KR20110131627A - Apparatus for detecting malicious code using structure and characteristic of file, and terminal thereof - Google Patents

Abstract

PURPOSE: A malicious code diagnostic/recovery device and terminal device for the same are provided to prevent a malicious code by comparing a file structure of a terminal device and characteristic of the terminal device. CONSTITUTION: A file transceiver(610) receives file information about the modified file from terminal devices. A file comparator(620) compares file information of the terminal device. A malicious code diagnosis unit(630) determines the terminal device to the terminal device which is infected with the malicious code. A system recovery unit(640) recovers an OS(Operating System) of the infected terminal device to the previous OS.

Description

Apparatus for Detecting Malicious Code Using Structure and Characteristic of File, and Terminal Thereof}

The present invention relates to an apparatus for diagnosing and recovering malicious codes. More particularly, the present invention relates to the fact that internal terminal devices to which security patches and the like are applied at a similar point in a unit group composed of a plurality of terminal devices have almost the same file structure and characteristics. If one terminal device has a different file structure and characteristics than a plurality of terminal devices, it relates to a malicious code diagnosis and recovery device that considers this as an intrusion due to malicious code, and a terminal device for the same.

Due to the development of the Internet, most computers are connected to a network. As a result, individuals can collect various information over the Internet, exchange information via email, and chat and videoconference with remote friends. However, a computer may be infected with malicious code on the Internet, and thus, various information including personal information in the computer may be leaked. In addition, these malicious codes can cause problems with the computer's operating system and prevent them from using the system anymore.

In order to solve this problem, as a countermeasure for preventing malicious codes and hacking in recent years, various information protection systems have been operated. The information protection system blocks illegal packets and malicious codes that come into the computer group through intrusion detection systems and intrusion blocking systems, and uses malicious programs to treat malicious codes by using a vaccine program. However, since the conventional information protection system operates based on a predetermined rule or pattern, it is a reality that malicious information that is not deviated from the rule or is not recognized is defenseless. To this end, a number of techniques are actively used to develop and apply rules or patterns, but after a certain period of time, more efficient malicious code appears to decrease efficiency.

1 to 3 are diagrams for describing a process of generating a system failure by a distributed service attack in a conventional information security system.

Referring to FIG. 1, malicious codes that deviate from a predetermined rule or pattern enter the internal terminal group 130 by bypassing the intrusion prevention system 110 and the intrusion detection system 120.

Referring to FIG. 2, some terminal devices 132 are infected with malicious codes, and terminal devices 134 not infected with malicious codes normally update the system and the user environment. At this time, even if the antivirus server 150 is running, since the malicious code is disguised as update information, it is very difficult to identify the terminal device 132 infected with the malicious code among a plurality of terminal devices and to remove the malicious code. .

Referring to FIG. 3, a malicious code infects a plurality of terminal devices 132 and then modulates a system file of a plurality of terminal devices 132 infected with a malicious code or hides a Trojan horse in a system. Afterwards, a plurality of terminal devices 132 infected with malicious code leak main information or generate a large amount of packets such as a distributed denial of service attack (hereinafter, referred to as 'DDoS') to operate the server 140. Paralysis) and system failure.

In other words, recent attack techniques use network and computer structural vulnerabilities to cause normal service delay for several days, and hackers distribute malicious code for service attack to various computers to attack specific sites. It generates massive amounts of packets that cannot be handled by the target system simultaneously, resulting in network performance degradation or system paralysis. The most typical hacking method is DDoS attack, which transmits a huge amount of arbitrarily manipulated aggressive traffic to various servers such as web servers, management servers, and DB servers, and network devices such as routers and firewalls. Delay or paralyze further services. In particular, while the attack technique is very simple but has a large ripple effect, no effective countermeasures have been prepared. Therefore, recent attacks have evolved from simple theft to attack large-scale systems, and have been developed as a powerful tool to carry out the purpose of cyber warfare.

To this end, defense-related research on large packets is being actively conducted. The most basic method is a method of gathering suspect traffic from a router into a separate space and then discarding the traffic. However, it can not be a proper solution because it can contain normal traffic in addition to malicious code in a separate space. Also, the filtering method is not effective for attacking using a general protocol. In addition, most intrusion prevention systems have DDoS protection, but it is difficult to withstand a large amount of traffic, and the detection of malicious code is limited to known forms, and thus, it is impossible to prevent all attacks and breaches in real time. In some cases, the network bandwidth can be increased through load balancing, redundancy, and redundancy, but this is a cost-effective and short-term solution.

Some suggested methods include various methods, including how to verify that zombie terminal devices are active by communicating silence, how to verify that unauthorized processes are running on the system, and how to block source IPs from which large packets are occurring. While methods have been suggested, intelligent malware is bypassing these methods. In addition, it is virtually impossible to respond to malicious code that continues to be silent for a period of time, behave unregistered in a process, or constantly change its source IP.

