KR102102577B1 - Apparatus for detecting malicious app and method thereof - Google Patents

Abstract

A malicious app detection device is provided. The malicious app detection device, based on the difference between the first behavior analysis result and the second behavior analysis result for the existing malicious app, generates a decision rule for determining whether to perform the behavior analysis of the app under analysis in the real environment, The first behavior analysis result is a behavior analysis result for the existing malicious app performed in a virtual environment and the second behavior analysis result is a behavior analysis result for the existing malicious app performed in a real environment, a rule generator, and It may include a behavior analysis control unit for controlling to perform the behavior analysis of the analysis target app based on the generated decision rule.

Description

Malicious app detection device and method thereof {APPARATUS FOR DETECTING MALICIOUS APP AND METHOD THEREOF}

The present invention relates to a method and apparatus for detecting a malicious app. More specifically, by minimizing the use of a terminal that is used for behavior analysis, a maintenance cost for detecting a malicious app is reduced, and a device capable of more effectively detecting a malicious app in an actual operating environment and the operation of the device It's about how.

With the spread of smart phones, users enjoy the convenience of life. However, as shown in Figure 1, due to the continuous increase in malicious apps that contain mobile malware, users have various forms of security, such as personal information leakage such as call history, location information, account information, and billing through micro payment. Threats. In particular, security threats of smartphones are occurring in Android-equipped terminals, which can be attributed to the openness and high market share of Android.

In order to detect a malicious app, a detection method that analyzes a malicious app in a virtual environment, such as an emulator or a virtual machine, is mainly used. This is because the virtual environment is easy to control, and even if it is infected with malicious code, it does not affect the host PC, so the maintenance cost for detecting malicious apps can be greatly reduced. For example, Google determines in advance whether a mobile app is a malicious app through behavior analysis before the mobile app is registered in the app market through a QEMU (Quick Emulator) -based Google bouncer.

However, as mobile malicious code production technology has evolved, analysis evasion-type malicious apps designed to bypass behavior analysis in a virtual environment have emerged. Analysis evasion-type malicious app refers to a malicious app that intelligently evades behavior analysis in the virtual environment by detecting the execution environment and performing only normal operations when the execution environment is determined to be a virtual environment.

For example, the analysis-avoidance malicious app detects the execution environment by using the difference between the attribute information set in the actual terminal 1 and the attribute information set in the emulator 2, as shown in FIG. 2. For a more detailed example, in the emulator 2, attribute information such as International Mobile Equipment Identity (IMEI), model of the terminal, and network information is set to a different value from the actual terminal 1. Therefore, the analysis-avoidance malicious app can determine whether the execution environment corresponds to the virtual environment by checking the property information as described above. In addition, since the analysis-avoiding malicious app is designed not to perform a malicious behavior in a virtual environment, it is possible to intelligently evade the behavior analysis in the virtual environment.

Therefore, in order to detect an analysis evasion-type malicious app, inevitably, behavior analysis needs to be performed in a real environment such as a mobile terminal. However, the mobile terminal input to the behavior analysis is continuously infected by the malicious code, and the life of the terminal is significantly reduced, and accordingly, a maintenance cost for detecting a malicious app increases significantly.

Accordingly, there is a need for a method capable of reducing maintenance costs required for detecting malicious apps by minimizing the use of a terminal input for behavior analysis when detecting malicious apps.

Korean Patent Publication No. 2013-0078278

The technical problem to be solved by the present invention is to provide a malicious app detection device and a method of operating the device, which can reduce maintenance costs for detecting malicious apps in an actual operating environment.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

In order to solve the above technical problem, the malicious app detection device according to an embodiment of the present invention analyzes the behavior of an app to be analyzed based on a difference between a first behavior analysis result and a second behavior analysis result for an existing malicious app Create a decision rule to determine whether to perform in the real environment, wherein the first behavior analysis result is the behavior analysis result for the existing malicious app performed in the virtual environment, and the second behavior analysis result is the existing behavior performed in the real environment It may include a behavior analysis control unit for controlling to perform behavior analysis of the analysis target app based on the rule generation unit and the generated decision rule, which is a result of behavior analysis for a malicious app.

In one embodiment, each of the first behavior analysis result and the second behavior analysis result includes information on at least one application programming interface (API) called from the existing malicious app, wherein the rule generation unit calls the API A suspect API may be selected from the at least one API based on a difference in the number of times, and a determination rule including conditions defined based on the suspect API may be generated.

In one embodiment, each of the first behavior analysis result and the second behavior analysis result includes information on at least one system call called from the existing malicious app, wherein the rule generator is configured to perform a system call. A suspicious system call may be selected from the at least one system call based on a difference in the number of calls, and a decision rule including conditions defined based on the suspicious system call may be generated.

In one embodiment, each of the first behavior analysis result and the second behavior analysis result includes information about at least one function called from the existing malicious app, wherein the rule generation unit is configured to vary the number of times the function is called. A suspicious function is selected from the at least one function based on the selected function, and a decision rule including a condition defined based on the suspicious function is generated, and the behavior analysis control unit generates a source code of the analysis target app through static analysis. In response to a determination that the function extracting unit extracts the included function and the extracted function satisfies a condition defined based on the suspicious function, a rule-based control unit controlling to perform behavior analysis of the analysis target app in a real environment It may include.

The method for detecting a malicious app according to an embodiment of the present invention for solving the above-described technical problem, in a method for detecting a malicious app performed by the device for detecting a malicious app, obtains a first behavior analysis result for an existing malicious app, , The first behavior analysis result is a result of behavior analysis for the existing malicious app performed in a virtual environment, obtaining a second behavior analysis result for the existing malicious app, wherein the second behavior analysis result is Based on the difference between the first behavior analysis result and the second behavior analysis result, which is a result of behavior analysis for the existing malicious app performed in a real environment, behavior analysis of an analysis target app is performed in a real environment Generating a decision rule for determining whether to perform or not and controlling to perform an action analysis for the analysis target app based on the generated decision rule. Can do

The computer program according to an embodiment of the present invention for solving the above technical problem is combined with a computing device to obtain a first behavior analysis result for an existing malicious app, wherein the first behavior analysis result is in a virtual environment. The step, which is a result of the behavior analysis for the existing malicious app, acquires a second behavior analysis result for the existing malicious app, and the second behavior analysis result is for the existing malicious app performed in a real environment. Generating a decision rule for determining whether to perform a behavior analysis of an analysis target app in a real environment, based on a difference between the first behavior analysis result and the second behavior analysis result, which is a behavior analysis result; and Computer-readable to execute the step of controlling to perform the behavior analysis for the analysis target app based on the generated decision rule It may be stored in recording media.

