KR102156340B1 - Method and apparatus for blocking web page attack - Google Patents

Abstract

The disclosed method for blocking attacks through web pages includes: loading a security library on a memory when the web browser is first executed; Library layer of memory by acquiring an attack detection module that performs an attack detection function from the security library when at least one of the internal command execution function, internal file browsing function, internal file modification function, memory creation function, or memory change function is called. Installing on; During web browsing, the attack detection module detects an attack that includes at least one of an internal command execution attack detection function, an internal file browsing attack detection function, an internal file tampering attack detection function, a memory creation attack detection function, or a memory change attack detection function. Performing a function; And blocking access to the web page where the attack is detected by the attack detection module. Therefore, a drive-by download attack that is automatically executed when a web browser of a mobile terminal that cannot apply technologies such as Active X or plug-in additionally installed in the web browser accesses a web page that causes malicious code through a vulnerability attack. There is an advantage of being able to detect and block attacks using web pages such as, etc. in real time.

Description

Web page attack blocking method and device {METHOD AND APPARATUS FOR BLOCKING WEB PAGE ATTACK}

The present invention relates to a web page attack blocking method and apparatus, and more particularly, to a web page attack blocking method and apparatus for detecting and blocking attacks using web pages such as drive-by download attacks. will be.

Recently, as mobile platforms equipped with mobile operating systems such as Android, i-OS (iPhone Operating System), and Windows Mobile have grown rapidly, the mobile market has changed and the web service and client access environment has changed significantly. Is taking place. Unlike the wired Internet environment where Windows-based web browsers were dominated in the past, the use of various mobile web browsers based on the WebKit engine has increased exponentially.

This change to the mobile environment has also affected the way attackers distribute malicious codes, one of which is a change in drive-by download attack technology that infects malicious codes only by accessing a website.

Since the mobile web browser has a different application operation structure and operating system environment than the existing PC environment, drive-by download attacks targeting PCs in the past are impossible. Accordingly, attackers use attack codes different from those of the existing PC environment. I am making an exploit that can be operated in.

Since the technology for blocking malicious behavior through a web browser according to the prior art focuses on drive-by download attacks targeting PCs in the past, there is a limitation that cannot be applied to the web browser of the newly changed mobile terminal platform.

The drive-by download attack blocking technologies according to the prior art are the first method of applying various protection technologies by changing the operating web browser and operating system environment, and secondly, a method of blocking the attack by detecting obfuscated web pages. , Thirdly, it can be classified into a method of applying technology for the purpose of collecting malicious codes.

However, the first method according to the prior art has a problem that it is not applicable in a mobile environment due to technical limitations applicable only in a general Windows PC environment, and there are problems that platform administrator rights of the mobile terminal are required to apply the technologies. .

Subsequently, the second method according to the prior art requires a separate obfuscation code pattern to detect whether or not it is obfuscated, and most of the attack codes distributed through the recently discovered web browser vulnerabilities are distributed without obfuscation. There are problems such as that detection is impossible.

The third method according to the prior art is applied to protect a mobile web browser with the least privilege, and has a problem such as a large difference in its purpose and function, and directly affects the operating system or communication performance during web browsing. .

Korean Patent Publication No. 1033932, registration date May 2, 2011. Korean Patent Publication No. 1027928, registration date April 1, 2011. Korean Registered Patent Publication No. 0915202, registration date August 26, 2009.

According to an embodiment of the present invention, when a web browser of a mobile terminal that cannot apply technologies such as activeX or a plug-in additionally installed in a web browser accesses a web page that causes malicious code through a vulnerability attack Provides a method and apparatus for blocking web page attacks that can detect and block attacks using web pages such as drive-by download attacks that are automatically executed in real time.

The problem to be solved of the present invention is not limited to those mentioned above, and another problem to be solved that is not mentioned will be clearly understood by those of ordinary skill in the art from the following description.

