KR102478984B1 - Determine method for malicious file by linking with events in user terminal and system using them - Google Patents

Abstract

The present invention relates to a method for determining a malicious file by collecting security events occurring inside by linking various security equipment and SIEM with a PC and analyzing the PC that generated the event, and a system using the same. Step of generating security event analysis information by analyzing the security event of the terminal in the monitoring server, extracting the file event information including the event information of the PE file of the user terminal related to the security event analysis information with the monitoring agent installed in the user terminal, and monitoring it. Step of transmitting to the server, PE file in which security event analysis information and event information of the PE file are integrated in the monitoring server Step of generating integrated security data in which security event analysis information and file event information are integrated, PE by analyzing the integrated security data Determining whether a file is a malicious file and integrated security data are stored in chronological order in the monitoring server to create a past integrated security data group including past integrated security data consisting of past PE file security event analysis information and past file event information steps may be included.

Description

User terminal event-linked malicious file judgment method and system using the same

The present invention relates to a method for determining a malicious file linked to a user terminal event and a system using the same, and more particularly, to collect security events occurring internally by linking various security devices and SIEMs with a user terminal, and detecting the user who generated the event It relates to a method and system for determining malicious files such as malware by analyzing a terminal.

Security equipment plays a role in preventing threats within an organization in advance by detecting/blocking abnormal behavior in internal/external networks. SIEM (Security Information & Event Management) collects and analyzes events of various security devices to build a more systematic and rapid security system.

Conventionally, upon detecting anomalies in an internal user's PC through such a security system, a security officer manually analyzes the PC and diagnoses whether or not there is a threat.

However, such manual analysis has a problem in that it requires a lot of specialized manpower and time due to analysis time delay factors due to geographical limitations and non-reproducible factors related to one-time activities.

Republic of Korea Patent No. 10-1414084 (registered on June 25, 2014)

The present invention has been devised to solve the above problems, and the present invention collects security events occurring inside by linking various security devices and SIEMs with user terminals, and analyzes the user terminal that generated the event to detect malware. An object of the present invention is to provide a user terminal event-linked malicious file determination method and a system using the same.

In order to solve the above problems, the user terminal event-linked malicious file determination method of the present invention analyzes the security event of the user terminal in a monitoring server to generate security event analysis information, PE of the user terminal related to the security event analysis information Extracting file event information including file event information with a monitoring agent installed in the user terminal and transmitting it to the monitoring server, PE file security event analysis information in which security event analysis information and PE file event information are integrated in the monitoring server, and The step of generating integrated security data in which file event information is integrated, the step of analyzing the integrated security data to determine whether the PE file is a malicious file, and the integrated security data is stored in chronological order in the monitoring server, so that past PE file security event analysis information and It may include generating a past integrated security data group including past integrated security data composed of past file event information.

In addition, the user terminal event-linked malicious file determination system of the present invention includes a security event information collection unit for collecting user terminal-related security event information, and event information of a PE file of the user terminal installed in the user terminal and related to security event analysis information. Security event analysis information is generated by analyzing the security event information of the surveillance agent unit that collects the stored file event information and the security event information collection unit, and PE file security event analysis information and It may include a monitoring server unit that generates integrated security data in which file event information is integrated, and a malicious file determining unit that analyzes the integrated security data generated by the monitoring server unit and determines whether the PE file is a malicious file.

The method for judging a malicious file linked to a user terminal event according to the present invention can facilitate the analysis and determination of a malicious file as it operates in conjunction with a user terminal instead of manual analysis by a security officer. That is, the user terminal event-linked malicious file determination method of the present invention collects security events occurring internally by linking various security equipment and SIEM with the user terminal, analyzes the user terminal that generated the event, and determines the malicious file. can

1 is a diagram schematically illustrating a configuration in which a user terminal event-linked malicious file determination system according to an embodiment of the present invention is connected to a user terminal through a network.
2 is a diagram schematically illustrating the configuration of a user terminal event-linked malicious file determination system according to an embodiment of the present invention.
3 is a flowchart illustrating a method for determining a malicious file linked to a user terminal event according to an embodiment of the present invention.
FIG. 4 is a flowchart illustrating some steps of the method of determining a malicious file linked to a user terminal event of FIG. 3 .

Advantages and features of the present invention, and methods of achieving them, will become clear with reference to the detailed description of the following embodiments taken in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various different forms, only these embodiments make the disclosure of the present invention complete, and common knowledge in the art to which the present invention belongs. It is provided to fully inform the holder of the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numbers designate like elements throughout the specification.