The malicious app detection system according to an embodiment of the present invention for solving the above-described technical problem is a first behavior analysis device that performs behavior analysis on an analysis target app in a virtual environment, for the analysis target app in a real environment In response to a determination that the second behavior analysis device for performing behavior analysis and a determination rule for determining whether to perform behavior analysis of the analysis target app in a real environment, and the analysis target app satisfies the generated decision rule, And a behavior analysis control device that controls the analysis of the app to be analyzed through the second behavior analysis device, wherein the behavior analysis control device is a first behavior analysis result for an existing malicious app performed in a virtual environment. Based on the difference between the results of the second behavior analysis for the existing malicious app performed in the real environment, the decision rule is generated. It can be accomplished.

1 is a diagram illustrating an example of a security threat according to a mobile malicious code and / or a mobile malicious app.
FIG. 2 is a diagram for explaining an exemplary method in which an analysis evasion-type malicious app detects a virtual environment.
3 is a configuration diagram of a malicious app detection system according to an embodiment of the present invention.
4 is a block diagram illustrating an apparatus for controlling behavior analysis according to an embodiment of the present invention.
5 is a block diagram showing a malicious app detection device according to an embodiment of the present invention.
6 is a diagram for explaining a process of generating a decision rule by a malicious app detection device according to an embodiment of the present invention.
7 is an exemplary view showing a result of behavior analysis in a virtual environment and a real environment that can be referred to in some embodiments of the present invention.
8 and 9 are exemplary diagrams of API and system calls that may be referenced in some embodiments of the present invention.
10 is a diagram for explaining a process of controlling a behavior analysis of an app to be analyzed by a malicious app detection device according to an embodiment of the present invention.
11 is a detailed block diagram showing a behavior analysis control unit of a malicious app detection device according to an embodiment of the present invention.
12 is a hardware configuration diagram of a malicious app detection device according to another embodiment of the present invention.
13 and 14 are flowcharts illustrating a method for generating a decision rule according to an embodiment of the present invention.
15 is a flowchart illustrating a method for controlling behavior analysis based on a decision rule according to an embodiment of the present invention.
16 is a flowchart illustrating a method for controlling behavior analysis based on a decision rule according to the first embodiment of the present invention.
17 is a flowchart illustrating a method for controlling behavior analysis based on a decision rule according to a second embodiment of the present invention.
18 is a flowchart illustrating a method for controlling behavior analysis based on a decision rule according to a third embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, and methods for achieving them will be clarified with reference to embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only the embodiments allow the disclosure of the present invention to be complete, and common knowledge in the art to which the present invention pertains It is provided to completely inform the person having the scope of the invention, and the present invention is only defined by the scope of the claims.

It should be noted that in adding reference numerals to the components of each drawing, the same components have the same reference numerals as possible even though they are displayed on different drawings. In addition, in describing the present invention, when it is determined that detailed descriptions of related well-known structures or functions may obscure the subject matter of the present invention, detailed descriptions thereof will be omitted.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used in a sense that can be commonly understood by those skilled in the art to which the present invention pertains. In addition, terms defined in the commonly used dictionary are not ideally or excessively interpreted unless specifically defined. The terminology used herein is for describing the embodiments and is not intended to limit the present invention. In this specification, the singular form also includes the plural form unless otherwise specified in the phrase.

In addition, in describing the components of the present invention, terms such as first, second, A, B, (a), and (b) may be used. These terms are only for distinguishing the component from other components, and the nature, order, or order of the component is not limited by the term. When a component is described as being "connected", "coupled" or "connected" to another component, that component may be directly connected to or connected to the other component, but another component between each component It should be understood that elements may be "connected", "coupled" or "connected".

As used herein, "comprises" and / or "comprising" refers to the components, steps, operations and / or elements mentioned above, the presence of one or more other components, steps, operations and / or elements. Or do not exclude additions.

Prior to the description of the present specification, some terms used in the specification will be clarified.

In this specification, the virtual environment means a virtual execution environment similar to the actual execution environment of the app. For example, an execution environment implemented as a virtual machine, an emulator environment, and the like may be included in the virtual environment. For a more detailed example, if the target app is a mobile app running on Android, the virtual environment may mean an execution environment equipped with an Android emulator such as BlueStacks, GenyMotion, Andy, YouWave, and the like.

In the present specification, the actual environment means an actual execution environment in which the app operates. For example, when the target app is a mobile app running on Android, a mobile terminal equipped with Android may be included in a real environment.

In the present specification, the analysis-avoidance malicious app means an intelligent malicious app designed to bypass behavior analysis performed in a virtual environment.

In the present specification, the virtual environment detection application programming interface (API) means an API that an analysis evasion-type malicious app uses to detect the virtual environment. For example, the virtual environment detection API may include an API requesting any one attribute information set to a different value from the real environment in the virtual environment.

In the present specification, the fake information refers to information set to have a value that simulates a real environment in order to prevent a virtual environment detection function of an analysis evasion-type malicious app.

In the present specification, an instruction is a series of instructions grouped by function and refers to a component of a computer program and executed by a processor.

Hereinafter, some embodiments of the present invention will be described in detail according to the accompanying drawings.

3 is a configuration diagram of a malicious app detection system according to an embodiment of the present invention.

Referring to FIG. 3, a malicious app detection system according to an embodiment of the present invention may include a malicious app detection device 100, a first behavior analysis device 210 and a second behavior analysis device 230. However, this is only a preferred embodiment for achieving the object of the present invention, and of course, some components may be added or deleted as necessary. In addition, it is noted that each component of the malicious app detection system illustrated in FIG. 3 represents functionally divided functional elements, and at least one component may be implemented in an integrated form in a physical environment. For example, the malicious app detection device 100, the first behavior analysis device 210 and / or the second behavior analysis device 230 may be implemented in the form of different logic in the same physical computing device. .

In the malicious app detection system, the malicious app detection device 100 is a computing device that detects a malicious app using the first behavior analysis device 210 and the second behavior analysis device 230. For example, the malicious app detection device 100 collects an app to be analyzed from the app market server 300, and uses the first behavior analysis device 210 and the second behavior analysis device 230 for the app to be analyzed. By performing behavior analysis, it is possible to detect a malicious app. However, the malicious app detection device 100 may collect the app to be analyzed through various routes in addition to the app market server 300.

The computing device may be a laptop, a desktop, a laptop, or the like, but is not limited thereto, and may include all types of devices equipped with computing functions.

