KR102426504B1 - System and method for detecting malicious code - Google Patents

Abstract

The present invention relates to a malicious code diagnosis system for diagnosing whether a file to be diagnosed is infected with malicious code, and the system for diagnosing a malicious code sequentially extracts behavior information on an action executed in each process of a file to be diagnosed in blocks of a specific size. Thus, one or more user terminals that sequentially transmit the extracted block-by-block behavior information block to the diagnosis server, and the behavior information block received from the user terminal are combined with the previously received behavior information block for the combined behavior information block It consists of a diagnostic server that diagnoses whether or not a malicious code is infected.

Description

Malware diagnosis system and method

The present invention relates to a malicious code diagnosis system and a diagnostic method for diagnosing whether a computer file is infected with malicious code.

A personal computer, general purpose computer, or mobile communication terminal, etc. (hereinafter referred to as this In the specification, they are collectively referred to as “user terminals”) and the damage caused by so-called malicious codes such as network traffic generation, system performance degradation, file deletion, and personal information leakage is rapidly increasing, and accompanying this, malicious code of files Malicious code diagnosis technology for diagnosing infection is also developing in various forms.

As one of such malicious code diagnosis technologies, the malicious code is executed on a separate virtual machine or hardware to extract behavior information for a set period of time to determine which files are actually infected with the malicious code (hereafter simply “Malware Code”). There is a known method of diagnosing (sometimes referred to as "infection or not") (hereinafter, simply referred to as "diagnosis of whether or not a malicious code is infected") (for example, Patent Document 1).

However, according to these conventional methods, a separate virtual machine or hardware is required for diagnosing whether a file is infected with a malicious code, and in order to extract behavior information for diagnosing whether a file is infected with a malicious code, machine) or hardware, the entire file that needs to be diagnosed with malicious code to be executed must be transmitted to the diagnosis server, and the diagnosis server executes the entire received file on a virtual machine or hardware, Since it is necessary to diagnose whether or not the code is infected and the result is fed back to the user terminal, it takes a considerable amount of time to diagnose whether or not the malicious code is infected.

Registered Patent No. 10-1880686 Publication (2018. 07. 20. Announcement)

The present invention has been made in view of the above problems of the prior art, and the terminal specifies behavior information for each process of a diagnosis target file (hereinafter, simply referred to as "diagnosis target file") requiring a diagnosis of whether or not a malicious code is infected. It is extracted and maintained in block units, and if the extracted behavior information block contains an action satisfying the malicious behavior diagnosis requirements, the behavior information block is transmitted to the diagnosis server, and the diagnosis server transmits the behavior information block received from the terminal before. The purpose of the present invention is to provide a malicious code diagnosis system and diagnosis method that can reduce the diagnosis time to as close as possible to real-time diagnosis by allowing the diagnosis of malicious code infection in combination with the received behavior information block.

The malicious code detection system for solving the above problem is a malicious code diagnosis system for diagnosing whether a file to be diagnosed is infected with malicious code. One or more steps for sequentially generating behavior information blocks by extracting them, and sequentially transmitting behavior information blocks including behaviors corresponding to the malicious behavior diagnosis requirements set in advance in at least one behavior among the behaviors in the generated behavior information blocks to the diagnosis server and a user terminal and a diagnosis server that combines the behavior information block received from the user terminal with the previously received behavior information block, and diagnoses whether the combined behavior information block is infected with malicious code.

In addition, the malicious code detection method for solving the above problem is a malicious code diagnosis method for diagnosing whether a diagnosis target file executed in the user terminal is infected with a malicious code by a diagnostic system comprising a user terminal and a diagnostic server, wherein the user terminal monitors the system API of the diagnosis target file, and when the system API is monitored, blocks the monitored system API in a predetermined unit to sequentially generate behavior information blocks, and whenever the behavior information blocks are generated, the generated behavior information It is determined whether at least one of the actions in the block includes an action corresponding to a preset malicious behavior diagnosis requirement, and a behavior information block including an action corresponding to the preset malicious behavior diagnosis requirement is sent to the diagnosis server to request a diagnosis of malicious code infection, and the diagnosis server generates a combined behavior information block by combining the received behavior information block with the previously received behavior information block when the behavior information block is received from the user terminal, , to diagnose whether the malicious code is infected with the combined behavior information block.

