KR20120070025A - Web / email for distributing malicious code through the automatic control system and how to manage them - Google Patents

Abstract

PURPOSE: A system for automatically managing malicious codes circulating through Web/e-mails and a method for managing for the system are provided to generate/distribute corresponding signatures based on the analyzed result of the collected malicious codes. CONSTITUTION: An automatic infected PC analyzing system(110) is installed at a malicious code PC and detects infected malicious code information through Web/e-mails and a malicious code infection route. A malicious code waypoint/distributor detecting system(120) detects a malicious code route/distributing part using a malicious code waypoint/distributor signature. An automatic malicious code collecting system includes a managing module(140) and a collecting module(150).

Description

{Web / email for distributing malicious code through the automatic control system and how to manage them}

The present invention is automatically distributed through a web / email management system and its management method is transmitted through the malicious code infection path collected from the automatic PC analysis system infected with, and detected through interaction with the malicious code via / spread detection system Via a web / email including an automatic malicious code collection system including a management module for receiving and storing the pass-through / distribution list and unanalyzed lists, and a collection module for collecting generated files and file information transmitted from the management module. The present invention relates to an automated malicious code management system and a management method thereof.

Recently, as cyber attack response time is shortened due to malware, it is necessary to secure proactive technologies. Various malwares used in most cyber attacks, such as DDoS attacks and personal information takeovers, are rapidly increasing. As can be seen from the frequently intimidating DDoS attacks and infringement incidents, the damages are gradually increasing.

Therefore, there is a problem in that it is necessary to construct a system that can prevent cyber attacks in advance through a technology of early collecting malicious codes that may pose a deadly threat and generating / distributing corresponding signatures from the analyzed results.

Accordingly, the present invention is to solve the problems posed in the prior art, and receives the path of malware infection collected from the automatic PC analysis system infected with, via the distribution / distribution site detection system via the malicious code via / distribution site detected It includes a malicious code automatic collection system having a management module for receiving and storing a list and unanalyzed lists and a collection module for collecting generated files and file information transmitted from the management module, thereby causing a malicious threat. The purpose is to provide an automatic malware management system and its management method, which are distributed through web / email that can prevent cyber attacks by proactively collecting codes and generating / distributing corresponding signatures from the analyzed results.

In order to achieve the above object, the present invention provides an automatic malicious code management system, which is installed on a malicious code PC and automatically detects infected malicious code and a malicious code infection path distributed through a web / email. ; A malware via / distribution detection system that detects via / distribution using a malware via / distribution detection signature; The management module and the management for receiving and storing the malicious code infection path collected from the automatic PC analysis system for infection, and receiving and storing the detected gasoline / distribution list and the unanalyzed list in cooperation with the malicious code via / distribution detection system. Automatic malware collection system having a collection module for collecting the generated file and file information transmitted from the module; And a malicious code automatic analysis system which periodically receives and manages the collected malicious code information by interworking with the automatic malicious code collection system, and performs static or dynamic analysis. Provides automatic malware management system.

In addition, the management module, Seed URL collection unit for analyzing the EML log for automatic collection of malicious code, linking the search engine, and collects the URL black list; A URL queue manager for managing the URL duplication and statistics; A web content crawler that checks HTTP request generation and response download, HTML document extraction and analysis, and script obfuscation; And a first DB manager configured to store and query a suspicious URL analysis result from the web content crawler.

In addition, the management module, the virtual machine control unit for receiving a virtual machine recovery request from the management UI to restore to the guest OS Rever; An F / W management unit that manages F / W policy inquiry and change control from the management UI; And a setting management unit for querying and changing the settings of the Seed URL collecting unit, the URL queue managing unit, and the web content crawling unit through a policy management UI.

In addition, the collection module, the communication management unit for receiving the suspicious URL information from the management module periodically by HTTP; A Secure FS management unit that adds, deletes, copies, and searches Secure FS files; An initialization of the Secure FS management unit, an URL loading execution unit, and a URL loading execution unit sharing information; A second DB manager which stores and retrieves the result analyzed by the URL loading execution unit; A hooking DLL unit hooking a script function and a COM object output from the URL loading execution unit; A result analysis unit which receives the hooked data from the hooking DLL unit and analyzes page redirection and malicious Active X; And an IRP MSG hooker unit for receiving and analyzing the IRP MSG through the IRP hooker and managing the PID.

