KR101937325B1 - Method for Detecting and Preventing Malware and Apparatus thereof - Google Patents

Abstract

The present invention relates to a method for detecting and preventing malware and an apparatus for the same. In order to solve a problem caused by methods of prevention based on a blacklist and a whitelist, the apparatus is suitable for detecting malware, performing of warning a user and forcible blocking gradually and preventing widespread attacks of malware in advance when malware such as ransomware performs search and change actions on a plurality of files with regard to storage devices such as a hard disk, a removable disk, and a network storage connected to a terminal such as a PC, etc. The method comprises the processes of: a first process of detecting a search act; a second process of identifying whether the search act is registered as a first trust process; a third process of warning to a user′s terminal; a fourth process of saving a back-up file and processing a file; a fifth process of comparing a similarity of the back-up file and the processed file; a sixth process of comparing and identifying whether the file is registered as a second trust process when a similarity is low below a standard; and a seventh process of returning to the first process in order to process search to a next file when the file is identified as the second trust process.

Description

FIELD OF THE INVENTION [0001] The present invention relates to a method and a device for detecting malware,

The present invention relates to a system and method for detecting and blocking a malicious code in a computer system, and more particularly, to a system and method for detecting and blocking a malicious code in a computer system, And more particularly, to a method and apparatus for detecting and blocking malicious codes that determine whether malicious code is the same and perform a warning and a forced block to the user step by step to block a wide range of malicious code in advance.

Ransomware Malicious code originated from malware type virus program which was made for the purpose of disabling the user terminal such as the conventional PC or damaging the user's file. However, (Such as asymmetric key 2048 bits and symmetric key 256 bits), and then it is an evolved form of malicious code that requires a significant amount of money in exchange for restoration of the file.

These technologies are relatively easy to develop and are becoming more widespread due to the emergence of an environment in which money can securely be earned thanks to the emergence and growth of anonymity such as bit coins, Techniques are evolving rapidly.

Conventional vaccine programs collect information about malicious codes causing damage more than once and then accumulate the hash value of the malicious code or the type (signature, signature) information of other code in the DB, And provides a black list method in which when the mobile terminal is infiltrated into a terminal such as a PC and executed, it is detected and blocked in advance.

However, as mentioned above, the malware of Ransomware which can be easily modified can not be sufficiently blocked by the existing black list because the generation of spreads and modification codes is so high that about 1,000 variants are generated and distributed worldwide.

Therefore, recently, various technologies for blocking and defending Ransomware have been studied and commercialized. In order to block malicious codes of variants that are rapidly transformed, it is necessary to detect the behavior of an unspecified process, and if the behavior of the process is doubtful But it also maintains a whitelist, which is a list of trusted processes to reduce cases of false detection.

The problem is that it is very difficult to realistically detect the behavior of many processes that perform the tasks of the OS and the user of the PC terminal and accurately classify the Rangemeware through it. Therefore, it is difficult to use complex technologies and algorithms, , And it is a reality that there are many cases where an actual Ransomware attack is rendered ineffective due to an error of an exceptioned whitelist list.

The passive method of generating a decoy file and detecting the process of modifying the file with the Ransom has been rendered ineffective by the introduction of Ransomware, which has already avoided the introduction of trap files by hackers, Blocking systems that want to be aware of attacks should establish appropriate and valid criteria for file input / output (I / O) operations and file content changes in many processes, but there is a realistic probability of false positives and detections, If an attack occurs on a processed process, a single attack will cause a fatal damage to the user file.

If the most appropriate point of malicious code behavior that damages a file can be detected and deformation behavior can be detected, the reliability of the preemptive blocking and defense of the malicious code as described above is greatly improved and even in the worst case, , The technical approach to the point in time should first be established.

KR 10-1685014 B1

In order to solve the problems caused by the conventional black list-based blocking method and the whitelist-based blocking method, malicious codes such as a random software are stored in a storage medium such as a hard disk, a removable disk, The malicious code is detected by detecting malicious code when performing a plurality of file searching and changing operations on the malicious code, And to provide a method and a device therefor.

Another object of the present invention is to provide an opportunity for user judgment in a user warning process in case of detection as a randomware, thereby providing an opportunity for immediate follow-up without a separate exception processing procedure and reflecting the same in a whitelist and a blacklist DB .

