KR102210659B1 - Game theory based dynamic analysis input system and method for intelligent malicious app detection - Google Patents

Abstract

The present invention relates to a dynamic analysis input system for detecting a malicious app, comprising: a user input data storage unit for storing at least one user input data for a malicious app and a preference value assigned to the user input data; A user input generator for generating a user input to be provided to the malicious app based on the stored user input data to minimize a maximum value of the payoff of the malicious app based on game theory; And a user input delivery unit for transferring the generated user input to the malicious app.

Description

Game theory-based dynamic analysis input system and method for intelligent malicious app detection {GAME THEORY BASED DYNAMIC ANALYSIS INPUT SYSTEM AND METHOD FOR INTELLIGENT MALICIOUS APP DETECTION}

The present invention relates to a dynamic analysis input system and method based on game theory for detecting intelligent malicious apps.

Existing malicious apps running on Android smartphones are classified as basic malicious apps that perform malicious actions when user input is given, and evasive malicious apps that determine whether or not malicious actions are based on the operation of the emulator-based dynamic analysis input system. In addition, conventional malicious app detection techniques are being studied focusing on detection of basic malicious apps and evasive malicious apps. However, the above technique has the following problems.

Assuming that an attacker creates an intelligent malicious app that intelligently controls malicious behavior, such an intelligent malicious app does not perform malicious behavior if it determines that the dynamic analysis input system operates through intelligent judgment on user input values. However, if it is determined that it does not work, it performs malicious actions, so it is difficult to detect intelligent malicious apps with conventional malicious app detection techniques.

Embodiments of the present invention are proposed to solve the above problems, and prevent malicious apps from grasping the operation of the dynamic analysis input system, thereby increasing the possibility of detecting malicious apps due to an increase in the number of malicious actions. It is intended to provide a dynamic analysis input system and method for app detection.

A dynamic analysis input system for detecting a malicious app according to an embodiment of the present invention includes: a user input data storage unit for storing at least one user input data for a malicious app and a preference value assigned to the user input data; A user input generator for generating a user input to be provided to the malicious app based on the stored user input data to minimize a maximum value of the payoff of the malicious app based on game theory; And a user input delivery unit for transferring the generated user input to the malicious app.

In addition, in the dynamic analysis input system for detecting malicious apps according to an embodiment of the present invention, the preference value given to the user input data may be determined according to the frequency of use of the corresponding user input data.

In addition, in the dynamic analysis input system for detecting malicious apps according to an embodiment of the present invention, the malicious app is installed in a normal world under a trusted execution environment, and the dynamic analysis input system is installed in the normal world under a trusted execution environment. It is provided in a secure world separate from the realm.

In addition, in the dynamic analysis input system for detecting malicious apps according to an embodiment of the present invention, when the user input generator receives a non-maskable interrupt signal from the general area, the stored user input data is As a result, a user input to be provided to the malicious app can be generated.

In addition, in the dynamic analysis input system for detecting malicious apps according to an embodiment of the present invention, the malicious app knows in advance the preference value given to the user input data, and is malicious based on the Sequential Probability Ratio Test (SPRT). Determine whether to perform an action, but if the preference value of the user input received from the dynamic analysis input system is less than or equal to the input preference threshold, the SPRT adopts the zero hypothesis (H ₀ ) to perform the malicious action, When the preference value of the user input received from the dynamic analysis input system is greater than the input preference threshold value, the SPRT adopts an alternative hypothesis (H ₁ ) to perform a normal behavior.

In addition, in the dynamic analysis input system for detecting malicious apps according to an embodiment of the present invention, the malicious app may update the input preference threshold every time the user input is received from the dynamic analysis input system.

In addition, in the dynamic analysis input system for detecting malicious apps according to an embodiment of the present invention, the user input generation unit assumes the malicious app and the user input generation unit as first and second players, respectively, and the first and second players. In a minimax game model between players, one of at least one user input is selected according to a Nash Equilibrium condition in which the second player minimizes the maximum value of the payoff of the first player.

In addition, in the dynamic analysis input system for detecting malicious apps according to an embodiment of the present invention, the user input generation unit uniformly and randomly selects one of k different user inputs, where k is greater than 1 It is a natural number like or.

