KR20110057297A - Dynamic analyzing system for malicious bot and methods therefore - Google Patents

Abstract

PURPOSE: A system and method for malicious bot dynamic analysis are provided to detect and analyze the execution of a malicious bot by avoiding the analysis avoiding method of a malicious bot. CONSTITUTION: A malicious bot detector(100) detects the execution of a malicious bot by avoiding an analysis avoiding method of malicious bot which can exist in an OS(Operating System) of a terminal. A malicious bot analyzer(300) generates, stores, and analyzes the detection result. The malicious bot detector includes first to third modules(110~150) detects an execution of the malicious bot by avoiding a kernel level rootkit scheme, virtual environment detection method, and a DLL(Dynamic Link Library), or binary code insertion scheme.

Description

Dynamic Analyzing System For Malicious Bot And Methods Therefore}

The present invention relates to a dynamic analysis system and method for analyzing malicious bots, and more specifically, bypasses a kernel-level rootkit method, a virtual environment detection method, a DLL or binary file insertion method, etc. Malicious bot dynamic analysis system and method for detecting the execution of malicious bots.

In general, a bot is a subordinate process that operates in a compromised system, and communicates with a manipulator and performs malicious actions by a manipulator's instructions. A botnet is a network composed of the bot and a manipulator. Collectively. As attacks by malicious bots gradually increase, social and economic damages by malicious bots continue to increase.

Methods for detecting and analyzing such malicious bots can be largely classified into a static analysis method and a dynamic analysis method according to whether or not the malicious bots to be analyzed are executed. The static analysis method is performed by analyzing the internal strings of the malicious bots and the portable executable file (PE) file, and the analysis result is high in accuracy and various analysis tools exist, but it is difficult to automate. have. In addition, the dynamic analysis method is performed by analyzing a file, a process, a registry, and a network event after execution of a malicious bot, and is used in a large amount of malicious bot analysis. It is characterized by ease.

Recently, malicious bots use intelligent analysis avoidance methods such as kernel level rootkit, virtual environment detection, DLL or binary file insertion to delay the analysis time. Therefore, the present invention discloses a malicious bot dynamic analysis system and method capable of overcoming the above-mentioned analysis avoidance method of malicious bots.

An object of the present invention is to provide a malicious bot dynamic analysis system and method that can cope with the analysis avoidance method of malicious bots, such as DLL or binary code insertion, virtual environment detection, etc. that are not compatible with conventional malicious bot analysis method It's in the ship.

Malicious bot dynamic analysis system according to the present invention, a malicious bot detection unit for detecting the execution of the malicious bot after bypassing the analysis avoidance method of the malicious bot existing in the operating system (OS) of the terminal; And a malicious bot analyzer for generating, storing, and analyzing detection result information based on whether the malicious bot detection unit detects execution of the malicious bot. It includes.

In this case, the malicious bot detection unit, the first module for detecting the execution of the malicious bot by bypassing the kernel-level rootkit scheme in the malicious bot; A second module for detecting execution of the malicious bot by bypassing a virtual environment detection method in the malicious bot; And a third module for detecting execution of the malicious bot by bypassing a DLL or binary code insertion scheme in the malicious bot; It includes any one or more of.

In addition, the first malicious bot dynamic analysis method according to the present invention includes the steps of: (i) the malicious bot dynamic analysis system copies a system call layer of the kernel to a virtual memory region of the kernel; (B) if an interrupt is generated by the execution of a malicious bot, the malicious bot dynamic analysis system jumps the interrupt to a system call layer of a kernel copied into a virtual memory area of the kernel; And 경우 when the malicious bot is executed based on a system call layer of the kernel copied to the virtual memory area of the kernel, the malicious bot dynamic analysis system monitors the native API call of the malicious bot to Detecting the execution of a malicious bot; It includes.

In addition, the second malicious bot dynamic analysis method according to the present invention, (a ') the malicious bot dynamic analysis system copying the system call layer (System Call Layer) of the kernel to the virtual memory region of the kernel; (b ') The malicious bot dynamic analysis system changes the system call layer of the kernel copied to the virtual memory area of the kernel, and hooks a request regarding the native API of the malicious bot. Responding to a native API call of the malicious bot; And (c ') when the malicious bot is executed based on the response of the malicious bot dynamic analysis system in the step (b'), the malicious bot dynamic analysis system detecting the execution of the malicious bot; It includes.

