KR101783159B1 - Apparatus and method of detecting intrusion of into files on computer network - Google Patents

Abstract

The present invention relates to a device for preventing an intrusion into a file on a computer network by first detecting the validity of an executable file before execution of a process executable file (hosts file), blocking an execution file from being tampered with, When an executable file having a specific target is executed in a folder and then a list of files in the folder is examined and a file reading operation of the executed executable file occurs in a folder in which a file list is examined A hooking unit for hooking an execution request input signal before the executable file and the dynamic connection file of the process are loaded into the memory when the file is damaged by the executable file accessing the folder, Use at least one of the hash (MD5 hash) and certificate to check whether the executable file is tampered with or malicious. A file checking unit for checking whether a malfunctioning file has been verified as a result of the file checking unit, a request for execution of the process is executed when a malfunctioning file is verified as a result of the file checking unit, And an execution processing unit for limiting the use of the computer through subsequent processing to prevent the modulated process file from being run.

Description

[0001] Apparatus and method for detecting intrusion into files on a computer network [0002]

FIELD OF THE INVENTION The present invention relates to the security field of computer processes, and more particularly, to an apparatus and method for preventing intrusion into a file on a computer network.

There are two known security models in communication network security systems: intrusion prevention and intrusion detection. Intrusion prevention is typically active, while intrusion detection is used for reporting, for example, and is passive. There are several types of intrusion prevention systems, including network based and host based.

Intrusion detection systems constantly monitor communications through the network, which protects and blocks or drops suspicious network communications, as well as alerts the network administrator. The process of blocking or dropping suspicious traffic ensures the security of the network.

Among them, malicious bots and worms are spread through easy password setting of windows system, window vulnerability, Windows shared folder, etc. Especially, malicious bots can spread through backdoor ports used by other worm viruses do. These malicious bots and worm infected systems are connected to a specific server designated by the malicious bot and worm spreader. Infected systems infiltrate specific IP band attacks, user information, etc. for additional infection according to the distributor's instructions do. In particular, malicious bots can manage infected hosts centrally by an attacker to perform various attack commands such as DoS, and perform worm attacks to infect hosts around them again.

The propagation methods of these malicious bots and worms are based on shared folders, leakage of passwords, and security vulnerabilities of Windows itself. For example, Shared Folders for management purposes, which are basically set in a Windows operating system, are necessary for administrators to access the system from a remote place, and are set by default when the system is installed. These folders are represented by the [drive] $ expression and are usually named C $, D $, and so on. If an administrator password is not set or is set to a password that is easy to guess, it can be exposed to various attacks from remote sites. These vulnerabilities exploit malicious bots and worms to spread.

Also, if there is no administrator password of the administrator of the window system or password that is easy to guess, it may be vulnerable to attack by malicious bot. Systems that are infected with malicious bots and worms spread themselves through a shared IPC $ (TCP port 445) for administrative purposes in order to find a system that uses an easily identifiable user account (ID) and password. In other words, malicious bots and worms copy related files to the Windows folder or Windows system folder, add themselves to the registry to run when Windows starts automatically, and then the malicious bots and worms The antivirus program modifies the hosts file so that the antivirus program can not update the newly added virus pattern, and then the operating system registration number (CD Key) of the user of the window, the game CD Keys, personal data, etc.

The system infected by malicious bots and worms makes an unnecessary network connection attempt for additional infection. The additional attack and service attack for this infection causes excessive network traffic. The system infected by malicious bots and worms is executed by a specific processor The system may be slowed down because the CPU is occupied.

Many methods have conventionally been proposed for selecting scales to be used for detection of such malicious bots and worms and it has been proposed that malicious bots or worm detection methods based on attack signatures and malicious bots A method of using these behavior models by analyzing patterns of traffic generated by a bot or a worm, and a method of using the behavior as an indicator by analyzing a trend causing an increase in traffic have been conventionally used.

A signature-based malicious bot or worm detection method used in dual-commercial vaccines and most intrusion detection systems exploits the signatures contained in the data area of a worm or malicious bot, It is classified as an attack.

However, the detection method using such a scale requires a direct search of the data area of the packet. In order to search the data area of the packet transmitted on the network, there is a problem that the search time is long. There was a problem of.

