KR20040098902A - Device and Method for Detecting Malicious Code of Process Memory - Google Patents

Abstract

PURPOSE: A device and a method for detecting a malicious code of a process memory are provided to detect existence of the malicious code based on confirmable information if the malicious code is present in the process memory. CONSTITUTION: A data storage(170) stores integrity data of an original file instruction code for executing a process and pattern data of a general instruction code. A code area monitor(140) judges that the malicious code is present in a code area of the process memory(100) based on the integrity data. A variable data area(150) monitor judges that the malicious code is present in a variable data area of the process memory based on the pattern data. A warning tool(160) outputs warning information if the malicious code is present.

Description

Malware detector in process memory and its method {Device and Method for Detecting Malicious Code of Process Memory}

The present invention relates to a malicious code detector and a method of the process memory, and more particularly, to a malicious code detector and method for monitoring whether or not the malicious code is present in the process memory by monitoring the process memory of the process running in the computer system It is about.

Process memory refers to a memory location in which a process executable code and data necessary for execution are loaded in order to execute a process in a computer system.

Malware refers to program codes that are intentionally designed to damage computer systems and include viruses, worms, Trojan horses or hacking programs.

Current computer systems have made it possible to access various network node systems with the development of network technology. But network access means that computer systems can be more vulnerable to malware.

In other words, the malware source system rapidly distributes malware through the network, and computer systems connected to the network are fatally damaged by the distributed malware.

According to the prior art, by recognizing the distribution of malicious code and analyzing the binary pattern for the malicious code to develop a vaccine program to proceed to the process of blocking the malicious code infection path or repairing the computer system infected with the malicious code.

The problem with this prior art is that the computer system is completely unprotected by the malware until the vaccine program against the malware is executed on the computer system. The severity of this problem is proportional to time. That is, the longer the time until the computer system is protected by the antivirus program, the more likely the network node system is infected with malicious code, and the number of computer systems that cannot function normally due to the malicious code increases. will be.

The present invention has been proposed to solve the above problems, and a malicious code detector of a process memory for detecting the presence of malicious codes based on information that can be identified when malicious code exists in the process memory, and a method thereof and a computer for realizing the method. It is an object of the present invention to provide a recording medium which can be read.

Other objects and advantages of the invention will be described below and will be appreciated by the practice of the invention. In addition, the objects and advantages of the present invention can be realized by means and combinations indicated in the claims.

1 is an overall configuration diagram of a computer system equipped with a malware detector according to a preferred embodiment of the present invention;

2 is a flow chart showing a malicious code detection process according to a preferred embodiment of the present invention;

3 is a view for explaining a code region inspection process of FIG.

4 is a view for explaining a heap region inspection process of FIG.

FIG. 5 is a diagram for describing a stack area inspection process of FIG. 2.

<Description of main reference numerals in the drawings>

100: process memory 101: code area

103: data area 105: heap area

107: stack area

110: CPU 111: DR (Debug Register)

113: IP (Instruction Pointer)

130: malware detector

140: code area monitoring means

141: integrity inspection unit 143: integrity comparison unit

150: variable data area monitoring means

151: code detection unit 153: BP setting unit

155: context check unit

160: warning means

170: data storage means

171: Integrity data 173: Excluded process identifier

175: command code pattern data

The present invention for achieving the above object is a device mounted on a computer system for detecting whether or not malicious code exists in the process memory, the integrity data of the original file command code and pattern data of the general command code for executing the process Stored data storage means, code area monitoring means for determining whether malicious code exists in the code area of the process memory based on the integrity data of the original file command code, variable process memory based on the pattern data of the general command code Variable data area monitoring means for determining whether or not malicious code is present in the data area and warning means for outputting warning information when it is determined that the malicious code is present.

In addition, the present invention for achieving the above object is executed in a computer system to detect whether or not malicious code exists in the process memory, the integrity of the original file command code for executing the process and the pattern of the general command code A first step of generating and storing data, a second step of determining whether malicious code exists in a code region of the process memory based on the integrity data of the original file command code, and a process based on the pattern data of the general command code And a third step of determining whether malicious code exists in the variable data area of the memory.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Prior to this, terms or words used in the specification and claims should not be construed as having a conventional or dictionary meaning, and the inventors should properly explain the concept of terms in order to best explain their own invention. Based on the principle that can be defined, it should be interpreted as meaning and concept corresponding to the technical idea of the present invention.

