KR101535503B1 - Method for detecting malware infected terminal based on commercial e-mail - Google Patents

Abstract

Provided is a method for detecting a malicious code infected terminal based on a commercial e-mail, which comprises the steps of: detecting reception information from a received e-mail; identifying a unique reception end area by comparing a domain and removing relays on a receiving side; checking whether a false received field is appeared or not by using a from-by tracking method; checking domains corresponded to ′from′ and ′by′, respectively, in every received filed in order to recognize the number of sending domains except a final reception domain; detecting a sending Internet protocol (IP) according to the number of recognized domains; determining whether the detected sending IP violates a mail transmission agent (MTA) or not; and classifying a type of the mail received through attacking methods used according to whether the false received field is appeared or not, the number of the recognized domains, and whether the MTA is violated or not. According to the present invention, an e-mail address of a sender/receiver, the sender IP, and a mail reception time in a commercial e-mail file are directly extracted and analyzed. The detection performance of the malicious code infected terminal can be increased by classifying the type of the mail received through the attacking methods used according to whether the false received field is appeared or not, the number of the recognized domains, and whether the MTA is violated or not.

Description

[0001] METHOD FOR DETECTING MALWARE INFECTED TERMINAL BASED ON COMMERCIAL E-MAIL [0002]

The present invention relates to a commercial e-mail based malicious code infected terminal detection method for detecting a malicious code infected terminal by directly extracting and analyzing a source / destination e-mail address, a sender IP and a mail reception time in a commercial e-mail file.

Botnet is a huge network of zombie PCs already hacked. Botnets typically allow hundreds to hundreds of thousands of zombie PCs to be remotely controlled via a C & C (Command & Control) server, allowing an attacker to do what they want. One bot is trading in the underground economy for around $ 0.03, with hundreds of thousands of bots being sold for hundreds of dollars. Botnets traded in the underground economy are being exploited to take monetary gain by illegal methods such as DDoS attacks, personal and financial information leakage, illegal spamming, and online fraud.

Botnets are constantly evolving as botnets become a means of being exploited by criminals to attack and accumulate wealth, and the number of PCs infected with bots and falling into zombie PCs is also increasing.

Botnets are used for a variety of purposes such as intimidating DDoS attacks, personal and financial information leakage, illegal spamming, and online fraud for money extortion. In most DDoS attacks, zombie PCs infected by malicious bots are being exploited, and attacks that can be detected most easily by botnets are also DDoS attacks. However, zombie PCs used for DDoS attacks can be easily detected and blocked by ISPs, and a botmaster who attacks DDOS must take the risk of losing his botnet. For this reason, botnets are increasingly being used for spamming, which can make a lot more money than DDoS attacks in recent years, and for which there is little risk to be discovered. One of the most important uses of bots is spamming. Spam Mail Servers are blocked by spam blocking policies such as Real-time Black List (RBL), which requires a large number of new mail servers to send spam. Hosts infected with bots provide a good way to send spam Giving.

Conventional email-based zombie IP and botnet group detection technologies proceed as follows. Initially, we focused on the grounds that can be judged as zombie IP by each originating IP, and judged based on MTA violation, number of received field, number of RBL violation, number of outgoing mail. As Zombie IP was formed to form a botnet group, grouping of URLs contained in the body of the email was conducted to investigate botnet group detection schemes and analysis and verification of zombie IP distribution patterns in the same botnet group.

Conventional e-mail-based zombie PC detection systems detected zombie PCs targeted at spam mails (EML files) that were preprocessed in spam traps. Spam traps analyze the header information of spam mails that come into the virtual accounts that the system has, and generate additional headers. The specificity of the EML file extracted from the spam traps is convenient for extracting data based on the detection of the zombie PC. However, in the conventional zombie PC and botnet group detection system designed according to the above, the limit to process the spam mail extracted from the commercial mail server .

Disclosure of Invention Technical Problem [8] Accordingly, the present invention has been made keeping in mind the above problems occurring in the prior art, and it is an object of the present invention to provide an e-mail system capable of detecting malicious- And to provide a method of detecting a code-infected terminal.

