KR20090005934A - Apparatus and method for detection of malicious program using program behavior - Google Patents

Abstract

An apparatus and a method for detecting a malicious program by using behavior of a computer are provided to generates optimized malicious code diagnosis data which are used for judging whether a computer program executed in a computer system is a normal code or a malicious code. A behavior feature vector creation unit(410) creates a first behavior feature vector based on behavior features extracted from a diagnosis target program, and a diagnosis data storage unit(420) stores plural second behavior feature vectors for a sample program of which malicious feature is known to everybody. A code diagnosis unit(430) diagnoses whether or not a diagnosis target program is a malicious code by comparing the first behavior feature vector with the plural behavior feature vectors, and the code diagnosis unit consists of a distance calculation unit(440) and a code judgment unit(450).

Description

Apparatus and method for diagnosing whether or not a malicious program using behavior of computer program {APPARATUS AND METHOD FOR DETECTION OF MALICIOUS PROGRAM USING PROGRAM BEHAVIOR}

The present invention relates to a method and apparatus for diagnosing whether a computer program executed in a computer system is a malicious program, and more particularly, to an apparatus and method for diagnosing whether a computer program is a malicious program using the behavior of a computer program; And a method and apparatus for generating the apparatus.

According to the conventional malicious program monitoring technology, a sample of a conventionally generated malicious program is collected to extract a constant character string that is characteristic of the malicious program, and whether the character string is present in a file of a diagnosis target computer system or the like is applied to the malicious program. It was determined whether it was infected.

Therefore, when a new malicious program occurs, a malicious program diagnostic apparatus for identifying the identity of the new malicious program, extracting a character string, and monitoring the malicious program corresponding to the malicious program should be developed. Therefore, before the information of the malicious program is added to the existing malicious program diagnosis apparatus, it is impossible to prepare for the new malicious program, and thus, the damage to the new malicious program cannot be prevented. Also, as the types of malicious programs increase, the types of character strings that characterize the malicious programs also increase proportionally. Therefore, the time required to diagnose the malicious program was increased in the process of checking whether the character string of the malicious program is present.

If a mobile device such as a mobile phone or PDA, which is powered by a battery, is used to extract a character string from a specific program and check whether it is the same as a character string, which is a characteristic of a conventional malicious program, the mobile device is consumed. The problem occurs that the operation time of the decrease.

In addition, in the related art, when a vulnerability of a computer is disclosed due to a hacker's attack, the manufacturer of the program may stop the attack of the hacker by using a patch program that fixes the vulnerability, and is not yet disclosed. It could not cope with other attacks that used a number of vulnerabilities.

Most malicious programs are not new programs, they are completely different from existing malicious programs, but variants of existing malicious programs. However, in order to check variant malicious programs, it is necessary to use a new string extracted from a variant malicious program, not a string extracted from a conventional malicious program. Therefore, each string has to be provided to check each variant malicious program.

An object of the present invention is to determine whether a particular computer program is normal code or malicious code using the behavior of a computer program running on a computer system.

An object of the present invention is to generate malicious code diagnostic data used to determine whether a computer program executed in a computer system is normal code or malicious code.

In order to achieve the above object and to solve the problems of the prior art, the present invention provides a behavioral feature vector generator for generating a first behavioral feature vector based on a behavioral feature extracted from a diagnosis target program, and a plurality of sample programs that are known to be malicious. A diagnostic data storage for storing a plurality of second behavioral feature vectors, and a code for diagnosing whether the target program is a malicious code by comparing the first behavioral feature vector with the plurality of second behavioral feature vectors It provides a malicious code diagnostic apparatus comprising a diagnostic unit.

According to one aspect of the invention, generating a first behavioral feature vector based on the behavioral features extracted from the program to be diagnosed, loading a plurality of second behavioral feature vectors for a plurality of sample programs that are known to be malicious, And comparing the first behavioral feature vector with the plurality of second behavioral feature vectors to diagnose whether the program to be diagnosed is a malicious code.

According to an aspect of the present invention, in the apparatus for generating malicious code diagnostic data, a behavior feature vector generator for generating respective behavior feature vectors from a plurality of sample programs that are known to be malicious, and the behavior feature vectors for the plurality of sample programs. And a weight vector determiner configured to determine a weight vector based on the malicious status, and a diagnostic data storage configured to store the respective behavior feature vector and the weight vector, wherein the behavior feature vector and the weight vector are the diagnostic target program. Provided is an apparatus for generating malicious code diagnostic data, which is used to determine whether the malicious code is malicious.

According to one aspect of the present invention, in the method for generating malicious code diagnosis data, generating each behavioral feature vector from a plurality of sample programs that are known to be malicious; Determining a weight vector based on the weight vector, and storing the respective behavior feature vector and the weight vector, wherein the behavior feature vector and the weight vector are used to determine whether the diagnosis target program is a malicious code. Provided is a method for generating malicious code diagnostic data, characterized in that.

According to the present invention, it is possible to determine whether a particular computer program is normal code or malicious code by using the behavior of the computer program running on the computer system.

According to the present invention, it is possible to generate optimal malicious code diagnostic data used to determine whether a computer program running on a computer system is normal code or malicious code.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention;

1 is a flowchart illustrating a step-by-step method for checking malicious programs using the behavior of computer programs in accordance with the present invention. Hereinafter, a method of checking a malicious program using the behavior of a computer program modeled according to the present invention will be described in detail with reference to FIG. 1.

The malicious program or malicious code described in the present invention may be any and all forms of executable programs that operate on a computer system such as macros, scripts, and all malicious purposes created by the creators to intentionally damage the user. Say the program.

In operation S110, a behavior feature vector is generated by modeling the behavior of the sample program. The sample program includes not only malicious programs but also normal programs.

