KR102222804B1 - System and method for analyzing alamalicious code based on blockchain - Google Patents

Abstract

The present invention discloses a malicious code analyzing system. More specifically, the present invention relates to a blockchain-based malicious code analyzing system for performing malicious code analysis by distributing a plurality of collected malicious code suspicious files to a plurality of nodes participating in a blockchain network. According to an embodiment of the present invention, by providing a blockchain network comprising a collection node which collects suspicious files, a storage node which provides suspicious files and distributes an analysis-completed malicious code analysis report, and an analysis node which analyzes the provided suspicious files, it is possible to build a malware analysis ecosystem in which multiple analysts participate, and to a method thereof. Accordingly, the system can solve the central storage operation problem of the conventional threat intelligence system, and respond more quickly to threats to important information assets by sharing threat information. By being organically connected to each other on the P2P network, there is an effect that the level of the security field can be further improved through collaboration between each node.

Description

Blockchain-based malware analysis system and method {SYSTEM AND METHOD FOR ANALYZING ALAMALICIOUS CODE BASED ON BLOCKCHAIN}

The present invention relates to a malicious code analysis system, and in particular, to a block chain-based malicious code analysis system and method for analyzing malicious code by distributing a plurality of collected malicious code suspicious files to a plurality of nodes participating in a blockchain network. About.

Recently, as malicious codes such as Ransomeware are indiscriminately distributed online through various channels, the damage of bona fide online users is increasing rapidly.

Malware refers to software designed to infiltrate and install a computer system without the user's knowledge, causing damage to the system, and illegally acquiring information. In order to cope with the threat of such malicious code, various malicious code analysis and detection studies are currently being actively conducted, but it is a reality that there are many limitations in responding to malicious codes that become more intelligent and sophisticated as time goes by.

Accordingly, there is a trend that a technology for preventing malicious code infection in advance is continuously required, and the necessity of a cyber threat intelligence system is emerging.

Conventionally, as cyber threat intelligence adopts a centralized management method that manages threat data such as malicious code samples from a central location, huge costs are incurred in operating storage.

According to Threat Intelligence market analysis data, the size of the global cyber threat intelligence market is estimated to be about $3.22 billion in 2016. However, the threat data collected through various methods and enormous input costs are being traded at high prices, so it is a market that cannot be entered by buyers with insufficient capital power.

Registered Patent Publication No. 10-1400680 (announcement date: 2014.05.29.)

The present invention was devised to solve the above-described problems, and the present invention solves the problems of purchasing power and entry barriers, and at the same time, system elements for each process from collection to storage of malicious codes determined through analysis are organically connected to each other. The task is to realize a new ecosystem in the field of malicious code analysis by discovering new threat information and sharing and rewarding the collected information through the blockchain.

In order to solve the above-described problem, the blockchain-based malware analysis system according to an embodiment of the present invention extracts one or more suspicious files detected through the mounted malicious code search bot, and connects the suspicious files to the blockchain network. A first node cluster including a plurality of collection nodes that are transmitted to and from a second node including a plurality of storage nodes that receive the suspicious file and transmit it to itself or a node belonging to the same node cluster through a distributed hashing procedure and store it distributedly. A third including a plurality of analysis nodes for receiving a suspicious file stored in any one of the cluster and the plurality of storage nodes, analyzing the malicious code, generating an analysis report for the analysis result, and transmitting the analysis report to the second node cluster. Including a node cluster, the second node cluster broadcasts the transmitted analysis report on the blockchain network, and stores the analysis report having a certain level of reliability or higher in the distributed ledger by consensus according to voting on the analysis report. I can.

The collection node includes a signature storage storing a plurality of signature data for selecting malicious codes, a vaccine unit that compares a plurality of commands included in a process with the signature data to determine the presence of a malicious code, and a malicious code by the vaccine unit. It includes a malicious code search bot that extracts one or more suspicious files from among the linked files checked for the existence of the code, and a suspicious file transmission unit that transmits the extracted suspicious files to the blockchain network. I can.

The collection node may further include a signature update unit that extracts and stores the malicious code defined in one or more reports recorded in the distributed ledger in the signature storage as signature data when a rating of a certain level or higher is received.

