KR20040090373A - Method for realtime monitoring/detecting/curing virus on wireless terminal - Google Patents

Abstract

PURPOSE: A method for monitoring/diagnosing/curing virus in real-time on a wireless terminal is provided to automatically monitor/diagnose/cure the virus when the virus is flown in or executed on the wireless terminal by monitoring/diagnosing applications and contents flown in or executed on the wireless terminal. CONSTITUTION: A real-time virus monitoring/diagnosing/curing function is set to the wireless terminal by a user. The virus is monitored/diagnosed/cured in real-time by using an anti-virus engine processor, a user notification processor, and a result processor. The real-time virus monitoring/diagnosing/curing function is cancelled.

Description

Method for realtime monitoring / detecting / curing virus on wireless terminal}

The present invention relates to a computer-readable recording medium recording a real-time virus monitoring / diagnosis / treatment method and a program for realizing the method in a wireless terminal. Realizing the real-time virus monitoring / diagnosis / treatment method and the method which perform the functions such as real-time monitoring and diagnosis, user notification, and virus treatment among the important functions of the vaccine program for wireless terminal to protect and prevent from virus or mobile virus. The present invention relates to a computer-readable recording medium having recorded thereon a program.

In addition, the term virus used in the present invention is used as a term of a concept including a virus and a malicious code.

Currently, the platform of the wireless terminal is unified, and as the demand of the wireless user increases, various applications are used in the wireless terminal, but there are no programs for preventing viruses (including malicious codes).

Meanwhile, examples of actual damages caused by viruses (including malicious codes) in wireless terminals are as follows.

1. Timofonyca worm: Telephonica is a variation. In Spanish, Timo means 'fraud' and 'plunder'. The Timofonica worm randomly sends e-mails to the Global System for Mobile communication (GSM) channel used by Telefonica's Moviestar service. By randomly sending mail to an e-mail address used by the GSM terminal, inappropriate traffic on the network is increased.

2. I-Mode Malicious Code: Malicious code in the I-Mode application caused hundreds of mobile phones in Japan to randomly call police emergency calls.

3. Short Message Service (SMS) Malware: As a fact revealed by a Norwegian company, it has been found that certain SMS messages have caused Nokia cellular phones to stop working.

4. Viruses that run on the Palm OS: Viruses that run on the Palm OS include "Phage", "Vapor", and "Liberty".

On the other hand, the wireless terminal has a structure vulnerable to viruses. In addition, since there is only a ROM transfer of the terminal as a method of recovering a system infected with a virus, when the virus occurs, the damage is also very large and wide.

Therefore, there is a need for a method for minimizing damage caused by such a virus and for coping with a virus quickly.

The present invention has been proposed to meet the above-mentioned requirements, and a virus (including malicious code) produced by a malicious user is introduced and executed in a wireless terminal by monitoring and diagnosing applications and contents that are introduced and executed through the wireless terminal. It is an object of the present invention to provide a real-time virus monitoring / diagnosis / treatment method for automatically detecting, diagnosing, and treating a city and a computer-readable recording medium recording a program for realizing the method.

1A to 1C are exemplary diagrams for explaining a concept of monitoring / diagnosing / treating viruses in real time in a wireless terminal according to the present invention;

2 is a diagram illustrating an embodiment of a setting process of a real-time virus monitoring / diagnosis / treatment method in a wireless terminal according to the present invention.

3 is a diagram illustrating an embodiment of a monitoring / diagnosis / treatment process among real-time virus monitoring / diagnosis / treatment methods in a wireless terminal according to the present invention;

Figure 4 is an embodiment explanatory diagram of the release process of the real-time virus monitoring / diagnosis / treatment method in a wireless terminal according to the present invention.

5a to 5c is a flow chart of an embodiment of a real-time virus monitoring / diagnosis / treatment method in a wireless terminal according to the present invention.

* Explanation of symbols for the main parts of the drawings

101: main memory 102: mobile process

103: real-time monitoring, diagnosis and treatment unit 103: mobile content

The method of the present invention for achieving the above object, in the real-time virus monitoring / diagnosis / treatment method in a wireless terminal, the first to set the real-time virus monitoring / diagnosis / treatment function for monitoring / diagnosing / treating the virus in real time And a second step of monitoring, diagnosing, and treating the virus in real time using the antivirus engine processing unit, the user notification processing unit, and the result processing unit, and real time virus monitoring, diagnosis, and treatment for monitoring, diagnosing, and treating the virus in real time. And a third step of releasing the function.