The present invention has been made to solve the problems as described above, and diagnoses the malicious code that can not be solved by intrusion detection system, intrusion prevention system and vaccine, and the like, and a device for diagnosing and recovering malicious code for recovering the system, and The purpose is to provide a terminal device.

The present invention for achieving the above object, File transmission and reception unit for receiving file information on the modified file from a plurality of terminal devices; A file comparison unit comparing file information of the plurality of terminal devices; A malicious code diagnosis unit that determines that a terminal device having different file information is infected with a malicious code when a terminal device having different file information from other terminal devices exists among the plurality of terminal devices; And when the terminal device infected with the malicious code is found as a result of the determination of the malicious code diagnosis unit, removes the file infected with the malicious code from the terminal device infected with the malicious code and replaces the operating system of the terminal device infected with the malicious code with the previous operating system. It provides a malicious code diagnosis and recovery device including a system recovery unit for recovering.

In addition, the present invention, the file history management unit for managing the modification history of a plurality of files; A file storage unit for storing file information on the modified file; And a file transceiving unit configured to transmit file information stored in the file storage unit to a malicious code diagnosing and repairing device for diagnosing malicious code. And it provides a terminal device including a malicious code blocking unit for blocking the operation of the file infected with malicious code at the request of the malicious code diagnosis and recovery device.

As described above, the present invention provides a malicious code diagnosis and repair device for determining whether a malicious code is infected by comparing file structures and characteristics of a plurality of terminal devices, and a terminal device therefor. Even malicious code can be prevented and malicious code can be found without updating the pattern of malicious code every time.

In addition, by blocking the computer that participates in the DDoS attack in advance, it is possible to solve the national and global inability to respond to the DDoS and operate a well-intentioned management system.

In addition, by detecting and blocking unrecognized malicious code in advance, it is possible to improve the safety of the computer and to completely solve the parts not solved in the existing information protection system such as data security and external attack prevention.

1 to 3 are diagrams for explaining a system failure generation process by a distributed service attack in a conventional information security system,
4 is a diagram showing the configuration of an information protection system according to an embodiment of the present invention;
5 is a block diagram schematically illustrating a configuration of a terminal device according to an embodiment of the present invention;
6 is a block diagram schematically illustrating a malicious code diagnosis and a configuration of a terminal device according to an embodiment of the present invention;
7 to 9 are diagrams for explaining a response process when a distributed service attack in the information protection system according to an embodiment of the present invention.

In many terminal devices, since most of the changed files are changed by an update or a patch, the changes are the same. Therefore, in the case of a terminal device having a file whose change is different, it can be suspected that malicious code is planted. In one embodiment of the present invention, malicious code is detected by the above principle.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

4 is a diagram showing the configuration of an information protection system according to an embodiment of the present invention.

Referring to FIG. 4, the information protection system according to the present invention includes a plurality of terminal devices 410 including a computer, a notebook computer, a mobile phone, and a smartphone, a malicious code diagnosis and recovery device 420, an intrusion detection system 430, Intrusion prevention system 440, operation server 450, vaccine server 460 and authentication and encryption server 470, and the like.

The plurality of terminal devices 410 manages modification history of all files in the device. In detail, the plurality of terminal devices 410 periodically checks for changes in files including system files, work files, update files, cookies, and the like except for temporary files, and checks the log of the modified files, that is, file information. It is periodically updated and stored, and transmits the stored file information to the malicious code diagnosis and repair device 420. A detailed configuration of the plurality of terminal devices 410 according to the present invention will be described with reference to FIG. 5.

The malicious code diagnosis and recovery apparatus 420 receives file information from the plurality of terminal devices 410, compares the redundancy, similarity, and file attribute of the file information of the plurality of terminal devices 410 to be different from other terminal devices. If a terminal device with file information exists, it is determined that the terminal device is infected with malicious code.

In addition, when the malicious code diagnosis and repair device 420 finds a terminal device infected with malicious code, the malicious code infected terminal device must be quarantined, and the terminal device infected with the malicious code no longer operates as a zombie terminal device. do. To this end, the malicious code diagnosis and recovery apparatus 420 removes the file infected with the malicious code from the terminal device infected with the malicious code, and restores the operating system of the terminal device infected with the malicious code to the previous operating system.

In addition, the malicious code diagnosis and repair device 420 provides the file information infected with the malicious code to the intrusion prevention system 430, the chip detection system 440, and the antivirus server 460, and thus, the terminal device infected with the malicious code. It can block traffic and prevent the spread of malicious code. Detailed configuration of the apparatus for diagnosing and repairing malicious code 420 according to the present invention will be described with reference to FIG. 6.