The dynamic analysis input method for detecting a malicious app according to an embodiment of the present invention is provided to the malicious app based on pre-stored user input data to minimize the maximum value of the payoff of the malicious app based on game theory. Generating a user input to be performed; And transmitting the generated user input to the malicious app.

In addition, in the step of generating a user input in the dynamic analysis input method for detecting a malicious app according to an embodiment of the present invention, the first and second players are assumed to be the first and second players, respectively. Selecting one of at least one user input according to a Nash Equilibrium condition in which the second player minimizes the maximum value of the payoff of the first player in a Minimax game model between second players Includes.

In addition, the step of generating a user input in the dynamic analysis input method for detecting a malicious app according to an embodiment of the present invention includes the step of uniformly and randomly selecting one of k different user inputs, Where k is a natural number greater than or equal to 1.

In addition, in the computer-readable recording medium, the present invention may include a recording medium in which a program for executing a dynamic analysis input method for detecting malicious apps with a computer is recorded.

The dynamic analysis input system for detecting malicious apps according to embodiments of the present invention prevents malicious apps from grasping the operation of the dynamic analysis input system, thereby increasing the possibility of detecting malicious apps due to an increase in the number of malicious actions.

1 is a conceptual diagram of a trusted execution environment system according to an embodiment of the present invention.
2 is a block diagram of a trusted execution environment system including a dynamic analysis input system according to an embodiment of the present invention.
3 is a view showing the operating principle of the dynamic analysis input system according to an embodiment of the present invention.
4 is a diagram showing the operating principle of an intelligent malicious app according to an embodiment of the present invention.
5 is a diagram for describing an operation of a user input generator according to an embodiment of the present invention.

Other advantages and features of the present invention, and a method of achieving them will become apparent with reference to embodiments to be described later in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only this embodiment is intended to complete the disclosure of the present invention, and to provide ordinary knowledge in the technical field to which the present invention belongs. It is provided to completely inform the scope of the invention to those who have it, and the invention is only defined by the scope of the claims.

Even if not defined, all terms (including technical or scientific terms) used herein have the same meaning as commonly accepted by universal technology in the prior art to which this invention belongs. Terms defined by general dictionaries may be construed as having the same meaning as the related description and/or the text of this application, and not conceptualized or excessively formalized, even if not clearly defined herein. Won't.

The terms used in the present specification are for describing exemplary embodiments and are not intended to limit the present invention. In this specification, the singular form also includes the plural form unless specifically stated in the phrase. As used in the specification,'includes' and/or various conjugated forms of this verb, for example,'includes','includes','includes','includes', etc. refer to the mentioned composition, ingredient, component, Steps, operations and/or elements do not preclude the presence or addition of one or more other compositions, components, components, steps, operations and/or elements. In the present specification, the term'and/or' refers to each of the listed components or various combinations thereof.

Meanwhile, terms such as'~ unit','~ group','~ block', and'~ module' used throughout this specification may refer to a unit that processes at least one function or operation. For example, it can mean software, hardware components such as FPGAs or ASICs. However,'~bu','~gi','~block', and'~module' are not limited to software or hardware. The'~ unit','~ group','~ block', and'~ module' may be configured to be in an addressable storage medium, or may be configured to reproduce one or more processors.

Therefore, as an example,'~ unit','~ group','~ block', and'~ module' are components such as software components, object-oriented software components, class components, and task components. S, processes, functions, properties, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays and Include variables. The functions provided in the components and'~Boo','~Gi','~Block', and'~Module' include a smaller number of elements and'~Boo','~Gi','~Block. It may be combined into','~modules' or further separated into additional components and'~unit','~group','~block', and'~module'.

1 is a conceptual diagram of a trusted execution environment system according to an embodiment of the present invention.

Hereinafter, the trusted execution environment system referred to in this specification will be described based on the ARM TrustZone technology of ARM Corporation, but the trusted execution environment system is not limited to the technology.

Referring to FIG. 1, in a trusted execution environment, one physical processor core can be divided into a secure world and a normal world, and each area has a separate CPU register, and only in the secure area. You can designate accessible devices or memory areas.

In addition, the trusted execution environment can divide the interrupt into a secure area and a non-secure area. When the current interrupt is a security area, an interrupt does not occur in a non-secure area, and when the interrupt is a non-secure area, an interrupt can occur in the non-secure area and the security area.