In operation S120, malicious code diagnostic data is generated. The malware diagnosis apparatus may distinguish between a malicious program and a normal program using the malicious code diagnosis data and the behavioral feature vector generated in step S110. According to an embodiment of the present invention, the apparatus for diagnosing malware calculates a value greater than or equal to a threshold for a behavioral feature vector modeling the behavior of a normal program and a value less than or equal to a threshold for an behavioral feature vector modeling the behavior of a malicious program. Can be generated to calculate.

In operation S130, the diagnosis target program executed in the computer system is diagnosed as a malicious program or a normal program using the behavioral feature vector generated from the diagnostic target program and the malicious code diagnostic data generated in operation S120.

If the program to be diagnosed is a normal program, the device for testing a malicious program calculates a value greater than or equal to a threshold for the behavioral feature vector of the program to be diagnosed. If the program to be diagnosed is a malicious program, the device for testing the malicious program is determined to be a program. A value below the threshold may be calculated for the behavioral feature vector of.

Most malicious programs are not new malicious programs at all. It is only a modified malicious program that has been modified by modifying some of the existing malicious programs. Therefore, the behavior of a new malicious program that cannot be determined as a malicious program by the existing malicious program inspection device is similar to that of an existing malicious program.

In addition, most malicious programs infiltrate the user's computer system and delete the user's data or delete the system files.

Therefore, if it is determined whether the diagnosis target program is a normal program or a malicious program using the behavior of the diagnosis target program, it is possible to determine whether the malicious program is much more accurate than the conventional string comparison method. In addition, the behavior of a new variant of a malicious program that has not been known so far can determine whether it is a malicious program.

Unlike the prior art, it is not necessary to analyze information on a new malicious program, thereby reducing damage occurring at the time of analyzing a new malicious program.

2 is a diagram illustrating a behavioral feature vector generated from a sample program in a behavioral feature vector space. Hereinafter, a concept of diagnosing a malicious program using a behavioral feature vector generated from a diagnosis target program will be described in detail with reference to FIG. 2.

2 illustrates an embodiment in which behavior feature vectors 211 and 212 generated from a normal program and behavior feature vectors 211 and 222 generated from a malicious program are located in a two-dimensional space of behavior feature vectors. The same can be applied to the case where the feature vector space is two or more dimensions.

Behavioral features extracted from normal programs are similar to each other, and behavioral features extracted from malicious programs are similar to each other. However, behavioral features extracted from normal programs and behavioral features extracted from malicious programs are not similar. Therefore, normal and malignant feature vectors generated based on the behavioral features extracted from normal and malicious programs are similar to each other. The normal behavioral feature vectors 211 and 212 and the malicious behavioral feature vectors 221 and 222 are located in regions separated from each other in the behavioral feature vector space.

Accordingly, the apparatus for diagnosing malicious code according to the present invention includes a malicious feature feature region 210 in which the normal feature feature vectors 211 and 212 are located and a malicious feature feature vector 221 and 222 located in the behavior feature vector space. Behavioral feature vector region 220. The malware diagnosis apparatus determines whether the diagnosis target program is malicious code based on whether the behavior feature vector generated from the diagnosis target program belongs to the normal behavior feature vector region 210 or the malicious behavior feature vector region 220. can do.

There may be various types of malware diagnosis apparatuses 231 and 232 that distinguish the normal behavior feature vector region 210 and the malicious behavior feature vector region 220.

The diagnostic target programs corresponding to the behavioral feature vector located in the specific region 240 in the behavioral feature vector space may have different diagnosis results depending on the malicious code diagnosis apparatus.

3 is a diagram illustrating a concept of selecting optimal data from malicious code diagnostic data that divides a behavioral feature vector space into a malicious vector space and a normal vector space according to the present invention. Hereinafter, the concept of selecting the optimal data will be described in detail with reference to FIG. 3.

The normal behavior feature vectors 311, 312, and 313 are located in the normal behavior feature vector region 310, and the malicious behavior feature vectors 321, 322, 323, and 324 are located in the malicious behavior feature vector region 320. The malicious code diagnosis apparatus may distinguish the two regions by using the first boundary 330 or the second boundary 340. The first boundary 330 and the second boundary 340 are determined according to the diagnostic data used by the malicious code diagnosis apparatus.

When the two regions are distinguished by using the first boundary 330, the distance 333 between the normal behavior feature vector 313 and the malicious behavior feature vector 323 located closest to the first boundary 330 may be equal to or greater than the distance 333. It can have margins.

In the case of distinguishing the two regions using the second boundary 340, the distance 343 between the normal behavior feature vector 313 and the malicious behavior feature vector 324 located closest to the second boundary 340 may be equal to or greater than the distance 343. You can relax.

In order for the malicious code diagnosis apparatus to accurately diagnose whether the diagnosis target program is malicious, the distances 333 and 343 separating the normal behavior feature vector region 310 and the malicious behavior feature vector region 320 should be maximized. Therefore, in the malware diagnosis apparatus according to the embodiment of the present invention, the behavior feature vector generated from the program to be diagnosed using the first boundary 330 at which the distance separating the two regions 310 and 320 becomes the maximum is normal behavior. Whether it belongs to the feature vector region 310 or the malicious behavior feature vector region 320 can be accurately determined.

The malicious code diagnosis apparatus may accurately diagnose the normal program and the malicious program when the distance between the normal behavior feature vector region 310 and the malicious behavior feature vector region 320 becomes maximum. Since the boundary for distinguishing the normal behavior feature vector region 310 and the malicious behavior feature vector region 320 from the malicious code diagnosis apparatus is determined by the malicious code diagnostic data, the malicious code for causing the malicious code diagnostic apparatus to use the first boundary. Diagnostic data is the optimal malware diagnostic data.

4 is a diagram illustrating a structure of a malicious code diagnosis apparatus for diagnosing whether a diagnosis target program is a malicious code based on a behavioral feature vector generated from the diagnosis target program according to an embodiment of the present invention. Hereinafter, the structure of a malicious code diagnosis apparatus will be described in detail with reference to FIG. 4.