Although first, second, etc. are used to describe various elements, components and/or sections, it is needless to say that these elements, components and/or sections are not limited by these terms. These terms are only used to distinguish one element, component or section from another element, component or section. Accordingly, it goes without saying that the first element, first element, or first section referred to below may also be a second element, second element, or second section within the spirit of the present invention.

Terminology used herein is for describing the embodiments and is not intended to limit the present invention. In this specification, singular forms also include plural forms unless specifically stated otherwise in a phrase. As used in the specification, a referenced component, step, operation and/or element to "comprises" and/or "made of" refers to one or more other components, steps, operations and/or elements. Existence or additions are not excluded.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used in a meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless explicitly specifically defined.

At this time, it will be understood that like reference numerals designate like elements throughout the specification, and each configuration of process flow diagrams and combinations of flow diagrams can be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment, so that the instructions executed by the processor of the computer or other programmable data processing equipment are described in the flowchart configuration(s). It creates means to perform functions.

It should also be noted that in some alternative embodiments it is possible for the functions recited in the configurations to occur out of order. For example, two components shown in succession may in fact be performed substantially concurrently, or the components may sometimes be performed in reverse order depending on the function in question.

Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings.

1 is a diagram schematically illustrating a configuration in which a user terminal event-linked malicious file determination system according to an embodiment of the present invention is connected to a user terminal through a network. And, Figure 2 is a diagram schematically showing the configuration of a user terminal event-linked malicious file determination system according to an embodiment of the present invention.

Referring to FIGS. 1 and 2, the user terminal event-linked malicious file determination system 100 according to the present embodiment includes a security event information collection unit 110, a monitoring agent unit 120, a monitoring server unit 130 and A malicious file determination unit 140 may be included.

The security event information collecting unit 110 may collect security event information related to the user terminal. That is, security event information related to the user terminal may be collected in the security event information collection unit 110 through the monitoring agent unit 120 installed in the user terminal.

The monitoring agent unit 120 is installed in the user terminal and may collect file event information including event information of PE files (EXE, DLL, Drive, Object, etc.) of the user terminal related to security event analysis information.

The monitoring server unit 130 analyzes the security event information of the security event information collection unit 110 to generate security event analysis information, PE file security event analysis information and PE file security event analysis information in which the security event analysis information and event information of the PE file are integrated. Integrated security data in which file event information is integrated can be created.

The malicious file determination unit 140 may analyze integrated security data generated by the monitoring server unit 130 to determine whether the PE file is a malicious file.

Here, the security event information collection unit 110 includes a security information event management unit 111 that collects one or more of alert information, correlation information, and scenario-based information, and security equipment that collects one or more of user terminal-related detection and blocking event information. It may include a unit 112 and a packet mirroring unit 113 that collects packet mirroring information between the user terminal and the Internet and the server zone.

Also, the security event information collection unit 110 may extract and store event occurrence time, alarm name, source IP, source port, destination IP, destination pot information, and risk level from among the contents of the alarm information.

The malicious file determination unit 140 may include a malicious file suspicion report generation unit 141 .

If the PE file is not a malicious file, the malicious file suspicion report generation unit 141 determines whether the PE file is suspected of being a PE file and generates a malicious file suspicion report.

As a result, the user terminal event-linked malicious file determination system 100 according to the present embodiment can determine whether or not a malicious file is present in association with the user terminal.

3 and 4 are flowcharts schematically illustrating a method for determining a malicious file linked to a user terminal event according to an embodiment of the present invention.

Referring to FIG. 3 , the method for determining a malicious file linked to a user terminal event (S200) according to the present embodiment includes generating security event analysis information (S210), transmitting file event information to a monitoring server (S220), It may include generating integrated security data (S230), determining whether the PE file is a malicious file (S240), and creating a past integrated security data group (S250).

In the step of generating security event analysis information according to the present embodiment (S210), security event analysis information of the user terminal may be analyzed by the monitoring server to generate security event analysis information.

In the embodiment, the security event analysis information generated in the step of generating the security event analysis information (S210) includes the security information event information of the user terminal generated by the security information event management (SIEM) unit 111, the security equipment unit ( It may include one or more of detection and blocking event information of the user terminal generated in 112) and packet mirroring information between the user terminal and the Internet and the server zone.

That is, in the step of generating security event analysis information (S210), the monitoring server collects security events generated in the user terminal in order to analyze the security events.