Intrusion detection system 430 stores a predetermined rule or pattern for blocking malicious code. The intrusion detection system 430 according to the present invention may be provided with a new rule from the malicious code diagnosis and repair device 420 with respect to malicious code.

The intrusion prevention system 440 blocks malicious code according to a predetermined rule or pattern stored in the intrusion detection system 430.

Operation server 450 is a variety of servers including a web server, a management server, a DB server and the like operating a large-scale system.

The vaccine server 460 provides an vaccine program for treating malicious code. The vaccine server 460 according to the present invention receives file information infected with malicious code from the malicious code diagnosis and repair device 420, updates the vaccine program, and checks the entire system of all terminal devices.

The authentication and encryption server 470 is installed in front of the malicious code diagnosis and recovery device 420, and separate communication for performing secret communication between the plurality of terminal devices 410 and the malicious code diagnosis and recovery device 420. Provide protocols and operating systems. Accordingly, the malicious code diagnosis and recovery apparatus 420 blocks all communication except for communication with the terminal device.

5 is a block diagram schematically illustrating a configuration of a terminal device according to an embodiment of the present invention.

Referring to FIG. 5, the terminal device 410 according to the present invention includes a file history managing unit 510, a file storing unit 520, a file transmitting and receiving unit 530, a malicious code blocking unit 540, and the like.

The file history manager 510 manages modification histories of a plurality of files. That is, the file history manager 510 checks changes of a plurality of files including system files, work files, update files, cookies, and the like except for temporary files, and continuously updates the log of the modified files.

The file storage unit 520 stores file information about the modified file. Here, the file information includes file name, file size, creation date, modification date, access date, file total hash value, folder path information, file start pattern, EXE / DLL file control information, external function access information, and network according to virtual execution. System access records.

The file transceiving unit 530 transmits the file information stored in the file storage unit 520 to the malicious code diagnosis and recovery device 420. Here, the file transceiving unit 530 may transmit file information on the specific file to the malicious code diagnosis and repair device 420 when checking the system time of the specific file. This is because files infected with malicious code or hidden Trojans perform latencies and check system time for simultaneous multiple attacks.

The malicious code blocking unit 540 blocks an operation of a file infected with malicious code in response to a request of the malicious code diagnosis and repair device 420.

In addition, the terminal device 410 according to the present invention may further include a hash function calculator 550, a security manager 560, a file search unit 570, and the like.

The hash function calculation unit 550 performs a hash function calculation on the modified file. Using this, the file history manager 510 may manage the modification history of a plurality of files by using a hash function, and the file storage unit 520 may correspond to the modified file together with the file information about the modified file. The hash value is stored, and the file transceiving unit 530 may transmit the hash value along with the file information on the modified file to the malicious code diagnosis and repair device 420.

The security manager 560 encrypts and stores files (eg, various document files including Word, Excel, PowerPoint, etc.) that have passed a predetermined period of time, and diagnoses and recovers an encryption key of the encrypted file. Stored in the device 420, the user decrypts the encrypted file using the encryption key stored in the malicious code diagnosis and recovery device 420 when the user views the encrypted file. Accordingly, it is possible to prevent the leakage of the file stored in the terminal device 410 for a long time.

The file search unit 570 provides a file search function using a search word, and provides a function of deleting or backing up unnecessary files. Accordingly, the user of the terminal device 410 may search for a file desired by the user using a search word, and delete or back up unnecessary files.

6 is a block diagram schematically illustrating a configuration of an apparatus for diagnosing and recovering malicious codes according to an embodiment of the present invention.

Referring to FIG. 6, the apparatus for diagnosing and recovering malicious codes 420 according to the present invention may include a file transceiving unit 610, a file comparator 620, a malicious code diagnosing unit 630, and a system recovering unit 640. Include.

The file transceiver 610 receives file information on the modified file from the plurality of terminal devices 410 and organizes the received file information for each file. Here, the file transceiver 610 performs secret communication with the plurality of terminal devices 410 using a separate protocol and an operating system. In detail, the authentication and encryption server 470 is located in the plurality of terminal devices 410 and the malicious code diagnosis and recovery device 420, and the file transmission / reception unit 610 is connected to the plurality of terminals through the authentication and encryption server 470. Perform secret communication with the device 410.

The file comparison unit 620 compares file information of the plurality of terminal devices 410. In this case, the file comparison unit 620 may compare the file information of the plurality of terminal devices 410 using a hash value corresponding to the file information in order to shorten the time for comparing the file information.

The malicious code diagnosis unit 630 determines whether there is a terminal device having file information different from that of other terminal devices among the plurality of terminal devices 410 as a result of the comparison of the file comparison unit 620. If a terminal device with file information exists, it is determined that the terminal device with different file information is infected with malicious code.