A web page attack blocking method according to an aspect of the present invention includes the steps of loading a security library on a memory when a web browser is first executed; When at least one of an internal command execution function, an internal file view function, an internal file modulation function, a memory creation function, or a memory change function is called, an attack detection module that performs an attack detection function is obtained from the security library, Installing on the library layer; During web browsing, the attack detection module includes at least one of an internal command execution attack detection function, an internal file browsing attack detection function, an internal file tampering attack detection function, a memory generation attack detection function, or a memory change attack detection function. Performing an attack detection function; It may include the step of blocking access to the web page where the attack is detected by the attack detection module.

In the web page attack blocking device according to another aspect of the present invention, when a web browser is first executed, a security library is loaded on a memory, and an internal command execution function, an internal file browsing function, an internal file modification function, a memory creation function, or a memory change An attack detector installation module for acquiring an attack detection module performing an attack detection function from the security library when at least one function among functions is called, and installing it in the library layer of the memory; When the at least one function is called during web browsing, at least one of an internal command execution detection function, an internal file browsing attack detection function, an internal file tampering attack detection function, a memory generation attack detection function, or a memory change attack detection function The attack detection module for performing the attack detection function including; It may include an attack blocking module for blocking access to a web page in which an attack is detected by the attack detection module.

According to an embodiment of the present invention, while supporting a mobile web browser environment as it is, an attack using a web page such as a drive-by download attack performed through a web browser vulnerability attack with minimal modification can be detected in real time.

In addition, even without applying a physical system change method such as replacing the native library of the system that requires administrator rights of the mobile terminal platform, an attack that spreads malicious code through the vulnerability of the web browser can be detected when accessing the web. .

In addition, the malicious code through the vulnerability of the web browser when accessing the web without a monitoring process that checks the contents of all data in the communication process and compares it with a separate code pattern to detect the attack code while causing performance degradation to detect malicious code. It can detect attacks that spread

Therefore, a drive-by download attack that is automatically executed when a web browser of a mobile terminal that cannot apply technologies such as Active X or plug-in additionally installed in the web browser accesses a web page that causes malicious code through a vulnerability attack. Attacks using web pages such as, etc. can be detected and blocked in real time.

Furthermore, a web that can respond to a variety of attacks targeting client mobile web browsers, such as providing secure access to obfuscated web pages, and a system for collecting real-time information on malicious code distribution sites and harmful websites. There is an effect that can be extended and implemented as an application technology in the security field.

1 is a block diagram of a web page attack blocking device capable of performing a web page attack blocking method according to an embodiment of the present invention.
2 is a flowchart illustrating a method of blocking a web page attack according to an embodiment of the present invention.
3 is a flowchart illustrating a process of detecting and blocking an attack when a function related to execution of a command is called in a method for blocking web page attacks according to an embodiment of the present invention.
4 is a flowchart illustrating a process of detecting and blocking an attack when a file browsing-related function is called in a method for blocking web page attacks according to an embodiment of the present invention.
5 is a flowchart illustrating an attack detection and blocking process when a memory related function is called in a web page attack blocking method according to an embodiment of the present invention.

Advantages and features of the present invention, and a method of achieving them will become apparent with reference to the embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in a variety of different forms, and only these embodiments make the disclosure of the present invention complete, and are common knowledge in the technical field to which the present invention pertains. It is provided to completely inform the scope of the invention to those who have, and the invention is only defined by the scope of the claims. The same reference numerals refer to the same components throughout the specification.

In describing the embodiments of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. In addition, terms to be described later are terms defined in consideration of functions in an embodiment of the present invention, which may vary according to the intention or custom of users or operators. Therefore, the definition should be made based on the contents throughout this specification.

1 is a block diagram of a web page attack blocking device capable of performing a web page attack blocking method according to an embodiment of the present invention.

As shown, the web page attack blocking device 100 according to the embodiment includes an attack detector installation module 110, an attack detection module 120, an attack blocking module 130, and the like.

When the web browser application is executed for the first time, the attack detector installation module 110 loads a security library in memory, and at least one of an internal command execution function, an internal file browsing function, an internal file modification function, a memory creation function, or a memory change function. When a function is called, the attack detection module 120 that performs an attack detection function is obtained from the loaded security library and installed in the library layer of the memory.

