KR20090054822A - Method and apparatus for collecting malicious codes - Google Patents

Abstract

A method for collecting malware codes and an apparatus thereof are provided to collect malware codes from corresponding to sites through an automated program which is executed at predetermined time intervals. A timer controller reads the address information of a site to be connected from a site database(S710), and then sets up start conditions in a condition and operation database(S720). A web browser connects to a corresponding site through the site address information inputted from the timer controller, and then receives a web page(S730). After setting up a timer, the timer controller executes a malware collecting program(S740).

Description

Method and apparatus for collecting malicious codes

The present invention relates to a method and apparatus for collecting malicious code, and more particularly, to a method and apparatus for collecting malicious code by monitoring a web site distributing malicious code.

Malware is also referred to as malware, malicious programs, and malicious users, mainly when browsing web pages, using peer-to-peer services, using shareware, using pirated programs, Infiltrate user's computer or induce installation when opening mail attachments or messenger files, etc., to expose commercial advertisements, generate network traffic, degrade system performance, delete files, send e-mails automatically, leak personal information Perform tasks such as remote control.

Malware is classified into viruses, worm viruses, and Trojan horses. Viruses, which are representative of malicious code, are defined as a combination of instructions that copy themselves or transformed themselves into a program, any executable part or data. It spreads by modifying the infected program or code by copying the virus code or some code and infecting other targets.

A worm is defined as a combination of instructions that copies itself or its variants without infecting other programs. Worms are also called Network Aware viruses. Worms exist in memory in the form of code or as executable files. When executed, the worm copies the file or the code itself to another system.

A Trojan is defined as a combination of instructions that does not copy itself intentionally included by the programmer so that the user cannot know it in the program of the computer. It is different from a program bug in that it is intentionally included, and a bit different from a virus or a worm in that it does not copy itself.

Since these malicious codes cause problems such as degrading the performance of the system or randomly deleting important files stored on the user's computer, detecting and removing such malicious codes quickly is very important in the modern society where the Internet is common. It is emerging as an issue.

In order to effectively cope with the situation where new malicious code is generated and distributed every day, it is necessary to quickly identify the current status of new malicious code and to provide anti-malware programs that can remove the malicious code. Do.

To this end, the anti-malware program provider according to the prior art periodically puts information on the latest malware on the server, and the user terminal periodically accesses the server to download the anti-malware program or download the upgrade patch. It keeps up-to-date and diagnoses / repairs new malicious code.

Anti-malware program providers should always try to maintain up-to-date information about malware (hereinafter referred to as "malware DB"), which must first collect malware samples.

The first way to collect malware samples is by first reporting the user, secondly by exchanging malware information with relevant experts, and thirdly by visiting suspicious malware sites. There is a direct way to import.

In the third method, websites that distribute malware tend to distribute new malware repeatedly. Therefore, if it is determined that the site that has distributed the malicious code (suspect site) is visited periodically, It is necessary to confirm whether it occurred. In the early days of the art, a person manually visited a suspicious site using a web browser and visually checked whether there was any change. However, as the number of sites to verify increased, this conventional approach became an inefficient task that consumed a lot of manpower and time.

Therefore, the introduction of a technique for automating such inefficient tasks with a computer is urgently required, but this technique has not been proposed until now.

Accordingly, the present applicant has considered the application of the web search engine technology to solve this problem. Among the components of the web search engine, a computer program automatically visits a site and follows a respective link to gather information. The basic configuration is to periodically read a site address to be visited as shown in FIG. After accessing the relevant site using socket communication and investigating, if malicious code is found, it is stored in the malicious code DB.

However, when applying such a technology, since it is implemented using the socket communication technology, which is a communication technology on the Internet, it is excellent for collecting a large amount of data at high speed, but it is not suitable for the operator visually confirming the malware collection operation.

And, as mentioned earlier, it is not appropriate to implement socket communication because it is possible to achieve the desired purpose by checking 1 to 20,000 or less sites at intervals of 3 to 4 days instead of 1 to 2 million. It is a bad choice.

Accordingly, the present applicant has considered the application of a technology for automatically controlling a web browser on a PC. If you use this, you will connect to the Internet through socket communication, but once you control the web browser running on it, the operator can visually check the movement or processing process, which is easy to maintain.

The basic configuration is shown in FIG. Referring to FIG. 2, the configuration is similar to that shown in FIG. 1, except that the user can visually check the appearance with a web browser.