In order to accomplish the object of the present invention, a malicious code detection and blocking process includes detecting and blocking a malicious code process based on a plurality of file searching and changing actions on a storage medium of a user terminal by a malicious code blocking module mounted on the user terminal The method comprising: detecting a search behavior of a plurality of files stored in a storage medium of a user terminal by the malicious code blocking module; A second step of confirming that the search process is a first trust process registered in a trust database when a search operation for a predetermined protected file is detected during the first process; A third step of alerting the user terminal if the process is not registered in the trust database in the second process; A fourth step of storing the backup file for the corresponding file and proceeding to the corresponding process when the user terminal selects allow or exception processing for the corresponding process in the third step; A fifth step of comparing the similarity between the backup file before the process progress and the file after the process progress in the fourth process; A sixth step of comparing whether the second trust process registered in the trust database corresponds to the second trust process when the degree of similarity is equal to or greater than the damage criterion in the fifth process; And a seventh step of, if it is determined in the sixth step that the file corresponds to the second trust process, returning to the first step to proceed with a search process for the next file.

Herein, the process for each file detected by the malicious code blocking module in each process is an accessing operation including file search, open, write, and delete, and the malicious code is a file storing user information excluding an executable file or a system important file And the protection target file is set as a file in which the target user information is stored.

In addition to the seventh process, if the corresponding file does not correspond to the second trust process in the sixth process, the current process is blocked, and then the alert is notified through the user terminal; If the exception process for the current process is selected by the user terminal of the first stage, storing the trust process in the trust database as a second trust process; And restoring the backup file stored in the fourth step when rejection of the current process is selected by the user terminal of the first step.

Another method for achieving the object of the present invention is to detect malicious code for detecting and blocking a malicious code process based on a plurality of file searching and changing actions on a storage medium of a user terminal by a malicious code blocking module mounted on the user terminal And a blocking method, comprising: detecting an act of searching for a plurality of files stored in a storage medium of a user terminal by the malicious code blocking module; If a search operation for a predetermined protected file is detected during the eleventh process, a backup file for the file is stored and the corresponding process is performed; A thirteenth process of comparing the similarity between the backup file before the process progress and the file after the process progress in the twelfth process; And a 14th step of blocking the current process and restoring the stored backup file if the degree of similarity is equal to or greater than the corruption criterion in step 13.

The malicious code detection and blocking device for achieving the object of the present invention detects and blocks a malicious code process based on a plurality of file searching and changing actions on a storage medium of a user terminal by a malicious code blocking module mounted on the user terminal Wherein the malicious code blocking module monitors a file search behavior of a process performed by the malicious code and performs backup and content similarity verification of the file; A policy module for exchanging information on blocking or exception processing of the malicious code with another user terminal or malicious code blocking policy server through a network; And a database for storing exception processing information of a process performed by the malicious code.

Herein, another user terminal or malicious code blocking policy server exchanges the malicious code blocking module with the file malicious code detection information by the malicious code, and exchanges the exception processing information of the database with the malicious code blocking module through the network. And further comprising:

A self-protection module for protecting the malicious code blocking module itself from attacks including memory intrusion and forcible termination; And a notification module for notifying and querying a user when the malicious code finds a file search and a malicious behavior of the storage medium, and waits for selection by a user.

The system and method for blocking Ransomware according to the present invention can be applied to a file input / output operation (I / O) performed by a number of processes including an operating system (OS) of a user terminal such as a PC, It is possible to provide a technology of target of Ransomware behavior that minimizes false positives while using the least resources compared to Ransomware behavior based detection technology of Ransomware.

Moreover, it is possible to prevent a situation in which a user file is extensively damaged due to a single detection while simultaneously minimizing the probability of false positives.

Recognizing the unspecified process when performing a search operation on a user storage medium (a hard disk, a moving disk, a network storage, etc.), securing a file source and comparing file damage during the search process, It is not necessary to track the file change behavior of all processes by performing the process blocking and file recovery steps. This action is the core action that must be performed in all Ransomware, and it acts like Achilles tendon, It can provide the most effective and fast accurate effect on Ransomware interception.

In contrast to the conventional solutions in which an error occurs, a user arbitrarily searches for a corresponding process and performs an exception process (whitelist), the present invention provides a real-time user query and an opportunity for comment on the process at the time of searching, Processing, and blocking can be performed. As the collected information accumulates, more rapid and accurate Raman-software interception becomes possible, and it is possible to evolve into a sophisticated blocking system through information exchange between user terminals installed with the present invention system.

