KR102017016B1 - Apparatus and method for malware - Google Patents

Abstract

According to the present invention, the monitoring filter 130 checks whether the program 110 requesting to open a file by accessing the computer system is a monitored program, and the original data storage means 150 retains the stored data when the checked program is not the monitored program. The file can be modified normally with respect to the original file. On the contrary, when it is determined that the program requesting to open the file is a monitored program, the monitoring filter 130 is a copy of the original file stored in the original data storage means 150. Create a new redirection file and store it in the redirection data storage means 160, which is a different path from the original file's storage path, and the monitored program can modify the file only for the redirection file stored in the redirection data storage means 160. do. In addition, if the validation result of the redirection file is valid, the redirection file is merged with the original file. If the redirection file is not valid, the redirection file storage unit 160 deletes the redirection file.

Description

Malicious program processing device and processing method {APPARATUS AND METHOD FOR MALWARE}

The present invention relates to a malicious program processing apparatus and method, and more particularly, a file modified by the program to be monitored when a file approaching the computer system is a monitored program that is suspected to be a malicious program infected with a malicious code or the like and needs to be monitored. The present invention relates to a malicious program processing apparatus and a method for managing a system securely from malicious programs by managing the same in a redirect path.

Detecting so-called malicious programs that infiltrate and damage computer systems, such as computer viruses, worms, Trojan horses, or spyware, are based on signature-based static detection and malicious program behavior. There is a base detection method.

Among these methods, there are various detection methods described in, for example, Patent Documents 1 and 2 as an action-based detection method that detects malicious status by analyzing the behavior of a program to be executed.

Patent Literature 1 analyzes APIs and parameters that are called at the time of execution of a file (program) to be analyzed and measures the risk score of the action, and calculates the risk level of the file by summing the measured risk scores. It checks whether it is a malicious program.

In addition, Patent Literature 2 generates a feature vector using characteristic parameter information collected in the process of executing a process (program), and detects whether a process contains malicious code using the generated feature vector. .

However, in the known behavior-based detection methods including Patent Documents 1 and 2, treatment or restoration is performed for actions performed before the executed program is identified as a malicious program, for example, modifying or deleting the original file, or changing the path. There is a problem that is difficult.

Publication No. 10-1404882 (Notified on June 11, 2014) Publication No. 10-2017-81386 (published Jul. 12, 2017)

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems of the prior art, and manages system resource manipulation behaviors of a suspected program separately from the original system resources, and then separates and manages the program if it is identified as a malicious program. It is an object of the present invention to provide a malicious program processing apparatus and method for maintaining a system in an environment before a malicious program is executed by removing a resource.

Malicious program processing apparatus of the present invention for solving the above problems, a surveillance filter for accessing a computer system to check whether a program requesting a file open is a monitored program suspected to be a malicious program, and whether the monitored program; And a watched item database holding a watched item for judging, wherein the watched filter determines that the program as a watched program when the program requesting the file open corresponds to any one or more of the watched items. Copying the original file of the file that the monitoring target program makes an open request to generate a redirection file, and storing the generated redirection file in a redirection path which is different from the file path of the original file.

In addition, the malicious program processing method of the present invention for solving the above problems, step a) of determining whether or not the program to access the computer system file request to open the file suspected to be a malicious program, and the step a B) generating a redirection file by copying the original file of the file requested by the program when the program requesting the file open request is a monitored program; and generating the redirection file by the file of the original file. And storing c) in a redirection path that is different from the path.

As described above, the present invention is modified by a program suspected to be a malicious program by storing the file modified by a normal program and a file modified by a monitored program suspected to be a malicious program in different paths. The file and the file modified by the normal program can be managed separately from each other, and when the validation of the redirection file turns out to be invalid, it can be easily processed by deleting the invalid redirection file from the system. It can protect your system from malicious programs.

1 is a block diagram showing a malicious program processing apparatus according to a preferred embodiment of the present invention;
2 is a flowchart showing the flow of a malicious program processing method according to a preferred embodiment of the present invention;
3 is a flowchart showing the flow of a file validation method for validating a file.

EMBODIMENT OF THE INVENTION Hereinafter, preferred embodiment of this invention is described in detail, referring an accompanying drawing.

First, a malicious program processing apparatus of a preferred embodiment of the present invention will be described. 1 is a block diagram showing a malicious program processing apparatus of a preferred embodiment of the present invention.

The malicious program processing apparatus 100 according to the present embodiment uses a redirection technique that separates and manages resources used by a normal application and resources used by a malicious program. The supervisory filter 130 is configured by adding a redirection function to the filter that monitors the behavior between the program 110 running in the user mode and the actual data of the kernel mode. By 130, it is possible to separate and manage the resources used by the actual data and malicious programs to secure the resources in the computer system.