In order to achieve the above object, the present invention provides a method for automatically managing malicious code, wherein an automatic PC analysis system for infection is installed on a malicious code PC to detect infected malware information and a malicious code infection path distributed through a web / email. Making; Detecting, via the malicious code via / distribution detection system, using the malware via / distribution detection signature; The automatic malicious code collection system having a management module and a collection module receives the malicious code infection path collected from the automatic PC analysis system, and the diesel / distribution list detected through interworking with the malicious code via / distribution detection system; Receiving unanalyzed lists; And receiving the malicious code information collected and managed by interworking with the automatic malicious code automatic collection system, and performing static or dynamic analysis; and through the web / email. Provides automatic management method of spreading malicious codes.

In addition, the automatic malicious code collection system is connected to the route via the malicious code / distribution site detection system and receiving the detected route / distribution list and un-analyzed list, (a) the malicious code via / distribution site detection system is the malicious Requesting a malicious website visit to the automatic code collection system; (b) the malicious code collection system querying the corresponding URL and returning the result to respond to the visit request to the malicious code route / distribution detection system; (c) transmitting, by the management module of the automatic malicious code collection system, a visit processing result to the collection module; And (d) requesting a visit result to the malicious code automatic collection system through the malicious code route / distribution detection system.

In addition, the automatic malicious code analysis system is interoperated with the automatic malicious code collection system periodically receiving the collected malware information, and performing a static or dynamic analysis, (a) the automatic malware analysis system Analyzing suspicious URLs; (b) storing the suspected URL analysis result in a DB; (c) determining whether a generated file exists; (d) storing the generation file and file information when the generation file exists; (e) creating the generated file information into an XML file; And (f) analyzing the collected file created as an XML file.

In the above, the present invention receives the malicious code infection path collected from the automatic PC analysis system, and receives and manages the stored route / distribution list and the unanalyzed list, which are interlocked with the malware route / distribution detection system. By including a malicious code automatic collection system having a management module and a collection module for collecting the generated files and file information transmitted from the management module, by collecting the malicious code that can pose a critical threat early, from the analysis result It is effective to prevent cyber attacks by creating / distributing response signatures.

1 is a block diagram of a system for automatically managing malware distributed through a web / email according to an embodiment of the present invention.
Figure 2 is a detailed configuration diagram of the management module employed in the automatic management system for malicious code spread through the web / email according to an embodiment of the present invention.
Figure 3 is a detailed configuration diagram of the collection module employed in the automatic management system for malicious code spread through the web / email according to an embodiment of the present invention.
4 is a flowchart illustrating a method for automatically managing malicious code spread through web / e-mail according to an embodiment of the present invention.
5 is an interlocking flow diagram for an automatic system for collecting malicious codes and a system for detecting and passing through malicious codes in a method for automatically managing malicious codes distributed through web / email according to an embodiment of the present invention.
6 is an interlocking flow diagram for an automatic malicious code analysis system in a method for automatically managing malicious codes distributed through a web / email according to an embodiment of the present invention.

Matters related to the effect including the technical configuration of the automatic malicious code management system and its management method distributed through the web / email according to the present invention will be described by the following description with reference to the drawings showing preferred embodiments of the present invention Will be clearly understood.

Automatic malware management system distributed through web / email

Referring to Figures 1 to 3, the present invention, the automatic malicious code management system distributed through the web / email 100 is installed on the malware PC, infected malware information and malicious distributed via the web / email Infection PC automatic analysis system 110 that performs code infection path detection, malicious code via / distribution detection system 120 that detects via / distribution using the signature of malware passing / distribution detection signature, the infection PC automatic analysis system ( A management module 140 for receiving and storing the malicious code infection path collected from 110 and receiving and storing the detected route / distribution list and the unanalyzed list in cooperation with the malicious code via / distribution detection system 120; Automatic malware collection system 130 and the malicious code having a collection module 150 for collecting the generated file and file information transmitted from the management module 140 It may include a malicious code automatic analysis system 170 for periodically receiving the malware information collected and managed in cooperation with the automatic collection system 130 to perform a static or dynamic analysis.

The infected PC automatic analysis system 110 may be installed on a malicious code infected PC to detect infected malicious code information and a malicious code infection path, and transmit the collected malicious code to the automated malicious code collection system 130.

The malicious code route / distribution detection system 120 periodically uses a malicious code route / distribution detection signature to automatically collect malware / distribution lists and unanalyzed lists detected as a system for detecting the route / distribution site. 130).