The storage node includes a suspicious file receiving unit receiving a suspicious file transmitted from the first node cluster, a distributed hashing unit generating a plurality of index data through hashing with reference to a distributed hash table for the received suspicious file, and the index It may include a distributed data storage for storing some of the suspicious files matched with data, and a data distribution unit for providing the index data to the third node cluster.

The storage node may include a transaction processing unit that, when a transaction for verifying a report is requested from the analysis node, performs voting and records it in the distributed ledger according to a consensus based on a delegated stake verification method.

The transaction processing unit may pay a cryptocurrency corresponding to a reward to a corresponding analysis node for an analysis report that has obtained consent of a certain level or higher.

The analysis node searches for a plurality of index data stored in the second node cluster, a data search unit receiving a matching original suspicious file through the selected index data, and analyzing the presence of malicious code in the received suspicious file. It may include an analysis unit providing an analysis tool, a work storage storing an analysis result by the analysis tool, and a report generation unit generating an analysis report on the malicious code existing in the suspicious file.

The analysis node may further include a transaction request unit for requesting a report transaction for mining the analysis report generated by the report generation unit from the second node cluster.

In addition, a block chain-based malicious code analysis method according to an embodiment of the present invention for solving the above-described problem is a block chain-based malicious code analysis method using first to third node clusters, wherein the first node cluster is a collection node. Extracting one or more suspicious files by driving the malicious code search bot mounted on the device, transmitting the suspicious files to the connected blockchain network, the second node cluster receives the suspicious files, and each suspicious file through a distributed hashing procedure Distributed and stored in a plurality of storage nodes, and a third node cluster receives a suspicious file stored in any one of the plurality of storage nodes by an analysis node, analyzes the malicious code, and generates an analysis report for the analysis result. And transmitting the analysis report to the second node cluster and broadcasting the analysis report transmitted by the second node cluster on the blockchain network, and an analysis report having a certain level of reliability or higher by consensus according to the result of voting on the analysis report. It may include the step of storing in the distributed ledger.

The first node cluster extracts one or more suspicious files by driving a malicious code search bot mounted on the collection node, and transmits the suspicious files to a connected blockchain network, in which a plurality of commands included in the process are transmitted to the malicious code. The step of determining whether a malicious code exists by comparing it with a plurality of signature data that selects, using a defined deep learning-based learning model among files connected to a process in which malicious code does not exist through a malicious code search bot. Steps to extract suspicious files. Transmitting the extracted suspicious file to the blockchain network, and when the malicious code defined in one or more reports recorded in the distributed ledger has a rating of a certain level or higher, the step of extracting and storing it as signature data may be further included. .

The step of receiving the suspicious file by the second node cluster and distributedly storing each suspicious file in a plurality of storage nodes through a distribution procedure includes: receiving a suspicious file transmitted from the first node cluster, the received suspicion Generating a plurality of index data through hashing with reference to a distributed hash table for a file, storing suspicious files matching the index data in each storage node, providing the index data to the third node cluster Step, when a transaction for report verification is requested from the analysis node, voting and recording in the distributed ledger according to the consensus based on the delegated proof-of-stake method, and for the analysis report that has obtained a certain level of consent, the corresponding analysis node It may include the step of paying a cryptocurrency corresponding to the reward.

The step of broadcasting the analysis report transmitted by the second node cluster on the blockchain network, and storing the analysis report having a certain level of reliability or higher in a distributed ledger by consensus according to the result of voting on the analysis report, Searching for a plurality of index data being published in a two-node cluster, receiving the matching original suspicious file through the selected index data, providing an analysis tool that analyzes the presence of malicious code in the received suspicious file, and the analysis tool Storing the analysis result by the method, generating an analysis report for the malicious code existing in the suspicious file, and requesting a report transaction for mining the generated analysis report to the second node cluster. I can.

According to an embodiment of the present invention, by providing a block chain network consisting of a collection node for collecting suspicious files, a storage node for providing the suspicious file and distributing the analyzed malicious code report, and an analysis node for analyzing the provided suspicious file, It is possible to build a malicious code analysis ecosystem in which a large number of analysts participate.