When the attack detection module 110 is installed in the library layer of the memory, the attack detector installation module 110 includes an internal command execution function, an internal file browsing function, and an internal function included in the basic library loaded on the memory of the web browser processor. A web browser initialization routine code is added so that the attack detection module 120 is called when the function is called by modifying the code of at least one function among the file modulation function, the memory generation function, and the memory change function.

The attack detection module 120 is installed in the library layer of the memory by the attack detector installation module 110 when the web browser application is first executed, and an internal command execution function, an internal file browsing function, and an internal file modification function during web browsing. , At least one of an internal command execution detection function, an internal file browsing attack detection function, an internal file tampering attack detection function, a memory generation attack detection function, or a memory change attack detection function when at least one of the memory creation function or memory change function is called. It performs an attack detection function including any one function.

When the internal command execution function is called, the attack detection module 120 checks whether it is a library execution function or a system call execution function, and if a library execution function is a library execution function, it determines the calling function information and parameter information, and the result of the test. If it is a system call execution function according to, parameter information is identified. In addition, the attack detection module 120 provides the identified calling function information and/or factor information to the attack blocking module 130 so that it can be recorded, displayed, or transmitted in the blocking content log.

In addition, when the internal file browsing function or the internal file falsifying function is called, the attack detection module 120 checks whether the path factor of the called function exists in the pre-stored white list, and the path factor of the called function is present in the white list. Otherwise, it is judged as a web page attack.

In addition, when the memory creation function or the memory change function is called, the attack detection module 120 checks whether all read, write, and execution rights are included, and if all read, write, and execution rights are included, it is determined as a web page attack.

The attack blocking module 130 blocks access to a web page in which an attack is detected by the attack detection module 120, and records or displays the web page blocking content as a log to notify the user or transmit it to a collection server.

2 is a flowchart illustrating a method of blocking a web page attack according to an embodiment of the present invention.

As shown, the web page attack blocking method according to the embodiment includes the steps of loading a security library on a memory when the web browser application is first executed (S201 to S205).

Subsequently, an attack detection module that performs an attack detection function is obtained from the security library loaded when at least one of the internal command execution function, internal file browsing function, internal file modification function, memory creation function, or memory change function is called. It further includes installing in the library layer of the memory (S207).

In addition, during web browsing, the attack detection module includes at least one of an internal command execution attack detection function, an internal file browsing attack detection function, an internal file tampering attack detection function, a memory generation attack detection function, or a memory change attack detection function. It further includes a step (S209) of performing an attack detection function.

In addition, it further includes steps (S211 to S217) of blocking or allowing access to the web page according to the detection result of the web page attack by the attack detection module.

3 is a flowchart illustrating a process of detecting and blocking an attack when a function related to execution of a command is called in a method for blocking web page attacks according to an embodiment of the present invention.

As shown, the web page attack blocking method according to the embodiment includes the steps of checking whether the internal command execution function is called during function call monitoring (S301 to S305).

Subsequently, if the function is a library execution function according to the result of the function check, the step (S307) of determining call function information and parameter information is further included.

And, according to the result of the function check, if the function is a system call execution function, it further includes a step (S309) of determining factor information.

In addition, it further includes a step (S311) of blocking access to the web page that called the internal command execution function.

Further, it further includes a step (S313) of recording, displaying, or transmitting a blocking content log including the identified calling function information or factor information.

4 is a flowchart illustrating a process of detecting and blocking an attack when a file browsing-related function is called in a method for blocking web page attacks according to an embodiment of the present invention.

As shown, in the method for blocking web page attacks according to the embodiment, when an internal file browsing function or an internal file altering function is called during function call monitoring, the step of checking whether the path argument of the called function exists in a pre-stored white list ( S401 to S407).

And, if the path argument of the called function does not exist in the white list, it is determined as a web page attack, and the access to the web page is blocked, and if it exists in the white list, the steps of allowing access to the web page (S409 to S413) are further included. .

5 is a flowchart illustrating an attack detection and blocking process when a memory related function is called in a web page attack blocking method according to an embodiment of the present invention.

As shown, the web page attack blocking method according to the embodiment includes the steps (S501 to S505) of checking whether all read, write, and execution rights are included when a memory creation function or a memory change function is called during function call monitoring. do.