According to an embodiment of the present invention, the malicious app detection device 100 performs an analysis result of an existing malicious app performed in a virtual environment (hereinafter referred to as a "first behavior analysis result") and an existing performed in a real environment. A predetermined decision rule may be generated based on a difference in a behavior analysis result of a malicious app (hereinafter, referred to as a “second behavior analysis result”). Here, the determination rule may be understood as a rule for determining whether to perform a behavior analysis of an analysis target app in a real environment or a rule for detecting an analysis target app suspected of an analysis evasion-type malicious app.

In addition, the malicious app detection device 100 analyzes the behavior of the app under analysis in a real environment, that is, in response to a determination that the characteristic of the app under analysis satisfies the decision rule, and precisely the predetermined condition defined in the decision rule. 2 through the behavior analysis device 230, it can be controlled to perform. In this embodiment, the malicious app detection device 100 may be referred to as a behavior analysis control device 100. According to the present embodiment, behavior analysis is performed in a real environment only for a part of an app to be analyzed that is suspected of an analysis evasion-type malicious app. Therefore, the use of the terminal (e.g. second behavior analysis device 230) input to the behavior analysis can be minimized, and accordingly, the maintenance cost required for the malicious app detection system in the actual operating environment can be greatly reduced. The detailed description of the process in which the malicious app detection apparatus 100 generates a decision rule and controls the behavior analysis according to the decision rule will be described in detail with reference to the drawings illustrated in FIG. 4 and below.

In the malicious app detection system, the first behavior analysis device 210 is a device that performs behavior analysis on an app to be analyzed in a virtual environment. For example, the first behavior analysis device 210 may be an emulator having an Android environment, but the scope of the present invention is not limited thereto.

In the malicious app detection system, the second behavior analysis device 230 is a device that performs behavior analysis on an app to be analyzed in a real environment. For example, the second behavior analysis device 230 may be implemented as a mobile terminal such as a smart phone, but the scope of the present invention is not limited thereto.

The devices 100, 210, 230, and 300 shown in FIG. 3 may communicate through a network. Here, the network is a wired / wireless network of any kind, such as a local area network (LAN), a wide area network (WAN), a mobile radio communication network, a Wibro (Wireless Broadband Internet), and the like. Can be implemented.

So far, a malicious app detection system according to an embodiment of the present invention has been described with reference to FIG. 3. Next, the configuration and operation of the behavior analysis control device 100 or the malicious app detection device 100 will be described with reference to FIGS. 4 to 12.

First, FIG. 4 is a block diagram illustrating a behavior analysis control apparatus 100 according to an embodiment of the present invention.

Referring to FIG. 4, the behavior analysis control device 100 may include a behavior analysis control unit 110 and a rule generation unit 130. However, only components related to the embodiment of the present invention are illustrated in FIG. 4. Therefore, it can be seen that a person skilled in the art to which the present invention pertains may include other general-purpose components in addition to the components shown in FIG. 4. In addition, each of the components of the behavior analysis control device 100 shown in FIG. 4 is functionally divided functional elements, and at least one component may be implemented in a form that is integrated with each other in an actual physical environment. Be careful.

Looking at each component, the behavior analysis control unit 110 controls the behavior analysis of the analysis target app to be performed based on the decision rule. For example, the behavior analysis control unit 110 may control to perform the behavior analysis of the analysis target app through the first behavior analysis device 210 in response to the determination that the feature of the analysis target app does not satisfy the determination rule. You can. For another example, the behavior analysis control unit 110 may control to perform the behavior analysis of the analysis target app through the second behavior analysis device 230 in response to the determination that the characteristics of the analysis target app satisfy the decision rule. . For another example, the behavior analysis control unit 110 performs behavior analysis of the analysis target app through the first behavior analysis device 210 by default, and the characteristic of the analysis target app derived according to the behavior analysis is determined rule In response to a determination that satisfies, the second behavior analysis device 230 may be used to further control the behavior analysis of the analysis target app.

In addition, in order to obtain first and second behavior analysis results used to generate a decision rule, the behavior analysis control unit 110 analyzes behavior of the existing malicious app through the first and second behavior analysis devices 210 and 230. It can be controlled to perform. Here, the existing malicious app means an app that has been previously determined to be malicious, and it may be preferable to include an analysis-avoidance malicious app. The first and second behavior analysis results may be provided to the rule generator 130.

A more detailed description of the operation of the behavior analysis control unit 110 will be described later with reference to FIGS. 10 and 11.

The rule generation unit 130 generates a predetermined decision rule based on a difference between a first behavior analysis result of an existing malicious app performed in a virtual environment and a second behavior analysis result of an existing malicious app performed in a real environment. The first and second behavior analysis results may be obtained through the first behavior analysis device 210 and the second behavior analysis device 230, or may be provided with analysis results previously performed from an arbitrary device. A detailed description of the process of the rule generation unit 130 generating the decision rule will be described in detail with reference to FIGS. 6 to 9.

5 is a block diagram showing a malicious app detection device 100 according to an embodiment of the present invention.

As shown in FIG. 5, the malicious app detection device 100 further includes a module 110 and 130 for controlling behavior analysis of the analysis target app, and a malicious determination unit 190 for determining whether the analysis target is malicious or not. can do.

In addition, according to an embodiment, the malicious app detection device 100 may be configured to further include a first behavior analysis unit 150 and / or a second behavior analysis unit 170. Here, the first behavior analysis unit 150 may be understood as a module corresponding to the first behavior analysis device 210, and the second behavior analysis unit 170 may be understood as a module corresponding to the second behavior analysis device 230. have. Hereinafter, for convenience of description, it will be assumed that the malicious app detection device 100 is implemented to include modules 150 and 170 for performing behavior analysis in each analysis environment.

Each component illustrated in FIGS. 4 and 5 may mean software or hardware such as a field programmable gate array (FPGA) or an application-specific integrated circuit (ASIC). However, the above components are not limited to software or hardware, and may be configured to be in an addressable storage medium, or may be configured to execute one or more processors. The functions provided in the above components may be implemented by more detailed components, or may be implemented as a single component that performs a specific function by combining a plurality of components.

Hereinafter, a process of generating a decision rule by the malicious app detection device 100 will be described in detail with reference to FIGS. 6 to 9.

Referring to FIG. 6, the process of generating the decision rule starts from a process of acquiring a first behavior analysis result and a second behavior analysis result for an existing malicious app. For example, the rule generation unit 130 may obtain a first behavior analysis result and a second behavior analysis result for an existing malicious app performed by the first behavior analysis unit 150 and the second behavior analysis unit 170. Can (①, ②).

Next, the rule generation unit 130 generates a decision rule based on the difference between the first behavior analysis result and the second behavior analysis result, and provides the generated decision rule to the behavior analysis control unit 110 (③).