On the other hand, the present invention, the first to set the real-time virus monitoring / diagnosis / treatment function for monitoring / diagnosing / treating the virus in real time to a wireless terminal having a processor in order to monitor / diagnose / treat the virus in real time Function, a second function that monitors / diagnoses / cures virus in real time using anti-virus engine processing unit, user notification processing unit and result processing unit, and real-time virus monitoring / diagnosis / treatment for monitoring, diagnosing / cleaning virus in real time A computer readable recording medium having recorded thereon a program for realizing a third function of releasing a function is provided.

As such, the present invention, when the real-time monitoring, diagnosis / treatment function is set in the "real-time monitoring, diagnostic setting processing unit" to set up for the virus monitoring / diagnosis / treatment in real time, the "real-time monitoring, diagnosis initialization processing unit" 'Real-time monitoring / diagnosis / treatment processing unit' is loaded into memory to perform the monitoring / diagnosis / treatment function. This 'real-time monitoring / diagnosis / treatment processing unit' The call will diagnose whether it is a computer virus or a mobile virus. If the diagnosed part is determined to be a computer virus or a mobile virus, the user notification processor is notified to the user, and the known result is treated and processed according to the user's choice within the possible range of the antivirus (vaccine) engine. Will be performed. Then, when the user executes the 'real time monitoring and diagnosis release processing unit' to release the real time monitoring / diagnostic / treatment function, the 'real time monitoring / diagnostic / treatment processing unit' for monitoring, diagnosing and treating a computer virus or a mobile virus. Will be released.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1A to 1C are exemplary diagrams for explaining a concept of monitoring / diagnosing / treating viruses in real time in a wireless terminal according to the present invention.

In the present invention, the real-time monitoring, diagnosis and treatment unit 103 that performs the function of monitoring, diagnosing and treating the virus in real time is loaded on the wireless terminal, and executed in the wireless terminal.

In this case, the real time monitoring, diagnosis and treatment unit 103 may be loaded into the wireless terminal by the user by the real time monitoring / diagnostic setting unit.

The real-time monitoring, diagnosis, and treatment unit 103 set as described above is loaded into a memory and diagnoses in advance about loading, access, etc. of all programs, and grants the corresponding authority.

For example, as shown in FIG. 1A, in the logical disk structure in the terminal, the mobile content 104 is loaded into the main memory 101 and executed by the mobile process 102 in real time. By monitoring, diagnosing and treating the unit 103, it is possible to load only the mobile content 104 determined to be a normal program through the virus diagnosis in the main memory 101, otherwise the virus or malicious code to the user virus and malicious Along with the notification that it is determined to be a code, it gives a choice of processing.

Next, as shown in FIG. 1B, when the mobile process 102 accesses any data 105 stored in a logical disk structure within the terminal, the real-time monitoring, diagnosis, and treatment unit 103 may, as shown in FIG. After the virus diagnosis is performed, access to the arbitrary data 105 is allowed. If the virus scan result turns out to be normal data, the mobile process 102 is allowed access to the data; otherwise, if it is found to be a virus or malware, the user has the option of processing with a notification that the user is determined to be a virus and malware. Will be given.

Next, as shown in FIG. 1C, the content 102 downloaded via wireless data communication or through serial communication or other external input is monitored in real time before being stored in a logical disk structure in the terminal. The diagnosis and treatment unit 103 is subjected to the virus test, diagnosis and treatment. If the virus scan result turns out to be normally downloaded content, it is allowed to be stored in the logical disk structure. Otherwise, if the virus scan result turns out to be a virus or malware, the user is given the option of processing with the notice that it is judged to be a virus or malware. Done.

In addition to the three functions described above, the real-time monitoring, diagnosis, and treatment unit 103 additionally supports real-time protection for all content and data input and output to the wireless terminal.