Also, information on the SYN flag of the TCP header and the success of the 3-way handshake is used as a main measure in the case of detecting the worm by analyzing the traffic pattern using the mathematical algorithm TRW (Threshold Random Walk). It can detect worms using TCP protocol quickly, but can not detect worms that scan worms. In the case of Detecting Early Worm Propagation through Packet Matching (DEWP), which is a method of detecting worms by classifying the traffic flowing into the network into specific patterns, the access port is used as a scale and based on the frequency of access, Although it is easy and easy to detect, the frequency of worms and general users may become similar in case of a site which suddenly increases the number of external users, so that there is a disadvantage in that detection is wrong.

Japanese Patent Application Laid-Open No. 10-2013-0117728 (published on October 20, 2013) Patent Registration No. 10-0602920 (registered date 2006.07.12)

SUMMARY OF THE INVENTION Accordingly, the present invention has been made to solve the above problems, and it is an object of the present invention to provide a method and system for detecting a legitimacy of an executable file before execution of a process executable file (hosts file) It is an object of the present invention to provide an apparatus and method for preventing intrusion into a file on a computer network.

It is another object of the present invention to provide an apparatus and method for preventing intrusion into a file on a computer network for protecting a user data file, not a configuration for preventing virus infiltration of all stored executable files.

Other objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood by those skilled in the art from the following description.

According to another aspect of the present invention, there is provided an apparatus for preventing intrusion into a file on a computer network, the apparatus comprising: an execution file having a specific target executed in a folder; When the file reading operation of the executed executable file is performed in the inspected folder, if the file is damaged by the executable file accessing the corresponding folder, A hooking unit for hooking an execution request input signal before the executable file and the dynamic connection file of the process are loaded into the memory, and a modulating unit for modifying executable files using at least one of a header, a hash (MD5 hash) And a file checking unit for checking whether a malicious file is malicious. When a malfunction file is verified as a result of the file checking unit, a request for execution of the process is executed. When a file is damaged, And an execution processing unit for limiting the use of the computer through subsequent processing for the execution process recognized as the execution process and preventing the modulated process file from being executed.

Preferably, the hooking unit detects a file corruption due to overwriting, a file corruption due to deletion of an original after a new file is created, and a file corruption due to the renaming of the original file after a new file is created. do.

Preferably, the file checking unit includes a detecting unit detecting at least one of a header, a hash (MD5 hash) and a certificate of an executable file, a storage unit storing unique information of the process file using an encryption table according to a predetermined rule, And a comparison unit comparing the verification information detected by the detection unit and the unique information stored in the storage unit and checking the integrity according to the match.

Preferably, the detecting unit includes a header detecting unit for detecting a header for verification in an executable file when an executable file accesses a protected folder of the process, a hash function for verifying in the executable file when the executable file accesses the protected folder, And a certificate detection unit for detecting the content of the certificate for verification in the executable file when the executable file is accessed by the protected folder.

Preferably, the execution processing unit permits the use of the computer only when the integrity check file is verified as a result of checking the file checking unit to execute the execution request of the input process, and if not verified, executes all the file accesses The process is terminated, the process moves to the quarantine area so that the malicious action file can not be executed again, and the previously backed up file is restored to its original position .

According to another aspect of the present invention, there is provided a method of preventing intrusion into a file on a computer network, the method comprising: (A) detecting execution of a file having a specific target in a folder, When a file reading operation of the executed executable file is performed in a folder in which a file list is examined, if a file is damaged by an executable file accessing the corresponding folder, the executable file and the dynamic link file of the process are stored in the memory (B) examining whether the executable file is tampered with and malicious using at least one of a header, a hash and a certificate of the process through a file checker, and (C) executing an execution request of the process when the integrity check file is verified through the execution processing unit, and If not, there makin comprises the step of preventing in advance that a modulation process by limiting the file using the computer via the drive of the subsequent processing execution process.

Preferably, the step (A) includes detecting a file corruption due to overwriting, a file corruption due to the deletion of the original after creation of a new file, and a file corruption due to the renaming of the original file after the creation of a new file, .

Preferably, the step (B) includes the steps of: detecting verification information of at least one of a header, a hash and a certificate of an executable file; and comparing the detected verification information with unique information of a process file And checking the integrity according to whether or not the process file is encrypted. At this time, the unique information of the process file is encrypted according to a predetermined rule and stored in the storage unit.