The malicious code diagnosis apparatus 400 according to the present invention includes a behavior feature vector generator 410, a diagnostic data storage unit 420, and a code diagnosis unit 430.

The code diagnosis unit 430 according to an embodiment of the present invention includes a distance calculator 440 and a code determiner 450.

The behavioral feature vector generator 410 generates a first behavioral feature vector based on the behavioral feature extracted from the diagnosis target program.

The diagnostic data storage unit 420 stores a plurality of second behavioral feature vectors for a plurality of sample programs that are known to be malicious. According to an embodiment of the present invention, the plurality of sample programs may include at least one normal program and at least one malicious program.

According to an embodiment of the present invention, the diagnostic data storage unit 420 may include a plurality of second behavioral feature vectors for a sample program and whether each of the sample programs is malicious, and a plurality of second behavioral feature vectors for the sample program. The weight vector generated based on the S can be stored.

The code diagnosis unit 430 compares the first behavioral feature vector with the plurality of second behavioral feature vectors to diagnose whether the diagnosis target program is a malicious code.

According to an embodiment of the present invention, the code diagnosis unit 430 calculates a distance between the first behavioral feature vector and the plurality of second behavioral feature vectors and compares them with the distance calculation unit 440 and the calculation. It may include a code determination unit 450 that determines whether the diagnostic target program is a malicious code based on the distance.

According to an embodiment of the present invention, the code determination unit 450 determines the distance between the behavioral feature vector of the normal program and the behavioral feature vector of the diagnosis target program and the distance between the behavioral feature vector of the malicious program and the behavioral feature vector of the diagnosis target program. Compare. Based on the compared distance, it is determined whether the behavioral feature vector of the program to be diagnosed belongs to the normal behavioral feature vector region 310 or the malicious behavioral feature vector region 320, and correspondingly, the diagnostic target program is a malicious program. Determine whether or not.

According to an embodiment of the present invention, the distance calculator 440 may calculate the Euclidean distance between the first behavioral feature vector and the second behavioral feature vector.

The behavioral feature vector space is divided into a normal behavioral feature vector region 310 and a malicious behavioral feature vector region 320.

According to an embodiment of the present invention, the diagnostic data storage unit 420 stores the weight vector determined based on the second behavioral feature vector and the malicious status of each sample program. The code determining unit 450 multiplies the calculated distance by an element of the weight vector and compares it with a predetermined threshold so that the behavior feature vector of the program to be diagnosed is the normal behavior feature vector region 310 and the malicious behavior feature vector region ( It may be determined in which area in 320.

According to an embodiment of the present invention, the code determiner 450 may multiply the calculated distance by an element of the weight vector according to the value of Equation 1 below.

[Equation 1]

는 진단 대상 프로그램으로부터 추출한 제1 행동 특징 벡터를,

는 i번째 샘플 프로그램으로부터 추출한 제2 행동 특징 벡터를 각각 나타낸다. here,

Is the first behavioral feature vector extracted from the program to be diagnosed,

Respectively represent the second behavioral feature vectors extracted from the i th sample program.

는 i번째 샘플 프로그램의 악성 여부로서, 본 발명의 일실시예에 따르면 i번째 샘플 프로그램이 정상 프로그램이면 '-1', 악성 프로그램이면 '+1'이 될 수 있다.

Denotes whether the i th sample program is malicious. According to an embodiment of the present invention, 'i' may be '-1' if the i th sample program is a normal program and '+1' if it is a malicious program.

는 두 행동 특징 벡터 a, b 간의 거리에 반비례 하는 값으로서 하기 수학식 2에 의하여 결정된다.

Is a value inversely proportional to the distance between two behavioral feature vectors a and b, and is determined by Equation 2 below.

는 가중치 벡터의 i번째 원소를 나타낸다.

Denotes the i th element of the weight vector.

[Equation 2]

은 샘플 프로그램의 개수를,

는 임의의 값을 가지는 상수로 서, 본 발명의 일실시예에 따르면

는 '1'이 될 수 있다.here,

Is the number of sample programs,

Is a constant having an arbitrary value, according to an embodiment of the present invention.

May be '1'.

가 0이 아닐 경우에만 대응되는

를 진단 데이터 저장부(420)에 저장하고 수학식 1의 계산에 사용한다. 따라서, 그 외의 제2 행동 특징 벡터들은 수학식 1의 계산에 영향을 미치지 않는다. 이들

가 0이 아닐 경우에만 대응되는

를 지지 벡터(Support Vector)라고 한다. 지지 벡터들은 일반적으로 제1 경계(330) 또는 제2 경계(340) 부근에 위치하므로 그 수가 샘플 프로그램의 개수에 비해 매우 작으며, 따라서 진단 데이터 저장부(420)의 저장 용량 및 수학식 1의 계산량도 매우 작게 된다.here,

Matches only if is not zero

Is stored in the diagnostic data storage unit 420 and used for the calculation of Equation 1. Thus, the other second behavioral feature vectors do not affect the calculation of Equation 1. these

Matches only if is not zero

Is called a Support Vector. Since the support vectors are generally located near the first boundary 330 or the second boundary 340, the number of the support vectors is very small compared to the number of sample programs, so that the storage capacity of the diagnostic data storage unit 420 and The calculation amount is also very small.

According to an embodiment of the present invention, the code determining unit 450 compares a value of the following Equation 1 with a predetermined threshold value determined by Equation 3 below to determine that the behavioral feature vector for the program to be diagnosed is a normal behavioral feature vector. It may be determined which area of the area 310 and the malicious behavior feature vector area 320.

[Equation 3]

는 상기 소정의 임계값을,

은 정상 샘플 프로그램으로부터 추출한 제2 행동 특징 벡터를,

는 악성 샘플 프로그램으로부터 추출한 제2 행동특징 벡터를 각각 나타낸다.here,

Is the predetermined threshold,

Is the second behavioral feature vector extracted from the normal sample program,

Respectively represent the second behavioral feature vectors extracted from the malicious sample program.