According to the present invention, the process of the diagnosis target file executed in the user terminal is blocked in units of behavior information blocks of a certain unit, and whenever a behavior information block is generated, it is combined with the previously generated behavior information block to diagnose whether a malicious code is infected. Since it is designed to execute the diagnosis, it is possible to shorten the diagnosis time to the extent that it is close to real-time diagnosis.

1 is a system block diagram showing a schematic configuration of a malicious code diagnosis system according to a preferred embodiment of the present invention;
2 is a block diagram showing the configuration of a user terminal;
3 is a block diagram showing the configuration of a detection server;
4 is a flowchart showing the flow of a malicious code diagnosis method according to a preferred embodiment of the present invention.

Hereinafter, a malicious code diagnosis system and a diagnosis method according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

First, the configuration of a malicious code diagnosis system according to a preferred embodiment of the present invention will be described with reference to FIGS. 1 to 3 . Fig. 1 is a system block diagram showing the schematic configuration of a malicious code diagnosis system according to a preferred embodiment of the present invention, Fig. 2 is a block diagram showing the configuration of a user terminal, and Fig. 3 is a block diagram showing the configuration of a detection server.

As shown in FIG. 1 , in the malicious code diagnosis system according to the preferred embodiment of the present invention, one or more user terminals 10 are communicatively connected to the diagnosis server 30 via a communication network 50 .

The user terminal 10 may be a personal computer such as a desktop or a laptop computer, a general purpose computer used for office, scientific or control purposes, or, for example, a mobile communication terminal such as a smartphone, etc. , in the present invention, one or more diagnosis target files, which are the target of diagnosing whether or not a malicious code is infected, are stored in a storage device. However, the diagnosis target file is not limited to the file stored in the storage device of the user terminal 10, for example, including a file input to the user terminal 10 from the outside such as e-mail, etc. in the user terminal 10 Any file that is executed can be a target file for diagnosis. In addition, in this specification, a file is used in the sense of including both a program file and a data file.

As shown in FIG. 2 , the user terminal 10 is a place where a diagnosis target file, which is a target of diagnosing whether or not a malicious code is infected, is executed, and is executed in each process such as, for example, opening of a certain program, network communication, execution, etc. Behavior information related to a given behavior is sequentially extracted and managed in blocks of a specific size, and if any one or more behaviors in the extracted behavior information block contain an behavior satisfying a specific condition, the behavior information block is described later. transmitted to the server 30 .

To this end, the user terminal 10 includes a real-time process behavior tracking unit 11 . The real-time process behavior tracking unit 11 provides various behavioral information about a process executed in the user terminal 10 (eg, a system API (application programming interface: system call and system library API, etc.) for process n of FIG. 2 ). ), and blocks the monitored behavior information in a predetermined unit and maintains it in the form of a queue in the memory (not shown) of the user terminal 10 .

Here, the behavior information is the order and number of calls of a system API (system application programming interface: system call and system library API, etc.) provided by an operating system (OS) to execute (operate) a certain program in the user terminal 10 . Alternatively, it refers to the execution of a new program or output (eg, malicious code infection, data generation, etc.) made in connection with the execution (operation) of the program.

In addition, the real-time process behavior tracking unit 11 transmits the extracted behavior information block to the diagnosis server 30 for diagnosing whether the malicious code is infected among the blocked behavior information (hereinafter referred to as “malicious behavior diagnosis requirements”). In some cases), if the corresponding action is included, the action information block is transmitted to the diagnosis server 30 through the communication network 50 .

