KR20040056998A - Method and Apparatus for Detecting Malicious Executable Code using Behavior Risk Point - Google Patents

Abstract

PURPOSE: A bad execution code detecting system and method is provided to calculate a risk degree by making a behavior analysis based on a security policy and to detect a bad execution code based on the calculated risk degree. CONSTITUTION: The system comprises a bad execution code management database(700), a system resource monitoring module, a security policy module(600), a bad execution code detection module(500), an update module(900), and an alarm module. The bad execution code management database(700) stores already known bad execution codes. The system resource monitoring module monitors a file system, a process and a network. The security policy module(600) establishes the first security policy for basically preventing a behavior on a specific file or directory by using the system resource monitoring module, and the second security policy for calculating a risk degree for each process and sensing a bad behavior. The bad execution code detection module(500) performs the first bad execution code detection via the database(700) and the second bad execution code detection via the security policy module(600). The update module(900) transmits new bad execution code data and important security policy data to the detection module(500) and the database(700).

Description

Apparatus and method for detecting malicious executable code through risk estimation {Method and Apparatus for Detecting Malicious Executable Code using Behavior Risk Point}

The present invention relates to an apparatus for detecting malicious executable code through policy-based risk estimation. In particular, when an executable code is automatically downloaded from a remote site and executed automatically on a user's computer, it detects any malicious behavior and notifies and copes with the user. A malicious execution code detection device and method for protecting a computer system and internal resources from malicious execution code and preventing the spread of the malicious execution code.

The conventional web environment has a static and simple form as a plain text transmission, and the executable programs are executed only on one computer. Therefore, if you want to run on other computer systems, the basic method was to move, run, or share using a mobile storage device. However, with the advent of the Internet and the World Wide Web, an environment in which various types of information can be moved and executed through various paths has been established, free from static and simple forms of information movement. Execution code technologies such as Java Applet, Java Script and ActiveX Control have been developed to provide greater convenience and functionality in accessing this diverse information.

These various executable code technologies can be easily written by anyone and can be performed on any computer system through a web browser. By the way, the execution codes are executed without the user's awareness in the user's system while the user is using the web, and all of them have an interpreter format that can be executed without distinguishing between the sender and the user's computer.

These execution contents suggest various measures to meet the security requirements, such as having their own security functions, but using vulnerability of each executable code, confidentiality attack, integrity attack, and availability (Availability) Various damages are taking place, including invasion attacks, user discomfort and annoyance. And as the production of various executable contents using executable code increases, these problems will occur more.

Therefore, it detects malicious executable code detection database by analyzing and comparing information before executing malicious executable code to detect malicious executable code. In addition, by providing the integrity of the code by using the cryptographic digital signature technique, it checks the forgery of the execution code or responds through the policy setting function. However, these methods can only detect known malicious executable code, and due to the lack of various conditions such as the establishment of public key infrastructure, it is not a perfect response to malicious executable code. In addition, several companies (Finjan, Digitivity) are developing malicious code countermeasures (SurfinShield, SurfinGate, Cage, AppletTrap), but only provide detection of known malicious code and provide detection of unknown malicious code. There is a problem that you are not doing.

Korean Patent Application No. 10-2002-13994 discloses a method of preventing an infection caused by a computer virus by identifying a writing operation of a malicious code and prohibiting it or notifying a user. However, when a parasitic virus among file viruses tries to attach a virus program before or after an executable file to infect an executable file, it detects and detects a write operation on the file. Therefore, there is a limit not to detect all kinds of malicious codes, but only to target malicious codes that perform limited types of actions.

The technical problem to be achieved by the present invention is an apparatus and method for detecting malicious execution code through the calculation of the risk that can detect malicious executable code through risk calculation through security policy based behavior analysis when executing executable code downloaded from the outside. To provide.

1 is a block diagram illustrating the positional relationship of a malicious executable code detection apparatus in a computer system.

2 is a block diagram illustrating a malicious execution code detection apparatus according to a preferred embodiment of the present invention.

Figure 3 is a block diagram for explaining in more detail the module for detecting malicious executable code according to an embodiment of the present invention.

4 is a flowchart illustrating a malicious execution code detection method according to a preferred embodiment of the present invention.

In order to achieve the above object, the malicious code execution detection device through the risk calculation according to the present invention, a system resource monitoring module, a system for monitoring a malicious code database, file system, process and network for storing known malicious code A security policy unit that performs a secondary security policy for detecting malicious behavior by accumulating a risk score for each process and a primary security policy for preventing an action on a specific file or directory by using a resource monitoring module; Sending malicious code detection module, new malicious code information or important security policy to malicious code detection module and malicious code database to perform primary detection through malicious code database and secondary detection through security policy department Update modules and malware detection modules It is preferable to include a malicious executable code warning module that provides a process for classifying a detected security policy violation into a prohibition, ignore and forced termination.