According to an embodiment of the present invention, the code determining unit 450 adds the predetermined threshold value to the value of Equation 1, and when the calculation result is smaller than '0', the behavior feature vector for the diagnosis target program. If is greater than '0' in the normal behavior feature vector region 310, it may be determined that the behavior feature vector for the program to be diagnosed is located in the malicious behavior feature vector region 320.

According to the exemplary embodiment of the present invention, when the value of the following Equation 4 is greater than '0', the code determining unit 450 has a behavioral feature vector for the diagnosis target program in the normal behavioral feature vector region 310. If less than 0 ', it may be determined that the behavioral feature vector for the program to be diagnosed is located in the malicious behavioral feature vector region 320.

[Equation 4]

5 is a method for diagnosing whether a program to be diagnosed is a malicious program based on a feature vector obtained by transforming a behavior feature vector into a high level when it is not possible to determine whether the program is a malicious program using the behavior feature vector generated from the diagnosis target program. It is a figure which shows a concept. Hereinafter, a concept of diagnosing whether a program to be diagnosed as a malicious program using a feature vector obtained by transforming a behavioral feature vector into a high level will be described in detail.

FIG. 5A illustrates the normal behavior feature vectors 511 and 512 and the malicious behavior feature vectors 513 and 514 located in the behavior feature vector space. The normal behavioral feature vectors 511 and 512 and the malicious behavioral feature vectors 513 and 514 are located in the overall behavioral feature vector space without any rules. The overall behavioral feature vector space cannot be divided into a normal behavioral feature vector space 310 and a malicious behavioral feature vector space 320.

FIG. 5B converts the normal behavior feature vectors 511 and 512 and the malicious behavior feature vectors 513 and 514 to generate corresponding feature vectors 521, 522, 523, and 524, respectively. The characteristic vectors 521, 522, 523, and 524 are shown in the characteristic vector space.

In FIG. 5B, an embodiment in which a two-dimensional behavior feature vector is converted into a three-dimensional feature vector is illustrated, but in another embodiment of the present invention, the embodiment may be converted to a four-dimensional or higher dimension than the behavior feature vector.

FIG. 5C is a diagram showing feature vectors 531 and 532 of a normal program and feature vectors 533 and 534 of a malicious program located in a feature vector space. Each feature vector 531, 532, 533, 534 transformed from the behavior feature vector is located in a region separated from each other in the feature vector space.

The feature vectors 531 and 532 of the normal program and the feature vectors 533 and 534 of the malicious program may be distinguished using a specific boundary 535.

FIG. 6 is a diagram illustrating a structure of a malicious code diagnosis apparatus for diagnosing whether a diagnosis target program is a malicious code based on a feature vector generated from the diagnosis target program according to an embodiment of the present invention. Hereinafter, a structure of a malicious code diagnosis apparatus for diagnosing whether a diagnosis target program is a malicious code based on the characteristic vector will be described in detail with reference to FIG. 6.

The malicious code diagnostic apparatus 600 according to the present invention includes a behavior feature vector generator 610, a diagnostic data storage 620, and a code diagnostic unit 630.

The code diagnosis unit 630 according to an embodiment of the present invention includes a vector converter 640, a distance calculator 650, and a code determiner 660.

The behavioral feature vector generator 610 generates a first behavioral feature vector based on the behavioral feature extracted from the diagnosis target program.

The diagnostic data storage unit 620 stores a plurality of second behavioral feature vectors for a plurality of sample programs that are known to be malicious. According to an embodiment of the present invention, the plurality of sample programs may include at least one normal program and at least one malicious program.

According to an embodiment of the present invention, the diagnostic data storage unit 620 may include a plurality of second behavioral feature vectors for a sample program and whether each of the sample programs is malicious, and a plurality of second behavioral feature vectors for the sample program. The weight vector generated based on the S can be stored.

The code diagnosis unit 630 compares a first behavioral feature vector with the plurality of second behavioral feature vectors to diagnose whether the diagnosis target program is a malicious code.

According to an embodiment of the present invention, the code diagnosis unit 630 performs high-dimensional conversion of the first behavioral feature vector into a first characteristic vector, and high-dimensional conversion of the plurality of second behavioral feature vectors into a plurality of second characteristic vectors. On the basis of the calculated distance and the distance calculator 650 for calculating respective distances between the vector converter 640, the first feature vector and the plurality of second feature vectors, and determining whether the diagnosis target program is a malicious code. The code determining unit 660 may be included.

According to an embodiment of the present invention, the vector transforming unit 640 may determine the distance between the first characteristic vector converted from the first behavioral feature vector and the second characteristic vector converted from the second behavioral feature vector. Each vector can be converted to be proportional to the distance between the two behavioral feature vectors. That is, the vector converter 640 determines that the distance between the first behavioral feature vector and the second behavioral feature vector is the distance between the first characteristic vector corresponding to the first behavioral feature vector and the second characteristic vector corresponding to the second behavioral feature vector. The first behavioral feature vector and the second behavioral feature vector may be converted to be proportional to.

The characteristic vector space is divided into a normal characteristic vector region and a malicious characteristic vector region.

According to an embodiment of the present invention, the diagnostic data storage unit 620 stores the weight vector determined based on the second characteristic vector and the malicious status of each sample program. The code determining unit 660 multiplies the calculated distance by an element of the weight vector and compares it with a predetermined threshold to determine which region of the characteristic vector region and the malicious characteristic vector region is located in the diagnostic vector program. You can decide.

The code determining unit 660 diagnoses the diagnosis target program as a normal program when the feature vector of the diagnosis target vector is located in the normal feature vector region, and diagnoses the feature vector of the diagnosis target vector as a malicious feature vector region. The target program can be diagnosed as a malicious program.