The malicious program processing apparatus 100 of the present embodiment for executing the above functions is installed in a computer system, and as shown in FIG. 1, the monitoring filter 130, the monitoring target item database 140, and the original data storing means 150. ), A redirection data storage means (160) and a redirection information memory (170).

The supervisory filter 130 is a redirection function added to the mini-filter provided by the Windows operating system (Windows Operating System), and all programs (file open) that request a file open to access a computer system and execute a task ( For 110, the program 110 determines whether the program is suspected of being infected with malicious code, that is, a program to be monitored. If the program is a monitored program, the redirected file copied from the original file is different from the path of the original file. It is saved in the redirection path which is the path, and the modification of the file by the monitored program is executed only for the redirection file.

More specifically, in general, the program 110 accessing a resource for file modification, etc., obtains a handle of a file to be modified in kernel mode, and modifies the file, and the monitoring filter 130 All programs or threads that access the user mode for file modification, etc. (In this specification, the term "program" is used to encompass all the programs or threads that access user mode for file modification.) The program 110 may be a malicious program infected with a malware or the like, and the program to be monitored (in this specification, this program is referred to as a "monitored program", and a program that is not a monitored program is "normal"). Program).

To this end, the malicious program processing apparatus 100 has a monitoring target item database 140, the monitoring target item database 140 has a plurality of monitoring target items, and the user mode of the malicious program processing device 100. If the approaching program 110 corresponds to any one or more of the monitored target items held by the monitored target database 140, the program is set as the monitored target program.

An example of the monitored object held by the monitored object database 140 will be briefly described below.

-The presence or absence of a digital signature: Since most programs have a digital signature of the manufacturer who made the program, if a digital signature exists in the program 110 to access the user mode, the program may be regarded as a normal program. However, in recent years, digital signature files have been tampered with by leaking digital signature files, so there may be cases where digital signatures cannot be trusted unconditionally. Checking other information together can increase reliability.

-Validity of the execution file property information: Since a general commercial program has file property information such as a file version, a producer name, and a file description, such property information is not included in the program 110 accessing the user mode. If the program file does not match the attribute information, the program is monitored.

-Path in which the file is executed: In case of a malicious program, a method of downloading and executing it from a remote location is mainly used. Therefore, when the program 110 accessing the user mode is a program executed in a specific path such as the Internet Temp folder or the Downloads folder. There is a possibility that it is a malicious program.

-Whether the thread is injected: If the malicious program is not an executable file such as EXE or COM, it loads into another running process (this is called 'DLL injection'), and the program 110 accesses the user mode. It checks whether or not the thread is injected by thread creation monitoring. If the thread is injected, the program to be monitored is used.

-Script type program: Script execution program such as VBScript, WScript, powershell, php or malicious program using interpreter such as java program exist. Therefore, process or interpreter that can execute script is to be monitored.

When the program 110 approaching the user mode is determined to be a monitored program, the monitoring filter 130 stores a redirection file previously redirected by the monitored program in the redirection data storage means 160. Check whether there is.

As a result of the check, if there is a redirection file that was previously redirected, the redirection information memory 170 obtains file information of the redirection file, applies the file information of the redirection file obtained, obtains a handle of the redirection file from the kernel, and returns it to the program. As a result, file modification of the redirection file previously stored in the redirection data storage means 160 is performed.

On the contrary, if the redirection file that is redirected by the previous file open request from the program to be monitored is not stored in the redirection data storage means 160, the monitoring filter 130 is stored in the original data storage means 150. A redirection file, which is a copy file of which the original file is copied, is generated and stored in the redirection data storage unit 160, and the file information of the generated redirection file is stored in the redirection information memory 170.

Thereafter, the monitoring filter 130 applies the file information of the newly generated redirection file to obtain a handle of the redirection file from the kernel and returns the handle to the program. File modifications are made.

On the other hand, when the program 110 to access the user mode is the program to be monitored, the monitoring filter 130 obtains a handle of the original file stored in the original data storage means 150 and returns to the program, thereby storing the original data Modifications to the original file stored in the means 150 are made.

The monitoring target item database 140 holds the monitoring target item for determining whether the program 110 accessing the user mode is the monitored program, and the monitoring target item is the same as described above.

Original data storage means 150 is a data storage means for storing the original file created or modified by the normal program, for example, the storage of a known configuration such as an electronic storage device such as a hard disk, CD-ROM, RAM or ROM Means can be used.

