KR101737794B1 - Method for monitoring malwares which encrypt user files - Google Patents

Abstract

A malicious code monitoring apparatus according to the present invention includes a target file generation module for generating a target file for monitoring malicious codes on a storage device in which a user file is stored; a monitoring module for confirming a thread sensing a corresponding request when there is the request of write access authority for the target file; and an execution program interruption module for forcibly terminating the thread identified by the monitoring module. So, it is possible to prevent an important file stored on a users computer from being encrypted.

Description

METHOD FOR MONITORING MALWARES WHICH ENCRYPT USER FILES,

The present invention relates to a technique for detecting a computer virus or malicious code.

As is well known, the performance of computers has been greatly improved as memories and communication technologies have improved. In particular, the spread of the Internet has been expanding due to the development of network infrastructure. Due to the development of communication technologies such as the Internet, a large number of computers are connected to each other to share information, and the number of users is increasing day by day.

The environment in which many computers are connected by networking accelerates the damage caused by malicious codes or computer viruses. Malicious codes (or viruses) that illegally use other Internet users' hacking information without permission, or encroach on computer terminals and servers of other Internet users are becoming serious social problems. In particular, malicious code causes problems in various forms, such as a user using the Internet sending data to another computer or changing the internal system registry of the user's computer so that an unintended and unintended site is set as an Internet site . Such malicious code is usually installed on a user's computer by simply accessing the Internet through a file program that is easily obtained from the Internet.

Meanwhile, in recent years, a malicious code that infects a user system and encrypts a user file such as a document file, warns the user of the file, and requests a user for money by using a bit coin or the like to recover the encrypted document. Although this type of malicious code can be detected by a vaccine program and delete the malicious code file, it is difficult to recover the document file of the already encrypted user. That is, according to the vaccine program currently used, it is possible to delete the file after detecting the malicious code. However, since the decryption key can not be known due to the characteristics of the vaccine, it is impossible to recover the document file of the user who has already been encrypted.

In order to prevent the malicious code from encrypting the user file, it is necessary to detect and block the malicious code before encrypting the user file. To this end, it is an object of the present invention to provide a malicious code monitoring apparatus and method capable of detecting the first execution of a malicious code for encrypting a user file and preventing an important file stored in the user computer from being encrypted in advance.

The malicious code monitoring apparatus according to the present invention monitors a malicious code for encrypting a user file and includes a target file generation module for generating a target file for monitoring malicious code on a storage device in which a user file is stored; A monitoring module for confirming a thread sending a request for writing access to the target file; And an execution program interruption module for forcibly terminating the thread identified by the monitoring module.

Here, it is preferable that the target file generation module generates a trap folder in a topmost path of the storage device, and generates the target file in the trap folder. In this case, it is more preferable that the trap folder has a folder name that is first searched for by the malicious code. The trap folder is preferably created as a hidden attribute.

In addition, the apparatus according to the present invention may further include an alarm module for outputting a malicious code infection message when a write access right is requested to the target file. In addition, if the monitoring module requests a write access right to the target file, the monitoring module blocks the request.

A method of monitoring a malicious code for encrypting a user file according to the present invention includes a first step of generating a target file for monitoring the malicious code on a storage device in which a target file generation module stores a user file; A second step of the monitoring module checking a thread to which the request is sent if the request file has a request for write access to the target file; And a third step of forcibly terminating the thread identified by the monitoring module by the execution program interruption module.

In the first step, the target file generation module may generate a trap folder in the uppermost path of the storage device, and generate the target file in the trap folder. The target file generation module may generate the trap folder having a folder name that is first searched for by the malicious code. In particular, it is preferable that the target file generation module generates the trap folder as a hidden attribute.

The method may further include the step of outputting a malicious code infection message by the alarm module when a write access right is requested to the target file.

In the second step, if the monitoring module requests a write access right to the target file, the monitoring module blocks the request.

In order to solve the problems of the present invention, it is possible to provide a computer-readable recording medium on which a program for causing the computer to execute the malicious code monitoring method is recorded.

According to the malicious code monitoring apparatus and method according to the present invention, it is possible to effectively prevent an important file of a user from being encrypted by a malicious code. Although the conventional vaccine program can delete the malicious code after detecting it, it is impossible to recover the encrypted user file. However, according to the present invention, a virtual target object to be encrypted first by malicious code is generated, and monitoring of the processing of the target object causes execution of the malicious code or an application program executed by the malicious code By stopping, important files of the user can be prevented from being encrypted in advance.

1 is a schematic block diagram of a malicious code monitoring apparatus according to the present invention.
FIG. 2 is a flowchart illustrating a process of performing a malicious code monitoring method according to the present invention.
FIG. 3 shows an example in which a trap folder is created in the user system according to the malicious code monitoring apparatus and method according to the present invention.
FIG. 4 shows an example in which a target file is created in a trap folder created in the user system according to the malicious code monitoring apparatus and method according to the present invention.

