KR102316404B1 - Method for ransomware mitigation by extension randomization, recording medium and device for performing the method - Google Patents

Abstract

A ransomware damage defense method through extension randomization includes: recognizing a file extension existing in a Windows registry; generating an encryption extension corresponding to each of the file extensions through encryption using a random value; generating a randomized extension key in the Windows registry based on the encryption extension; storing information on a file extension corresponding to the randomized extension key; and replacing the extension of a file existing in the file system with the encryption extension. Accordingly, security against ransomware can be strengthened because file extension registry values are randomly generated and information is copied.

Description

Ransomware damage defense method through extension randomization, recording medium and device for performing the same

The present invention relates to a method for preventing ransomware damage through randomization of extensions, a recording medium and an apparatus for performing the same, and more particularly, to prevent ransomware damage that infects a PC through an attack path that cannot be blocked in a computer system. It's about technology.

Ransomware is a type of malicious software that infects computer systems, restricts access, and demands a ransom. Because access to the computer is restricted, to remove the restriction, the person who developed the malicious program will be forced to pay. While there is ransomware that encrypts at this point, some simply lock the system and pop up prompts to force the computer user to pay.

Recently, mass hacking through ransomware worldwide continues to occur. Widespread attacks, including crypto-based ransomware, have begun to increase through Trojans such as CryptoLocker and CryptoWall, which have extorted approximately $3 million and $18 million, respectively.

These are malicious codes that are installed on the computer without the user's consent and take internal files hostage and demand money. In general, it occurs most often in PCs with Windows operating systems installed, but it also occurs in mobile environments, and Mac OS can also be infected.

MTD (Moving Target Defense) is a technology and perspective that has recently been attracting attention as a more fundamental and innovative solution to the cybersecurity problem. In the existing security strategy, there is no change in the configuration of the attack target system itself, resulting in providing time for attackers to find vulnerabilities in the target system.

In addition, as a result, the main security strategy was to take only passive and ad hoc defenses against attacks using the vulnerabilities of the attack target system. In MTD, by periodically changing the configuration of the attack target system, time constraints are added to the attacker's vulnerability analysis, and the discovered vulnerabilities are invalidated over time.

Windows Registry is a database containing settings and selections of Microsoft Windows 32/64-bit versions and Windows Mobile operating systems. Contains information and settings.

When a user changes control panel settings, file associations, system policies, or installed software, the changes are reflected and saved in the registry. The registry also provides Windows into the kernel's operating system, exposing runtime information such as performance counters and the hardware currently in use.

When a ransomware infects a PC through an unstoppable attack vector, it is a big problem that the user's files are not protected. On May 12, 2017, a ransomware called WannaCry that utilized the hacking tool of the US National Security Agency (NSA) infected more than 100,000 computers in more than 100 countries around the world within a day of its distribution.

This large-scale hacking was possible because the hacking tool used a powerful, undiscovered software vulnerability called a zero-day vulnerability that most users could not respond to at all. Although it is not common, attackers using zero-day vulnerabilities can exist in many Internet and network services, and many users' PCs can be defenselessly infected with ransomware through these vulnerabilities at any time.

Most existing ransomware countermeasures and research technologies detect and prevent ransomware before it becomes infected, but there is a problem that it can be infected somehow if a strong vulnerability is used, such as the WannaCry case.

KR 10-2000369 B1 KR 10-1995944 B1

Accordingly, it is an object of the present invention to provide a method for protecting against ransomware damage through randomization of extensions.

Another object of the present invention is to provide a recording medium in which a computer program for performing the ransomware damage defense method through the extension randomization is recorded.

Another object of the present invention is to provide an apparatus for performing the ransomware damage defense method through the extension randomization.

According to an embodiment of the present invention, there is provided a method for preventing ransomware damage through randomization of extensions for realizing the object of the present invention, the method comprising: recognizing a file extension existing in a Windows registry; generating an encryption extension corresponding to each of the file extensions through encryption using a random value; generating a randomized extension key in the Windows registry based on the encryption extension; storing information on a file extension corresponding to the randomized extension key; and replacing the extension of a file existing in the file system with the encryption extension.

In an embodiment of the present invention, the ransomware damage defense method through the extension randomization may repeat the above steps at regular intervals.

In an embodiment of the present invention, generating an encryption extension corresponding to each file extension through encryption using a random value may encrypt a file extension using a Cryptographically Secure Pseudo Random Number Generators (CSPRNG) API.