According to an aspect of the present invention, there is provided a method for detecting a malicious infected terminal based on a commercial e-mail, comprising the steps of: receiving commercial e-mail and extracting reception information; The method comprises the steps of extracting an IP (Internet Protocol) address, confirming whether the domain address of the source IP address matches the sender domain address, and if the domain address of the source IP address and the source domain address of the commercial e- And detecting the terminal of the source IP as an infected terminal.

A method for detecting a malicious e-mail infected terminal based on commercial e-mail according to another embodiment of the present invention includes detecting received information from a received e-mail, removing a relay on the receiving side by comparing domains, Checking whether there is a false received field by using the from-by tracking technique, identifying a domain corresponding to from and a domain corresponding to by from all received fields, Determining a number of domains, detecting an internet protocol according to the number of identified domains, determining whether the detected source IP is a violation of a mail transfer agent (MTA) Mail is received according to an attack technique according to the presence or absence of the false received field, the number of identified domains, and the violation of the MTA And sorting that type.

The present invention extracts and analyzes the sender / receiver e-mail address, the sender IP, and the mail reception time directly from the commercial e-mail file, and analyzes the attack information according to the existence of the false received field, the number of identified domains, Thus, by classifying the type of incoming mail, malicious code infected terminal detection performance can be improved.

In order to detect a zombie terminal in a commercial e-mail, and to prevent an additional cyber attack using a zombie terminal, the present invention supplements a conventional outbound IP extraction algorithm and analyzes zombie terminal detection results thereof. Accordingly, the present invention can detect the zombie IP based on the e-mail received from the mail server of the main portal and the enterprise to block the inflow of the spam mail.

1 is a block diagram of a malicious-code-infected terminal detection system according to the present invention;
FIG. 2 is a flowchart illustrating a malicious-code-infected terminal detection method according to a first embodiment of the present invention; FIG.
FIG. 3 is a flowchart of a source IP extraction process shown in FIG. 2; FIG.
4 is a flowchart illustrating a malicious-code-infected terminal detection method according to a second embodiment of the present invention.
FIG. 5A illustrates a header of a normal mail; FIG.
FIG. 5B is a diagram illustrating a mail header via an open relay server; FIG.
FIG. 6 is a table on the attack type and type-specific incidence of e-mail based malware according to the present invention.
7 shows an example and characteristic of a type 1 inflow path.
8 shows an example and characteristic of a type 2 funnel.
9 shows an example and characteristic of a type 3 funnel.
10 shows an example and characteristic of a type 4 inflow path.
11 shows an example and characteristic of a type 5 inflow path.
12 shows an example and characteristic of a type 6 inflow path.
13 shows an example and characteristic of a type 7 funnel.
14 shows an example and characteristic of a type 8 funnel.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a malicious code infected terminal detection system according to the present invention.

1, a malicious code-infected terminal detection system 1 according to the present invention includes an email receiving unit 10, an originating IP (Internet Protocol) extracting unit 20, a detecting unit 30, a database 40, . ≪ / RTI >

The e-mail receiving unit 10 receives the e-mail from the commercial e-mail server, and parses the header of the e-mail to extract the received information. Here, the e-mail may be an EML (Electronic Mail Log) file, which is an RFC-822 standard mail file format, and the received information means a Received field included in header information of the e-mail.

The originating IP extracting unit 20 extracts the originating IP using the reception information transmitted from the e-mail receiving unit 10. The source IP extracting unit 20 confirms whether the received information satisfies a set condition. For example, the source IP extracting unit 20 checks whether the sender and receiver information and the initial address specification information exist in the received information. Here, the sender information and the receiver information are the sender domain address and the receiver domain address respectively extracted from the "from" and "to" items of the reception field. The initial address specification information is an initial form extracted from the for field of the reception field.

The source IP extracting unit 20 checks the sender information included in the received information if the received information satisfies the set condition, and extracts the sender information as the source IP address if the sender information is an IP address.

On the other hand, if the received information does not satisfy the set condition, the source IP extracting unit 20 searches for the highest received information having the sender information. Then, the source IP extracting unit 20 confirms the sender information of the searched reception information. The source IP extracting unit 20 extracts the sender information as the source IP address if the source information is an IP address.

