KR20120076100A - A malware detection system in open mobile platform - Google Patents

Abstract

PURPOSE: The malware detection system of open type mobile platform environment is provided to supply safe contents against malware in mobile environment by previously inspecting contents to be downloaded at server. CONSTITUTION: A constraint policy part(41) receives and stores constraint policies for malware detection. A malware analyzing part(42) compares/analyzes contents with malware. A state monitoring part(43) monitors the state of a mobile terminal and detects the state change of the mobile terminal. A malware analyzing part registers the signature of the malware. If the registered signature is detected from the contents, the malware analyzing part verifies the detection of the malware corresponding to the signature.

Description

A malware detection system in open mobile platform}

The present invention relates to a malware detection system of an open mobile platform environment in which a mobile terminal receives a content to download from a content server, inspects a malicious code, and transmits the inspected content to the mobile terminal.

In particular, the present invention analyzes the vulnerability of malicious code inflow in mobile terminals such as smartphones using an open mobile platform, and has its own security system for intrusion of mobile malicious code, such as unauthorized malicious viruses and worm attacks. The present invention relates to a malware detection system of an open mobile platform environment that can effectively prevent unauthorized user and application access to prevent malicious code damage.

Due to the development of mobile communication technology around the world, mobile devices can download high-speed and large-capacity data, as well as data-driven Internet browsing, mobile banking, and various multimedia contents. It has evolved into a smartphone that can handle (Multimedia Contents). Smartphones emerged by the change of mobile devices and various demands of users have made mobile convergence possible in our real life because various interfaces and functions are provided in one mobile device.

The rapid development of mobile technology and network advancement has led to the spread of smartphones, which has led to the increase of open mobile platforms due to the competition of smartphones, and the active activation of application market places such as the App Store. ought. In this open mobile environment, a standardized development environment is open to all developers, and the application of anyone can create and distribute applications, thereby activating qualitative and quantitative mobile applications.

However, due to the emergence of an open mobile platform environment, mobile terminals such as smartphones facilitate the production of malware, and the produced mobile malware gradually damages such as billing and information leakage to smartphone users using the open mobile platform. It is increasing. Therefore, it will be important to study the malware detection that can prevent the damage of information and malware in advance for smartphone users in the open mobile platform environment.

Cloud computing, meanwhile, refers to a set of abstracted computing infrastructures that are highly scalable and well-managed to accommodate various applications. This concept is a mixture of utility computing, software as a service (SaaS), and grid computing concepts. In other words, it is similar to utility computing or SaaS in terms of users in that it pays for using hardware or software computing resources. It is like the concept of grid computing in terms of a resource provider that aggregates distributed computing resources so that they can be used as a single computing resource.

 Therefore, it is defined as a technology that integrates and provides resources of computers existing in different physical locations into virtualization technology. In other words, programs or documents that have been stored separately on a personal computer or a corporate server can be stored on a large computer that can be connected to the Internet. It means a user-oriented computer environment that can be performed.

In addition, the detection method for known malicious code is detected by a pattern matching method. First, when malicious code spreads, it collects and analyzes information about them, generates signatures, and detects them by comparing them with suspicious files. It is a very efficient detection method in the uncompressed file state and is currently adopted by most antivirus products. This method, like the detection of misuse behavior in the scope of intrusion detection, can be detected precisely when there is a pattern, but it is impossible to detect an unknown pattern. Therefore, there is a limit that can not detect newly occurring malware or variants.

 For detection of unknown malware, the detection method uses the assembly level and the order of API calls, not the pattern for binary. Static Analyzer For Executable (SAFE) at Wisconsin University offers a way to detect tampering viruses at the assembly level. The method used in SAFE extracts assembly code from binary, abstracts the code that has been circumvented by annotators in the modulated part of the extracted code, and compares and detects patterns seen in malicious code. This method detects bypass techniques using simple combinations such as nop code insertion, data modification, control flow modification, data and control flow modification, and the use of pointer aliases, which makes virus detection difficult, but modulated by execution compression. Cannot be detected. Static Analyzer of Vicious Executables (SAVE) at the University of New Mexico detects viruses by measuring the similarity between known virus API sequences and those extracted from PE executables. Cosine, extended jacard, and Pearson's correlation methods are used in combination to measure similarity. When comparing the similarities, all three methods are calculated and given a threshold, which is detected as a virus when the threshold is exceeded. SAVE uncompresses the PE file and suggests a method for detecting viruses that have been modified using similarities. However, if you do not have all the algorithms for execution compression, you can only detect specific viruses. Also, even though the Pearson correlation method and the cosine method are not exactly identical among the similarity comparison methods, when the pattern is repeated at regular intervals, it is calculated as a high similarity value and can be detected as a virus even if it is not a virus.

