KR20030021859A - System and Method for mailing warning message against the worm virus and anti-virus vaccine automatically against it via wireless networks - Google Patents

Abstract

PURPOSE: A method and system for automatically transmitting a wireless worm virus warning message is provided to cure a worm virus by chasing a transmission path of a corresponding worm virus and automatically transmitting a warning message and a worm vaccine with respect to the worm virus to a client wireless communication device located in the chased path when the worm virus is detected in a wire/wireless Internet or an electronic mail system initially. CONSTITUTION: If a worm vaccine is transmitted from a worm vaccine developer to a vaccine mailing service requester or the first worm virus infected person(1000), the worm vaccine blocks all jobs of a mail client program and starts a worm virus searching process(1005). If an objected new worm virus or a pre-existing other kind worm virus is found through the worm vaccine(1010), the worm vaccine extracts a transmission path of the corresponding worm virus(1015), removes a discovered all kinds of viruses(1020), and recovers a changed program as the original state(1025).

Description

System and Method for mailing warning message against the worm virus and anti-virus vaccine automatically against it via wireless networks}

According to the present invention, when a worm virus is first detected in a wired / wireless Internet or an e-mail system, the worm virus producer tracks the propagation path of the worm virus and alerts the worm virus to a client wireless communication device located in the tracking path. By automatically sending a message and a worm vaccine, the worm virus of the worm virus host client which has transmitted the worm virus to the system infected with the worm virus and the worm virus receiving client which has received the worm virus from the system infected with the worm virus A method and system for minimizing infection by the worm virus.

A worm is a piece of program or malicious code that moves between programs within a single computing system, or automatically replicates and propagates to different computing systems over a network. Often a worm is often confused with a computer virus, but the worm itself is not a computer virus.

A computer virus is a program that copies itself from an infected computer disk to another computer disk for malicious purposes. The purpose of a computer virus is to destroy information on an infected computer disk, to cause the system to crash, or to operate abnormally. It is. Therefore, a back door that accesses a specific computer and leaks information to the outside is not a computer virus.

A backdoor is a secret passage that removes system security for a particular computing system. It is designed to allow a system developer or service technician to access a system without formal procedures for debugging or maintaining the system. Unlike worms and viruses, backdoors are not intended for malicious purposes, and most backdoors are removed before the product is released. Of course, some products may be released without removing the backdoor to support future services, but even in this case, they are completely hidden from developers and service technicians for system maintenance.

However, the backdoors dealt with in the present invention are not the backdoors in the traditional sense, but are intended as malicious means used by an attacker who attacks the system to access the target system without any authentication process and no log record. As a backdoor of, it is automatically installed in the form of an agent on the target system and provides a way to leak system information to the outside or to allow a malicious attacker to access the target system at any time.

Worm virus is a type of virus that is a proper combination of worms, viruses, and backdoors, although there are some differences depending on the type. The worm virus is automatically spread to computers connected to the network through worms, It is a program or malicious code that infects a system by destroying it or causing it to operate abnormally, and then transmits the system information of the target system to a virus developer or makes it maliciously accessible through a back door. It is also called an email virus.

Today, the rapid spread of such worm viruses is due to the unity of infrastructure, the convenience of worm development, the increase of network access rate by a single communication mechanism, and the use of the same technology between companies and individuals. The explanation is as follows.

The unity of infrastructure is that nearly every computer in the world has the same structure, as companies that supply computer hardware and software become increasingly monopolized.

For example, most desktop computers around the world use the Windows operating system (Win3.1 / 95/98 / NT / 2000 / XP) supplied by Microsoft and Intel-compatible Central Processing Units (CPUs). Most of the workstations use the Solaris family of operating systems supplied by Sun Microsystems.

As a result, worm virus developers targeting desktop computers can infect 90% of the world's top desktop computers simply by developing a worm virus that runs on the Windows-based operating system supplied by Microsoft.

The convenience of worm development is that Microsoft has built a technology called COM (Common Object Model) on the Windows operating system (since the Win95 OSR version), making it easy to develop worm viruses without using advanced developers. .

COM is a sub-infrastructure for developing and supporting component objects in a program. It aims to provide a level of functionality defined by the Common Object Request Broker Architecture (COBA). Judgment, licenses, event services, etc. In other words, worm virus developers can easily develop programs that can manipulate the system without using the system programming of the infrastructure through COM used in the Windows operating system.

For example, worm virus developers can use COM to easily create macros that can automatically send emails through Outlook without any expertise in Microsoft's Outlook or email structure.

Increasing network access rates with a single communication mechanism means that the majority of Internet users access the Internet or e-mail through the same mechanism, which can propagate the worm virus to millions of Internet users around the world in a matter of seconds. Is there.

Most Internet users who access the Internet or e-mail use COM-based communication mechanisms. COM provides convenience to worm virus developers, but the same structure of COM provides a way to rapidly spread worm viruses. do. In some cases, a mail server of a client infected with a worm virus may crash or crash the system due to an email transmission request automatically generated by the worm in the mail client.

The use of the same technology between a company and an individual means that the worm virus spreads regardless of the company or individual, especially when the worm virus is spread through a customer address book stored in the company, its destructive power and speed of spread are beyond imagination. .

1 is a simple block diagram of a worm virus consisting of a virus, a worm, and a backdoor.

Worm viruses that target desktop computers are written in high-level languages, such as Visual C ++ or Visual Basic, which can be programmed based on COM. Most worm viruses are executable files in the form of mail messages or EXEs. Or in the form of an attachment such as a script in VBS format. This is very different from existing viruses written primarily in Low Level Languages, such as Assembly Language. In other words, the worm virus is not only easy and simple to produce, but also means that the destructive power is huge compared to the existing virus.

Worm viruses are slightly different depending on the type, but they basically consist of viruses, worms, and back doors. These worm virus components are not divided into independent modules, but are classified according to the function of the worm virus.

Because the virus of the worm virus is written in a high-level language based on COM, unlike the traditional virus that infects the entry code part of a file, it intelligently places a JTV (Jump To Virus) command in the middle of the file. The entry point obscuring (EPO) encryption technique is designed to allow a virus to gain control of the system first, decrypt it, and then infect the system.