As a result of the determination by the malicious code diagnosis unit 630, the system recovery unit 640 detects the terminal device infected with the malicious code, so as to isolate the terminal device infected with the malicious code, the system recovery unit 640 is infected with the malicious code from the terminal device infected with the malicious code. Remove the file and restore the operating system of the terminal device infected with the malicious code to the previous operating system. In addition, the system recovery unit 640 may transmit a prevention message indicating the occurrence of the malicious code to the plurality of terminal devices 410 so that the malicious code does not propagate to other terminal devices.

7 to 9 are diagrams for explaining a response process when a distributed service attack in the information protection system according to an embodiment of the present invention.

Referring to FIG. 7, a plurality of terminal devices 410 manages modification history of all files in the device and transmits file information on the modified files to the malicious code diagnosis and recovery device 420.

The malicious code diagnosis and recovery apparatus 420 receives file information from the plurality of terminal devices 410, compares the redundancy, similarity, file attributes, and the like of the file information of the plurality of terminal devices 410 to be different from other terminal devices. If a terminal device with file information exists, it is determined that the terminal device with different file information is infected with malicious code.

Referring to FIG. 8, when there is a terminal device infected with malicious code in the internal network, the malicious code diagnosis and repair device 420 removes a file infected with malicious code from the terminal device and transfers the system of the terminal device. Restore to a system file. At the same time, the malicious code diagnosis and repair apparatus 420 may remotely execute an update or patch file for the plurality of terminal devices 410.

Referring to FIG. 9, after recognizing malicious code, the malicious code diagnosing and repairing device 420 provides a new rule to the intrusion detecting system 430 and the intrusion blocking system 440, and provides the malicious code to the antivirus server 460. Provides file information infected with code. Accordingly, the antivirus server 460 updates the antivirus program by reflecting the file information infected with the malicious code, and checks the entire system of the plurality of terminal devices 410.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and variations without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas falling within the scope of the same shall be construed as falling within the scope of the present invention.

410: a plurality of terminal devices 420: malware diagnosis and repair device
430: intrusion detection system 440: intrusion prevention system
450: production server 460: antivirus server
470: authentication and encryption server 510: file history management unit
520: File storage unit 530: File transceiver
540: malware blocking unit 550: hash function calculation unit
560: security management unit 570: file search unit
610: file transceiver 620: file comparison unit
630: malware diagnosis unit 640: system recovery unit

Claims (10)

A file transceiving unit which receives file information on the modified file from a plurality of terminal devices;
A file comparison unit comparing file information of the plurality of terminal devices;
A malicious code diagnosis unit that determines that a terminal device having different file information is infected with a malicious code when a terminal device having different file information from other terminal devices exists among the plurality of terminal devices; And
As a result of the determination of the malicious code diagnosis unit, when the terminal device infected with the malicious code is found, the file infected with the malicious code is removed from the terminal device infected with the malicious code, and the operating system of the terminal device infected with the malicious code is restored to the previous operating system. A system recovery unit;
Malware diagnostic and repair device comprising a.
The method of claim 1,
The file information includes file name, file size, creation date, modification date, access date, file total hash value, folder path information, file start pattern, EXE / DLL file control information, external function access information, and network and system according to virtual execution. And at least one of an access record.
The method of claim 1,
And the file comparison unit compares file information of the plurality of terminal devices using a hash value corresponding to the file information.
The method of claim 1,
The file transceiving unit is a malicious code diagnosis and recovery device, characterized in that for performing the communication with the plurality of terminal devices using a separate protocol and operating system.
A file history manager for managing modification histories of a plurality of files;
A file storage unit for storing file information on the modified file; And
A file transmitting / receiving unit which transmits the file information stored in the file storage unit to a malicious code diagnosis and recovery device for diagnosing malicious code; And
A malicious code blocking unit that blocks an operation of a file infected with a malicious code at the request of the malicious code diagnosis and recovery device;
Terminal device comprising a.
The method of claim 5,
The file information includes file name, file size, creation date, modification date, access date, file total hash value, folder path information, file start pattern, EXE / DLL file control information, external function access information, and network and system according to virtual execution. And at least one of access records.
The method of claim 5,
A hash function calculator for performing a hash function calculation on the modified file;
Terminal device characterized in that it further comprises.
The method of claim 5,
Encrypts and saves the file after a preset period of time, stores the encryption key of the encrypted file in the malicious code diagnosis and recovery device, and encrypts the file stored in the malicious code diagnosis and recovery device when a user browses the encrypted file. A security manager that decrypts the encrypted file by using;
Terminal device characterized in that it further comprises.
The method of claim 5,
A file search unit that provides a file search function using a search word and provides a function of deleting or backing up unnecessary files;
Terminal device characterized in that it further comprises.
The method of claim 5,
The file transmitting and receiving unit, when checking the system time of a specific file, the terminal device, characterized in that for transmitting the file information on the malicious code diagnosis and recovery device.

Images