KR101589652B1 - System and method for detecting and inquiring metamorphic malignant code based on action - Google Patents

Abstract

Disclosed are a system and a method for detecting and inquiring a metamorphic malignant code based on action. According to the present invention, the system comprises: a malignant code analysis system which extracts application program interface (API) call information which a malignant code calls by performing a malignant code doubt execution file, and detects the malignant action of the malignant code by using the extracted API call information; and an action classification system which generates action codes by matching between stored action classification rule information and the malignant action of a malignant cold provided from the malignant code analysis system, and generates an action group where malignant codes included in the same action group are grouped by using the action code. Thereby, a metamorphic malignant code of which a part is mutated is effectively detected.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a malicious code variant detection system,

The embodiments are directed to a behavior-based malware variant detection and query system and method for detecting and querying malicious variant malicious code.

The security product performance assessment agency checked the malware and found that more than 100 million new malicious code was detected by October 2014.

In order to respond quickly to such rapidly growing malicious codes, studies are being actively conducted to automate malicious code analysis.

Recently, a system for automatically analyzing malicious code behavior at the kernel level has been proposed.

However, the existing malware detection system has been unable to analyze detailed behavior because it only monitored basic action events such as files, registers and processes.

Moreover, there was an increasing number of variants of malicious code that changed some code included in malicious code.

Korean Patent Publication No. 2012-0124638, publication date: November 14, 2012 Title of the invention: an action-based malware detection system and malicious code detection method.

It is an object of the present invention to provide a behavior-based malicious code variant detection system and method for detecting malicious code of malicious code by extracting API call information called by malicious code.

It is another object of the present invention to provide an action-based malicious code variant detection system and method for extracting an action code and an action group that classify a malicious action belonging to the same group that can recognize the variant malicious code type.

In addition, the embodiments have another object to provide a behavior-based malicious code variant inquiry system and method for inquiring malicious behavior and variant malicious codes.

According to an embodiment of the present invention, a malicious suspicious execution file is executed to extract application program interface (API) call information called by malicious code, and malicious code malicious behavior is detected using the extracted API call information Malicious code analysis system; And malicious code of malicious code provided from the malicious code analysis system and malicious code of malicious code provided by the malicious code analysis system and previously stored malicious code classification rule information and generates malicious code belonging to the same malicious code group by using the malicious code, An action-based malware variant detection and inquiry system including a behavior classification system for generating a malicious code is provided.

Here, the malicious code analysis system may collect the malicious suspicious execution file from a network traffic sensor connected to the network.

The malicious code analysis system may further include a malicious suspicious execution file, first API call information, and a first database for storing malicious malicious code of the malicious code.

In addition, the malicious code analysis system can extract API call information called by the malicious code through API hooking on the user level and the kernel level.

In addition, the malicious code analysis system can detect the malicious behavior by applying the malicious code rule set in advance to the API call information.

Also, the malicious code analysis system may apply the malicious code rule set including the hooking filtering.

In addition, the malicious code analysis system can detect the malicious behavior including virtualization malicious activity and real-time malicious activity.

The behavior classification rule information includes an API number for identifying the action information according to the call of the API call information and the API included in the action rule of the action information, A parameter which is an object to be referred to for performing the action; A parameter value that is an actual value of the object, an associated API that is called together when the corresponding API is called; And a flag identifying whether the action is to be invoked with the associated API to match the action.

In addition, the behavior classification system may extract an API sequence using a malicious code list that collects the malicious codes included in the generated action group.

In addition, the behavior classification system can generate bit codes (1, 0) for each of the behavior codes through the coincidence between the extracted API sequence and the unit behavior in the behavior classification rule information.

In addition, the behavior classification system may include a second database for storing the behavior code, the action group, the malicious code list, the API sequence, and the bit code.

The malicious code variant detection and inquiry system further includes a malicious code inquiry system for inquiring information stored in the first and second databases and performing a combination and calculation of the information for verifying the variant malicious code .