Looking specifically at the method for generating a decision rule, the first behavior analysis result and the second behavior analysis result include information on an application programming interface (API) and / or a system call called from an existing malicious app. Including, the rule generation unit 130 may generate a decision rule using the information on the API and / or system call. At this time, the information about the API and / or system call may include the number of calls of the API / system call, the order of calls, and call parameters.

The API may include all kinds of APIs, for example, APIs provided by platform operators. In addition, the API may include an API that does not call a system call and / or an API that results in a system call. For an example of the API used in the Android app, refer to FIG. 8.

The system call may include all kinds of system calls related to file system, memory, process, network activity, etc. as shown in FIG. 9. For an example of the system call, refer to FIG. 9.

The rule generator 130 may generate a decision rule according to some embodiments below.

In the first embodiment, the rule generation unit 130 selects a suspected API from at least one API called from the existing malicious app based on a difference in the number of API calls, and generates a decision rule based on the suspected API. If a specific API is called more in a real environment, the specific API is likely to be an API mainly used in an analysis evasion-type malicious app, so the specific API is used as a decision condition of the behavior analysis environment.

For example, as shown in FIG. 7, when the difference 405 between the number of calls 403 of the first API in the real environment and the number of calls of the first API 401 in the virtual environment is 405 or more. , The first API may be selected as a suspect API.

In the first-first embodiment, the rule generator 130 may select a suspect API by further considering a difference in the order of API calls. For example, even if the difference in the number of API calls is less than a threshold value, if the call order is different in a real environment, the rule generator 130 may select the API as a suspect API.

In the embodiment 1-2, the rule generation unit 130 may select the suspect API by further considering differences in API call factors. For example, even if the difference in the number of API calls is less than a threshold value, if the API's call factor (that is, the parameter value) is changed, the rule generator 130 may select the API as a suspect API.

In the first-3 embodiment, the rule generator 130 may select a suspect API by a combination of the first-first embodiment and the first-second embodiment.

When a suspect API is selected according to the above-described embodiment, the rule generation unit 130 generates a decision rule including conditions defined based on the suspect API. The conditions of the determination rule may include various conditions based on the number of suspected APIs included in the app to be analyzed, the type of suspected APIs, the number of calls of the suspected APIs, and the weight of the suspected APIs compared to the entire API.

For a specific example, the determination rule is a first determination rule for performing behavior analysis in a real environment when a certain number of suspected APIs are included in an app to be analyzed, a real environment when a suspected API is called a certain number of times or more in a real environment It may include a second decision rule to perform the behavior analysis. Alternatively, the determination rule is a third determination rule that performs behavioral analysis in a real environment when a suspected index (ie, the degree of suspicion of an analysis evasion-type malicious app) is greater than a certain value calculated based on a suspected API. It may include.

In the third decision rule, different doubt indices and / or different weights may be assigned to each suspect API. For example, a higher suspicion index and / or weight may be assigned to a suspicious API having a large difference in a result of behavior analysis (e.g., a difference in the number of calls, a difference in a call sequence, and a difference in a call factor) derived from an existing malicious app. Alternatively, a higher suspicion index and / or weight may be assigned to a suspicious API related to network behavior among suspicious APIs. This is because network-related APIs can cause serious security threats such as personal information leakage.

When the third decision rule is applied, a suspicious index is calculated for each suspicious API based on the degree to which the suspicious API appeared in the app to be analyzed (eg suspicious index of the suspicious API x number of calls), and the suspicious calculated for each suspicious API The total suspected index may be calculated according to the sum of the weights of the index, and when the total suspected index is greater than or equal to a threshold, behavior analysis may be performed in a real environment.

In addition to the above-described decision rules, various decision rules may be generated, which may vary depending on the embodiment.

In the second embodiment, the rule generation unit 130 selects a suspicious system call from at least one system call called from an existing malicious app based on a difference in the number of system call calls, and a decision rule based on the suspicious system call Produces In addition, a suspicious system call may be selected in a similar manner to the above-described embodiments 1-1 to 1-3.

When a suspicious system call is selected, the rule generation unit 130 generates a decision rule including conditions defined based on the suspicious system call. The conditions of the decision rule may include various conditions based on the number of suspicious system calls included in the app to be analyzed, the type of suspicious system calls, the number of suspicious system calls, and the proportion of suspicious system calls to the total system calls. .

For a specific example, the determination rule may include conditions defined based on a suspicion index calculated according to the appearance of the suspicion system call. At this time, the suspicion index is a weight of the first suspicion index calculated according to the appearance of the first suspicious system call related to the network activity and the second suspicion index calculated according to the appearance of the second suspicious system call related to the other behavior It may be determined as a sum, and the first doubt index may be assigned a higher weight than the second doubt index. This is because when system-related system calls are used in malicious apps, they can cause more serious security threats such as personal information leakage.

The method for generating a decision rule based on the suspicious system call is similar to generating a decision rule based on the suspect API, and thus, further description will be omitted.

In the third embodiment, the rule generation unit 130 selects a suspect function from at least one function called from the existing malicious app based on a difference in the number of function calls, and generates a decision rule based on the suspect function. In this case, the function may be understood as a concept encompassing API and system calls. The method for generating a decision rule based on the suspicious function is similar to generating a decision rule based on a suspect API or a suspicious system call, so further description will be omitted.

Meanwhile, according to an embodiment of the present invention, a first behavior analysis result indicating a behavior analysis result of an existing app performed in a virtual environment includes a first process of detecting a virtual environment detection API call of the existing malicious app and the call It may be a result of behavior analysis derived through a second process of returning fake information in response to detection. At this time, the virtual environment detection API is an API that requests information that is set differently from the real environment in the virtual environment, and the fake information is information set to have a value that simulates the real environment to prevent detection of the virtual environment of the existing malicious app. Means When behavior analysis is performed in a virtual environment through the first process and the second process, the virtual environment detection function of some analysis evasion-type malicious apps may be neutralized. Accordingly, some of the analytic evasion-type malicious apps perform the same malicious behavior in the virtual environment and the real environment, and the difference in the behavior analysis results is not large. According to this embodiment, only functions related to some analysis evasion-type malicious apps in which the virtual environment detection function cannot be neutralized through fake information among the existing malicious apps are selected as suspect functions. Therefore, the number of times the behavior analysis is performed in the actual terminal can be further reduced, and accordingly, the accuracy of the malicious app detection is guaranteed, and the maintenance cost required for the malicious app detection can be further reduced.

So far, with reference to FIGS. 6 to 9, the process of generating the decision rule by the malicious app detection device 100 has been described. Hereinafter, with reference to FIGS. 10 to 11, the process of controlling the behavior analysis of the app to be analyzed by the malicious app detection device 100 based on the decision rule will be described in detail.

