KR20060133728A - Method and apparatus and system for cutting malicious codes - Google Patents

Abstract

A method, a device, and a system for blocking malicious codes are provided to minimize damage of a computer system before a vaccine program is generated by preventing the malicious codes from being intruded or operated in the computer system. A network blocking module(541) blocks intrusion of a program or prevents the computer system from accessing the network in case that an event set in a malicious code blocking policy is generated in the program entered through the network. A resource preoccupying module(549) preoccupies at least one of Mutex(Mutual Exclusion Object), the event, a semaphore, and a specific registry according to the blocking policy if the blocking policy is received to the computer system. The network blocking module blocks access to the network by blocking at least one of an IP(Internet Protocol) address, an access port number, and a protocol of the network. A file/folder blocking module(545) prevents the malicious code from accessing a file or a folder needed for activation according to the blocking policy.

Description

METHOD AND APPARATUS AND SYSTEM FOR CUTTING MALICIOUS CODES}

1 illustrates a system for blocking malicious code according to an embodiment of the present invention.

2 is an internal block diagram of a blocking policy management apparatus for blocking malicious code according to an embodiment of the present invention.

3 is a flowchart illustrating a malicious code blocking method according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100: blocking policy management device

200, 400: computer system

300: network

The present invention relates to a malicious code blocking method and apparatus for minimizing damage to a computer system by invading the computer by malicious code distributed to the computer through a network and the system.

In general, malicious code refers to program codes that are intentionally designed to damage computer systems, and include viruses, worms, Trojan horses, or hacking programs.

When a malicious code is generated and distributed and the system is infected with the malicious code, damages that damage the system by destroying or distorting various resources inside the system have occurred. Accordingly, treatment-based vaccine programs are constantly being provided to recover systems damaged by malicious code.

However, the discovery of new malware causes a certain period of time until the creation of a vaccine program that focuses on the treatment and repair of the system damaged by the malicious code, that is, after the detection and damage cases of the malicious code have been reported. Recently, due to the improvement of Internet usage and network environment, the time required for the generation, distribution, and infection of the malicious code is further accelerated, so that many systems are already infected by the malware even during the vaccine production and distribution. As it is, malicious code is spread and the damage amounted to a large number.

In addition, because vaccines use high system resources for the treatment and recovery process and keep increasing information on tens of thousands of malicious codes, some systems may not be able to receive vaccines due to resource limitations and administrative issues. . In order to minimize the damage caused in this series of processes, it is urgent to prepare a countermeasure that can prevent the spread of malicious code until the generation of the malware and the time when the vaccine is produced, distributed and applied.

The present invention has been made in view of the above circumstances, and an object of the present invention is to block intrusion of malicious code in order to minimize damage of a computer system due to malicious code after generating a malicious code program after generating a malicious code. To provide a method and apparatus for blocking malicious code and a system for blocking the activity of the malicious code inside the system.

Malicious code blocking method according to a first aspect of the present invention for achieving the above object,

A) analyzing the malicious code by detecting malicious code spread over the network;

B) creating a blocking policy for blocking the malicious code based on the analyzed result;

C) sending the blocking policy to a computer system via a network; And

D) if the vaccine program for the malicious code is generated, replacing the blocking policy with the vaccine program.

Malware blocking apparatus according to a second aspect of the present invention for achieving the above object,

A network blocking module that blocks an entry of the program or blocks the computer system from accessing the network when an event set in a malicious code blocking policy occurs for a program entering a computer system through a network; And

And a resource preemption module for preempting at least one of a mutex, an event, a semaphore, and a specific registry according to the blocking policy when the blocking policy is received by the computer system.

The network blocking module may block access to the network by blocking at least one of an IP address, an access port number, and a protocol of the network.

Malware blocking system according to a third aspect of the present invention for achieving the above object,

Analyze how malicious code spreads through the network invade computer systems or patterns after intrusion to create a blocking policy to block the malicious code, and manage the blocking policy to send the blocking policy to the computer system Device; And

When the malicious code is detected by connecting to the blocking policy management device through the network, the blocking policy management device is notified, the malicious code is blocked according to the blocking policy received from the blocking policy management device, and the blocking history is displayed. And a computer system generating a log file and uploading the log policy management device.

Therefore, according to the present invention, it is possible to minimize the extent of damage and the duration of infection to be applied to a computer system exposed to malicious code.

