KR102143915B1 - Server and method for detecting malware in data files - Google Patents

Abstract

In a method for detecting a malicious code in a data file by a malicious code detection server according to an embodiment of the present invention, a data file encrypted by a homomorphic encryption technique based on a first encryption key previously designated by a user from a client device Receiving; Comparing the encrypted data file with a signature file of a malicious code previously stored in a database and encrypted using a homogeneous encryption technique; And transmitting, to the client device, a comparison result encrypted with the homogeneous encryption method calculated by the comparing step, wherein the comparison result indicates whether the data file is infected with a malicious code. We want to provide a code detection method.

Description

Server and method for detecting malicious codes in data files {SERVER AND METHOD FOR DETECTING MALWARE IN DATA FILES}

The present invention relates to a server and method for detecting a malicious code in a data file, and more specifically, to a server and method for detecting a malicious code in a state where a data file is encrypted using a homogeneous encryption technique.

Currently, a service that detects malicious codes by uploading files on the web is commercially available. For example, Google provides a web vaccine that analyzes files uploaded by users called VirusTotal and checks the existence of malicious codes. However, files uploaded to VirusTotal may be viewed by others on the server, and corporate confidentiality may be leaked due to this situation.

To prevent this, encryption of the file is required to preserve the privacy of the file uploaded on the web, but a general encryption system cannot detect malicious code without decrypting the encrypted file. After all, in order to detect the malicious code, the malicious code must be decrypted on the server, so there is a problem that the possibility of disclosure of the contents of the file is not excluded.

In order to solve the above-described problem, the server and method for detecting malicious code of a data file according to the present invention compare a data file encrypted with a homogeneous encryption technique with a signature file of the encrypted malicious code, and the malicious code in the state where the data file is encrypted. To provide a malicious code detection server and method capable of detecting

In a method for detecting a malicious code in a data file by a malicious code detection server according to an embodiment of the present invention, a data file encrypted by a homomorphic encryption technique based on a first encryption key previously designated by a user from a client device Receiving; Comparing the encrypted data file with a signature file of malicious code previously stored in the database and encrypted using a homogeneous encryption technique; And transmitting the comparison result encrypted with the homogeneous encryption technique calculated by the comparing step to the client device, wherein the comparison result indicates whether the data file is infected with a malicious code. I want to provide.

In this embodiment, a method for detecting a malicious code in a data file may be provided in which the encrypted comparison result is decrypted on the client device based on the first encryption key.

In the present embodiment, the comparing step may provide a method of detecting a malicious code of a data file by comparing and calculating an encrypted data file and a signature file of the encrypted malicious code in bit units.

In the present embodiment, the comparing step includes performing an exclusive OR operation on a bit string of an encrypted data file and a bit string of a signature file of the encrypted malicious code; And it is possible to provide a method for detecting a malicious code in a data file, including the step of performing an OR operation on the result of the exclusive OR operation.

According to another embodiment of the present invention, there is provided a server for detecting malicious codes, comprising: a memory storing a program for detecting malicious codes of data files; And a processor executing a program stored in the memory, wherein the processor receives a data file encrypted by the homomorphic encryption method based on the first encryption key previously designated by the user from the client device according to the execution of the program, and the encrypted The data file is previously stored in the database and compared with the signature file of the malicious code encrypted with the homogeneous encryption method, and the comparison result encrypted with the homogeneous encryption method calculated by the comparison is transmitted to the client device, and the comparison result is a data file We intend to provide a server for detecting malicious codes of data files, which indicates whether or not a malicious code is infected.

In this embodiment, the encrypted comparison result can be provided with a server for detecting a malicious code of a data file, which is decrypted on the client device based on the first encryption key.

In the present embodiment, the comparison may provide a server for detecting a malicious code of a data file by comparing and calculating an encrypted data file and a signature file of the encrypted malicious code in bit units.

In the present embodiment, the comparison provides a malicious code detection server for a data file, which performs an exclusive OR operation on the bit string of the encrypted data file and the bit string of the encrypted malware signature file, and the exclusive OR operation result. can do.

The server for detecting the malicious code of the data file according to an embodiment of the present invention compares the data file encrypted by the homogeneous encryption technique with the signature file of the encrypted malicious code to calculate an encrypted comparison result value, and the user Since it is possible to know whether the data file is infected with a malicious code by decrypting on the device, the data file encrypted on the server does not need to be decrypted, so that the contents of the file can be prevented from being leaked to others.