Referring to FIG. 10, the process of controlling the behavior analysis starts in a process in which the behavior analysis control unit 110 receives an analysis target app (①). Next, the behavior analysis control unit 110 controls to perform the behavior analysis through the first behavior analysis unit 150 and / or the second behavior analysis unit 170 based on the previously generated decision rule (②, ③). ), For example, in response to a determination that the characteristics of the app under analysis (eg, the extent to which a suspected API / suspicious system call has appeared in the source code, the extent to which a suspicious API / suspicious system call has actually been invoked) satisfies the decision rule , The behavior analysis control unit 110 may control to perform behavior analysis of an analysis target app through the second behavior analysis unit 170. Next, the malicious determination unit 190 receives the result of the behavior analysis of the analysis target app (④), and determines whether the analysis target app is malicious based on the behavior analysis result.

Looking in more detail about the process of controlling the behavior analysis, the behavior analysis control unit 110 may control behavior analysis of the analysis target app according to some embodiments below.

In the first embodiment, the behavior analysis control unit 110 extracts a function included in the source code of the analysis target app through static analysis of the analysis target app, and the extracted function is a condition defined based on the suspect function In response to the determination that it satisfies, it may be controlled to perform behavior analysis of the analysis target app in a real environment. To this end, the behavior analysis control unit 110 includes a function extraction unit 111 for extracting a function included in the source code and a rule-based control unit 113 for controlling behavior analysis according to a decision rule, as shown in FIG. 11. It can be configured to.

In the second embodiment, the behavior analysis control unit 110 may control to perform behavior analysis of an analysis target app in a virtual environment through the first behavior analysis unit 150 by default. Next, the behavior analysis control unit 110 obtains information (eg, a list of functions that are called, the number of calls, etc.) about the function called from the analysis target app as a result of behavior analysis in the virtual environment, and the obtained information is In response to the determination that the decision rule is satisfied, the second behavior analysis unit 170 controls to perform the behavior analysis of the analysis target app in the real environment.

In the third embodiment, the function extraction unit 111 extracts a function included in the source code through static analysis, and the behavior analysis control unit 110 analyzes the app in the virtual environment through the first behavior analysis unit 150 It can be controlled to perform the behavior analysis of. Next, as shown in FIG. 11, the function extracting unit 111 displays information (eg, a list of functions called, the number of calls, etc.) of functions called from an analysis target app as a result of behavior analysis in a virtual environment. Acquiring and extracting a function that is not called during behavior analysis among functions included in the source code may be extracted using a list of acquired functions. Then, the rule-based control unit 113 determines whether the uncalled function satisfies the decision rule, and responds to the determination that the decision rule is satisfied, through the second behavior analysis unit 170 to analyze the app to be analyzed in the real environment. It can be controlled to perform additional behavior analysis.

In the first to third embodiments, when the behavior analysis is performed in the real environment, the malicious determination unit 190 may determine whether the app to be analyzed is malicious or not based on the result of the behavior analysis in the real environment. have.

According to the first to third embodiments, behavior analysis is performed in a real environment only for some analysis target apps that satisfy a condition defined based on a suspect function among the analysis target apps. Therefore, the use of an actual terminal input for behavior analysis can be minimized, and accordingly, maintenance costs for detecting malicious apps in a real operating environment can be greatly reduced.

So far, with reference to FIGS. 10 and 11, a process in which the malicious app detection device 100 controls behavior analysis for an app to be analyzed based on a decision rule has been described. Hereinafter, a malicious app detection device 100 according to another embodiment of the present invention will be described.

12 is a hardware configuration diagram of a malicious app detection device 100 according to another embodiment of the present invention.

Referring to FIG. 12, the malicious app detection apparatus 100 includes a memory for loading a computer program performed by one or more processors 101, a bus 105, a network interface 107, and a processor 101 ( 103) and a storage 109 for storing the malicious app detection software 109a and the decision rule 109b. However, only components related to the embodiment of the present invention are illustrated in FIG. 12. Therefore, it can be seen that a person skilled in the art to which the present invention belongs may include other general-purpose components other than those shown in FIG. 12.

The processor 101 controls the overall operation of each component of the malicious app detection device 100. The processor 101 comprises a CPU (Central Processing Unit), MPU (Micro Processor Unit), MCU (Micro Controller Unit), GPU (Graphic Processing Unit) or any type of processor well known in the art of the present invention. Can be. Further, the processor 101 may perform operations on at least one application or program for executing the method according to embodiments of the present invention. The malicious app detection device 100 may include one or more processors.

The memory 103 stores various data, commands and / or information. The memory 103 may load one or more programs 109a from the storage 109 in order to execute a malicious app detection method according to embodiments of the present invention. In Fig. 12, RAM is illustrated as an example of the memory 103.

The bus 105 provides a communication function between components of the malicious app detection device 100. The bus 105 may be implemented as various types of buses, such as an address bus, a data bus, and a control bus.

The network interface 107 supports wired and wireless Internet communication of the malicious app detection device 100. In addition, the network interface 107 may support various communication methods other than Internet communication. To this end, the network interface 107 may include a communication module well known in the technical field of the present invention.

The storage 109 may store the one or more programs 109a non-temporarily. In FIG. 12, malicious app detection software 109a is illustrated as an example of the one or more programs 109a.

The storage 109 is a non-volatile memory such as a read only memory (ROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EPMROM), a flash memory, a hard disk, a removable disk, or well in the art. And any known form of computer-readable recording media.

The malicious app detection software 109a may include instructions loaded in the memory 103 to cause the processor 101 to perform a malicious app detection method according to an embodiment of the present invention.

For example, the malicious app detection software 109a causes the processor 101 to obtain a first behavior analysis result for an existing malicious app, wherein the first behavior analysis result is for the existing malicious app performed in a virtual environment. An action that is a result of behavior analysis, and obtains a second behavior analysis result for the existing malicious app, wherein the second behavior analysis result is a behavior analysis result for the existing malicious app performed in an actual environment. Based on the difference between the first behavior analysis result and the second behavior analysis result, an operation of generating a decision rule to determine whether behavior analysis of an app to be analyzed is performed in a real environment and based on the generated decision rule By doing so may include instructions for performing an operation to control to perform the behavior analysis of the analysis target app.

So far, the configuration and operation of the malicious app detection apparatus 100 according to some embodiments of the present invention have been described with reference to FIGS. 4 to 12. Hereinafter, a method for detecting a malicious app according to an embodiment of the present invention will be described.