FIG. 1 is a configuration diagram of a Raman-software interception system according to an embodiment of the present invention,
FIG. 2 is a view schematically showing a process of operating a Raman-software interception module according to an embodiment of the present invention,
FIG. 3 is a flowchart illustrating a process of blocking the RAN firmware, according to an embodiment of the present invention,
FIG. 4 is a flowchart illustrating a process of blocking the RAN firmware in accordance with another embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, It will be possible.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail.

It should be understood, however, that the invention is not intended to be limited to the particular forms disclosed, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

Preferred embodiments of the present invention will be described with reference to the accompanying drawings. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A malicious code detection and blocking method and apparatus according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a malicious code detection and blocking apparatus according to an embodiment of the present invention. The malicious code detection and blocking apparatus includes a hard disk for storing an operating system (OS), a system file or various documents, pictures, A malicious code blocking module 110 for detecting and blocking a malicious code process based on a plurality of file searching and changing actions for the storage medium 120; a storage medium 120 such as a disk, a moving medium, a network shared folder and storage; And another user terminal or malicious code blocking policy server 101 which exchanges process exception processing information with the user terminal 100 through a network.

The malicious code blocking module 110 includes a verification module 111 for monitoring a file search behavior of a process performed by the malicious code and performing backup and content similarity verification of the file, A policy module 112 for exchanging information about exception processing with another user terminal or a malicious code blocking policy server through a network; and a notification module for notifying and querying a user when a malicious code detects a malicious code file search / A database (DB) 114 for storing exception processing information of a process performed by the malicious code, a memory (DB) 114 of the malicious code blocking module 110 itself, And a self-protection module 115 for protecting against attacks including intrusion and forcible termination.

Referring to FIG. 2, the malicious code blocking module 110 of the user terminal 100 exchanges malicious code damage, blocking information, recognition information, and the like, Another user terminal or malicious code blocking policy server 101 that exchanges with the malicious code blocking module 110 through the firewall 101 may be additionally configured.

The malicious code includes random software for encrypting a file storing user information excluding an executable file or a system important file.

The malicious code detection and blocking apparatus and process according to the embodiment of the present invention will be described in detail with reference to the accompanying drawings.

First, when a malicious code process is executed in the user terminal 100, a search for files must be performed for all storage media (hard disk, moving media, network shared folder, storage, etc.) connected to the user terminal. The search operation is performed.

All the search operations are separated into user level (USER) service and kernel (KERNEL) level service of the operating system (OS), and the verification module 10 of the present invention enters the user and the kernel level service and monitors the search service of the corresponding process do.

(S100), the verification module 111 monitors the action from the start point of the search action to the end point of the search. In accordance with the search order, the N (N > 0) (S110), it is determined whether the file is a target file (step S120).

Most malicious code blocking module 110 encrypts the protection target file from the policy module 112 or the pre-configured policy file because the most malicious code blocking module 110 encrypts the files containing the user's information without encrypting executable files or system critical files. .

If the current process file is a protection target file, it is checked whether the process performing the current search process is a primary trust process through the exception handling DB 114 (S130). If the process is a primary trusted process, Nth file) (step S 170).

If the process for the current file N is not a trust process, the process notifies the user of the process and the search file via the notification module 113, and inquires whether to permit, block, or handle an exception S140).

If the user denies the execution of the process at this stage, the process is blocked (S150).

If the user selects an exception process of the process, the process is stored in the primary trust DB 114 (S160) and the process proceeds to the next step.

If a search operation is performed and the search operation for the (N + 1) th file as the next file is synchronized (S180), or if a file operation such as opening, writing, or deleting occurs for the Nth file currently being searched (S190) File is compared with the backup N * file and verified whether the criterion corresponding to the damage is exceeded (S200).

The similarity depends on the type and the type of the N file. If there is no specific file header information, a fuzzy hash technique or a simple comparison technique, and if there is a specific file header information, And compares the excluded fixed frame information.

For example, in the case of MS Office files, the 2003 version uses the standard compressed file format, and the 2007 version and above use the XML header information format in the compressed file. It can be controlled via a separate policy file.

If it is recognized that the file similarity verification is performed as described above, it is checked whether the process corresponds to the second trust process (S210).