In addition, if all of the read, write, and execution rights are included, the access to the web page is determined as a web page attack, and if all rights are not included, the steps of allowing access to the web page (S507 to S511) are further included.

Hereinafter, a web page attack blocking method performed by the web page attack blocking device according to an embodiment of the present invention will be described in more detail with reference to FIGS. 1 to 5.

There are various types of web page attack methods such as drive-by download attacks targeting mobile terminals, but most of them are caused by design flaws (or weaknesses) in browsers. Typical attacks due to design flaws include arbitrary shellcode execution attacks due to design flaws in the memory handling process and system internal command execution attacks due to design flaws in the function implementation process. Web page attack methods including such arbitrary shell code execution attacks and system internal command execution attacks have a common point of executing by calling a function of a native library, and in the embodiment of the present invention, various It enables real-time detection and blocking of web page attacks.

First, with reference to FIGS. 1 and 2, an overall attack detection and blocking process by a web page attack blocking method according to an embodiment of the present invention will be described.

A web browser application modified to include a security library is distributed to mobile terminals, and when the deployed web browser application is first executed on the mobile terminal, the attack detector installation module 110 is executed, and the security library is stored in the memory. Load. Here, in order to distinguish between a web browser modified to include a security library and a web browser pre-installed in the mobile terminal according to an embodiment of the present invention, it is referred to as "web browser application", but these may be collectively referred to as "web browser" (S201 To S205).

Subsequently, an attack detection module 120 that performs an attack detection function from the loaded security library when at least one of an internal command execution function, an internal file browsing function, an internal file modification function, a memory generation function, or a memory change function is called. Is acquired and installed in the library layer of the memory (S207).

In this way, when the attack detection module 120 is installed in the library layer, an internal command execution function, an internal file browsing function, an internal file modification function, a memory creation function, or a memory change included in the basic library loaded on the memory of the web browser processor A web browser initialization routine code is added so that the attack detection module 120 is called when the function is called by modifying the code of at least one of the functions. In other words, it goes through the process of patching the code of each API function so that attackers can correctly detect the attack according to the type of exploitation.

At this time, to detect internal command execution, the code of each command execution function existing in the library is modified and the code entering the command execution system call is removed. In addition, in order to effectively detect information leakage and file tampering attacks by an attacker, the code of the file browsing function is modified so that both types of attacks, such as internal file browsing and internal file tampering, can be inspected. In addition, in order to effectively detect a memory tampering attack of a web browser, the code of the memory creation function and the memory change function is found and modified.

Then, the attack detection module 120 installed in the library layer of the memory is called when at least one of an internal command execution function, an internal file browsing function, an internal file modification function, a memory generation function, or a memory change function is called during web browsing. It performs an attack detection function including at least one of an internal command execution detection function, an internal file browsing attack detection function, an internal file tampering attack detection function, a memory generation attack detection function, or a memory change attack detection function (S209). ).

Next, when a web page attack is detected by the attack detection module 120, the attack blocking module 130 blocks access to the web page according to the attack detection result (S213), and records the blocked content as a log or is recognized by the user. It is displayed so that it can be done or transmitted to a preset external server (S215). However, if a web page attack is not detected by the attack detection module 120, the attack blocking module 130 allows access to the web page (S217).

A process of detecting and blocking an attack when a function related to execution of a command is called in the web page attack blocking method according to an embodiment will be described with reference to FIGS. 1 and 3.

When an instruction execution-related function such as an internal instruction execution function is called during function call monitoring, the attack detection module 120 checks whether it is a library execution function or a system call execution function (S301 to S305).

Subsequently, the attack detection module 120 determines the calling function information and argument information if it is a library execution function according to the result of the function check in step S305, and provides the identified calling function information and argument information to the attack blocking module 130 Do (S307).

Then, the attack detection module 120 detects factor information if it is a system call execution function according to the result of the function check in step S305, and provides the identified factor information to the attack blocking module 130 (S309).

Here, the different processing of the delivery information through steps S307 and S309 is to distinguish the type of actual drive-by download attack, and to make it easy to grasp at which layer the attack started.