According to another embodiment of the present invention, there is provided a malicious code analysis method comprising the steps of: (a) extracting application program interface (API) call information called by a malicious code from a malicious code analysis system after executing a malicious suspicious execution file; (b) detecting malicious behavior for the malicious code in the malicious code analysis system using the extracted API call information; (c) generating behavior codes in the behavior classification system through matching between the detected malicious behavior and pre-stored behavior classification rule information; And (d) generating a group of malicious codes belonging to the same action group by using the action code in a behavior classification system.

Here, the step (a) may detect the malicious behavior by applying API hooking and malicious code ruleset to the API call information on the user level and the kernel level.

The behavior classification rule information includes an API number for identifying the action information according to the call of the API call information and the API included in the action rule of the action information, A parameter which is an object to be referred to for performing the action; A parameter value that is an actual value of the object, an associated API that is called together when the corresponding API is called; And a flag identifying whether the action is to be invoked with the associated API to match the action.

As described above, according to the embodiments, malicious behavior is detected in a Windows environment, and an action code and / or an action group are generated based on the malicious action, thereby effectively detecting a variant malicious code whose code is partially modified.

1 is a block diagram schematically showing a malicious code variant detection and inquiry system according to an embodiment of the present invention.
FIG. 2 is a detailed view of a malicious code analysis system of a malicious code variant detection system according to an embodiment of the present invention.
4 is a diagram illustrating a malicious code detection system in the real time analysis agent view according to an embodiment of the present invention.
5 is a diagram showing an API-based malicious behavior analysis result processed through the existing system and the system (virtualization environment) of the present embodiment.
6 is a diagram showing an example of malicious code analysis result processed through the existing system and the system of the present embodiment.
7 is a diagram showing a malicious code processing result processed through the existing system and the system of the present embodiment.
FIG. 8 is a detailed view of a behavior classification system and an inquiry system of a malicious code variant detection system according to an embodiment of the present invention.
FIG. 9 is a diagram illustrating exemplary behavior codes generated in a behavior classification system according to an exemplary embodiment of the present invention. Referring to FIG.
10 is a diagram illustrating an exemplary behavior group generated in the behavior classification system according to an embodiment of the present invention.
11 is a diagram exemplarily showing types of a malicious code list and API call information generated in a malicious code variant detection and inquiry system according to an embodiment of the present invention.
12 and 13 are views illustrating exemplary results of a user interface inquiry of a malicious code inquiry system according to an embodiment of the present invention.
FIG. 14 is a flowchart exemplarily showing a behavior-based malicious code variant detection and inquiry method according to an embodiment of the present invention.
15 is a flowchart illustrating a malicious behavior detection method of the behavior-based malicious code variant detection and inquiry method according to an embodiment of the present invention in more detail.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings, so that those skilled in the art can easily carry out the present invention. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

≪ Embodiment 1 >

1 is a block diagram schematically showing a malicious code variant detection and inquiry system according to an embodiment of the present invention.

Referring to FIG. 1, a malicious code variant detection and inquiry system 1000 according to an exemplary embodiment of the present invention includes a malicious code analysis system 100 for detecting malicious code of a malicious code, A behavior classification system 200 for detecting a malicious code, and a malicious code inquiry system 300 for inquiring malicious behavior and variant malicious code as described above.

Between each of these configurations, an external network such as a wired / wireless communication network or an internal network may be connected. However, the network to be connected between the respective configurations is not limited to the above network configuration. Hereinafter, each configuration will be described in more detail.

<Examples of detection of malicious behavior>

FIG. 2 is a detailed view of a malicious code analysis system of a malicious code variant detection system according to an embodiment of the present invention.

Referring to FIG. 2, the malicious code analysis system 100 according to an exemplary embodiment of the present invention manages overall malicious behavior analysis including API analysis request, analysis assignment, and analysis result inquiry and storage.

To this end, the malicious code analysis system 110 may include a malicious code management server 110 and a virtualization analysis agent 120. First, the malicious code management server 110 collects the analysis target traffic from the network traffic sensor 101 as a malicious code analysis target.

