KR102419867B1 - System and method to detect injection attack type malicious code - Google Patents

Abstract

The present invention is to diagnose/detect injection of an attack type malicious code, such as polymorphic shell code, which is difficult to diagnose as the code exists only in memory. The present invention provides a new technology which can diagnose/detect polymorphic shell codes with high reliability without missing detection or false positives, breaking away from the existing pattern-based detection techniques. That is, the present invention is to realize an injection attack type malicious code detection system and an injection attack type malicious code detection method.

Description

Injection attack type malicious code detection system and injection attack type malicious code detection method {SYSTEM AND METHOD TO DETECT INJECTION ATTACK TYPE MALICIOUS CODE}

The present invention relates to a technology for diagnosing/detecting malicious code, and more particularly, to a technology for diagnosing/detecting an injection attack type malicious code that is difficult to diagnose because it exists only in a memory.

Malicious code that attacks by performing malicious actions is distributed in the form of a file and infiltrates the target user's system. There are also types that do.

This fileless type of malware starts an attack by injecting an initial attack code called shellcode into the memory of the attack target system to perform malicious actions on the target system.

In addition, the malicious code obtains execution control authority for the system by using the vulnerability of the attack target system, and controls the execution of the beginning of the shellcode injected into the memory to hijack/attack the system.

Therefore, the defender diagnoses/detects based on the pattern (signature) of the injected shellcode to detect the attack behavior such as the tactic of the fileless type of malicious code, and the attacker makes it difficult to detect the pattern to bypass the pattern-based detection. It is evolving by applying polymorphic techniques to shellcode.

As a result, the existing pattern-based detection technique has a limitation in that it cannot cope with polymorphic shellcode patterns that are continuously randomly generated using polymorphism.

Accordingly, the present invention intends to propose a method (technique) capable of diagnosing/detecting an injection attack type malicious code, such as a polymorphic shellcode, which exists only in memory and is difficult to diagnose, with high accuracy, away from the existing pattern-based detection technique.

The present invention was created in consideration of the above circumstances, and the purpose of the present invention is to break away from the existing pattern-based detection technique, and to accurately detect injection attack-type malicious code that is difficult to diagnose because it exists only in the memory, such as polymorphic shellcode, with high accuracy. It is to provide a new technology for diagnosis/detection, that is, an injection attack type malicious code detection system and an injection attack type malicious code detection method.

According to a first aspect of the present invention, there is provided a method for detecting an injection attack type malicious code, comprising: a monitoring step of monitoring a thread code execution in which a code is executed in a thread; an entropy measurement step of measuring the entropy of a thread execution code in a memory to be executed when the execution of the thread code is detected; an entropy interpolation step of interpolating the measured entropy according to a result of checking whether an abnormal symbol appears in the thread execution code; and detecting whether the thread execution code is a malicious code injected into a memory based on the interpolated entropy.

According to a second aspect of the present invention, there is provided an injection attack type malicious code detection system, comprising: a monitoring unit monitoring thread code execution in which a code is executed in a thread; an entropy measuring unit measuring entropy of a thread execution code in a memory to be executed when the execution of the thread code is detected; an entropy interpolation unit for interpolating the measured entropy according to a result of checking whether an abnormal symbol appears in the thread execution code; and a detection unit that detects whether the thread execution code is a malicious code injected into a memory based on the interpolated entropy.

According to the embodiments of the present invention, a new injection attack type malicious code (eg, shellcode) using entropy is detected, paying attention to the high entropy of shellcode that does not exist in a file and operates only in memory, especially polymorphic shellcode. In particular, a more reliable detection technique is realized by applying a flexible entropy interpolation method to avoid detection omissions or false positives, such as when the entropy of the shellcode is detected as normal entropy.

For this reason, according to the present invention, in diagnosing/detecting an injection-attacking malicious code, such as polymorphic shellcode, which exists only in memory and is difficult to diagnose, it departs from the existing pattern-based detection technique and diagnoses/detects it with high reliability without missing detection or false positives. possible effects can be derived.

1 is a block diagram showing the configuration of an injection attack type malicious code detection system according to an embodiment of the present invention.
2 to 4 are exemplary tables showing the concept of interpolating entropy of polymorphic shellcode in the present invention.
5 is a flowchart illustrating an embodiment in which the injection attack type malicious code detection method according to an embodiment of the present invention operates.