FIG. 7 is a diagram illustrating a structure of an apparatus for generating malicious code diagnosis data using a behavioral feature vector of a sample program according to an embodiment of the present invention. Hereinafter, the structure of the apparatus for generating malicious code diagnosis data will be described in detail with reference to FIG. 7.

The malicious code diagnostic data generating apparatus 700 according to the present invention includes a behavior feature vector generator 710, a distance calculator 720, a weight vector determiner 730, and a diagnostic data storage 740.

The behavioral feature vector generator 710 generates each behavioral feature vector from a plurality of sample programs that are known to be malicious. According to an embodiment of the present invention, the plurality of sample programs may include at least one normal program and at least one malicious program.

The weight vector determiner 730 determines a weight vector based on behavioral feature vectors for the plurality of sample programs and whether each of the plurality of sample programs is malicious.

According to an embodiment of the present invention, the distance calculator 720 calculates distances between the plurality of behavior feature vectors generated from the plurality of sample programs, and the weight vector determiner 730 calculates the plurality of calculated behavior features. The weight vector may be determined based on a distance between vectors and whether the sample program is malicious.

The diagnostic data storage unit 740 stores a plurality of behavior feature vectors and the determined weight vector generated from the plurality of sample programs. The stored plurality of behavioral feature vectors and the weight vector are used by a malicious code diagnosis apparatus to determine whether the diagnosis target program is malicious code.

The first boundary 330 and the second boundary 340 in FIG. 3 are determined by the weight vector. According to an embodiment of the present invention, the weight vector determiner 730 is a normal behavior feature vector region 310 among a plurality of weight vectors capable of distinguishing between the normal behavior feature vector region 310 and the malicious behavior feature vector region 320. ) And a weight vector that can distinguish the malicious behavior feature vector region 320 as accurately as possible.

을 최대화 하고, 하기 수학식 6 및 하기 수학식 7을 만족하도록 상기 가중치 벡터를 결정할 수 있다.According to an embodiment of the present invention, the weight vector determiner 730 is determined according to Equation 5 to accurately distinguish between the normal behavior feature vector region 310 and the malicious behavior feature vector region 320.

The weight vector may be determined to maximize Equation 6 and satisfy Equation 6 and Equation 7 below.

[Equation 5]

는 i번째 샘플 프로그램으로부터 추출한 행동 특징 벡터를,

는 i번째 샘플 프로그램의 악성 여부를 각각 나타낸다. 본 발명의 일실시예에 따르면 i번째 샘플 프로그램이 정상 프로그램이면 '-1'를, 악성 프로그램이면 '+1'이 될 수 있다.

는 두 행동 특징 벡터 a, b 간의 거리를,

은 샘플 프로그램의 개수를 나타낸다.

는 가중치 벡터의 i번째 원소를 나타낸다.here,

Is the behavioral feature vector extracted from the i th sample program,

Indicates whether the i th sample program is malicious. According to an embodiment of the present invention, if the i th sample program is a normal program, it may be '-1', and if it is a malicious program, it may be '+1'.

Is the distance between two behavioral feature vectors a and b,

Represents the number of sample programs.

Denotes the i th element of the weight vector.

[Equation 6]

[Equation 7]

According to an embodiment of the present invention, the weight vector determiner 730 may determine a predetermined threshold for distinguishing between the normal behavior feature vector region 310 and the malicious behavior feature vector region 320 according to Equation 8 below. have.

[Equation 8]

는 상기 소정의 임계값을,

은 정상 샘플 프로그램으로부터 추출한 제2 행동 특징 벡터를,

는 악성 샘플 프로그램으로부터 추출한 제2 행동특징 벡터를 각각 나타낸다.

Is the predetermined threshold,

Is the second behavioral feature vector extracted from the normal sample program,

Respectively represent the second behavioral feature vectors extracted from the malicious sample program.

8 is a flowchart illustrating a step-by-step method of diagnosing whether a malicious program is a malicious program using a behavioral feature vector of a diagnostic target program according to an embodiment of the present invention. Hereinafter, a method of diagnosing whether a malicious program is a malicious program using a behavioral feature vector will be described in detail.

In operation S810, a first behavioral feature vector is generated based on the behavioral feature extracted from the diagnosis target program. According to an embodiment of the present invention, only some behavioral features may be extracted from the program to be diagnosed, not all behavioral features, and a first behavioral feature vector may be generated based on the partial behavioral features.

In operation S820, a plurality of second behavioral feature vectors for a plurality of sample programs that are known to be malicious are loaded. According to an embodiment of the present invention, the plurality of sample programs may include at least one normal program and at least one malicious program.

In operation S830, a distance is calculated by comparing the first behavioral feature vector and the second behavioral feature vector. When there are a plurality of second behavioral feature vectors, respective distances between the first behavioral feature vector and each second behavioral feature vector are calculated.

According to an embodiment of the present invention, in step S830, the Euclidean distance between the first behavioral feature vector and the second behavioral feature vector may be calculated.

In step S840, based on the distance between the behavioral feature vectors calculated in step S830, it is diagnosed whether the diagnosis target program is a malicious code. According to an embodiment of the present invention, in step S840, the calculated feature is multiplied by an element of the weight vector to be compared with a predetermined threshold, so that the feature vector of the diagnosis target program is a normal behavior feature vector region 310 and malicious. It may be determined which area of the behavioral feature vector region 320 is located. If the behavioral feature vector of the diagnostic target program is located in the normal behavioral feature vector region 310, the diagnostic target program is a normal program. If the behavioral feature vector of the diagnostic target program is located in the malicious behavioral feature vector region 310, the diagnostic target program is selected. It can be diagnosed as a malicious program.

According to an embodiment of the present invention, in step S840, the element of the weight vector may be multiplied by the calculated distance according to the value of Equation 9 below.

[Equation 9]

는 진단 대상 프로그램으로부터 추출한 제1 행동 특징 벡터를,

는 i번째 샘플 프로그램으로부터 추출한 제2 행동 특징 벡터의 i번째 원소를 각각 나타낸다.