Prior to the detailed description of the present invention, the terms or words used in the present specification and claims should not be construed as limited to ordinary or preliminary meaning, and the inventor may designate his own invention in the best way It should be construed in accordance with the technical idea of the present invention based on the principle that it can be appropriately defined as a concept of a term to describe it. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention, and are not intended to represent all of the technical ideas of the present invention. Therefore, various equivalents It should be understood that water and variations may be present.

In addition, combinations of each block of the accompanying block diagrams and each step of the flowchart may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which may be executed by a processor of a computer or other programmable data processing apparatus, And means for performing the functions described in each step are created. These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible for the instructions stored in the block diagram to produce a manufacturing item containing instruction means for performing the functions described in each block or flowchart of the block diagram. Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible that the instructions that perform the processing equipment provide the steps for executing the functions described in each block of the block diagram and at each step of the flowchart.

Also, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order according to the corresponding function.

Hereinafter, a preferred embodiment of a malicious code monitoring method according to the present invention will be described in detail. However, a detailed description of known functions and configurations that may obscure the gist of the present invention will be omitted.

FIG. 1 is a schematic block diagram of a malicious code monitoring apparatus 100 according to an embodiment of the present invention. The target file generating module 110, the monitoring module 120, the execution program suspending module 130, , And an alarm module (140).

Here, the malicious code that is infected by the user system and encrypts a user's arbitrary file (hereinafter, referred to as 'user file') selectively encrypts only the file expected as the user file without encrypting the general computer system file. To this end, the malicious code searches for a plurality of files in the user storage device, (2) detects an expected encryption target in the user file, (3) encrypts the user file to be targeted, and ) Is executed by changing the extension of the corresponding user file.

Here, the malicious code may be an executable file that encrypts any user document file of the user system. In addition, the user file encrypted by the malicious code may be various kinds of files stored and managed by the user such as a document file created by the user, an image file such as a photograph, a moving image file, or the like.

Such a malicious code may be executed as an independent executable file, but may be executed in parasitism with any executable program capable of processing a user file to be encrypted.

In view of the way of executing such a malicious code, in the present invention, first, an arbitrary object to be encrypted by the malicious code is generated, and it is monitored whether or not the object is processed. If it is detected that the object is processed The process of terminating the executable program for processing the target object prevents the user file from being encrypted by the malicious code.

In addition, the malicious code monitoring apparatus and method according to the present invention can be executed together with a security program (vaccine) installed or executed in a user system or as a separate execution program.

Referring to FIG. 1 and FIG. 2, a detailed process of the malicious code monitoring apparatus and method according to the present invention will be described.

[Create target object]

When the malicious code monitoring apparatus 100 executing the malicious code monitoring method according to the present invention is installed and executed in the user system, the target file generation module 110 first creates a target object in the user system (S110). The target object is generated as a file that can be encrypted by malicious code. The target object is a file extension (for example, "hwp", "doc", " quot ;, "jpg "," txt ", etc.). Such a target file serves as a trap file recognized as a user file by malicious code.

On the other hand, malicious codes that are generally executed in a Windows operating system environment are searched from the root of the drive using an API (Application Program Interface) such as FindFirstFile, FindNextFile, and the like. Malicious code that encrypts user files will retrieve user files from the user's system's main drive (usually the "C" drive) to the removable disk. That is, the malicious code searches the "root" of the main drive for the target to be encrypted, and if there is no target file to be encrypted on the root, it searches the subfolders sequentially.

In consideration of this point, a target file is formed in the topmost path in a storage device (fixed drive, removable drive, or the like) in which a user file is stored in the user system. That is, it is preferable that the target file is generated in a folder that can be searched for by a malicious code or a file name that can be searched before a user file in a file search by a malicious code. At this time, since the target file is generated for monitoring malicious code, the user should not access and access the file arbitrarily. For this purpose, the target file can be set as a "hidden attribute", but in this case, the malicious code may not recognize the target file as a user file. Therefore, it is preferable that the target file is created in the trap folder created in the topmost path, rather than being created directly in the topmost path (root) of the user storage device.

FIG. 3 illustrates a state in which a trap folder is created in the uppermost path (the root of the C drive) of the user storage device. Here, the trap folder 210 is generated so as to have a folder name that can be searched for first by the malicious code. For example, when the user system is operated by the WINDOW OS, the folder name is generated such that the ASCII code of the permissible characters of the path name (i.e., the folder name) in the WINDOW OS starts with a character having a low rank. That is, except for the characters that can not be used as path names (or filenames), malicious codes are detected in the user system as "!", "@", "#" ! " The object to be encrypted is detected with respect to a file in a folder having a name starting with a character with a lower rank of the ASCII code.

3 and 4 show an example in which a target file 211 having various kinds of extensions is generated in a trap folder 210 having a folder name "@ $ HbgVF" Respectively. When the target file is generated in this manner, the malicious code attempts to encrypt the target file 211 generated in the trap folder 210 first. At this time, the folder attribute of the trap folder 210 is set to "hidden attribute ", thereby preventing the user from arbitrarily accessing the trap folder 210 and the object file 210 therein.

