KR102053869B1 - Method and apparatus for detecting malignant code of linux environment - Google Patents

Abstract

Disclosed are a method for detecting a malicious code in a Linux environment and an apparatus thereof. According to one embodiment of the present invention, the apparatus for detecting a malicious code, which is to detect a malicious code in a Linux environment, comprises: a behavior data collection module collecting behavior data including each system call and system call parameter called as a target file is executed; a behavior data processing module classifying collected one or more system calls into any one of predetermined behavior groups to generate the behavior group related information of the target file; and a similarity determination module measuring a similarity between the behavior group related information of the target file and the behavior group related information of a pre-stored malicious file.

Description

METHOD AND APPARATUS FOR DETECTING MALIGNANT CODE OF LINUX ENVIRONMENT}

Embodiments of the invention relate to malware detection techniques in the Linux environment.

Recently, the number of malicious codes is increasing, and researches are being actively conducted to automate malicious code analysis in order to quickly respond to the increasing malicious codes. However, the existing static analysis alone has its limitations, and researches on malicious code detection technology through dynamic behavior analysis have been conducted.

Such dynamic behavior analysis is based on function call information of kernel or user area such as API (Application Program Interface) or system call. In the case of the Windows environment, the kernel API is functionally divided so that dynamic behavior analysis based on such API call is valid.

For example, the Windows environment's APIs include CreateProcess, WinExec, ShellExecute, CreateFile, CopyFile, RegCreateKeyEx, and RegSetValueEx. Its functions, such as setting a value, are subdivided so that you can easily grasp information about each action with individual API calls.

However, unlike the Windows environment, individual APIs are not functionally divided, so it is difficult to analyze behavior only by individual APIs. In addition, since system calls such as file access, network access, and process creation and destruction are mixed, it is difficult to measure similarity with malicious code only by simple system call call information and sequence.

01) (Korea Patent Publication No. 10-1620931, 2016.05.13)

An embodiment of the present invention is to provide a new technique for detecting malicious code in the Linux environment.

Malware detection apparatus according to an embodiment is a device for detecting malicious code in a Linux environment, collecting behavior data to collect behavior data including each system call and system call parameters that are called while the target file is executed module; An action data processing module for classifying the collected one or more system calls into any one action group among preset action groups to generate action group related information of the target file; And a similarity determination module for measuring similarity between the action group related information of the target file and the previously stored action group related information of the malicious file.

The behavior data processing module may include: a pre-processing unit classifying each of the collected system calls by a predetermined category, and assigning a predetermined category classification number to the classified category to the corresponding system call; A system call table generation unit generating a system call table including the category classification number and the system call parameter according to a call order of the collected system calls; And classify the collected one or more system calls into any one of a set of action groups based on a category classification number and a system call parameter of the system call table, and set a predetermined action group number for the classified action group. It may include a group classification unit for granting.

The group classification unit classifies the one or more system calls into any one action group among predetermined action groups according to the type of system call, and the type of the system call is a single system call type or a continuous system call of the same category. Types, and complex category system call types.

The behavior data processing module may further include a context map table generation unit configured to generate a context map table including an action group number and an action group parameter according to a time sequence of each classified action group, and the similarity determination module may include: The similarity between the context map table of the target file and the context map table of the previously stored malicious file can be measured.

The similarity determination module may measure the first similarity by determining similarity between the time order of the action group number in the context map table of the target file and the time order of the action group number in the prestored context map table of the malicious file.

The similarity determination module may measure a second similarity by determining similarity between the action group number and the action group parameter in the context map table of the target file and the action group number and the action group parameter in the prestored context map table of the malicious file. have.

The similarity determination module gives a first weight to the first similarity, gives a second weight higher than the first weight to the second similarity, adds the second weight, and adds it to the context map table of the target file and the previously stored malicious file. The total similarity score between the context map tables can be calculated.

A malicious code detection method of a Linux environment according to an embodiment of the present disclosure is a method performed in a computing device having one or more processors and a memory storing one or more programs executed by the one or more processors. Collecting each system call and system call parameter that is called as the file is executed; Generating the action group related information of the target file by classifying the collected one or more system calls into any one action group among preset action groups; And measuring similarity between the action group related information of the target file and the action group related information of the pre-stored malicious file.