Since the present invention can have various changes and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention. In describing each figure, like reference numerals have been used for like elements.

When a component is referred to as being “connected” or “connected” to another component, it may be directly connected or connected to the other component, but it is understood that other components may exist in between. it should be On the other hand, when it is said that a certain element is "directly connected" or "directly connected" to another element, it should be understood that the other element does not exist in the middle.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It is to be understood that this does not preclude the possibility of the presence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present application. does not

Hereinafter, the present invention will be described with reference to the accompanying drawings.

The present invention relates to a technique for diagnosing/detecting an injection attack type malicious code that exists only in a memory and is difficult to diagnose.

Malicious code that attacks by performing malicious actions is distributed in the form of a file and infiltrates the target user's system. There are also types that do.

This fileless type of malware starts an attack by injecting an initial attack code called shellcode into the memory of the attack target system to perform malicious actions on the target system.

In addition, the malicious code obtains execution control authority for the system by using the vulnerability of the attack target system, and controls the execution of the beginning of the shellcode injected into the memory to hijack/attack the system.

Therefore, the defender diagnoses/detects based on the pattern (signature) of the injected shellcode to detect the attack behavior such as the tactic of the fileless type of malicious code, and the attacker makes it difficult to detect the pattern to bypass the pattern-based detection. It is evolving by applying polymorphic techniques to shellcode.

As a result, the existing pattern-based detection technique has a limitation in that it cannot cope with polymorphic shellcode patterns that are continuously randomly generated using polymorphism.

Accordingly, the present invention intends to propose a method (technique) capable of diagnosing/detecting an injection attack type malicious code, such as a polymorphic shellcode, which exists only in memory and is difficult to diagnose, with high accuracy, away from the existing pattern-based detection technique.

More precisely, the present invention proposes a new detection technique for detecting an attack behavior in which a malicious code injects a shellcode in order to infiltrate the user environment in memory, and in particular, a detection technique using entropy.

Entropy refers to the amount of information and is expressed in bits.

Higher entropy than the entropy of normal code means high uncertainty and different from normal code shape.

Assuming that a thread executes a shellcode with polymorphism applied, it will have a different form from normal code and will have high entropy.

Accordingly, the present invention proposes a detection technique using entropy to effectively detect polymorphic shellcodes, paying attention to the high entropy of polymorphic shellcodes.

That is, the present invention is characterized by proposing a technique capable of detecting shellcode, particularly polymorphic shellcode, that operates only in memory without a file, rather than shellcode included in a file type such as a document or script.

More specifically, the present invention intends to implement an injection attack type malicious code detection system 100 or a detection device capable of realizing the proposed detection technique.

1 shows the configuration of an injection attack type malicious code detection system 100 according to an embodiment of the present invention.

The injection attack type malicious code detection system 100 according to the present invention is preferably mounted/installed on an independent user system that can be attacked by malicious code.

The injection attack type malicious code detection system 100 of the present invention may be in the form of an application, program, or engine installed in a user system.

As shown in FIG. 1 , the injection attack type malware detection system 100 according to an embodiment of the present invention may include a monitoring unit 110 , an entropy processing unit 120 , and a detection unit 130 . have.

Furthermore, the injection attack type malicious code detection system 100 may be configured by dividing the entropy processing unit 120 into an entropy measuring unit 126 and an entropy interpolating unit 128 .

As a result, the injection attack type malicious code detection system 100 of the present invention shown in FIG. 1 deviated from the detection method proposed by the present invention, that is, the existing pattern-based detection method, based on the above-described configuration, and does not include a file. It is possible to realize a new method of diagnosing/detecting shellcodes that operate only in memory, especially polymorphic shellcodes with high accuracy.

Hereinafter, each configuration in the injection attack type malicious code detection system 100 for realizing the technology proposed by the present invention will be described in more detail.

The monitoring unit 110 is responsible for monitoring the execution of the thread code in which the code is executed in the thread.

More specifically, the monitoring unit 110 may monitor/detect the execution of the thread code in a manner of monitoring the start time point at which the code is executed in the thread.

Monitoring/detection of thread code execution means to detect when the malicious code shellcode is injected into memory and then executed. It means detecting/detecting various execution methods that can execute a thread, including work requests (apc), etc.