Preferably, the step (B) encrypts part or all of the header value of the process authenticated by the user and stores the encrypted partial or entire header value in the storage unit. When the process accesses the protected folder with the executable file, Comparing the read verification header with a unique header stored in the storage unit; authenticating the executable file as a zero-defect file if it is the same as the comparison result, and estimating the executable file as a malicious file if the comparison is not successful; And a step of informing a user of the computer if it is estimated as a file.

Preferably, the step (B) may include calculating and encrypting a hash value of a process authenticated by the user, storing the hash value in a storage unit, and, when the executable file accesses the protected folder, Comparing the computed verification hash value with a unique hash value stored in the storage unit; and if the comparison result indicates that the executable file is authenticated as a non-integrity file, And a step of notifying a user of the computer if the malicious file is estimated.

Preferably, the step (B) includes encrypting a specific value including a name or a detailed content of the process certificate authenticated by the user and storing the encrypted specific value in a storage unit, and when the executable file accesses the protected folder, Comparing the extracted certificate contents with a unique certificate specific value stored in the storage unit, and if the same is the result of the comparison, authenticating the executable file as a zero-integrity file, Estimating the file as a malicious file, and notifying a user of the computer when the malicious file is estimated.

Preferably, the subsequent process of step (C) further comprises: blocking all file accesses to prevent further file corruption, forcibly terminating the process, moving to the quarantine station area to prevent the malicious action file from being executed again, , And restoring the file backed up before the damage to the original location.

The apparatus and method for preventing intrusion into a file on a computer network according to the present invention as described above have the following effects.

First, there is an effect that the executable file is prevented from executing the process of the modulated or suspicious file, thereby solving the problem that the important packet of the process may be lost.

Second, when various software installed in a computer is modified by a virus or a hacking tool, it is easy to detect it before execution of a process, thereby providing a stable PC environment.

Thirdly, after an executable file having a specific target is executed in a folder, only an executable file that accesses the folder is hooked, inspected, and executed in a hooking unit, a file checking unit, and an execution processing unit, The time can be processed more quickly.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a block diagram illustrating a configuration of an intrusion prevention apparatus into a file on a computer network according to an embodiment of the present invention; FIG.
FIG. 2 is a block diagram showing in detail the configuration of the file checking unit in FIG.
3 is a flowchart illustrating a method for preventing intrusion into a file on a computer network according to an embodiment of the present invention.
FIG. 4 is a flowchart for explaining a process of detecting a process header as verification information in the method of checking the modulation and maliciousness of an executable file in FIG.
FIG. 5 is a view illustrating a screen in which a file in which a process currently in operation is stored is displayed using the Hex Viewer
FIG. 6 is a flowchart for explaining the process of detecting a process hash as verification information in the method of checking the modulation and maliciousness of an executable file in FIG.
FIG. 7 is a diagram showing the MD5 hash value of the process in FIG. 6
FIG. 8 is a flow chart for explaining a process of detecting a process certificate as verification information in the method of checking the modulation and maliciousness of an executable file in FIG. 3
Figure 9 is a view of the certificate of the process in Figure 8;

Other objects, features and advantages of the present invention will become apparent from the detailed description of the embodiments with reference to the accompanying drawings.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of an apparatus and method for preventing intrusion into a file on a computer network according to the present invention will now be described with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. It is provided to let you know. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention and are not intended to represent all of the technical ideas of the present invention. Therefore, various equivalents It should be understood that water and variations may be present.

1 is a block diagram showing a configuration of an intrusion prevention device into a file on a computer network according to an embodiment of the present invention.

As shown in FIG. 1, after an executable file having a specific target is executed in the folder, it is recognized that the file list in the corresponding folder is examined, and the file read operation of the executed executable file occurs in the folder in which the file list is examined A hooking unit 100 for hooking an execution request input signal before the executable file and the dynamic connection file of the process are loaded into the memory when the file is damaged by the executable file accessing the folder, A file inspecting unit 200 for inspecting whether an executable file has been tampered with or malicious using at least one of a header, a hash (MD5 hash) and a certificate of the process; and a file checking unit Executes the process execution request, backs up the original file before the damage if the file is damaged, Consists of the execution processing section 300 executes a process.

For reference, a specific target file refers to a file that is subject to such a tampering and malicious file attack because only the file (.doc) having user data is targeted and a malicious file attack is being performed.

At this time, the hooking unit 100 detects that the file is damaged in the following three cases.

First, file corruption due to overwriting. That is, a write operation is generated with the modified contents of the file in which the file read operation occurred (for example, reading the file A -> writing the file A).