Each step of the malicious app detection method according to an embodiment of the present invention, which will be described below, may be performed by a computing device. For example, the computing device may be a malicious app detection device 100 or a behavior analysis control device 100. However, for convenience of description, description of the operation subject of each step included in the malicious app detection method may be omitted. In addition, each step of the malicious app detection method may be implemented with instructions of a computer program executed by a processor.

The method for detecting a malicious app according to an embodiment of the present invention includes a process of generating a decision rule for an existing malicious app and performing a behavior analysis for an app to be analyzed based on the generated decision rule. In order to provide convenience of understanding, a process of first generating a decision rule will be described with reference to FIGS. 13 and 14. The contents of the malicious app detection method, which will be described below, are generally similar to those described with reference to FIGS. 5 to 11. Therefore, descriptions of overlapping parts will be omitted.

13 is a flowchart illustrating a method for generating a decision rule according to an embodiment of the present invention. However, this is only a preferred embodiment for achieving the object of the present invention, and of course, some steps may be added or deleted as necessary.

Referring to FIG. 13, in step S100, the malicious app detection device 100 obtains a first behavior analysis result for an existing malicious app performed in a virtual environment.

In step S200, the malicious app detection device 100 obtains a second behavior analysis result for an existing malicious app performed in a real environment.

In step S300, the malicious app detection apparatus 100 generates a decision rule based on the difference between the first behavior analysis result and the second behavior analysis result. Referring to FIG. 14, this step (S300) will be described in detail.

As illustrated in FIG. 14, the malicious app detection device 100 selects a suspect function from among functions called from the existing malicious app based on the difference in the number of function calls (S310). For example, the malicious app detection apparatus 100 may select a function having a difference in the number of calls that is greater than or equal to a threshold among functions called from existing malicious apps as a suspect function. At this time, the threshold may be set to a fixed value or may be set to a relative value (e.g. the top 10%). As described above, the function includes an API and a system call, and in addition to the number of calls of the function, a suspect function may be selected in consideration of a difference between a call order and a call argument of the function.

Next, the malicious app detection device 100 generates a decision rule including a condition defined based on the suspect function (S330). The detailed description of the method for generating the decision rule is the same as that described with reference to FIGS. 6 to 9, and further description will be omitted.

Hereinafter, a process of controlling behavior analysis for the app to be analyzed based on the decision rule will be described with reference to FIGS. 15 to 18.

15 is a flowchart illustrating a method for controlling behavior analysis based on a decision rule according to an embodiment of the present invention. However, this is only a preferred embodiment for achieving the object of the present invention, and of course, some steps may be added or deleted as necessary.

Referring to FIG. 15, in step S400, the malicious app detection device 100 controls to perform behavior analysis of an analysis target app based on a decision rule. For example, in response to the determination that the characteristics of the app to be analyzed satisfy the decision rule, the malicious app detection device 100 may control to perform the behavior analysis of the app to be analyzed in the real environment. A more specific embodiment will be described later with reference to FIGS. 16 to 18.

In step S500, the malicious app detection device 100 determines whether the app to be analyzed is malicious based on the result of the behavior analysis. For example, if a third behavior analysis is performed on the app to be analyzed in a virtual environment and a fourth behavior analysis is performed on the app to be analyzed in the real environment in response to a determination that the decision rule is satisfied, malicious The app detection device 100 may determine whether the app to be analyzed is malicious based on the result of the fourth behavior analysis.

16 to 18 are flowcharts illustrating a method for controlling behavior analysis based on a decision rule according to some embodiments of the present invention.

First, a method for controlling behavior analysis according to the first embodiment will be described with reference to FIG. 16.

In step S411, the malicious app detection device 100 extracts a function included in the source code of the analysis target app through static analysis. For example, when the app to be analyzed is an application package file (.apk), the malicious app detection device 100 acquires source code through processing such as decompile, and analyzes the obtained source code. Through this, functions included in the source code can be extracted.

In step S413, the malicious app detection apparatus 100 determines whether the extracted function satisfies the decision rule. For example, when the determination rule includes a condition in which the suspicion index is equal to or greater than the threshold value, the malicious app detection device 100 identifies the suspicious function among the extracted functions and calculates the overall suspicion index for the identified suspicious function Then, it is determined whether or not the overall suspicion index satisfies the decision rule. However, the above example is only for convenience of understanding, and this step (S413) may be modified as many as the type of decision rule.

In step S415, the malicious app detection device 100 controls the behavior analysis for the app to be analyzed in the real environment in response to the satisfaction determination. On the contrary, if the decision rule is not satisfied, the malicious app detection device 100 may control to perform the behavior analysis of the analysis target app in the virtual environment.

Next, a method for controlling behavior analysis according to the second embodiment will be described with reference to FIG. 17.

In step S421, the malicious app detection device 100 controls to perform behavior analysis on the app to be analyzed in the virtual environment. That is, in this embodiment, behavior analysis in the virtual environment is performed by default. This is because the effect of the behavior analysis in the virtual environment on the maintenance cost is very small.

In one embodiment, the following steps (S423, S425) may be performed only when the analysis target app is not determined as malicious as a result of behavior analysis in the virtual environment. This is because if the app to be analyzed is already determined to be malicious in the virtual environment, no further analysis needs to be performed in the real environment. According to the present embodiment, since the use of the terminal used for behavior analysis is further reduced, the maintenance cost for detecting malicious apps may be further reduced.

In another embodiment, the following steps (S423, S425) may be performed even when an analysis target app is determined to be malicious as a result of behavior analysis in a virtual environment. That is, since the probability of false positives determined in the virtual environment cannot be excluded, behavior analysis may be additionally performed in the real environment as necessary. According to this embodiment, there is an effect of improving the accuracy of malicious app detection.

In step S423, the malicious app detection apparatus 100 determines whether the result of the behavior analysis in the virtual environment satisfies the decision rule. For example, the malicious app detection apparatus 100 may determine whether a function of an analysis target app called in a virtual environment satisfies a decision rule.

In step S425, the malicious app detection apparatus 100 controls to perform the behavior analysis of the analysis target app in the real environment in response to the satisfaction determination.

Next, a method for controlling behavior analysis according to the third embodiment will be described with reference to FIG. 18.

Referring to FIG. 18, in step S431, the malicious app detection device 100 performs behavior analysis on an app to be analyzed in a virtual environment. That is, the behavior of the third embodiment is also performed in the virtual environment by default.

In one embodiment, the following steps S433 to S439 may be performed only when the analysis target app is not determined as malicious as a result of behavior analysis in the virtual environment. This is because if the app to be analyzed is already determined to be malicious in the virtual environment, no further analysis needs to be performed in the real environment.

In another embodiment, the following steps (S433 to S439) may be performed even when an analysis target app is determined to be malicious as a result of behavior analysis in a virtual environment. That is, since the probability of false positives determined in the virtual environment cannot be excluded, additional behavior analysis may be performed in the real environment as necessary.