According to an exemplary embodiment of the present disclosure, each system call and system call parameter that is called while the target file is executed are collected, and the collected one or more system calls are classified into any one action group among predetermined action groups, thereby acting on the target file. By generating group-related information, it is possible to classify the actions according to system calls in the Linux environment and perform dynamic analysis of malicious codes based on system calls.

1 is a diagram illustrating a system call mixed state in a Linux environment
2 is a block diagram illustrating a configuration of an apparatus for detecting malicious code in a Linux environment according to an embodiment of the present disclosure;
3 is a block diagram showing a configuration of a behavior data processing module according to an embodiment of the present disclosure;
FIG. 4 illustrates a state classification of behavior groups for a single system call type in one disclosed embodiment. FIG.
5 is a diagram illustrating a state of classifying an action group for consecutive system call types of the same category in an embodiment of the present disclosure.
6 is a diagram illustrating a state of classifying an action group for a compound category system call type in an embodiment of the present disclosure.
7 is a graph showing chronological order of behavior groups classified according to one disclosed embodiment.
8 is a flowchart illustrating a malicious code detection method in a Linux environment according to an embodiment of the present invention.
9 is a block diagram illustrating and describing a computing environment including a computing device suitable for use in example embodiments.

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to assist in a comprehensive understanding of the methods, devices, and / or systems described herein. However, this is only an example and the present invention is not limited thereto.

In describing the embodiments of the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the present invention, and may be changed according to intention or custom of a user or an operator. Therefore, the definition should be made based on the contents throughout the specification. The terminology used in the description is for the purpose of describing embodiments of the invention only and should not be limiting. Unless expressly used otherwise, the singular forms “a,” “an,” and “the” include plural forms of meaning. In this description, expressions such as "comprises" or "equipment" are intended to indicate certain features, numbers, steps, actions, elements, portions or combinations thereof, and one or more than those described. It should not be construed to exclude the presence or possibility of other features, numbers, steps, actions, elements, portions or combinations thereof.

In the following description, the terms "transfer", "communication", "transmit", "receive", and the like in the sense of a signal or information are not only to directly convey the signal or information from one component to another component, It also includes passing through other components. In particular, "transmitting" or "transmitting" a signal or information to one component indicates the final destination of the signal or information and does not mean a direct destination. The same is true for the "reception" of a signal or information. In addition, in this specification, "relating" two or more pieces of data or information means that if one data (or information) is obtained, at least a portion of the other data (or information) can be obtained based thereon.

Meanwhile, directional terms such as upper side, lower side, one side, the other side, and the like are used in connection with the orientation of the disclosed drawings. Since components of the embodiments of the present invention may be positioned in various orientations, the directional terminology is used for the purpose of illustration and not limitation.

In addition, terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms may be used for the purpose of distinguishing one component from another component. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component.

The disclosed embodiment is a technique for detecting malicious code in a Linux environment (ie, a computing environment in which the operating system is Linux). In the case of Linux environment, there are various distributions and libraries as open source, so unlike the Windows environment, it is difficult to detect malicious code based on API calls.

In the Linux environment, malicious code can be detected based on system call calls. The system call is an interface for the operating system to use kernel area functions such as file access or network access. The system call analysis can be used to understand the behavior of an application program.

However, in a Linux environment, system calls are made up of basic function calls, so it is difficult to understand the context of the behavior based on individual system call information. In other words, as shown in Table 1, in Linux environment, system call is composed of primitive function calls such as open, read, write, and close.

Example of Linux System Call Sys_create produce Sys_open Heat Sys_read read Sys_fork fork Sys_write writing Sys_close close

In addition, even in the case of the system logic in the Linux environment, the call order may be changed when executed. As shown in FIG. 1, system calls of various categories such as processes, network calls, and file access calls are mixed. In other words, it is difficult to determine similarity with malicious code only by the call information and sequence of system calls.

