KR101741026B1 - Method and Computer Readable Recording Medium for Detecting Malicious Module of On-Line Game - Google Patents

Abstract

The present invention can be loaded into a memory of a user computer to detect a malicious module that is abnormally playing an online game while calling a normal game function. In particular, detection of a malicious module is configured to perform a monitoring function that is called together when a game function is called. The monitoring function examines the list of modules loaded in the online game process and the address where each module is loaded into memory, checks the return address of the called function in the call stack, finds the module that called the game function, It is determined whether or not it is a normal module. It is possible to detect an effective malicious module since it is not necessary to periodically examine all the modules loaded in the memory because the investigation of whether or not a malicious module exists is performed only when a specific game function is called, It is possible to accurately determine whether or not it is the same.

Description

TECHNICAL FIELD [0001] The present invention relates to a method for detecting a malicious module in an online game, and a computer readable recording medium,

The present invention relates to an online game, and more particularly, to a malicious module that is executed in a user's computer in order to use an online game abnormally, by using a call stack.

As the communication network and computer related technology develops, various types of online game services are being provided. As the value of in-game goods increases, online games are increasingly used in an abnormal manner.

There are various ways to use online games abnormally to obtain in-game goods.

For example, by using a USB device, a hardware processing method that masquerades as if a user enters a command through a keyboard or a mouse, a program (malicious module) that performs a specific function is loaded into an online game process of a memory, And a software processing method for calling a function.

In the latter case, a robot program (also called an illegal program or 'BOT') injects a malicious module into an online game process running on a user's computer. In general, a malicious module is made of a dynamic link library Is injected into the game process.

The malicious module injected into the online game process calls a normal function provided by the game client to advance the game, and performs hunting or gathering in the game to obtain the in-game goods.

When the game is progressed by the malicious module, the user who normally uses the game is unfairly deprived of the opportunity to obtain a good game item in the game, and the game progress is interrupted.

This may reduce interest in online games, thereby avoiding the use of games and becoming a major factor in generating complaints.

Accordingly, the present invention has been made to solve the above-mentioned problems, and it is an object of the present invention to efficiently detect a malicious module that is loaded in a memory of a user's computer, have.

In order to accomplish the above object, an embodiment of a malicious module detection method in an online game according to the present invention includes: checking a list of modules loaded in an online game process running in a user computer; Checking each module in the list for an address loaded into memory; Checking a call stack (Call Stack) to check a return address of a called function (the called function is a normal function provided by the game client); And analyzing the module indicated by the return address of the called function to determine whether the module is a normal module.

At this time, each of the steps is performed by a monitoring function called together when the called function (game function) is called.

The module identified by the monitoring function may include a DLL (Dynamic Link Library) format module.

The monitoring function can determine whether the corresponding module is a normal module by using at least one of a file name, a file size, and a hash value of the module indicated by the return address of the called function.

The monitoring function can transmit predetermined information to the specific server via the communication network when the corresponding module is an abnormal module as a result of the determination.

Yet another embodiment of the malicious module detection method in an online game according to the present invention includes: checking a list of modules loaded in an online game process running in a user computer; Checking each module in the list for an address loaded into memory; Checking a call stack (Call Stack) to check a return address of a called function (the called function is a normal function provided by the game client); And transmitting information of a module indicated by the return address to a specific server through a communication network.

At this time, each of the steps is performed by a monitoring function called together when the called function (game function) is called.

The information transmitted to the specific server by the monitoring function may include at least one of a file name, a file size, and a hash value of the corresponding module.

The specific server may analyze the module information received through the communication network to determine whether the corresponding module is a normal module.

According to the present invention, a surveillance function is linked to a normal game function that can be called by a malicious module that abnormally uses an online game, so that a monitoring function is also called when a game function is called.

Then, the monitoring function checks the module that calls the game function through the return address of the game function, which is the called function, and determines whether the module is a normal module.

Since a malicious module is checked only when a specific game function is called, it is not necessary to periodically check all the modules loaded in the memory, thereby enabling efficient malicious module detection.

In addition, it is possible to accurately determine whether or not the malicious module of the user computer is related to the online game.

1 shows an overview of a system for providing online games,
2 shows a specific example of a user computer,
3 is a block diagram of an embodiment of a malicious module detection method according to the present invention,
4 is an example of explaining that a monitoring function is called according to a call of a game function,
Figure 5 is an example of a call stack,
6 is an embodiment for transmitting information on a malicious module to a game server,
7 is a block diagram illustrating another embodiment of a malicious module detection method according to the present invention,
8 is an example of a memory state for explaining a process of detecting a malicious module according to the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1, an online game service is provided through various communication networks 15 such as a wired Internet network or a wireless Internet network. A game client 11 installed in each user computer 10 receives a game And proceeds with online game while communicating with the server 17.

There are various kinds of online games. For example, MMORPG (Massively Multi-player Online Role Playing Game) type game can be concurrently played by a plurality of users.

The user computer 10 used by each user to use an online game can be an online game service such as a personal computer (PC) such as a desktop computer or a notebook computer, May be any device having performance.

