KR20100026781A - Method for blocking malicious code through removable disk and apparatus thereof - Google Patents

Abstract

PURPOSE: A method for blocking a malicious code through a removable disk and an apparatus thereof are provided to prevent the propagation of a malicious code through a mobile disk. CONSTITUTION: A file save attempt is detected a removable disk(S310), and it is judged whether or not the file to be stored is identical to a restriction conduction(S320). If so, the file is stores at a cache memory which is prepared as an additional storage region(S330,S340). Otherwise, the file is stored in the connected mobile disk(S380). The information as to the file stored at the cache memory is displayed through the terminal.

Description

Method for blocking malicious code through removable disk and apparatus

The present invention relates to a method and apparatus for blocking malicious programs through a removable disk for preventing malicious code from invading a removable disk in a computer.

In general, malicious code refers to program codes that are intentionally designed to damage computer systems, and include viruses, worms, Trojan horses, or hacking programs.

When a malicious code is generated and distributed and the system is infected with the malicious code, damages that damage the system by destroying or distorting various resources inside the system have occurred. Accordingly, treatment-based vaccine programs are constantly being provided to recover systems damaged by malicious code.

However, the discovery of new malware causes a certain period of time to create a vaccine program that focuses on the treatment and repair of the system damaged by the malicious code, that is, after receiving reports of the malicious code's findings and damages, and then creating a remedy. Recently, due to the improvement of Internet usage and network environment, the time required for the generation, distribution, and infection of the malicious code is further accelerated, so that many systems are already infected by the malware even during the vaccine production and distribution. As it is, malicious code is spread and the damage amounted to a considerable amount.

Moreover, in the past, the network via the Internet was the main route, but now the distribution route is diversified to removable disks via USB.

Recent malware has become increasingly intelligent, with some malware hiding as if it were a normal Windows configuration file (Autorun.inf), which will automatically run when the removable disk is connected and move from the computer to the removable disk. If the "Autorun.inf" file or the Recycle Bin is created in the USB memory, it is most likely infected with malware. In the past, some Trojans used this technique, but the use of removable disks has increased, and malware that targets them is rapidly increasing. If you use this removable disk, all of your computers will be infected with malicious code, causing a very serious problem.

To prevent these problems, one of the latest removable disks, USB memory, has a write lock (write lock). Assuming the user only reads and does not write to the information on the removable disk, the user can connect and use the computer with the write lock. This prevents malware on your computer from spreading to removable disks. However, most removable disks currently in circulation do not have a write lock device, and even if a write lock device exists, the user must set the write lock on the removable disk or force the write lock to be released in order to save data on the removable disk. It is obvious that it is often impossible to prevent the spread of malicious codes to removable disks.

The present invention has been made to solve the above problems, an object of the present invention, when a removable disk is connected to the computer by preventing the unwanted files are stored on the removable disk, the malware through the removable disk To provide a method and apparatus for blocking malicious programs through a removable disk to block the spread.

According to an aspect of the present invention, there is provided a method for blocking malicious programs through a removable disk, the method comprising: detecting an attempt to save a file to the removable disk in a terminal connected to the removable disk; Comparing whether the file to be stored matches a preset constraint; And storing the file in a cache storage unit, which is a storage area separately provided in the terminal, if the comparison result is limited in the comparison step, and storing the file in the connected removable disk if the limitation condition is not satisfied. Storing.

The restriction condition may be one or more of whether the extension of the file corresponds to a specific extension or a method of checking the format of the file.

The method may further include displaying information about the file stored in the cache storage unit through the terminal; And receiving a processing method for the file from a user through the terminal.

The processing method is preferably at least one of deletion, copying to a removable disk, and malware inspection.

On the other hand, the malicious program blocking method through a removable disk according to another embodiment of the present invention for achieving the above object, in the terminal connected to the removable disk, detecting an attempt to open a file stored in the removable disk or cache storage unit; step; When the open event is a new write, opening a file in the cache storage unit or creating a new file if not present; If the open event is an overwrite, if the file exists in the cache storage unit, the file is opened and created immediately, and if there is a file on the removable disk, the file is first copied to the cache storage unit and then moved; And in other cases, if there is a file in the cache storage unit, open the file in the cache storage unit, and if not, open the file in the mobile disk.

On the other hand, the malicious program blocking device via a removable disk according to the present invention for achieving the above object, the terminal connected to the removable disk, the file inquiry module for detecting a file storage attempt to the removable disk; A policy management module for comparing whether the file to be stored matches a predetermined constraint; A cache storage unit capable of temporarily storing a file as a storage space inside the terminal; And if the comparison result is limited by the policy management module, stores the file in a cache storage unit, which is a storage area separately provided in the terminal, and when the file does not correspond to the restriction condition, the file is stored in the connected removable disk. It includes a control module for controlling to store in.