The automatic malicious code collection system 130 receives the malicious code infection path collected from the automatic PC analysis system 110, and the diesel / distribution site detected in cooperation with the malicious code via / dissemination site detection system 120 The list and unresolved lists can be received.

In addition, the automatic malicious code collection system 130 is a management module 140 for managing and storing the via / distribution list and the unanalyzed list and a collection module for collecting the generated files and file information transmitted from the management module 140 150 is provided. In addition, the automatic malicious code collection system 130 transmits the management collected information to the malicious code DB (160).

The management module 140 selects suspicious URLs through collecting and analyzing Seed URLs for automatic collection of malicious codes, provides a setting for crawling web content, a change of inspection result criteria, and a UI for managing a collection system. Use the VMWare API for control.

In more detail, as shown in FIG. 2, the management module 140 includes a Seed URL collector 141, a URL queue manager 142, a web content crawler 143, a first DB manager 144, and a virtual machine. The controller 145, the F / W manager 146, and the setting manager 147 may be configured.

The Seed URL collecting unit 141 may analyze an EML log, link a search engine, and collect a URL black list to automatically collect malicious codes. At this time, the Seed URL collector reads a configuration file such as an EML log storage path, a search period, a search keyword, a black list domain list, etc. by referring to the configuration file at the start time. In addition, the search engine interworking may remove duplicate URLs from the search engine response results for each keyword and store the URL in the URL queue manager 142.

The URL queue manager 142 may manage the URL duplication and statistics. In this case, the URL queue management unit may be implemented in various storage spaces such as a file, a DB, a memory, etc., and will be embodied in the implementation and detailed design.

The URL queue manager 142 determines whether the URL value of the collected URL is linked to the Seed URL collection module through URL reconfirmation and is a URL of a real web page or a file to be downloaded. And files can be saved in DB. In addition, the URL that passes the URL object confirmation through the URL queue manager URL duplication inquiry checks whether the URL is duplicated for a set duplicate prohibition time, and then stored only in the URL queue for the URL that does not have a duplicate and the web content crawler through URL extraction After receiving the URL query request from 143, the URL stored in the URL queue may be deleted and transmitted to the web content crawler 143.

The web content crawling unit 143 may check HTTP request generation and response download, HTML document extraction and analysis, and script obfuscation. At this time, the web content crawling unit 143 generates an HTTP request by using the URL received from the URL queue management module through the generation of the HTTP request, and the user-agent information of the HTTP request uses the setting information, and the generated HTTP Request information can be delivered by HTTP Request transmission and Response reception. The web content crawling unit 143 transmits the HTTP request generated through the HTTP request transmission and response reception to the corresponding URL, analyzes the response code after receiving the HTTP response from the URL, and when the response code is 302 (redirect), After setting Reffer information of HTTP Request and resending HTTP Request and response code is 200, HTTP Response can be delivered to HTML Document extraction & analysis. The web content crawler extracts and analyzes an HTML document from an HTTP response through HTTP document extraction & analysis, and when there is a hidden iframe in the HTML document, it can be stored in a DB as a suspect URL. In this case, the hidden IFrame definition is <iframe src = http: //www.kisa.or.kr width = 0 height = 0>, </ iframe> <iframe src = http: //www.kisa.or.kr width = 1 height = 0> </ iframe>, <iframe src = http: //www.kisa.or.kr width = 0% height = 1%> </ iframe>, <iframe src = “http: // www .kisa.or.kr ”width = 150 height = 100 style =“ display: none; ”> </ iframe>, only when the src value is an external site, it is considered a hidden iframe, and the product of width and height is 0 It can be considered as a hidden iframe.

In addition, when the JavaScript tag exists in the HTML document, the web content crawling unit 143 checks the entire HTML document, the entire JavaScript in the web document, and script obfuscation for each JavaScript block, and when the script is obfuscated, Stored in DB as URL, the result of JavaScript obfuscation and Hidden iframe can be checked at the same level.