[Monitoring the processing of the target file]

Next, the monitoring module 120 regularly monitors whether the generated target file is processed (S120). For example, malicious code running in a Windows operating system environment can be used to access a file (CreateFile or ZwCreateFile), modify a file (WriteFile or ZwWriteFile) to secure write access right to a target, ), And the end of the handle (CloseHandle or ZwClose). As a result, malicious code will inevitably require write access to the file in order to encrypt the file. Accordingly, the monitoring module 120 continuously monitors whether or not a request to acquire a write access right for the generated target files is received (S121).

If a write access permission request for a target file is detected by an arbitrary executable program while the user is using his / her system, a thread that requests write access to the target file while blocking the request, (S122). Here, a "thread" refers to a unit of flow executed in a process when executing a computer program, that is, a series of executable codes, and generally has its own unique identification. Accordingly, the monitoring module 120 identifies the thread requesting write access to the target files, and stores the unique ID of the thread.

[Interruption of executable program]

If a thread attempting to access the target file is identified by the monitoring module 120, the unique ID of the thread is provided to the execution program suspension module 130. Then, the execution program interruption module 130 forcibly terminates the thread corresponding to the unique ID (S130).

Even if the monitoring module 120 blocks the write access right to the target file, the malicious code can continuously attempt to encrypt other user files. Accordingly, after confirming the thread requesting the write access authority by the monitoring module 120, the thread forcibly terminates the request, thereby preventing the user file from being encrypted due to the execution of the malicious code.

On the other hand, if the user system is infected with a malicious code, the malicious code first encrypts the target file among the files of the user system. At this time, the malicious code may be operated in various ways to encode the target file. The malicious code may directly process the target file and encrypt the target file. Alternatively, the malicious code may parse an arbitrary executable program, You can encrypt the file while processing it. When the malicious code itself directly processes and encrypts the target file, execution of the malicious code may be forcibly terminated by the execution program halting module 130. [ However, if the malicious code is injected into an unspecified normal system process, it is desirable to selectively terminate the thread only, rather than terminating the normal system process. There can be only one thread in the normal process where malicious code is injected, but more than one thread can be created. Therefore, it is desirable to selectively terminate only the thread injected with the malicious code in the normal process and forcibly terminate the process by terminating only the thread requesting write access to the target file.

[Warning about Malicious Code Infection]

If it is determined that the malicious code is infected to the user system, that is, if the monitoring module 120 requests a write access right to the target file, the alarm module 140 notifies the user that the system has infected the malicious code (S140). This allows the user to back up his or her important document file to another storage device, thereby effectively preventing his / her important user file from being encrypted by the malicious code.

Although the conventional vaccine program can delete the malicious code after detecting it, it is impossible to recover the encrypted user file. However, as described above, according to the malicious code monitoring apparatus and method according to the present invention, it is possible to effectively prevent an important file of a user from being encrypted by a malicious code.

In addition, the present invention can be embodied as computer-readable codes on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like. In addition, the computer-readable recording medium may be distributed over a network-connected computer system so that computer-readable code can be stored and executed in a distributed manner.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the invention. It is therefore to be understood that the embodiments of the invention described herein are to be considered in all respects as illustrative and not restrictive, and the scope of the invention is indicated by the appended claims rather than by the foregoing description, Should be interpreted as being included in.

Claims (11)

A target file generation module for generating a target file for monitoring malicious code on a storage device in which a user file is stored;
A monitoring module for confirming a thread sending a request for writing access to the target file; And
And an execution program interruption module for forcibly terminating the thread identified by the monitoring module,
Wherein the target file has a file name that is first searched for by the malicious code, and the target file is generated as a hidden attribute.
The method according to claim 1,
Wherein the target file generation module generates the target file in the uppermost path of the storage device.
delete The method according to claim 1,
Further comprising an alarm module for outputting a malicious code infection message when a write access right is requested to the target file.
The method according to claim 1,
Wherein the monitoring module blocks the request when a write access right is requested to the target file.
A method for monitoring a malicious code that encrypts a user file,
A first step in which a target file generation module generates a target file for monitoring the malicious code on a storage device in which a user file is stored;
A second step of the monitoring module checking a thread to which the request is sent if the request file has a request for write access to the target file; And
And a third step of forcibly terminating the thread identified by the monitoring module by the execution program interruption module,
Wherein the target file has a file name that is first searched for by the malicious code, and the target file generation module generates the target file as a hidden attribute.
The method according to claim 6,
Wherein in the first step, the target file generation module generates the target file in the highest path of the storage device.
delete The method according to claim 6,
Further comprising the step of outputting a malicious code infection message by an alarm module when a write access right is requested to the target file.
The method according to claim 6,
In the second step, the monitoring module intercepts the request if the request for write access is made to the target file.
A computer-readable recording medium on which a program for causing a computer to execute the malicious code monitoring method according to any one of claims 6, 7, 9, and 10 is recorded.

Images