 Second, file corruption due to deletion of original after creation of new file. That is, a file having a different name is created in the folder where the file reading operation is performed, and the file in which the file reading operation is performed is deleted (for example, reading the file A -> creating the file B -> deleting the file A)

Third, file corruption caused by renaming the original file after creating a new file. That is, a file with a different name is created in the folder in which the file diary operation has occurred, and the path of the file in which the file read operation occurred is changed (for example, reading file A -> creating file B -> changing file A name)

Meanwhile, the hooking unit 100 may hook an application programming interface (API) used by a process requested to be executed. API hooking refers to the technique of intercepting the commands used by a process to view or manipulate the commands or parameters used. That is, the operation of the file checking unit 200 may be included in the hooking routine.

In addition to EXE files called executable processes or application applications, DLL files called dynamic link libraries for process execution are loaded into memory at the time of program execution. These EXE files and related DLL files are loaded into the memory so that the process becomes available, and one EXE and several related DLLs thus constitute one process. The present invention can check the integrity of the program file before the actual process is started by using the hooking technique by the action action.

However, the present invention is not limited to this, and the hooking unit 100 may be configured to generate a hooking signal to perform an integrity check when power is supplied to the computer, that is, when booting up or when downloading a new process file.

The file checking unit 200 checks at least one of a header, a hash (MD5 hash) and a certificate of the process to check whether the executable file is a malicious file or not, A storage unit 220 for storing unique information (a header, a hash, a certificate, and the like) of the process file using an encryption table according to a predetermined rule; (230) for comparing the verification information detected by the verification unit (210) with the unique information stored in the storage unit (220) and checking the integrity according to whether the verification information matches or not.

In this case, the detection unit 210 includes a header detection unit 211 for detecting a header for verification in an executable file when an executable file accesses a protected folder of the process, A hash detection unit 212 for calculating and detecting a hash value for verification in a file, and a certificate detection unit 213 for detecting the contents of a certificate for verification in an executable file when an executable file accesses a folder protected by the process .

The execution processing unit 300 permits the use of the computer only when the integrity check file of the file checking unit 200 is verified to execute the execution request of the input process, and when the file is damaged, And restricting the use of the computer through subsequent processing of the execution process recognized as malicious action, thereby preventing the process file from being tampered.

The subsequent processing firstly blocks all file accesses to prevent further file corruption, and then forcibly terminates the process. Second, it moves to the quarantine area so that malicious file can not be executed again. Third, restore the files that were backed up before the damage to the original location.

Hereinafter, the operation of the intrusion prevention device in a file on the computer network according to the present invention will be described in detail with reference to the accompanying drawings. Like reference numerals in FIG. 1 or FIG. 2 denote the same members performing the same function.

3 is a flowchart illustrating a method for preventing intrusion into a file on a computer network according to an embodiment of the present invention.

Referring to FIG. 3, when an executable file having a specific target is executed in a folder, it is recognized that a list of files in the folder is inspected and a file reading operation of the executed executable file occurs in a folder in which a file list is examined , And if the file is damaged by the executable file accessing the folder (S100) The execution request input signal is hooked (S200) before the execution file of the process and the dynamic connection file are loaded into the memory through the hooking unit 100. [

The detection of the damage of the file refers to the following three cases.

First, file corruption due to overwriting. That is, a write operation is generated with the modified contents of the file in which the file read operation occurred (for example, reading the file A -> writing the file A).

Second, file corruption due to deletion of original after creation of new file. That is, a file having a different name is created in the folder where the file reading operation is performed, and the file in which the file reading operation is performed is deleted (for example, reading the file A -> creating the file B -> deleting the file A)

Third, file corruption caused by renaming the original file after creating a new file. That is, a file with a different name is created in the folder in which the file diary operation has occurred, and the path of the file in which the file read operation occurred is changed (for example, reading file A -> creating file B -> changing file A name)

Then, at least one of the header, the hash (MD5 hash) and the certificate of the process is used by the file checking unit 200 to check whether the executable file is malfunctioning or not (S300).

A header detection unit 211, a hash detection unit 212 and a certificate detection unit 213 through a detection unit 210 as a method of checking whether the executable file is modulated and malicious, and outputs a header of the executable file, a hash (MD5 hash) (Header, hash, certificate, etc.) of the process file stored in advance in the storage unit 220 and the detected verification information, and checks the integrity of the process file according to the match do. At this time, the unique information of the process file is stored in the storage unit 220 using an encryption table according to predetermined rules.