In addition, the third malicious bot dynamic analysis method according to the present invention, (a ") after the malicious bot dynamic analysis system has finished analyzing whether the malicious bot of the operating system (OS) in the terminal for a predetermined time, the terminal Determining whether a DLL or binary code is inserted into a process of an operating system (OS); (b ") the malicious bot dynamic analysis system determines that the DLL or binary code is inserted into a process of an operating system (OS) in the terminal; Determining whether to execute a process of an operating system (OS) in a terminal into which the DLL or binary code is inserted; And (c ") when the malicious bot dynamic analysis system determines that the process of the operating system (OS) in the terminal in which the DLL or the binary code is inserted is not executed, forcibly executes the process in which the DLL or the binary code is inserted. Detecting the execution of the bot.

According to the present invention, it is possible to detect and analyze the execution of malicious bots by bypassing the analysis avoidance method of malicious bots such as DLL or binary code insertion, virtual environment detection, etc., which are not compatible with conventional malicious bot dynamic analysis systems and methods. By providing a malicious bot dynamic analysis system and method, there is an effect that can prevent and cope with the social and economic damage caused by the malicious bot in advance.

Before describing the details for carrying out the present invention, it should be noted that configurations that are not directly related to the technical gist of the present invention are omitted within the scope of not distracting the technical gist of the present invention. In addition, the terms or words used in the present specification and claims are intended to comply with the technical spirit of the present invention based on the principle that the inventor can define the concept of appropriate terms in order to best explain the invention. It should be interpreted as a concept.

Hereinafter, before the malicious bot dynamic analysis system and method according to the present invention will be described, the analysis avoidance method of the malicious bot will be described in detail.

First, in the kernel level rootkit method, a malicious bot takes control of the operating system (OS) of the terminal at the kernel level at which the operating system (OS) of the terminal operates, and performs malicious actions according to the code of the malicious bot. This makes it difficult to detect malicious bots.

Next, in the case of DLL or binary file insertion method, a specific process, for example, explore.exe, winlogon, is used in an evasion method which aims to change the registry so that a malicious bot can be executed after the terminal is rebooted. It inserts DLL or binary code into memory area of Windows process such as .exe and svchost.exe.

Finally, in the case of the virtual environment detection method, it is an analysis evasion method that aims to delay the analysis time of the malicious bot. After checking whether the virtual machine is running before the malicious bot executes its code, the VM is executed. If it is running, it is determined that malicious bot analysis is running so that the code execution is stopped or only normal processes are executed.

Hereinafter, the malicious bot dynamic analysis system according to the present invention will be described in detail based on the accompanying drawings. 1 is an overall configuration diagram of a malicious bot dynamic analysis system according to the present invention, and FIGS. 2A to 2B illustrate a malicious bot detection unit in a malicious bot dynamic analysis system according to the present invention.

The malicious bot dynamic analysis system according to the present invention includes a malicious bot detection unit 100 and a malicious bot analysis unit 300.

The malicious bot detection unit 100 includes: a first module 110 for detecting execution of the malicious bot by bypassing a kernel level rootkit scheme in the malicious bot; A second module 130 for detecting execution of the malicious bot by circumventing a virtual environment detection method in the malicious bot; And a third module 150 for bypassing the DLL or binary code insertion scheme in the malicious bot to detect execution of the malicious bot. It includes any one or more of.

In this case, the first module 110 will be described in detail with reference to the accompanying drawings. 2A illustrates the first module 110 in the malicious bot detection unit.

The first module 110, after booting the operating system (OS) of the terminal, SSDT (System Service Dispatch Table) containing the address information of the native API in the virtual memory area of the kernel, KiSystemService function and Native API Copy the system call layer of the kernel, including the Application Programming Interface.

When the malicious bot is executed in the operating system of the terminal and an interrupt such as 'INT 2E' or 'SYSENTER' occurs, the first module 110 replaces the original KiSystemService function with the virtual memory area of the kernel. Let's jump to the address of the KiSystemService function in the system call layer of the kernel.

Accordingly, the system call layer of the kernel copied by the malicious bot to the virtual memory area of the kernel through the KiSystemService function in the system call layer of the kernel copied to the virtual memory area of the kernel. By using the native API address information in the SSDT, the native API in the system call layer of the kernel copied to the virtual memory area of the kernel is called.