The user computer 10 is provided with a game client 11 that allows a user to use an online game.

The game client 11 can be downloaded and installed through the communication network 15 and is maintained in the latest version. The game client 11 can display the game related announcements, process the game screen, process sound effects, provide various user interfaces for the game, It is responsible for various roles to be performed.

The game client 10 basically performs the online game while communicating with the game server 17 and the roles of the game client 11 and the game server 17 can be variously configured as needed .

2 shows a specific example of the user computer 10.

Each element is connected to each other through a system bus 10-1 having a variety of structures, and plays a role of exchanging data with each other under the general control of a central processing unit (CPU) 10-2.

The memory 10-3 is a RAM (Random Access Memory), and stores a computer program or data to be immediately accessed by the central processing unit 10-2.

The input device interface 10-4 is connected to the input device 10-5 so that a user can input various commands and information to the user computer 10. [ The user computer 10 may be connected to various input devices 10-5 such as a keyboard, a mouse, a keypad, and a touch screen through an input device interface 10-4.

The display adapter 10-6 processes the video information to be outputted through the various display devices 10-7, and the sound card 10-8 processes the audio information and outputs it through the speaker 10-9.

The network interface 10-11 enables the user computer 10 to communicate with various communication networks 15 such as a wired Internet network or a wireless Internet network.

The storage medium 10-10 is non-volatile and may have various forms of embedded, external, removable, non-removable, accessible by the user's computer 10.

Various computer programs and data such as an operating system (OS) 14 and a game client 11 such as Microsoft's Windows are installed and stored in the storage medium 10-10.

In particular, the storage medium 10-10 may be provided with a robot program 12, which disguises itself as a user and abnormally advances an online game according to programmed contents.

When the user executes the game client 11, the game client 11 is loaded into the memory 10-3 to generate an online game process, and the central processing unit 10-2 sequentially processes the corresponding code.

When the online game is used abnormally, the robot program 12 is also executed. The robot program 12 injects a malicious module into the online game process of the memory 10-3 and the malicious module calls a game function to obtain in-game goods such as hunting and gathering, and proceeds the game .

The malicious module that the robot program 12 injects into the online game process is generally made of a dynamic link library (DLL).

Hereinafter, for convenience of explanation, a game function called by a malicious module injected into the online game process by the robot program 12 will be referred to as a 'monitoring target function'. A monitored function is a normal game function even if it is called by a malicious module.

Referring to FIG. 3, an embodiment of a malicious module detection method in an online game according to the present invention will be described.

First, a monitoring function is called together with a monitoring target function by a certain module of the online game process (S211).

Here, the monitoring function refers to a program code used for monitoring a malicious module according to the present invention, and is configured to be called when a monitoring target function is called in connection with a monitoring target function.

4, the malicious module 41 injected into the online game process 40 generated by the robot program 12 in the memory 10-3 calls the monitoring target function 43 to proceed with the game . At this time, the monitoring target function 43 is connected to the monitoring function 45, and the monitoring target function 43, which is called by the malicious module 41, calls the monitoring function. Then, the monitoring function 45 performs steps S212 to S215 to determine whether or not the module calling the monitoring target function 43 is a malicious module.

The monitoring function called in step S211 checks the list of each module loaded in the online game process (S212).

The method for obtaining the module list for the monitoring function in step S212 can be variously configured. As a specific example, if the operating system of the user computer 10 is Microsoft's Windows, a module list can be obtained by using a Windows application program interface (API) function.

In addition, the monitoring function examines the address loaded in the memory 10-3 by each module of the module list identified in step S212 (S213).

Then, the monitoring function examines the call stack (Call Stack) and checks the return address of the monitoring target function called in step S211 (S214).

A call stack is a memory area that dynamically stores information about the call relationship between functions, and in particular, stores a memory address (return address) to be returned when each subroutine is terminated.

FIG. 5 shows an example of a call stack, and a parameter (PARAM), a return address, and a local variable (LOCAL) corresponding to each subroutine are stored. 'PARAM' is an area for storing information about a parameter of a function, and a return address is an area for storing an address to be returned after a called function is terminated, and 'LOCAL' is an area for storing a local variable.

Now, the monitoring function can find the module that called the monitoring target function based on the return address confirmed in step S214, analyze the information of the module, and determine whether it is a malicious module (S215).

The method for determining whether the module that calls the monitoring target function in step S215 is a normal module or a malicious module may be configured in various ways.

For example, a file name of the corresponding module, a file size of the module, and a hash value of the module can be determined. That is, if the file name, file size, hash value, etc. of the module do not match the information of the normal module known by the monitoring function, it can be determined as a malicious module.

In addition, the code of the corresponding module existing in the memory 10-3 may be compared with a code of a normal module to determine whether the corresponding module is a malicious module.

6, the monitoring function can transmit information on the module to the specific server through the communication network 15 when the corresponding module is the malicious module as a result of the determination in step S215 (S216-1) 2).

Here, the specific server may be the game server 17 or a separate server (not shown) performing the malicious module monitoring function. Then, the server can take an action against the user who is using the online game abnormally.