When the user releases the real-time monitoring, diagnosis and treatment unit 103 by using the real-time monitoring and diagnosis release unit, the real-time monitoring, diagnosis and treatment unit 103 no longer operates, and thus, a virus or other malicious code. The real-time monitoring function is released, and the function for real-time diagnosis and treatment is also released.

The real-time monitoring, diagnosis, and treatment unit 103 that performs the functions as described above is provided with various functional units as follows.

First, the real time monitoring and diagnosis setting unit is a part for setting the real time monitoring, diagnosis and treatment unit 103 by a user's command (instruction).

When the real time monitoring, diagnosis and treatment unit 103 is set, the real time initialization processor performs a preparation process for setting the system and loading the real time monitoring, diagnosis and treatment unit 103 in the memory.

The real-time monitoring and diagnosis processing unit is a part that is in charge of the real-time monitoring and diagnosis processing, and performs diagnosis when a virus diagnosis is required while monitoring (monitoring) in real time.

The anti-virus engine processor is a test engine called for diagnosis by the real-time monitoring and diagnostic processor.

The user notification processor is a part that delivers a notification to the user when it is determined that the virus is diagnosed by the antivirus engine. The result processor is called by the user's selection.

The result processing unit is a part for treating, deleting or disregarding the result diagnosed by the antivirus engine according to a user's selection.

The real-time monitoring and setting release unit is a part for releasing the real-time monitoring, diagnosis and treatment unit 103 by the user.

On the other hand, the present invention relates to a real-time virus monitoring, diagnosis and treatment method in a wireless terminal, which is associated with the platform, the process of setting up the real-time virus monitoring, diagnosis and treatment functions, real-time virus monitoring, diagnosis and treatment functions It is divided into three processes: disabling, disabling real-time virus monitoring, diagnosing and treating. Looking at each process in detail with reference to Figures 2 to 5c as follows.

2 is a diagram illustrating an embodiment of a process of setting a real time virus monitoring / diagnosis / treatment method in a wireless terminal according to the present invention, and FIG. 5A is a setting of a real time virus monitoring / diagnosis / treatment method in a wireless terminal according to the present invention. One embodiment flow chart for the process.

First, in order to set the real-time virus monitoring / diagnosis / treatment function in the antivirus program of the wireless terminal, after a user runs the vaccine program, a specific window for setting the real-time virus monitoring / diagnosis / treatment function is displayed on the screen. When the real time setting button is clicked according to the instructions displayed on the screen, the vaccine program passes the real time monitoring library identifier (ID) and the vaccine application code (required for security) to the real time monitoring initialization calling part.

When receiving the real-time monitoring library identifier (ID) and the vaccine application code, the real-time monitoring initialization calling unit first checks the real-time monitoring library identifier (ID) and the vaccine application code. Here, the real-time monitoring library identifier (ID) is an identifier (ID) negotiated with the platform and is a unique value on the platform. The vaccine application code is a value for authenticating the corresponding application. When the real-time monitoring library identifier (ID) and the vaccine application code are authenticated on the platform, the real-time monitoring unit loads the real-time monitoring library in an arbitrary memory area by using the real-time monitoring library identifier (ID).

When the real-time monitoring library is successfully loaded in any memory, the real-time monitoring unit returns a result value, and thus the set state result value is stored in an environment database to store and maintain the state of the result value.

After storing the setting state result value in the environment database, the real time virus monitoring / diagnosis / treatment function setting contents (setting success result or setting failure result) are output to the user through the LCD of the wireless terminal (notification). do. Then, a specific window for setting the real-time virus monitoring / diagnosis / repair function is closed.

If the real-time monitoring library for real-time virus monitoring is set through the above process, the malware and virus will be monitored while staying in the memory until the real-time virus monitoring / diagnosis / repair function is released.

3 is a diagram illustrating an embodiment of a monitoring / diagnosis / treatment process among real-time virus monitoring / diagnosis / treatment methods in a wireless terminal according to the present invention, and FIG. 5B illustrates real-time virus monitoring / diagnosis / in a wireless terminal according to the present invention. One embodiment flow chart for the monitoring / diagnosis / treatment process of the treatment method.

In general, various types of executable files are executed inside the wireless terminal, various types of files are inputted and outputted, and also various files are downloaded and uploaded through a network.