Accordingly, a system including a secure area and a non-secure area based on a trusted execution environment can isolate CPU, address space, memory, and device for each area.

In addition, the trusted execution environment can add a monitor mode to the existing FIQ, IRQ, Abort, Undefined, Kernel, and User in a separate CPU mode, and the monitor mode exists only in the security area.

Here, entering the monitor mode is to access the security zone, and the access to the monitor mode is established when the SMC (Secure Monitor Call) command is executed or when IRQ and FIQ occur.

Also, since the SMC command can be executed only in kernel mode, it is not possible to switch between regions at the application level.

In summary, one area cannot affect another area, and the non-security area cannot interfere with the execution of the security area even if an interrupt or device is used. Therefore, in general, programs that require high reliability for safe protection from rootkits are executed in a secure area, and other programs are executed in a non-security area.

2 is a block diagram of a trusted execution environment system including a dynamic analysis input system according to an embodiment of the present invention.

Referring to FIG. 2, the trusted execution environment system 10 consists of a normal area and a secure world, and the normal area is a malicious app 100, an interrupt output unit 200, and a user input receiving unit. 300, and the security domain includes the dynamic analysis input system 400.

The malicious app 100 knows the preference value assigned to the user input data stored by the dynamic analysis input system 400, and determines whether to perform a malicious action based on the Sequential Probability Ratio Test (SPRT).

The interrupt output unit 200 may generate a non-maskable interrupt signal by a user and transmit it to the dynamic analysis input system 400.

The unmaskable interrupt is generally generated to alert the environment to an unrecoverable hardware error, and is used for communication between the normal domain and the security domain under the trusted execution environment system 10 operated independently of each other. A signal capable of secure communication between security areas is not limited thereto.

The user input receiving unit 300 may receive a user input from the dynamic analysis input system 400 and transmit the user input to the malicious app 100.

Referring back to FIG. 2, the dynamic analysis input system 400 may include a user input data storage unit 410, a user input generation unit 420, and a user input transmission unit 430.

The dynamic analysis input system 400 collects a plurality of user input data of various types for the malicious app 100 to be scanned, and then analyzes it using a static analysis technique and a deep learning technique.

In addition, the dynamic analysis input system 400 may assign a preference value for each user input data in consideration of various factors such as frequency of use and accessibility.

According to an embodiment of the present invention, a preference value assigned to user input data is determined according to a frequency of use of the user input data.

Specifically, the preference value given to the user input data is higher as it is user input data with a high frequency of use or data directly input by the user, and decreases as it is determined that it is user input data with a low frequency of use or data incorrectly input by the user.

Also, the preference value assigned to the user input data may be selected as one of natural numbers from 1 to 10.

The user input data storage unit 410 may store at least one user input data for the malicious app 100 and a preference value assigned to the user input data.

The user input generator 420 generates a user input to be provided to the malicious app 100 based on stored user input data to minimize the maximum value of the payoff of the malicious app 100 based on the game theory.

Also, the user input generator 420 may receive a non-maskable interrupt signal from a general area.

In addition, the user input generation unit 420 assumes that the malicious app 100 and the user input generation unit 420 are the first and second players, respectively, in the Minimax game model between the first and second players. One of at least one user input is selected according to a Nash Equilibrium condition in which the second player minimizes the maximum value of the payoff of the first player.

Also, the user input generator 420 may uniformly and randomly select one of k different user inputs, where k is a natural number.

The user input transmission unit 430 may transmit the generated user input to the malicious app 100.

3 is a view showing the operating principle of the dynamic analysis input system according to an embodiment of the present invention, Figure 4 is a view showing the operating principle of an intelligent malicious app according to an embodiment of the present invention, and Figure 5 is the present invention A diagram for describing an operation of a user input generator according to an embodiment of

As shown in FIG. 3, the dynamic analysis input method for detecting the malicious app 100 of the dynamic analysis input system 400 includes at least one user input data for the malicious app 100 and a preference given to the user input data. Storing the value (S100), when receiving a non-maskable interrupt signal from the normal world, minimizes the maximum value of the payoff of the malicious app 100 based on the game theory Generating a user input to be provided to the malicious app 100 based on the stored user input data (S200), and transmitting the generated user input to the malicious app 100 (S300).