If the calling party information is not an IP address, the calling IP extracting unit 20 inquires the IP address corresponding to the calling party information and extracts the calling IP address.

The detecting unit 30 compares the domain address of the source IP address extracted by the source IP extracting unit 20 with the sender domain address. Here, the detection unit 30 interprets the extracted source IP address as a domain address corresponding to the extracted source IP address through the PTR (Pointer DNS Record) inquiry.

If the PTR inquiry result of the extracted originating IP address does not match the sender domain address, the detection unit 30 determines that the mail transfer agent (MTA) violation is violated and sends the terminal of the extracted originating IP address to the malicious code infected terminal Detect.

On the other hand, the detection unit 30 detects the terminal having the extracted source IP address as a malicious code-infected terminal even when the PTR inquiry result of the extracted source IP address does not exist.

The database 40 may store a lookup table including mapping information of an IP address and a domain address and a black list including an IP address of the infected terminal.

FIG. 2 is a flowchart of a malicious code scanning terminal detection method according to the first embodiment of the present invention, and FIG. 3 is a flowchart of a source IP extraction process shown in FIG.

The e-mail receiving unit 10 according to the present embodiment first receives commercial e-mail from a commercial e-mail server (S11). The e-mail receiving unit 10 extracts the received information contained in the header information of the received commercial e-mail.

The source IP extracting unit 20 extracts the source IP address from the commercial e-mail using the reception information output from the e-mail receiving unit 10 (S12).

In order to extract the source IP, the source IP extracting unit 20 analyzes the received information of the commercial e-mail as shown in FIG. 3 and confirms whether the received information satisfies the set conditions (S121, 122). Here, the set condition means whether the sender domain address (from item), the receiver domain address (to item), and the initial address specification information (for item) exist in the reception information.

When the reception information satisfies the set condition, the source IP extracting unit 20 confirms whether the sender information included in the received information (the content of the from item) is an IP address (S123, S126).

On the other hand, if the received information does not satisfy the set condition, the source IP extracting unit 20 searches the highest received information having the sender information (S124). Then, the source IP extracting unit 20 confirms whether the sender information included in the searched highest received information is an IP address (S125, S126).

In step S126, if the sender information of the received information or the highest received information is an IP address, the source IP extracting unit 20 extracts the sender information as a source IP (S127).

In step S126, if the sender information of the reception information or the highest order reception information is not an IP address, the source IP extracting unit 20 retrieves the IP address corresponding to the sender information through the lookup table and extracts it as a source IP (S128). For example, if the sender information of the received information or the highest received information is a domain address, the source IP extracting unit 20 queries the IP address mapped to the sender information.

The detection unit 30 checks whether the PTR inquiry result (domain address) of the source IP extracted by the source IP extracting unit 20 matches the sender domain address of the commercial e-mail (S13). At this time, the detection unit 30 performs a PTR inquiry about the extracted originating IP. If the PTR inquiry result does not exist, the detecting unit 30 detects the terminal of the source IP address as the infected terminal.

If the PTR inquiry result and the sender domain address do not match, the detection unit 30 detects (judges) the terminal of the source IP as an infected terminal (S14).

On the other hand, if the PTR inquiry result matches the sender domain address, the detection unit 30 determines the terminal of the source IP as a normal terminal (S15).

As described above, the present invention compares the domain of the sender's address with the PTR inquiry result of the originating IP, and if the PTR is not inquired or inconsistent, it can be determined as a violation of the MTA and detected as a zombie terminal. In order to improve the occurrence of false positives when the originating IP is extracted from the "from" field of the reception field existing at the top of the mail header, the originating IP from the "from" entry of the Received field including the "from" Extract it and designate it as originating IP. Therefore, the present invention can prevent a case where a normal mail is erroneously judged as an MTA violation.