Therefore, even if the malicious bot changes the SSDT by kernel level rootkit method to avoid the analysis, the first module 110 detects execution of the malicious bot based on monitoring the native API call of the malicious bot. .

In this case, the second module 130 will be described in detail with reference to the accompanying drawings. 2B is a diagram for describing the second module 130 in the malicious bot detection unit.

The second module 130 changes a system service dispatch table (SSDT) containing address information of a native API in a system call layer of the kernel copied to the virtual memory region of the kernel, thereby causing a malicious bot. After hooking a specific Native API call of, it responds to the manipulated result for the specific Native API call of the malicious bot.

For example, referring to FIG. 1B, when the malicious bot calls the NtQuerySystemInformation function to obtain a list of running processes, the second module 130 returns VMToolservice.exe, VMwareService. Deleting and responding to information about processes related to virtual environment (VME) such as exe and VMwareUser.exe.

Accordingly, the malicious bot determines that the execution environment of the operating system of the terminal is not a virtual environment and executes its own code, so that the second module 130 bypasses the malicious environment detection method of the malicious bot and thus malicious. Detect bot execution

In addition, the virtual environment detection method of the malicious bot using the change of the start address of the IDT (Interrupt Descriptor Table) in the virtual environment, SSDT in the system call layer of the kernel copied to the virtual memory area of the kernel After changing the address of the native API to obtain the IDT address in the hook to the native API call of the malicious bot in the second module 130, and changes the start address of the IDT to respond.

Accordingly, the malicious bot determines that the execution environment of the current operating system is not a virtual environment and executes its own code, so that the second module 130 bypasses the malicious environment detection method of the malicious bot to Detect execution

In this case, the third module 150 will be described in detail. The third module 150 detects a case where the malicious bot is not executed immediately after being infected by the operating system of the terminal, but is modified by inserting into a process when the terminal is rebooted by modifying the registry.

Therefore, after the third module 150 analyzes whether a malicious bot exists in the operating system (OS) in the terminal for a predetermined time, the third module 150 determines whether the DLL or binary code is inserted into the operating system (OS) in the terminal. To judge.

In addition, when the third module 150 determines that a process in which a DLL or binary code is inserted into an operating system (OS) in the terminal exists, the third module 150 determines that the process in which the DLL or binary code is inserted is It is determined whether the operating system (OS) in the terminal is running.

When the process in which the DLL or the binary code is inserted is not running in the operating system (OS) in the terminal, the third module 150 uses the process forcing technique to execute the process in which the DLL or the binary code is inserted. Force execution

Accordingly, the third module 150 detects the execution of the malicious bot by monitoring the execution of the process in which the DLL or the binary code is inserted by bypassing the DLL or the binary code insertion method of the malicious bot.

The malicious bot analyzer 300 performs a function of generating, storing, and analyzing detection result information based on whether the malicious bot detection unit 100 detects execution of the malicious bot.

In more detail, the malicious bot analyzer 300 detects the execution of the malicious bots detected by the first module 110 to the third module 150 in the malicious bot detector 100. For example, it collects name information of malicious bots, frequency information of malicious bots, information about files generated by malicious bots, process and registry, and generates them as detection result information.

In addition, when the execution of the malicious bot is not detected by the first module 110 and the second module 130, the execution of the malicious bot is detected by the third module 150. 300 deletes the detection result information previously stored and regenerates and stores the detection result information according to the execution of the malicious bot detected by the third module 150.

Hereinafter, the dynamic analysis method for the malicious bot according to the present invention will be described in detail with reference to the accompanying drawings. 3A to 3C are flowcharts illustrating a dynamic analysis method for malicious bots according to the present invention.

At this time, a first dynamic analysis method for malicious bots according to the present invention will be described in more detail with reference to FIG. 3A.

First, the malicious bot dynamic analysis system copies the system call layer of the kernel to the virtual memory region of the kernel (S101). In this case, the system call layer of the kernel preferably includes an SSDT (System Service Dispatch Table), a KiSystemService function, and a native API including address information of the native API.

Next, when an interrupt is generated by the execution of the malicious bot, the malicious bot dynamic analysis system jumps the interrupt to the system call layer of the kernel copied to the virtual memory area of the kernel (S103). .