First, in the step of generating security event analysis information (S210), the monitoring server uses an interlocking method such as DB Connection or open API for security information event information of the user terminal generated in the security information event management (SIEM) unit 111. Security information event information can be collected by linking with the server.

At this time, the security information event information of the user terminal may include one of single alert information, association alert information, and scenario-based alert information. Then, the monitoring server can extract and store the occurrence time, alarm name, source IP, source port, destination IP, destination port information and risk level from among the contents of these alarm information.

In addition, in the step of generating security event analysis information (S210), the monitoring server collects detection and blocking event information of the user terminal generated by the security equipment unit 112, such as IPS, Ddos, and Web Firewall (WAF; Web Application Fire/Wall) receives detection/blocking event logs generated from the security equipment unit 112 in the form of syslog, extracts occurrence time, alarm name, source IP, source port, destination IP, destination port information and risk level can be saved

And, in the step of generating security event analysis information (S210), the monitoring server collects packet mirroring information between the user terminal and the Internet and the server zone, through equipment between the user terminal and the Internet or between the user terminal and the server zone. Packets can be collected by mirroring. At this time, through the collected packets, it is possible to monitor BlackIP connection behavior of the user terminal and abnormal connection behavior of the server zone. When an access activity is discovered, the occurrence time, detection name, source IP, source port, destination IP, and destination port information are stored in memory.

Here, the information stored by the event analysis in the security information event management (SIEM) unit 111 and the security equipment unit 112, that is, security information event information and detection and blocking event information, is “SEDP”, which is an abbreviation of Security Event Data Preprocessing. , the information stored by mirroring analysis is named “MPAR”, which is an abbreviation of Mirror Packet Analysis Result, and the user terminal IP can be named “UIP”, which is an abbreviation of UserIP.

In the step of transmitting the file event information according to the present embodiment to the monitoring server (S220), the file event information including the event information of the PE file of the user terminal related to the security event analysis information is extracted and monitored by the monitoring agent installed in the user terminal. can be sent to the server. Here, the event information of the PE file may include the file name of the PE file, hash value (SHA256), and location information stored in the monitoring server.

In an embodiment, in the step of transmitting the file event information to the monitoring server (S220), the file event information may be transmitted to the monitoring server through the monitoring agent installed in the user terminal.

At this time, in the step of transmitting the file event information to the monitoring server (S220), the following functions may be performed by the monitoring agent. First, it stores all communication details generated by the user terminal, and then receives and executes commands from the monitoring server, and then monitors abnormal access behaviors from the user terminal to network equipment and communication between UIPs. Finally, the saved communication details and monitoring details can be compared, and matching information can be extracted and transmitted to the server.

Specifically, in the step of transmitting the file event information to the monitoring server (S220), the monitoring agent may store all communication details generated in the user terminal. At this time, the communication details may include all communication contents with the outside attempted by the PE file. Whenever a PE file attempts to connect, the occurrence time, PE file name, PE file path, PE file hash, source IP, source port, destination IP, and destination port information can be sequentially stored in each pair. Since a plurality of PE files may be involved in one connection attempt, event information of a plurality of PE files may be stored in a pair.

In addition, in the step of transmitting the file event information to the monitoring server (S220), the monitoring agent may receive a command from the monitoring server and perform it. At this time, the monitoring agent's command execution function can kill the corresponding process or logically block the network if UIP analyzes that a malicious file such as malware exists. Communication between monitoring server and monitoring agent is allowed even if communication is blocked by logical network. Here, permission of communication between monitoring server and monitoring agent is to release logical network blocking and corresponding process blocking if it is determined to be a false positive later.

And, in the step of transmitting the file event information to the monitoring server (S220), the monitoring agent can monitor the abnormal access behavior from the user terminal to the network equipment and the communication between the UIP. Here, the file event information may include one or more of abnormal connection event information between a user terminal and network equipment related to event information of a PE file, and connection event information between a user terminal and other user terminals.

At this time, in the step of transmitting the file event information to the monitoring server (S220), the monitoring agent stores the occurrence time, source IP, source port, destination IP, and destination port in memory when abnormal behavior on network equipment and communication between UIPs occur. It compares the monitoring details with the communication details that have previously saved all the communication details generated in the user terminal, extracts matching information, and transmits the extracted contents to the server. can be sent to the server.

In the step of generating integrated security data according to this embodiment (S230), integrated security data in which security event analysis information and PE file event information are integrated in the monitoring server is integrated with PE file security event analysis information and file event information. can do.