[Table 1] shows a total of 87 mail samples (8 normal emails and 79 spam mail). As a result, all the normal mail except one exception mail included from / by / for items of Received field In exceptional cases, exception handling is possible if the sender sends a message to itself via webmail.

division Number of messages Remarks from / by / for
If the Received field is present 16 Normal: 7
Spam: 9 from / by / for
If there is no Received field 70 Spam only: 70 [Exceptions]
If the Received field itself is missing One Top 1

If all the from / by / for items are present in the Received field as in the above Table 1, it is possible to prevent a case in which the IP address is extracted from the from field of the corresponding field, .

Recently, the e-mail spamming technique that can be found is summarized as three methods: Direct-To-MX and outgoing domain forgery method, fake received field addition method, and open relay vulnerability utilization method.

The direct-to-MX and outbound domain falsification method is a method of directly transmitting to a receiving mail server without passing through a mail server which relay in the middle, and can use its own mail server or can perform a DNS lookup You use a zombie host. Attackers prefer this method because they can be used to hide traffic from ISPs (Internet Service Providers) used to send mail, to make it harder to detect the origin of mail, or to target specific domains This is because the originating domain can be falsified.

Direct-To-MX and outbound domain falsification methods are currently the most used attack techniques among e-mail spam sending methods, but they are easily detected at the receiving end and can not hide the origin of the mail. ), There are not many recipients who know that the sending domain is easily forged.

The method of adding a false Received field is a method of inserting a false Received field into an email header. Attackers prefer this method because they want to hide the origin of the mail, or to target a specific domain as a destination.

Although the method of adding a false Received field is relatively common as an attack technique, fake headers are easy to detect and process, and some of the mail header analysis tools (eg SpamCop, etc.) can detect forged headers.

The method of exploiting the above-mentioned Open Relay vulnerability is a method of exploiting a server in which a relay function is activated due to an administrator's fault, that is, a mail server having a weak security as an intermediate server. Attackers prefer this method because they can hide abnormal transmission of spam by way of a normal server and reduce the cost of sending spam.

The use of Open Relay vulnerabilities is often used, but is rarely used in recent spam attacks because it is easy to detect open relay servers. Since 2001, its use has decreased, due to other attack methods (eg, open proxy, botnet, etc.), open relay prevention programs, and open relay blacklist management. Recently, however, It is not used.

4 is a flowchart illustrating a malicious-code-infected terminal detection method according to a second embodiment of the present invention.

In the case of a normal mail, if the originating IP is extracted from the upper received field as in the conventional method, a problem of false positives may occur. It is necessary to solve the problem that it is difficult to extract the accurate originating IP due to the receiving server relay. The solution is to compare the domains and remove the relay on the receiving side. By removing the receiver side relay, a unique receiving end area can be identified.

As shown in FIG. 4, when the email receiving unit 10 receives the mail, the detecting unit 30 according to the present embodiment first compares the domains and removes the relay on the receiving side, Identify regions. (S210)

The detection unit 30 compares domains corresponding to by of the upper received field of the mail. If the domain corresponding to by the upper received field and the domain corresponding to by of the lower received field are inconsistent, the source IP extracting unit 20 extracts the source IP that has arrived at the receiving server from from the upper received field .

5A illustrates a header of a normal mail.

(E.g., naver.com) corresponding to by of the upper received field and a domain corresponding to by of the lower received field (e.g., kisa.or.kr (211.252.150.22)), as illustrated in the header of Fig. 5A, The source IP extracting unit 20 can extract the source IP (e.g., 211.252.150.22) that has arrived at the receiving server from from the upper received field.

For the extracted source IP, the detection unit 30 confirms the existence of the false received field using the from-by tracking technique, and removes the confirmed false received field. (S220)

Since the attacker adds the false received field inputted at the lower end, it is difficult to extract the accurate originating IP, so the detecting unit 30 removes the false received field using the from-by tracking technique.

The by-by tracking scheme identifies the presence or absence of a false received field by comparing the domain (or IP) corresponding to from of the upper received field with the domain (or IP) corresponding to the by of the lower received field.