Hereinafter, with reference to the accompanying drawings will be described a preferred embodiment of the present invention.

1 illustrates a system for blocking malicious code according to an embodiment of the present invention.

Referring to FIG. 1, a system for blocking malicious code generates and distributes a priority blocking policy with only a minimum activity pattern set by an administrator, even if only a few activity characteristics of the malicious code are extracted. A blocking policy management apparatus 100 for discovering a pattern or feature to reinforce the blocking policy; A computer system 200 for blocking the malicious code by applying the blocking policy according to the characteristics of each system; A network (300) for performing continuous information exchange between the blocking policy management device (100) and the computer system (200); And a plurality of computer systems 400 networked with the computer system 200.

The blocking policy management apparatus 100 generates a blocking policy by analyzing a path in which malicious code detected on a network invades a computer system, an invading method, and a pattern in which malicious code invades the computer system.

In other words, IP, port number, network protocol method, type of IN / OUT used by the malicious code to access the system, name or file name of the program related to the malicious code, email subject in case of email , The contents of the body, and files attached to an email, a folder used by the malicious code, a registry, a mutex, a semaphore, and event information generated by the malicious code, thereby detecting a pattern in which the malicious code operates. It can be seen. Therefore, the blocking policy management apparatus 100 generates a blocking policy based on the detected information when at least one or more of an intrusion path of the malicious code, an intrusion method, and an activity pattern of the malicious code are detected. At this time, the blocking policy management device 100 generates a blocking policy including the anticipated antivirus program name and version information for the malicious code.

The blocking policy management apparatus 100 upgrades the blocking policy by periodically supplementing or deleting the blocking policy periodically, preferably in real time, whenever the information on the malicious code is upgraded.

In addition, the blocking policy management apparatus 100 transmits the blocking policy to the computer system 200 to block malicious code. In other words, the blocking policy management apparatus 100 continuously distributes the blocking policy to the computer system 200 whenever the blocking policy is upgraded, and deletes the blocking policy when an antivirus program corresponding to the malicious code is generated. By downloading the vaccine program or by patching the blocking policy, the vulnerable part is reinforced, and when the activity of the malicious code is stopped, the blocking policy according to the malicious code is deleted to stop the blocking of the malicious code.

The computer system 200 is connected to the blocking policy management apparatus 100 through a network 300 to transmit and receive data, the computer system 200 is connected to a plurality of computer systems, and the other computer system applies the blocking policy. It is possible to distribute the blocking policy on request.

The computer system 200 may include a detection unit 210 for detecting invasive malicious code and a blocking policy selection unit 230 for selecting only a blocking policy suitable for its own system from among blocking policies received from the blocking policy management device 100. ), An execution unit 250 for blocking the malicious code according to the blocking policy, a backup / recovery unit 260, a log file management unit 270, and a transmission unit 280.

The execution unit 250 for blocking the malicious code should minimize the change of resources of the computer system 200 so that the computer system 200 operates normally by focusing on blocking the malicious code.

The log file manager 270 may perform a blocking policy applied according to a method and a path in which the malicious code invades the computer system 200, or a pattern activated after invading the computer system 200, and the blocking policy. A plurality of blocking modules for collecting and analyzing the results of blocking the malicious code in real time to generate and manage the results in a log file. In addition, the log file management unit 270 periodically transmits the generated log file to the blocking policy management device 100 in real time, preferably in real time, so that the blocking policy management device 100 may transmit the malicious file from the log file. The activity pattern of the code is detected and the detected activity pattern is reflected in the blocking policy.

The backup / recovery unit 260 performs a function of recovering the information of the specific file or registry when the information of the specific file or the registry is deleted due to unnecessary blocking while blocking the malicious code in the execution unit 250. .

In addition, the backup / recovery unit 260 performs a function of backing up a file or registry suspected of malicious code before deleting and randomly recovering the file after deleting the file.

2 is an internal block diagram of a malicious code blocking device for blocking malicious code according to an embodiment of the present invention.

Referring to FIG. 2, the malicious code blocking apparatus 500 is a specific server connected to a terminal, such as a computer, a laptop, or a plurality of terminals that can be connected to the network 300, and performs blocking of the detected malicious code.