At this time, the network traffic sensor 101 is connected to a network, for example, a wired or wireless network, collects traffic including an executable file of an application program executed in a system running in a Windows environment, extracts analysis target traffic requiring analysis, To the code management server (110). An example of the analysis target traffic requested for analysis can be shown in FIG.

Therefore, the malicious code management server 110 receives the traffic to be analyzed from the network traffic sensor 101, and uses the Rest API to store the first malicious suspicious execution file and various meta information of the application program included in the traffic to be analyzed And can be stored in the database 111.

At this time, the executable file of the collected application program is preferably a PE (Portable Executable) file executable in a Windows environment.

However, it may be input, not collection. That is, the malicious code management server 110 may manually receive at least one executable file and store the executable file in the database 111.

At this time, the input executable file is preferably a PE (Portable Executable) file executable in a Windows environment. However, it is needless to say that the present invention is not limited to the PE (Portable Executable) file described above.

Next, the virtualization analysis agent 120 may include at least one virtualization agent module 121 that is simultaneously operated using virtualization technology. The virtualization agent module 121 may refer to a Windows system that is executed in a virtualized environment.

When the virtualization agent module 121 is activated, the virtualization agent module 121 can execute the first malicious suspicious execution file received from the malicious code management server 110. As a result of execution, the first application program interface (API) call information called by the malicious code can be extracted.

More specifically, the virtualization analysis server 120 executes the first malicious suspicious execution file received from the malicious code management server 110 using at least one or more virtualization agent modules 121, 1 API (Application Program Interface) call information.

Preferably, the first API call information can be extracted by monitoring API information called by the malicious code through API hooking at the user level and the kernel level. When the first API call information is extracted, the malicious behavior for the malicious code can be known.

In other words, 'Register at registry execution location', 'Copy file', 'Execute worm process', 'Create log file at C: W', 'Create mutex to prevent duplication' It is possible to know malicious behavior at the same user level and kernel level. The extracted first API call information is transmitted to the malicious code management server 110.

Thus, since the first API call information can be extracted on both the user level and the kernel level, the malicious code behavior analysis can be performed on various APIs.

In this case, the malicious code management server 110 may store the first API call information received from the virtualization analysis agent 120 in the database 101.

Meanwhile, the malicious code management server 110 may include a malicious behavior analysis management module 112 to detect more detailed malicious behavior using the stored first API call information.

In one embodiment, the malicious behavior analysis management module 112 may detect malicious malicious behavior in a virtual environment by applying a preset malicious code rule set to the first API call information received from the virtualization analysis agent 120.

At this time, the malicious rule set may include hooking filtering. That is, the malicious code ruleset including the hooking filtering is applied to the first API call information, and when the hooking-filtered first API calling information is compared with the predefined malicious code rule set to identify the malicious code malicious code, can do. It is a matter of course that the detected malicious malicious behavior is stored in the database 111.

However, all malicious code from the first malicious suspicious executable file may not be detected in the virtualized environment. In order to prepare for this, the present embodiment may further include a real-time analysis agent. This real-time analysis agent may be as shown in FIG.

4 is a diagram illustrating a malicious code detection system in the real time analysis agent view according to an embodiment of the present invention.

Referring to FIG. 4, the malicious code detection system 100 according to an exemplary embodiment of the present invention may include a malicious code management server 110 and a real-time analysis agent 130. At this time, the malicious code management server 110 may include a malicious behavior analysis management module 112.

First, the malicious behavior analysis management module 112 is a module for analyzing actual malicious behavior. The malicious behavior analysis management module 112 extracts a second malicious suspicious execution file that has not detected a malicious malicious behavior from the first malicious suspicious execution file stored in the database 111 have. The extracted second malicious suspicious execution file may be transmitted to the real analysis server 130 to be described later.

Next, in one embodiment, the real-time analysis agent 130 may include at least one real-time agent 131 that executes the second malicious suspicious executable file provided from the malicious behavior analysis management module 112 .

That is, the real-time agent 131 executes the received second malicious suspicious execution file in a real-time environment excluding the virtual environment, and then extracts second application program interface (API) calling information called by the malicious code.