At this time, in each of the following cases other than manual inspection by the user in the wireless terminal, real-time monitoring, diagnosis, and treatment are automatically performed to prevent viruses.

1. When the executable is loaded into memory to run

2. When any executable file is input or output

3. When any file is downloaded or uploaded through the network

In addition, in order to monitor, diagnose, and treat a virus in real time within a wireless terminal in real time, real-time monitoring using a vaccine program is required.

That is, in order to monitor / diagnose / repair the virus in real time when various types of executable files are executed in a wireless terminal environment, when various types of files are inputted / outputted, or when various files are downloaded or uploaded through a network ( In other words, real-time monitoring of the virus is essential to prevent the virus from infecting normal files.

To this end, real-time monitoring, diagnosis, and residing in memory when several types of executable files are executed in a wireless terminal environment, when various types of files are inputted and outputted, or when various files are downloaded or uploaded through a network. Control is passed to the treatment unit 103.

Then, in order to monitor the virus in real time in the situation, the real-time monitoring, diagnosis and treatment unit 103 intercepts the call situation using predetermined functions (software interrupts) and executes the execution file, Find out when the file is input and output, and when the file is input and output via the network.

Thereafter, the identifier (file name or any identification code) of the target file and the status information value of the file are transmitted to the real-time monitoring, diagnosis and treatment unit 103.

Then, the real-time monitoring, diagnosis and treatment unit 103 calls the anti-virus engine processing unit by using the identifier of the target file and the status information of the file to check for viruses. Then, the anti-virus engine processing unit calls the vaccine engine database to diagnose the virus, determines whether the virus is infected, and returns the result. Here, the antivirus engine processor has a diagnosis algorithm for diagnosing a virus using a diagnosis pattern record, a treatment algorithm for deleting the virus, and a deletion routine.

As a result of the determination, if the anti-virus engine processing unit determines that the target file is not a virus infection (result value: normal file diagnosis), the real-time monitoring, diagnosis, and treatment unit 103 performs any requirements (file execution, file execution) requested by the system. Allow I / O, download and upload to network).

As a result of the determination, if it is determined that the virus is infected (result value: diagnosed as a virus), the result of the virus diagnosis is transmitted to the user notification processing unit. Then, the user notification processor outputs a notice on the screen to notify the user that the virus has been found. At this time, when the notice is displayed on the screen, the antivirus engine outputs a result value indicating whether or not the antivirus engine can be cleaned or deleted. In addition, the user is provided with three selection menus such as 'treat', 'delete', or 'ignore'. Here, 'ignoring' means that the user executes the file, input / output of the file, or network download and upload of the file despite the virus warning.

If the user selects a treatment, the user notification processor transmits the treatment state selection result to the result processor. The result processing unit then calls the anti-virus engine processing unit again for the treatable virus and malicious code to treat the virus with a virus treatment routine so as to be able to operate normally. At this time, the virus treatment routine uses the treatment pattern record stored in the virus treatment pattern database to treat the virus.

If the user selects to delete, the user notification processor transmits the deletion state selection result to the result processor. The result processor then calls the antivirus engine processor's deletion routine to delete the file infected with the virus.

Finally, if the user selects ignore, the user notification processor delivers the result of the ignore state selection to the result processor. The result processor then permits arbitrary access to the requirements of the system.

On the other hand, when a virus is detected in real time during the real-time monitoring, diagnosis and treatment process, a result record is generated and stored in a result record database, so that it can be used to notify the user later.

As described above, unless the real-time monitoring, diagnosis and treatment function is released, the real-time monitoring, diagnosis, and treatment function continues to execute viruses at the time of executing a random file on the wireless terminal, at the time of file input / output, network download, and upload. Perform monitoring, diagnosis and treatment.

4 is a diagram illustrating an embodiment of a release process of a real-time virus monitoring / diagnosis / treatment method in a wireless terminal according to the present invention, and FIG. 5C is a release of a real-time virus monitoring / diagnosis / treatment method in a wireless terminal according to the present invention. As an embodiment of the process flow, since it is performed in the same manner as the setting process, only the gist of the process will be briefly described.

In order to cancel the real-time monitoring, diagnosis and treatment function set in the above process, if the user selects the release after outputting a specific window to release the real-time monitoring, diagnosis and treatment function, the real-time monitoring, diagnosis and treatment function is performed. Will be released.