In the embodiment, the PE file security event analysis information generated in the step of generating integrated security data (S230) is PE file security information event information in which security information event information and event information of the PE file are integrated, detection and blocking event information and PE file detection and blocking event information combined with PE file event information and PE file packet mirroring information combined with packet mirroring information and PE file event information.

Here, in the step of generating integrated security data (S230), a UIP is obtained whenever new content is added to SEDP and MPAR, which are security event analysis information, in the monitoring server, and communication details, source IP, and source port are obtained from the monitoring agent of the corresponding UIP , it asks to see if there is a match with the destination IP and destination port information, and receives the event information of the PE file matched with the request. The contents of SEDP and MPAR are integrated with the event information of the received PE file and stored. The event information of the PE file can be composed of the file name, hash value (SHA256), and location information on the monitoring server that stores the file transmitted from the monitoring agent. The stored information can be named “PE_SEDP” and “PE_MPAR” with the event information of the PE file added to SEDP and MPAR. That is, PE_SEDP may include PE file security information event information and PE file detection and blocking event information, and PE_MPAR may include PE file packet mirroring information.

In this way, in the step of generating integrated security data (S230), the monitoring server integrates four contents: PE_SEDP information, PE_MPAR information, communication details related to abnormal access behavior of network equipment sent from the monitoring agent, and communication details between user terminals and can be stored as integrated security data. At this time, the information of four integrated integrated security data can be named “ISD”, an abbreviation of Integrated Security Data.

In the step of determining whether the PE file is a malicious file according to this embodiment (S240), it is possible to determine whether the PE file is a malicious file by analyzing integrated security data. At this time, in the step of determining whether the PE file is a malicious file (S240), the monitoring agent may determine a malicious file by sending the PE file stored in the ISD to a static/dynamic analyzer when an event occurs. The static/dynamic analyzer functioning as such a malicious file determination unit may be built in the monitoring server or may be built and operated as a separate server. For example, as a dynamic analyzer used in this embodiment, Cuckoo Sandbox for dynamic analysis of malicious files based on a monitoring agent can be used.

In the step of generating a past integrated security data group according to this embodiment (S250), integrated security data is stored in chronological order in the monitoring server, including past integrated security data consisting of past PE file security event analysis information and past file event information. Past integrated security data group can be created.

On the other hand, according to this embodiment, in the step of determining whether the PE file is a malicious file (S240), if the PE file is determined to be a malicious file, the monitoring server tells the user terminal to stop executing the PE file or stop the user terminal network. In can instruct the monitoring agent of the user terminal.

In contrast, when it is determined that the PE file is not a malicious file, according to the present embodiment, the step of determining whether the PE file is a malicious file (S240) is the step of determining a time interval as shown in FIG. 4 ( S241), counting past PE file security event analysis information and past file event information (S242), comparing hash values of past PE files (S243), and generating a suspicious malicious file report (S244). can

In the step of determining the time interval according to the present embodiment (S241), the monitoring server may determine a time interval between the malicious file analysis start time and the past time. At this time, in the step of determining the time interval (S241), a time interval from the current time to an arbitrary past time may be determined for ISD analysis of a specific time band. For example, a time interval of a past time up to 20 minutes prior to the current time may be set.

In the step of counting past PE file security event analysis information and past file event information according to this embodiment (S242), at least one of the past PE file security event analysis information and past file event information is several times in the time interval in the past integrated security data group. Can count if a dog has been created. At this time, in the step of counting the past PE file security event analysis information and past file event information (S242), the monitoring agent extracts only the contents corresponding to the set time interval from the ISD, which is integrated security data, and can divide it into two pieces of information. The first is information related to the security information event management (SIEM) unit, and the second may be content related to security equipment events and abnormal network access behaviors. Two count statistics can be created based on UIP for each of the two categories.

Here, the past PE file security event analysis information includes past security information event information of the user terminal generated by the security information event management (SIEM) unit, past detection and blocking event information of the user terminal generated by the security equipment unit 112, and It may include one or more of past packet mirroring information between the user terminal and the Internet and server zone.

In this case, the past file event information may include one or more of past abnormal connection event information between a user terminal and network equipment related to event information of a past PE file, and past access event information between a user terminal and other user terminals.

For example, events occurring in a specific time band for each user terminal may include a SIEM event, an IPS event, a WebF/W event, a Ddos event, a BlackIP access event, an abnormal server zone access event, and an abnormal network access event.