Accordingly, in the disclosed embodiment, each system call and system call parameter that is called while the target file is executed are collected, and the collected one or more system calls are classified into any one action group among the predetermined action groups, and the Behavior group related information is generated and the similarity between the behavior group related information of the target file and the behavior group related information of the pre-stored malicious file can be checked to determine whether the malicious code exists in the target file. That is, even in the Linux environment, malicious code can be detected dynamically based on system calls. This will be described in detail below.

2 is a block diagram illustrating a configuration of an apparatus for detecting malicious code in a Linux environment according to an embodiment of the present disclosure.

Referring to FIG. 2, the malicious code detection apparatus 100 of the Linux environment may include a behavior data collection module 102, a behavior data processing module 104, and a similarity determination module 106. The configuration of the malicious code detection apparatus 100 illustrated in FIG. 2 is a functional element that is functionally divided, and may be mutually functionally connected to perform a function according to the present invention, and any one or more components may be physically physically connected. May be implemented to be integrated with each other.

The behavior data collection module 102 may collect behavior data according to execution of a target file (that is, a file to be detected as malicious code). In an example embodiment, the behavior data collection module 102 may execute the target file via the virtual machine to collect behavior data.

The behavior data collection module 102 may collect individual system calls and system call parameters that are invoked as the target file is executed. Here, the system call parameter is a call argument accompanying the system call, for example, a file name, a file descriptor, and the like. Table 2 is a table showing system call and system call parameters according to an embodiment disclosed.

System call System call parameters Sys_unlink ./0x7a30786ceo Sys_open "/ dev / misc / watchdog", 2,0 Sys_chdir "/" Sys_socket 2, 2, 0 Sys_connect 3, 8.8.8.8, 45084 Sys_close 3 Sys_fork Sys_write 2, 0x14394, 1

The behavior data processing module 104 may classify the collected one or more system calls into one of the predetermined behavior groups to generate behavior group related information of the target file.

3 is a block diagram showing the configuration of the behavior data processing module 104 according to one embodiment. Referring to FIG. 3, the behavior data processing module 104 may include a preprocessor 111, a system call table generator 113, a group classifier 115, and a context map table generator 117. .

In one embodiment, the preprocessor 111, the system call table generator 113, the grouper 115, and the context map table generator 117 are implemented using one or more physically separated devices, or one It may be implemented by the above processor or a combination of one or more processors and software, and unlike the illustrated example may not be clearly distinguished in the specific operation.

The preprocessor 111 may classify the individual system calls collected by the behavior data collection module 102 by preset categories and may assign unique numbers to the individual system calls. In an exemplary embodiment, the preprocessor 111 may classify each system call into a process category, a file category, a network category, and the like according to the behavior characteristic of each system call. Here, a category number may be set for each preset category. For example, a category classification number may be set to 1 for a process category, 2 for a file category, 3 for a network category, and the like.

The preprocessor 111 classifies each system call into any one category among preset categories according to the behavior characteristics of the corresponding system call for each collected system call, and the category classification number set in the category classified in the corresponding system call. Can be given. Table 3 is a table showing a state in which the preprocessor 111 has assigned a unique number and category classification number for each system call.

System call Unique number Category Classification Number Sys_open One 3 Sys_write 2 3 ... ... ... Sys_socket 35 2 Sys_connect 36 2 ... ... ... Sys_fork 122 One ... ... ...

The system call table generator 113 may generate a system call table for individual system calls collected by the behavior data collection module 102. In an exemplary embodiment, the system call table generator 113 may generate a system call table including a category classification number, a system call unique number, a file descriptor, and a system call parameter according to the collected call order of the system call. have. Table 4 is a system call table according to an embodiment of the present disclosure, and shows an example of creating a system call table for each system call shown in Table 2.

Call Order category
Classification number System call
ID number
File descriptor System call
parameter One 3 9 One ./0x7a30786ceo 2 3 One 2 / dev / misc / watchdog 3 3 5 NULL Of 4 2 35 3 2 5 2 36 3 8.8.8.8 6 3 2 3 3 7 One 12 NULL NULL 8 One 4 2 2

The group classifier 115 may classify one or more system calls into any one action group among predetermined action groups based on the category classification number and the system call parameter of the system call table.