In order to achieve the above another object, the malicious code execution detection method through the risk calculation according to the present invention, checking whether there is a known malicious code execution, if present, forcibly terminating the process, if the malicious code does not exist In case of prohibition act set through the primary security policy, the process is stopped, and if the prohibition act does not occur and the prohibition act does not occur, the risk score for each act is calculated by the second security policy. Summing the risk scores, stopping the process if the summed risk scores exceed a predetermined value, and notifying the user.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the following embodiments are provided to those skilled in the art to fully understand the present invention, and may be modified in various forms, and the scope of the present invention is limited to the embodiments described below. It is not.

1 is a block diagram illustrating the positional relationship of a malicious executable code detection apparatus in a computer system.

Referring to FIG. 1, a user downloads executable code from a web server 100 to a web browser 200 through a network such as the Internet and an intranet. In order to execute the execution code executed in the web browser 200 to access the computer system resource 400, the computer system resource 400 is accessed only through a secure area such as a sandbox 300 in which an active area is limited by a security policy. can do.

2 is a block diagram illustrating a malicious execution code detection apparatus according to a preferred embodiment of the present invention.

The client computer system of the user downloads executable code embedded in a web page from a web server 100 connected through a network. The downloaded executable code refers to code that can be executed independently in the web browser 200 of the client computer, such as Java applets, ActiveX controls, JavaScript and Visual Basic script. The web browser 200 may be an Explorer or a Netscape. The execution code is automatically executed in the user's web browser 200. At this time, the execution code is monitored using the malicious execution code detection module 500 to perform malicious actions other than the intended action of the user.

The malicious executable code detection module 500 first checks whether there is a known malicious executable code using the malicious executable code database 700. If there is no known malicious executable code, the executable code is allowed to run. And if you want to perform any malicious action on the user system by monitoring all the actions, it detects it and prohibits the execution of the execution code and generates pattern information for it and stores it in the malicious execution code database 700. This pattern information is later used to detect known malicious executable code when the same malicious code is executed.

When the malicious policy detection module 500 detects malicious behavior, the security policy unit 600 holds a list of risk scores for each malicious behavior, and calculates a risk score for each behavior. That is, the security policy unit 600 may have a behavioral risk score database that defines a behavioral performance risk score for individual behaviors to assign a risk score for each behavior. In addition, the malicious code detection module 500 can be upgraded quickly by receiving the malicious code information or an important security policy detected through the update module 900, or by transmitting to other detection tools.

Figure 3 is a block diagram for explaining in more detail the module for detecting malicious executable code according to an embodiment of the present invention.

Referring to FIG. 3, the malicious behavior detection module 500 illustrated in FIG. 2 includes a primary malicious code detection module 500 and a secondary malicious code detection module 500, and includes a computer system resource 400. Includes system resource monitoring modules 411, 412, 413.

Execution code downloaded from the web server is the primary control using the malicious executable code database 700 in the primary malicious executable code detection module 510. The malicious executable code database 700 stores information on the executable code that has been previously detected as malicious executable code. If the downloaded execution code exists in the malicious execution code database 700, execution of the execution code is stopped before the execution code is executed. At this time, the malicious code execution database 700 is upgraded through the update module 900, the malicious code detection information detected from other malicious code detection tools.

The second malicious execution code detection module 520 performs process control using the security policy unit 600 if the malicious execution code is not detected in the first malicious execution code detection module 510. Process control by the second malicious execution code detection module 520 is divided into process control by the primary security policy and process control by the secondary security policy. Process control for the primary security policy performs the basic control of the process. In other words, it provides the simplest function and form among the process control methods by fundamentally preventing the action of a specific file or directory. On the other hand, process control by the secondary security policy is to control the process behavior not detected by the primary security policy, and it accumulates malicious behavior by accumulating risk scores by each action for each process's access to computer system resources. Detect it.

The system resource monitoring module 410 may be composed of a file system monitoring module 411, a process monitoring module 412, and a network monitoring module 413, respectively.

Among them, the file system monitoring module 411 monitors all file related operations occurring in the file system. If the security policy is violated according to the primary security policy that can suspend the undesired file operation among the monitored file operations, the file operation is not performed. And leaves a violation log. On the other hand, file operations that do not violate the primary security policy perform the malicious activity detection by the secondary security policy by creating the secondary log and sending it to the secondary malicious execution code detection module.

The process monitoring module 412 provides monitoring information about creation and destruction of a process, creation and destruction of threads, and image loading of the process. Based on the information provided, the user can use the function to forcibly execute the process. In addition, in the primary security policy, a confidence value for each process is set. According to this confidence value, the risk value for each action in the secondary security policy is changed later.