In step S433, the malicious app detection device 100 extracts a function included in the source code of the analysis target app through static analysis.

In step S435, the malicious app detection apparatus 100 extracts a function that is not called during behavior analysis from among functions included in the source code. That is, in the third embodiment, it is determined whether the decision rule is satisfied based on a function included in the source code but not called in the virtual environment.

In step S437, the malicious app detection device 100 determines whether the function extracted in step S435 satisfies the decision rule.

In step S439, the malicious app detection device 100 controls to perform behavior analysis on the app to be analyzed in the real environment in response to the satisfaction determination.

So far, with reference to FIGS. 16 to 18, a method for controlling a behavior analysis based on a decision rule according to some embodiments of the present invention has been described. According to some of the above-described embodiments, behavior analysis is performed in a real environment only for some analysis target apps that satisfy a condition defined based on a suspect function among the analysis target apps. Therefore, the use of an actual terminal input for behavior analysis can be minimized, and accordingly, maintenance costs for detecting malicious apps in a real operating environment can be greatly reduced.

So far, some embodiments of the present invention and effects according to the above embodiments have been described with reference to FIGS. 3 to 18. Effects according to embodiments of the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

The concept of the present invention described so far with reference to FIGS. 3 to 18 may be embodied as computer readable codes on a computer readable medium. The computer-readable recording medium may be, for example, a removable recording medium (CD, DVD, Blu-ray Disc, USB storage device, removable hard disk), or a fixed recording medium (ROM, RAM, hard disk equipped with a computer). You can. The computer program recorded on the computer-readable recording medium may be transmitted to another computing device through a network such as the Internet and installed on the other computing device, thereby being used in the other computing device.

In the above, even if all the components constituting the embodiments of the present invention are described as being combined or operated as one, the present invention is not necessarily limited to these embodiments. That is, within the scope of the present invention, all of the components may be selectively combined and operated.

Although the operations are shown in a specific order in the drawings, it should not be understood that the operations must be executed in a specific order or in a sequential order, or all illustrated operations must be executed to obtain a desired result. In certain situations, multitasking and parallel processing may be advantageous. Moreover, the separation of various configurations in the above-described embodiments should not be understood as such a separation is not necessarily necessary, and the described program components and systems may generally be integrated together into a single software product or packaged into multiple software products. It should be understood that there is.

Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may be implemented in other specific forms without changing the technical spirit or essential features of the present invention. Can understand. Therefore, it should be understood that the above-described embodiments are illustrative in all respects and not restrictive. The scope of protection of the present invention should be interpreted by the claims below, and all technical spirits within the scope equivalent thereto should be interpreted as being included in the scope of the present invention.

Claims (20)