The group classifier 115 may classify the group into a predetermined action group according to the type of each system call based on the category classification number of the system call table and the system call parameter. In an exemplary embodiment, the predetermined action group may be classified into a single system call type, a continuous system call type of the same category, a complex category system call type, and the like.

Here, the single system call type represents a case in which a single system call can be identified as a process fork, file creation, file deletion, and the like. FIG. 4 illustrates a group of behaviors for a single system call type in an exemplary embodiment of the present disclosure. It is a figure which shows the state to make. In FIG. 4, actions according to the corresponding system call are classified into an action group called "file deletion".

In addition, the continuous system call type of the same category indicates a case where the system call is continuously called in the same category such as file reading, network reception, etc. FIG. 5 illustrates a continuous system call type of the same category in an embodiment of the disclosure. A diagram illustrating a state of classifying an action group. In FIG. 5, system calls appear continuously in the same category of "file" (category classification number 3), and actions according to the corresponding system calls are classified into an action group called "file reading."

In addition, the compound category system call type indicates a case where system calls are combined and called in two or more categories, and FIG. 6 is a diagram illustrating a state of classifying an action group for a compound category system call type in an embodiment of the present disclosure. to be. In FIG. 6, when a system call is combined in two or more categories called "network" (category classification number 2) and "file" (category classification number 2), an action according to the system calls is called "file download". Classified as an action group. That is, the system call is a complex category system call type, consisting of a part that receives data through network communication (that is, a network category) and a part that writes the received data to a file (that is, a file category). Download "may be classified into an action group.

The group classification unit 115 may assign a predetermined action group number to the classified action group. Table 5 is a table showing an action group and an action group number according to an embodiment of the disclosure.

Act group Act group number Generate file 101 Delete file 102 ... ... Network connection 201 Download 210 ... ... Process creation 301 ... ...

The context map table generator 117 may generate a context map table for each action group classified by the group classifier 115. In an exemplary embodiment, the context map table generator 117 may generate a context map table including an action group number and an action group parameter according to a time sequence of each classified action group. Here, the action group parameter may be information indicating what the main factor of the action group is. In an exemplary embodiment, the action group parameter may be set based on a system call parameter of a system call corresponding to the action group.

FIG. 7 is a graph illustrating behavior groups classified according to an embodiment of the present disclosure in chronological order, and Table 6 is a table illustrating a context map table for the behavior groups illustrated in FIG. 7.

order Act group number Behavior group parameter 0 301 Process name (A) One 302 Process name (A) 2 301 Process name (B) 3 104 File name (A) 4 105 File name (B) 5 201 IP address (A network) 6 210 File name (C)

The similarity determination module 106 may include an action group number and an action group parameter according to the time order of the action group of the target file (ie, action group related information of the target file), and an action group according to the time order of the action group of the previously stored malicious file. The similarity can be determined by comparing the number and behavior group parameters (ie, behavior group related information of the malicious file). In an exemplary embodiment, the similarity determination module 106 may compare the context map table of the target file with the context map table of the previously stored malicious file and determine the similarity.

In detail, the similarity determination module 106 may measure the first similarity by determining the similarity between the time order of the action group number in the context map table of the target file and the time order of the action group number in the context map table of the previously stored malicious file. Can be. For example, the similarity determining module 106 may measure the first similarity using the N-gram algorithm, but the similarity measuring method is not limited thereto.

In addition, the similarity determination module 106 measures the second similarity by determining similarity between the behavior group number and the behavior group parameter in the context map table of the target file and the behavior group number and the behavior group parameter in the context map table of the pre-stored malicious file. can do. For example, the similarity determination module 106 may measure the second similarity using a cosine similarity measurement or a jacquard similarity measurement method, but the similarity measurement method is not limited thereto.

The similarity determination module 106 assigns a first weight to the measured first similarity, adds a second weight to the measured second similarity, and adds the sums to the behavior group related information of the target file and the behavior group related information of the malicious file. The total similarity score of the liver can be calculated. Here, the second weight may be weighted higher than the first weight. For example, the sum of the first weight and the second weight may be set to one. The total similarity score may be calculated through Equation 1 below.