In an embodiment of the present invention, generating an encryption extension corresponding to each file extension through encryption using the random value includes: generating a random number using a CSPRNG API; deriving an alphabet corresponding to the number through a modulo operation of 26 on the generated random number; and repeatedly performing the above steps until three or four alphabets are derived.

In an embodiment of the present invention, the step of generating an encryption extension corresponding to each file extension through encryption using the random value includes generating an encryption extension by arranging the derived three or four alphabets. can do.

In an embodiment of the present invention, the step of generating an encrypted extension corresponding to each file extension through encryption using the random value may further include: checking whether the generated encrypted extension overlaps with an extension that is already in use. can

In an embodiment of the present invention, the step of generating an encryption extension corresponding to each file extension through encryption using the random value includes using the random value when the generated encryption extension overlaps with an extension already in use. It may further include; re-performing the step of generating an encryption extension corresponding to each file extension through encryption.

In an embodiment of the present invention, the step of generating an encryption extension corresponding to each file extension through encryption using the random value includes the generated encryption extension when the generated encryption extension does not overlap with an extension that is already in use. may further include; applying to the corresponding file extension.

In a computer-readable storage medium according to an embodiment for realizing another object of the present invention, a computer program for performing a ransomware damage defense method through extension randomization is recorded.

According to an embodiment of the present invention for realizing another object of the present invention, there is provided an apparatus for protecting against ransomware damage through extension randomization, comprising: an extension recognition unit for recognizing a file extension existing in a Windows registry; a randomization encryption unit generating an encryption extension corresponding to each file extension through encryption using a random value; a random key generator for generating a randomized extension key in the window registry based on the encryption extension; an extension backup unit for storing information on a file extension corresponding to the randomized extension key; and an extension replacement unit that replaces the extension of a file existing in the file system with the encrypted extension.

In an embodiment of the present invention, the apparatus for preventing ransomware damage through extension randomization may repeatedly perform extension randomization at regular intervals.

In an embodiment of the present invention, the randomization encryption unit may encrypt a file extension using a Cryptographically Secure Pseudo Random Number Generators (CSPRNG) API.

In an embodiment of the present invention, the randomization encryption unit, a number generator for generating a random number using a CSPRNG API; an alphabet derivation unit for deriving an alphabet corresponding to the number through a modulo operation of 26 for the generated random number; an extension generator generating an encryption extension by arranging the derived three or four alphabets; and a duplication checker that checks whether the generated encrypted extension overlaps with an extension that is already in use.

In an embodiment of the present invention, the randomization encryption unit may regenerate an encryption extension corresponding to each file extension through encryption using the random value when the generated encryption extension overlaps with an extension that is already in use. .

According to the ransomware damage defense method through the randomization of the extension, even when the ransomware operates normally on the PC through an arbitrary high process, randomized file information is set in advance in the process of checking and encrypting the target file. Prevent encryption. In addition, even if the file extension is randomized by duplicating the registry information, there is no problem in using the file as an application program or for various purposes. Accordingly, security against ransomware can be strengthened because file extension registry values are randomly generated and information is copied.

1 is a block diagram of an apparatus for protecting against ransomware damage through extension randomization according to an embodiment of the present invention.
FIG. 2 is a detailed block diagram of the randomization encryption unit of FIG. 1 .
3 is a diagram showing an example of a Windows registry.
4 is a diagram showing an example of a file system before extension conversion in the related art.
5 is a diagram showing an example of a file system after extension conversion according to the present invention.
6 is a diagram showing a ransomware sample collected to verify the effect of the present invention.
7 is a table showing experimental results of the ransomware sample of FIG. 6 .
8 is a flowchart of a method for protecting against ransomware damage through extension randomization according to an embodiment of the present invention.
9 is a detailed flowchart for explaining a step of generating an encryption extension corresponding to the file extension of FIG. 8 .

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0023] Reference is made to the accompanying drawings, which show by way of illustration specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention are different but need not be mutually exclusive. For example, certain shapes, structures, and characteristics described herein with respect to one embodiment may be embodied in other embodiments without departing from the spirit and scope of the invention. In addition, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the detailed description set forth below is not intended to be taken in a limiting sense, and the scope of the invention, if properly described, is limited only by the appended claims, along with all scope equivalents to those claimed. Like reference numerals in the drawings refer to the same or similar functions throughout the various aspects.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

1 is a block diagram of an apparatus for protecting against ransomware damage through extension randomization according to an embodiment of the present invention. FIG. 2 is a detailed block diagram of the randomization encryption unit of FIG. 1 .