Accordingly, it is possible to solve the central storage operation problem of the conventional threat intelligence system, share threat information and respond to threats to important information assets more quickly, and through cooperation between each node by being organically connected to each other on the P2P network. There is an effect that can further improve the level of the security field.

1 is a diagram showing the overall structure of a block chain-based malicious code analysis system according to an embodiment of the present invention.
2 is a diagram showing the structure of a collection node of a block chain-based malicious code analysis system according to an embodiment of the present invention.
3 is a diagram showing the structure of a storage node of a block chain-based malicious code analysis system according to an embodiment of the present invention.
4 is a diagram showing the structure of an analysis node of a block chain-based malicious code analysis system according to an embodiment of the present invention.
5 is a diagram showing a method of analyzing a malicious code based on a block chain according to an embodiment of the present invention.
6 is a diagram illustrating the structure of a distributed ledger of a block chain-based malicious code analysis system according to an embodiment of the present invention.

When a part of the specification says that a certain component is "equipped" or "included", it means that other components may be further included rather than excluding other components unless otherwise stated. In addition, terms such as "...unit", "...node" and "...system" described in the specification refer to units that process one or more functions or operations. It means, and this may be implemented in hardware, software, or a combination of hardware and software.

In addition, in the present specification, the term "example" means serving as an illustration, example, or illustration, but the subject of the invention is not limited by such an example. In addition, "comprising", "having", "having" and other similar terms are used, but when used in the claims, "included" as an open transition word that does not exclude any additional or other elements. It may be used generically in a manner similar to the term "comprising".

The various techniques described herein may be implemented with hardware or software, or, where appropriate, with a combination of both. As used herein, terms such as "...unit", "...node" and "...system" are likewise a computer-related entity, i.e., hardware , It can be treated as a combination of hardware and software, software or equivalent to software at the time of execution. In addition, each function executed in the program of the present invention may be configured in a module unit, and may be recorded in one physical memory, or distributed between two or more memories and a recording medium.

In the following description, the term “blockchain-based malicious code analysis system” may be abbreviated as “malware analysis system” or “system” for convenience of description.

Hereinafter, a block chain-based malicious code analysis system and method according to an embodiment of the present invention will be described with reference to the drawings.

1 is a diagram showing the overall structure of a block chain-based malicious code analysis system according to an embodiment of the present invention.

Referring to FIG. 1, a block chain-based malware analysis system according to an embodiment of the present invention extracts one or more suspicious files detected through a mounted malicious code search bot, and connects the suspicious files to the blockchain network (1). The first node cluster 100 including a plurality of collecting nodes 110 that transmits to, receives a suspicious file and transmits each suspicious file to itself or a node belonging to the same node cluster through a distributed hashing procedure, and stores them in a distributed manner. By receiving a suspicious file stored in any one of the second node cluster 200 and the plurality of storage nodes 210 including the storage node 210 of, the malicious code is analyzed, and an analysis report for the analysis result is generated. The second node cluster 200 may include a third node cluster 300 including a plurality of analysis nodes 310 that transmits to the second node cluster 200, and in particular, the second node cluster 200 transmits the transmitted analysis report to the blockchain network. (1) It is broadcasted on the top, and the analysis report having a certain level of reliability or higher may be stored in the distributed ledger 230 by consensus according to the result of voting for the analysis report.

The first node cluster 100 may be composed of a plurality of collection nodes 110 participating in the blockchain network 1. The collection node 110 monitors the analysis result of the currently running program, that is, the process from the vaccine program running on itself or in a terminal connected to it on a P2P basis, and a file for a process that is likely to be a malicious code through artificial intelligence detection. May be collected and transmitted to the second node cluster 200.

In order to implement the above-described suspicious file collection function, the collection node 110 may be equipped with a malicious code search bot based on deep learning technology, and the malicious code search bot searches for a vaccine program in real time, and Suspicious files can be extracted accordingly.

This collection node 110 participates in the blockchain network 1, and a distributed application for performing the above-described functions can be installed and executed, and as a participant of the blockchain network 1, the chain code 120 can be owned. have.