The redirection data storage means 160 is a data storage means for which the monitoring filter 130 stores a redirection file which is a copy copied from the original file stored in the original data storage means 150. For example, the redirection data storage means 160 is a hard disk, a CD-. The storage means of well-known structures, such as ROM, RAM, and an electronic memory device, such as ROM, can be used. In addition, the redirection data storage means 160 may use the same storage means as the original data storage means 150 for storing the original file, or may use other storage means, but the original data storage means 150 The access path must be different, and modification of the file by the program determined by the monitoring filter 130 as the program to be monitored is possible only for the redirection file stored in the redirection data storing means 160.

The redirection information memory 170 is a memory for storing the file information of the redirection file when the monitoring filter 130 generates a redirection file which is a copy copied from the original file stored in the original data storage means 150. For example, the file information of the redirection file is, for example, the file path of the original file, the copy date and time of copying the first file, and the name of the redirection file.

Next, the malicious program processing method of the preferred embodiment of the present invention will be described with reference to FIG. 2 is a flowchart showing the flow of a malicious program processing method of a preferred embodiment of the present invention.

First, if there is a file open request for modification of a file from the program 110 accessing the user mode of the malicious program processing apparatus 100 (step S11), in step S12, the monitoring filter 130 performs a file open request. Check whether the program is a monitored program.

As a result of checking in step S12, if the program requesting to open the file is not a program to be monitored (step S12 = NO), the process proceeds to step S13. ), The original file requested in step S18 is opened, and operations such as modification of the file contents, deletion or change of the file, and the like are terminated.

As a result of checking in step S12, if the program requesting to open the file is a program to be monitored (step S12 = YES), the process proceeds to step S14. In step S14, the monitoring filter 130 is stored in the redirection information memory 170. By checking information such as the file path of the original file, which is the file information of the redirected file, the copy date and time of copying the first file, and the name of the redirected file, the redirected file that was previously redirected to the file that the monitored program requests to open is displayed. Check whether there is.

If there is no redirection file previously redirected as a result of checking in step S14 (step S14 = NO), the supervisory filter 130 creates a new redirection file by copying the original file stored in the original data storage means 150 and generating the new redirection file. After the redirection file is stored in the redirection data storing means 160, the process proceeds to step S16. ), And the flow advances to step S17. As described above, the file information of the redirection file is the file path of the original file, the copy date and time of the first file copy, the name of the redirection file, and the like.

If there is a file that has been redirected before as a result of checking in step S14 (step S14 = YES), the process proceeds to step S17. In step 17, the monitoring filter 130 applies the file information of the redirection file to handle the redirect file in the kernel. And return to the program and proceed to step S18. In step S18, file modification operations such as modification, deletion, or modification of the redirection file are executed and finished.

As described above, in the present embodiment, the monitoring filter 130 checks whether the program 110 requesting the file open by accessing the user mode is the program to be monitored. When the program requesting the file open is determined to be a monitored program, the monitoring filter 130 stores the original data stored in the original data storage means 150. Creates a new redirection file, which is a copy of the original file, and saves it in the redirection path (redirection data storage means 160), which is different from the path of the original file.The monitored program can modify the file only for the redirection file stored in the redirection path. Do it.

At the same time as this processing or after the processing, the redirection file stored in the redirection path is verified whether the file is modified by a malicious program infected with malicious code, that is, the file is validated. When the modified file is found to be an invalid file, the malicious program processing apparatus 100 processes the deletion of the redirection file, etc. On the contrary, when the file is found to be a valid file, the malicious file processing unit stores the redirection file as an original data storage means ( And merging with the original file stored in 150).

File validation of the redirection file stored in the redirection path is performed through a normal validation procedure, which will be briefly described below. 3 is a flowchart showing a validation method for validating a program.

First, in step S21, the file data of the redirection file is read and the process proceeds to step S22, and in step S22, the file header value of the file data of the read redirection file is verified.

Generally, files used in application programs are jpg, exe, docx,… A file with a specific extension, such as, has a value unique to the entry of the file, i.e., a file header value, and since a malicious program typically modulates the file header value, the file of the redirect file You can validate the file by checking the header value.

If the verification result of step S22 determines that the redirection file is valid (step S22 = YES), the flow advances to step S23 to execute command verification.

Some malware modifies the file from a specific offset position, leaving the file header intact. In this case, only validating the file header value does not allow full file validation. Therefore, even when the file header value of the verification result of step S22 is found to be valid, the file is validated once more by applying the imperative verification code to check the data included in the file.

If the verification result of step S23 also proves that the redirection file is valid, the flow advances to step S24 to merge the validated redirection file with the original file and ends.