(Equation 1)

Total similarity score = (first similarity × first weight) + (second similarity × first weight)

The similarity determination module 106 may determine whether there is malicious code in the target file according to the total similarity score between the behavior group related information of the target file and the behavior group related information of the malicious file.

In the present specification, the module may mean a functional and structural combination of hardware for performing the technical idea of the present invention and software for driving the hardware. For example, the “module” may mean a logical unit of a predetermined code and a hardware resource for performing the predetermined code, and does not necessarily mean a physically connected code or a kind of hardware. .

According to an exemplary embodiment of the present disclosure, each system call and system call parameter that is called while the target file is executed are collected, and the collected one or more system calls are classified into any one action group among predetermined action groups, thereby acting on the target file. By generating group-related information, it is possible to classify the actions according to system calls in the Linux environment and perform dynamic analysis of malicious codes based on system calls.

8 is a flowchart illustrating a malicious code detection method of a Linux environment according to an embodiment of the present invention. In the flowchart shown, the method is divided into a plurality of steps, but at least some of the steps may be performed in a reverse order, in combination with other steps, omitted together, divided into detailed steps, or not shown. One or more steps may be added and performed.

Referring to FIG. 8, the malicious code detecting apparatus 100 collects behavior data including each system call and system call parameters that are called while the target file is executed (S 101).

Next, the malicious code detection apparatus 100 classifies each collected system call by a predetermined category, and assigns a category classification number set in the classified category to the corresponding system call (S 103). Here, the malicious code detection apparatus 100 may assign a unique number to each collected system call.

Next, the malicious code detection apparatus 100 generates a system call table including a category classification number and a system call parameter according to the collected call order of system calls (S 105). Here, the system call table may further include a system call unique number and a file descriptor.

Next, the malicious code detection apparatus 100 classifies one or more system calls into any one action group among predetermined action groups based on the category classification number and the system call parameter of the system call, and sets the classified action group. An action group number is assigned (S 107).

Next, the malicious code detection apparatus 100 generates a context map table including the action group number and the action group parameter according to the time sequence of each classified action group (S 109).

Next, the malicious code detection apparatus 100 measures the similarity between the context map table of the target file and the context map of the previously stored malicious file (S 111).

The malicious code detection apparatus 100 may measure the first similarity by determining the similarity between the time order of the action group number in the context map table of the target file and the time order of the action group number in the prestored context map table of the malicious file. . In addition, the malicious code detection apparatus 100 determines the similarity between the behavior group number and the behavior group parameter in the context map table of the target file and the behavior group number and the behavior group parameter in the prestored context map table of the malicious file to determine the second similarity. It can be measured.

The malicious code detection apparatus 100 may calculate a total similarity score by adding a first weight to the measured first similarity, adding a second weight to the measured second similarity, and adding the weights.

Next, the malicious code detection apparatus 100 determines whether there is malicious code in the target file according to the measured similarity (S 113). For example, when the measured similarity exceeds the preset reference similarity, the malicious code detecting apparatus 100 may determine that there is malicious code in the target file.

9 is a block diagram illustrating and describing a computing environment 10 that includes a computing device suitable for use in example embodiments. In the illustrated embodiment, each component may have different functions and capabilities in addition to those described below, and may include additional components in addition to those described below.

The illustrated computing environment 10 includes a computing device 12. In one embodiment, computing device 12 may be a malware detection device 100 in a Linux environment.

Computing device 12 includes at least one processor 14, computer readable storage medium 16, and communication bus 18. The processor 14 may cause the computing device 12 to operate according to the example embodiments mentioned above. For example, processor 14 may execute one or more programs stored in computer readable storage medium 16. The one or more programs may include one or more computer executable instructions that, when executed by the processor 14, cause the computing device 12 to perform operations in accordance with an exemplary embodiment. Can be.