Therefore, when the worm virus is first received and received by the mail client, the virus scans the Win32 kernel for system information by scanning the operating system type, registry structure, the location of the current directory and system directory, and the COM version and mail client type. After extraction, the worm virus is replicated to a specific location on the system, the worm and the backdoor contained in the worm virus are concealed, and the target is infected to find the target to infect the system in the desired form.

In general, the files targeted by viruses include system files such as winsock (dllsock32.dll) used by all Windows-like operating systems, Office suites that support COM (Excel, Word, PowerPoint, etc.) and mail client applications ( Outlook, Outlook Express), and especially COM-supporting applications, make the worm easy to spread itself to other computers using COM.

Worms Virus worms start their activities after they have been replicated by a virus to a specific location on the system, and then start themselves by referring to the mail client's address book, inbox, sent letter, and the Internet and FTP sites that the client visits. Extract the mail address to propagate. The way in which the worm extracts e-mail addresses depends on the type of worm virus. Generally, the e-mail address is extracted except for the anti-virus domain or the domain of the vaccine research organization.

When the extraction of the e-mail address is completed as described above, the worm transmits an e-mail including a worm virus to the extracted e-mail address. In particular, some worms propagate themselves to the extracted e-mail address, and then recover the system file (wsock32.dll) modified by the virus to prevent the virus from being detected.

A worm virus's backdoor, like a worm, is replicated by a virus to a specific location on the system and immediately begins to act, usually running independently of the worm.

In order for the backdoor component to be installed on the system, after the Windows system key is generated, the registry must be changed to point to the infected system file. If at this point the system key already exists and the backdoor cannot be installed on the system, the backdoor component uses the registry to manipulate it for the next time it boots.

Once the back door is installed, the worm virus infected system connects to a specific Internet server, downloads the files necessary for the worm virus to work, reinfects the system with another virus, or sends system information to the server designated by the back door.

Worm propagation methods for propagating a worm virus include native propagation, parasitic propagation, Arbitrary Protocol propagation, and P2P propagation.

The self-propagation method spreads the worm by simply sending an email from the mail server to the mail client, without opening the mail containing the worm virus because the worm virus is sent as an email message rather than as an attachment. .

The parasitic propagation method is a worm virus is transmitted in the form of an attachment, and the mail client user has to open an email infected with the worm virus to spread the worm.

The dogmatic protocol propagation method is a worm virus propagation using a protocol other than e-mail as a propagation means, and propagates through existing Internet protocols such as Internet Relay Chat (IRC) protocol, File Transfer Protocol (FTP), or TCP / IP.

The P2P propagation method is a dogmatic protocol propagation method. Recently, P2P applications such as Napster and Soribad have emerged, and worm viruses are spread through P2P applications.

2 is a simple flow diagram of a process in which a general worm virus consisting of a virus, a worm, and a backdoor is spread to a specific computer to infect a virus, install a backdoor, and then automatically spread to another computer through a worm. However, Figure 1 is for a typical worm virus, the order or method may vary depending on the type of virus.

Worm Virus Producer When an e-mail containing a worm virus is sent to a specific e-mail address, it is sent to a mail server corresponding to the e-mail address and stored temporarily. In this case, the worm virus exists in the form of an attachment or a mail message. When a mail client requests transmission to a client using Point of Presence 3 (POP3) or Internet Message Access Protocol (IMAP), the mail server receives a given protocol. Sends the mail to the client.

When a mail containing a worm virus is first received from a mail server and received by a mail client, the virus of the worm virus modifies the system files so that the worm virus can be activated, and replicates and hides itself in a specific area of the system.

When the worm virus is replicated as described above, the worm virus extracts an e-mail address to be automatically propagated through the worm from an address book or an inbox of the mail client. In this case, the worm virus does not spread to all e-mail addresses, but does not propagate to e-mail addresses such as antivirus companies or virus research organizations, and sometimes only to e-mail addresses with attachments in the inbox. Therefore, the type of e-mail address that the worm virus extracts to spread itself automatically varies slightly depending on the worm virus, and the extraction method is different. For example, the Melissa worm selectively extracts the top 50 of the mail client's address book, and the Butterfly worm selectively extracts only mail with attachments from the inbox.

When the e-mail address transmitting the worm virus replicated by the worm is extracted, the worm virus requests the Simple Mail Transfer Protocol (SMTP) to send an e-mail containing the worm virus through COM to the extracted e-mail address.

When the worm virus replicated to the extracted e-mail address is transmitted, the worm virus replicated in the system is installed by installing a back door on the system so that the virus producer can access the system, or the system information is extracted by the virus producer. Send to.

When the backdoor installation is completed by the worm virus, the worm virus finally manipulates the system infected with the worm virus through the virus. In particular, by changing the registry, the virus is executed automatically the next time you boot. In some cases, the system may be destroyed.

Therefore, for the worm virus propagated through the above process, there is no worm variance safe zone of the computer connected to the network, and the fundamental method to be freed from the worm virus is not to connect the computer to the network or to use the Internet. . However, such a method is very dangerous and the value of the opportunity to give up because of the worm virus is tremendous.

The only known worm virus countermeasures are the filtering of known worm viruses on mail servers and mail clients, or the installation of a vaccine on the computer to defend against worm viruses and to cure infected viruses.

However, a method of blocking a worm virus through filtering for a known worm virus in a mail server and a mail client has little effect on the nature of the worm virus, and has a disadvantage in that it is exposed to a new worm virus in a defenseless state. In addition, the method of blocking the worm virus by installing a vaccine on a computer connected to the network is also inconvenient to operate the vaccine every time the mail is read, and the serious disadvantage of being completely defenseless against new viruses that have not been produced yet. There is this. In particular, due to the fact that the worm virus spreads in seconds to minutes, the existing virus protection method that is exposed to new viruses unprotected is no different from hoping that the worm virus will not invade until the vaccine is developed or filtered by the mail server. .

An object of the present invention for solving the above problems is to detect the worm virus in the wired or wireless Internet or e-mail system for the first time, the client to track the propagation path of the worm virus by the manufacturer of the worm antivirus to be located in the trace path By automatically transmitting a warning message and a worm vaccine for the worm virus to a wireless communication device, the worm virus is transmitted from a worm virus host client and a system infected with the worm virus to the worm virus infected system. The present invention provides a method and system for minimizing an infection caused by a worm virus by treating a worm virus of a worm virus receiving client.