In addition, the monitoring/detection of thread code execution by the monitoring unit 110 may be realized by being delivered through a notification technique and a hooking mechanism within a window user/kernel.

The entropy processing unit 120 is the core of the proposed method of the present invention, that is, a newly proposed detection technique, and is responsible for measuring and interpolating the entropy of the thread execution code in the memory to be executed when the execution of the thread code is detected.

Specifically, the entropy processing unit 120 may be divided into an entropy measuring unit 126 and an entropy interpolating unit 128 .

The entropy measuring unit 126 is responsible for measuring the entropy of the thread execution code in the memory to be executed when the execution of the thread code is detected.

Specifically, when the execution of the thread code is detected according to the monitoring of the monitoring unit 110, the entropy measurement unit 126 extracts a symbol of the thread execution code to be executed in the memory and measures the entropy of the extracted symbol. have.

According to a specific embodiment, the entropy measuring unit 126 may extract the symbol of the beginning of the thread execution code to be executed in the memory.

Here, the reason for extracting the symbol at the beginning of the thread execution code is that if an abnormal symbol to be described later appears (exists) in the front (eg, 0 to 100 bytes before) of the thread code, it is highly likely to be malicious.

On the other hand, the thread code executed in the memory is interpreted and executed as an opcode instruction and an operand argument as a byte code.

Here, since an unfixed value is used as a factor part of the operand, it may affect the entropy measurement result.

Accordingly, the entropy measuring unit 126 may disassemble the opcode at the beginning of the opcode command/operand argument of the thread execution code to be executed in the memory, that is, the opcode at the beginning and extract it as a symbol ( 122).

Then, the entropy measuring unit 126 measures entropy by using the extracted symbol.

According to an embodiment, the entropy measuring unit 126 may measure entropy through a measurement formula, for example, a Shannon entropy formula (hereinafter, Equation 1), using a symbol array consisting of an opcode of the beginning that has been extracted above. can (124).

[Equation 1]

l(x) = -logP(x)

Here, P means the probability of the symbol. Of course, in the present invention, entropy may be measured by using various measurement formulas other than the Shannon entropy formula, and the measurement formula will not be limited.

The entropy interpolation unit 128 is responsible for interpolating the currently measured entropy according to a result of checking whether an abnormal symbol appears in the current thread execution code.

Specifically, the entropy interpolation unit 128 checks whether an abnormal symbol appears in a symbol at the beginning (opcode) of the thread execution code extracted from the entropy measurement unit 126, and according to the result, the entropy measurement unit 126. The measured entropy can be interpolated.

Assuming that the symbol entropy of the normal thread start code is 3.5 to 3.7 bits (hereinafter, the allowable range of the normal entropy standard value), among the symbols used in the polymorphic shellcode, there are commands (abnormal symbols) that cannot come out of the normal thread start code. Even so, when the amount of information is small because the frequency of occurrence of more symbols is small, similar to the symbol entropy of a normal thread start code, it may be measured between 3 and 4 bits.

That is, even when the current thread execution code is a shellcode (or polymorphic shellcode), the entropy measured by the entropy measuring unit 126 using the symbol falls within the allowable range of the normal entropy reference value (eg, 3.5 to 3.7 bits). situations can arise.

In order to accurately diagnose/detect the shellcode (or polymorphic shellcode) even in such a situation, the entropy interpolation unit 128 is configured in the present invention.

In a more specific embodiment, the entropy interpolation unit 128 may check whether an abnormal symbol appears in the current thread execution code by using a symbol table defined based on a plurality of normally verified thread start code data.

For example, in the injection attack malware detection system 100 of the present invention, a symbol table consisting of unique symbols used by a normal thread start code from a plurality of normally verified (eg, hundreds of thousands or more) thread start code data is generated. can be defined.

Such a symbol table may be newly updated periodically or at a predetermined event time point, and may be managed/maintained as the latest symbol table.

Accordingly, the entropy interpolation unit 128 determines whether a symbol not included in the symbol table appears in the symbol at the beginning of the current thread execution code extracted by the entropy measurement unit 126 using a predefined symbol table. appearance can be checked.

That is, if a symbol not included in the symbol table appears in the symbol at the beginning of the current thread execution code, the entropy interpolator 128 determines/confirms the symbol as an abnormal symbol.