In step S216-2, the information to be transmitted to the specific server may vary according to need. The file name of the corresponding module, the file size of the module, the contents of the loaded memory block, and the like.

Referring to FIG. 7, another embodiment of a malicious module detection method in an online game according to the present invention will be described.

Steps S231 to S234 in FIG. 7 are the same as steps S211 to S214 described with reference to FIG. 3, and therefore duplicate description will be omitted.

Then, the monitoring function can find the module that called the monitoring target function based on the return address confirmed in step S234, and transmits information about the module to the specific server through the communication network (S235).

The information to be transmitted to the specific server in step S235 may vary as needed.

For example, a file name of the corresponding module, a file size of the module, a hash value of the module, a content of the loaded memory block, and the like.

Then, the specific server analyzes the information received through the communication network to determine whether the corresponding module is a normal module or a malicious module.

As a concrete example, it is checked whether or not the file name, file size, hash value, etc. of the module coincide with previously known information, or whether the code of the memory block coincides with the code of the normal module, It can be determined whether or not the malicious module is malicious.

Here, the specific server may be the game server 17 or a separate server (not shown) performing the malicious module monitoring function.

Meanwhile, the malicious module detection method in the online game of the embodiment described with reference to FIG. 3 can be implemented as a computer-readable code on a computer-readable recording medium.

The malicious module detection method in the on-line game of the embodiment described with reference to FIG. 7 can also be implemented as a computer-readable code on a computer-readable recording medium.

The computer-readable recording medium includes all kinds of recording apparatuses in which information that can be read by a computer is stored.

For example, it may include a ROM (Read Only Memory), a RAM, a CD-ROM, a magnetic tape, a floppy disk, a hard disk drive (HDD), an optical data storage device, a Universal Serial Bus have. And may be implemented in a form that is transmitted through a communication network.

A specific process of detecting a malicious module according to the present invention will be described with reference to an example of the memory 10-3 shown in Fig.

Kernel32.dll 81, abc.dll 83, and game.exe 84, which execute an online game process, are loaded in the memory 10-3. Depending on the number of threads included in the online game process, A stack area 82 is allocated.

If a module calls a game function (watchdog function), the watchdog function is called as well as this game function is called.

The monitoring function obtains a list including a list including all the modules of the online game process, for example, Kernel32.dll (81), abc.dll (83), and game.exe (84). At this time, if the operating system (OS) of the user's computer is Microsoft's Windows, the monitoring function can obtain a list of modules used by the online game process using the Windows API function.

Also, the monitoring function examines the address where Kernel32.dll (81), abc.dll (83), and game.exe (84) are loaded into the memory 10-3.

In the stack area 82, the return address of the called function (monitoring target function) is checked to determine which module has called the monitoring target function.

For example, if the return address is between 0x00400000 and 0x00420000 ', the module that called the watchdog function is' abc.dll'.

Now, the surveillance function checks whether the 'abc.dll' module is a malicious module by checking whether the file name, file size, and hash value of the 'abc.dll' module matches that of a known normal module, or Send information about abc.dll to a specific server.

It is to be understood that the present invention is not limited to the above-described embodiment, and that various changes and modifications may be made by those skilled in the art without departing from the technical spirit of the present invention. to be.

10: user computer 11: game client
12: Robot program 15: Communication network
17: game server 10-2: central processing unit (CPU)
10-3: Memory 10-10: Storage medium
14: Operating system (OS) 40: Online game process
41: malicious module 43: monitored function
45: Surveillance function

Claims (10)

CLAIMS 1. A method for detecting a malicious module running on a user's computer,
Checking a list of modules loaded in an online game process running in the user computer;
Checking each module in the list for an address loaded into memory;
Checking a call stack to check a return address of a called function - the called function being a normal game function; And
Analyzing a module indicated by the return address of the called function and determining whether the module is a normal module,
Wherein each of the steps is performed by a monitoring function that is called together when the called function is called,
Wherein the monitoring function determines whether the module is a normal module by using at least one of a file name, a file size, and a hash value of a module indicated by a return address of the called function. Detection of malicious modules in games. The method according to claim 1,
Wherein the module to be monitored by the monitoring function includes a dynamic link library (DLL). delete The method according to claim 1,
Wherein the monitoring function transmits predetermined information to the specific server via a communication network when the module is an abnormal module as a result of the determination. CLAIMS 1. A method for detecting a malicious module running on a user's computer,
Checking a list of modules loaded in an online game process running in the user computer;
Checking each module in the list for an address loaded into memory;
Checking a call stack to check a return address of a called function - the called function being a normal game function; And
And transmitting information of a module indicated by the return address to a specific server through a communication network,
Wherein each of the steps is performed by a monitoring function that is called together when the called function is called,
Wherein the monitoring function determines whether the module is a normal module by using at least one of a file name, a file size, and a hash value of a module indicated by a return address of the called function. Detection of malicious modules in games. 6. The method of claim 5,
Wherein the module to be monitored by the monitoring function includes a dynamic link library (DLL). delete 6. The method of claim 5,
Wherein the specific server analyzes the module information received through the communication network to determine whether the module is a normal module or not. delete delete

Images