1 is a simple block diagram of a worm virus consisting of a virus, a worm, and a backdoor.

2 is a simple flow diagram of a process in which a common worm virus infects a particular computer and is automatically spread to another computer.

3 is a simple block diagram of a worm vaccine consisting of a vaccine, a worm, and a backdoor.

4 is a step in which the worm vaccine tracks the worm virus, and when there is a worm vaccine for the worm virus, the worm virus alert message is transmitted to the N-type worm virus infected person to the infected person's wireless communication device in the second step. This is a simple block diagram of a case where a worm vaccine is transmitted in response to a request for treatment by a worm virus infected after confirming treatment.

5 shows that the worm vaccine tracks the worm virus, transmits the worm virus infection to the wireless communication device of the infected person from the first to Nth worm virus infected person, confirms the treatment, and then treats the worm virus. As per request A simple block diagram of tracking a worm virus using a back door.

Figure 6 extracts the worm virus propagation path from the primary worm virus infected person and sends a warning message to the client wireless communication device located in the propagation path. This is a simple block diagram of automatically sending a worm vaccine after sending it out automatically and checking for treatment.

Figure 7 extracts the worm virus propagation path from the primary worm virus infected person and sends a warning message to the client wireless communication device located in the propagation path. This is a simple flow chart of automatically sending a worm vaccine after sending it out automatically and checking for treatment.

8 is a simple block diagram of a worm virus searcher for finding worms in a virtual network that is blocked from the outside.

9 is a simple flowchart illustrating a process of exterminating the worm virus by repeating each step as shown in FIG. 7 through the worm and the back door of the worm vaccine transmitted to the infected person.

10 is a simple illustration of a worm vaccine being transmitted from a worm vaccine developer to a vaccine mailing service requester or a worm virus primary infected person.

Figure 11 is an embodiment of sending a warning message to inform the fact that the worm virus infection and confirm whether or not to the wireless communication device of the secondary worm virus infected.

<Description of main parts of drawing>

400: Worm Virus Producer 405: Worm Antivirus Developer

410: Worm virus primary infected person 415: Worm virus secondary infected

420: third worm virus infected person425: email server

430: mobile carrier

The present invention relates to a method and system for providing the worm virus warning message and worm vaccine (Worm Vaccine) to a client wireless communication device located in a worm virus (Worm Virus) propagation path, in a wired, wireless Internet or e-mail system When the worm virus is detected for the first time, the worm virus maker automatically tracks the propagation path of the worm virus and automatically transmits a warning message and a worm vaccine for the worm virus to a client wireless communication device located in the tracking path. A method and system for minimizing infection by the worm virus by treating a worm virus of a worm virus host client transmitting the worm virus to a system infected with the worm virus and a worm virus receiving client receiving the worm virus from the worm virus infected system. After infection by the worm on to the instant process is to transfer the worm primary or N primary infected determine whether a treatment to give to the wireless communication apparatus on the infected transfer that infection and worm vaccine to the wireless communication device of the infected .

When a worm virus is first reported to the vaccine producer on a wired or wireless Internet or e-mail system, the worm's antivirus authors send the worm virus's propagation path (email address book and inbox, Sent Items, Deleted Items, etc. on the system infected with the worm virus). The worm virus refers to a route through which the worm virus is transmitted and received through an e-mail address extracted from the back, and the worm virus host system that transmits the worm virus to the system infected with the worm virus, and the worm that has received the worm virus from the system infected with the worm virus. The email address of the virus-receiving system collectively), and the worm virus warning message and Worm Vaccine are sent to the client wireless communication device located in the trace path. By automatic transmission immediately A method and system for minimizing infection by worm viruses.

3 is a simple block diagram of a worm vaccine 300 composed of a vaccine 305, an order receiver 310, a worm 315, and a backdoor 320.

The worm vaccine 300, like the worm virus, is spread in the form of a mail message or an attachment of a mail, and is composed of a vaccine 305, a worm 315, an order receiver 310 and a back door 320. have. Vaccine 305 of the worm vaccine 300 is to treat viruses, worms, and backdoors of the worm virus, worm 315 of the worm vaccine 300 is to track the path of propagation of the worm virus, and worm vaccine 300 The back door 320 of) transmits the propagation path of the original virus tracked by the worm of the worm vaccine to the vaccine developer so as to download the latest vaccine capable of treating the worm virus from the vaccine developer.

When the worm vaccine is transmitted through the propagation path of the worm virus through the self-replication of the worm in the worm vaccine 300, the command receiver 310 tracks the propagation path of the worm virus and is located in the tracking path. After transmitting the worm virus warning message to the client wireless communication device, the client wireless communication device receiving the warning message receives a response result from the vaccine developer from the vaccine developer to transmit the worm vaccine through self-replicating of the worm. It plays a role of selectively selecting and transmitting a route.

The vaccine 305 of the worm vaccine 300 detects a worm virus on a system exposed to the worm virus or a system already infected with the worm virus, repairs and removes the detected worm virus, and then changes the system that the worm virus maliciously manipulates. It is responsible for restoring the item. The vaccine of the worm vaccine 300 does not perform treatment and repair only for the virus of the worm virus, but removes and treats the virus, the worm, and the back door of the worm virus to restore the original state.

The worm 315 of the worm vaccine 300 extracts the propagation path of the worm virus, and the worm virus infected person according to the command of the vaccine developer 405 received by the command receiver 310 with respect to the electronic path of the extracted worm virus. Self-replicating the worm vaccine 300 for the route for the treatment request of the worm vaccine 300 to the client system received the treatment request of the worm virus infected It serves to propagate.

The backdoor 320 of the worm vaccine 300 downloads the latest vaccine to a system infected with the worm virus or takes a traditional purpose backdoor to take necessary measures for the treatment and repair of new viruses other than the currently worm virus. Perform the role of installation. The back door 320 of the worm vaccine 300 plays a role of delivering the propagation path of the worm virus or the path to which the worm vaccine 300 is to be propagated to the vaccine developer.

The worm vaccine 300 tracks and treats the worm virus in the case where the worm virus extracts the route information propagated for the step of determining the route to which the worm vaccine 300 is propagated in the infected or infected system. And extracting all path information that can be obtained from a system exposed to the worm virus, regardless of the actual propagation path of the worm virus. In the case where the worm vaccine 300 tracks the worm virus through the worm And tracking the backdoor and using the worm and the backdoor at the same time.