The second node cluster 200 may be composed of a plurality of storage nodes 210 participating in the blockchain network 1. The storage node 210 receives and stores the suspicious file transmitted from the collection node 110 and provides it to the third node cluster 300 to create an environment so that analysts belonging to it can analyze the existence of malicious codes. Do it. In addition, when a malicious code is found, the storage node 210 receives the analysis result in the form of a report and broadcasts it to the blockchain network 1 to receive a vote from each node to evaluate the reliability, and Accordingly, information on the malicious code can be disclosed by recording the analysis report on the distributed ledger 230.

Here, as an analyst, not only a company specializing in malware analysis but also individuals may be included.

This storage node 210 participates in the blockchain network 1 and a distributed application for performing the above-described functions can be installed and executed, and as a participant in the blockchain network 1, the chain code 220 and the distributed ledger ( 230).

The third node cluster 300 may be composed of a plurality of analysis nodes 310 participating in the blockchain network 1. The analysis node 310 is driven by the analyst terminal, searches for and downloads a suspicious file stored in the storage node 210 to be analyzed, and the analyst may analyze the suspicious file through an analysis tool to determine whether or not a malicious code exists. At this time, if it is determined that the malicious code exists, the analysis node 310 generates an analysis report for the malicious code and requests a report transaction for registration to the distributed ledger 230 from the second node cluster 200. I can. Accordingly, the second node cluster 200 executes the chain code 220 and records the malicious code information in the distributed ledger 230 through verification according to voting, so that the malicious code information is disclosed.

This analysis node 310 can participate in the blockchain network 1 and install and execute a distributed application for performing the above-described functions, and can own the chain code 320 as a participant in the blockchain network 1. have.

According to the above-described structure, the blockchain-based malware analysis system according to the embodiment of the present invention is largely a participant of three types of blockchain networks, and the collection node detects files suspected of malicious behavior through vaccines, The storage node distributes and stores the file transmitted from the collection node, or publishes an analysis report and performs cryptocurrency compensation for the performance of the analysis node, and the analysis node consists of a malware analyst and the file uploaded to the storage node. By analyzing the data and uploading the transaction to the blockchain network, it is possible to build a malware analysis ecosystem platform.

Hereinafter, a collection node of a block chain-based malicious code analysis system according to an embodiment of the present invention will be described in detail with reference to the drawings.

2 is a diagram showing the structure of a collection node of a block chain-based malicious code analysis system according to an embodiment of the present invention. In the following description, each component constituting the collection node interlocks with the blockchain network, is implemented as a distributed application program executable by a microprocessor, and is recorded on a recording medium capable of reading and writing to be mounted on a terminal device connected to the collection node. I can. In addition, the storage node and the configuration unit of the distributed node to be described later may also be implemented in the form of a distributed application program and recorded in a recording medium.

Referring to FIG. 2, the collection node 110 of the block chain-based malware analysis system according to an embodiment of the present invention includes a signature storage 111 in which a plurality of signature data for selecting a malicious code is stored, and a plurality of pieces included in the process. Using the deep learning-based learning model defined among the files connected to the process in which the malicious code does not exist by the vaccine unit 112 and the vaccine unit 112 to determine whether or not a malicious code exists by comparing the command of The malicious code search bot 113 that extracts one or more suspicious files by doing so, the suspicious file transmission unit 114 that transmits the extracted suspicious files to the blockchain network, and the malicious codes defined in one or more reports recorded in the distributed ledger are scheduled. When the rating is higher than or equal to the level, the signature update unit 115 may be extracted and stored as signature data in the signature storage 111.

In detail, the signature storage 111 may store signature data used when a vaccine program monitoring a process running in the collection node 110 identifies a malicious code. Such signature data may be provided by the initial vaccine program operating side, and then updated by the vaccine program operating side or the signature update unit 115.

The vaccine unit 112 may detect a running process and check whether a known malicious code exists in the code. The vaccine unit 112 may check the existence of the malicious code by comparing the process code and the signature data with reference to the signature storage 111. In addition, the vaccine unit 112 may check whether a malicious code is included by examining an executable file stored in the collection node 110 in addition to the process.

As the vaccine unit 112, a known commercially available vaccine program (ex. V3, Naver vaccine, etc.) may be used, but is not limited thereto.

The malicious code search bot 113 searches for a file in real time by the anti-virus unit 112, uses a learning model derived by machine learning to check whether a code suspected of a malicious code is included, and Related files can be extracted as suspicious files.