The malicious code blocking device 500 includes a policy management unit 530 for managing a blocking policy for malicious code, a blocking / preemption execution unit 540 for blocking the malicious code according to the blocking policy, and activity of the malicious code. And a log file manager 570 and a backup / recovery unit 560 for recording patterns and / or blocking details of the malicious code.

Preferably, the malicious code blocking device 500 further includes a malicious code detector 510, a malicious code analyzer 520, and a display unit 550.

The malicious code detection unit 510 classifies the program as malicious code when a program entering the malicious code blocking device 500 that is a computer system through the network adversely affects the computer system.

The malicious code analyzer 520 analyzes a method of injecting the malicious code detected by the malicious code detector 510 into the computer system, an intrusion path, and a pattern in which the malicious code operates in the computer system. In addition, when a log file is received from the log file manager 570, the log file is analyzed to determine whether a new activity pattern of the malicious code exists.

The policy manager 530 receives and manages a blocking policy corresponding to the malicious code from an external terminal or generates a blocking policy based on a result analyzed by the malicious code analyzer 520.

The blocking / preemption execution unit 540 may include at least one of a network blocking module 541, an email blocking module 543, a file / folder blocking module 545, a registry blocking module 547, and a resource preemption module 549. It is configured to include.

When the event set in the blocking policy is generated due to a program entering the computer system that is the malicious code blocking device 500 through the network, the network blocking module 541 accesses the access port number and the IP on the network according to the blocking policy. Blocking the computer system from accessing the network by blocking an address, a protocol represented by TCP / UDP, etc., and transmits the result to the log file management module 570.

The email blocking module 543 requests the mail server that sends the email in accordance with the blocking policy so that the email is first sent to the email blocking module 543 before being sent to the recipient's computer system. The email blocking module 543 analyzes the information of the email intercepted in the middle, and generates a warning mail when a malicious code is found, and generates the email as a file that is not executed and attaches the warning mail to the recipient. Transfer to computer system.

The file / folder blocking module 545 accesses the specific file or the specific folder for a program, a process, or a file to access the specific file or the specific folder defined in the blocking policy or to create or modify the specific file or the specific folder. Blocking the malicious code, terminating sharing of the specific folder, or deleting the program, process, or file itself classified as malicious code, and transmitting the result to the log file management module 570. .

The registry blocking module 547 blocks the malicious code from accessing the registry or creates or modifies the registry for malicious code that attempts to access or create or modify the registry defined in the blocking policy. Block what you are trying to do. Alternatively, the registry blocking module 547 blocks the activity of the malicious code by directly blocking the registry, and transmits the above-described series of blocking results to the log file management module 570.

The resource preemption module 549 blocks the malicious code from operating in the system by preempting the resources necessary for the malicious code to operate inside the system. When the blocking policy is provided to a computer system, the resource preemption module 549 preempts a resource used by the malicious code among resources such as a mutex, an event, a semaphore, and a specific registry to preempt the malicious code. Block normal activity. For example, the resource preemption module 549 uses the resource in advance to determine that the malicious code is already active in the computer system, so that the malicious code is interrupted from activity in the computer system.

The operating state of the present invention configured as described above will be described.

3 is a flowchart illustrating a malicious code blocking method according to an embodiment of the present invention.

When the malicious code is generated and distributed and an abnormality caused by the malicious code is found in the computer system 200, it is determined that the abnormality is malicious code having a certain activity pattern. If it is determined that the malicious code is the malicious code, various methods such as the method or entry path of the malicious code into the computer system, a process name for the malicious code to operate, email information, a file and folder to be used, a mutex to use, an event, etc. The malicious code is analyzed by examining the elements (S300).

Based on the analysis result of step S300, a blocking policy including information on a blocking target, a method for blocking, and information on a vaccine program corresponding to the malicious code is generated and registered (S310).

The generated blocking policy is transmitted to a computer system, such as a computer, a notebook, and the like, which should block malicious code (S320).

In addition, the blocking policy is upgraded in real time when the analysis result of step S300 is upgraded, the computer system 200 to the blocking policy management server 100 to generate and manage the blocking policy periodically or in real time. Connect to download the upgraded blocking policy.

The computer system 200 selects a blocking policy to be applied to the system among the received blocking policies, and the computer system 200 accesses the blocking policy management server 100 to download an upgraded blocking policy. Even when it is possible to select and download only the selected blocking policy (S330).