The network monitoring module 413 performs a monitoring function through the network. Based on the information obtained here, it filters whether the primary security policy is violated for the network connection status. In the primary security policy, you can set whether or not to authenticate items by network status and stop the process in case of violation. If there is no activity that violates the primary security policy, secondary logs for each network activity are created and secondary detection is performed through the secondary security policy.

The secondary malicious code detection module 520 manages the secondary log transmitted from each monitoring module described above. The secondary security policy sets a risk score for each class by assigning a rating to each executable code. In the 2nd malware execution module, the risk score of the 2nd security policy is applied to the corresponding action through log analysis, and the risk score is accumulated in a running process. If the accumulated risk score exceeds the malicious behavior determination score, it is determined that it is likely to be malicious and notifies the user that the security policy has been violated.

The malicious code execution warning module 800 provides the processing for the security policy violation by dividing it into prohibition, ignore, and forced termination. If you choose not to run, it stores the information of the process in the malicious executable code database so that it cannot be executed continuously. If you choose to ignore, the process will continue running without any sanctions. If you choose to kill, force the termination of the offending process.

4 is a flowchart illustrating a malicious execution code detection method according to a preferred embodiment of the present invention.

The malware execution tool installed in the client computer includes system monitoring modules 411, 412, 413, malicious code database 700, primary malicious code detection module 510, and secondary malicious code as shown in FIG. 3. It is configured to include a detection module 520, security policy unit 600, malicious code execution warning module (800).

Client System The computer system downloads the execution code from the server using a communication network such as the Internet or an intranet (S10). In order to check whether the execution code includes a known malicious process, a search for the program code is performed by using a known malicious execution code database 700 (S12), and if a matching process exists, the corresponding process is forced. It ends (S14).

If no known malicious execution code is found, the first malicious behavior detection module through the first security policy is performed (S16). The primary malicious behavior detection module through the primary security policy filters the execution code execution behavior monitored by the file system monitoring module 411, the process monitoring module 412, and the network monitoring module 413.

In this case, in the malicious activity detection through the file system monitoring module 411, access to a specific file set as a primary security policy, access to a specific directory, attribute change, file creation and file rewriting, etc. Compare the information monitored by the system monitoring module 411. After the comparison, when the prohibition act set as the primary security policy occurs, the process is stopped, the user is notified of the detection of malicious behavior, and at the same time, the user is asked whether the process is to be continued or not through the malware execution module 800. (S18).

Malicious behavior detection through process monitoring module 412 compares the collected process information with process information that is prohibited to execute in the primary security policy, disables the processes that are not allowed to run, notifies the user of malicious process detection, and continues Ask the user whether or not (S18).

In addition, the malicious activity detection through the network monitoring module 413 compares the collected information with the network information that is set to be prohibited in the primary security policy, that is, a policy such as a source port, a source IP, a destination port, and a destination IP. At the same time, stops the process, notifies the detection of malicious behavior, and at the same time asks the user through the malicious executable code warning module whether the process continues to perform (S18).

As described above, based on the primary security policy and the information reported from each of the monitoring modules 411, 412, and 413, the first malicious behavior detection module 510 performs the first filtering on the malicious executable code. If no malicious activity is found in the first filtering step, each monitoring module generates a second log for each monitor and transmits it to the second malicious activity detection module 520. In other words, the execution code for which malicious behavior is not detected through the primary security policy is secondarily filtered through the secondary security policy (S20).

The secondary malicious behavior detection module 520 maintains a risk score database for each behavior, and assigns a risk score for each behavior for each analysis analyzed from the monitoring modules 411, 412, and 413.

First of all, information on file property change, file contents access, file extension, and other risk score database is provided through monitoring information on the file executed by the execution code for the execution code that has passed the primary security policy. Calculate the risk score for each behavior using. Here, the risk score by behavior is calculated using information such as malicious risk score, process reliability, and access directory risk score for file behavior. The cumulative risk score for security policy violation for each process file is calculated.

Similar to the 2nd malicious behavior detection through file monitor, the process monitor performs malicious behavior detection by process. When the reliability of each process is set through the secondary security policy, the scope of activity (malicious behavior estimation score area) that the process can perform is adjusted according to the established reliability, and processes with low reliability are detected as malicious behavior. The chances of becoming high. In other words, a process with low reliability may be determined to be malicious even when a score for which a cumulative risk score calculated for each monitor is small is set because a malicious behavior determination score is set low when system resources are utilized.

In the second malicious activity detection through network monitor, the network monitor module analyzes the network port selection for the process, the packets sent and received for the process, the risk of preoccupying the network port set in the secondary security policy, and the network. Secondary malicious activity is detected based on the setting value of the risk for the transport packet. For example, different risk scores are given for each port sent and received according to process reliability, or IP packets are added to the packet transmitted per unit time according to process reliability, and different risk scores are added. The risk score for each star is calculated and accumulated.