The search range of the malicious code search bot 113 may be extended to not only terminal devices directly connected to the collection node 110 but also other terminal devices or Internet web pages connected to the terminal device through a predetermined network.

The suspicious file transmission unit 114 may transmit the suspicious file extracted by the malicious code search bot 113 to each storage node belonging to the second node cluster of the blockchain network. In this case, the procedure for transmission may be performed by executing the chaincode included in the collection node 110.

On the other hand, the collection node 110 according to the embodiment of the present invention downloads the malicious code defined in the analysis report published on the blockchain network 1 as signature data, so that the accuracy of the malicious code identification of the vaccine unit 112 Can be improved.

Hereinafter, a storage node of a block chain-based malicious code analysis system according to an embodiment of the present invention will be described in detail with reference to the drawings.

3 is a diagram showing the structure of a storage node of a block chain-based malicious code analysis system according to an embodiment of the present invention.

3, the storage node 210 of the block chain-based malicious code analysis system according to the embodiment, a suspicious file receiving unit 211 receiving a suspicious file transmitted from the first node cluster, with respect to the received suspicious file A distributed hashing unit 212 that generates a plurality of index data through hashing with reference to a distributed hash table, a distributed data storage 213 that stores suspicious files matching the index data, and provides index data to a third node cluster. The data distribution unit 214 may include a transaction processing unit 216 that, when a transaction for verifying a report is requested from the analysis node, proceeds to vote and records it in the distributed ledger according to an agreement based on a delegation proof-of-stake method.

The suspicious file receiving unit 211 may receive a collected suspicious file transmitted from the blockchain network 1 and receive an analysis request for the suspicious file. The storage node 210 of the second node cluster may receive suspicious files from a plurality of collection nodes and store them for analysis.

The distributed hashing unit 212 distributes and stores the received suspicious file to each storage node in the second node cluster, including its own node, and generates and stores the hashed index data through a distributed hash table (DHT) technology. Through this, the suspicious file stored in each storage node 210 can be searched and then distributed and stored. Here, the search by index data is performed through matching with DHT.

The distributed data storage 213 may store a suspicious file in which index data is generated. The hashed original suspicious file may be stored in the current node itself or in one or more other storage nodes in the second node cluster.

The data distribution unit 214 distributes the index data generated by distributed hashing to the third node cluster so that the analyst can search for and download a desired suspicious file. In addition, DHT, a table for matching original suspicious files searched by index data, can be shared on the blockchain network (1).

On the other hand, the storage node 210 according to the embodiment of the present invention further provides a function of recording an analysis report, which is a result of malicious code analysis, in the distributed ledger 230, and publishing it on the blockchain network, in addition to the storage function of the above-described suspicious file. To this end, a transaction processing unit 216 for performing a verification procedure for a report transaction requested by the third node cluster may be further included.

When a report transaction is requested from the analysis nodes, the transaction processing unit 216 broadcasts to the blockchain network 1 to vote by each participating node by broadcasting it to the blockchain network 1 as a verification procedure for the transaction, and schedules according to the voting result. An analysis report that has obtained consent greater than or equal to the ratio may be recorded in the distributed ledger 230. Here, the voting procedure may be performed through a web page implemented in the form of a feed.

In addition, the block of the distributed ledger 230 may store an agreed analysis report, a comment on it, and a peer ID and a public key of a node participating in voting. The higher the rating, the better the reliability of the malware analysis report.

As the consensus algorithm used here, a delegated stake-proof method may be applied, and the stake details may be determined by the system operator and assigned to each node.

In particular, the transaction processing unit 216 may pay a cryptocurrency corresponding to a reward to a corresponding analysis node for an analysis report that has obtained consent of a certain level or higher. This has the character of a price for the analyst's performance.

Hereinafter, an analysis node of a block chain-based malicious code analysis system according to an embodiment of the present invention will be described in detail with reference to the drawings.

4 is a diagram showing the structure of an analysis node of a block chain-based malicious code analysis system according to an embodiment of the present invention.