Preferably, the real-time analysis agent 130 can extract the second API call information by monitoring the API information called by the malicious code through API hooking at the user level and / or kernel level. The extracted second API call information may be transmitted to the malicious behavior analysis management module 112.

Accordingly, the malicious behavior analysis management module 112 stores the second API call information received from the real-time agent 131 in the database 111, re-applies the previously stored malicious code rule set to the stored second API call information And detects real-time malicious activity.

At this time, the malicious code ruleset has the same relationship as described above, and a description thereof will be omitted. Of course, the detected real-time malicious activity is stored in the database 111.

As described above, in this embodiment, by extracting all the API call information (e.g., the first API call information and the second API call information) corresponding to the user level and the kernel level in the virtualized environment and / or the real-time environment, It gives the advantage of detecting malicious behavior of code.

<Comparative Example>

FIG. 5 shows an API-based malicious behavior analysis result processed through the existing system and the system (virtualization environment) of the present embodiment, FIG. 6 shows malicious code analysis results processed through the existing system and the system of the present embodiment as an example, 7 shows malicious code processing results processed through the existing system and the system of this embodiment.

In one embodiment, FIG. 5 compares whether malicious code behaviors that were not detected in the existing analysis system through the experiment can be detected in the proposed malicious code detection system 100. FIG.

According to experiments, we actually used malicious code samples that were circulated in 2013, and the malicious code samples inquired about the anti-virus process on the Windows system and forcibly terminated the corresponding anti-virus process.

And, malicious behavior such as downloading the executable file from the web was performed. In the existing analysis system, the action for the termination of the vaccine process was detected, but the action for the vaccine process was not detected.

On the other hand, in the malicious code detection system 100 proposed in one embodiment, in addition to the vaccine process inquiry, detailed malicious actions performed by the malicious code as shown in FIG. 5 can be recognized.

In this experiment, the analysis and detection performance of the existing behavior analysis system and the proposed system (100) are also measured for a plurality of malicious code samples. An example of the analysis result using 110 malicious code samples actually distributed can be shown in FIG.

As shown in FIG. 6, it can be seen that the system 100 of the embodiment detects an action that the existing analysis system can not detect. As a result, as shown in FIG. 7, the system 100 proposed in the embodiment detects 97 out of 110 malicious code samples used in the experiment, and shows that the performance is 88% We could detect malicious code (eg, 7) of malicious code that was not detected by the analysis system.

<Detection of modified malware>

FIG. 8 is a detailed view of a behavior classification system and an inquiry system of a malicious code variant detection system according to an embodiment of the present invention.

Referring to FIG. 8, a malicious code variant detection system 1000 according to an embodiment of the present invention includes a malicious code detection system 300 and a malicious code classification system 200, And may include a behavior classification server 210 and a database 220 to detect variant malicious code based on the behavior of the user.

First, the behavior classification server 210 receives malicious code of the malicious code and / or API call information from the malicious code analysis system 100. The behavior classification server 210 generates behavior codes by matching the malicious behavior of the received malicious code with the pre-stored behavior classification rule information.

In this case, the action classification rule information includes an API number for identifying API included in the action rule of the action information, an API number for identifying the API included in the action rule of the action information, A parameter value that is an actual value of an object, a flag that identifies whether an associated API that is called together when the API is invoked, and whether it should be called with the associated API to match the behavior.

Accordingly, it is confirmed that malicious behavior of the received malicious code belongs to the action classification rule, so that matching can be performed to generate action codes. An example of the generated behavior codes as shown in FIG. 9 can be shown.

As shown in FIG. 9, it can be seen that a malicious behavior is classified into an action code according to a behavior classification rule. On the other hand, the behavior codes are codes for identifying malicious code-specific behaviors, and a complex malicious behavior can be represented by one bit string. For example, it can be displayed as a bit string '1' when matching behavior and '0' when mismatching.

In this manner, when the behavior code is generated, the behavior classification server 210 can generate an action group in which malicious codes belonging to the same action group are grouped by using the generated action code.

For example, as shown in FIG. 10, malicious codes assigned with a malicious code may generate at least one malicious code grouped for classification into similar malicious codes based on the malicious codes.