The apparatus for preventing ransomware damage through randomization of extensions (10, hereinafter) according to the present invention relates to a computer system, and more particularly, to an apparatus for preventing ransomware damage.

Referring to FIG. 1 , the device 10 according to the present invention includes an extension recognition unit 110 , a randomization encryption unit 130 , a random key generation unit 150 , an extension backup unit 170 , and an extension replacement unit 190 . ) is included. The device 10 according to the present invention may further enhance security by repeatedly performing extension randomization at regular intervals.

In the device 10 of the present invention, software (application) for performing ransomware damage defense through extension randomization may be installed and executed, and the extension recognition unit 110, the randomization encryption unit 130, The configuration of the random key generation unit 150, the extension backup unit 170 and the extension replacement unit 190 is software for performing ransomware damage defense through the extension randomization executed in the device 10 can be controlled by

The device 10 may be a separate terminal or a module of the terminal. In addition, the configuration of the extension recognition unit 110 , the randomization encryption unit 130 , the random key generation unit 150 , the extension backup unit 170 , and the extension replacement unit 190 is an integrated module. Or, it may consist of one or more modules. However, on the contrary, each configuration may be formed of a separate module.

The device 10 may be a standalone product as a security solution specialized for ransomware, or may configure some functions as a function installed in the operating system.

The operating system is a system program for software to use the hardware of the device, and is a mobile computer operating system such as Android OS, iOS, Windows Mobile OS, Bada OS, Symbian OS, Blackberry OS, and Windows series, Linux series, Unix series, It can include all computer operating systems such as MAC, AIX, and HP-UX.

The extension recognition unit 110 recognizes a file extension existing in the Windows registry. 3 shows an example of a Windows registry.

The file extension includes all file extensions that can be targeted by ransomware. For example, txt, zip, pdf, docx, pptx, xlsx, etc.

The randomization encryption unit 130 generates an encryption extension corresponding to each of the file extensions through encryption using a random value. If a fixed pattern or incomplete random value is used, the attacker can guess in advance, so a randomized encryption method is used.

As an embodiment, the randomization encryption unit 130 may generate an extension with a random value using a Cryptographically Secure Pseudo Random Number Generators (CSPRNG) API generated by a cryptographically secure method for each file extension.

Specifically, referring to FIG. 2 , the randomization encryption unit 130 includes a number generation unit 131 , an alphabet derivation unit 133 , an extension generation unit 135 , and a duplicate check unit 137 .

The number generator 131 generates a random number using the CSPRNG API. The alphabet derivation unit 133 derives an alphabet corresponding to the number through a modulo operation on the generated random number.

The modulo operation is a mathematical operation for calculating the remainder of division. In the present invention, for example, the modulo operation may be set to a number of 26 and calculated as a remainder value divided by 26. Therefore, when 29 is a random number, the remainder after dividing by 26 becomes 3, and the corresponding letter c is derived. Also, when a random number comes out 10, 10 becomes the remainder, and the corresponding alphabet j is derived.

These random numbers are generated and the alphabet derivation through modulo operation is repeated 3 or 4 times to derive 3 or 4 alphabets. Here, the reason for designating three or four alphabets is that in general, an extension system uses an alphabetic string of three or four lengths as an extension.

If you do not follow these implicit rules and use special characters or more than 5 alphabetic strings, the attacker may recognize it as an unusual pattern and predict it in advance.

The extension generating unit 135 generates an encrypted extension by arranging the derived three or four alphabets. The arrangement order may be changed in the derived order or in the reverse order or randomly.

The duplicate check unit 137 checks whether the generated encrypted extension overlaps with an extension that is already in use. When the generated encrypted extension overlaps with an extension that is already in use, it goes back to the beginning and regenerates an encrypted extension corresponding to each file extension through encryption using the random value. In other words, the number generator 131 may start again from generating a random number using the CSPRNG API.

On the other hand, when the generated encrypted extension does not overlap with an extension that is already in use, the generated encrypted extension is applied to the corresponding file extension.

The random key generator 150 generates a randomized extension key in the window registry based on the encryption extension.

The extension backup unit 170 stores information on the file extension corresponding to the randomized extension key. In this way, even if the file extension is randomized by duplicating the registry information, there is no problem in the user using the file for application programs and various purposes.

The extension replacement unit 190 replaces the extension of a file existing in the file system with the encryption extension. In this case, the same file extension may be changed to the encrypted extension all at once.

4 shows an example of a file system before extension conversion in the prior art, and FIG. 5 is a view showing an example of a file system after extension conversion according to the present invention.