The computer system 200 prevents the intrusion of the malicious code or blocks the activity of the malicious code by using the blocking policy (S340).

In addition, the computer system 200 collects and organizes the selected blocking policy, the blocking activity by the blocking policy, the activity pattern of the malicious code, and generates a log file and uploads it to the blocking policy management server 100 ( S350).

The blocking policy management server 100 analyzes the log file to upgrade the blocking policy and transmits the upgraded blocking policy to the computer system 200 (S360).

The blocking policy is further supplemented with the contents of the blocking policy from the log file, thereby increasing the scope and accuracy of the blocking policy. The blocking policy is continuously upgraded until a vaccine program corresponding to the malicious code is generated and distributed or it is determined that activity of the malicious code is lost. Therefore, when the vaccine program is generated and downloaded, the computer system 200 stops using the blocking policy or deletes the blocking policy itself (S370 and S380).

As described in detail above, according to the malicious code blocking method and apparatus and system of the present invention, the blocking policy according to the activity pattern is generated and applied almost simultaneously with the time when the unique activity pattern found in the process of distributing the malicious code is collected. Therefore, there is an advantage of minimizing the damage to the computer system exposed to malicious code when the anti-virus program is not yet made.

In addition, by blocking the malicious code in advance, it is possible to significantly reduce the number of repair costs inevitably paid if the vaccine cannot be treated after the malware is infected.

In addition, the pre-blocking target is focused on the malicious code and the behavior of the malicious code, so that computer system resources are less distorted and changed, thereby minimizing damage caused by system resource changes.

In addition, the administrator can select and apply the blocking policy required for the system, and can minimize the damage caused by malicious code by quickly blocking even the system that is not applied with the latest malicious code vaccine program due to the limitation of system resources. have.

In addition, unlike traditional methods of deleting or suspiciously modifying emails that are infected or suspected of being malicious code, create an email that includes a warning phrase and attach the original email to it. By passing on the original email, the original email block is minimized.

Although the present invention has been described in detail with reference to preferred embodiments, the present invention is not limited to the above-described embodiment, and the technical field to which the present invention belongs without departing from the gist of the present invention as claimed in the following claims. Anyone skilled in the art will have the technical idea of the present invention to the extent that various modifications or changes are possible.

Claims (21)