Accordingly, a more detailed description will be described in more detail below with reference to FIGS. 4 to 9. FIG.

Next, when the integrity check file is verified through the execution processing unit 300, the execution request of the process is executed (S400). As a result of checking the file checking unit 200, only when the integrity file is verified, the use of the computer is permitted and the execution request of the inputted process is executed. If the file is not verified, the use of the computer is restricted through the subsequent process for the execution process, Thereby preventing the process file from being driven.

The subsequent processing firstly blocks all file accesses to prevent further file corruption, and then forcibly terminates the process. Second, it moves to the quarantine area so that malicious file can not be executed again. Third, restore the files that were backed up before the damage to the original location.

FIG. 4 is a flowchart for explaining a process of detecting a process header as verification information in the method of checking the modulation and maliciousness of an executable file in FIG.

Referring to FIG. 4, first, a part or all of the header value of the process authenticated by the user is encrypted and stored in the storage unit 220 (S310). At this time, as shown in FIG. 5, the header of the process is as shown in FIG. 5 by looking at the Hex (hexadecimal) value. 5 is a screen in which a file in which an actual process is stored is displayed using the Hex Viewer.

When the process accesses the protected folder, the verification header is read from the executable file (S311).

The verification header is compared with the unique header stored in the storage unit 220 in step S312. If the same is true, the execution file is authenticated as a non-integrity file and the operation for performing the subsequent process is not blocked in step S313. The executable file is estimated as a malicious file, and the process is prevented from accessing the protected folder (S314), and then the user of the computer is notified (S315).

On the other hand, if the user specifies a process for a malicious process (process termination, deletion, etc.), the process is processed according to the description of the user.

FIG. 6 is a flowchart for explaining a process of detecting a process hash as verification information in the method of checking the modulation and maliciousness of an executable file in FIG.

Referring to FIG. 5, first, a hash value of a process authenticated by the user is calculated, encrypted, and stored in the storage unit 220 (S320). 7 is a diagram showing the MD5 hash value of the process, and shows a value calculated by reading the file in which the process is stored.

If the process accesses the protected folder, the verification hash value is calculated in the executable file (S321).

In step S322, the computed verification hash value is compared with the unique hash value stored in the storage unit 220. If they are the same, the execution file is authenticated as a non-integrity file, If the file is not correct, the executable file is estimated as a malicious file, and the process is prevented from accessing the protected folder (S324), and then the user of the computer is notified (S325).

On the other hand, if the user specifies a process for a malicious process (process termination, deletion, etc.), the process is processed according to the description of the user.

FIG. 8 is a flowchart for explaining a process of detecting a process certificate as verification information in the method of checking the modulation and maliciousness of an executable file in FIG.

First, the specific value (certificate name, certificate details) of the process certificate authenticated by the user is encrypted and stored in the storage unit 220 (S330). 9 is a view showing a certificate of the process.

When the executable file accesses the protected folder, the content of the certificate is extracted from the executable file (S331).

In step S332, the extracted certificate content is compared with the unique certificate specific value stored in the storage unit 220. If the same is true, the execution file is authenticated as a non-integrity file, . If it is not correct, the executable file is estimated as a malicious file, and the process is prevented from accessing the protected folder (S334), and the user of the computer is notified (S335).

On the other hand, if the user specifies a process for a malicious process (process termination, deletion, etc.), the process is processed according to the description of the user.

For reference, certificate-based authentication can use the following functions. In other words, even if the certificate information is not stored in advance, it can be judged as a safe process even if the entire process authenticated through the certification authority or a well-known company (Microsoft, Adobe, have.

For example, if the authentication name is Microsoft, judge every process as a safe process (limited aggregation), or judge it as safe (the most extensive set) for all processes that have a certificate granted by the certification authority.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. It will be apparent to those skilled in the art that various modifications may be made without departing from the scope of the present invention. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

Claims (12)