In the step of the worm vaccine 300 tracking the worm virus, tracking the worm virus using the worm 315 of the worm vaccine 300, if there is already a worm vaccine 300 against the worm virus, Worm vaccine directly tracks the worm virus using SMTP (Simple Mail Transfer Protocol) embedded in the worm of 300 or the SMTP of the infected or infected system (see FIG. 4). Tracking the worm virus using the back door 320, the back door 320 of the worm vaccine 300 is installed on the system exposed or infected by the worm virus, the worm virus infection information and the worm virus propagation of the system When the route information and the like are transmitted to the vaccine developer, the vaccine developer injects the worm vaccine 300 directly into the corresponding system to treat the vaccine. And tracking the worm virus by using the worm 310 and the back door 320 of the worm vaccine 300 at the same time, combines the tracking using the worm 310 and the tracking using the back door 320, worm vaccine Tracking of the worm virus using 300 is performed by the SMTP and vaccine developers who can be used directly in the worm vaccine 300 at the same time.

4 shows that in the stage where the worm vaccine 300 tracks a worm virus, when there is a worm vaccine for the worm virus, the worm virus warning message is transmitted to the N-type worm virus infected person to the infected person's wireless communication device at the second time. This is a simple block diagram of a case where a worm vaccine is transmitted at the request of a worm virus infected person after transmitting and confirming the treatment.

When the worm virus producer 400 spreads the worm virus (101), the worm virus finds and infects the worm virus primary infector 410 on the Internet (102), and the next worm virus infector information from the primary infector 410 The worm virus is extracted and starts to spread the worm virus to the secondary infected person 415. (103) The worm virus started to spread from the primary infected person 410 is spread to the secondary infected person 415 and (103.1) the secondary. The infected person 415 is infected with a worm virus like the primary infected person 410. (103.2) Worm virus The worm virus that infects the secondary infected person 415 extracts the following worm virus information from the secondary infected person 415. In addition, a vaccine against the worm virus has been developed and repeatedly propagated until the infected system has been cured (103.3).

Here, the primary infector refers to a client inquiring a vaccine provider whether a worm virus is infected, and specifies that the primary infector serves as a starting point of a worm virus warning message and automatic distribution of a worm vaccine.

In addition, the secondary infected person refers to a worm virus host client system that transmits the worm virus to the primary client system infected with the worm virus, and an infected client system that receives the worm virus from the primary client system infected with the worm virus. Collectively.

When the primary infected person 410 infected with the worm virus reports the spread of the new worm virus to the worm vaccine developer 405 (104), the worm vaccine developer 405 sends the vaccine of the worm virus to the virus primary infected person (410). (105).

The worm vaccine 300 transmitted to the worm virus primary infected person 410 repairs the system and recovers it to a normal state, and then transmits the worm vaccine 300 propagation path (on the system infected with the worm virus) from the infection information of the worm virus. The worm virus refers to a route through which the worm virus is transmitted and received through an e-mail address book and an e-mail address extracted from an inbox, a sent letter, a deleted item, and the like. The email address of the worm virus receiving system that has received the worm virus from the system infected with the virus) is determined, and the propagation path of the worm virus is transmitted to the worm vaccine developer using the back door 320 in the worm vaccine 300. (106).

Worm vaccine developer 405 works in conjunction with each e-mail company 425, the address book of the primary infected e-mail sent by the worm vaccine 300 or the e-mail send / receive address recently used by the primary infected 410. Secondary infected radio communication device Download the phone number (107) (User wireless communication device when filling out the e-mail service application according to the prior agreement. The information in the number input field is serviced by each E-mail company 425).

Here, the downloading of the second infected person wireless communication device phone number in conjunction with each e-mail company 425 is for the simplification of the implementation of the present invention (each E-mail company 425 is a user in the e-mail member information Secondary infected person as above) Wireless communication device The phone number extraction is provided separately from the primary infected person 410 or linked with the email address in the primary infected person system to provide a dictionary service. Wireless communication device After the phone number is stored, it will specify the bar that can be extracted by the worm vaccine 300 from the address book.

Since the worm virus does not know the infection until the computer turns on the computer and checks the e-mail, in order to notify the infected person of the infection immediately and minimize the damage as described above. A second worm as shown in FIG. 12 through a mobile communication company 430 is extracted from the mobile communication device 430 which is separately provided from the primary infected person or the email address stored in the primary infected person system for providing a preliminary service. The wireless communication device of the virus infected person notifies that the worm virus is infected and sends a warning message to confirm whether or not the treatment (108).

When the secondary worm virus infected person 415 requests treatment, the worm vaccine developer 405 uses the command receiver (order receiver, order-receiver) 310 in the worm vaccine 300 to receive the primary worm virus infected person 410. The E-mail address of the secondary worm virus infected person 415 requesting treatment of the secondary worm virus infected person is transmitted to the worm vaccine 300 previously transmitted to the worm 315 of the worm vaccine 300. The predetermined propagation path is corrected so that the worm vaccine 300 is automatically transmitted to the secondary worm virus infected person 415 who requested the treatment (110).

As described above, when the worm vaccine 300 started to spread from the primary infected person 410 reaches the secondary infected person 415 by tracking the worm virus (110.1), the worm vaccine 300 is the secondary infected person infected with the worm virus. (415) to heal and recover (110.2), and this process is repeated until the worm virus is tracked down and killed. (110.3)

The command / information transmission / reception method between the worm vaccine 300 and the vaccine developer 405 transmitted to the system of the worm virus infected is realized by using the back door 320 and the order receiver 310 of the worm vaccine 300. do.

The worm vaccine 300 determines the worm vaccine propagation path from the worm virus infection information, and transmits the worm vaccine 300 propagation path to the vaccine developer 405 using the backdoor 320 in the worm vaccine 300.

Vaccine developer 405 is an order receiver in the worm vaccine 300 only the information of the infected worm virus infected in the next propagation path of the worm vaccine 300 received from the back door 320 of the worm vaccine 300 requesting treatment ( 310 to be transmitted only to the infected person who requested the worm virus treatment.

5 is a step in which the worm vaccine 300 tracks a worm virus, transmits the worm virus infection to the worm virus infected person from the first to Nth worms to the wireless communication device of the infected person, checks whether the worm virus is cleaned, and then the worm virus. According to the request of the infected person A simple block diagram of a case of tracking a worm virus using the back door 320 is shown.