In terms of internal flow, visiting a site from within a web browser is technically the same as the socket communication described earlier. Internet Explorer is designed for developers to use it for other purposes. Although it provides an interface for inserting a web browser into the developer's program source, it is not a technology designed to make itself work. There is a failure, and long time operation is impossible.

In order to automatically control the system shown in FIG. 2, the web browser should be set to call an interception code for arbitrarily adjusting the page changing operation at the time of navigating the user code during navigation. The interception code invocation process is established by initializing the web browser and inserting interception code.

According to this method, however, as shown in FIG. 3, the navigation operation of the web browser is called without being terminated at the time when the web browser calls the user code, and the navigation of the web browser is called again from the interception code. However, the intercept operation is called without ending.

As shown in FIG. 3, when repeatedly executed in this manner, there is a problem in that the stack in the system overflows, thereby increasing the possibility of stopping the operation of the system.

The problem to be solved by the present invention is to provide a malicious code collection method and apparatus that can collect malicious code by automatically monitoring the site that distributes malicious code without the need for manual administrators.

The malicious code collection method of the present invention for achieving the above object, (a) the condition DB and the condition and operation command to be performed by accessing each site and the site DB that stores the address information of suspicious sites that cause malicious code collection device Comprising a condition and a command DB for storing; (b) the malicious code collecting device reading the address information from the site DB; (c) the malicious code collecting device accessing the suspicious site according to the read address information and receiving a web page; And (d) the malicious code collecting device sets a system timer to execute the malicious code collecting program every cycle of the system timer to read one condition and operation command stored in the condition and operation DB, and the condition is satisfied. Collecting malicious code by executing an action command.

In addition, in the step (d) described above, when the malicious code collecting program is executed every cycle of the system timer (d1), the malicious code collecting device reads the condition and the condition stored in the operation DB, and the state of the received web page is read. Investigating whether the satisfied condition is satisfied; And (d2) if the state of the webpage satisfies the read condition, the malicious code collecting device reads and executes the stored action instruction from the condition and action DB in association with the condition, and performs the next condition to be performed in the next cycle of the system timer. And setting an operation command.

In addition, in the above-described step (d2), the operation command is a connection command to a new web page, and in step (d2), the malicious code collecting device may access the web page according to the operation command.

In addition, the above-described malicious code collection method may further include (e) performing step (d) on the condition and operation command set in step (d2) in the next cycle of the system timer.

In addition, the above-described condition is set to a specific character string, and step (d) described above examines whether or not a specific character string is included in the web page, and determines that the condition is satisfied when the specific character string is included in the web page. Can be.

In addition, the above-described condition is set to a string representing an ID or password required for login, and step (d) determines that the condition is satisfied when a string representing an ID or password is included in the webpage, and the You can log in.

In addition, in the step (d) described above, if the condition is satisfied, the operation command for downloading malicious code from the site may be performed by clicking the download tab posted on the site.

In addition, the above-described malicious code collection method may be read by a computer and recorded as executable program code.

On the other hand, the malicious code collection apparatus of the present invention for achieving the above technical problem, the site DB that stores the address information of the suspicious sites that cause malicious code; A condition and command DB for storing an operation command to be performed by accessing a suspicious site and a condition for performing the operation command; A web browser accessing a suspicious site according to the input site address information, receiving a web page, and outputting status information including the content of the received web page; And reading the address information of the site from the site DB and outputting it to a web browser, receiving status information from the web browser, setting a system timer, and executing a malware collection program every cycle of the system timer to collect malicious code. It includes a timer controller.

In addition, the above-described timer control unit reads one condition and operation command stored in the condition and operation DB every cycle of the system timer, compares the state information with the condition, executes the operation command when the condition is satisfied, and executes the malicious code. Can be collected.

In addition, the above-described operation command is a connection command to a new web page, and the malicious code collecting device can access the web page according to the operation command.

In addition, the above-described condition is set to a specific character string, and the timer controller may determine whether the specific character string is included in the web page by checking whether the specific character string is included in the web page.

In addition, the above-described condition is set to a string representing an ID or password required for login, and the timer controller determines that the condition is satisfied when a string representing an ID or password is included in the web page and logs in to the site. You can execute the operation command to perform.

In addition, the above-described timer control unit may perform an operation command for downloading malicious code from the site by clicking the download tab posted on the site when the condition is satisfied.