In this case, the script obfuscation strength test determines JavaScript suspected malicious obfuscation website by measuring JavaScript overall Entropy, JavaScript Block average Entropy through JavaScript, used character, function and variable name Entropy Based on the results, each Entropy of special and non-special characters is obtained, and the suspected malignant obfuscation website is determined by using the difference of the measured values, and the variable and function name average Entropy is measured and determined. Check if 3 or more. (If the size is 1 or 2, there is a meaningless data overflow when checking, e.g. the size of variables used in branches, loops, etc. is mostly less than 2.) Checks the frequency of occurrence of malicious obfuscation websites by checking the frequency of occurrence of specific functions (Substring, fromCharCode, eval, setTimeout, document.write, document.createElement, replace) that are used for encoding. The occurrence frequency of Mark can be determined by obfuscation when showing high value, and the frequency of use of% character can be determined by obfuscation when it is over a certain value. In addition, by measuring the length of a single string around the character delimiter ((,), {,}, [,], ",", etc.) through the maximum length of a single string, it is determined that the string is obfuscated when the length of the string is 200 or more. Of the single strings, the strings included in the HTTP link are not included in the single string.

The first DB manager 144 stores and retrieves a suspicious URL analysis result from the web content crawler 143.

The virtual machine controller 145 may receive a virtual machine recovery request from the management UI and recover the guest OS reverberation. The virtual machine controller 145 receives the virtual machine recovery request from the management UI to recover the remote malware collection system and uses the VMWare API to control the remote virtual machine, and received when the virtual machine recovery request is received. Remote control can be performed using the IP address.

The F / W manager 146 may manage F / W policy inquiry and change control from the management UI. The F / W management unit 146 receives the collection system information modification request registered from the management UI, reflects the IP address of the collection system included in the modification request in the F / W policy, and changes the F / W setting file and then changes the F / W setting file. F / W policy can be modified by restarting F / W through W control. In addition, the F / W management unit 146 may control the F / W by implementing a restart function according to the installed F / W.

The configuration manager 147 may query and change the settings of the Seed URL collector 141, the URL queue manager 142, and the web content crawler 143 through a policy management UI.

The collection module 150 periodically queries the suspected URL (analysis target) information with the management module 140, collects malicious code after directly visiting the suspected URL received by using a web browser, and collects the malicious code. Can be uploaded to the management system via HTTP, and the collection system can be configured as VMWare ESX and the guest OS responsible for visiting suspicious URLs.

In more detail, as shown in FIG. 3, the collection module 150 includes a communication manager 151, a Secure FS manager 152, a URL loading execution unit 153, a second DB manager 154, and a hooking DLL unit. 155, the result analysis unit 156 and the IRP MSG hooker unit 157 may be configured.

The communication manager 151 periodically receives suspicious URL information from the management module 140 in HTTP.

The Secure FS manager 152 may add, delete, copy, and inquire a Secure FS file. The Secure FS management unit 152 receives the Secure FS initialization request from the URL loading execution unit 153, and transmits the generated file to the management module through the communication management unit if the generated file exists, and from the URL loading execution unit 153. Receives SecureFS initialization request, checks whether a file created in SecureFS exists, and if it exists, copy it to existing NTFS and upload it.

The URL loading execution unit 153 may initialize the Secure FS management unit 152, execute URL loading, and share information. The URL loading execution unit 153 is registered as a startup program and is automatically executed when the system is booted. The URL loading execution unit 153 is responsible for executing a web browser and SecureFS management through initialization, and inserts a hooking DLL into a running web browser. The loading execution unit 153 transfers the process ID information of the web browser and SecureFS executed in the initialization through the information sharing to the IRP MSG hooker unit 157 and the PID information sharing uses a predefined shared memory address. In addition, the URL loading execution unit 153 receives a suspicious URL from the management module 140 through URL information loading & execution and executes it on a running browser IE to wait for a timer and an event to receive an analysis completion message. After the analysis is completed, the analysis URL information can be saved. When the URL loading execution unit 153 waits to receive the analysis completion message for a time set through the timer and fails to receive the timer setting time analysis completion message, the URL loading execution unit 153 stores the analysis result as a corresponding URL analysis failure, and receives the result through event reception. A URL analysis complete message may be received from the analysis module.

The second DB manager 154 may store and search a result analyzed by the URL loading execution unit 153, and the hooking DLL unit 155 may output a script function output from the URL loading execution unit 153. And COM objects can be hooked.

