substituted into Equation 1, the result of 0.14 is derived as follows (

). When the similarity is also calculated for the malignant specimen 1 and the species 3, the similarity of 0.75 for species 1 and 0.19 for species 3 is calculated. Therefore, the application (a) to be detected can be detected as the species 1 having the highest degree of similarity. However, according to another embodiment of the present invention, it is possible to set a threshold value for the degree of similarity, and to detect that the detection target application (a) is a malicious code classified as the malicious sample species when the degree of similarity exceeds a predetermined threshold value .

FIG. 6 is a performance chart for calculating an average detection success rate and an average false rate using a malicious code detection apparatus according to an embodiment of the present invention.

The performance chart of FIG. 6 uses 20 kinds of randomly selected samples from each species using the 4 types of malicious Android specs, 79 specimens and 1,680 normal specimens as the specimen of the unique information and the remaining 80% as the specimen This is the average of the results of 10 experiments.

Table 1 shows a comparison table of the same performance metrics disclosed in previous foreign studies in the same technical field and the performance derived from the experiment of this technique. Accuracy, Precision, and Recall, all of the three performance indicators showed not only improved performance, but also the F-Measure, which is an overall evaluation index of Precision and Recall.

Method Accuracy Recall Precision F- measure AndroGuard 93.04% 49.58% 99.16% 66.11% DroidMat 97.87% 87.39% 96.74% 91.83% Proposed 99.89% 97.73% 99.74% 98.73%

When detecting malicious code among a plurality of applications, the present invention collects malicious code samples and variants thereof in advance, and detects malicious codes accurately and efficiently by using the unique information of the refined species. As a result, It is possible to greatly reduce the number of objects to be directly analyzed and to ultimately protect the user of the mobile device from the risk of infecting the malicious code and to prevent the secondary damage that may be caused by the malicious code infected mobile device.

1 refers to a hardware component such as software or an FPGA (Field Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit), and performs predetermined roles .

However, 'components' are not meant to be limited to software or hardware, and each component may be configured to reside on an addressable storage medium and configured to play one or more processors.

Thus, by way of example, an element may comprise components such as software components, object-oriented software components, class components and task components, processes, functions, attributes, procedures, Routines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables.

The components and functions provided within those components may be combined into a smaller number of components or further separated into additional components.

Each component shown in FIG. 1 may be composed of a 'module'. The term 'module' refers to a hardware component such as software or a Field Programmable Gate Array (FPGA) or an Application Specific Integrated Circuit (ASIC), and the module performs certain roles. However, a module is not limited to software or hardware. A module may be configured to reside on an addressable storage medium and may be configured to execute one or more processors. The functionality provided by the components and modules may be combined into a smaller number of components and modules or further separated into additional components and modules.

One embodiment of the present invention may also be embodied in the form of a recording medium including instructions executable by a computer, such as program modules, being executed by a computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, the computer-readable medium may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes any information delivery media, including computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transport mechanism.

The above-described malicious code detection method according to the present invention can be implemented as computer-readable code on a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording media storing data that can be decoded by a computer system. For example, it may be a ROM (Read Only Memory), a RAM (Random Access Memory), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, or the like. In addition, the computer-readable recording medium may be distributed and executed in a computer system connected to a computer network, and may be stored and executed as a code readable in a distributed manner.

While the methods and systems of the present invention have been described in connection with specific embodiments, some or all of those elements or operations may be implemented using a computer system having a general purpose hardware architecture.

S210: Collecting unique information
S220, S230: Purification and ratio calculation
S240: Detecting malicious code
110:
120: Sample information refinement unit
130: Weight calculation unit
140:

Claims (10)