Meanwhile, in order to achieve the above object, an apparatus for blocking malicious programs through a removable disk according to the present invention includes a terminal connected to a removable disk,

A file inquiry module for detecting an attempt to open a file stored in the removable disk or the cache storage unit; A cache storage unit capable of temporarily storing a file as a storage space inside the terminal; And if the open event is a new write, open the file in the cache storage, or if there is no file, create a new file and open it. If the open event is an overwrite, the file is in the cache storage. Open the file and write it. If there is a file on the removable disk, copy it to the cache storage and move it. Then, open the file in the cache storage if there is a file in the cache storage. It contains a control module that controls the opening of files on disk.

On the other hand, the computer-readable recording medium according to the present invention, the terminal connected to the removable disk, detecting the attempt to save the file to the removable disk; whether the file to be stored meets a predetermined constraint Comparing; And storing the file in a cache storage unit, which is a storage area separately provided in the terminal. Storing.

As described above, by using the method and apparatus provided by the present invention, even when a removable disk is connected to the computer, even if a file is copied to the removable disk or written to the removable disk at a moment when the computer does not recognize the user, Rather than being immediately stored in the removable disk, the storage is preferentially stored in the cache storage unit provided in the user's computer. After the data is stored, only the files that can be stored by asking the user to process the files are stored on the actual removable disk, or only the files that are determined to be non-malware are stored on the actual removable disk.

As a result, it is possible to prevent the spread of malicious code through the removable disk.

Hereinafter, with reference to the drawings will be described the present invention in more detail.

1 is a diagram illustrating a state in which a USB memory, which is a representative example of a removable disk, is connected to a computer.

Recently, users use the USB memory 200 a lot to transfer files. At this time, as shown in the figure, users simply plug the USB memory 200 into their computer 100.

2 is an internal block diagram of an apparatus for blocking malicious programs through a removable disk according to an embodiment of the present invention.

As shown in FIG. 2, the malicious program blocking device 160 includes a file query module 110, a policy management module 120, a cache storage unit 130, a control module 140, and a USB connection terminal 150. do.

The malicious program blocking device 160 is installed in the user's computer 100. Thereafter, the file inquiry module 110 checks whether or not a specific file is stored in the USB memory 200 connected to the outside in the computer 100 in real time.

The policy management module 120 sets a condition to be stored in the cache storage unit 130. Malware usually appears in many forms, such as executable files or Excel files. Therefore, after setting these conditions, the corresponding conditions are compared using the file extension. That is, if the extension is an executable file such as an EXE or a COM, a condition may be set to be stored in the cache storage unit 130.

In addition, when comparing only the extension, it can be avoided by changing only the extension of the file, which is actually an executable file. In order to prevent such a case, a method of checking the format of the file is also possible. In this case, the method of checking the format of the file is a method of analyzing the contents of the file to determine whether a specific code is included. For most files, you can find out if the file is an executable file, an Excel file, or some other file by just examining the first 4-8 bytes.

The cache storage unit 130 is a space temporarily stored before being substantially stored in the USB memory 200. That is, it does not mean a cache, which is a necessary memory because of a speed difference between CFI and RAM, which are commonly known by those skilled in the art, and may be any storage space in the user computer 100 that may temporarily store instead of the USB memory 200. Therefore, some space may be allocated to the memory and utilized, or some space of the hard disk of the user computer 100 may be allocated.

The control module 140 controls the above-described file query module 110, the policy management module 120 and the cache storage unit 130, the specific file detected by the file query module 110 is the policy management module 120 After determining whether it is a restriction condition, if applicable, instead of sending it to the external USB memory 200 through the USB connection terminal 150, and stores it in the cache storage unit 130 in the computer 100. This content will be described later in detail with reference to FIG. 3.

The USB memory 200 includes a USB connection terminal 150 that performs USB communication with a computer, and a storage unit 210 that stores data substantially. Meanwhile, in the present embodiment, the USB memory 200 is described as an example, but this is merely an example for convenience of description. Therefore, the present invention may be applied to any type of removable disk as well as the USB memory 200. Hereinafter, instead of the USB memory 200 will be referred to as a removable disk.

3 is a flowchart provided to explain a malicious program blocking method through a removable disk according to an embodiment of the present invention.

First, an attempt to save a file on a removable disk is checked (S310). No attempt is made to create a file on the removable disk, whether the user copies and moves the file to the removable disk, a particular application attempts to write the file to the removable disk, or attempts to secretly write the file at a moment that the user does not recognize. It's all about checking.