4, the analysis node 310 of the block chain-based malware analysis system according to an embodiment of the present invention searches for a plurality of index data stored in the second node cluster, and is matched through the selected index data. The data search unit 311 receiving the original suspicious file, the analysis unit 312 providing an analysis tool that analyzes the presence of malicious code in the received suspicious file, the work storage 313 storing the analysis result by the analysis tool, suspicion A report generation unit 314 for generating an analysis report for malicious codes existing in the file and a transaction request unit for requesting a report transaction for mining the analysis report generated by the report generation unit 314 to the second node cluster (316) may be included.

The data search unit 311 may search for one or more suspicious files stored in the second node cluster by using the index data distributed according to the analyst's input. The suspicious file may be distributed and stored in a plurality of storage nodes, and the data search unit 311 may match and download the original suspicious file associated with the index data by referring to the DHT.

The analysis unit 312 may analyze the received suspicious file. The analysis procedure by the analysis unit 312 may be performed by an analyst, and the analysis unit 312 provides a predetermined analysis tool capable of displaying, selecting, extracting, and collating codes included in the suspicious file. Can provide. Analysts can perform analysis by creating a project through an analysis tool and loading a suspicious file.

The work storage 313 may store a result generated in a suspicious file analysis project performed by the analysis unit 312. The analyst may store and load the results of the analysis project being worked on in the work storage 313 from time to time to continuously perform the work.

The report generation unit 314 may generate an analysis report on the suspicious file for which the analysis work has been completed. As a result of the analysis, when a code suspected of malicious code is found in the suspicious file, the operator reflects his or her opinion and completes the analysis project, and the report generator 314 may generate an analysis report in a form that can be transmitted and shared. .

The transaction requesting unit 316 may vote on the generated analysis report, generate a report transaction for registration in the distributed ledger, and transmit it to the blockchain network 1. In order for the analysis report to be registered on the distributed ledger, verification based on the consensus algorithm is required from a plurality of nodes participating in the blockchain network (1) excluding the analysis node itself of the analyst, and the transaction request unit 316 verifies such a blockchain. A report transaction is generated for and transmitted to the second node cluster.

Hereinafter, a method of analyzing a malicious code based on a block chain by the system of the present invention will be described in detail with reference to the drawings.

5 is a diagram showing a method of analyzing a malicious code based on a block chain according to an embodiment of the present invention. In the following description, the execution subject for each step and procedure is a collection node, a storage node, and an analysis node of the present invention, and each component thereof, even if there is no separate description.

In the block chain-based malicious code analysis method according to an embodiment of the present invention, a first node cluster extracts one or more suspicious files by driving a malicious code search bot mounted on a collection node, and transfers the suspicious files to a connected blockchain network. Transmitting, the second node cluster receiving the suspicious file, generating index data through a distributed hashing procedure, and distributedly storing the suspicious file in a plurality of storage nodes, and the third node cluster is performed by the analysis node. Analyzing a malicious code by receiving a suspicious file stored in any one of a plurality of storage nodes, generating a report on the analysis result, and transmitting it to the second node cluster, and an analysis report transmitted by the second node cluster Is broadcast on the blockchain network, and the analysis report with a certain level of reliability is stored in the distributed ledger by consensus according to the result of voting on the analysis report. It will be described in detail.

5, in the step of extracting one or more suspicious files by driving the malicious code search bot mounted on the collection node by the first node cluster 100 and transmitting the suspicious files to the connected blockchain network, first, first The node cluster 100 detects the scan result of the vaccine program by driving the malicious code search bot (S100), extracts a suspicious file accordingly, and transmits it to the second node cluster 200.

Next, in the step of receiving the suspicious file from the second node cluster 200, generating index data through a distributed hashing procedure, and storing each suspicious file in a plurality of storage nodes, the second node cluster 200 ) Derives the index data by performing distributed hashing of the suspicious file received by the distributed hash table (DHT), and stores the original suspicious file in each storage node (S120), and stores the index data according to the hashing to the third node. It is disclosed to the cluster 300 (S130).

Next, the third node cluster receives the suspicious file stored in any one of the plurality of storage nodes by the analysis node, analyzes the malicious code, generates an analysis report for the analysis result, and transmits it to the second node cluster. In the step of, the third node cluster 300 searches for index data (S140), and extracts and receives one or more original suspicious files associated therewith (S150).