Next, the attack blocking module 130 blocks access to the web page that called the internal command execution function (S311), and logs the blocking content including calling function information or argument information identified and transmitted through step S307 or S309. Is recorded, displayed so that the user can recognize it, or transmitted to a preset external server (S313).

A process of detecting and blocking an attack when a file browsing-related function is called in a web page attack blocking method according to an embodiment will be described with reference to FIGS. 1 and 4.

The attack detection module 120 checks whether a path factor of the called function exists in a pre-stored white list when a file browsing-related function such as an internal file browsing function or an internal file falsifying function is called during function call monitoring (S401 to S407). Here, it is determined whether the file is read or the file is written, and it is possible to check whether it exists in the read white list or the write white list according to the determination result.

In addition, if the path factor of the called function does not exist in the white list, the attack detection module 120 determines that it is a web page attack and transmits the path factor to the attack blocking module 130.

Then, the attack blocking module 130 blocks access to the web page if it is determined that the attack detection module 120 attacks the web page (S409), records the blocking content log, or displays the block so that the user can recognize it. It is transmitted to a preset external server (S411). However, if the path argument of the called function exists in the white list, web page access and normal file browsing are allowed (S413).

A process of detecting and blocking an attack when a memory-related function is called in a web page attack blocking method according to an embodiment will be described with reference to FIGS. 1 and 5.

If the memory creation function or the memory change function is called during the function call monitoring, the attack detection module 120 checks whether all read, write, and execution rights are included (S501 to S505). Here, the authority check may be performed after first discriminating whether a memory is created or a memory is changed.

In addition, the attack detection module 120 determines that a web page attack when all read, write, and execution rights are included and transmits a factor to the attack blocking module 130. This is based on the inference that permissions including read, write, and execute permissions are not necessary for a normal web browser.

Then, the attack blocking module 130 blocks access to the web page if it is determined that the attack detection module 120 attacks the web page (S507), and records the blocking content log or displays it so that the user can recognize it. It is transmitted to a preset external server (S509). However, if all read, write, and execution rights are not included, access to the web page and normal memory-related function calls are allowed (S511).

As described so far, according to the embodiment of the present invention, while supporting the mobile web browser environment as it is, it is possible to detect in real time an attack using a web page such as a drive-by download attack performed through a web browser vulnerability attack with minimal modification. I can.

In addition, even without applying a physical system change method such as replacing the native library of the system that requires administrator rights of the mobile terminal platform, an attack that spreads malicious code through the vulnerability of the web browser can be detected when accessing the web. .

In addition, the malicious code through the vulnerability of the web browser when accessing the web without a monitoring process that checks the contents of all data in the communication process and compares it with a separate code pattern to detect the attack code while causing performance degradation to detect malicious code. It can detect attacks that spread

Therefore, a drive-by download attack that is automatically executed when a web browser of a mobile terminal that cannot apply technologies such as Active X or plug-in additionally installed in the web browser accesses a web page that causes malicious code through a vulnerability attack. Attacks using web pages such as, etc. can be detected and blocked in real time.

Combinations of each block in the block diagram attached to the present invention and each step in the flowchart may be performed by computer program instructions. Since these computer program instructions can be mounted on the processor of a general purpose computer, special purpose computer, or other programmable data processing equipment, the instructions executed by the processor of the computer or other programmable data processing equipment are shown in each block or flowchart of the block diagram. Each step creates a means to perform the functions described. These computer program instructions can also be stored in computer-usable or computer-readable memory that can be directed to a computer or other programmable data processing equipment to implement a function in a particular way, so that the computer-usable or computer-readable memory It is also possible to produce an article of manufacture in which the instructions stored in the block diagram contain instruction means for performing the functions described in each block or flow chart. Computer program instructions can also be mounted on a computer or other programmable data processing equipment, so a series of operating steps are performed on a computer or other programmable data processing equipment to create a computer-executable process to create a computer or other programmable data processing equipment. It is also possible for the instructions to perform the processing equipment to provide steps for performing the functions described in each block of the block diagram and each step of the flowchart.