는 i번째 샘플 프로그램의 악성 여부로서, 본 발명의 일실시예에 따르면 i번째 샘플 프로그램이 정상 프로그램이면 -1'의 값을, 악성 프로그램이면 '+1'이 될 수 있다.

은 샘플 프로그램의 개수를,

는 가중치 벡터의 i번째 원소를 각각 나타낸다.

는 두 행동 특징 벡터 a, b 간의 거리에 반비례 하는 값으로서 하기 수학식 10에 의하여 결정된다.

Is the first behavioral feature vector extracted from the program to be diagnosed,

Denote i-th elements of the second behavioral feature vector extracted from the i-th sample program, respectively.

Denotes whether the i th sample program is malicious, and according to an embodiment of the present invention, 'i' may be a value of -1 'if the i th sample program is a normal program and' +1 'if it is a malicious program.

Is the number of sample programs,

Each represents the i th element of the weight vector.

Is a value inversely proportional to the distance between two behavioral feature vectors a and b, and is determined by Equation 10 below.

가 0이 아닐 경우에만 대응되는

를 수학식 9의 계산에 사용한다. 따라서, 그 외의 제2 행동 특징 벡터들은 수학식 9의 계산에 영향을 미치지 않는다. 이들

가 0이 아닐 경우에만 대응되는

를 지지 벡터(Support Vector)라고 한다. 지지 벡터들은 일반적으로 정상 행동 특징 벡터 영역(310)과 악성 행동 특징 벡터 영역(320)의 경계 부근에 위치하므로 그 수가 전체 샘플 프로그램의 개수

에 비해 매우 작으며, 따라서 수학식 9의 계산량도 매우 작게 된다.here,

Matches only if is not zero

Is used in the calculation of equation (9). Thus, the other second behavioral feature vectors do not affect the calculation of equation (9). these

Matches only if is not zero

Is called a Support Vector. The support vectors are generally located near the boundary between the normal behavior feature vector region 310 and the malicious behavior feature vector region 320, so that the number of the total number of sample programs is maintained.

It is very small compared with, and thus the calculation amount of Equation 9 is also very small.

[Equation 10]

는 임의의 값을 가지는 상수로서, 본 발명의 일실시예에 따르면

는 '1'이 될 수 있다.

Is a constant having an arbitrary value, according to an embodiment of the present invention.

May be '1'.

According to an embodiment of the present invention, step S840 may be performed by comparing the value of Equation 9 with a predetermined threshold value determined by Equation 11 below to determine whether the behavioral feature vector for the diagnosis target program is a normal behavioral feature vector region ( 310 and the malicious behavior feature vector region 320.

[Equation 11]

는 상기 소정의 임계값을,

은 정상 샘플 프로그램으로부터 추출한 제2 행동 특징 벡터를,

는 악성 샘플 프로그램으로부터 추출한 제2 행동특징 벡터를 각각 나타낸다.

Is the predetermined threshold,

Is the second behavioral feature vector extracted from the normal sample program,

Respectively represent the second behavioral feature vectors extracted from the malicious sample program.

According to an embodiment of the present invention, in step S840, the predetermined threshold value is added to the value of Equation 9, and when the calculation result is smaller than '0', the behavioral feature vector for the diagnosis target program is normal. If the behavioral feature vector region 310 is greater than '0', it may be determined that the behavioral feature vector for the program to be diagnosed is located in the malicious behavioral feature vector region 320.

According to an embodiment of the present invention, in step S840, when the value of Equation 12 is smaller than '0', the behavioral feature vector for the program to be diagnosed is '0' in the normal behavioral feature vector region 310. In a larger case, it may be determined that the behavioral feature vector for the program to be diagnosed is located in the malicious behavioral feature vector region 320.

[Equation 12]

9 is a flowchart illustrating a step-by-step method of diagnosing whether a malicious program is a malicious program using a characteristic vector of a program to be diagnosed according to an embodiment of the present invention. Hereinafter, a method of diagnosing whether a malicious program is a malicious program using a characteristic vector will be described in detail with reference to FIG. 9.

In operation S910, a first behavioral feature vector is generated based on the behavioral feature extracted from the diagnosis target program. According to an embodiment of the present invention, only some behavioral features may be extracted from the program to be diagnosed, not all behavioral features, and a first behavioral feature vector may be generated based on the partial behavioral features.

In step S920, a plurality of second behavioral feature vectors for a plurality of sample programs that are known to be malicious are loaded. According to an embodiment of the present invention, the plurality of sample programs may include at least one normal program and at least one malicious program.

According to an embodiment of the present invention, in step S920, a weight vector determined based on whether a plurality of second behavioral feature vectors of the plurality of sample programs and each of the plurality of sample programs is malicious may be loaded.

In operation S930, the high-order transform of the generated first behavioral feature vector is transformed into a first characteristic vector, and the plurality of loaded second behavioral feature vectors are high-dimensionally transformed into a second characteristic vector.

In operation S940, respective distances between the first feature vector and the plurality of second feature vectors are calculated.

In step S950, it is determined whether the diagnosis target program is a malicious code based on the calculated distance. According to an embodiment of the present invention, the calculated distance is multiplied by an element of the weight vector to be compared with a predetermined threshold to determine which region of the feature vector of the diagnosis target program is located between a normal feature region and a malicious feature vector region. Can be.

According to an embodiment of the present invention, in step S950, when the characteristic vector of the diagnosis target vector is located in the normal characteristic vector region, the diagnosis target program is diagnosed as a normal program, and the characteristic vector of the diagnosis target vector is a malicious characteristic vector region. In this case, the diagnosis target program can be diagnosed as a malicious program.

10 is a flowchart illustrating a step-by-step method of generating malicious code diagnostic data for diagnosing whether a malicious program is a malicious program using a behavioral feature vector of a diagnostic target program according to an embodiment of the present invention. Hereinafter, a method of generating malicious code diagnostic data for diagnosing whether a malicious program is a malicious program using a behavioral feature vector will be described in detail.