When an executable file having a specific target is executed in a folder and a list of files in the folder is examined and a file reading operation of the executed executable file occurs in a folder in which a file list is examined, A hooking unit for hooking an execution request input signal before the executable file and the dynamic connection file of the process are loaded into the memory,
A file checking unit for checking whether the execution file is tampered with or malicious using at least one of a header, a hash (MD5 hash) and a certificate of the process;
A file execution unit configured to execute a process execution request when a defect-free file is verified as a result of the file checking unit; back up the original file before a damage is detected if a file is damaged; And an execution processing unit for restricting the use of the computer through the network and preventing the modulated process file from being driven,
At this time, the file checking unit
A detection unit for detecting verification information of at least one of a header, a hash (MD5 hash) and a certificate of an executable file;
A storage unit for storing unique information of a process file using an encryption table according to a set rule;
And a comparison unit comparing the verification information detected by the detection unit and the unique information stored in the storage unit and checking the integrity according to whether the verification information matches or not.
The detection unit
A header detecting unit for detecting a header for verification in an executable file when the executable file accesses the protected folder of the process;
A hash detector for calculating and detecting a hash value for verification in an executable file when an executable file accesses a protected folder of the process,
And a certificate detection unit for detecting the contents of the certificate for verification in the executable file when the executable file accesses the protected folder of the process. The method according to claim 1,
Wherein the hooking unit detects a file corruption due to overwriting, a file corruption due to deletion of an original after a new file is created, and a file corruption due to a change of the original file name after a new file is created, Intrusion prevention device into file on network. delete delete The method according to claim 1,
The execution processing unit permits the use of the computer only when the integrity check file of the file checking unit is verified and executes the execution request of the input process, and if not verified, blocks all file access to prevent further file damage The process is forcibly terminated, the malicious action file is moved to the quarantine station area so as not to be executed again, and the file backed up before the damage is restored to the original location. (A) When an executable file having a specific target is executed in a folder, it is recognized that a file list in the folder is examined, and when a file reading operation of the executed executable file occurs in a folder in which a file list is examined, Hooking the execution request input signal before the execution file and the dynamic connection file of the process are loaded into the memory through the hooking unit when the file is damaged by the executable file,
(B) checking whether the executable file is tampered with and malicious using at least one of a header, a hash and a certificate of the process through a file checking unit;
(C) executing an execution request of the process in the case where the defect-free file is verified through the execution processing unit through the execution processing unit, and if not verified, restricting the use of the computer through subsequent processing for the execution process, In advance,
At this time, the step (B)
Calculating and encrypting a hash value of a process authenticated by a user and storing the encrypted hash value in a storage unit;
When the process accesses the protected folder with the executable file, calculating a verification hash value in the executable file;
Comparing the calculated verification hash value with a unique hash value stored in a storage unit,
Authenticating the executable file as a zero-defect file if the result of the comparison is the same; estimating an executable file as a malicious file if it is not correct;
And notifying a user of the computer if the malicious file is estimated as malicious file. 7. The method of claim 6, wherein step (A)
A file damage due to overwriting, a file damage due to deletion of an original after creation of a new file, and a file damage due to a change of the original file name after generation of a new file are detected as a damage of the file by the executable file. A method for preventing intrusion into a vehicle. 7. The method of claim 6, wherein step (B)
Detecting verification information of at least one of a header, a hash and a certificate of an executable file;
Comparing the detected verification information with the unique information of the process file stored in advance in the storage unit, and checking the integrity according to whether the verification information matches or not,
Wherein the unique information of the process file is encrypted according to a predetermined rule and stored in the storage unit. 7. The method of claim 6, wherein step (B)
Encrypting a part or all of a header value of a process authenticated by a user and storing the encrypted header value in a storage unit;
Reading a verification header from the executable file when the process accesses the protected folder with the executable file;
Comparing the read verification header with a unique header stored in a storage unit;
Authenticating the executable file as a zero-defect file if the result of the comparison is the same; estimating an executable file as a malicious file if it is not correct;
And notifying a user of the computer if the malicious file is estimated as malicious file. delete 7. The method of claim 6, wherein step (B)
Encrypting a specific value including a name or detail of a process certificate authenticated by the user and storing the encrypted specific value in a storage unit;
Extracting certificate contents from the executable file when the executable file accesses the protected folder,
Comparing the extracted certificate content with a unique certificate specific value stored in a storage unit,
Authenticating the executable file as a zero-defect file if the result of the comparison is the same; estimating an executable file as a malicious file if it is not correct;
And notifying a user of the computer if the malicious file is estimated as malicious file. 7. The method of claim 6, wherein the subsequent processing of step (C)
Blocking all file accesses to prevent further file corruption and forcing the process to terminate;
Moving to the quarantine station area to prevent the malicious action file from being executed again,
And restoring the file that was backed up before the damage to the original location.

Images