In addition, the third node cluster 300 performs an analysis on the received suspicious file to determine whether there is a malicious code, and when it finds the malicious code, generates an analysis report thereon (S170). In addition, the third node cluster 300 requests a report transaction for registering the distributed ledger of the analysis report from the second node cluster 200 (S180).

Next, in the step of broadcasting the analysis report transmitted by the second node cluster on the blockchain network, and storing the analysis report with a certain level of reliability or higher in the distributed ledger by consensus according to the voting result for the analysis report, When the second node cluster executes the chaincode to request verification of the report transaction from the participants of the blockchain network and proceeds to vote (S190), and the result of voting according to the consensus based on the proof-of-stake method, and consent above the standard is received. As it is determined that the malicious code has a certain level of reliability or higher, the second node cluster records the analysis report in the distributed ledger (S200).

Thereafter, the second node cluster 200 pays a cryptocurrency as an outcome to the analysis node that provided the report, that is, the analyst (S210).

In addition, after registering the distributed ledger of the analysis report, the collection node of the first node cluster may update the signature repository by receiving malicious code information defined in the analysis report as signature data for detecting malicious code.

Hereinafter, the technical idea of the present invention will be described in detail through an example of a structure of a distributed ledger operated by a block chain-based malicious code analysis system according to an embodiment of the present invention.

6 is a diagram illustrating the structure of a distributed ledger of a block chain-based malicious code analysis system according to an embodiment of the present invention.

Referring to FIG. 6, the structure of the distributed ledger of the malicious code analysis system according to an embodiment of the present invention, that is, the block structure is shown, and the structure of the first block generated in the block chain is illustrated.

In the present invention, malware analysts who lack capital power mainly participate to obtain malware samples, and the analyzed file is a transaction of the blockchain network in the form of an analyst's report including metadata of the file along with the peer ID value of the stored storage node. Can be uploaded.

In the block, an analysis report containing the opinion of a malicious code analyst and comments on it can be stored. In addition, the peer ID and public key of the node voting for the analysis report are stored. The storage node is connected to a web page implemented in the form of a feed and can conduct voting by publishing an analysis report, and the higher the rating, the higher the reliability of the malicious code analysis report.

Although many items are specifically described in the above description, this should be construed as an example of a preferred embodiment rather than limiting the scope of the invention. Therefore, the invention should not be determined by the described embodiments, but should be determined by the claims and equivalents to the claims.

1: Blockchain network 100: 1st node cluster
110: collection node 111: signature storage
112: vaccine unit 113: malicious code search bot
114: suspicious file transmission unit 115: signature update unit
120: (1st) chain code 200: second node cluster
210: storage node 211: suspicious file reception unit
212: distributed hashing unit 213: distributed data storage
214: data distribution unit 216: transaction processing unit
220: (2) chain code 230: distributed ledger
300: third node cluster 310: analysis node
311: data search unit 312: analysis unit
313: job storage 314: report generation unit
316: transaction request unit 320: (third) chain code

Claims (12)