The detection unit 30 compares the domain (or IP) corresponding to from of the upper received field with the domain (or IP) corresponding to the by of the lower received field according to the from-by tracking scheme, (Tracking = '0') (S240). If they are different from each other, it is determined that the mail is a mail added with a false received field (Tracking = '1'). If the compared domains (or IPs) are different from each other according to the from-by tracking technique, the corresponding mail is in violation of from-by tracking, and the detection unit 30 deletes the false received field at the bottom. (S230)

The detection unit 30 identifies a unique domain by comparing the domain corresponding to from and the domain corresponding to by of all received fields by applying the from-by tracking scheme, Know the number. (S250)

At this time, if the number of source domains excluding the final reception domain is two, the detection unit 30 extracts the source IP of the destination side of the destination server through the source IP extracting unit 20 (S290), and determines whether the MTA is in violation . (S300)

If it is determined that the source IP address of the receiving server is in violation of the MTA, it means that the mail has been transmitted as an attack method based on the Direct-To-MX method and the Open Relay vulnerability exploiting method. Extracts a source host IP existing in the lowest received field of the received message and classifies the corresponding mail as type 4 (case 4) or type 8 (case 8) in FIG. (S310 to S320) FIG. 6 is a table about the attack type and type-specific incidence of the e-mail based malicious code according to the present invention.

If there is no false received field in the mail header (Tracking = '0'), the mail is classified as type 4, and if there is a false received field (Tracking = '1'), it is classified as type 8. Fig. 10 is a view showing an example and characteristic of a type 4 inflow path, and Fig. 14 is a view showing a type 8 inflow path example and characteristics.

If it is determined in step S300 that the originating IP address of the receiving server is not an MTA violation, the detecting unit 30 classifies the mail into a type 1 (case 1) or a type 5 (case 5). (S330). Then, the source host IP in the lowest received field of the corresponding mail is extracted. (S340) FIG. 7 is a view showing an example and characteristic of a type 1 inflow path, and FIG. 11 is a view showing a type 5 inflow path example and characteristics.

If the false received field does not exist (Tracking = '0'), the corresponding mail is classified into type 1 in step S330, and if the false received field exists (Tracking = '1' .

FIG. 5B illustrates a mail header via the open relay server.

In the case of the mail header shown in FIG. 5B, the number of sending domains except for the final receiving domain (e.g., " kisa.or.kr (211.252.150.22) ") is 2 (e.g.," incheon.ac.kr " , "176.61.136.155"), the corresponding mail is not in violation of from-by tracking (Tracking = '0') and classified as type 4.

If the number of source domains excluding the final reception domain is one in step S250, the detection unit 30 extracts the source IP in the front end of the reception server through the source IP extracting unit 20. [ (S260) and confirms that it is an MTA violation. (S270)

If the number of sending domains except for the final receiving domain is one, it means that the mail is imported as an attack method by the Direct-To-MX method, and the detecting unit 30 classifies the mail as type 2 or type 6 . (Tracking = '0'), the corresponding mail is classified as type 2, and when there is a false received field (Tracking = '1'), the mail is classified as type 6 do. Fig. 8 is a view showing an example and characteristic of the inflow path of type 2, and Fig. 12 is a diagram showing the inflow path example and characteristics of type 6.

If the number of sending domains except for the final receiving domain is three or more in step S250, the detecting unit 30 extracts the second calling IP from the end through the calling IP extracting unit 20. [ (S350) and confirms that it is not an MTA violation. (S360). The second originating IP from the end means the second IP in the lower part of the received field, and extracts the IP (original originating server IP) of the originating server before being sent to the server having the open relay vulnerability shown in FIG. .

If the number of sending domains except for the final receiving domain is three or more, it means that the corresponding mail has flowed into the method of utilizing the open relay vulnerability, and the detecting unit 30 classifies the corresponding mail as type 3 or type 7. (S370). Then, the source host IP in the lowest received field of the corresponding mail is extracted. (S380)

If a false received field does not exist in the mail header (Tracking = '0'), the corresponding mail is classified into type 3 in step S370. If there is a false received field (Tracking = '1' . Fig. 9 is a view showing an example and characteristic of a type 3 inflow path, and Fig. 13 is a view showing a type 7 inflow path example and characteristics.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative and not restrictive.