At this time, the interrupt is preferably one of 'INT 2E' or 'SYSENTER'. The malicious bot dynamic analysis system jumps the malicious bot to execute its own code based on the SSDT in the system call layer of the kernel copied to the virtual memory region of the kernel.

Next, when the malicious bot is executed based on the kernel's system call layer copied to the kernel's virtual memory area, the malicious bot dynamic analysis system monitors the native API call of the malicious bot. The execution of the malicious bot is detected (S105).

At this time, even if the malicious bot is executed based on the kernel level rootkit method, the malicious bot is based on the address of the native API stored in the SSDT in the system call layer of the kernel copied to the virtual memory area of the kernel. By executing a call requesting a native API, the malicious bot dynamic analysis system detects the execution of the malicious bot as the native API call can be monitored.

Finally, the malicious bot dynamic analysis system generates and stores the detection result information based on whether the malicious bot has detected execution of the malicious bot (S107), thereby terminating the execution detection of the malicious bot.

In addition, a second dynamic analysis method for malicious bots according to the present invention will be described in detail with reference to FIG. 3B.

First, the malicious bot dynamic analysis system copies the system call layer of the kernel to the virtual memory region of the kernel (S301). In this case, the system call layer of the kernel preferably includes a System Service Dispatch Table (SSDT), a KiSystemService function, and a Native API including address information of a native API.

Next, the malicious bot dynamic analysis system changes the system call layer of the kernel copied to the virtual memory area of the kernel, and hooks a request regarding the native API of the malicious bot. In response to the bot's Native API call (S303).

For example, if the malicious bot calls NtQuerySystemInformation function to get a list of running processes, the malicious bot dynamic analysis system may return VMToolservice.exe, VMwareService.exe, VMwareUser.exe, etc. as a result of the invocation of the malicious bot. Deletes and responds to information about processes related to Virtual Machine Enviroment (VME).

Accordingly, since the malicious bot determines that the execution environment of the operating system of the terminal is not the virtual environment and executes its own code, the malicious bot bypasses the virtual environment detection method of the malicious bot to detect the execution of the malicious bot.

Next, when the malicious bot is executed based on the response of the malicious bot dynamic analysis system, the malicious bot dynamic analysis system detects execution of the malicious bot (S305).

Finally, the malicious bot dynamic analysis system generates and stores the detection result information based on whether the malicious bot has detected the execution of the malicious bot (S307), thereby terminating the execution detection of the malicious bot.

In addition, a third dynamic analysis method for malicious bots according to the present invention will be described in detail with reference to FIG. 3C.

First, after the malicious bot dynamic analysis system analyzes whether the malicious bot of the operating system (OS) of the terminal is running for a predetermined time, it is determined whether a DLL or binary code has been inserted into the process of the operating system (OS) of the terminal. It is determined (S501).

Next, when the malicious bot dynamic analysis system determines that a DLL or binary code is inserted into a process of an operating system (OS) in the terminal, whether the process of the operating system (OS) in the terminal in which the DLL or binary code is inserted is executed. It is determined (S503).

Next, when the malicious bot dynamic analysis system determines that the process of the operating system (OS) in the terminal in which the DLL or the binary code is inserted is not executed, the malicious bot dynamic analysis system forcibly executes the process in which the DLL or the binary code is inserted to The execution is detected (S505).

Finally, the malicious bot dynamic analysis system generates and stores the detection result information based on whether the malicious bot dynamic analysis detects the execution of the malicious bot (S507), thereby terminating the execution detection of the malicious bot.

As described above, the present invention has been described and illustrated with reference to a preferred embodiment for illustrating the spirit of the present invention, but the present invention is not limited to the above-described configuration and operation as shown. In addition, those skilled in the art will appreciate that many changes and modifications can be made without departing from the scope of the technical idea of the present invention. Therefore, inventions which have been subjected to all appropriate changes and modifications and inventions belonging to the equivalents of the present invention should also be regarded as belonging to the present invention.

1 is an overall configuration diagram of a malicious bot dynamic analysis system according to the present invention.

2A to 2B illustrate a malicious bot detection unit in a malicious bot dynamic analysis system according to the present invention.

3A to 3B are flowcharts illustrating a malicious bot dynamic analysis method according to the present invention.