As described above, the present invention by storing a list of websites that may cause malicious code in advance, and by accessing the sites by an automated program at regular intervals to collect malicious code, It is effective to solve the waste of manpower and time wasted by the administrator of each direct access to each site.

In addition, since the present invention collects malicious code by automatically accessing a website by controlling a web browser, an administrator can visually monitor a malicious code collecting operation, and thus, there is an easy management.

In addition, the present invention is independent of the operation of the web browser, by using the timer call function of the system by comparing the current state of the website with the pre-stored conditions, by executing a malicious code collection operation when the conditions are satisfied, automatic For the control, it is effective to solve the stack overflow that occurs when the web browser calls the interception code when the user code is called during navigation.

In addition, the malicious code collection method by the timer control can be applied to a variety of applications that need to automatically control the web browser. It can be applied when you need to periodically check the changes of other specific sites, or when you want to automatically access specific sites and import data, and on sites where search engines are provided by simply using specific search terms. It can also be applied to analyze the results of a search and then visit the site again and collect data.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

4 is a diagram showing the overall system configuration of the malicious code collection apparatus through the web page monitoring according to the present invention. Referring to FIG. 1, the malicious code collection device of the present invention is connected to a plurality of suspicious site servers 400 and a plurality of user terminals 600 through an internet network.

 As described below, the malicious code collecting apparatus periodically connects to the suspicious site server 400, collects malicious codes from the corresponding site server 400, stores the malicious codes therein, and generates an anti-malware program to the user terminal 600. Provided by).

5 is a block diagram showing the configuration of a malicious code collection device. Referring to FIG. 5, the malicious code collecting device of the present invention includes a timer controller 540, a condition and operation DB 520, a malicious code DB 510, a site DB 530, a web browser 550, and a communication unit ( 560.

First, the site DB 530 stores a list of sites that have a history of generating malicious code or are likely to generate malicious code, and the malicious code DB 510 stores malicious code collected from suspicious sites.

The condition and action DB 520 indicates a condition item, an operation command to be executed when the condition stored in the condition item is satisfied, and a next condition item indicating a condition to be examined next after the operation commands are executed and a location to be executed. This array is stored.

The timer controller 540 reads a site address to be accessed from the site DB 530 at a predetermined time period, and controls the web browser 550 to access the read site. Thereafter, the system timer is started, and at each cycle of the timer setting time period, the web browser 550 receives the status information of the web page to determine whether the condition and the condition for performing the operation stored in the operation DB 520 are satisfied. After the condition is satisfied, the malicious code is collected by performing an operation stored in the condition and operation DB 520 in advance, and the collected malicious code is stored in the malicious code DB 510.

The web browser 550 accesses the suspicious site at regular time intervals according to the control signal input from the timer controller 540, and outputs the current state information of the web page received from the site to the timer controller 540, and the timer controller 540. In accordance with the operation execution command input from the) to execute the operation command such as login, free download, etc. to the connected site to collect malicious code and output to the timer control unit 540. The web browser 550 is a program that allows users to view websites on the Internet within the operating system installed on the PC. The web browser 550 is developed by Microsoft, a developer of Windows, and hierarchically again, the explorer, a product of the company, functions as the web browser. Is finally shown to the user. Of course, it is designed to be used by companies or programmers who want to develop other application software.

The communication unit 560 communicates with the user terminals 600 and the suspicious site server 400 through the Internet network according to a predetermined communication protocol.

6 conceptually illustrates operations performed by the timer controller 540 and the web browser 550 according to an exemplary embodiment of the present invention.

When the suspect site read from the site DB 530 is connected, the timer control unit 540 reads the condition from the condition and operation DB 520 and receives the current state from the web browser 550. The current state refers to the address and contents of a web page currently being accessed or displayed on the screen.

Also, as shown in FIG. 6, the condition and operation DB 520 may specify a condition item and an operation item to be performed when the condition is satisfied, and a next condition that specifies a next operation to be performed after the operation is performed and a condition thereof. Store items in an array.

The timer controller 540 examines whether the current state input from the web browser 550 satisfies the read condition, and if it satisfies it, reads an operation command stored in association with the condition and outputs it to the web browser 550. In addition, the web browser 550 performs a command input from the timer controller 540.