At this time, malicious codes having the same behavior code are grouped into one group, and they can be classified into malicious codes having mutually similar actions. Also, the behavior code of one signature is identified as one behavior group, and the total number of behavior codes may have the same state as the number of similar behavior groups.

Thus, due to the generated behavior code and action group, the behavior-based variant malicious code can be easily identified in the present embodiment.

In addition, in one embodiment, the behavior classification server 210 may extract an API sequence using a malicious code list including malicious codes included in the generated action group. At this time, an example of the malicious code list can be represented as shown in FIG. 11, the API call information described in FIGS. 1 to 10 is also displayed.

The extracted API sequence can be used to generate bit codes for each behavior code. That is, the behavior classification server 120 can generate bit codes (1, 0) for each behavior code by matching the extracted API sequence with the unit behavior in the behavior classification rule information.

As described above, the generated bit code is very useful for inputting a bit code at the time of inquiry in the malicious code variant inquiry system 300 to be described later to confirm various information such as variant malicious codes.

On the other hand, in the present embodiment, the database 220 serves to store behavior codes, action groups, malicious code lists, API sequences and bit codes generated as described above. The stored information can be queried by the malicious code inquiry system 300 to be described later.

Lastly, in the present embodiment, the malicious code inquiry system 300 stores the malicious code in the database 111 of the malicious code management server 110 and the database 220 of the malicious code classification system 200 described with reference to Figs. 1 to 7 Information can be searched, and a combination and calculation of information for identifying the malicious code of the variant can be performed. Such inquiry and output can be realized through a user interface (GUI).

For example, as shown in FIG. 12, in order to inquire a list of variant malicious codes belonging to a specific group, a group name_id (28), channel information (TYPE1), and variant determination result (TRUE) When an inquiry is made, MAL2_id 11, 52, etc. may be calculated and output as a variant group according to the result of the variant determination.

13, for the variant inquiry for a specific malicious code A, "case1. [Lookup] mal1_id (24), variant judgment result (TRUE) and case2. [Lookup] mal1_id [24] (TRUE), the group type (TYPE1), and the case3. [Inquiry] mal1_id [24], the variant determination result (TRUE), the group type (TYPE2) , Only a list of variants within the same group is output, and a list of variants belonging to different groups can be output.

<Example of Detection of Variant Malicious Code>

FIG. 14 is a flowchart exemplarily showing a behavior-based malicious code variant detection and inquiry method according to an embodiment of the present invention. FIG. 15 is a flowchart illustrating a malicious code variant detection and inquiry method according to an embodiment of the present invention. FIG. 5 is a flow chart showing the behavior detection method in more detail.

Referring to FIG. 14, an operation-based malicious code variant detection and inquiry method (S1000) according to an embodiment of the present invention detects a malicious behavior of a malicious code in a malicious code analysis system 100 (S100) A malicious code variant based on malicious behavior is detected by the malicious code classification system 200 (S200), and the malicious code and variant malicious code described above are inquired by the malicious code inquiry system 300 (S300) .

15, S100 may include storing a malicious suspicious execution file that is collected or input as shown in FIG. 15, executing a malicious suspicious execution file to delete first API call information called by the malicious code to a user level And extracting the malicious code on the kernel level in step S120; detecting a malicious malicious behavior by applying a malicious code rule set in advance to the first API call information; and detecting malicious code from a malicious code file And detecting the real-time malicious behavior by extracting second API call information called by the first API call information.

First, in step S110, the malicious code management server 110 collects the analysis target traffic from the network traffic sensor 101 as a target of analysis.

At this time, the network traffic sensor 101 is connected to a network, for example, a wired or wireless network, collects traffic including an executable file of an application program executed in a system running in a Windows environment, extracts analysis target traffic requiring analysis, To the code management server (110).

Accordingly, in step S110, the analysis target traffic is received from the network traffic sensor 101, and the first malicious suspicious execution file and various meta information of the application program included in the analysis target traffic are transmitted to the malicious code management server 110). &Lt; / RTI &gt;

At this time, the executable file of the collected application program is preferably a PE (Portable Executable) file executable in a Windows environment.