Table 1 below is a table showing statistics of an exemplary event that occurred in a specific time band in a user terminal.

number detection item count One SIEM events 2 2 IPS event One 3 Web F/W event 0 4 DDos event 0 5 BlackIP Access Event 2 6 Server zone abnormal access event 0 7 Network abnormal access event One

In the step of comparing hash values of past PE files according to this embodiment (S243), if the number of generation of one or more of past PE file security event analysis information and past file event information in the time interval is two or more, two or more past PE files Hash values of two or more past PE files related to file security event analysis information and/or past file event information may be compared. At this time, in the step of comparing hash values of past PE files (S243), a UIP having a count of K or more may be obtained from two count statistics, and data may be extracted from ISD under the condition that both the time interval and the UIP are satisfied. K is divided into K1 and K2. K1 is used in the first count statistics in the step of counting past PE file security event analysis information and past file event information (S242), and K2 value is used in second count statistics. In addition, K1 and K2 are constants equal to or greater than “2” and may be set to different values by an administrator. , events of the remaining items may be set to K2.

And, in the step of comparing hash values of past PE files (S243), ISD data having the same hash value equal to or greater than the Z value can be extracted from among the extracted contents. Z is a redundant constant of hash value, and can have a value of “2” or more, and the value can be set differently by the administrator.

Table 2 below is an example of extracting only the part related to the security information event management (SIEM) unit of a specific time band from Integrated Security Data (ISD), which is integrated security data.

In addition, Table 3 below is an example of extracting only events and network abnormal behaviors generated in the security equipment unit 112 in a specific time band from Integrated Security Data (ISD), which is integrated security data.

As in Table 2 above, the sum of SIPs (or checksums) in item K1, that is, the number of collections (three times) is greater than or equal to “2”, which is an integer determined by the manager, and similarly, as in Table 3 above, in item K2 Since the sum of SIPs (or checksums), that is, the number of collections (three times) is more than “2”, which is an integer determined by the administrator, in each case, duplicate counts of two or more PE hash values were collected, and the comparison of the collected files was performed. You can classify the file as a suspicious file.

In the step of generating a suspected malicious file report (S244) according to the present embodiment, a suspected malicious file report may be generated for a past PE file having the same hash value among two or more past PE files. At this time, the contents of the ISD data may be output in the form of a suspicious file report so that a security officer can perform various analyses.

Therefore, the user terminal event-linked malicious file determination method (S200) according to the present embodiment can determine a malicious file from security event information generated in the user terminal in conjunction with the user terminal.

In addition, according to the user terminal event-linked malicious file determination method (S200) according to the present embodiment, even if a PE file is determined to be not a malicious file, the corresponding file can be classified as a suspicious file and managed through comparison with past PE files. Therefore, the risk caused by malicious files can be prevented.

On the other hand, the user terminal event-linked malicious file determination method (S200) according to an embodiment of the present invention can be implemented as a single module by software and hardware, and the above-described embodiments of the present invention are written as programs that can be executed on a computer. It is possible and can be implemented in a general-purpose computer that operates the program using a computer-readable recording medium. The computer-readable recording medium is implemented in the form of a magnetic medium such as a ROM, floppy disk, and hard disk, an optical medium such as CD and DVD, and a carrier wave such as transmission through the Internet. In addition, computer-readable recording media may be distributed to computer systems connected through a network to store and execute computer-readable codes in a distributed manner.

In addition, the components used in the embodiments of the present invention are software such as tasks, classes, subroutines, processes, objects, execution threads, programs, or FPGAs performed in a predetermined area on the memory. It may be implemented in hardware such as a field-programmable gate array (ASIC) or an application-specific integrated circuit (ASIC), or a combination of the above software and hardware. The components or '~unit' may be included in a computer-readable storage medium, or some of them may be distributed and distributed to a plurality of computers.

Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art to which the present invention pertains can be implemented in other specific forms without changing the technical spirit or essential features of the present invention. you will be able to understand Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting.

