KR101530530B1 - Apparatus and Method for Detecting Malicious Process Execution in a Mobile Terminal - Google Patents

Abstract

The present invention relates to a system and method for detecting a malicious process executed in a mobile terminal in real time or periodically.
The malicious process execution detection system of the mobile terminal according to the present invention includes a running process information collecting unit for collecting information about a process running on the Android operating system and a process information collecting unit for storing process information during execution, A parser for receiving the log data from the log manager and extracting the process information from the log data; a parser for extracting the process information extracted from the parser and the process stored in the process information storage unit And a malicious code detecting unit for detecting whether the newly executed process is a malicious code or not.

Description

TECHNICAL FIELD The present invention relates to a malicious process execution detection system and a malicious process execution detection method in a mobile terminal,

The present invention relates to a malicious process execution detection system and method of a mobile terminal, and more particularly, to a system and method for detecting a malicious process executed in a mobile terminal in real time or periodically.

Recently, a widely used mobile terminal is called a smartphone as a mobile phone that provides advanced functions such as a PC, such as being able to use various programs and data by using an operating system, and to continuously add and delete programs. Mobile terminals with these functions provide a standardized interface and platform for applications. In addition to being able to connect to the Internet using wireless Internet, mobile terminal users can create or purchase various functions (free or paid) It is possible to optimize the mobile terminal to be used in accordance with its use pattern. In recent years, financial transactions and internet shopping transactions using mobile terminals have been rapidly increasing due to the launch of applications for mobile terminals at financial institutions and Internet shopping malls, and various important personal information is stored in mobile terminals.

As the use of mobile terminals such as smart phones increases, malicious codes targeted to mobile terminals are also rapidly increasing, and attack methods of malicious codes are also diversifying. For example, numerous malicious codes such as mobile viruses, worms, Trojans, and spyware have been produced and distributed, and the spread of such malicious codes soon leads to the leakage of personal information of a mobile terminal and damage to financial transactions.

Accordingly, there is a need for a security method for detecting malicious code on a mobile terminal. Conventionally, malicious code detection method of a mobile terminal has dedicated a malicious code detection method of a conventional PC, and a malicious code is detected by periodically inspecting a process list with respect to an application already executed in the mobile terminal. Such a malicious code detection method has a problem that it can not accurately detect when malicious code is executed, and also inspects all the processes continuously executed at a designated time, thereby causing a problem of deteriorating performance of a mobile terminal and battery consumption.

In order to solve such a problem, Korean Patent Registration No. 1256461, entitled " Apparatus and Method for Determining Process Execution Time ", discloses an apparatus for detecting execution of an application executed in a portable terminal, And a file monitoring unit for monitoring whether or not the process execution information recorded in the process information file is changed and detecting a process execution time of the application.

This prior patent collects application information previously installed in the portable terminal, detects the time when the application of the collected information is executed, and performs malicious code diagnosis for the application at the time of execution of the process. That is, in this prior patent, when the application information installed in the portable terminal is collected, the execution time of the application can be detected, and it is possible to diagnose whether or not the process is malicious code at the time of execution of the process.

However, such prior patents have a problem in that, for an application that is installed in the portable terminal for the first time and the information is not collected, the execution time can not be detected until information about the application is collected.

SUMMARY OF THE INVENTION It is an object of the present invention to solve the problems of the prior art described above by providing a mobile terminal capable of detecting an execution process of a corresponding application even before collecting information on an application newly installed in the mobile terminal, A malicious process execution detection system and method.

In order to accomplish the above object, the malicious process execution detection system of the mobile terminal according to the present invention includes: a process information collecting unit for collecting information about a process running on the Android operating system; A parser for receiving log data from the log manager and extracting the process information from the log data, a parser for extracting the process information extracted from the parser, A process comparator for comparing the previously stored process information with the information stored in the information storing unit and extracting the newly executed process information; and a malicious code detecting unit for detecting whether the newly executed process is malicious code.