However, it may be input, not collection. That is, at step S110, at least one executable file may be manually input and stored in the database 111. [ At this time, it is preferable that the executable file to be input is a PE (Portable Executable) file executable in a Windows environment. However, it is needless to say that the present invention is not limited to the PE (Portable Executable) file described above.

Thereafter, in one embodiment, step S120 may simultaneously activate at least one virtualization agent module 121 using virtualization technology. At this time, the virtualization agent module 121, which is operated in conjunction with the virtualization agent module 121, may refer to a Windows system that is executed in a virtualized environment.

When the virtualization agent module 121 is activated, the first malicious suspicious execution file received from the malicious code management server 110 can be executed in the virtualization agent module 121. As a result of execution, the first application program interface (API) call information called by the malicious code can be extracted.

Conversely, in step S120, the first malicious suspicious execution file received from the malicious code management server 110 is executed using at least one virtualization agent module 121, and then a first API (Application Program) Interface call information can be extracted from the virtualization analysis server 120.

Preferably, API information called by the malicious code is monitored through API hooking at the user level and the kernel level, and the first API call information can be extracted from the virtualization analysis server 120. When the first API call information is extracted, the malicious behavior for the malicious code can be known.

In other words, 'Register at registry execution location', 'Copy file', 'Execute worm process', 'Create log file at C: W', 'Create mutex to prevent duplication' It is possible to know malicious behavior at the same user level and kernel level. The extracted first API call information is transmitted from the virtualization analysis server 120 to the malicious code management server 120.

Thus, since the first API call information is extracted on both the user level and the kernel level, the malicious code behavior analysis can be performed on various APIs.

In this case, the first API call information received from the virtualization analysis agent 120 may be stored in the database 101 of the virtualization analysis server 120.

Thereafter, in order to detect more detailed malicious behavior using the stored first API call information, step S130 is a step of setting malicious code rule sets, which are preset with the first API call information received from the virtualization analysis agent 120, 112) to detect virtual malicious behavior in a virtualized environment.

At this time, the malicious rule set may include hooking filtering. That is, a malicious code rule set including hooking filtering is applied to the first API call information, and when the hooking-filtered first API calling information is compared with a predefined malicious code rule set to confirm the identity, malicious code malicious behavior Can be detected by the analysis management module 112. The detected virtual malicious behavior may be stored in the database 111 of malicious behavior analysis management module 112.

However, it may not be possible to detect all malicious codes from the first malicious suspicious executable in a virtualized environment. In order to prepare for this, in step S130, the second malicious suspicious execution file that has not detected the virtual malicious behavior may be extracted from the first malicious suspicious execution file stored in the database 111. [ The extracted second malicious suspicious execution file is transmitted to the real analysis server 130 to be described later.

In step S140, the second malicious suspicious execution file received from the malicious behavior analysis management module 112 is executed through the real-time agent 131 of the real-time analysis agent 130, and then the malicious code The second API (application program interface) call information to be called by the real time analysis agent 130 is extracted.

Preferably, the second API call information can be extracted from the real-time analysis agent 130 by monitoring API information called by the malicious code through API hooking at the user level and / or the kernel level. The extracted second API call information is transmitted to the malicious behavior analysis management module 112.

Accordingly, in step S140, the second API call information received from the real-time agent 131 is stored in the database 111 of the malicious behavior analysis management module 112, and the stored second API call information is stored in the preset malicious code rule set The malicious behavior analysis module 112 detects the real-time malicious behavior.

At this time, the malicious code ruleset has the same relationship as described above, and a description thereof will be omitted. The detected real-time malicious activity is stored in the database 111. Therefore, the information stored in the database 111 can be usefully used for malicious behavior analysis as needed.

In this way, the present embodiment extracts all the API call information corresponding to the user level and the kernel level in the virtualized environment and / or the real-time environment, thereby detecting more detailed malicious behavior of the malicious code.