Thereafter, the entropy interpolation unit 128 interpolates the entropy measured by the entropy measurement unit 126 according to the result of checking whether an abnormal symbol appears in the symbol at the beginning of the current thread execution code extracted by the entropy measurement unit 126 . handle

That is, the entropy interpolation unit 128 determines whether an abnormal symbol appears, and if an abnormal symbol appears, the entropy is within the allowable range of the normal entropy reference value (eg, 3.5 to 3.7 bit) even if the frequency of occurrence of the abnormal symbol is low. In order not to cause a belonging situation, the entropy measured by the entropy measuring unit 126 should be interpolated (increased).

To describe a specific embodiment, the entropy interpolation unit 128 applies different weights according to the frequency at which the abnormal symbol appears in the symbol at the beginning of the current thread execution code and the entropy previously measured by the entropy measurement unit 126, The previously measured entropy can be interpolated.

For example, when the entropy interpolation unit 128 confirms that an abnormal symbol appears in the symbol at the beginning of the current thread execution code, the entropy measurement unit 126 determines the entropy previously measured as the basis for the thread execution code, that is, the thread execution code. In a case where the frequency of occurrence of an anomaly symbol is low in the symbol at the beginning of , the interpolation increment can be relatively large by applying a greater weight than when the frequency is high.

In this case, assuming that the current thread execution code is a shellcode (or polymorphic shellcode), the lower the occurrence frequency of the abnormal symbol, the lower the entropy measured by the entropy measuring unit 126 using the symbol is that of the normal entropy reference value. It is highly likely to fall within the allowable range (e.g., 3.5 to 3.7 bit), but by making the interpolation increment relatively large, the shellcode (or polymorphic shellcode) entropy may fall within the allowable range of the normal entropy reference value (e.g., 3.5 to 3.7 bit). can lower the chances.

Conversely, the entropy interpolation unit 128, when it is confirmed that an abnormal symbol appears in the symbol at the beginning of the current thread execution code, is based on the entropy previously measured by the entropy measurement unit 126, that is, the start of the thread execution code, that is, the thread execution code. When the frequency of occurrence of an abnormal symbol in the partial symbol is high, the interpolation increment can be relatively small by applying a smaller weight than when the frequency is low.

In this case, assuming that the current thread execution code is a shellcode (or polymorphic shellcode), the higher the occurrence frequency of the abnormal symbol, the higher the entropy measured by the entropy measuring unit 126 using the symbol is that of the normal entropy reference value. Since the probability of falling within the allowable range (eg 3.5 to 3.7 bit) is sufficiently low, the interpolation increment can be flexibly used with a correspondingly small value.

Of course, the entropy interpolation unit 128 does not interpolate (increase) the entropy measured by the entropy measurement unit 126 or interpolates the interpolation value as 0 if the abnormal symbol does not appear as a result of checking whether the abnormal symbol appears. can be processed

2 to 4, the concept of interpolating entropy of polymorphic shellcode in the present invention is shown as an example table.

2 and 3 show the symbol extraction process for "D9C0BF439FAC24D97424F4582BC966B9370283C004317815033B8A4ED1EE3F6299F4B8FA720C39FD8ABF6FABDD55E70C88C059D92221A694FF613E2EBB", the bytecode at the beginning of the polymorphic thread.

That is, in the embodiment of the present invention, only the opcode symbol at the beginning of the bytecode at the beginning of the polymorphic thread is extracted through disassembly, and in this case, the symbol arrangement "D9 BF D9 58 2B 66 83 31 03 8A" EE 3F 62 0C FD 8A E7 88 59 D9 21 2E".

Using the thus obtained symbol arrangement "D9 BF D9 58 2B 66 83 31 03 8A EE 3F 62 0C FD 8A E7 88 59 D9 21 2E", if entropy is measured through the Shannon entropy formula, 4.15 bit can be obtained.

As can be seen from FIG. 3 , the symbol arrangement includes symbols that are not used in normal thread start codes, such as d9 fld and d9 fnstenv, which are opcodes used for polymorphism.