7A and 7B are diagrams illustrating a method of collecting malicious codes through webpage monitoring according to a preferred embodiment of the present invention. First, referring to FIG. 7A, the timer controller 540 first reads address information of a site to be accessed from the site DB 530 and outputs the address information to the web browser 550 (S710), and the condition and operation DB 520. In step S720, the start condition is read and set. At this time, the setting of the condition means setting the arrangement position of the condition and operation DB 520 storing the condition and the operation contents.

The web browser 550 receives site address information from the timer controller 540 and accesses the corresponding site to receive a web page (S730).

Thereafter, the timer controller 540 sets a system timer to execute the malware collection program performing the process shown in FIG. 7B at regular time intervals (S740).

Referring to FIG. 7B, when the process performed in step S740 is described, first, when a timer is set and a program is executed, the timer controller 540 reads the setting condition from the condition and operation DB 520 (S741). ). The setting condition indicates a condition to be read as described above. When the setting condition is first performed on the currently connected site, when the condition set in step S720 is read and is not performed on the currently connected site for the first time. The condition set in step S749 described later is read.

When the condition is read, the timer controller 540 receives state information from the web browser 550 (S743). As described above, the status information refers to the address of the web page currently connected or displayed on the screen, its contents, and the like.

Thereafter, the timer controller 540 compares the read condition with the state information of the web browser 550 to check whether the condition is satisfied, and if the condition is not satisfied, does not set the next condition, that is, the present condition. The collection of malicious code information for the web page ends (S745).

On the other hand, as a result of comparing the read condition with the status information of the web browser 550, if the condition is satisfied, the operation command stored corresponding to the condition is read, and the operation command is output to the web browser 550 to perform the operation. In operation S747, when the operation is completed, the next condition item stored in association with the condition and the current condition of the operation DB 520 is read to set a condition to be performed next (S749).

During one cycle of the timer set in step S740, the above-described steps S741 to S749 are performed for one condition and one operation stored in the condition and operation DB 520, and then for the next timer cycle, step S749. If the condition set in step S and an operation corresponding thereto are performed, and all conditions and operations stored in the condition and operation DB 520 are performed, the operation is performed again from the above-described step 710.

Each process of the above-described step S741 to step S749 will be further described as follows.

The condition and operation DB 520 stores a specific character string (eg, a character string such as "About Us", "E-mail Collection Rejection" displayed at the bottom of the main page of a general shopping mall site) in the condition 1 item in advance, and S741. This string is read by the timer control unit 540 in step.

In operation S743, the timer controller 540 receives strings included in the web page accessed as status information from the web browser 550.

In step S745, the timer controller 540 compares whether the strings included in the status information include the same string as the string read as a condition, and if the same string is included, the condition is satisfied. To judge. For example, when the status information includes the string "About Us", it may be determined that all web pages have been received.

When the condition is satisfied, step S747 reads the operation command from the condition and operation DB 520 and outputs it to the web browser 550 to perform the corresponding operation. In this case, the performed operation may include data on a specific element on the screen, and may cause the web browser 550 to move to another page by clicking a specific button or link. Or you can print a new Navigation command to go to a new page.

If the operation is performed, step 749 designates the position in the array in which the condition and operation to be performed in the next timer cycle are stored and the current timer cycle ends.

Exemplarily, in addition to those described above, conditions and operations may be variously set. For example, as a condition, a picture file path name in jpg or bmp format can be set in a web page. This is generally used to display contents such as "free download" to a user on a web page. If the web page includes a "free download" item, the condition is satisfied and a corresponding operation command is "free download". You can click the tab to download from the site you are currently connected to.

In addition, as a condition, a character string included in a login box such as "ID" and "password" can be set, and if such a string is included in a web page and the condition is satisfied, an operation command can be set to perform a login. have.

In addition, the condition is set whether or not an arbitrary download code such as ACTIVE X is hidden in the connected site, and if the condition is satisfied when such arbitrary download code is hidden, the site to which ACTIVE X is installed and connected You can download the code to distribute randomly.

The malicious codes of executable programs, ACTIVE X, scripts, etc. (collectively referred to as "malware") downloaded from the suspicious sites to the malicious code collecting device through the processes of FIGS. 7A and 7B described above are common malware detection methods. Selected according to the malicious code DB (510) is stored. Since the process of screening malicious code is a known technique, a detailed description thereof will be omitted.

In addition, the above-described process illustrated in FIGS. 7A and 7B described a process performed for one site read from the site DB 530, which is sequentially performed for all sites stored in the site DB 530. Is performed.