To this end, the real-time process behavior tracking unit 11 determines whether an action corresponding to the malicious behavior diagnosis requirement is included in the blocked behavior information whenever one block is monitored, and the malicious behavior diagnosis requirement in the blocked behavior information If the corresponding action is included, the block is transmitted to the diagnosis server 30 .

2 shows an example in which the behavior information of process n is block according to the order, and among the behavior information of process n, behaviors (system API) A-B-C are shown in blocks 1, ... , actions U-V-W are block m-1 and actions X-Y-Z are block m, respectively. In addition, in the example shown in FIG. 2 , the actions indicated in red, that is, in block 1, among actions A, B, and C, C marked in red, action W in block m-1, and action Z in block m, respectively, are diagnostic requirements for malicious behavior. It is considered to be an act corresponding to

The behavior corresponding to the malicious behavior diagnosis requirement may be appropriately set by empirical rules, and the malicious behavior diagnosis requirement in the Windows OS may be, for example, the behaviors shown in Table 1 below.

division System API
Process NtCreateProcess
NtOpenProcess
NtTerminateProcess
… Thread NtCreateThread
NtTerminateThread
NtSuspendThread
… Memory NtAllocateVirtualMemory
NtReadVirtualMemory
NtWriteVirtualMemory
… File NtCreateFile
NtDeleteFile
NtWriteFile
NtDeleteFile
… Registry NtCreateKey
NtDeleteKey
NtSetValueKey
… Network WSASocket
WSAConnect
WSASend
WSARecv
… Service CreateService
DeleteService
StartService
… Etc LoadLibrary
…

Summarizing the operation of the user terminal 10, the real-time process behavior tracking unit 11 performs a series of actions (eg, A-B-C … U-V-W-X-Y-Z) that are sequentially executed according to, for example, the execution of process n among the processes of the file to be diagnosed. is blocked in a certain unit (block 1, ..., block m-1, block m in Fig. 2) according to the order in which each action is performed, and maintained and managed in the form of a queue, and at the same time, malicious actions are recorded in individual blocks of the blocked action information. It is judged whether an act corresponding to the diagnostic requirement is included. In block 1 of the example of Figure 2, act C, ... , block m-1 includes the W action and block m includes the Z action, so the real-time process behavior tracking unit 11 transmits block 1 to the diagnosis server 30 when block 1 is blocked, ... , when block m-1 is completed, block m-1 is transmitted to the diagnosis server 30, and, likewise, when block m is completed, block m is transmitted to the diagnosis server 30. At this time, the user terminal 10 may discard the behavior information block transmitted to the diagnosis server 30, or may store and maintain it in its own storage device.

In addition, the real-time process behavior tracking unit 11 may also transmit static information such as memory information, file information, and factor information for the behavior information (these information is dynamic information) transmitted when the behavior information block is transmitted. By doing this together, it is possible to more easily diagnose whether the malicious code is infected by the diagnostic server 30 .

The diagnosis server 30 maintains and manages block-based behavior information transmitted from the user terminal 10 and, in combination with previously transmitted behavior information, diagnoses whether or not a malicious code is infected.

To this end, the diagnosis server 30 includes a behavior information block combination unit 31 , a behavior information processing unit 33 , and a diagnosis unit 35 .

The behavior information block combination unit 31 records and maintains the behavior information block received from the real-time process behavior tracking unit 11 of the user terminal 10 in a storage device such as a memory not shown, and at the same time, the previously received In combination with the action information block, the combined action information is sent to the action information processing unit 33 .

Maintenance of the received behavior information block is performed, for example, for each terminal, for each process of each terminal, and also with reference to static information such as memory information, file information, and factor information. Therefore, by using these information when combining the behavior information blocks, it is possible to easily identify the behavior information block to be combined is the behavior information for which process of which terminal.

The behavior information processing unit 33 processes the combined behavior information block received from the behavior information block combination unit 31 so that it is easy to diagnose whether or not the malicious code is infected, and sends the processed behavior information block to the diagnosis unit 35 .