If an attempt is made to save the file in this way, the file is compared with a preset constraint (S320).

These constraints can be set by the user through option screens or settings, or can be set in advance by the operator for distribution to the user. As described above in the description of FIG. 2, the limitation condition is set in the form of a file in which many malicious codes are found. The comparison method may be a method of comparing extensions or checking a file format. Of course, if you want to filter out any file, you can set the constraint to all files.

If the comparison result does not correspond to the constraint (S330-N), it is immediately stored on the actual removable disk (S380).

If it is a restriction condition (S330-Y), instead of the removable disk is stored in the cache storage provided in the user's computer (S340). This prevents the spread of malicious code and other files directly to a removable disk.

Once the files corresponding to the constraints are temporarily put into the cache storage, it is checked whether or not the malicious code (S350). Most malware detection programs have a general scan and a detailed scan, and it usually takes too much time to scan the entire hard disk, so most users do not use it. However, the file stored in the cache storage unit as in the present invention is a high risk file and does not have much capacity, so in this case, it is more efficient to inspect using a close inspection.

If the scan is not malicious code (S360-N), it is actually stored on the removable disk (S380).

If the malware corresponds to (S360-Y), check whether the malware can be repaired again, if it can be cleaned (S362-Y), after treating the malware (S364) and save the repaired file to a removable disk (S380). On the contrary, if the treatment is not possible (S370-N) it is deleted from the cache storage (S370).

Before storing the file that meets the above constraints on the removable disk, the method to prevent the spread of malicious code to the removable disk by using the cache storage method is described. In particular, in the above-described example, the contents of malicious code inspection after being put into the cache storage unit have been described, but the present invention is not limited thereto.

4 is a flowchart provided to explain a malicious program blocking method through a removable disk according to another embodiment of the present invention.

Steps S410, S420, S430, and S440 in FIG. 4 are similar to steps S310, S320, S330, and S340 in FIG. 3, and thus a detailed description thereof will be omitted.

After being stored in the cache storage unit at step S440, the information on the stored file is displayed for the user to view, and an input window for inputting a processing method for the file is displayed together (S450).

As a method of processing, an input window may be displayed next to the file information, asking whether to delete the file, to check whether it is malicious code, or to immediately store it on a removable disk. Of course, if an application that can detect malicious code is not installed on the user's computer, it is also possible to display only an input window asking whether to delete.

If the user deletes through the input window (S460-Y), the file is deleted from the cache storage unit (S470).

On the other hand, if the user inputs a malicious code scan (S480-Y), it scans the malicious code (S482).

If the scan is not malicious code (S484-N), it is actually stored on the removable disk (S490).

If the malware corresponds to (S484-Y), check whether the malware can be repaired again, and if it can be cleaned (S486-Y) after treating the malware (S488) and save the cured file to a removable disk (S490). On the contrary, if the treatment is impossible (S486-N) it is deleted from the cache storage (S470).

Meanwhile, in the present invention, the file stored in the cache storage unit remains only in the cache storage unit, and when the user tries to remove the removable disk, the cache storage unit may move from the removable disk, or the user does not use an application or the like system. It can also be modified by moving to a removable disk using the moment when there is no load.

On the other hand, when using a removable disk and the cache storage unit as in the present invention, a new operation is required to read a file.

For example, suppose you have a file named A on your removable disk and a file named A on your new cache store. Even in this case, in order to avoid confusion, all users show that there is only one file, A, on the removable disk when they look in the file search window. After that, the newly created file A is moved to the removable disk through the above-described process, while overwriting the existing file.

The problem is that you need to open a file named A before moving it to a removable disk. That is, as above, the file may be in both the cache storage and the removable disk, or in only one location.

In this case, there are three main types of open events: read, write w / truncate, and write w / o truncate. Of course, these events occur when the file is opened in the application stage, which is not recognized by the actual user.

In case of simple reading, if there is a file in the cache storage, open the file in the cache storage. If not, open the file in the moving disk. In this case, the file is simply opened for reading, so there is little risk of spreading malicious code.

In the case of a new write, a conventional file is not necessary. Therefore, if there is a file in the cache storage, the file can be opened and used. If it is not in the cache storage, it is possible to create and open a new file directly from the cache storage without checking whether there is a file on the removable disk. After creating and opening a new cache storage unit, it is created and moved to a removable disk afterwards. If there is a corresponding file on the removable disk, there is no problem because it is overwritten during the moving process.

On the other hand, in the case of overwriting, a conventional file is required. Therefore, if there is a file in the cache storage, open it and create it. If there is a file on the removable disk, copy it to the cache storage and move it, and then rewrite it here. By doing so, even when a new file is written as well as a method of modifying an existing file, even when the malicious code is distributed, the file is moved to the cache storage to be written once, thereby preventing the spread of the malicious code.