Therefore, the embodiments described in the specification and the drawings shown in the drawings are only the most preferred embodiment of the present invention and do not represent all of the technical idea of the present invention, various modifications that can be replaced at the time of the present application It should be understood that there may be equivalents and variations.

1 is an overall configuration diagram of a computer system equipped with a malware detector according to a preferred embodiment of the present invention. Referring to the drawings, the computer system according to the present invention executes the command code of the process and the data is loaded and executed in the process memory 100, the process code of the process memory 100 in order to control the CPU ( 110) and a malicious code detector 130 that checks whether or not the malicious code exists in the process memory (100).

The process memory 100 is allocated by a computer operating system (OS) and is generally divided into a code area 101, a data area 103, and a variable data area.

The code area 101 is an area in which command code for executing a process is loaded and executed from the original file to achieve the main function of a process such as a function call or a branch.

The data area 103 is a portion in which data necessary for executing the command code of the code area 101 is stored. The data area 103 is an area in which data already estimated and allocated from the source code is stored.

The variable data area refers to the heap area 105 and the stack area 107. The heap region 105 is a memory region that stores and uses a variable amount of data that is not known until a process is executed. Having a certain amount of heap area 105 already available from a computer operating system (OS) can make storage-related processing easier, and is generally a process rather than requesting storage space from the computer operating system (OS) whenever needed. It is used for many programs because of its fast processing speed.

Similar to the heap area 105, the stack area 107 is a data store required for processing related to the storage of a process, in which data is recorded in a specific order and read out in the same manner.

The heap region 105 is a place for storing data shared by the whole process in the process execution, whereas the stack region 107 stores data related to the execution of the thread of the process. Therefore, the stack region 107 may have several stack regions 107 according to the number of threads of the process.

The malware detector 130 monitors the process memory 100 of the running process to check whether or not the malware exists. The malicious code is generally inserted into the code area 101 of the process memory to change the code area 101 or to intentionally overrun the data stored in the variable data area to execute the command code.

In general process, the code area is changed during execution or the command code is rarely executed in the variable data area. Therefore, it is possible to detect such a change and confirm the existence of malicious code.

Accordingly, the malicious code detector 130 monitors whether the code area monitoring unit 140 monitors whether the code area 101 of the process memory has been changed and whether the malicious code exists in the variable data area of the process memory. Area monitoring means (150).

In addition, the malware detector includes a data storage unit 170 for storing data necessary for monitoring the malicious code, and a warning means 160 for outputting warning information to the computer user when it is determined that the malicious code exists.

The data storage unit 170 stores integrity data 171 and general command code pattern data 175 of the command code of the process original file.

Integrity data is a value used to confirm whether the integrity of the command code is guaranteed later, it is preferably calculated by an algorithm such as a cyclic redundancy check (CRC) or a checksum.

Integrity data 171 of the command code of the process source file is preferably calculated and stored at a point in time when the integrity of the source file command code is guaranteed (when no malicious code exists).

In addition, the data storage unit 170 may further store the exclusion process identifier 173 and exclude the process memory 100 corresponding to the exclusion process identifier 173 from being inspected. The general process does not change the code area 101 of the process memory 100 during execution, but there may be a process of changing the code area 101 such as a firewall program. Therefore, by registering the exclusion process identifier 173 to distinguish the process into the data storage means 170 in advance, it is possible to exclude the malicious code check for the process.

In addition, the exclusion process identifier 173 may be additionally registered at any time by the computer system user to exclude the malicious code scan.

The code area monitoring unit 140 includes the integrity data calculated by the integrity checking unit 141 and the integrity checking unit 141 which generate the integrity data of the code area 101 and the original file integrity data stored in the data storing unit 170. 171) compares and includes an integrity comparison unit 143 that determines that the malicious code exists if there is no match.

The variable data area monitoring unit 150 includes a code detection unit 151 and a matching code for checking whether or not a command code corresponding to the general command code pattern data 175 stored in the data storage unit 170 exists in the variable data area. If a pattern exists, the BP setting unit 153 sets a break point at a corresponding address.

The address of the process memory where the break point is set is stored in the DR (Debug Register, 111) of the CPU 110, and the IP (Instruction Pointer, 113) indicating the instruction code address executed during process execution is stored in the DR (111). If matched with the CPU 110 generates an interrupt.