100: Malicious file determination system linked with user terminal events
110: security event information collection unit 111: security information event management unit
112: security equipment unit 113: packet mirroring unit
Reference Numerals 120: monitoring agent unit 130: monitoring server unit 140: malicious file determination unit 141: malicious file suspicion report generation unit

Claims (11)

generating security event analysis information by analyzing a security event of a user terminal in a monitoring server;
Extracting file event information including event information of a PE file of the user terminal related to the security event analysis information with a monitoring agent installed in the user terminal and transmitting the extracted file event information to the monitoring server;
generating PE file security event analysis information in which the security event analysis information and event information of the PE file are integrated and integrated security data in which the file event information is integrated in the monitoring server;
analyzing the integrated security data to determine whether the PE file is a malicious file; and
Storing the integrated security data in chronological order in the monitoring server to generate a past integrated security data group including past integrated security data consisting of past PE file security event analysis information and past file event information,
The security event analysis information,
Security information event information of the user terminal generated by the security information event management (SIEM) unit, detection and blocking event information of the user terminal generated by the security equipment unit, and the user terminal and the Internet and server zone generated by the packet mirroring unit Includes one or more of packet mirroring information between
The PE file security event analysis information,
PE file security information event information in which the security information event information and event information of the PE file are integrated, PE file detection and blocking event information in which the detection and blocking event information and event information of the PE file are integrated, and the packet mirroring information and one or more of PE file packet mirroring information in which event information of the PE file is integrated,
The file event information,
The method of determining a user terminal event-linked malicious file further comprising at least one of event information of the PE file, abnormal connection event information between the user terminal and network equipment, and connection event information between the user terminal and other user terminals. delete delete delete According to claim 1,
Event information of the PE file,
A method for determining a user terminal event-linked malicious file including the file name of the PE file, hash value (SHA256), and location information stored in the monitoring server. According to claim 1,
In the step of determining whether the PE file is a malicious file,
If the PE file is determined to be a malicious file, the monitoring server instructs the monitoring agent of the user terminal to stop execution of the PE file or stop the network of the user terminal; A method for judging malicious files linked to terminal events. According to claim 1,
In the step of determining whether the PE file is a malicious file, if it is determined that the PE file is not a malicious file,
determining a time interval between the malicious file analysis start time and the past time in the monitoring server;
counting how many of one or more of the past PE file security event analysis information and the past file event information were generated in the time interval in the past integrated security data group;
If the generation number of at least one of the past PE file security event analysis information and the past file event information is two or more in the time interval, the two or more past PE file security event analysis information and/or the past file event information Comparing hash values of two or more related past PE files; and
Generating a malicious file suspicion report for a past PE file having the same Hash value among the two or more past PE files; According to claim 7,
The past PE file security event analysis information,
Past security information event information of the user terminal generated by the security information event management (SIEM) unit, past detection and blocking event information of the user terminal generated by the security equipment unit, and past information between the user terminal and the Internet and the server zone includes one or more of packet mirroring information;
The past file event information,
A method of determining a user terminal event-linked malicious file including at least one of past abnormal access event information between the user terminal and network equipment related to the event information of the past PE file and past access event information between the user terminal and other user terminals. a security event information collection unit for collecting user terminal-related security event information;
a monitoring agent unit installed in the user terminal to collect file event information including event information of the PE file of the user terminal related to security event analysis information;
The security event information collection unit analyzes the security event information to generate the security event analysis information, and the PE file security event analysis information and the file event information in which the security event analysis information and event information of the PE file are integrated are integrated. a monitoring server unit that generates integrated security data; and
A malicious file determination unit that analyzes the integrated security data generated by the monitoring server unit and determines whether the PE file is a malicious file;
The security event analysis information,
Among the security information event information of the user terminal generated by the security information event management (SIEM) unit, detection and blocking event information of the user terminal generated by the security equipment unit, and packet mirroring information between the user terminal and the Internet and the server zone, contain one or more;
The PE file security event analysis information,
PE file security information event information in which the security information event information and event information of the PE file are integrated, PE file detection and blocking event information in which the detection and blocking event information and event information of the PE file are integrated, and the packet mirroring information and one or more of PE file packet mirroring information in which event information of the PE file is integrated,
The file event information,
The user terminal event interlocking malicious file determination system further comprising at least one of event information of the PE file, abnormal connection event information between the user terminal and network equipment, and connection event information between the user terminal and other user terminals. According to claim 9,
The security event information collection unit,
A security information event management unit that collects at least one of alarm information, correlation information, and scenario-based information, a security equipment unit that collects at least one of detection and blocking event information related to the user terminal, and packets between the user terminal and the Internet and the server zone A system for determining malicious files linked to user terminal events, including a packet mirroring unit that collects mirroring information. According to claim 9,
The malicious file determination unit,
If the PE file is not a malicious file, a malicious file determination system linked with a user terminal event including a malicious file suspicion report generator for determining whether the PE file is suspected of being the PE file and generating a malicious file suspicion report.

Images