That is, in the present invention, unlike general opcodes (symbol table-based) such as 66 mov, 58 pop, 2b sub, etc., symbols not used in the normal thread start code are classified as abnormal symbols / abnormal symbol appearance is identified, Dynamically interpolated entropy can be obtained by applying an appropriate weight according to the frequency of appearance of symbols and the measured entropy (numerical value) to flexibly increase the entropy interpolation value.

4 shows the relationship between the entropy (measured entropy, entropy) of the polymorphic thread start code symbol and the interpolated entropy (entropy 2) of the polymorphic thread start code symbol according to the above, and the weight applied at this time in the present invention.

Referring to FIG. 4, in the case of the polymorphic shellcode mentioned in FIGS. 2 and 3, the interpolation entropy of 5.29 bits is obtained by interpolation processing in which a weight of 0.82 is applied to 4.15 bits of entropy of the extracted symbol array. know you can get it.

The detection unit 130 is responsible for detecting whether the current thread execution code is a malicious code injected into the memory, for example, shellcode (or polymorphic shellcode) based on the entropy interpolated by the entropy interpolation unit 128 . do.

Specifically, the detection unit 130 compares the entropy 2 interpolated by the entropy interpolation unit 128 with the normal entropy reference value, and a predefined allowable range, that is, the allowable range of the normal entropy reference value (eg, 3.5 to 3.7). bit), the current thread execution code can be detected as malicious code injected into memory, such as shellcode (or polymorphic shellcode).

As described above, in the injection-attack malware detection system 100 of the present invention, new injection using entropy, paying attention to the fact that entropy is high in the case of shellcode that does not exist in a file and operates only in memory, especially polymorphic shellcode A more reliable detection technique is realized by applying a flexible entropy interpolation method to avoid detection omissions or false positives, such as when the shellcode entropy is detected as normal entropy. are realizing

Accordingly, according to the present invention, in diagnosing/detecting injection-attack malware, such as polymorphic shellcode, which exists only in memory and is difficult to diagnose, it is possible to diagnose/detect with high reliability without missing detection or false positive, departing from the existing pattern-based detection technique. possible effects can be derived.

Hereinafter, with reference to FIG. 5, a specific embodiment in which the injection attack type malicious code detection method of the present invention operates will be described.

For convenience of description, the injection attack type malicious code detection system 100 will be referred to as an operating subject for performing the injection attack type malicious code detection method of the present invention.

According to the injection attack type malicious code detection method of the present invention, the injection attack type malicious code detection system 100 monitors the thread code execution in which the code is executed in the thread (S10).

Specifically, according to the injection attack type malicious code detection method of the present invention, the injection attack type malicious code detection system 100 monitors/detects the execution of the thread code by monitoring the starting point of code execution in the thread. can

According to the injection attack type malicious code detection method of the present invention, the injection attack type malicious code detection system 100 extracts the symbol of the thread execution code to be executed on the memory when the execution of the thread code is detected according to the monitoring in step S10 (S20) ).

Specifically, according to the injection attack type malicious code detection method of the present invention, the injection attack type malicious code detection system 100 can extract the symbol of the beginning of the thread execution code to be executed in the memory, and in particular, an opcode command. The opcode of the /operand argument, that is, the opcode at the beginning may be disassembled and extracted as a symbol (S20).

And, according to the injection attack type malicious code detection method of the present invention, the injection attack type malicious code detection system 100 measures entropy by using the symbol extracted in step S20 (S30).

According to an embodiment, the injection attack type malicious code detection system 100 measures entropy through a measurement formula, for example, the Shannon entropy formula (Equation 1), using a symbol array consisting of the previously extracted opcodes at the beginning. can do.

On the other hand, according to the injection attack type malicious code detection method of the present invention, the injection attack type malicious code detection system 100 checks whether an abnormal symbol appears in the symbol at the beginning of the thread execution code extracted in step S20 (opcode), Depending on the result, the entropy measured in step S30 may be interpolated (S40, S50).

In a more specific embodiment, the injection attack type malicious code detection system 100 checks whether an abnormal symbol appears in the current thread execution code by using a symbol table defined based on a plurality of normally verified thread start code data. can be (S40).

For example, in the injection attack malicious code detection system 100 of the present invention, a symbol table consisting of unique symbols used by a normal thread start code from a plurality of normally verified (eg, hundreds of thousands or more) thread start code data is generated. can be defined.