Based on the difference between the first behavior analysis result and the second behavior analysis result for the existing malicious app, a determination rule is generated to determine whether to perform the behavior analysis of the analysis target app in a real environment, wherein the first behavior analysis result is virtual A rule generation unit for a behavior analysis result for the existing malicious app performed in an environment and the second behavior analysis result for a behavior analysis result for the existing malicious app performed in a real environment; And
When the analysis target app satisfies the generated decision rule, and includes a behavior analysis control unit that controls to perform the behavior analysis of the analysis target app in the real environment,
The decision rule,
If the analysis target app includes the conditions defined for the characteristics of the analysis evasion-type malicious app analyzed through the difference between the first behavior analysis result and the second behavior analysis result, and the analysis target app includes the condition It is a rule that determines that behavior analysis is performed in a real environment.
The analysis evasion-type malicious app,
In the virtual environment, characterized in that to avoid the behavior analysis,
Malware detection device. According to claim 1,
Each of the first behavior analysis result and the second behavior analysis result includes information on at least one application programming interface (API) called from the existing malicious app,
The rule generation unit,
Characterized in that, based on the difference in the number of API calls, selecting a suspect API from the at least one API, and generating a decision rule including a condition defined based on the suspect API,
Malware detection device. According to claim 2,
The suspected API is selected based on the difference in the order of API calls,
Malware detection device. According to claim 2,
The suspected API is characterized in that it is further determined based on the difference of the API call parameters,
Malware detection device. According to claim 1,
Each of the first behavior analysis result and the second behavior analysis result includes information on at least one system call called from the existing malicious app,
The rule generation unit,
Characterized in that by selecting a suspect system call from the at least one system call based on the difference in the number of system call calls, and generating a decision rule including a condition defined based on the suspect system call,
Malware detection device. The method of claim 5,
The decision rule includes conditions defined based on a suspected index calculated according to the appearance of the suspected system call.
The doubt index,
It is determined by the sum of the weights of the first suspicion index calculated according to the appearance of the first suspicious system call related to the network behavior and the second suspicion index calculated according to the appearance of the second suspicious system call related to the other behavior,
Characterized in that the first suspected index is given a higher weight than the second suspected index,
Malware detection device. According to claim 1,
Each of the first behavior analysis result and the second behavior analysis result includes information on at least one function called from the existing malicious app,
The rule generation unit,
A suspicious function is selected from the at least one function based on a difference in the number of times the function is called, and a decision rule including conditions defined based on the suspicious function is generated,
The behavior analysis control unit,
A function extraction unit for extracting a function included in the source code of the analysis target app through static analysis; And
In response to the determination that the extracted function satisfies a condition defined based on the suspect function, characterized in that it comprises a rule-based control unit for controlling to perform the behavior analysis of the app under analysis in a real environment,
Malware detection device. The method of claim 7,
The function extraction unit,
As a result of analyzing the third behavior of the app to be analyzed performed in a virtual environment, a list of functions called by the app to be analyzed during the third behavior analysis is obtained, and the source code is used by using the list of the obtained functions Characterized in that it extracts a function that is not called during the third behavior analysis among the functions included in,
Malware detection device. According to claim 1,
Further comprising a malicious determination unit for determining whether the app to be analyzed is malicious based on the analysis result of the row of the app to be analyzed,
The behavior analysis control unit,
The third behavior analysis for the analysis target app is controlled to be performed in a virtual environment, and in response to a determination that the result of the third behavior analysis satisfies the generated decision rule, the fourth behavior analysis for the analysis target app Control to perform further in the real environment,
The malicious determination unit,
Characterized in that it is determined whether the analysis target app is malicious based on the result of the fourth behavior analysis,
Malware detection device. According to claim 1,
The first behavior analysis result is a behavior analysis result performed through a process of detecting a call of the virtual environment detection API of the existing malicious app and a process of returning fake information in response to the detection of the call,
The virtual environment detection API is an API that requests information set differently from the real environment in the virtual environment,
The fake information is characterized in that the information is set to have a value that simulates the real environment to prevent the detection of the virtual environment of the existing malicious app,
Malware detection device. In the malicious app detection method performed by the malicious app detection device,
Obtaining a first behavior analysis result for an existing malicious app, wherein the first behavior analysis result is a behavior analysis result for the existing malicious app performed in a virtual environment;
Obtaining a second behavior analysis result for the existing malicious app, wherein the second behavior analysis result is a behavior analysis result for the existing malicious app performed in a real environment;
Generating a decision rule for determining whether to perform a behavior analysis of an analysis target app in a real environment based on a difference between the first behavior analysis result and the second behavior analysis result; And
When the analysis target app satisfies the generated decision rule, controlling to perform an action analysis on the analysis target app in the real environment,
The decision rule,
If the analysis target app includes the conditions defined for the characteristics of the analysis evasion-type malicious app analyzed through the difference between the first behavior analysis result and the second behavior analysis result, and the analysis target app includes the condition It is a rule that determines that behavior analysis is performed in a real environment.
The analysis evasion-type malicious app,
In the virtual environment, characterized in that to avoid the behavior analysis,
How to detect malicious apps. The method of claim 11,
Each of the first behavior analysis result and the second behavior analysis result includes information on at least one application programming interface (API) called from the existing malicious app,
Generating the decision rule,
Selecting a suspect API from the at least one API based on a difference in the number of API calls; And
And generating a decision rule including a condition defined based on the suspect API.
How to detect malicious apps. The method of claim 11,
Each of the first behavior analysis result and the second behavior analysis result includes information on at least one system call called from the existing malicious app,
Generating the decision rule,
Selecting a suspicious system call from the at least one system call based on a difference in the number of system call calls; And
And generating a decision rule including a condition defined based on the suspicious system call.
How to detect malicious apps. The method of claim 13,
The decision rule includes conditions defined based on a suspected index calculated according to the appearance of the suspected system call.
The doubt index,
It is determined by the sum of the weights of the first suspicion index calculated according to the appearance of the first suspicious system call related to the network behavior and the second suspicion index calculated according to the appearance of the second suspicious system call related to the other behavior,
Characterized in that the first suspected index is given a higher weight than the second suspected index,
How to detect malicious apps. The method of claim 11,
Each of the first behavior analysis result and the second behavior analysis result includes information on at least one function called from the existing malicious app,
Generating the decision rule,
Selecting a suspicious function from the at least one function based on a difference between the first behavior analysis result and the second behavior analysis result; And
Generating a decision rule including conditions defined based on the suspect function,
The step of controlling to perform the behavior analysis for the analysis target app,
Extracting a function included in the source code of the analysis target app through static analysis; And
And in response to a determination that the extracted function satisfies a condition defined based on the suspect function, controlling the behavior analysis of the app to be analyzed to be performed in a real environment.
How to detect malicious apps. The method of claim 15,
The step of controlling to perform the analysis of the behavior of the app to be analyzed in a real environment,
Controlling to perform a third behavior analysis on the analysis target app in a virtual environment, and obtaining a list of functions called by the analysis target app during the third behavior analysis as a result of the third behavior analysis;
Extracting at least one function not called during the third behavior analysis from among functions included in the source code, by using the obtained function list; And
And in response to a determination that the extracted at least one function satisfies a condition defined based on the suspect function, controlling to perform behavior analysis of the analysis target app in a real environment.
How to detect malicious apps. The method of claim 11,
Further comprising the step of determining whether the analysis target app is malicious based on the analysis result of the analysis target app,
The step of controlling to perform the behavior analysis for the analysis target app,
Controlling the third behavior analysis of the app to be analyzed to be performed in a virtual environment; And
In response to a determination that the result of the third behavior analysis satisfies the generated decision rule, controlling to further perform a fourth behavior analysis for the analysis target app in a real environment,
The step of determining whether the app to be analyzed is malicious,
And determining whether the app to be analyzed is malicious or not based on the result of the fourth behavior analysis.
How to detect malicious apps. The method of claim 11,
The first behavior analysis results,
The result of the behavior analysis performed through the process of detecting the call of the virtual environment detection API of the existing malicious app and the process of returning the preset fake information in response to the detection of the call,
The virtual environment detection API is an API that requests information set differently from the real environment in the virtual environment,
The fake information is characterized in that the information is set to have a value that simulates the real environment to prevent the detection of the virtual environment of the existing malicious app,
How to detect malicious apps. A computer program for identifying information of a computer system recorded on a computer readable medium including computer program instructions executable by a processor, when the computer program instructions are executed by a processor of a computing device,
Obtaining a first behavior analysis result for an existing malicious app, wherein the first behavior analysis result is a behavior analysis result for the existing malicious app performed in a virtual environment;
Obtaining a second behavior analysis result for the existing malicious app, wherein the second behavior analysis result is a behavior analysis result for the existing malicious app performed in a real environment;
Based on the difference between the first behavior analysis result and the second behavior analysis result, a determination rule is generated to determine whether to perform the behavior analysis of the analysis target app in a real environment, wherein the determination rule is the first behavior analysis result When the virtual environment is analyzed through a difference between a result of analysis and a second behavior analysis, and includes a condition defined for characteristics of an analysis evasion-type malicious app that avoids the behavior analysis, and the analysis target app includes the condition Generating the decision rule so that the app to be analyzed is determined to perform behavior analysis in the real environment; And
If the app to be analyzed satisfies the generated decision rule, a step of controlling to perform an action analysis on the app to be analyzed is performed in the real environment.
Computer program. A first behavior analysis device performing behavior analysis on an app to be analyzed in a virtual environment;
A second behavior analysis device performing behavior analysis on the analysis target app in a real environment; And
Create a decision rule for determining whether to perform the behavior analysis of the analysis target app in a real environment, and respond to a determination that the analysis target app satisfies the generated decision rule, analyze the behavior of the analysis target app in the second Including the behavior analysis control device for controlling to perform in the real environment through the behavior analysis device,
The behavior analysis control device,
The decision rule is generated based on a difference between a first behavior analysis result for an existing malicious app performed in a virtual environment and a second behavior analysis result for the existing malicious app performed in a real environment,
The decision rule,
If the analysis target app includes the conditions defined for the characteristics of the analysis evasion-type malicious app analyzed through the difference between the first behavior analysis result and the second behavior analysis result, and the analysis target app includes the condition It is a rule that determines that behavior analysis is performed in a real environment.
The analysis evasion-type malicious app,
In the virtual environment, characterized in that to avoid the behavior analysis,
Malicious app detection system.

Images