Worm virus producer 400 spreads the spreading worm virus through the process of 101-103.x of FIG. 4, and the primary infected person 410 reports this fact to the worm vaccine developer 405 (104). After developing a vaccine against the worm virus, the vaccine developer 405 transmits the vaccine to the primary infected person 410 to treat the worm virus, and installs the back door 320 in the primary infected person 410 (105). .

The backdoor 320 installed in the primary infected person 410 transmits information necessary for propagating the worm vaccine 300 from the primary infected person 410 to the worm vaccine developer 405 (106), and the worm vaccine developer 405 Interworking with each E-mail company 425 or separately provided from the primary infected person 410 or interworking with the email address stored in the primary infected person system for providing a preliminary service Wireless communication device The second infected person's wireless communication device from the e-mail sending / receiving address recently used by the first infected person 410 using the phone number address book. Download the phone number (107).

Since the worm virus infected person does not know the infection until the computer is turned on and checks the e-mail, it is linked with each e-mail company 425 as described above to immediately notify the infected person of the infection and minimize the damage. Interworking with the e-mail address previously provided from the primary infected person 410 or stored in the primary infected system for providing a prior service Wireless communication device Receives the service number of each e-mail user's wireless communication device using the phone number address book and receives the second worm virus infected person as shown in FIG. The wireless communication device notifies the worm virus infection and sends a warning message confirming whether or not the treatment 108. When the secondary worm virus infected person 415 requests treatment, the worm vaccine developer 405 directly propagates the worm vaccine 300 to this path (109).

The worm vaccine 300 propagated from the worm vaccine developer 405 to the secondary infected person 415 installs the backdoor 320 after treating the system (110), which is a worm virus from the secondary infected person 415. Warning messages The information necessary for propagation of the worm vaccine 300 is extracted and transmitted to the worm vaccine developer 405. (111)

The worm vaccine developer 405, which has received the information necessary for the worm vaccine 300 propagation from the secondary infected person 415, is provided with the E-mail company 425 or separately provided from the primary infected person 410 based on this. Linked with the email address previously stored in the primary infected system to provide advance service Wireless communication device Sends a worm virus warning message confirming the infection and whether it is cured to the wireless communication device of the third worm virus infected person 420 by using the phone number address book. After transmitting 112, the worm vaccine 300 that reaches the third infected person 420 treats a worm virus of the system and installs a back door 320 (113).

The back door 320 installed as described above is accompanied by a worm virus warning message from the third infected person 420. The information necessary for the re-propagation of the worm vaccine 300 is extracted and transmitted to the developer 405 of the worm vaccine 300 (114), and the process is repeated until the worm virus is killed on the Internet.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the following examples are one of various methods for most appropriately explaining the present invention, and the present invention is not limited to the following examples.

6 shows a worm virus primary infected person (a client inquiring a vaccine provider whether a worm virus is infected, and serves as a starting point for worm virus warning mail and worm vaccine automatic distribution) 410 of the present invention. The worm virus propagation path (e-mail address on the system infected with the worm virus and the email address extracted from the Inbox, Sent Items, Deleted Items, etc. refers to the route transmitted and received by the worm virus, and the system infected with the worm virus The email address of the worm virus host system that transmitted the worm virus and the worm virus receiving system that received the worm virus from the worm virus infected system), and the client wireless communication device located in the propagation path. To It is a simple block diagram for automatically sending the worm vaccine 300 after automatically sending and confirming the treatment.

The vaccine developer 405 includes a worm virus receiving unit 615 for receiving worm virus information from the primary infected person 410, a worm virus searching unit 610 for checking whether a worm virus is present, a vaccine for treating the worm virus, and the A worm extracting a worm virus propagation path, a worm vaccine transmission unit 620 for transmitting a worm vaccine 300 including a backdoor interconnecting the vaccine developer, a backdoor management unit 650 for managing the backdoor, and the worm virus Wireless communication corresponding to each e-mail address in conjunction with an e-mail company 425 by referring to the back door receiving unit 655 which receives the information on the worm virus propagation path from the back door installed in the infected person, and the information on the propagation path. A wireless communication device number generation unit 605 for generating a device number, a worm virus warning message generation unit 625 for automatically generating a warning message for a new worm virus, Then, a warning message sending unit 635 for confirming the treatment by sending a worm virus warning message to the wireless communication device of the worm virus infected person, and a wireless data receiving unit 640 receiving the treatment or not from the wireless communication device of the worm virus infected person. It is composed.

The worm virus receiving unit 615 serves to receive worm virus information transmitted from the primary infected person 410, and at this time, the worm virus information received by the worm virus receiving unit 615 varies according to the worm virus type. For example, in the case of a worm virus attached to an e-mail, the worm virus receiving unit 615 receives worm virus information in the form of e-mail, and in the case of a worm virus based on a P2P system, the worm in the form of P2P transmission / reception data. Receive virus information. It also receives a message confirming whether or not the worm virus infected person is treated for the worm virus warning message.

The worm virus detection unit 610 checks whether the worm virus received by the worm virus reception unit 615 actually includes a worm that is automatically propagated on the Internet, and then determines whether the worm virus is a new worm virus. In addition, the official name of the worm virus is automatically assigned to the case of being identified as a new worm virus, and the report is automatically generated by analyzing the characteristics of the worm virus. The generated report is used by programmers of the worm vaccine developer 405 to rapidly develop the worm vaccine 300, and the new worm virus warning message generator 635 includes detailed information about the worm virus in the alert mail. It is used to

The worm vaccine transmission unit 620 includes a worm extracting the vaccine generated by referring to the search result of the worm virus search unit 610, a worm extracting the worm virus propagation path, and a back door interconnected with the vaccine developer 405. The worm vaccine 300 is configured to transmit to the primary infected person 410.

Also, the The worm vaccine transmission unit 620 transmits the worm vaccine 300 to a worm virus infected person who has been checked for treatment after sending a warning message for checking whether the worm is sent to the wireless communication device of the worm virus infected person described below. Do this.