Computer readable storage medium 16 is configured to store computer executable instructions or program code, program data and / or other suitable forms of information. The program 20 stored in the computer readable storage medium 16 includes a set of instructions executable by the processor 14. In one embodiment, computer readable storage medium 16 may include memory (volatile memory, such as random access memory, nonvolatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash Memory devices, or any other form of storage medium accessible by computing device 12 and capable of storing desired information, or a suitable combination thereof.

The communication bus 18 interconnects various other components of the computing device 12, including the processor 14 and the computer readable storage medium 16.

Computing device 12 may also include one or more input / output interfaces 22 and one or more network communication interfaces 26 that provide an interface for one or more input / output devices 24. The input / output interface 22 and the network communication interface 26 are connected to the communication bus 18. The input / output device 24 may be connected to other components of the computing device 12 via the input / output interface 22. Exemplary input / output device 24 may include a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touchpad or touchscreen), a voice or sound input device, various types of sensor devices, and / or imaging devices. Input devices, and / or output devices such as display devices, printers, speakers, and / or network cards. The example input / output device 24 may be included inside the computing device 12 as one component of the computing device 12, and may be connected to the computing device 12 as a separate device from the computing device 12. It may be.

Although exemplary embodiments of the present invention have been described in detail above, those skilled in the art will appreciate that various modifications can be made to the above-described embodiments without departing from the scope of the present invention. . Therefore, the scope of the present invention should not be limited to the embodiments described, but should be defined by the claims below and equivalents thereof.

100: Linux malware detection device
102: behavior data collection module
104: Behavioral Data Processing Module
106: Similarity Determination Module
111: preprocessing unit
113: system call table generation unit
115: group classification unit
117: context map table generator

Claims (9)