In addition, each block or each step may represent a module, segment, or part of code comprising one or more executable instructions for executing the specified logical function(s). In addition, it should be noted that in some alternative embodiments, functions mentioned in blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially simultaneously, or the blocks or steps may sometimes be performed in the reverse order depending on the corresponding function.

The above description is merely illustrative of the technical idea of the present invention, and those of ordinary skill in the art to which the present invention pertains will be able to make various modifications and variations without departing from the essential characteristics of the present invention. Accordingly, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain the technical idea, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

According to an embodiment of the present invention, it is automatically executed when a web browser of a mobile terminal that cannot apply technologies such as Active X or a plug-in additionally installed in the web browser accesses a web page that causes malicious code through a vulnerability attack. It can detect and block attacks using web pages such as drive-by download attacks in real time. Therefore, it can be used in various mobile communication devices and related technical fields such as a smart phone including a mobile web browser.

100: web page attack blocking device 110: attack detector installation module
120: attack detection module 130: attack blocking module

Claims (6)

As a method of blocking web page attacks by a web page attack blocking device,
Loading a security library on memory when the web browser is first executed;
When at least one of an internal command execution function, an internal file view function, an internal file modulation function, a memory generation function, or a memory change function is called, an attack detection module that performs an attack detection function is obtained from the security library, Installing on the library layer;
During web browsing, the attack detection module includes at least one of an internal command execution attack detection function, an internal file browsing attack detection function, an internal file tampering attack detection function, a memory generation attack detection function, and a memory change attack detection function. Performing an attack detection function; And
Blocking access to a web page where an attack is detected by the attack detection module,
Installing the attack detection module in the library layer,
Modify the code of the internal command execution function, remove the code entering the command execution system call, and modify the code of the internal file browsing function so that the internal file browsing attack type and the internal file tampering attack type can be checked. And modifying the memory creation function and the memory change function to detect a memory modification attack of the web browser. The method of claim 1,
The step of installing the attack detection module in the library layer includes the internal command execution function, the internal file browsing function, the internal file modification function, and the memory generation function included in a basic library loaded on a memory of a web browser processor. Or modifying a code of at least one function among the memory change functions, and adding a web browser initialization routine code so that the attack detection module is called when a corresponding function is called. The method of claim 1,
The step of performing the attack detection function,
If the internal command execution function is called, checking whether it is a library execution function or a system call execution function;
As a result of the inspection, if it is a library execution function, determining call function information and parameter information; And
If the test result is a system call execution function, further comprising the step of determining the factor information,
Blocking the access to the web page,
Blocking access to a web page that called the internal command execution function; And
And recording, displaying, or transmitting a blocking content log including the identified calling function information or the parameter information. The method of claim 1,
The step of performing the attack detection function,
When the internal file browsing function or the internal file modulation function is called, checking whether a path argument of the called function exists in a pre-stored white list;
And determining as a web page attack if the path argument of the called function does not exist in the white list. The method of claim 1,
The step of performing the attack detection function,
If the memory creation function or the memory change function is called, checking whether all of the read, write, and execution rights are included;
And determining that it is a web page attack if all of the read, write, and execution rights are included. When the web browser is executed for the first time, the security library is loaded into memory, and when at least one of an internal command execution function, an internal file view function, an internal file modification function, a memory creation function, or a memory change function is called, from the security library. An attack detector installation module acquiring an attack detection module performing an attack detection function and installing it in the library layer of the memory;
When the at least one function is called during web browsing, at least one of an internal command execution detection function, an internal file browsing attack detection function, an internal file tampering attack detection function, a memory generation attack detection function, or a memory change attack detection function The attack detection module for performing the attack detection function including; And
An attack blocking module that blocks access to a web page where an attack is detected by the attack detection module,
The attack detector installation module,
Modify the code of the internal command execution function, remove the code entering the command execution system call, and modify the code of the internal file browsing function so that the internal file browsing attack type and the internal file tampering attack type can be checked. A web page attack blocking device that performs a task, and performs a task of modifying the memory creation function and the memory change function to detect a memory tampering attack of the web browser.

Images