In step S1010, each behavioral feature vector is generated from a plurality of sample programs that are known to be malicious. According to an embodiment of the present invention, the plurality of sample programs may include at least one normal program and at least one malicious program.

In step S1020, each distance between the plurality of behavioral feature vectors generated in step S1010 is calculated. According to an embodiment of the present invention, the distance may be an Euclidean distance.

In step S1030, a weight vector is determined based on the distance between the plurality of behavior feature vectors calculated in step S1020 and whether each of the sample programs is malicious.

을 최대화 하고, 하기 수학식 14 및 하기 수학식 15을 만족하도록 상기 가중치 벡터를 결정할 수 있다.According to an embodiment of the present invention, in step S1030, in order to accurately distinguish between the normal behavioral feature vector region 310 and the malicious behavioral feature vector region 320, it is determined according to Equation 13 below.

, And the weight vector may be determined to satisfy Equation 14 and Equation 15 below.

[Equation 13]

는 i번째 샘플 프로그램으로부터 추출한 행동 특징 벡터를,

는 i번째 샘플 프로그램의 악성 여부로서 본 발명의 일실시예에 따르면 i번째 샘플 프로그램이 정상 프로그램이면 -1'의 값을, 악성 프로그램이면 '+1'이 될 수 있다.

는 두 행동 특징 벡터 a, b 간의 거리를,

은 샘플 프로그램의 개수를

는 가중치 벡터의 i번째 원소를 각각 나타낸다.

Is the behavioral feature vector extracted from the i th sample program,

The i-th sample program is malicious or not according to one embodiment of the present invention. If the i-th sample program is a normal program, the value may be -1, and if it is a malicious program, the value may be '+1'.

Is the distance between two behavioral feature vectors a and b,

Number of sample programs

Each represents the i th element of the weight vector.

[Equation 14]

[Equation 15]

According to an embodiment of the present invention, in step S1030, the malware diagnosis apparatus may determine a threshold value used to diagnose whether the diagnosis target program is a malicious program.

[Equation 16]

는 상기 소정의 임계값을,

은 정상 샘플 프로그램으로부터 추출한 제2 행동 특징 벡터를,

는 악성 샘플 프로그램으로부터 추출한 제2 행동특징 벡터를 각각 나타낸다.

Is the predetermined threshold,

Is the second behavioral feature vector extracted from the normal sample program,

Respectively represent the second behavioral feature vectors extracted from the malicious sample program.

In step S1040, the generated behavioral feature vector and the determined weight vector are stored. According to an embodiment of the present invention, in operation S1040, the determined predetermined threshold value may also be stored.

The stored predetermined threshold value and weight vector are used by the malicious code diagnosis apparatus to determine whether the diagnosis target program is malicious code.

Embodiments of the invention may be recorded on a computer readable medium containing program instructions for performing various computer-implemented operations. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those skilled in the art. Examples of computer readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and floptical disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. When all or part of the operation of the mobile terminal or base station described in the present invention is implemented as a computer program, a computer readable recording medium storing the computer program is also included in the present invention.

1 is a flowchart illustrating a step-by-step method for checking malicious programs using the behavior of computer programs in accordance with the present invention.

2 is a diagram illustrating a behavioral feature vector generated from a sample program in a behavioral feature vector space.

3 is a diagram illustrating a concept of selecting optimal data from malicious code diagnostic data that divides a behavioral feature vector space into a malicious vector space and a normal vector space according to the present invention.

4 is a diagram illustrating a structure of a malicious code diagnosis apparatus for diagnosing whether a diagnosis target program is a malicious code based on a behavioral feature vector generated from the diagnosis target program according to an embodiment of the present invention.

5 is a method for diagnosing whether a program to be diagnosed is a malicious program based on a feature vector obtained by transforming a behavior feature vector into a high level when it is not possible to determine whether the program is a malicious program using the behavior feature vector generated from the diagnosis target program. It is a figure which shows a concept.

FIG. 6 is a diagram illustrating a structure of a malicious code diagnosis apparatus for diagnosing whether a diagnosis target program is a malicious code based on a feature vector generated from the diagnosis target program according to an embodiment of the present invention.

FIG. 7 is a diagram illustrating a structure of an apparatus for generating malicious code diagnosis data using a behavioral feature vector of a sample program according to an embodiment of the present invention.

8 is a flowchart illustrating a step-by-step method of diagnosing whether a malicious program is a malicious program using a behavioral feature vector of a diagnostic target program according to an embodiment of the present invention.

9 is a flowchart illustrating a step-by-step method of diagnosing whether a malicious program is a malicious program using a behavioral feature vector of a program to be diagnosed according to an embodiment of the present invention.

10 is a flowchart illustrating a step-by-step method of generating malicious code diagnostic data used for diagnosing whether a malicious program is a malicious program using a behavioral feature vector of a program to be diagnosed according to an embodiment of the present invention.

Claims (21)

A behavior feature vector generator configured to generate a first behavior feature vector based on the behavior feature extracted from the diagnosis target program; A diagnostic data storage unit for storing a plurality of second behavioral feature vectors for a plurality of sample programs that are known to be malicious; And Code diagnosis unit for diagnosing whether the diagnostic target program is a malicious code by comparing the first behavioral feature vector with the plurality of second behavioral feature vectors Malware diagnostic apparatus comprising a. The method of claim 1, wherein the code diagnostic unit A distance calculator configured to calculate respective distances between the first behavioral feature vector and the plurality of second behavioral feature vectors and compare them with each other; And Code determination unit for determining whether the diagnostic target program is a malicious code based on the calculated distance Malware diagnostic apparatus comprising a. The method of claim 2, And the distance is Euclidean distance. The method of claim 1, wherein the code diagnostic unit, A vector transform unit for high-dimensional transforming the first behavioral feature vector into a first characteristic vector and high-dimensional transforming the plurality of second behavioral feature vectors into a plurality of second characteristic vectors; A distance calculator configured to calculate respective distances between the first feature vector and the plurality of second feature vectors; And Code determination unit for determining whether the diagnostic target program is a malicious code based on the calculated distance Malware diagnostic apparatus comprising a. The method of claim 2, The diagnostic data storage unit stores a weight vector determined based on the second behavioral feature vector and malicious status of each sample program, And the code determining unit determines whether the malicious code is the malicious code by multiplying the calculated distance by an element of the weight vector and comparing it with a predetermined threshold value. The method of claim 5, wherein the code determination unit, The apparatus of claim 1, wherein the calculated distance is multiplied by an element of the weight vector according to the value of Equation 1 below. [Equation 1]