In addition, the worm vaccine 300 is a worm vaccine 300 through the self-copy of the worm in the worm vaccine 300 When transmitted through the propagation path of the worm virus, the propagation path of the worm virus is tracked and transmitted from the client radio communication device receiving the warning message after transmitting the worm virus warning message to the client radio communication device located in the tracking path. It may further comprise a command receiving unit (Order Receiver) for receiving the response result from the vaccine developer to selectively select and transmit the transmission path of the worm vaccine 300 through the self-replication of the worm. To specify.

The back door receiving unit 640 receives the information on the worm virus and the worm virus propagation path through the back door installed by the worm vaccine 300 in the primary infected system.

The backdoor management unit 650 manages the backdoors installed by the worm vaccine 300 in the worm virus infected person through the backdoor D / B 665, analyzes the information received from the worm virus infected person through the backdoor receiver 655, and the like. On the basis of this, a warning message generated by the new worm virus warning message generator 625 described below is generated.

The back door D / B 665 of the back door management unit 650 includes information on the back door installed by the worm virus warning mail in the worm virus infected person, worm virus propagation path information confirmed by the back door receiver 655, and worm virus infected people. The worm virus alert message information is sent.

The second-N-th order worm virus infected device number generator 605 interworkes with each E-mail company 425 by prior agreement. It generates a phone number corresponding to each E-mail of worm virus infected person located in the worm virus propagation path, and from 2nd to Nth, when a warning message is sent to notify the wireless communication device of the worm virus infected person immediately. Generates an infected wireless communication device number.

Here, the worm virus infected person wireless communication device number generation unit 605 is associated with each E-mail company 425, the secondary infected person wireless communication device Downloading the phone number is intended to simplify the implementation of the present invention (each E-mail company 425 is a user in the e-mail membership information Wireless communication device Since the number is already stored), the secondary infected wireless communication device phone number extraction as described above is provided separately from the primary infected person or linked with the email address in the primary infected person system to provide a preliminary service. Wireless communication device After the telephone number is stored in advance, it is specified that it can be generated by the worm vaccine 300 from the address book.

The new worm virus warning message generator 625 immediately detects the second-N secondary worm virus infected to minimize the damage when the first worm virus infected is identified. Wireless communication device Based on the information from the number generator (605.5) to the second worm virus infected person. The wireless communication device notifies the fact of infection and generates a warning message to confirm the treatment.

New Worm Virus Warning Message Sending unit 635 is a worm virus secondary-N With wireless communication device The worm virus alert message generating unit 625 plays a role of sending a warning message generated through the respective mobile carriers to the car-N car worm virus infected wireless communication device.

The wireless data receiver 640 performs a role of receiving a treatment from the wireless communication device of the worm virus infected person, and causes the worm vaccine transmitter 620 to transmit the worm vaccine 300 according to the treatment.

Here, the worm vaccine 300 through the self-copy of the worm in the worm vaccine 300 is When transmitted through the propagation path of the worm virus, the response result of the treatment from the client wireless communication device receiving the warning message is transmitted from the wireless data receiver to the order receiver in the worm vaccine 300. By the command receiver (Order Receiver) in the worm vaccine 300 Selectively select the transmission path of the worm vaccine 300 to automatically generate the worm vaccine 300 generated through the self-copy of the worm Send it.

7 is a worm virus primary infected person (client that inquires the vaccine provider whether the worm virus is infected, the client serving as a starting point of the automatic distribution of worm virus warning mail and worm vaccine 300 pursued by the present invention) ( 410 refers to a path through which the worm virus is transmitted and received through the worm virus propagation path (e-mail address book on the system infected with the worm virus and an e-mail address extracted from an inbox, sent letter, deleted item, etc.), and infected with the worm virus. A client wireless communication device extracting a worm virus host system that transmits the worm virus to the system and an email address of the worm virus receiving system that receives the worm virus from the worm virus infected system) and located in the propagation path. Warning message It is a simple flow diagram for automatically sending the worm vaccine 300 after automatically sending and confirming the treatment.

When the worm virus receiving unit 615 of the worm virus warning system 600 receives information about the worm virus from the worm virus primary infector 410 (700), the worm virus detection unit 610 sends a worm to the received worm virus. It is confirmed whether there exists (705). The method for confirming whether a worm exists in the worm virus received by the worm virus search unit 610 may include receiving the worm virus search unit 610 while temporarily blocking all network communication of the worm virus search unit 610. After being directly infected by the worm virus, the packet data sent to the outside is analyzed to automatically check for the existence of the worm.

Since the worm search unit 610 is directly infected with the worm virus as described above and analyzes the packet data to confirm the existence of the worm, the worm search unit 610 and the worm virus backdoor system 645 Implement on another independent system.

If a worm exists (710), the worm search unit 610 checks whether it is a new worm virus (715), and if it is identified as a new worm virus (725) and automatically assigns an official name of the worm virus (725); 730, the report is automatically generated by analyzing the characteristics of the worm virus (740).

After developing the vaccine against the worm virus by referring to the search result of the worm virus search unit 610, the worm vaccine transmission unit 620 extracts the worm virus treatment vaccine and the worm virus propagation path, and the vaccine developer The worm vaccine 300 including the back door interconnecting the 405 is transmitted to the primary infected person 410.

The vaccine of the worm vaccine received by the primary infected person 410 treats a worm virus of the primary infected person 410 (745), and the worm extracts a worm virus propagation path from the primary infected person 410. Then, a back door is installed in the primary infected person 410. The worm virus propagation path extracted from the primary infected person 410 is transmitted to the back door receiving unit 655 of the vaccine developer 405 through the back door, and the back door receiving the worm virus information and the worm virus propagation path. The receiver 655 transmits data to the backdoor manager 650 managing the backdoor (750).

The back door manager 650 analyzes the information received from the worm virus infected person through the back door receiver 655, and generates a warning message generated by the new worm virus warning message generator 625 described below. (740).

Received from the backdoor management unit 650 Based on the worm virus propagation path data, the second to Nth worm virus infected wireless communication device number generators 605 interwork with each e-mail company 501 by prior agreement (755). It generates a phone number corresponding to each e-mail of the worm virus infected person located in the worm virus propagation path, and from 2nd to Nth, when a warning message is sent to notify the wireless communication device of the worm virus infected person immediately. Generate an infected wireless communication device number of 760.