In addition, the variable data area monitoring unit 150 extracts a thread context from a computer operating system (OS), and determines that a malicious code exists when the IP (Instruction Pointer) of the thread context points to the variable data area. It may further include a context inspection unit 155 to.

The context is the execution information of a running thread and includes CPU register information at a specific point in time. Therefore, you can check whether the command code is executed in the variable data area by checking the IP from the context of the running thread.

The warning means outputs the warning information when it is determined that the malicious code exists by the code area monitoring means 140 and the variable data area monitoring means 150 so that the computer system user can establish an appropriate defensive measure.

Hereinafter, the process of detecting the malicious code by the malicious code detector 130 will be described in detail. In the description, the same reference numerals as in FIG. 1 refer to the same members performing the same functions.

In addition, the malicious code detection process described below is limited to a process that is not registered as the exclusion process identifier 173 in the data storage means 170.

2 is a flowchart illustrating a malware detection process according to a preferred embodiment of the present invention. Referring to the drawing, the malware detector 130 extracts a process handle running from a computer operating system (OS) (S200).

The computer operating system (OS) has an information structure for every process that runs, and the process handle serves as the key used to access the information structure and obtain the necessary information. Therefore, information about the address of the process memory 100 running from the computer operating system (OS) can be extracted through the process handle.

When the address of the process memory 100 is extracted, the malicious code detector 130 checks whether malicious code exists in the code area, the heap area, and the stack area of the process memory (S300, S400, S500).

When a new process is executed, the malicious code detector 130 automatically executes the above-described series of inspection processes or automatically executes at a specific point in time (a desired time or a certain period of time), so that malware exists in the currently running process memory. You can check whether it is.

FIG. 3 is a diagram for describing a process of inspecting a code region of FIG. 2. Referring to the drawing, the integrity checking unit 141 of the code area monitoring unit 140 generates integrity data for the code area 101 of the process memory 100 of the running process (S310).

The integrity comparing unit 143 extracts the integrity data 171 of the process original file command code stored in the data storing unit 170 and compares the integrity data calculated by the integrity checking unit 141 (S320 and S330).

As a result of the comparison, when the integrity data is matched, the code area 101 is not changed by the malicious code, and the process is continued (S340).

If the integrity data does not match, it is determined that the code area 101 is changed by the malicious code, and the warning means 160 outputs warning information indicating that the malicious code exists to the computer system user (S350).

On the other hand, if the code area 101 includes modules commonly used in a plurality of processes, it is also possible to compare the integrity data by performing an integrity check for each module. In this case, the data storage means 170 should store the integrity data of the original file command code of the module.

4 is a diagram for describing a process of inspecting a heap region of FIG. 2. Referring to the figure, the code detection unit 151 of the variable data area monitoring unit 150 extracts the address of the heap area 105 using the process handle (S410). Thereafter, the code detection unit 151 accesses the heap area 105 using the extracted address, and thus there exists a command code corresponding to the command code pattern data 175 stored in the data storage means 170 in the heap area 105. It is checked whether or not (S430).

General command code pattern data 175 is illustrated in Table 1 below as related to process execution, such as execution of a function, termination of a function, branching of a function, and the like.

Code pattern Representative pattern Start function push ebpmov ebp, espsub esp, 20h Function exit mov esp, ebppop ebpret Conditional statement cmp dword ptr [ebp-4], 1jne main + 30h Loop PSEUDO_RAND_SEND: .... jmp short PSEUDO_RAND_SEND Execute function push eaxcall dword ptr [esi]

If there is no command code matching the pattern data 175 of the general command code in the heap area 105, the running process continues to be executed (S430, S440).

If a matching command code exists, the BP setting unit 153 sets a break point at the corresponding address (S450). Afterwards, when the IP 113 of the CPU 110 indicates the address at which the brake is set, the instruction code is executed in the heap region 105, and the CPU 110 generates an interrupt (S460). After the break point is set, if the IP 113 does not point to the break address, the command code is not executed in the heap area 105, and the process continues to be executed (S440).

On the other hand, when an interrupt occurs by the CPU 110, the warning means 160 outputs warning information that a malicious code exists to the computer user (S470).

FIG. 5 is a diagram for describing a process of inspecting a stack region of FIG. 2. Since one process may have several threads, there may be many stack regions 107 for one process. Therefore, the malicious code detector 130 should check whether or not malicious code exists for each stack region 107.