Up to now, the malicious program blocking method through the removable disk for preventing the malicious code distributed to the computer through the removable disk to invade the removable disk from the computer has been described in detail with reference to a preferred embodiment.

In the present embodiment, a computer has been described as an example of a terminal, but the computer is merely an embodiment for convenience of description. Therefore, the present invention can be applied to any terminal that can store files by connecting a removable disk.

In addition, although the preferred embodiment of the present invention has been shown and described above, the present invention is not limited to the specific embodiments described above, but the technical field to which the invention belongs without departing from the spirit of the invention claimed in the claims. Of course, various modifications can be made by those skilled in the art, and these modifications should not be individually understood from the technical spirit or the prospect of the present invention.

Hereinafter, with reference to the drawings will be described the present invention in more detail.

1 is a view showing a state in which a USB memory that is a representative example of a removable disk connected to a computer,

2 is an internal block diagram of an apparatus for blocking malicious programs through a removable disk according to an embodiment of the present invention;

3 is a flow chart provided in the description of the malicious program blocking method through the removable disk according to an embodiment of the present invention, and

4 is a flowchart provided to explain a malicious program blocking method through a removable disk according to another embodiment of the present invention.

Explanation of symbols on the main parts of the drawings

100: computer 200: USB memory

110: file query module 120: policy management module

130: cache storage 140: control module

150: USB connector

Claims (9)

In the terminal connected to the removable disk, Detecting an attempt to save a file to the removable disk; Comparing whether the file to be stored matches a preset constraint; and If the comparison result of the comparison step is a constraint condition, the file is stored in the cache storage unit which is a storage area provided separately in the terminal, If it does not correspond to the constraint, malicious file blocking method via a removable disk comprising the step of storing the file on the connected removable disk. The method of claim 1, The limiting condition is whether the extension of the file corresponds to a specific extension or malicious program blocking method through a removable disk, characterized in that any one or more of the method of checking the format of the file. The method of claim 1, Displaying information about the file stored in the cache storage unit through the terminal; And And a step of receiving a processing method from the user through the terminal with respect to the file. The method of claim 3, wherein The processing method is a malicious program blocking method through a removable disk, characterized in that any one or more of the deletion, copying to a removable disk, and the malicious code scan. The method of claim 1, The method may further include checking a malicious code for a file stored in the cache storage unit. And deleting the file from the cache storage unit, copying to a removable disk, and performing a malicious code treatment in accordance with the test result. In the terminal connected to the removable disk, Detecting an attempt to open a file stored in the removable disk or cache storage; If the open event is a new write, opening the file if there is a file in the cache storage, and creating and opening a new file if not; If the open event is overwritten, opening the file in the cache storage unit if there is a file in the cache storage unit and copying the file to the cache storage unit and then opening the file in the cache storage unit if the file exists in the removable disk; And Otherwise, if there is a file in the cache storage unit, the file is opened in the cache storage unit, and if not, the malicious program blocking method comprising the step of opening a file on the removable disk. In the terminal connected to the removable disk, A file inquiry module for detecting an attempt to save a file to the removable disk; A policy management module for comparing whether the file to be stored matches a predetermined constraint; A cache storage unit capable of temporarily storing a file as a storage space inside the terminal; And If the comparison result of the policy management module corresponds to a restriction condition, the file is stored in a cache storage unit, which is a storage area separately provided in the terminal, If it does not correspond to the constraints, the malicious program blocking device through a removable disk comprising a control module for controlling to store the file on the connected removable disk. In the terminal connected to the removable disk, A file inquiry module for detecting an attempt to open a file stored in the removable disk or the cache storage unit; A cache storage unit capable of temporarily storing a file as a storage space inside the terminal; And If the open event is a new write, open a file in the cache storage unit or create a new file if not, and open the file. If the open event is overwritten, open the file immediately if there is a file in the cache storage.If there is a file on the removable disk, copy the file to the cache storage and move it. Otherwise, if there is a file in the cache storage unit, the file is opened in the cache storage unit, if not, the malicious program blocking device comprising a control module for controlling to open the file on the moving disk. In the terminal connected to the removable disk, Detecting an attempt to save a file to the removable disk; Comparing whether the file to be stored matches a preset constraint; And If the comparison result of the comparison step is a constraint condition, the file is stored in the cache storage unit which is a storage area provided separately in the terminal, The computer-readable recording medium having recorded thereon a program capable of performing the step of storing the file on the connected removable disk if the limitation does not apply.

Images