1 is a schematic diagram showing the configuration of a server for detecting a malicious code of a data file according to an embodiment of the present invention.
2 is a flowchart showing a method of detecting a malicious code in a data file according to another embodiment of the present invention.
3 is a schematic diagram showing a comparison of an encrypted data file and an encrypted malicious code signature file.
4 is a schematic diagram showing comparison of an encrypted data file and an encrypted malicious code signature file in bit units.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art may easily implement the present invention. However, the present invention may be implemented in various different forms and is not limited to the embodiments described herein. In addition, in the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part is said to be "connected" to another part, this includes "directly connected" and "electrically connected" with another element interposed therebetween. In addition, when a part "includes" a certain component, it means that other components may be further included rather than excluding other components unless specifically stated to the contrary.

The "client device" mentioned below may be implemented as a computer or portable client device that can access a server or other client device through a network. Here, the computer includes, for example, a notebook equipped with a web browser, a desktop, and a laptop, and the portable client device is, for example, a wireless communication device that guarantees portability and mobility. As, communication-based client devices such as International Mobile Telecommunication (IMT), Code Division Multiple Access (CDMA), W-Code Division Multiple Access (W-CDMA), and Long Term Evolution (LTE), all such as smartphones, tablet PCs, etc. It may include a type of handheld-based wireless communication device. In addition, “network” refers to a wired network such as a local area network (LAN), a wide area network (WAN), or a value added network (VAN), or a mobile radio communication network or satellite. It can be implemented with any type of wireless network such as a communication network.

Hereinafter, a description will be given of the malicious code detection server 100 of a data file according to an embodiment of the present invention with reference to the accompanying drawings.

1 is a schematic diagram showing the configuration of a malicious code detection server 100 of a data file according to an embodiment of the present invention.

Referring to FIG. 1, the malicious code detection server 100 may include a communication module 110, a memory 120, a processor 130, and a database (DB: 140).

The communication module 110 provides a communication interface to a client device by interworking with a communication network, and may serve to receive a data request transmitted from the client device and transmit data to the client device in response thereto. Here, the communication module 110 may be a device including hardware and software necessary to transmit and receive signals such as control signals or data signals through wired or wireless connection with other network devices.

In the memory 120, a program for detecting malicious codes in data files is recorded. Also, the memory 120 performs a function of temporarily or permanently storing data processed by the processor 130. Here, the memory 120 may include a volatile storage medium or a non-volatile storage medium, but the scope of the present invention is not limited thereto.

The processor 130 controls the entire process of providing a method of detecting malicious codes in data files. Each step performed by the processor 130 will be described later with reference to FIG. 2.

Here, the processor 130 may include all types of devices capable of processing data, such as a processor. Here, the'processor' may refer to a data processing device embedded in hardware, which has a circuit physically structured to perform a function represented by a code or instruction included in a program. As an example of a data processing device built into the hardware as described above, a microprocessor, a central processing unit (CPU), a processor core, a multiprocessor, and an application-specific integrated (ASIC) circuit), a field programmable gate array (FPGA), and the like, but the scope of the present invention is not limited thereto.

Hereinafter, a method of detecting a malicious code performed through the configuration of the malicious code detecting server 100 will be described.

2 is a flowchart showing a method of detecting a malicious code in a data file according to another embodiment of the present invention.

Referring to FIG. 2, in the method of detecting a malicious code in a data file by the malicious code detection server 100, first, a user can encrypt a data file using a homogeneous encryption technique using a first encryption key in a client device. Yes (S200). Here, the first encryption key may be a password arbitrarily set by the user to prevent others from opening and viewing the file.

Next, the malicious code detection server 100 may receive a data file encrypted by the homomorphic encryption technique based on the first encryption key previously designated by the user from the client device (S210).

Here, the homomorphic encryption technique may mean a fourth generation encryption system technology capable of analyzing data in a state in which the server encrypts various information of the user so that it cannot be identified. Homomorphic encryption is a cryptographic system technology that can be operated with only the cipher text itself without a separate decryption process. That is, when the operation result between ciphertexts is decrypted, the same result as the operation result between plaintexts can be obtained.

However, since homomorphic encryption supports only integer-to-integer operations, in order to encrypt data using homomorphic encryption, the data type must be set. An object of the present invention is to encrypt a file uploaded by a user, and for this purpose, it may be effective to transform the data file into a binary file format. Through this, each 0 and 1 bit constituting a data file in the form of a binary file can be encrypted.

Next, the malicious code detection server 100 may compare the encrypted data file with the signature file of the malicious code that is previously stored in the database 140 and encrypted by the homogeneous encryption technique (S220). Here, both the data file and the signature file of the malicious code are encrypted using the homogeneous encryption technique, so that they can be compared with each other in the encrypted state. The static analysis of the malicious code may be performed based on the signature database 140 of the malicious code built in advance. In the present invention, the signature of the malicious code stored in the database 140 may be encrypted using a homogeneous encryption technique, and compared with the encrypted data file uploaded on the server. At this time, if there is a cipher text in the encrypted data file that matches the signature file of the encrypted malicious code, it will be detected as a malicious code.