Referring to the drawing, the context inspecting unit 155 of the variable data area monitoring unit 150 extracts a thread context from the computer operating system (OS) (S510). If there are multiple threads running in a process, it extracts multiple thread contexts.

The context inspecting unit 155 checks whether the extracted thread context IP points to the stack region (S520). If the IP of the thread context points to the stack region, the command code is executed in the variable data region, so the context inspecting unit 155 determines that the malicious code exists in the stack region 107 (S530). Therefore, the warning means 160 outputs the warning information that the malicious code exists to the computer user to perform the appropriate defense policy (S540).

On the other hand, since the thread context contains only the instantaneous information of the running thread, the context IP points to the code region 101 at the time when the malware detector 130 inspects the malware even in the stack region 107. Can be.

Therefore, as in the heap region 105 inspection of FIG. 4, it is preferable to check whether the instruction code exists in the stack region 107 of the entire range.

Therefore, the code detector 151 extracts the address of the stack region 107 using the process handle (S550). Thereafter, the code detection unit 151 accesses the stack area 107 using the extracted address, and thus the command code corresponding to the command code pattern data 175 stored in the data storage means 170 exists in the stack area 107. It is checked whether or not (S560). The general command code pattern data 175 is as described above.

If there is no command code in the stack area 105 that matches the pattern data 175 of the general command code, the process continues as it is (S570, S580).

If a matching command code exists, the BP setting unit 153 sets a break point at the corresponding address (S590). Afterwards, when the IP 113 of the CPU 110 points to the address at which the brake is set, the instruction code is executed in the stack region 105, and the CPU 110 generates an interrupt (S600). If the IP 113 does not point to the break set address after the break point is set, the command code is not executed in the stack region 105, and thus the running process continues to be executed (S580).

On the other hand, if an interrupt occurs by the CPU 110, the warning means 160 outputs warning information that a malicious code exists to the computer user (S610).

When the warning information is output by the warning means 160, the user of the computer system may stop using a network connected to the computer system or stop input / output of a file. You can also terminate the execution of an ongoing process or thread. This prevents malware from spreading to other computer systems using the network.

In addition, by adding the identifier of the process to the data storage means 170 without leaving the process in progress, it is also possible to exclude the process from the detection of malware later.

As mentioned above, although this invention was demonstrated by the limited embodiment and drawing, this invention is not limited by this, The person of ordinary skill in the art to which this invention belongs, Of course, various modifications and variations are possible within the scope of equivalent claims.

According to the present invention, even if the malicious code is not already recognized, it is possible to detect whether the malicious code is infected by the process being executed in the system, thereby preventing the spread and re-infection of the malicious code. Therefore, even before a malicious code treatment method is provided, a computer user can establish an appropriate defense policy to secure a computer system.

Claims (27)