For reference, in the embodiment of the present invention, it is preferable that the primary trust process is defined as discriminating whether or not to permit a search action, and the secondary trust process is defined to discriminate whether or not to permit file similarity verification .

If the above-mentioned file similarity verification does not exceed the criterion, the corresponding process operation is permitted without user notification, exception processing, blocking, and the like.

If the corruption exceeds the criterion in the file similarity verification described above and corresponds to the second trust process, the process proceeds to the next search file (N = N + 1). If the corruption does not correspond to the second trust process, (S220). At this time, the user is inquired whether or not to process the exception of the process through the notification module 113 (S230).

If the user selects an exception process, the process information is recorded in the exception processing DB 114 as a secondary trust process (S240), and no further process is performed thereafter.

However, if the exception processing by the user is not performed, the damaged file N is recovered to the original file N * that was backed up in step S250.

At this time, the location where the backup file (N *) for the original file is temporarily stored is determined by allocating an arbitrary storage space in the malicious code blocking module 110, blocking access of other malicious code, Protect access by blocking the source.

FIG. 4 shows another embodiment of the present invention. In the preferred embodiment of FIG. 3, the steps of exchanging the Ransom block policy information through the network by the policy module and the step of notifying the user through the notification module, .

That is, when a malicious code process is executed on the user terminal 100, a search operation is performed for all files stored in all the storage media 120 connected to the user terminal. If the malicious code process is detected, (S300) The verification module 111 monitors the operation from the start time of the search operation to the end of the search. When the search operation for the N (N > 0) , And confirms that the file is a target file targeted by the RANemware (S320).

That is, the malicious code blocking module 110 identifies the protection target file from the policy module 112 or the pre-configured policy file.

If the current process file is a protection target file, it is checked whether the process performing the current search process is a primary trust process (S330) through the exception handling DB 114. If the process is not the primary trust process, (S340).

If the process is the first trusted process, the backup file N * for the current file (Nth file) is obtained (S350).

When a search operation is performed and a search operation for an (N + 1) th file as a next file is synchronized (S360), or when a file operation such as opening, writing, or deleting occurs for an Nth file currently being searched (S370) File and the backup N * file and verifies whether the criterion corresponding to the corruption is exceeded (S380).

The similarity is the same as the description of the 'S200' step of FIG. 3, and therefore, a detailed description thereof will be referred to.

If the file is recognized as being damaged in the file similarity verification as described above, it is checked whether the corresponding process corresponds to the second trust process (S390). If it corresponds to the trust process, the process for the next search file (N = N + 1) do.

For reference, in the embodiment of the present invention, it is preferable that the primary trust process is defined as discriminating whether or not to permit a search action, and the secondary trust process is defined to discriminate whether or not to permit file similarity verification .

If the above-mentioned file similarity verification does not exceed the criterion, the corresponding process operation is permitted without user notification, exception processing, blocking, and the like.

If the corruption exceeds the criterion in the file similarity verification described above and corresponds to the second trust process, the process proceeds to the next search file (N = N + 1). If the corruption does not correspond to the second trust process, (S400). At this time, the user is inquired of whether or not to process the exception of the process through the notification module 113 (S410).

If the user selects an exception process, the process information is recorded in the exception processing DB 114 as a secondary trust process (S420), and no further process is performed thereafter.

However, if the exception process is not performed by the user, the damaged file N is recovered to the original file N * that was backed up in step S430.

 As described above, the malicious code detection and blocking method according to the embodiment of the present invention has been described with reference to the limited embodiments and drawings, but the present invention is not limited to these embodiments. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

100: user terminal 101: policy server
110: malicious code blocking module 120: storage medium
111: verification module 112: policy module
113: Notification module 114: Exception processing DB
115: self protection module

Claims (17)