The processing of behavioral information, that is, data preprocessing, is a process of replacing existing data with data suitable for a machine learning algorithm, and the performance of model learning can be further improved through this data preprocessing process.

For details of the data preprocessing process, see 「Data Preprocessing for Efficient Machine Learning」, Donghyun Kim et al., Proceedings of the Winter Conference of the Korean Society of Computer Information and Information Science, Vol. 27 No. 1, 2019. 1. and 「Machine Learning (3)-Data Preprocessing」 , https://davinci-ai.tistory.com/15 may be referred to, and detailed descriptions are omitted herein.

The diagnosis unit 35 uses the combined behavior information block received from the behavior information processing unit 33 to diagnose whether a malicious code is infected, and transmits the diagnosis result to the user terminal 10 . The diagnosis method by the diagnosis unit 35 may use a known method, and detailed description of the diagnosis method for diagnosing whether or not a malicious code is infected will be omitted herein.

The communication network 50 may be either a wired communication network or a wireless communication network as long as the communication network 50 connects the user terminal 10 and the diagnosis server 30 to each other in a communicable manner.

In the process of diagnosing whether or not a malicious code has been infected according to the present invention, the real-time process behavior tracking unit 11 of the user terminal 10 generates each individual behavior information block in the order in which the behavior information block is generated. It is transmitted to the action information block combination unit 31 of (30).

In addition, the combination of the behavior information block by the behavior information block combination unit 31 of the diagnosis server 30 is made every time a behavior information block is received from the user terminal 10, and also the behavior information processing unit 33 The processing (data pre-processing) by is performed whenever the behavior information processing unit 33 receives the combined behavior information block from the behavior information block combination unit 31 . In addition, the diagnosis of malicious code infection by the diagnosis unit 35 is also performed whenever the diagnosis unit 35 receives the processed behavior information block from the behavior information processing unit 33, and the diagnosis result of the user terminal 10 The transfer to the diagnosing unit 35 is also performed whenever a diagnosis is made by the diagnosis unit 35 .

Therefore, according to the present invention, it is possible to quickly diagnose malicious code close to real time.

Next, a method for diagnosing whether a malicious code is infected by a malicious code diagnosis system according to a preferred embodiment of the present invention will be described. 4 is a flowchart showing the flow of a malicious code diagnosis method according to a preferred embodiment of the present invention.

First, in step S11, the real-time process behavior tracking unit 11 of the user terminal 10 monitors the system API of the process of the file to be diagnosed. As a result, when the system API is monitored, the system API is blocked in a predetermined unit in step S12. Create a behavior information block. Subsequently, the process proceeds to step S13 and stores the blocked behavior information block in the form of a queue in the user terminal 10 .

Subsequently, in step S14, the real-time process behavior tracking unit 11 transmits the behavior information block to the diagnosis server 30 to diagnose malicious behavior in the behavior information block to request a malicious code diagnosis (hereinafter simply referred to as “malicious code”). Behavior diagnosis requirements”), for example, it is judged whether any of the requirements in Table 1 is included If an action is included (step S14 = YES), the real-time process action tracking unit 11 transmits the action information block to the action information block combination unit 31 of the diagnosis server 30 to request a diagnosis of malicious code infection. .

If, as a result of the determination in step S14, the system API satisfying the malicious behavior diagnosis requirement is not included in the behavior information block (step S14 = NO), the operation of the system API included in the behavior information block is allowed (step S15) The flow returns to step S11 to execute the following operations.

The behavior information block combination unit 31 of the diagnosis server 30 receives a malicious code infection diagnosis request from the real-time process behavior tracking unit 11 of the user terminal 10 in step S21, and stores the received behavior information block Save it to your device. In addition, if there is an action information block received for the same process from the same terminal before the diagnosis request in step S21, the action information block combination unit 31 includes the action information block previously received in step S22 and the action information received in step S21. Blocks are combined to create a combined behavior information block.