The result analyzer 156 may receive the hooked data from the hooking DLL unit 155 to analyze page redirection and malicious Active X. The result analysis unit 156 receives the hooking result from the hooking DLL unit through the hooking result analysis, and the CoCreateinstance API hooking result delivers the CLSID value to the vulnerable ActiveX analysis and hooks Eval, Document.write, Document.writeln, and appendChild. The results can be passed to page redirection analysis. And the result analysis unit 156 compares the CLSID received from the hooking DLL unit 155 and the CLSID of the killbit list by analyzing the vulnerable ActiveX, and if it has the same CLSID is determined to be a malicious URL, after analysis event generation Can transmit The result analysis unit 156 analyzes whether the iframe is included in the dynamic generation script received from the hooking DLL unit 155 through page redirection analysis, and determines that the iframe is included as a malicious URL. Can transmit

The IRP MSG hooker 157 may receive and analyze the IRP MSG through the IRP hooker and manage the PID. At this time, the IRP MSG hooker 157 may receive an IRP message from the Filter Manager. The IRP MSG hooker unit 157 compares the PID value of the IRP message with the browser managed by the PID manager and the SecureFS management PID list by analyzing the received IRP message, and redirects the file generation IRP message from the browser to SecureFS. For example, reading file from browser IRP message, NTFS IRP message can only read file of existing NTFS.

The automatic malicious code analysis system 170 may receive the collected malicious code information periodically and perform static / dynamic analysis. In addition, the automatic malicious code analysis system 170 transmits the analyzed information to the malicious code DB (160).

Automated management of malware spread through web / email

4 to 6, the method for automatically managing malicious code distributed through web / email according to an embodiment of the present invention is distributed through web / email configured as shown in FIGS. 1 to 3. The redundant description will be omitted below as a management method through the automatic malicious code management system 100.

First, the infected PC automatic analysis system 110 is installed on the malware PC to detect infected malware information and malware infection paths distributed through the web / email (S100).

Next, the malicious code via / distribution detection system 120 detects the via / distribution using the malicious code via / distribution detection signature (S110).

Next, the automatic malicious code collection system 130 having the management module 140 and the collection module 150 receives the malicious code infection path collected from the automatic PC analysis system 110 and passes the malware code / In response to the distribution site detection system 120 interworked with each other, the detected gasoline / distribution list and unanalyzed list are transmitted. (S120) At this time, the automatic malicious code collection system 130 is connected to the gasoline / distribution site detection system 120 with the malicious code. Receiving the transmission and distribution list and the un-analyzed list detected in cooperation with each other is as shown in Figure 5, (a) the malicious code via / dissemination detection system 120 is the automatic malware collection system 130 Requesting a visit to a malicious website, (b) the malicious code collection system 130 queries the URL and returns the result to request the visit via the malicious code / distribution detection system 120. In response, (c) the management module 140 of the automatic malicious code collection system 130 transmits the visit processing result to the collection module 150, and (d) the route through the malicious code / distribution detection system ( 120 may be a step of requesting a visit result to the automatic malicious code collection system.

Next, the automatic malicious code analysis system 170 interoperates with the automatic malicious code collection system 130 and periodically receives the collected and collected malicious code information, and performs static or dynamic analysis (S130). The automatic malicious code analysis system 170 interoperates with the automatic malicious code collection system 130 and periodically receives the collected collected malicious code information, and performs static or dynamic analysis by (a) automatically detecting the malicious code. The analysis system 170 analyzes the suspicious URL, (b) storing the suspicious URL analysis result in a DB, (c) determining whether a generated file exists, (d) a generated file when the generated file exists, and Storing the file information, (e) creating the generated file information in an XML file, and (f) analyzing the collected file created in the XML file.

As such, the present invention receives the malicious code infection path collected from the automatic PC analysis system 110, and passes through the distribution / distribution list and un-analyzed list detected by interworking with the malicious code via / distribution detection system 120. By including an automatic malicious code collection system 130 having a management module 140 for receiving and storing the management module 140 and a collection module 150 for collecting the generated file and file information transmitted from the management module 140, Malicious code that can pose threats can be collected early, and response signatures can be generated / distributed from the analyzed results to prevent cyber attacks in advance.

Although the preferred embodiments of the present invention described above have been described in detail, those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom.

Accordingly, the scope of the present invention should not be limited to the disclosed embodiments but should be regarded as belonging to various modifications and improvements of those skilled in the art using the basic concept of the present invention as defined in the following claims, or the scope of the present invention. .