For example, the DarkSeoul malware that paralyzed the domestic computer network on March 20, 2013 contained a function that destroyed the MBR area and made it impossible to boot. In this case, the command “shutdown -r -t 0” that shuts down the system is set as the malicious code signature, and the file containing this command can be detected as malicious code.

3 is a schematic diagram showing a comparison of an encrypted data file and an encrypted malicious code signature file. 4 is a schematic diagram showing comparison of an encrypted data file and an encrypted malicious code signature file in bit units.

Referring to FIG. 3, the above-described comparison process may be a bit-wise comparison operation between an encrypted data file and a signature file of an encrypted malicious code. That is, each bit string constituting the encrypted data file (secret.html) and the bit string of each of the signature files of a plurality of encrypted malicious codes may be compared with each other. If the bit string (String A) of the encrypted malware signature file is included in a plurality of bit strings constituting the encrypted data file, it can be determined that the encrypted data file is infected with the malicious code.

Referring to FIG. 4, in detail, in the comparison process, an exclusive OR operation may be performed on a bit string of an encrypted data file and a bit string of a signature file of an encrypted malicious code (S221). Num1 of FIG. 4 may be a bit string of an encrypted data file. Num2 may be a bit string of a signature file of an encrypted malicious code. Here, bits constituting each column of Num1 and bits constituting each column of Num2 may be compared, and 0 may be output if they match, and 1 may be output if they do not match.

Next, the bits constituting the result of the beta OR operation may be ORed (S222). Specifically, the bits constituting the result of the beta OR operation may be compared, and 0 may be output if all are the same and 1 may be output if different.

In other words, the encrypted comparison result value calculated by comparing the above-described encrypted data file and the encrypted malicious code signature file with the malicious code detection server 100 is 1 in the case of Fig. 4A, In the case of (b) of FIG. 4, 0 may appear.

Then, the comparison result encrypted by the homomorphic encryption technique can be transmitted to the client device. Here, the comparison result may indicate whether the data file is infected with a malicious code (S230).

The encrypted comparison result may be decrypted on the client device based on the first encryption key (S240). In this way, the user can determine whether the data file is infected with the weakening code.

The server for detecting the malicious code of the data file according to an embodiment of the present invention compares the data file encrypted by the homogeneous encryption technique with the signature file of the encrypted malicious code to calculate an encrypted comparison result value, and the user Since it is possible to know whether the data file is infected with a malicious code by decrypting on the device, the data file encrypted on the server does not need to be decrypted, so that the contents of the file can be prevented from being leaked to others.

The above description is merely illustrative of the technical idea of the present invention, and those of ordinary skill in the art to which the present invention pertains will be able to make various modifications and variations without departing from the essential characteristics of the present invention. Accordingly, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain the technical idea, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be interpreted as being included in the scope of the present invention.

100: Data file malware detection server
110: communication module
120: memory
130: processor
140: database

Claims (8)

In a method of detecting a malicious code of a data file by a data file malicious code detection server,
Receiving a data file encrypted by a homomorphic encryption technique based on a first encryption key previously designated by a user from a client device;
Comparing the encrypted data file with a signature file previously stored in a database and set based on a command of a malicious code encrypted using a homogeneous encryption technique; And
And transmitting the comparison result encrypted with the homomorphic encryption technique calculated by the comparing step to the client device,
The comparison result indicates whether the data file is infected with a malicious code,
The comparing step,
Performing an exclusive OR operation on the bit string of the encrypted data file and the bit string of the encrypted malicious code signature file; And
A method of detecting a malicious code in a data file comprising the step of performing an OR operation on the result of the exclusive OR operation. The method of claim 1,
The encrypted comparison result is decrypted on the client device based on a first encryption key. delete delete In the server for detecting malicious codes in data files,
A memory in which a program for detecting malicious codes in data files is stored; And
And a processor that executes a program stored in the memory,
According to the execution of the program, the processor,
Receives a data file encrypted by the homogeneous encryption technique based on the first encryption key previously designated by the user from the client device, and executes the command of the malicious code that is previously stored in the database and encrypted by the homozygous encryption technique. Compared with the signature file set as a basis, and transmits a comparison result encrypted with the homomorphic encryption method calculated by the comparison to the client device,
The comparison result indicates whether the data file is infected with a malicious code, and the comparison is an exclusive OR operation on the bit string of the encrypted data file and the bit string of the encrypted malicious code signature file, and the exclusive OR operation Malware detection server for data files that logically sums the results. The method of claim 5,
The encrypted comparison result is decrypted based on the first encryption key on the client device, the malicious code detection server of the data file. delete delete

Images