A device mounted on a computer system to detect whether malicious code exists in process memory. Data storage means for storing integrity data of an original file command code and pattern data of a general command code for executing the process; Code area monitoring means for determining whether malicious code exists in a code area of a process memory based on integrity data of the original file command code; Variable data area monitoring means for determining whether malicious code exists in the variable data area of the process memory based on the pattern data of the general command code; And Warning means to output warning information when it is determined that malicious code exists Malware detection apparatus of the process memory comprising a. The method of claim 1, The code area monitoring means An integrity check unit which generates integrity data of the code area of the process memory; And Integrity comparison unit that compares the integrity data calculated by the integrity checker with the original file integrity data stored in the data storage means and judges that a malicious code exists if there is a mismatch Malware detection apparatus of the process memory, characterized in that it comprises a. The method of claim 2, The integrity data is Malware detection apparatus of the process memory, characterized in that calculated by the cyclic redundancy check (CRC) algorithm. The method of claim 1, The variable data area monitoring means A code detection unit for searching whether or not a command code matching the pattern data of a general command code stored in the data storage means exists; And BP setting part that sets break point at the corresponding address when there is a matching code pattern Including, And detecting a malicious code when an interrupt occurs when an IP (Instruction Pointer) of the CPU of the computer system matches an address set to a break point. The method of claim 4, wherein And the variable data area is a heap area. The method of claim 4, wherein And the variable data area is a stack area. The method of claim 6, The variable data area monitoring means A context inspector which extracts a thread context from an operating system (OS) of the computer system and determines that malicious code exists when an IP (Instruction Pointer) of the thread context indicates a variable data area. Malware detector of the process memory, characterized in that it further comprises. The method according to any one of claims 1 to 7, The data storage means Further stores identifiers of processes that are excluded from scanning And a process memory corresponding to the process identifier is excluded from the inspection object. The method of claim 8, The exclusion process identifier of the data storage means is And the malware detector of the process memory, wherein the malware is stored by the computer system user. A method that is executed on a computer system and detects whether malicious code exists in process memory. A first step of generating and storing integrity data of an original file command code and pattern data of a general command code for executing the process; A second step of determining whether malicious code exists in a code area of a process memory based on integrity data of the original file command code; And A third step of determining whether malicious code exists in the variable data area of the process memory based on the pattern data of the general command code; Malicious code detection method of the process memory comprising a. The method of claim 10, The second step is A fourth step of generating integrity data of a code area of said process memory; A fifth step of comparing the integrity data calculated in the fourth step with the original file integrity data stored in the first step; And Step 6 in which malicious code exists and outputs warning information when the integrity data does not match as a result of the comparison Malware detection method of the process memory, characterized in that it comprises a. The method of claim 11, The integrity data is Malicious code detection method of the process memory, characterized in that calculated by the CRC (Cyclic Redundancy Check) algorithm. The method of claim 10, The third step is A seventh step of searching for whether there is a command code matching the pattern data of the general command code stored in the first step; An eighth step of setting a break point at a corresponding address when a matching code pattern exists; And A ninth step of determining that a malicious code exists and outputting warning information when an interrupt occurs when an IP (Instruction Pointer) of the CPU of the computer system matches an address set to a break point; Malicious code detection method of the process memory comprising a. The method of claim 13, And the variable data area is a heap area. The method of claim 13, And the variable data area is a stack area. The method of claim 15, The third step is Extracting a thread context from an operating system (OS) of the computer system; An eleventh step of determining that a malicious code exists and outputting warning information when an IP (Instruction Pointer) of the thread context indicates a variable data area; Malicious code detection method of the process memory, characterized in that it further comprises. The method according to claim 10 to 16, The first step is And a twelfth step of storing the process identifier excluded from the inspection subject, And detecting a process memory corresponding to the process identifier from the inspection target. The method of claim 17, The 12th step is Malicious code detection method of a process memory, characterized in that stored by the computer system user. It runs on a computer system and detects whether malicious code exists in process memory. A first step of generating and storing integrity data of an original file command code and pattern data of a general command code for executing the process; A second step of determining whether malicious code exists in a code area of a process memory based on integrity data of the original file command code; And A third step of determining whether malicious code exists in the variable data area of the process memory based on the pattern data of the general command code; A computer-readable recording medium having recorded thereon a program for executing the program. The method of claim 19, The second step is A fourth step of generating integrity data of a code area of said process memory; A fifth step of comparing the integrity data calculated in the fourth step with the original file integrity data stored in the first step; And Step 6 in which malicious code exists and outputs warning information when the integrity data does not match as a result of the comparison A computer-readable recording medium having recorded thereon a program for executing the program. The method of claim 20, The integrity data is A computer-readable recording medium having a program recorded thereon, which is calculated by a cyclic redundancy check (CRC) algorithm. The method of claim 19, The third step is A seventh step of searching for whether there is a command code matching the pattern data of the general command code stored in the first step; An eighth step of setting a break point at a corresponding address when a matching code pattern exists; And A ninth step of determining that a malicious code exists and outputting warning information when an interrupt occurs when an IP (Instruction Pointer) of the CPU of the computer system matches an address set to a break point; A computer-readable recording medium having recorded thereon a program for execution. The method of claim 22, And the variable data area is a heap area. The method of claim 22, And the variable data area is a stack area. The method of claim 24, The third step is Extracting a thread context from an operating system (OS) of the computer system; An eleventh step of determining that a malicious code exists and outputting warning information when an IP (Instruction Pointer) of the thread context indicates a variable data area; A computer-readable recording medium having recorded thereon a program for execution. 26. The method of claim 19, wherein The first step is And a twelfth step of storing the process identifier excluded from the inspection subject, And a process memory corresponding to the process identifier, to be excluded from the inspection object. The method of claim 26, The 12th step is And a computer readable recording medium storing a program recorded by the computer system user.