Accordingly, the injection attack type malicious code detection system 100 determines whether a symbol that is not included in the symbol table appears in the symbol at the beginning of the current thread execution code extracted in step S20 using a predefined symbol table. appearance can be checked.

That is, if a symbol not included in the symbol table appears in the symbol at the beginning of the current thread execution code, the injection attack type malicious code detection system 100 determines/confirms the corresponding symbol as an abnormal symbol.

Thereafter, the injection attack type malicious code detection system 100 interpolates the entropy measured in step S30 according to the result of checking whether an abnormal symbol appears in step S40 (S50).

That is, if an abnormal symbol appears as a result of checking whether an abnormal symbol appears, the entropy is within the allowable range of the normal entropy reference value (eg, 3.5 to 3.7 even if the frequency of occurrence of the abnormal symbol is low). bit), the entropy measured in step S30 should be interpolated (increased).

In a specific embodiment, the injection attack type malicious code detection system 100 applies different weights according to the frequency at which an abnormal symbol appears in the symbol at the beginning of the current thread execution code and the entropy measured in step S30, and measures the above. One entropy can be interpolated.

For example, when an abnormal symbol appears in the symbol at the beginning of the current thread execution code, the injection attack type malware detection system 100 starts the thread execution code, that is, the thread execution code, based on the entropy measured in step S30. When the frequency of occurrence of an abnormal symbol in the partial symbol is low, the interpolation increment can be relatively large by applying a greater weight than when the frequency is high.

In this case, assuming that the current thread execution code is a shellcode (or polymorphic shellcode), the lower the frequency of occurrence of the abnormal symbol, the lower the entropy measured in step S30 using the symbol is within the allowable range of the normal entropy reference value (e.g. : 3.5~3.7 bit), but it is possible to reduce the possibility that the shellcode (or polymorphic shellcode) entropy falls within the allowable range of the normal entropy reference value (e.g. 3.5~3.7 bit) by making the interpolation increment relatively large. have.

Conversely, the injection attack type malware detection system 100 detects the occurrence of an abnormal symbol in the symbol at the beginning of the current thread execution code, based on the entropy measured in step S30, the symbol at the beginning of the thread execution code, that is, the thread execution code. In the case where the frequency of occurrence of abnormal symbols is high in , the interpolation increment can be relatively small by applying a smaller weight than when the frequency is low.

In this case, assuming that the current thread execution code is a shellcode (or polymorphic shellcode), the higher the frequency of occurrence of the abnormal symbol, the higher the entropy measured in step S30 using the symbol is within the allowable range of the normal entropy reference value (e.g. : 3.5~3.7 bit) is low enough, so the interpolation increment can be flexibly used as a small value accordingly.

Of course, the injection attack type malicious code detection system 100 does not interpolate (increase) the entropy measured in step S30 or interpolates the interpolation value as 0 if the abnormal symbol does not appear as a result of checking whether the abnormal symbol appears. can do.

Thereafter, according to the injection attack type malicious code detection method of the present invention, the injection attack type malicious code detection system 100 detects malicious code, such as shellcode, in which the current thread execution code is injected into the memory based on the entropy interpolated in step S50. (or polymorphic shellcode).

Specifically, the injection attack type malicious code detection system 100 compares the entropy 2 interpolated in step S50 with the normal entropy reference value, and the allowable range of the normal entropy reference value, that is, the predefined allowable range (e.g., 3.5 to 3.7). bit), the execution code of the current thread may be detected as malicious code injected into the memory, for example, shellcode (or polymorphic shellcode) (S70).

On the other hand, the injection attack type malware detection system 100 compares the entropy 2 interpolated in step S50 with the normal entropy reference value, and a predefined allowable range, that is, the allowable range of the normal entropy reference value (e.g., 3.5 to 3.7 bit) ), the current thread execution code may be detected as a normal thread code (S60 NO).

According to the injection attack type malicious code detection method of the present invention, the injection attack type malicious code detection system 100 performs the aforementioned step S10 and subsequent steps unless the detection function of the detection system 100 is turned off (S90 No). will do it repeatedly.

As described above, in the method for detecting an injection-attacking malicious code of the present invention, a new injection-attacking malicious code using entropy, paying attention to the fact that entropy is high in the case of shellcode, particularly polymorphic shellcode, that does not exist in a file and operates only in memory Realizes a code (eg shellcode) detection technique, and in particular, a more reliable detection technique is realized by applying a flexible entropy interpolation method to avoid detection omissions or false positives, such as when the shellcode entropy is detected as normal entropy. have.