Returning to FIG. 14, in step S200 according to the present embodiment, malicious code malicious code and / or API call information is received from the malicious code analysis system 100 by the malicious code analysis system 100 by the malicious code analysis system 100. The behavior classification server 210 generates behavior codes by matching malicious behavior of the received malicious code with pre-stored behavior classification rule information.

In this case, the action classification rule information includes an API number for identifying API included in the action rule of the action information, an API number for identifying the API included in the action rule of the action information, A parameter value that is an actual value of an object, a flag that identifies whether an associated API that is called together when the API is invoked, and whether it should be called with the associated API to match the behavior.

Accordingly, it is confirmed that malicious behavior of the received malicious code belongs to the action classification rule, so that matching can be performed to generate action codes. An example of the generated behavior codes as shown in FIG. 9 can be shown.

As shown in FIG. 9, it can be seen that a malicious behavior is classified into an action code according to a behavior classification rule. On the other hand, the behavior codes are codes for identifying malicious code-specific behaviors, and a complex malicious behavior can be represented by one bit string. For example, it can be displayed as a bit string '1' when matching behavior and '0' when mismatching.

If the action code is generated, the action classifying server 210 may generate an action group in which malicious codes belonging to the same action group are grouped using the generated action code in step S200.

For example, as shown in FIG. 10, malicious codes assigned with a malicious code may generate at least one malicious code grouped for classification into similar malicious codes based on the malicious codes.

At this time, malicious codes having the same behavior code are grouped into one group, and they can be classified into malicious codes having mutually similar actions. Also, the behavior code of one signature is identified as one behavior group, and the total number of behavior codes may have the same state as the number of similar behavior groups. In this way, the generated behavior codes and action groups are generated, so that the embodiment can easily detect malicious codes based on the behavior.

Also, in operation S200, the action classification server 210 may extract an API sequence using a malicious code list including malicious codes included in the generated action group. At this time, an example of the malicious code list can be represented as shown in FIG. 11, the API call information described in FIG. 14 is also displayed.

The extracted API sequence can be used to generate bit codes for each behavior code. That is, the behavior classification server 120 can generate bit codes (1, 0) for each behavior code by matching the extracted API sequence with the unit behavior in the behavior classification rule information.

As described above, the generated bit code is very useful for inputting a bit code at the time of inquiry in the malicious code variant inquiry system 300 to be described later to confirm various information such as variant malicious codes.

Thereafter, in this embodiment, step S200 stores the generated behavior code, action group, malicious code list, API sequence and bit code, etc., in the database 220 as described above. The stored information can be queried by the malicious code inquiry system 300 to be described later.

14, the information stored in the database 111 of the malicious code management server 110 and the database 220 of the behavior classification system 200 described in FIG. 14 is transmitted to the malicious code inquiry system 300 ), And the malicious code inquiry system 300 can perform a combination and calculation of information for identifying the malicious code. Such inquiry and output can be realized through a user interface (GUI).

For example, as shown in FIG. 12, in order to inquire a list of variant malicious codes belonging to a specific group, a group name_id (28), channel information (TYPE1), and variant determination result (TRUE) When an inquiry is made, MAL2_id 11, 52, etc. may be calculated and output as a variant group according to the result of the variant determination.

13, for the variant inquiry for a specific malicious code A, "case1. [Lookup] mal1_id (24), variant judgment result (TRUE) and case2. [Lookup] mal1_id [24] (TRUE), the group type (TYPE1), and the case3. [Inquiry] mal1_id [24], the variant determination result (TRUE), the group type (TYPE2) , Only a list of variants within the same group is output, and a list of variants belonging to different groups can be output.

As described above, in this embodiment, the malicious codes of variant malicious code and malicious code are advantageously inquired and calculated by the malicious code inquiry system 300 under various conditions.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the exemplary embodiments or constructions. You can understand that you can do it. The embodiments described above are therefore to be considered in all respects as illustrative and not restrictive.