The malicious process execution detection method of the mobile terminal according to the present invention is a malicious process execution detection method of a malicious process execution detection system installed in a mobile terminal, the malicious process execution detection method comprising: A second step of the malicious process execution detection system storing the execution process information collected in the first process in the process information storage unit during execution; A malicious process execution detection system compares the process information extracted in the third process with the process information stored in the second process and extracts the process information from the log data, Process information Shipping is characterized in that the fourth step with the malignant process run detection system including a fifth step in which the new run of the process detecting whether the infection.

As described above, according to the present invention, the process information is collected in the mobile terminal, the malicious code of the collected process is diagnosed and stored in the execution process list, and the process information is extracted from the log data input from the log manager There is an advantage that a malicious process newly installed and executed in the mobile terminal can be detected by collecting and updating the execution process list, detecting a newly executed process and diagnosing whether or not the malicious code is detected.

FIG. 1 is a view schematically showing a general Android structure to which the present invention is applied.
2 is a block diagram showing a malicious process execution detection system of a mobile terminal according to the present invention.
3 is a flowchart illustrating a malicious process execution detection method of a mobile terminal according to the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a malicious process execution detection system and method of a mobile terminal according to the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a view schematically showing a general Android structure to which the present invention is applied.

The Android operating system (OS) 11 runs on the Linux kernel 12 and includes C / C ++ libraries used in various Android system components. The Android operating system 11 includes an operating system and middleware, a user interface, and standard applications (web browser, email client, short message service (SMS), multimedia message service (MMS), etc.) for portable devices including mobile phones There is a software stack and a mobile operating system. The Android operating system (11) allows developers to write applications in the Java language and provides a runtime library to run compiled bytecode. It also provides various tools and APIs for developing applications through the Android Software Development Kit (SDK).

The Android operating system 11 executes the applications 14-1, 14-2 and 14-3 written in Java via the Davic Virtual Machines 13-1, 13-2 and 13-3 in a separate process As shown in FIG. All of the Android applications 14-1, 14-2, and 14-3 are virtual machines in the form of register machines. The virtual machines 13-1, 13-2, 13-2, 13-3), it operates in its own process with its own instance, and access to the resource area other than the area allocated to itself is limited. These virtual machines (13-1, 13-2, 13-3) are virtual machines (VMs) optimized for embedded terminals, and can store memory protection, garbage-collection, .

The Dalvik virtual machines 13-1, 13-2 and 13-3 use the respective garbage collectors 13a, 13b and 13c to store the memory allocated to each of the applications 14-1, 14-2 and 14-3 When the memory is insufficient, the garbage collection is executed, and the memory occupied by the object, which is no longer referred to by the application, is retrieved and secured in an allocatable state. The Dalvik virtual machines 13-1, 13-2 and 13-3 generate log data each time the garbage collectors 13a, 13b and 13c are driven. The log data includes time, a process identifier PID ), A tag, and a message. This log data is received in the log manager 15 of the Android operating system 11. [ In the embodiment of the present invention, the log manager 15 is described as receiving log data from the garbage collector. However, the present invention is not limited thereto, and log data may be received from a log generator corresponding to another mobile operating system.

2 is a block diagram showing a malicious process execution detection system of a mobile terminal according to the present invention.

The present invention is applied to the above-described Android environment. The malicious process execution detection system 20 of the mobile terminal according to the present invention is created as an APK file, and is downloaded to a mobile terminal as a method of installing an application of a typical Android mobile terminal Respectively. Then, the malicious process execution detection system 20 operates in the Dalvik virtual machine 20a on the Android operating system 11.

The malicious process execution detection system 20 according to the present invention includes a process information collecting unit 21 for collecting information on processes currently running on the Android operating system 11 and a process information collecting unit 21, A parsing unit 23 for receiving log data from the log management unit and extracting process information from the received log data, A process comparator 24 for comparing the process information extracted in the process information storage unit 22 with the process information stored in the process information storage unit 22 to extract newly executed process information, And a malicious code detecting unit 25 for detecting malicious code.