In a malicious code detection device,
An information extracting unit for collecting malicious samples and normal samples from previously stored or inputted malicious codes and normal codes;
A sample information refinement unit for generating unique information of the malicious sample and the normal sample by removing code information common to the collected malicious sample and the normal sample from the malicious sample and the normal sample;
A weight calculation unit for calculating a weight of each unique information included in the species of the malignant specimen and the species of the normal specimen; And
And a detection unit detecting a malicious code corresponding to the species of the malicious sample to which the detection target application corresponds based on the calculated weight and the probability of one or more unique information included in the detection target application,
The malignant specimen and the normal specimen are classified into one species of one or more malignant specimens and species of a normal specimen,
Wherein the probability of the unique information is calculated based on a weight of each unique information contained in the species of the one or more malign samples and the species of the normal specimen.
The method according to claim 1,
The weight calculation unit may calculate,
The malicious sample including at least one unique information contained in the malicious sample is compared with the number of malicious samples included in the malicious sample, and based on the ratio of the malicious sample including any one of the unique information in the species of the malicious sample, Weights are calculated for each unique information contained in the species,
Wherein the number of normal samples including one of the unique information contained in the normal sample is greater than the number of normal samples included in the normal sample, A malicious code detection device that calculates weights for each unique information contained in a species.
The method according to claim 1,
The detection unit detects,
A probability that the detection target application is included in the species of the malicious sample based on at least one unique information included in the detection target application, and a weight of each unique information included in the species of the malicious sample and the species of the normal sample, And determining whether the detection target application is similar to a malignant sample species by calculating a probability that the detection result is not included in the species of the normal specimen.
The method according to claim 1,
The detection unit detects,
Wherein the malicious code detection apparatus determines whether the detection target application is similar to a malignant sample species using the following equation.
[Mathematical Expression]

a is the detection application, Fi is the union of the sample information contained in the i-th malignant specimen, k is the unique information, p _k is the ratio of the malignant specimen containing the unique information k or the ratio of the normal specimen, W is one or more The union of sample information included in the normal sample, S (a, Fi) is the similarity of the detection target application and the i-th malignant sample species.
5. The method of claim 4,
The detection unit detects,
And detects that the detection target application is a malicious code belonging to the i-th malicious sample species when the similarity degree is equal to or greater than a predetermined threshold value.
In a malicious code detection method,
Collecting malignant and normal specimens from pre-stored or input malicious code and normal code;
Generating unique information of the malignant specimen and the normal specimen by removing code information common to the collected malignant specimen and the normal specimen from the malignant specimen and the normal specimen;
Calculating a weight of each unique information included in the species of the malignant specimen and the species of the normal specimen; And
Detecting a malicious code corresponding to a species of the malicious sample to which the detection target application corresponds based on the calculated weight and one or more unique information included in the detection target application,
The malignant specimen and the normal specimen are classified into one species of at least one malignant specimen and species of a normal specimen,
Wherein the probability of the unique information is calculated based on a weight of each unique information contained in the one or more malignant specimens and the species of the normal specimen.
The method according to claim 6,
The step of calculating the weight includes:
The malicious sample including at least one unique information contained in the malicious sample is compared with the number of malicious samples included in the malicious sample, and based on the ratio of the malicious sample including any one of the unique information in the species of the malicious sample, Weights are calculated for each unique information contained in the species,
Wherein the number of normal samples including one of the unique information contained in the normal sample is greater than the number of normal samples included in the normal sample, A malicious code detection method that calculates weights for each unique information contained in a species.
The method according to claim 6,
Wherein the detecting comprises:
A probability that the detection target application is included in the species of the malicious sample based on at least one unique information included in the detection target application, and a weight of each unique information included in the species of the malicious sample and the species of the normal sample, And calculating a probability that the detection target application is not included in the species of the normal specimen to judge whether the detection target application is similar to a malignant specimen.
The method according to claim 6,
Wherein the detecting comprises:
A malicious code detection method for determining whether a detection target application is similar to a malicious sample using the following equation.
[Mathematical Expression]

a is the detection application, Fi is the union of the sample information contained in the i-th malignant specimen, k is the unique information, p _k is the ratio of the malignant specimen containing the unique information k or the ratio of the normal specimen, W is one or more The union of sample information included in the normal sample, S (a, Fi) is the similarity of the detection target application and the i-th malignant sample species.
10. The method of claim 9,
Wherein the detecting comprises:
And detecting that the detection target application is a malicious code belonging to the i-th malicious sample species when the similarity degree is equal to or greater than a predetermined threshold value.

Images