Referring to FIG. 4, a method of determining whether the malicious app 100 detects malicious behavior is as follows.

The malicious app 100 updates the input preference threshold every time a user input is received from the dynamic analysis input system 400 (S10).

In addition, the malicious app 100 may receive a user input and determine an input preference threshold within a range in which the dynamic analysis input system 400 does not readily recognize malicious behavior based on the preference value of the user input.

In addition, the malicious app 100 determines whether the preference value of the user input transmitted from the dynamic analysis input system 400 is less than or equal to the input preference threshold (S20).

At this time, if the user preference value is less than or equal to the input preference threshold, SPRT adopts the zero hypothesis (H ₀ ) to perform malicious behavior (S30), and if the preference value of the user input is greater than the input preference threshold, SPRT Adopt the alternative hypothesis (H ₁ ) and perform the normal behavior (S40).

Referring to FIG. 5, a method of processing a user input for detecting a malicious app 100 by the user input generating unit 420 based on a game theory will be described below.

As shown in FIG. 3, after k (k is a natural number) different user inputs are generated in the step of generating a user input (S200), the step of generating the user input (S200) includes a user input generating unit 420 assumes that the malicious app 100 and the user input generator 420 are the first and second players, respectively, and the payoff of the first player in the Minimax game model between the first and second players. And selecting one of at least one user input according to a Nash Equilibrium condition in which the second player minimizes the maximum value (S210).

In addition, the step of generating the user input (S200) includes a step (S220) of uniformly and randomly selecting one of the k different user inputs by the user input generator 420.

)는 엔트로피(entropy)를 이용하여 다음과 같이 정의된다.In addition, assuming that the number of different user inputs is k, according to the Nash balance condition, the payoff of the final malicious app 100 minimized (

) Is defined as follows using entropy.

는 악성앱(100)에서 동작하는 SPRT가 영 가설(H₀)을 채택하였을 때 악성앱(100)의 페이오프의 값이고,

는 악성앱(100)에서 SPRT가 대립 가설(H₁)을 채택하였을 때 악성앱(100)의 페이오프의 값이며,

는 임의의 값으로 설정되고,

은 악성앱(100)에서 동작하는 SPRT가 결정에 도달하지 않고 진행중일 때 악성앱(100)의 페이오프의 값이다.here,

Is the value of the payoff of the malicious app 100 when the SPRT operating in the malicious app 100 adopts the zero hypothesis (H ₀ ),

Is the value of the payoff of the malicious app 100 when the SPRT adopts the confrontational hypothesis (H ₁ ) in the malicious app 100,

Is set to an arbitrary value,

Is a value of the payoff of the malicious app 100 when the SPRT operating in the malicious app 100 is in progress without reaching a decision.

는 SPRT에서 false negative rate이고,

은 H₀ 조건하에서 SPRT 결정을 위한 평균 샘플의 개수,

은 H₁ 조건하에서 SPRT 결정을 위한 평균 샘플의 개수를 나타낸다.Also,

Is the false negative rate in SPRT,

Is the average number of samples for SPRT determination under H ₀ condition,

Represents the average number of samples for SPRT determination under the H ₁ condition.

는 악성앱(100)의 입력 선호도 임계값 설정 전략이고,

는 사용자 입력 생성부(420)가 악성앱(100)에게 제공하는 사용자 입력 선택 전략이다.Also,

Is the input preference threshold setting strategy of the malicious app 100,

Is a user input selection strategy provided by the user input generator 420 to the malicious app 100.

In other words, the user input generator 420 uniformly and randomly selects one input from k different user inputs under the Nash balance condition and provides it to the malicious app 100, and the malicious app 100 An evenly and randomly selected input preference among the input preferences is determined as the input preference threshold.

Accordingly, the malicious app 100 receives an evenly and randomly selected user input from the user input generator 420 under the Nash balance condition, and updates the input preference uniformly and randomly selected from the input preferences to the input preference threshold. As a result, the operation of the user input dynamic analysis input system is not easily understood, and malicious behavior is performed, and evidence of malicious behavior increases with the increase in the number of malicious acts, and the malicious app 100 of the dynamic analysis input system 400 The possibility of detection is increased.