The process comparator 24 updates the newly executed process information to the in-process information storage unit 22. [ The process information collecting unit 21 periodically runs the process information collecting unit 21 and the process comparing unit 24 compares the process information collected in the process information collecting unit 21 during execution with the process information stored in the process information storing unit 22 ), And extracts the newly executed process information. The process information preferably uses a process identifier (PID). Updates the process information storage unit 22 during execution according to the periodical driving of the process information collecting unit 21 during execution so that the terminated process is removed from the list and the newly created process is added to the list. The malicious code detection unit 25 can apply a conventional malicious code detection method, and can apply a signature comparison method, a heuristic method, or the like.

3 is a flowchart illustrating a malicious process execution detection method of a mobile terminal according to the present invention. The malicious process execution detection method of the malicious process execution detection system of the mobile terminal according to the present invention will be described with reference to FIG.

First, when the malicious process execution detection system according to the present invention is activated in the mobile terminal, the process information collection unit 21 during execution collects the process information currently being executed in the mobile terminal, and the malicious code detection unit 25 collects The malicious code is detected for the currently executed process (S31). Here, the malicious code detection unit 25 can apply a conventional malicious code detection method.

Next, the process information storage unit 22 stores the collected process information during execution (S32).

As a plurality of processes are executed and terminated in the mobile terminal, log data is collected from the garbage collectors of all Dalvik virtual machines in the log manager 15 of the Android operating system 11, as described in FIG. The parsing unit 23 extracts the process information by receiving and parsing the log data stream from the log management unit 15 (S34).

The process comparing unit 24 compares the process information extracted from the log data with the process information currently being stored in the step S32 (S35) through the step S34, and compares the newly executed process (S36), and updates it to the process information storage unit during execution.

The information on the newly executed process can be detected in real time through the steps S33 to S36 described above and the presence or absence of the malicious code is detected with respect to the newly executed process so that the real- It is possible.

On the other hand, if steps S33 to S36 are repeatedly performed, the number of processes to be compared with the process information extracted from the log data increases as the process list stored in the process information storage unit during execution increases, It takes time.

In the present invention, the process information collection unit 21 is periodically executed to update the process information storage unit 22 during execution so that the terminated process is removed from the process list during execution.

When the detection cycle comes (S37), the process information collecting unit 21 is executed to collect the process information during execution (S38), and updates the process information storage unit during execution based on the newly collected in-process information , And detects whether or not the newly executed process is a malicious code (S39).

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiments, it is to be understood that the invention is not limited to the disclosed embodiments. In addition, it is a matter of course that various modifications and variations are possible without departing from the scope of the technical idea of the present invention by anyone having ordinary skill in the art.

20: malicious process execution detection system 20a: Dalbig virtual machine
21: Process information collecting part during execution 22: Process information storing part during execution
23: parsing section 24: process comparing section
25: malicious code detection unit

Claims (6)

A running-process-information collecting unit for collecting information about a process running on the Android operating system,
An execution-process-information storage unit for storing a list of processes in execution based on the process information collected during the execution;
A parser for receiving log data from the log manager and extracting the process information from the log data,
A process comparator for comparing the process information extracted by the parser with the process list and extracting the newly executed process information based on the log data,
And a malicious code detecting unit for detecting whether the newly executed process is a malicious code,
Wherein the process information collection unit is periodically executed and periodically updates the process information storage unit during the execution so that the terminated process is removed from the process list. The malicious process execution detection system according to claim 1, wherein the process comparison unit adds the newly executed process information to the running process list. delete A malicious process execution detection method of a malicious process execution detection system installed in a mobile terminal,
A first step of the malicious process execution detection system collecting information on a process running on the Android operating system;
A second step of the malicious process execution detection system storing a running process list in a process information storing unit during execution based on the running process information collected in the first step;
A third step of the malicious process execution detection system receiving log data from the log manager and extracting process information from the log data;
A fourth step of the malicious process execution detection system comparing the process information extracted in the third step with the execution process list and extracting the newly executed process information based on the log data;
And a fifth step of the malicious process execution detection system detecting whether the newly executed process is a malicious code,
Wherein the first and second steps are performed periodically to periodically update the process information storage during execution so that the terminated process is removed from the running process list. 5. The method of claim 4, wherein the fourth step adds the newly executed process information to the running process list. delete

Images