Accordingly, according to the present invention, in diagnosing/detecting injection-attack malware, such as polymorphic shellcode, which exists only in memory and is difficult to diagnose, it is possible to diagnose/detect with high reliability without missing detection or false positive, departing from the existing pattern-based detection technique. possible effects can be derived.

The injection attack type malicious code detection method according to an embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present invention, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with specific matters such as specific components and limited embodiments and drawings, but these are only provided to help a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , various modifications and variations are possible from these descriptions by those of ordinary skill in the art to which the present invention pertains.

Therefore, the spirit of the present invention should not be limited to the described embodiments, and not only the claims described below, but also all those with equivalent or equivalent modifications to the claims will be said to belong to the scope of the spirit of the present invention. .

100: Injection attack type malware detection system
110: monitoring unit 120: entropy processing unit
126: entropy measurement unit 128: entropy interpolation unit
130: detection unit

Claims (11)

In the injection attack type malicious code detection method performed in the injection attack type malicious code detection system,
a monitoring step of monitoring the thread code execution in which the code is executed in the thread;
when the execution of the thread code is detected, measuring the entropy of the thread execution code in the memory to be executed and checking whether an abnormal symbol appears in the thread execution code;
an entropy interpolation step of interpolating the measured entropy according to a result of checking whether an abnormal symbol appears in the thread execution code; and
a detecting step of detecting whether the thread execution code is a malicious code injected into a memory based on the interpolated entropy;
The entropy interpolation step is
Based on the measured entropy, when the frequency of occurrence of the identified abnormal symbol is low, the interpolation increase value is increased compared to when the frequency is high, the injection attack type malicious code detection method. The method of claim 1,
The entropy measurement step is,
when the execution of the thread code is detected, extracting a symbol of the beginning of the thread execution code on the memory to be executed;
and measuring entropy by using the extracted symbol. The method of claim 1,
The entropy interpolation step is
An injection attack type malicious code detection method, characterized in that it is checked whether an abnormal symbol appears in the thread execution code by using a symbol table defined based on data of a plurality of normally verified thread start code. 4. The method of claim 3,
The entropy interpolation step is
The injection attack type malicious code detection method, characterized in that the measured entropy is interpolated by applying different weights according to the frequency of occurrence of abnormal symbols in the thread execution code and the measured entropy. 4. The method of claim 3,
The entropy interpolation step is
The method for detecting an injection attack type malicious code, characterized in that the lower the frequency of occurrence of the same abnormal symbol in the thread execution code, the greater the weight is applied when the frequency is higher. The method of claim 1,
The detection step is
and detecting the thread execution code as a malicious code injected into a memory when the interpolated entropy and the normal entropy reference value are out of a predefined allowable range. a monitoring unit that monitors execution of a thread code in which code is executed in a thread;
an entropy measuring unit measuring entropy of a thread execution code in a memory to be executed when the execution of the thread code is detected;
an entropy interpolation unit that, when the execution of the thread code is detected, checks whether an abnormal symbol appears in the thread execution code, and interpolates the measured entropy according to the checked result; and
a detection unit configured to detect whether the thread execution code is a malicious code injected into a memory based on the interpolated entropy;
The entropy interpolation unit,
Based on the measured entropy, when the frequency of occurrence of the identified anomaly symbol is low, the interpolation increase value is larger than when the frequency is high. 8. The method of claim 7,
The entropy measuring unit,
When the execution of the thread code is detected, extracting a symbol of the beginning of the thread execution code on the memory to be executed,
An injection attack type malware detection system, characterized in that entropy is measured by using the extracted symbol. 8. The method of claim 7,
The entropy interpolation unit,
An injection attack type malicious code detection system, characterized in that it is checked whether an abnormal symbol appears in the thread execution code by using a symbol table defined based on a plurality of normally verified thread start code data. 10. The method of claim 9,
The entropy interpolation unit,
and applying different weights according to the frequency of occurrence of abnormal symbols in the thread execution code and the measured entropy, and interpolating the measured entropy. A computer-readable recording medium recording a program for performing the method of any one of claims 1 to 6.

Images