The scope of the present invention is defined by the appended claims, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included within the scope of the present invention.

As described above, the present invention extracts and analyzes the origination / destination e-mail address, the sender IP, and the mail reception time directly from the commercial e-mail file, and analyzes the existence of the false received field, the number of identified domains, It is possible to improve the detection performance of the malicious code infected terminal by classifying the type of the incoming mail according to the attack technique.

In order to detect a zombie terminal in a commercial e-mail, and to prevent an additional cyber attack using a zombie terminal, the present invention supplements a conventional outbound IP extraction algorithm and analyzes zombie terminal detection results thereof. Accordingly, the present invention can detect the zombie IP based on the e-mail received from the mail server of the main portal and the enterprise to block the inflow of the spam mail.

10: Email Receiver
20: Originating IP extracting unit
30:

Claims (16)

delete delete delete delete delete delete delete delete Detecting received information from the received e-mail;
Identifying a unique receiving end area by removing the receiving end relay by comparing domains corresponding to by of the upper received field of the email,
confirming the presence or absence of a false received field using the from-by tracking technique,
Identifying the domain corresponding to from and the domain corresponding to of all received fields and identifying the number of originating domains excluding the final receiving domain;
Detecting an internet protocol (IP) according to the number of the identified domains;
Determining whether the detected originating IP is a mail transfer agent (MTA) violation;
And classifying the type of the incoming mail according to an attack technique according to the presence or absence of the false received field, the number of identified domains, and the violation of the MTA. Terminal detection method.
10. The method of claim 9, wherein the step of verifying the presence or absence of the false received field
The domain corresponding to from of the upper received field is compared with the domain corresponding to by of the lower received field, and if the compared two domains are different from each other, it is determined that the mail is a mail added with a false received field (Tracking = '1') Wherein the malicious code is a malicious code.
10. The method of claim 9,
Detecting the originating IP address of the receiving server if the number of the identified domains is two;
Extracting a source host IP existing in a lowest received field of a corresponding mail if the detected source IP is an MTA violation and the false received field exists, and extracting the target mail by a Direct-To-MX method, an open relay vulnerability utilization method, And classifying it as an inflow by an attack method by a method of adding a false received field,
If the detected source IP is an MTA violation and the false received field is not present, the step of classifying the detected mail as an attack based on an attack method using a Direct-To-MX method and an Open Relay vulnerability utilizing method Based malicious code infected terminal detection method.
12. The method of claim 11,
Classifying the detected mail as a normal mail if the detected outgoing IP is not an MTA violation and the false received field is not present;
If the detected source IP is not an MTA violation and the false received field exists, classifying the received mail as an attack by an attack method by a method of adding a false received field,
And extracting an originating host IP existing in a lowest received field of the corresponding e-mail.
10. The method of claim 9,
Detecting the originating IP address of the receiving server when the number of the identified domains is one,
Confirming that the detected originating IP is an MTA violation;
If the false received field does not exist, categorizing the mail as an entry into the attack method by the Direct-To-MX method,
If the false received field exists, the step of classifying the received mail as an attack by an attack method by a Direct-To-MX method and a method of adding a false received field comprises: Code infected terminal detection method.
10. The method of claim 9,
Detecting a second outgoing IP from the end if the number of identified domains is three or more,
Confirming that the detected originating IP is not an MTA violation;
If the false received field does not exist, categorizing the mail as an attack based on an attack method using an Open Relay vulnerability method;
If the false received field is present, classifying the mail as an inflow into an attack method based on an open relay vulnerability utilization method and a false reception field addition method;
And extracting an originating host IP existing in a lowest received field of the corresponding e-mail.
10. The method of claim 9, wherein determining the number of source domains comprises:
The method comprising: comparing a domain corresponding to from of all received fields with a domain corresponding to by identifying a unique domain and identifying the number of originating domains excluding the final receiving domain; Detection method.
10. The method of claim 9, wherein determining whether the MTA violation is performed comprises:
Comparing the PTR (Pointer DNS Record) inquiry result of the detected source IP address with the sender domain address, and if not, determining that the MTA violation is detected.

Images