A malicious code detection and blocking method for detecting and blocking a malicious code process based on a plurality of file searching and changing actions on a storage medium of a user terminal by a malicious code blocking module mounted on the user terminal,
A first step of detecting a search operation for a plurality of files stored in a storage medium of the user terminal by the malicious code blocking module;
A second step of confirming that the search process is a first trust process registered in a trust database when a search operation for a predetermined protected file is detected during the first process;
A third step of alerting the user terminal if the process is not registered in the trust database in the second process;
A fourth step of storing the backup file for the corresponding file and proceeding to the corresponding process when the user terminal selects allow or exception processing for the corresponding process in the third step;
A fifth step of comparing the similarity between the backup file before the process progress and the file after the process progress in the fourth process; And
A sixth step of comparing whether the second trust process registered in the trust database corresponds to the second trust process when the degree of similarity is equal to or greater than the damage criterion in the fifth process;
And returning to the first step to proceed with a search process for the next file if the file corresponds to the second trust process in the sixth step. Way. The method according to claim 1,
Wherein the process for each file detected by the malicious code blocking module in each process is an accessing operation including file search, open, write, and delete. The method according to claim 1,
The malicious code is Ransomware which encrypts a file storing user information excluding an executable file or a system important file,
Wherein the protection target file is set as a file in which the target user information is stored. The method according to claim 1,
Wherein the malicious code blocking module enters the user level service and the kernel level service of the operating system of the user terminal and monitors the search service of the corresponding process. The method according to claim 1,
Wherein the fourth step stores the process as a first trust process in the trust database when the process for the current protection target file is selected as an exception process by the user terminal. The method according to claim 1,
Wherein the fourth step is to block the current process when rejecting the process for the current protection target file by the user terminal. The method according to claim 1,
In the fifth step, the similarity comparison is performed according to the type and the type of the file. When there is no specific file header information, the comparison is made using a fuzzy hash (Fuzzy Hash) technique or a simple comparison technique. If there is a header, the fixed frame information is compared with the header information except for the changed file-specific variable information,
Wherein the similarity determination criterion between the file header information and the corresponding file content is adjusted through a separate policy file. The method according to claim 1,
If the file does not correspond to the second trust process in the sixth process, blocking the current process and alerting the user through the user terminal;
If the exception process for the current process is selected by the user terminal of the first stage, storing the trust process in the trust database as a second trust process; And
And if the rejection of the current process is selected by the user terminal of the first stage, recovering the backup file stored in the fourth process. A malicious code detection and blocking method for detecting and blocking a malicious code process based on a plurality of file searching and changing actions on a storage medium of a user terminal by a malicious code blocking module mounted on the user terminal,
An eleventh process of detecting a search operation for a plurality of files stored in a storage medium of the user terminal by the malicious code blocking module;
If a search operation for a predetermined protected file is detected during the eleventh process, a backup file for the file is stored and the corresponding process is performed;
A thirteenth process of comparing the similarity between the backup file before the process progress and the file after the process progress in the twelfth process; And
14. The method of claim 13, wherein the step of blocking the current process and restoring the stored backup file when the degree of similarity is equal to or greater than the corruption criterion. 10. The method of claim 9,
Wherein the process for each file detected by the malicious code blocking module is an accessing operation including file search, open, write, and delete. 10. The method of claim 9,
The malicious code is Ransomware which encrypts a file storing user information excluding an executable file or a system important file,
Wherein the protection target file is set as a file in which the target user information is stored. A malicious code detection and blocking device for detecting and blocking a malicious code process based on a plurality of file search and change behavior based on a storage medium of a user terminal by a malicious code blocking module mounted on the user terminal,
The malicious code blocking module includes:
A verification module for monitoring a file search behavior of a process performed by the malicious code and performing backup and content similarity verification of the file;
A policy module for exchanging information on blocking or exception processing of the malicious code with another user terminal or malicious code blocking policy server through a network; And
And a database for storing exception processing information of a process performed by the malicious code,
A malicious code blocking policy server for exchanging malicious code blocking information with the malicious code blocking module and for exchanging exception processing information of the database with the malicious code blocking module via the network, And the malicious code detection and blocking device. delete 13. The method of claim 12,
The verification module enters a user level service and a kernel level service of an operating system of a user terminal and monitors a search service of the corresponding process,
Wherein the backup file before the process for the file to be processed is stored and the similarity of the file after the process is compared and verified. 13. The method of claim 12,
Wherein the malicious code is a random software that encrypts a file storing user information excluding an executable file or a system critical file. 13. The method of claim 12,
And a self-protection module for protecting the malicious code blocking module from attacks including memory intrusion and forcible termination of the malicious code blocking module itself. 13. The method of claim 12,
Further comprising a notification module for notifying and querying a user when the malicious code finds a file search and tampering behavior of the storage medium, and for waiting for selection by a user.

Images