A) analyzing the malicious code by detecting malicious code spread over the network; B) creating a blocking policy for blocking the malicious code based on the analyzed result; C) sending the blocking policy to a computer system via a network; And D) replacing the blocking policy with the vaccine program when the vaccine program for the malicious code is generated. The method of claim 1, wherein in step A), The malicious code blocking method, characterized in that the malicious code invades the computer system, or analyzing the activity pattern after the intrusion into the system. The method of claim 2, wherein the activity pattern of the malicious code, IP, port number, network protocol method, type of IN / OUT used by the malicious code to access the system, folder and file name used by the malicious code, process name to run the malicious code And at least one of a registry, a mutex, a semaphore, and event information. According to claim 2 or 3, wherein the blocking policy generated in step B), B-a) a policy for blocking the malicious code from invading the computer system according to the malicious code intrusion method; And B-b) The malicious code blocking method comprising the policy of blocking the activity pattern of the malicious code, when the malicious code is invaded into the computer system. The method of claim 4, wherein the blocking policy, B-c) further comprises a policy for deleting the malicious code invaded the computer system. The method of claim 4, wherein step B) B-1) if a new analysis result is derived in step A), further comprising the step of generating a blocking policy reflecting the analysis result, The upgraded blocking policy is transmitted to the terminal through the network. The method of claim 1, wherein the method is E) receiving a blocking policy corresponding to malicious code to be blocked by the computer system and selecting a blocking policy to be applied to the computer system; F) When a predetermined event occurs according to the selected blocking policy, the computer system blocks the intrusion of the malicious code or preempts a resource to be used by the malicious code after receiving the blocking policy. Blocking activity; And G) the computer system further comprises the step of generating and storing the selected blocking policy, and accordingly the malicious code blocking history as a log file. The method of claim 7, wherein the method is H) periodically uploading the log file from the computer system using the network; And I) further comprising the step of correcting or deleting the blocking policy by comparing the log file with the analysis result of the malicious code. The method according to claim 7 or 8, wherein step F) F-a) When the predetermined event occurs according to the blocking policy, further comprising the step of blocking the computer system access to the network. The method of claim 9, wherein step F) F-1) searching for the e-mail delivered through the network and generating an alert e-mail when malicious code is included; And F-2) further comprising the step of making the e-mail into an inoperative file and attaching the e-mail to the recipient's computer system. The method of claim 10, wherein the method is Preventing the computer system from accessing a predetermined file or folder that the malicious code uses for activity by the blocking policy, selecting one of the file system and the folder to terminate sharing, and deleting the file. Malware blocking method further comprising a. The method of claim 10, wherein the method is Select at least one or more of the computer system to block access to a predetermined registry that the malicious code uses for activity, block creation or modification of the registry, and delete the registry according to the blocking policy. Malicious code blocking method comprising the step of performing further. The method of claim 7 or 8, wherein preempting a resource to be used by the malicious code comprises: And wherein the computer system preempts at least one or more of a mutex, an event, a semaphore, and a resource of a specific registry that the malicious code uses for activity by the blocking policy. A network blocking module that blocks an entry of the program or blocks the computer system from accessing the network when an event set in a malicious code blocking policy occurs for a program entering a computer system through a network; And And a resource preemption module for preempting at least one of a mutex, an event, a semaphore, and a specific registry according to the blocking policy when the blocking policy is received by the computer system. The network blocking module may block access to the network by blocking at least one of an IP address, an access port number, and a protocol of the network. The method of claim 14, wherein the device, If malicious code is found that attempts to execute at least one of accessing, modifying, and creating a file or folder, the malicious code is blocked from accessing or sharing the file or folder required for activity. File / folder blocking module; And If malicious code is found that attempts to execute at least one of accessing, modifying, and creating a registry, the registry may block access to, modify, and create a registry required for the malicious code to operate according to the blocking policy, or block the registry. Malware blocking device further comprises a registry blocking module for deleting the. The method of claim 15, wherein the device, And an email blocking module for generating an alert message and selectively attaching the email to the alert message when the malicious code is found by analyzing the email transmitted from the mail server through the network. Malware Blocker. 17. The apparatus of any one of claims 14 to 16, wherein the device is A malicious code analyzer configured to analyze a method in which malicious code spreads through the network intrudes into a computer system or a pattern of activity after invading the computer system; A policy manager configured to generate a blocking policy for blocking the malicious code based on a result analyzed by the malicious code analyzer or to receive and store the blocking policy from an external terminal; And A record of blocking the malicious code invading the computer system according to the blocking policy, and providing the malware analysis unit or the blocking policy with a record history in real time to analyze an activity pattern of the malicious code; Malicious code blocking device comprising a log file management unit for transmitting to the terminal. Analyze how malicious code spreads through the network invade computer systems or patterns after intrusion to create a blocking policy to block the malicious code, and manage the blocking policy to send the blocking policy to the computer system Device; And When the malicious code is detected by connecting to the blocking policy management device through the network, the blocking policy management device is notified, the malicious code is blocked according to the blocking policy received from the blocking policy management device, and the blocking history is displayed. And a computer system generating a log file and uploading it to the blocking policy management device. The apparatus of claim 18, wherein the blocking policy generating device comprises: A malicious code analysis unit analyzing a method in which the malicious code intrudes into the computer system or a pattern active after the intrusion, and extracting an activity pattern of the malicious code by analyzing a log file uploaded from the computer system; A policy generation unit generating a blocking policy for blocking the malicious code based on the result analyzed by the malicious code analyzing unit, and reflecting the upgraded analysis result in the blocking policy; And And a communication unit which transmits the blocking policy to the computer system and receives a result of executing the blocking policy and transmits the result to the malicious code analyzing unit. 20. The computer system of claim 18 or 19, wherein the computer system comprises: A detector for detecting malicious code invading through a network; An execution unit configured to receive and execute a blocking policy for the malicious code; And The blocking policy selected by the computer system and the malicious code blocking details are generated as a log file, uploaded to the blocking policy generating device, and the blocking policy is requested by another networked computer system. Malicious code blocking system comprising a transmission unit for downloading. The computer system of claim 20 wherein the computer system comprises: And a blocking policy selecting unit configured to select and manage at least one or more of the blocking policies.

Images