In FIG. 4 , it can be seen that the extensions of txt, zip, pdf, docx, pptx, and xlsx are changed to random extensions as shown in FIG. 5 . Specifically, txt is umbc, zip is imko, pdf is ohiz, docx is juev, pptx is nhru, xlsx is qooi, and in particular, it can be seen that all pdf are changed to ohiz.

The apparatus 10 according to the present invention may repeat the above operations at a constant cycle, and may change the extension periodically by randomizing the extension. In this case, the defense against ransomware will be stronger.

6 is a diagram showing the ransomware sample collected to verify the effect of the present invention, and FIG. 7 is a table showing the experimental results of the ransomware sample of FIG. 6 .

6 and 7 , a total of 350 were collected, but 143 ransomware samples were tested except for those that did not operate normally due to C&C servers or environmental problems.

As a result, referring to FIG. 7 , as a result of the experiment, it showed an effect of protecting files from 141 ransomware out of 143. It can be confirmed that the ransomware damage defense solution through extension randomization according to the present invention has an excellent effect of blocking more than 98.6% of ransomware.

Accordingly, the present invention may be a single product as a security solution specialized for ransomware, or some functions may be configured as functions installed in the operating system.

8 is a flowchart of a method for protecting against ransomware damage through extension randomization according to an embodiment of the present invention. 9 is a detailed flowchart for explaining a step of generating an encryption extension corresponding to the file extension of FIG. 8 .

The ransomware damage defense method through extension randomization according to the present embodiment may be performed in substantially the same configuration as the device 10 of FIG. 1 . Accordingly, the same components as those of the device 10 of FIG. 1 are given the same reference numerals, and repeated descriptions are omitted.

Also, the ransomware damage defense method through extension randomization according to the present embodiment may be executed by software (application) for performing ransomware damage defense method through extension randomization.

Referring to FIG. 8 , the ransomware damage defense method through extension randomization according to the present embodiment recognizes file extensions existing in the Windows registry (step S10). The file extension includes all file extensions that can be targeted by ransomware. For example, txt, zip, pdf, docx, pptx, xlsx, etc.

An encryption extension corresponding to each of the file extensions is generated through encryption using a random value (step S20). If a fixed pattern or incomplete random value is used, the attacker can guess in advance, so a randomized encryption method is used.

As an embodiment, an extension may be generated with a random value using a Cryptographically Secure Pseudo Random Number Generators (CSPRNG) API generated by a cryptographically secure method for each file extension.

Specifically, referring to FIG. 9 , a random number is generated using the CSPRNG API (step S21). An alphabet corresponding to the number is derived through a modulo operation on the generated random number (step S22), and these steps are repeatedly performed 3 or 4 times until 3 or 4 alphabets are derived. (Step S23).

The modulo operation is a mathematical operation for calculating the remainder of division. In the present invention, for example, the modulo operation may be set to a number of 26 and calculated as a remainder value divided by 26. Therefore, when 29 is a random number, the remainder after dividing by 26 becomes 3, and the corresponding letter c is derived. Also, when a random number comes out 10, 10 becomes the remainder, and the corresponding alphabet j is derived. These random numbers are generated and the alphabet derivation through modulo operation is repeated 3 or 4 times to derive 3 or 4 alphabets.

An encryption extension is generated by arranging the derived 3 or 4 alphabets (step S24). The arrangement order may be changed in the derived order or in the reverse order or randomly.

Here, the reason for designating three or four alphabets is that in general, an extension system uses an alphabetic string of three or four lengths as an extension.

If you do not follow these implicit rules and use special characters or more than 5 alphabetic strings, the attacker may recognize it as an unusual pattern and predict it in advance.

It is checked whether the generated encryption extension overlaps with the extension already in use (step S25).

If the generated encrypted extension overlaps with an extension already in use, it goes back to the beginning and regenerates an encrypted extension corresponding to each file extension through encryption using the random value (step S21).

On the other hand, if the generated encrypted extension does not overlap with an extension that is already in use, the generated encrypted extension is applied to the corresponding file extension (step S26).

A randomized extension key is generated in the window registry based on the encryption extension (step S30).

Information on the file extension corresponding to the randomized extension key is stored (step S40). In this way, even if the file extension is randomized by duplicating the registry information, there is no problem in the user using the file for application programs and various purposes.

The extension of the file existing in the file system is replaced with the encrypted extension (step S50). In this case, the same file extension may be changed to the encrypted extension all at once.