When the real-time monitoring, diagnosis and treatment function is released as described above, the memory-resident part of the real-time monitoring unit is released from the memory, and thus, it is no longer possible to monitor, diagnose and treat malware and viruses in real time.

Then, after the release state result for the release of the real-time monitoring, diagnosis and treatment function is stored in any environment database, the user is notified and the real-time release window is terminated.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily implemented by those skilled in the art will not be described in more detail.

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

As described above, the present invention monitors and diagnoses applications and contents that are introduced and executed through a wireless terminal, and automatically detects a virus (including a malicious code) produced by a malicious user when the virus enters and executes the wireless terminal in real time. And by diagnosing and treating, it is possible to minimize the damage that can be caused by the virus when the user uses the wireless terminal, thereby enabling safe wireless communication, it is possible to use the application with confidence.

In addition, the present invention has the effect of protecting and defending the wireless terminal platform from viruses (including malicious code) produced by malicious users.

Claims (4)

In the real-time virus monitoring / diagnosis / treatment method in the wireless terminal, A first step of setting a real-time virus monitoring / diagnosis / treatment function for monitoring / diagnosing / treating a virus in real time; A second step of monitoring / diagnosing / treating a virus in real time using an antivirus engine processor, a user notification processor, and a result processor; And Third step of disabling real-time virus monitoring / diagnosis / remediation to monitor / diagnose / repair virus in real time Real time virus monitoring / diagnosis / treatment method in a wireless terminal comprising a. The method of claim 1, The first step is, A fourth step of outputting a specific window for setting a real-time virus monitoring / diagnosis / treatment function on the screen according to the operation of the vaccine program; A fifth step of the vaccine program delivering a real-time monitoring library identifier (ID) and a vaccine application code (required for security) to a real-time monitoring initialization calling unit according to a real-time virus monitoring / diagnostic / repair function setting command; A sixth step of receiving, by the real-time monitoring initialization calling unit, the real-time monitoring library identifier (ID) and the vaccine application code, and examining the real-time monitoring library identifier (ID) and the vaccine application code; A seventh step in which the real time monitoring unit loads the real time monitoring library in an arbitrary memory area using the real time monitoring library identifier (ID) and returns a setting result value; And In order to save and maintain the setting state, the returned setting result value is stored in the environment database and after real-time virus monitoring / diagnosis / repair function setting contents (setting success result or setting failure result) are announced, real-time virus monitoring / diagnosis is performed. Eighth step of terminating the particular window for setting the healing function Real time virus monitoring / diagnosis / treatment method in a wireless terminal comprising a. The method according to claim 1 or 2, The second step, A ninth step of detecting, by the real-time monitoring, diagnosis and treatment unit, a virus diagnosis time and receiving an identifier (file name or any identification code) of the target file and a status information value of the file; A tenth step in which the real-time monitoring, diagnosis and treatment unit calls the antivirus engine processing unit by using the identifier of the target file and the state information of the file; An eleventh step of determining, by the anti-virus engine processor, a vaccine engine database to diagnose a virus and determining whether the virus is infected, and returning a virus diagnosis result value; The twelfth step of monitoring, diagnosing, and treating the processor to perform any requirement requested by the system if the virus diagnosis result value is not a virus infection; A thirteenth step in which the user notification processor selects a processing direction such as 'treatment', 'delete' or 'ignore' by notifying a virus discovery; And Fourteenth step in which the result processing unit calls the anti-virus engine processing unit according to the processing direction such as 'treat', 'delete' or 'ignore' to treat or delete the virus or to allow the system's requirements. Real time virus monitoring / diagnosis / treatment method in a wireless terminal comprising a. In order to monitor / diagnose / cure a virus in real time, A first function of setting a real-time virus monitoring / diagnosis / treatment function to monitor / diagnose / cure a virus in real time; A second function of monitoring, diagnosing, and treating a virus in real time using an antivirus engine processor, a user notification processor, and a result processor; And Third function for disabling the real-time virus monitoring, diagnosis, and treatment to monitor, diagnose, and repair viruses in real time A computer-readable recording medium having recorded thereon a program for realizing this.