Here, the worm virus infected person wireless communication device number generation unit 605 is associated with each E-mail company 425 secondary infected person Wireless communication device Downloading the phone number is intended to simplify the implementation of the present invention (because each E-mail company 425 stores the user wireless communication device number in the E-mail member information), as described above. Wireless communication device The phone number extraction is provided separately from the primary infected person 410 or linked with the email address in the primary infected person system to provide a dictionary service. Wireless communication device After the telephone number is stored in advance, it is specified that it can be generated by the worm vaccine 300 from the address book.

Received from the backdoor management unit 650 Based on the worm virus information data, the new worm virus warning message generation unit 625 immediately detects the second to N-th order worm virus infections to minimize the damage when the new worm virus first infectors 410 are identified. Wireless communication device The number generating unit 605 informs the infected person of the infected wireless communication device number generated and generates a warning message for confirming the treatment (765).

The generated warning message is a new worm virus warning message. The transmission unit 635 transmits the worm virus to the wireless communication device of the second to Nth infected persons through each mobile communication company 430 (770).

remind After receiving the warning message, the client sees the warning message through the text service (775), requests confirmation of the worm virus treatment (780), and rejects the service (790).

When a request is made to confirm whether or not the worm virus is to be treated, the worm vaccine transmission unit 620 causes the worm vaccine transmission unit 620 to receive the treatment from the wireless communication device of the worm virus infected through the wireless data receiver 640. In operation 785, the worm vaccine 300 is transmitted to the infected person.

Here, the worm vaccine 300 through the self-copy of the worm in the worm vaccine 300 is When transmitted through the propagation path of a worm virus, a response result of the response from the client wireless communication device receiving the warning message is returned from the wireless data receiver 640 to an order receiver in the worm vaccine 300. 310, and by the order receiver 310 in the worm vaccine 300 Selectively select the transmission path of the worm vaccine 300 to automatically generate the worm vaccine 300 generated through the self-copy of the worm Send it.

The worm vaccine 300, which is transmitted to the infected person who has been approved for treatment, repeats the above steps through the worm and the back door to exterminate the worm virus.

8 is a simple block diagram of a worm virus searcher 610 that finds worms in a virtual network blocked from the outside.

Worm virus detection unit 610 is composed of a worm virus detection device and a network blocking device, the worm virus detection device is an independent computer system having a virtual address book and mailbox. Worm virus scanners are completely blocked from physical networks, including local area networks (LANs) and wide area networks (WANs), and completely disconnected from the hub or gateway and software as well as hardware before they are directly infected by the worm virus. Analyze packet data through the internal virtual network.

The network blocking device completely blocks the worm virus search unit 610 and the actual network, and monitors the process of searching for the worm by the worm virus search device. Network blocking devices are manufactured in a software form or hardware method, and in some cases, a combination of a software method and a hardware method is not a target of worm virus infection. Therefore, even if the worm virus scanning device is infected with the worm virus and causes a serious damage to the system, the network blocking device can monitor the presence of the worm from the worm virus scanning device.

The worm virus search unit 610 checks whether a worm exists in the worm virus received through the above method, and if the worm does not exist in the worm virus, the worm virus search ends. However, if a worm exists in the received worm virus, the worm virus search unit 610 checks whether it is an existing worm virus or a new worm virus.

If there is an existing worm virus, the worm virus search unit 610 terminates the warning system for the worm virus without performing a worm virus warning mail generation operation. However, if the received worm virus is a new worm virus that does not exist previously, the worm virus search unit 610 assigns an official name of the new worm virus based on a given condition, and automatically analyzes the characteristics of the worm virus. Write a report.

When the report on the new worm virus is generated in the worm virus detection unit 610, the new worm virus warning message generation unit 625 generates a worm vaccine for the new worm virus based on the report generated by the worm virus detection unit 610. 300) and a warning message.

9 is a simple flowchart illustrating a process of erasing a worm virus by repeating steps as shown in FIG. 7 through a worm and a back door of the worm vaccine 300 transmitted to the infected person.

The worm vaccine transmitted to the treatment request client (or secondary infected) system (900) outputs new worm virus information and warning messages (905) and then checks whether a back door is installed for blocking and treating the new worm virus. (910).

If the treatment request client system approves the backdoor installation (915), the worm virus worm vaccine mail starts the backdoor installation on the system (920). On the contrary, if the backdoor installation is rejected, the worm virus worm antivirus mail sends to the worm virus warning system 600 that the backdoor installation is rejected (925).

When the backdoor is installed on the treatment request client computer, the worm virus worm vaccine mail is sent from all the paths through which the worm virus can be propagated from the system (e.g., the e-mail address book on the system infected with the worm virus and the e-mail address extracted from the Inbox, Sent Items, Deleted Items etc. Means a path through which the worm virus is transmitted and received through the worm virus host system that transmits the worm virus to the system infected with the worm virus, and a worm virus reception system that receives the worm virus from the system infected with the worm virus. The e-mail address is collectively extracted) (930), and the worm virus propagation path is determined (935), and transmitted to the worm virus backdoor system 645 via the backdoor (940).

When the back door receiving unit 655 of the worm virus back door system 645 receives the propagation path of the worm virus through the back door of the worm virus worm vaccine mail installed in the worm virus infected person, the back door management unit 650 receives the back door D / B ( 665, the worm virus infected radio communication device number generation unit 605 receives the infected radio communication device number for each propagation path (950) and the new worm virus warning message generator 615 at the same time. Transmits the generated warning message to the infected person's wireless communication device (955). The service is terminated when the worm virus infected person is checked for treatment (960) and rejected (965). When a worm virus infected person requests a service on a wireless communication device (presses an identification key) (970), a new worm virus worm vaccine mail is sent to the worm virus infected system (975). This process is repeatedly performed, and when the worm vaccine mailing is completed, the worm virus worm vaccine mailing result is stored (980).

10 is a simple exemplary diagram in which the worm vaccine 300 transmitted from the worm vaccine developer 405 to the vaccine mailing service requester or the worm virus primary infected person 410 is treating the worm virus.

When the worm vaccine 300 is transmitted from the worm vaccine developer 405 to the vaccine mailing service requester or the primary worm virus infected person 410 (1000), the worm vaccine 300 blocks all operations of the mail client program, Start a worm virus scan (1005).

At this time, the worm vaccine 300 searches for spyware that adversely affects the system, including not only a target worm virus, but also other existing worm viruses and client viruses, and searches for a path through which the worm virus is propagated. Extract.