By repeating the above operations at regular intervals, the extension may be changed periodically by randomizing the extension. In this case, the defense against ransomware will be stronger.

Such a ransomware damage defense method through extension randomization may be implemented as an application or may be implemented in the form of program instructions that may be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc. alone or in combination.

The program instructions recorded on the computer-readable recording medium are specially designed and configured for the present invention, and may be known and available to those skilled in the computer software field.

Examples of the computer-readable recording medium include a hard disk, a magnetic medium such as a floppy disk and a magnetic tape, an optical recording medium such as a CD-ROM, a DVD, and a magneto-optical medium such as a floppy disk. media), and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like.

Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

Although described above with reference to the embodiments, those skilled in the art can variously modify and change the present invention within the scope without departing from the spirit and scope of the present invention described in the claims below You will understand.

The present invention is a security solution specialized for ransomware, and it is expected that it may be a standalone product, or some functions may be configured as a function installed in the operating system.

10: Ransomware damage defense device through extension randomization
110: extension recognition unit
130: randomization encryption unit
150: random key generator
170: extension backup unit
190: extension replacement part
131: number generator
133: alphabet derivation
135: extension generator
137: redundancy check unit

Claims (14)

Recognizing a file extension existing in the Windows registry;
generating an encryption extension corresponding to each of the file extensions through encryption using a random value;
generating a randomized extension key in the Windows registry based on the encryption extension;
storing information on a file extension corresponding to the randomized extension key; and
Replacing the extension of a file existing in the file system with the encryption extension; Including, but repeating the steps at regular intervals to randomize the extension and periodically change it,
The step of generating an encryption extension corresponding to each file extension through encryption using the random value,
Encrypt the file extension using the Cryptographically Secure Pseudo Random Number Generators (CSPRNG) API.
generating a random number using the CSPRNG API;
deriving an alphabet corresponding to the number through a modulo operation of 26 on the generated random number;
repeating the above steps until three or four alphabets are derived;
generating an encryption extension by arranging the derived three or four alphabets; includes,
Ransomware damage defense method through randomization of extensions that can be changed in the reverse order or randomly changeable order of the three or four alphabets derived above.
delete delete delete delete The method of claim 1, wherein the generating of an encryption extension corresponding to each file extension through encryption using the random value comprises:
Checking whether the generated encryption extension overlaps with the extension already in use; Ransomware damage defense method through extension randomization further comprising a.
The method of claim 1, wherein the generating of an encryption extension corresponding to each file extension through encryption using the random value comprises:
If the generated encrypted extension overlaps with the extension already in use, re-performing the step of generating an encrypted extension corresponding to each file extension through encryption using the random value; further comprising, randomizing the extension How to defend against ransomware damage.
The method of claim 1, wherein the generating of an encryption extension corresponding to each file extension through encryption using the random value comprises:
When the generated encrypted extension does not overlap with an extension that is already in use, applying the generated encrypted extension to a corresponding file extension; Ransomware damage defense method through extension randomization, further comprising a.
A computer-readable storage medium in which a computer program for performing the ransomware damage defense method through the extension randomization according to any one of claims 1 and 6 to 8 is recorded.
an extension recognition unit for recognizing file extensions existing in the Windows registry;
a randomization encryption unit generating an encryption extension corresponding to each file extension through encryption using a random value;
a random key generator for generating a randomized extension key in the window registry based on the encryption extension;
an extension backup unit for storing information on a file extension corresponding to the randomized extension key; and
Including; an extension replacement unit for replacing the extension of the file existing in the file system with the encryption extension;
The file extension is periodically changed by repeating extension randomization at regular intervals,
The randomization encryption unit,
Encrypt the file extension using the Cryptographically Secure Pseudo Random Number Generators (CSPRNG) API.
a number generator for generating a random number using the CSPRNG API;
an alphabet derivation unit for deriving an alphabet corresponding to the number through a modulo operation of 26 from the generated random number;
It includes; an extension generating unit that generates an encryption extension by arranging the derived three or four alphabets;
The arrangement order of the three or four alphabets derived above is a ransomware damage defense device through the derived reverse order or randomly changeable extension randomization.
delete delete The method of claim 10, wherein the randomization encryption unit,
A ransomware damage defense device through extension randomization, including; a duplicate check unit that checks whether the generated encryption extension is duplicated with an extension that is already in use.
The method of claim 13, wherein the randomization encryption unit,
Ransomware damage defense device through extension randomization, which regenerates an encrypted extension corresponding to each file extension through encryption using the random value when the generated encrypted extension overlaps with an extension that is already in use.

Images