When the risk scores by behavior calculated by each monitor module and the secondary security policy are added together and exceed the malicious behavior determination score specified by the user, the process is judged to be malicious and the user is notified of the malicious behavior detection and asked whether to continue the execution. (S18).

The malicious code execution alert module 800 asks the user whether to continue performing the malicious activity and performs the corresponding process if the user wants to continue (S26), stops the process if the user wants to stop the execution, that is, executes the process. The pattern information for the code is processed and inserted into the malicious execution code database 700 (S28). This ensures that even if the same malware is downloaded again later, the process is detected more quickly and efficiently by the known malware detection module.

As described above, the apparatus for detecting malicious code by using the risk calculation according to the present invention, and a method thereof, includes a primary malicious code detecting module using a previously known malicious code detection database, and a list of prohibition of conduct. Malicious behavior of executable code is quickly detected through the primary security policy, and detailed behavior monitoring through behavior monitoring tool and policy-based scoring of monitored information and malicious behavior by execution code for malicious execution code not detected through this It is effective to detect malicious executable code through risk scoring. In addition, detailed security risk score list management and malicious behavior determination score management for malicious behavior determination through secondary security policy can set user-specific policy and perform detailed risk behavior management. .

As mentioned above, although the present invention has been described in detail with reference to preferred embodiments, the present invention is not limited to the above embodiments, and various modifications may be made by those skilled in the art within the scope of the technical idea of the present invention. This is possible.

Claims (8)

In the malicious code detection device for detecting malicious executable code downloaded through the network, Malicious executable code database for storing known malicious executable code; A system resource monitoring module for monitoring file systems, processes and networks; A security policy that executes a secondary security policy for detecting malicious behavior by accumulating risk scores for each process and a primary security policy for fundamentally preventing an action on a specific file or directory using the system resource monitoring module. part; A malicious execution code detection module for performing primary detection through the malicious execution code database and secondary detection through the security policy unit; An update module for transmitting new malicious code information or an important security policy to the malicious code detection module and the malicious code database; And Malicious execution code detection device through the risk calculation, characterized in that it comprises a malicious execution code warning module for providing the processing for violation of the security policy detected by the malicious execution code detection module divided into prohibition, ignoring and forced termination. The method of claim 1, wherein the system resource monitoring module A file system monitoring module for monitoring all file related operations occurring in the file system; A process monitoring module for monitoring the creation and destruction of a process or thread, and the loading of the image of that process; And Malicious execution code detection device through the risk calculation, characterized in that it comprises a network monitoring module for performing monitoring over the network. According to claim 1, wherein the malicious code execution detection module A primary malicious executable code detection module for performing primary detection using the malicious executable code database; By using the primary security policy to prevent the behavior on a specific file or directory and the secondary security policy to detect malicious behavior by accumulating risk scores by each action for the actions of each process accessing system resources. Malicious executable code detection device through the risk calculation, characterized in that it comprises a secondary malicious code detection module for performing a secondary detection. The method of claim 1, wherein the security policy unit, Apparatus for detecting malicious execution code through the risk calculation, characterized in that it includes a risk score database for each action that defines the behavior performance risk score for each individual action to give a risk score for each action. In the malicious executable code detection method for detecting malicious executable code downloaded through the network, (a) checking for the existence of known malicious executable code and forcibly terminating the process if present; (b) if the malicious executable code does not exist, stopping the process and notifying the user when a prohibition act set through the primary security policy occurs; And (c) if the prohibition does not occur, the risk score for each action is calculated through the secondary security policy, and the calculated risk score for each action is summed, and if the summed risk score exceeds a predetermined value, the process is stopped; Malicious executable code detection method through the risk calculation, characterized in that it comprises the step of notifying the user. The method of claim 5, wherein after step (c), Continued execution of the process, or stopping the process and processing the pattern information for the malicious executable code further comprises the step of storing and storing the malicious executable code detection method characterized in that the risk. The method of claim 5, wherein in step (b), The prohibitions set through the primary security policy include access to a specific file, access to a specific directory, attribute change, file creation, file rewrite, execution of a prohibited process, and a prohibited network Malicious execution code detection method through the risk calculation, characterized in that the execution behavior. The method according to claim 5, wherein in the step (c), the risk score for each action through the secondary security policy is File monitoring using information such as malicious risk score and access directory risk score for each file behavior, Process monitoring that adjusts the range of activities that can be performed by the process by setting the reliability for each process, and Calculation using network monitoring using settings for network port selection for each process, analysis of the network monitor module for packets sent and received for that process, and risks for network port preemption, and risks for network transport packets. Malicious executable code detection method through the risk calculation characterized in that.