Is the first behavioral feature vector extracted from the diagnosis target program,

Is the i th element of the second behavioral feature vector extracted from the i th sample program.

Whether the i-th sample program is malicious.

Is a value inversely proportional to the distance between two characteristic vectors a and b, and is determined by Equation 2 below. [Equation 2]

Is a constant.

Is the number of sample programs.

Is the i element of the weight vector The method of claim 6, wherein the predetermined threshold is, Malware diagnostic apparatus, characterized in that determined by the following equation (3). [Equation 3]

Is a predetermined threshold.

Is a second behavioral feature vector extracted from the normal sample program.

Is a second behavioral feature vector extracted from the malicious sample program. Generating a first behavioral feature vector based on the behavioral feature extracted from the diagnosis target program; Loading a plurality of second behavioral feature vectors for a plurality of sample programs that are known to be malicious; And Diagnosing whether the diagnosis target program is a malicious code by comparing the first behavioral feature vector with the plurality of second behavioral feature vectors Malware diagnostic method comprising a. The method of claim 8, wherein the diagnosing whether the malicious code is a malicious code comprises: Calculating respective distances between the first behavioral feature vector and the plurality of second behavioral feature vectors; And Determining whether the diagnosis target program is a malicious code based on the calculated distance Malware diagnostic method comprising a. The method of claim 9, wherein the calculating and comparing the distances with each other comprises: And calculating a Euclidean distance between each of the behavioral feature vectors. The method of claim 8, wherein the step of diagnosing whether the code is malicious code, High dimensional transforming the first behavioral feature vector into a first feature vector and high dimensional transforming the plurality of second behavioral feature vectors into a plurality of second feature vectors; Calculating respective distances between the first characteristic vector and the plurality of second characteristic vectors; And Determining whether the diagnosis target program is a malicious code based on the calculated distance Malware diagnostic method comprising a. The method of claim 9, wherein the determining of the malicious code comprises: Characterized in that the malicious code is determined by multiplying the calculated distance by an element of the weight vector determined based on the second behavioral feature vector and the malicious status of each sample program and comparing it with a predetermined threshold value. How to diagnose code. In the apparatus for generating malware diagnostic data, A behavior feature vector generator for generating respective behavior feature vectors from a plurality of sample programs that are known to be malicious; A weight vector determiner which determines a weight vector based on behavior feature vectors and malicious status of the plurality of sample programs; And Diagnostic data storage unit for storing the respective behavior feature vector and the weight vector Including, The behavior feature vector and the weight vector are used to determine whether the diagnosis target program is a malicious code. The method of claim 13, Distance calculation unit for calculating the distance between the generated plurality of behavior feature vectors, respectively More, The weight vector determining unit determines the weight vector based on the calculated distance between the plurality of behavioral feature vectors and whether the sample program is malicious. 15. The apparatus of claim 14, wherein the weight vector determiner Determined according to the following equation (4)

And maximize the weight vector and determine the weight vector so as to satisfy Equations 5 and 6 below. [Equation 4]

Is the behavioral feature vector extracted from the i th sample program.

Whether the i-th sample program is malicious.

Is the distance between two behavioral feature vectors a and b

Is the number of sample programs

Is the i element of the weight vector [Equation 5]

[Equation 6]

The method of claim 14, The weight vector determiner determines a predetermined threshold value used to determine whether the diagnosis target program is a malicious code according to Equation 7 below. And the diagnostic data storage unit stores the determined predetermined threshold value. [Equation 7]

Is a predetermined threshold.

Is a second behavioral feature vector extracted from the normal sample program.

Is a second behavioral feature vector extracted from the malicious sample program. In the malware diagnostic data generation method, Generating each behavioral feature vector from a plurality of sample programs that are known to be malicious; Determining a weight vector based on behavioral feature vectors and malicious status of the plurality of sample programs; And Storing the respective behavior feature vector and the weight vector Including, The behavior feature vector and the weight vector are used to determine whether the diagnosis target program is a malicious code. The method of claim 17, Calculating distances between the generated plurality of behavioral feature vectors, respectively More, The determining of the weight vector may include determining the weight vector based on the calculated distance between the plurality of behavioral feature vectors and whether the sample program is malicious. The method of claim 17, wherein determining the weight vector comprises: Determined according to Equation 8

And determining the weight vector so as to satisfy Equation 9 and Equation 10 below. [Equation 8]

Is the behavioral feature vector extracted from the i th sample program.

Whether the i-th sample program is malicious.

Is the distance between two behavioral feature vectors a and b

Is the number of sample programs

Is the i element of the weight vector [Equation 9]

[Equation 10]

The method of claim 17, The determining of the weight vector may include determining a predetermined threshold value used to determine whether the diagnosis target program is a malicious code according to Equation 11 below. And storing each of the behavioral feature vectors and the weight vector comprises storing the determined predetermined threshold value. [Equation 11]

Is a predetermined threshold.

Is a second behavioral feature vector extracted from the normal sample program.

Is a second behavioral feature vector extracted from the malicious sample program. 21. A computer-readable recording medium having recorded thereon a program for executing the method of any one of claims 8-12 and 17-20.

Images