If the target new worm virus and other existing worm viruses are detected through the worm vaccine 300 (1010), the worm vaccine 300 extracts the propagation path of the worm virus (1015), and It removes all kinds of viruses and spyware (1020) and restores the changed system to its original state (1025).

In the course of treatment, the worm vaccine 300 outputs detailed information of the new worm virus to the user on the virus treatment screen or provides an additional service for exposing advertisements.

Figure 11 is an embodiment of a warning message sent to inform the fact that the worm virus infection to the wireless communication device of the secondary worm virus infected person 415 and whether or not to heal.

According to the present invention, after the initial detection of a worm virus in the Internet or an e-mail system, a warning message for the worm virus is sent to a client wireless communication device that tracks the propagation path of the worm virus by a worm antivirus producer and is located in the tracking path. By checking whether the automatic transmission and treatment, there is an effect to minimize the infection by the worm virus, there is an effect that can minimize the economic damage by the worm virus.

In addition, according to the present invention, by inserting an advertisement into a worm vaccine and a warning message for the worm virus propagating through the same range as the transmission range of the worm virus (range exponentially expanded from system to system) It has the effect of providing an advertising method to see my biggest effect.

Claims (12)

A first step of receiving worm virus discovery data or worm virus information data transmitted from an infected client system; A second step of transmitting a worm vaccine to which the worm attaches a worm for treating the worm virus and tracking the worm virus propagation path by referring to the worm virus information data to the client system; Treating the worm virus using the worm vaccine and installing a back door on the client system; Extracting the worm virus propagation path on the client system using the worm vaccine and transmitting the worm virus propagation path data to the worm vaccine providing server through the backdoor; remind A fifth step of generating a wireless communication device telephone number corresponding to each E-mail of a client located in the worm virus propagation path with reference to the worm virus propagation path data; Generated above Wireless communication device A sixth step of transmitting a warning message to a number to confirm the worm virus propagation information and the treatment; And A seventh step of receiving the treatment status approval data from the wireless communication device and transmitting the worm vaccine to the treatment status approval client; Automatic worm virus alert message sending method comprising the. The method of claim 1, wherein the fourth step of extracting the path through which the worm virus can propagate, A method for automatically sending a wireless worm virus alert message comprising extracting a route through which the worm virus can be propagated by referring to an e-mail address book, an inbox, an outbox, and an internet website and an FTP site visited by the client. The method of claim 1, wherein the fifth step of generating the wireless communication device telephone number comprises: In conjunction with each email company Client located in the worm virus propagation path Generating a wireless communication device telephone number corresponding to each e-mail; or A method of directly receiving and generating the worm virus through bidirectional communication with an infected client system; or A method of automatically generating a telephone number of a wireless communication device interworking with an email address in the infected or infected client system and automatically generating the worm virus from the address book by the worm vaccine; How to automatically send a wireless worm virus alert message According to claim 1, The worm vaccine automatic propagation method, Method for automatically sending wireless worm virus alert message characterized by using native propagation, parasitic propagation, or arbitrary protocol propagation, or peer-to-peer propagation The method of claim 1, wherein the seventh step of transmitting the worm vaccine to the treatment approval client, Receiving the treatment status approval data received from the wireless communication device And transmitting the worm virus to a worm vaccine in the infected client system and automatically transmitting the worm virus in the infected client system to the treatment approval client system through self-replication of the worm in the worm vaccine. A method of automatically sending a wireless worm virus alert message. A worm virus receiving unit that receives worm virus information data from a worm virus discovery or infected client system; A worm virus search unit for checking the presence of a worm virus by checking the worm virus information data received through the worm virus receiver; A worm vaccine transmission unit for transmitting a worm vaccine including a vaccine generated by referring to the search result of the worm virus search unit, a worm extracting the worm virus propagation path, and a back door interconnecting the vaccine developer to the client system ; A backdoor receiving unit for receiving information data on the worm virus propagation path from the backdoor in the client system installed by the worm vaccine; remind Based on the information data on the worm virus propagation path received to the back door receiving unit Clients in the Worm Virus Propagation Path A wireless communication device number generation unit for generating a telephone number corresponding to each e-mail; A warning message generation unit for notifying the wireless communication device of an infection and generating a warning message for confirming treatment; The warning message generated by the warning message generating unit is transmitted through each mobile carrier. Clients in the Worm Virus Propagation Path Warning message sent to wireless communication device Shipping department; And Receives worm virus treatment approval data from the wireless communication device, and the worm vaccine transmission unit to transmit the worm vaccine to the treatment approval client system in accordance with the treatment approval With a wireless data receiving unit to Wireless worm virus alert message automatic sending system, characterized in that made. The method of claim 6, wherein the worm virus search unit, In the state of temporarily blocking all network communication with the worm virus detection unit, the worm virus detection unit automatically checks for the presence of a worm virus by analyzing packet data transmitted after being directly infected with the received worm virus. Wireless worm virus alert message automatic sending system, characterized in that. According to claim 6, wherein the worm of the worm vaccine, Use SMTP present on the client system, or By using the worm virus alert mail or the SMTP built into the worm vaccine, Wireless worm virus alert message automatic sending system, characterized in that it has a function to self-replicate and redistribute the original worm vaccine toward the extracted worm virus propagation path. The method of claim 6, wherein the worm vaccine, A wireless worm virus warning message is automatically provided, further comprising an order receiver for receiving the treatment approval data received by the wireless data receiver and selectively selecting and transmitting the self-replicating transmission path of the worm vaccine. Shipping system. The method according to claim 1 or 6, Method and system for automatically sending wireless worm virus alert message, characterized in that the worm virus can be replaced by a general virus or spyware. The method according to claim 1 or 6, Wireless worm virus warning message automatic sending system, characterized in that provided by inserting an advertisement in the worm virus warning message or worm vaccine. The method of claim 1 or 6, wherein the propagation path, The worm transmits and receives the worm virus through an e-mail address book and an e-mail address extracted from an e-mail address book, an inbox, a sent mail box, and a deleted mail box on the system infected with the worm virus. A method and system for automatically sending a worm virus warning mail and a worm vaccine, comprising an e-mail address of a worm virus receiving system receiving the worm virus from a virus host system and a system infected with the worm virus.