For example, in step S21, the behavior information block combination unit 31 receives the behavior information block m for the process n of FIG. 2 from the real-time process behavior tracking unit 11 of the user terminal 10, thereby requesting a diagnosis of malicious code infection. If there is an action information block 1 and an action information block m-1 for process n received from the user terminal 10, which is the same terminal, before that, in step S21, the action information block combination unit 31 is the user By combining the action information block m received from the terminal 10 with the previously received action information block 1 and action information block m-1, "action information block 1 (A-B-C) + action information block m-1 (U-V-W) + action A combined behavior information block such as 'information block m(X-Y-Z)' is generated and transferred to the behavior information processing unit 33 .

Next, in step S23 , the behavior information processing unit 33 processes the combined behavior information block to be suitable for diagnosing whether or not a malicious code is infected and passes it over to the diagnosis unit 35 . The method of processing the combined behavior information block to be suitable for diagnosing whether or not a malicious code is infected is the same as described above.

Subsequently, in step S24 , the diagnosis unit 35 diagnoses whether the combined behavior information block handed over from the behavior information processing unit 33 is infected with a malicious code, and transmits the diagnosis result to the user terminal 10 (step S24 ). S25).

Next, in step S31, the diagnosis result transmitted from the diagnosis unit 35 of the diagnosis server 30 is received, and in step S32, the user terminal 10 determines that the diagnosis result received from the diagnosis unit 35 is "Malware infection" (step S32 = YES), the process proceeds to step S33 to block the infected system API. to allow execution of system APIs that are not infected with malicious code.

The malicious code diagnosis system of the present invention may repeat the above routine until the diagnosis of the entire file to be diagnosed is completed. it can be done as

As mentioned above, although preferred embodiment of this invention was described, this invention is not limited to the said embodiment, and various changes or deformation|transformation are possible within the scope of the invention described in the claims.

10 user terminal
11 Real-time process behavior tracking unit
30 Diagnostic Server
31 Behavior information block combination unit
33 Behavior Information Processing Department
35 diagnostics
50 network

Claims (6)

It is a malicious code diagnosis system that diagnoses whether the target file is infected with malicious code,
Behavior information on the behavior executed in each process of the diagnosis target file is extracted in blocks of a specific size to sequentially generate behavior information blocks, and a malicious behavior preset to at least one behavior among the behaviors in the generated behavior information block One or more user terminals that sequentially transmit behavior information blocks including behaviors corresponding to the diagnostic requirements to the diagnostic server;
and a diagnosis server that combines the behavior information block received from the user terminal with the previously received behavior information block and diagnoses whether the combined behavior information block is infected with malicious code. delete The method according to claim 1,
The diagnosis server is a malicious code diagnosis system that processes the combined behavior information block to facilitate the diagnosis of whether or not the malicious code is infected prior to diagnosing whether the malicious code is infected. A malicious code diagnosis method for diagnosing whether a file to be diagnosed is infected with a malicious code, which is executed in the user terminal, by a diagnostic system comprising a user terminal and a diagnostic server,
The user terminal is
monitoring the system API of the diagnosis target file,
When the system API is monitored, the monitored system API is blocked in a certain unit to sequentially generate behavior information blocks,
Whenever the behavior information block is generated, it is determined whether at least one of the behaviors in the generated behavior information block includes an behavior corresponding to a preset malicious behavior diagnosis requirement, and corresponds to the preset malicious behavior diagnosis requirement. Sending the action information block containing the action to the diagnosis server to request a diagnosis of malicious code infection,
The diagnostic server,
When the action information block is received from the user terminal, the received action information block is combined with the previously received action information block to generate a combined action information block,
A malicious code diagnosis method for performing a diagnosis of whether the malicious code is infected with the combined behavior information block. delete 5. The method according to claim 4,
The diagnosis server processes the combined behavior information block prior to diagnosing whether the malicious code is infected so that it is easy to diagnose whether the malicious code is infected.

Images