100: Automatically manage malware distributed through web / email
110: Automatic PC Analysis System
120: malicious code via / dissemination detection system
130: Automatic malware collection system
140: management module 150: collection module
160: malware DB
170: Automatic malware analysis system

Claims (7)

In the automatic malware management system,
Automatically infected PC analysis system installed on the malware PC to detect infected malware information and malicious code infection route distributed through web / email;
A malware via / distribution detection system that detects via / distribution using a malware via / distribution detection signature;
The management module and the management for receiving and storing the malicious code infection path collected from the automatic PC analysis system for infection, and receiving and storing the detected gasoline / distribution list and the unanalyzed list in cooperation with the malicious code via / distribution detection system. Automatic malware collection system having a collection module for collecting the generated file and file information transmitted from the module; And
An automatic malicious code analysis system which receives the malicious code information collected and managed in association with the automatic malicious code collection system and performs static or dynamic analysis;
Automatic malware management system that is distributed via a web / email, characterized in that it comprises a.
The method of claim 1,
The management module,
Seed URL collection unit for analyzing the EML log, integrating the search engine, and collecting the URL black list for automatic collection of malicious code;
A URL queue manager for managing the URL duplication and statistics;
A web content crawler that checks HTTP request generation and response download, HTML document extraction and analysis, and script obfuscation; And
A first DB manager that stores and retrieves a suspicious URL analysis result from the web content crawler;
Automatic malware management system that is distributed via a web / email, characterized in that it comprises a.
The method of claim 2,
The management module,
A virtual machine controller configured to receive a virtual machine recovery request from the management UI and restore the virtual machine to a guest OS Rever;
An F / W management unit that manages F / W policy inquiry and change control from the management UI; And
A setting management unit for viewing and changing the settings of the Seed URL collecting unit, the URL queue managing unit, and the web content crawling unit through a policy management UI;
Automatic malware management system that is distributed via a web / email, characterized in that it comprises a.
The method of claim 1,
The collection module,
A communication manager which periodically receives suspicious URL information from the management module through HTTP;
A Secure FS management unit that adds, deletes, copies, and searches Secure FS files;
An initialization of the Secure FS management unit, an URL loading execution unit, and a URL loading execution unit sharing information;
A second DB manager which stores and retrieves the result analyzed by the URL loading execution unit;
A hooking DLL unit hooking a script function and a COM object output from the URL loading execution unit;
A result analysis unit which receives the hooked data from the hooking DLL unit and analyzes page redirection and malicious Active X; And
IRP MSG hooker receiving and analyzing the IRP MSG through the IRP hooker, PID management;
Automatic malware management system that is distributed via a web / email, characterized in that it comprises a.
In the malicious code automatic management method,
Installing an infected PC automatic analysis system on the malware PC to detect infected malware information and malware infection paths distributed through web / email;
Detecting, via the malicious code via / distribution detection system, using the malware via / distribution detection signature;
The automatic malicious code collection system having a management module and a collection module receives the malicious code infection path collected from the automatic PC analysis system, and the diesel / distribution list detected through interworking with the malicious code via / distribution detection system; Receiving unanalyzed lists; And
A step in which an automatic malicious code analysis system interoperates with the automatic malicious code collection system and periodically receives and manages collected malicious code information, and performs static or dynamic analysis;
Automatically manage malware distributed via a web / email, characterized in that it comprises a.
6. The method of claim 5,
The automatic malicious code collection system is linked with the malicious code via / dissemination detection system and receiving the detected via / dissemination list and unanalyzed list,
(a) requesting a malicious website visit to the automatic malicious code collection system by the malicious code route / distribution detection system;
(b) the malicious code collection system querying the corresponding URL and returning the result to respond to the visit request to the malicious code route / distribution detection system;
(c) transmitting, by the management module of the automatic malicious code collection system, a visit processing result to the collection module; And
(d) requesting a result of the visit to the malicious code automatic collection system by the malicious code route / distribution detection system;
Automatic malware management method that is distributed through the web / email, characterized in that consisting of.
6. The method of claim 5,
The automatic malicious code analysis system interoperates with the automatic malicious code collection system and periodically receives the collected collected malicious code information to perform static or dynamic analysis.
(a) the malicious code automatic analysis system analyzing suspicious URLs;
(b) storing the suspected URL analysis result in a DB;
(c) determining whether a generated file exists;
(d) storing the generation file and file information when the generation file exists;
(e) creating the generated file information into an XML file; And
(f) analyzing the collected file created as an XML file;
Automatic malware management method that is distributed through the web / email, characterized in that consisting of.

Images