The invention can also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording 1 devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, which are also implemented in the form of a carrier wave (for example, transmission over the Internet). It also includes. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

1 is a block diagram conceptually showing a configuration of a web search engine according to the prior art.

FIG. 2 is a block diagram illustrating a configuration in which a web browser is inserted in the prior art of FIG. 1.

FIG. 3 is a diagram illustrating a problem that may occur when a web search engine including the web browser shown in FIG. 2 is applied to malicious code collection.

4 is a diagram showing the overall system configuration of the malicious code collection apparatus through the web page monitoring according to the present invention.

5 is a block diagram showing the configuration of a malicious code collection device.

6 is a view conceptually illustrating an operation performed by a timer controller and a web browser according to an exemplary embodiment of the present invention.

7A and 7B are diagrams illustrating a method of collecting malicious codes through webpage monitoring according to a preferred embodiment of the present invention.

Claims (14)

(a) comprising a site DB storing address information of suspicious sites generating malicious code, and a condition and command DB storing a condition and an operation command to be performed by accessing each site; (b) the malicious code collecting device reading address information from the site DB; (c) the malicious code collecting device accessing the suspicious site according to the read address information and receiving a web page; And (d) The malicious code collecting apparatus sets a system timer, executes a malicious code collecting program every cycle of the system timer, reads one condition and operation command stored in the condition and operation DB, and the condition is satisfied. And collecting malicious code by executing an operation command in a case. The method of claim 1, wherein step (d) (d1) When the malicious code collecting program is executed every cycle of the system timer, the malicious code collecting device reads the condition and the condition stored in the operation DB, and whether the state of the received web page satisfies the read condition. Investigating; And (d2) When the state of the webpage satisfies the read condition, the malicious code collecting apparatus reads and executes the stored operation command in association with the condition in the condition and the operation DB, and executes the next cycle of the system timer. Malicious code collection method comprising the step of setting the following conditions and action instructions. The method of claim 2, In the step (d2), the operation command is a connection command to a new web page, In the step (d2), the malicious code collection device is connected to the web page according to the operation command. The method of claim 2, (e) performing the step (d) of the condition and operation command set in the step (d2) in the next cycle of the system timer. The method according to any one of claims 1 to 4, The condition is set to a specific string, In the step (d), it is determined whether the specific string is included in the web page, and if the specific string is included in the web page, the malicious code collection method is characterized in that the condition is satisfied. . The method according to any one of claims 1 to 4, The condition is set to a string representing an ID or password for logging in, In the step (d), when the string indicating the ID or the password is included in the web page, the condition is satisfied, and the malicious code collection method is characterized in that the login to the site. The method according to any one of claims 1 to 4, In the step (d), if the condition is satisfied, the malicious code collection method is configured to perform an operation command for downloading malicious code from the site by clicking a download tab posted to the site. A recording medium in which the malicious code collection method of any one of claims 1 to 4 can be read by a computer, and recorded with executable program code. A site DB that stores address information of suspicious sites that cause malicious code; A condition and command DB for storing an operation command to be performed by accessing the suspicious site and a condition for performing the operation command; A web browser accessing a suspicious site according to the input site address information, receiving a web page, and outputting status information including the content of the received web page; And Read the address information of the site from the site DB and output it to the web browser, receive the status information from the web browser, set a system timer, and run a malicious code collection program every cycle of the system timer. Malicious code collection device comprising a timer control unit for collecting the code. The method of claim 9, wherein the timer control unit It reads one condition and operation command stored in the condition and operation DB every cycle of the system timer, compares the state information with the condition and executes the operation command to collect malicious code when the condition is satisfied. Malicious code collection device. The method of claim 10, The operation command is an access command to a new web page, and the malicious code collection device connects to the web page according to the operation command. The method according to claim 9 or 10, The condition is set to a specific string, And the timer controller determines whether the specific string is included in the web page, and determines that the condition is satisfied when the specific string is included in the web page. The method according to claim 9 or 10, The condition is set to a string representing an ID or password for logging in, The timer controller determines that the condition is satisfied when the character string representing the ID or password is included in the web page, and executes an operation command for logging in to the site. . The method according to claim 9 or 10, And the timer controller performs an operation command for downloading malicious code from the site by clicking a download tab posted to the site when the condition is satisfied.

Images