A first node cluster including a plurality of collection nodes for extracting one or more suspicious files detected through the mounted malicious code search bot and transmitting the suspicious files to a connected blockchain network;
A second node cluster including a plurality of storage nodes for receiving the suspicious file and transmitting it to a node belonging to the same node cluster through a distributed hashing procedure and storing it in a distributed manner; And
A third node cluster including a plurality of analysis nodes for receiving a suspicious file stored in any one of the plurality of storage nodes, analyzing a malicious code, generating an analysis report for the analysis result, and transmitting it to the second node cluster Including,
The second node cluster,
The transmitted analysis report is broadcast on the blockchain network, and the analysis report with a certain level of reliability or higher is stored in the distributed ledger by consensus by voting on the analysis report,
The collection node,
A signature storage storing a plurality of signature data for selecting malicious codes;
A vaccine unit that checks a plurality of commands included in a process with the signature data to determine whether or not a malicious code exists;
A malicious code search bot that extracts one or more suspicious files using a defined deep learning-based learning model from among files checked for the presence of malicious codes by the anti-virus unit; And
Including a suspicious file transmission unit that transmits the extracted suspicious files to the blockchain network,
The storage node,
A suspicious file receiving unit for receiving a suspicious file transmitted from the first node cluster;
A distributed hashing unit for generating a plurality of index data through hashing with reference to a distributed hash table for the received suspicious file;
A distributed data storage for storing some of the suspicious files matching the index data; And
A data distribution unit for providing the index data to the third node cluster,
The analysis node,
A data search unit that searches a plurality of index data stored in the second node cluster and receives a matching original suspicious file through the selected index data;
An analysis unit that provides an analysis tool for analyzing the presence of malicious code in the received suspicious file;
A work storage for storing the analysis result by the analysis tool; And
Blockchain-based malicious code analysis system comprising a report generation unit that generates an analysis report for the malicious code existing in the suspicious file. delete The method of claim 1,
The collection node,
A signature update unit that extracts and stores the malicious code defined in one or more reports recorded in the distributed ledger in the signature storage as signature data when it has received a rating of a certain level or higher
Blockchain-based malicious code analysis system further comprising a. delete The method of claim 1,
The storage node,
When a transaction for report verification is requested from the analysis node, a transaction processing unit that proceeds with voting and records it in the distributed ledger according to the consensus based on the delegated proof-of-stake method.
Blockchain-based malware analysis system including a. The method of claim 5,
The transaction processing unit,
Blockchain-based malware analysis system that pays a cryptocurrency corresponding to a reward to the analysis node for analysis reports that have obtained a certain level of consent. delete The method of claim 1,
The analysis node,
A transaction request unit for requesting a report transaction for mining the analysis report generated by the report generation unit to the second node cluster
Blockchain-based malicious code analysis system further comprising a. As a method for analyzing a block chain-based malicious code using the first to third node clusters according to claim 1,
Extracting one or more suspicious files by driving a malicious code search bot mounted on the collection node by the first node cluster, and transmitting the suspicious files to a connected blockchain network;
Receiving, by a second node cluster, the suspicious file, and storing each suspicious file in a plurality of storage nodes through a distributed hashing procedure;
Receiving, by the analysis node, a suspicious file stored in any one of the plurality of storage nodes, analyzing the malicious code, generating an analysis report on the analysis result, and transmitting it to the second node cluster; And
Broadcasting the analysis report transmitted by the second node cluster on the blockchain network, and storing the analysis report having a certain level of reliability or higher in a distributed ledger by consensus according to a voting result for the analysis report,
The step of extracting one or more suspicious files by the first node cluster driving a malicious code search bot mounted on the collection node, and transmitting the suspicious files to a connected blockchain network,
Determining whether a malicious code exists by comparing a plurality of instructions included in the process with a plurality of signature data for selecting malicious codes;
Extracting one or more suspicious files using a defined deep learning-based learning model from among files connected to a process in which the malicious code does not exist through a malicious code search bot;
Transmitting the extracted suspicious file to a blockchain network; And
If the malicious code defined in one or more reports recorded in the distributed ledger receives a rating of a certain level or higher, extracting and storing it as signature data,
The step of receiving, by the second node cluster, the suspicious file, and distributedly storing each suspicious file in a plurality of storage nodes through a distribution procedure,
Receiving a suspicious file transmitted from the first node cluster;
Generating a plurality of index data through hashing with reference to the distributed hash table for the received suspicious file;
Storing a suspicious file matching the index data in each storage node;
Providing the index data to the third node cluster;
When a transaction for report verification is requested from the analysis node, voting is performed and recording in a distributed ledger according to a consensus based on a delegated stake verification method; And
For an analysis report that has obtained consent of a certain level or higher, providing a cryptocurrency corresponding to a reward to the corresponding analysis node,
The step of broadcasting the analysis report transmitted by the second node cluster on the blockchain network, and storing the analysis report having a certain level of reliability or higher in the distributed ledger by consensus according to the result of voting on the analysis report,
Searching for a plurality of index data being published in the second node cluster, and receiving a matching original suspicious file through the selected index data;
Providing an analysis tool for analyzing the presence of malicious code in the received suspicious file;
Storing the analysis result by the analysis tool;
Generating an analysis report for the malicious code existing in the suspicious file; And
Blockchain-based malware analysis method comprising the step of requesting a report transaction for mining the generated analysis report to the second node cluster. delete delete delete

Images