100: malicious code analysis system 101: network traffic sensor
110: malicious code management server 111: database
112: malicious behavior analysis management module 120: virtualization analysis agent
121: virtualization agent module 130: real-time analysis agent
131: Real Time Agent 200: Action Classification System
210: behavior classification server 220: database
300: malicious code inquiry system 1000: malicious code variant detection and inquiry system

Claims (15)

A malicious code analysis system for executing a malicious suspicion executable file to extract API (application program interface) call information called by malicious code and detecting malicious behavior of malicious code using the extracted API call information,
Generates behavior codes by matching the malicious behavior of the malicious code provided from the malicious code analysis system with pre-stored behavior classification rule information, and creates an action group in which malicious codes belonging to the same action group are grouped by using the action code A behavior classification system, and
And a malicious code inquiry system for inquiring information stored in a database of the malicious code analysis system and the behavior classification system and performing a combination and calculation of the information for identifying the variant malicious code,

The malicious code analysis system collects malicious suspicious execution files such as PE (Portable Executable) files executable on the Window OS from network traffic sensors connected to the network,

Wherein the malicious code analysis system includes a malicious suspicious execution file, first API call information, and a first database for storing malicious behavior of the malicious code,

Wherein the behavior classification system extracts an API sequence using a malicious code list including the malicious codes included in the generated action group,

Wherein the behavior classification system generates bit code (1, 0) for each behavior code based on the behavior classification rule information and the unit behavior in the extracted API sequence, and the behavior classification rule information includes the API call information An API number for identifying an API included in an action rule of the action information, a parameter that is an object to be referred to for performing the action, a parameter value that is an actual value of the object, An associated API that is invoked together, and a flag that identifies whether it should be invoked with the associated API to match the behavior,

Wherein the behavior classification system comprises a second database for storing the behavior code, the action group, the malicious code list, the API sequence and the bit code. delete delete The method according to claim 1,
The malicious code analysis system comprises:
Based malicious code variant detection and retrieval system for extracting API call information called by the malicious code through API hooking on a user level and a kernel level. 5. The method of claim 4,
The malicious code analysis system comprises:
And detecting the malicious behavior by applying the malicious code rule set in advance to the API call information. 6. The method of claim 5,
The malicious code analysis system comprises:
Behavior based malware variant detection and retrieval system applying the malicious code ruleset including hook filtering. The method according to claim 1,
The malicious code analysis system comprises:
Based malicious code variant detection and retrieval system that detects malicious activity including virtualization malicious activity and real-time malicious activity. delete delete delete delete delete (a) extracting, from a malicious code analysis system, application program interface (API) call information called by a malicious code after executing a malicious suspicious execution file;
(b) detecting malicious behavior for the malicious code in the malicious code analysis system using the extracted API call information;
(c) generating behavior codes in the behavior classification system through matching between the detected malicious behavior and pre-stored behavior classification rule information;
(d) generating a group of malicious codes belonging to the same action group in the behavior classification system using the action code; And
(e) inquiring information stored in a database of the malicious code analysis system and the behavior classification system, and performing a combination and calculation of the information for identifying the variant malicious code in the malicious code inquiry system,

The malicious code analysis system collects malicious suspicious execution files such as PE (Portable Executable) files executable on the Window OS from network traffic sensors connected to the network,

Wherein the malicious code analysis system includes a malicious suspicious execution file, first API call information, and a first database for storing malicious behavior of the malicious code,

Wherein the behavior classification system extracts an API sequence using a malicious code list including the malicious codes included in the generated action group,

Wherein the behavior classification system generates bit code (1, 0) for each behavior code based on the behavior classification rule information and the unit behavior in the extracted API sequence, and the behavior classification rule information includes the API call information An API number for identifying an API included in an action rule of the action information, a parameter that is an object to be referred to for performing the action, a parameter value that is an actual value of the object, An associated API that is invoked together, and a flag that identifies whether it should be invoked with the associated API to match the behavior,

Wherein the behavior classification system comprises a second database for storing the behavior code, the action group, the malicious code list, the API sequence and the bit code. 14. The method of claim 13,
The step (a)
A malicious code variant detection and retrieval method for detecting malicious behavior by applying an API hook and a malicious code rule set to the API call information on a user level and a kernel level. delete

Images