If the verification result of the file header value in step S22 or the imperative verification result in step S23 turns out that the redirection file is invalid, the process proceeds to step S25 to delete an invalid redirection file from the system. Proceed and exit.

As described above, in the present embodiment, a file modified by a normal program and a file suspected to be a malicious program are separated and stored in different paths by a monitored program suspected to be a malicious program. Managed files and files modified by normal programs can be managed separately from each other, and when the validation of the redirection file turns out to be invalid, it can be easily processed by deleting the invalid redirection file from the system. Therefore, you can protect your system from malicious programs.

As mentioned above, although this invention was demonstrated by preferable embodiment, this invention is not limited to the said embodiment, A various change and a deformation | transformation are possible within the scope of the invention as described in a claim.

In the above embodiment, it is determined whether or not the program to be monitored is checked by confirming whether the program 110 accessing the user mode of the system corresponds to any one or more of the items to be monitored in the monitored item database 140. Although described above, for example, a program that is determined to have not been infected with a malicious code in the process of validating the file or other process described above (in this specification, this program is referred to as a "normal program". The term " normal program " indicated herein may be managed by a separate database or the like, and if the program 110 accessing the user mode of the system exists in the database, the program can be determined as a normal program.

In addition, a program determined to be a malicious program in the above process may be managed by a malicious program database. If a program 110 that accesses the user mode of the system is in the malicious program database, the program may be determined to be a monitored program. .

In addition, the said embodiment and the said modification may be implemented separately, and may be implemented in combination with each other.

100 Malware Handling Device
110 programs
130 supervisory filter
140 Monitored Items Database
150 Original data storage means
160 Redirect data storage means
170 Redirection Information Memory

Claims (11)

A monitoring filter that checks whether a program that accesses a computer system and requests a file open is a monitored program suspected of being a malicious program;
It includes a monitoring target item database for holding a monitoring target item for determining whether or not the program to be monitored,
The monitoring filter,
If the program requesting to open the file corresponds to any one or more of the items to be monitored, the program is determined to be a monitored program,
Redirect file is generated by copying the original file of the file that the watched program has requested to open,
The generated redirection file is stored in a redirection path which is different from the file path of the original file.
Modify the file by using the redirection file stored in the redirection path;
The monitoring target item is at least one of a digital signature, validity of executable file attribute information, a file execution path, and whether or not an injected thread is used. The method according to claim 1,
The surveillance filter further checks whether there is a redirect file previously generated by the surveillance target program before generating the redirect file.
Malware handling device that allows modification of files by using the redirected file if there is a previously generated redirected file. The method according to claim 2,
A redirection information memory for storing file information of the redirection file;
The presence or absence of the previously generated redirection file is a malicious program processing apparatus for confirming by the file information of the redirection file. delete The method according to claim 1,
The malicious program processing apparatus further executes validation of the redirection file,
And a malicious program processing apparatus for deleting the redirect file when the file is invalid as a result of the verification. The method according to claim 1,
The malicious program processing apparatus further executes validation of the redirection file,
And a malicious program processing apparatus for merging the redirection file with the original file when the file is valid. A malicious program processing method by a malicious program processing device that has a watched item for determining whether a program requesting a file open request by accessing a computer system is a monitored program suspected to be a malicious program.
A) determining whether the program requesting the file open by accessing the computer system is a monitored program suspected to be a malicious program;
B) generating a redirection file by copying the original file of the file requested by the program when the program requesting the file open is the monitored program as a result of the step a);
C) storing the generated redirection file in a redirection path which is different from the file path of the original file;
Modifying the file by using the redirection file stored in the redirection path;
The monitoring target item is one or more of the presence or absence of a digital signature, validity of executable file attribute information, a path in which a file is executed, or whether an injected thread is used.
In step a), if the program requesting to open the file corresponds to any one or more of the items to be monitored, the malicious program processing method for determining the program as a program to be monitored. The method according to claim 7,
Before generating the redirection file in step b), further comprising: checking whether there is a redirection file previously generated by the monitored program;
And if there is a redirection file generated before as a result of the checking in step d), modifying the file by using the redirection file. The method according to claim 8,
The presence or absence of the previously generated redirection file is a malicious program processing method for confirming by the file information of the redirection file held by the computer system. The method according to claim 7,
Executing after the step c) and performing validation of the redirection file;
The malicious program processing method of deleting the redirection file when the verification result of step e) is invalid. The method according to claim 7,
Executing after the step c) and performing validation of the redirection file;
And when the file is valid as a result of the verification of step e), merges the redirection file with the original file.

Images