The dynamic analysis input method for detecting a malicious app according to an embodiment of the present invention may be produced as a program to be executed on a computer and stored in a computer-readable recording medium. The computer-readable recording medium includes all types of storage devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tapes, floppy disks, and optical data storage devices. In addition, the dynamic analysis input method for detecting a malicious app according to an embodiment of the present invention may be implemented as a computer program stored in a medium to be combined with a computer and executed.

The detailed description above is illustrative of the present invention. In addition, the above description shows and describes preferred embodiments of the present invention, and the present invention can be used in various other combinations, modifications, and environments. That is, changes or modifications may be made within the scope of the concept of the invention disclosed in the present specification, the scope equivalent to the disclosed contents, and/or the skill or knowledge of the art. The embodiment described above describes the best state for implementing the technical idea of the present invention, and various changes required in the specific application fields and uses of the present invention are possible. Therefore, the detailed description of the invention is not intended to limit the invention to the disclosed embodiment. In addition, the appended claims should be construed as including other embodiments.

100: malicious app
200: interrupt output
300: user input receiver
400: dynamic analysis input system
410: user input data storage unit
420: user input generator
430: user input transmission unit

Claims (12)

A user input data storage unit for storing at least one user input data for the malicious app and a preference value assigned to the user input data;
The user input to be provided to the malicious app is generated based on the stored user input data so as to minimize the maximum value of the payoff of the malicious app based on game theory, but generated under Nash Equilibrium conditions. a user input generator for uniformly and randomly selecting one of k (k is a natural number greater than or equal to 1) different user inputs; And
A dynamic analysis input system for detecting malicious apps, including a user input transmission unit for transferring the generated user input to the malicious app.
The method of claim 1,
A dynamic analysis input system for detecting malicious apps in which the preference value given to the user input data is determined according to the frequency of use of the user input data.
The method of claim 1,
The malicious app is installed in the normal world under a trusted execution environment,
The dynamic analysis input system is a dynamic analysis input system for detecting malicious apps provided in a secure world separated from the general area under a trusted execution environment.
The method of claim 3,
The user input generating unit:
When a non-maskable interrupt signal is received from the general area, a dynamic analysis input system for detecting a malicious app generates a user input to be provided to the malicious app based on the stored user input data.
The method of claim 1,
The malicious app is:
Knowing in advance the preference value assigned to the user input data,
Determine whether or not to perform malicious actions based on the Sequential Probability Ratio Test (SPRT),
If the preference value of the user input received from the dynamic analysis input system is less than or equal to the input preference threshold, the SPRT adopts the zero hypothesis (H ₀ ) to perform a malicious action,
When the preference value of the user input received from the dynamic analysis input system is greater than the input preference threshold, the SPRT adopts the confrontation hypothesis (H ₁ ) to detect a malicious app that performs normal behavior. .
The method of claim 5,
The malicious app is a dynamic analysis input system for detecting a malicious app to update the input preference threshold every time the user input is received from the dynamic analysis input system.
The method of claim 5,
The user input generating unit,
Assuming that the malicious app and the user input generator are the first and second players, respectively, in the Minimax game model between the first and second players, the maximum value of the payoff of the first player is determined by the second player. Dynamic analysis input system for detecting malicious apps that selects one of at least one user input according to the Nash Equilibrium condition minimized by.
delete The user input to be provided to the malicious app is generated based on pre-stored user input data to minimize the maximum value of the payoff of the malicious app based on the game theory, but under the condition of Nash Equilibrium, the generated k uniformly and randomly selecting one of different user inputs (k is a natural number greater than or equal to 1); And
Dynamic analysis input method for detecting a malicious app comprising the step of transmitting the generated user input to the malicious app.
The method of claim 9,
The step of generating the user input, but uniformly and randomly selecting one of the generated k (k is a natural number greater than or equal to 1) different user inputs under the Nash Equilibrium condition:
The second player minimizes the maximum value of the payoff of the first player in the Minimax game model between the first and second players, assuming that the malicious app and the user input generating unit are the first and second players, respectively. Dynamic analysis input method for detecting a malicious app, comprising the step of selecting one of at least one user input according to a Nash Equilibrium condition.
delete In a computer-readable recording medium,
A recording medium in which a program for executing the dynamic analysis input method for detecting malicious apps according to claim 9 with a computer is recorded.

Images