Claims (10)

In the malicious bot dynamic analysis system, Malicious bot detection unit for detecting the execution of the malicious bot by bypassing the analysis avoidance method of the malicious bot in the operating system (OS) of the terminal; And a malicious bot analyzer for generating, storing, and analyzing detection result information based on whether the malicious bot detection unit detects execution of the malicious bot. Malicious bot dynamic analysis system comprising a. The method of claim 1, The malicious bot detection unit includes: a first module that detects execution of the malicious bot by bypassing a kernel level rootkit scheme in the malicious bot; A second module for detecting execution of the malicious bot by bypassing a virtual environment detection method in the malicious bot; And a third module for detecting execution of the malicious bot by bypassing a DLL or binary code insertion scheme in the malicious bot; Malicious bot dynamic analysis system including any one or more of the. The method of claim 2, The first module, Copy the system call layer of the kernel including System Service Dispatch Table (SSDT), KiSystemService function, and Native Application Programming Interface (API) to the virtual memory area of the kernel, and the malicious bot is executed to interrupt If an interrupt occurs, KiSystemService function in the system call layer of the kernel copied to the virtual memory area of the kernel is executed to monitor execution of the malicious bot by monitoring the native API call of the malicious bot. Malicious bot dynamic analysis system, characterized in that. The method of claim 2, The second module, Copies the system call layer of the kernel including the System Service Dispatch Table (SSDT), KiSystemService function, and Native Application Programming Interface (API) to the virtual memory area of the kernel. Hooking the native API call of the malicious bot by changing the SSDT in the system call layer of the kernel, and detecting execution of the malicious bot in response to the native API call of the malicious bot. Malicious bot dynamic analysis system. The method of claim 2, The third module, It is determined whether a process in which a DLL or binary code is inserted is present in the operating system (OS) in the terminal. Malicious bot dynamic analysis system, characterized in that by detecting execution of malicious bots. In the dynamic analysis method for malicious bots, (B) the malicious bot dynamic analysis system copies the system call layer of the kernel to the virtual memory area of the kernel; (B) when an interrupt is generated by execution of a malicious bot, the malicious bot dynamic analysis system jumps the interrupt to a system call layer of a kernel copied to a virtual memory area of the kernel; And ⒞ When the malicious bot is executed based on the system call layer of the kernel copied to the virtual memory area of the kernel, the malicious bot dynamic analysis system monitors the native API call of the malicious bot to monitor the malicious bot. Detecting execution of the bot; Dynamic analysis method for malicious bots including. In the dynamic analysis method for malicious bots, (a ') the malicious bot dynamic analysis system copying a system call layer of the kernel to a virtual memory area of the kernel; (b ') The malicious bot dynamic analysis system changes the system call layer of the kernel copied to the virtual memory area of the kernel, and hooks a request regarding the native API of the malicious bot. Responding to the native API call of the malicious bot; And (c ') when the malicious bot is executed based on the response of the malicious bot dynamic analysis system in the step (b'), the malicious bot dynamic analysis system detecting the execution of the malicious bot; Dynamic analysis method for malicious bots including. 8. The method according to claim 6 or 7, The system call layer of the kernel includes a system service dispatch table (SSDT), a KiSystemService function, and a native API. In the dynamic analysis method for malicious bots, (a ") After the malicious bot dynamic analysis system analyzes whether the malicious bot of the operating system in the terminal is running for a predetermined time, whether the DLL or the binary code is inserted into the process of the operating system in the terminal. Determining whether or not; (b ") when the malicious bot dynamic analysis system determines that a DLL or binary code is inserted into a process of an operating system (OS) in the terminal, whether the process of the operating system (OS) in the terminal in which the DLL or binary code is inserted is executed; Determining; And (c ") If the malicious bot dynamic analysis system determines that the process of the operating system (OS) in the terminal in which the DLL or the binary code is inserted is not executed, the malicious bot dynamic execution forcefully executes the process in which the DLL or the binary code is inserted. Detecting the execution of a; dynamic analysis method for a malicious bot comprising a. The method according to any one of claims 6 to 7, and 9, After the step (v) or after (c ') or (c "), Generating and storing the detection result information based on whether the malicious bot dynamic analysis system detects the execution of the malicious bot; Dynamic analysis method for malicious bots further comprising.

Images