As a device for detecting malicious code in Linux environment,
A behavior data collection module for collecting behavior data including each system call and system call parameters called while the target file is executed;
An action data processing module for classifying the collected one or more system calls into any one action group among preset action groups to generate action group related information of the target file; And
And a similarity determination module for measuring similarity between the behavior group related information of the target file and the previously stored behavior group related information of the malicious file.
The system call is composed of basic function calls for the operating system to use Linux kernel region functions in the Linux environment.
The behavior data processing module,
A pre-processing unit for classifying the collected system calls into predetermined categories according to behavior characteristics of the corresponding system calls, and assigning a predetermined category classification number to the classified categories to the corresponding system calls;
A system call table generation unit generating a system call table including the category classification number and the system call parameter according to a call order of the collected system calls;
Based on the category classification number and system call parameter of the system call table, the collected one or more system calls are classified into any one action group among predetermined action groups, and a predetermined action group number for the classified action group is assigned. A group classification unit to be given; And
A context map table generator for generating a context map table including an action group number and an action group parameter according to the time sequence of each classified action group,
The action group parameter is information indicating what the main factor of the action group is, and is set based on a system call parameter of a system call corresponding to the action group.
The similarity determination module,
The first similarity is measured by determining the similarity between the time sequence of the action group number in the context map table of the target file and the time order of the action group number in the context map table of the previously stored malicious file, and measuring the first similarity in the context map table of the target file. Determining a similarity between the behavior group number and the behavior group parameter in the context group table of the behavior group number and the behavior group parameter and the previously stored malicious file, measuring a second similarity, giving a first weight to the first similarity, Giving a second weight higher than the first weight to 2 similarities and adding the same to calculate a total similarity score between the context map table of the target file and the previously stored malicious map table;
The group classification unit classifies the one or more system calls into one of the predetermined action groups according to the type of system call,
The type of system call includes a single system call type, a continuous system call type of the same category, and a complex category system call type,
The single system call type indicates a case in which a single system call can grasp its behavior, and the continuous system call type of the same category indicates when system calls are continuously called in the same category, and the complex category system call type is 2 Apparatus for detecting malware in a Linux environment, which represents a case where a system call is called in a combination of two or more categories.
delete delete delete delete delete delete One or more processors, and
A method performed in a computing device having a memory that stores one or more programs executed by the one or more processors, the method comprising:
Collecting each system call and system call parameter that is called while the target file is executed;
Generating the action group related information of the target file by classifying the collected one or more system calls into any one action group among preset action groups; And
Measuring the similarity between the behavior group related information of the target file and the behavior group related information of a pre-stored malicious file;
The system call is composed of basic function calls for the operating system to use Linux kernel area functions in a Linux environment.
The generating of the action group related information may include:
Classifying each of the collected system calls by a predetermined category according to the behavior characteristic of the corresponding system call, and assigning a predetermined category classification number to the classified category to the corresponding system call;
Generating a system call table including the category classification number and the system call parameter according to the calling order of the collected system calls;
Based on the category classification number and system call parameter of the system call table, the collected one or more system calls are classified into any one action group among preset action groups, and the action group number preset for the classified action group is assigned. Giving action; And
Generating a context map table including an action group number and an action group parameter according to the time sequence of each classified action group,
The action group parameter is information indicating what the main factor of the action group is, and is set based on a system call parameter of a system call corresponding to the action group.
Measuring the similarity,
The first similarity is measured by determining the similarity between the time sequence of the action group number in the context map table of the target file and the time order of the action group number in the context map table of the prestored malicious file, and measuring the first similarity in the context map table of the target file. Determining a similarity between the behavior group number and the behavior group parameter in the context group table of the behavior group number and the behavior group parameter and the previously stored malicious file, measuring a second similarity, giving a first weight to the first similarity, Giving a second weight higher than the first weight to 2 similarities and adding the same to calculate a total similarity score between the context map table of the target file and the previously stored malicious map table;
The classifying into the action group may include classifying the at least one system call into any one action group among predetermined action groups according to a type of a system call,
The type of system call includes a single system call type, a continuous system call type of the same category, and a complex category system call type,
The single system call type indicates a case in which a single system call can grasp its behavior, and the continuous system call type of the same category indicates when system calls are continuously called in the same category, and the complex category system call type is 2 A method of detecting malicious code in a Linux environment, which indicates a case where a system call is called in a combination of two or more categories.
A computer program stored in a non-transitory computer readable storage medium,
The computer program is a computer program for detecting malicious code in a Linux environment,
The computer program includes one or more instructions that, when executed by a computing device having one or more processors, cause the computing device to:
Have the target file run to collect each system call and system call parameter that is called,
Classify the collected one or more system calls into any one action group among preset action groups to generate action group related information of the target file; and
Measure the similarity between the behavior group-related information of the target file and the behavior group-related information of a pre-stored malicious file;
The system call is composed of basic function calls for the operating system to use Linux kernel region functions in the Linux environment.
Instructions for generating the action group related information,
Classify each of the collected system calls by a predetermined category according to a behavior characteristic of a corresponding system call, and assign a predetermined category classification number to the classified category to the corresponding system call,
Generate a system call table including the category classification number and the system call parameter according to the calling order of the collected system calls;
Based on the category classification number and system call parameter of the system call table, the collected one or more system calls are classified into any one action group among predetermined action groups, and a predetermined action group number for the classified action group is assigned. To grant,
Generate a context map table including an action group number and an action group parameter according to the time sequence of each classified action group,
The action group parameter is information indicating what the main factor of the action group is, and is set based on a system call parameter of a system call corresponding to the action group.
Instructions for measuring the similarity,
Determine a similarity between the time order of the action group number in the context map table of the target file and the time order of the action group number in the context map table of the pre-stored malicious file to measure a first similarity, and the context map table of the target file Determine a similarity between the behavior group number and the behavior group parameter in the context map table of the previously stored malicious file and the behavior group parameter and the previously stored malicious file, measure a second similarity, give a first weight to the first similarity, The second similarity is given a second weight higher than the first weight and summed to calculate the total similarity score between the context map table of the target file and the stored context map table of the malicious file.
The instructions for classifying the action group may include: classifying the one or more system calls into any one action group among predetermined action groups according to a type of a system call,
The type of system call includes a single system call type, a continuous system call type of the same category, and a complex category system call type,
The single system call type indicates a case in which a single system call can grasp its behavior, and the continuous system call type of the same category indicates when system calls are continuously called in the same category, and the complex category system call type is 2 A computer program representing when a system call is called in combination in more than one category.

Images