On the other hand, the approach for detecting malware is divided into static analysis and dynamic analysis.

Static analysis is the examination of a program's code to determine the nature of its dynamic execution without running the program. This technique has been widely used by compiler developers for various analysis and code optimization, and is used for program understanding and reverse engineering of software systems.

 The results of static analysis can identify important strings used in the program, embedded dynamic link libraries (DLLs), function calls, and control statements. However, the control statement is just a command of how to handle the variable, and the input and output variables in the function call are difficult to check, so it is difficult to know exactly the operation without executing the program.

 Static analysis is not limited to specific execution conditions of a program, and can be thoroughly analyzed in that it can be analyzed for all executions of a program. And before running the risk of malicious code can be reviewed and judged, there is an advantage that there is no overload in execution.

Dynamic analysis, on the other hand, primarily aims to monitor and track the execution of a program to detect malicious behavior. Dynamic analysis has the following advantages over static analysis.

 First, dynamic analysis is not affected by changes in portable executable (PE) files. The use of no-operation (NOP) insertions, data changes, control flow changes, data and control flow changes, the use of pointer aliases and dozens of execution compressions, which are used primarily to bypass vaccines, can make static analysis difficult. It is a factor. In particular, changes made by execution compression have a problem in that static analysis is impossible unless an algorithm for releasing the execution compression is provided.

Second, dynamic analysis can accurately identify resource-specific approaches. Static analysis has a burden of repeatedly tracking access information about resources based on API call information, and when encryption is used for strings, it is difficult to obtain accurate information, such as using a separate decryption program.

Mobile terminals, such as smartphones, have considerably lower performance in terms of processing performance, such as processors and memory, than computer terminals, such as ordinary PCs. Instead, with the expansion of wireless networks, mobile terminals can be connected to the network from anywhere.

Therefore, the cloud computing environment as described above will be able to support malware detection in mobile terminals. In particular, malware detection should support both static and dynamic analysis.

An object of the present invention is to solve the problems described above, the mobile terminal receives the content to download from the content server to detect the malicious code and to detect the malware in the open mobile platform environment for transmitting the detected content to the mobile terminal To provide a system.

In addition, an object of the present invention is to monitor the status of the process and memory of the mobile terminal, to detect the abnormality of the running process to detect the malicious code generated in the running state malware detection system of the open mobile platform environment To provide.

In order to achieve the above object, the present invention is connected to a content server and a network, and is connected to a mobile terminal and a wireless network. A malware detection system of an open mobile platform environment for transmitting to a mobile terminal, comprising: a constraint policy means for receiving and storing a constraint policy for detecting a malware; A malicious code analysis unit for comparing and inspecting the content with malicious code; And a state monitor unit for monitoring a state of the mobile terminal and detecting a change in the state.

In addition, the present invention is a malicious code detection system of an open mobile platform environment, the malware analysis unit registers the signature of the malicious code, and if the registered signature is detected in the content, the malicious code corresponding to the signature is detected It is characterized by judging.

In addition, the present invention is a malicious code detection system of an open mobile platform environment, wherein the restriction policy includes a malicious code and the processing mode of the malicious code, the processing mode is at least one of blocking, allowing, detecting, and installation Includes, the malicious code analysis unit is characterized in that processing according to the processing mode of the restriction policy of the malicious code, the malicious code is detected.

In another aspect, the present invention provides a malicious code detection system of an open mobile platform environment, wherein the status monitor receives a process state that is operated in the mobile terminal and a memory state of the mobile terminal from the mobile terminal to process the mobile terminal. And monitoring the memory.

In addition, in the malware detection system of an open mobile platform environment, the state monitor unit extracts a signature for a process running in the mobile terminal if a change in process state or memory state does not meet a normal criterion. The malware analysis unit is characterized in that the registration as a signature of the malicious code.

As described above, according to the malware detection system of the open mobile platform environment according to the present invention, by checking the security of the content to be downloaded from the server in advance to provide a safe, it is safe from malware even in a mobile environment with an open but limited processing performance An effect capable of providing the content is obtained.

In addition, according to the malware detection system of the open mobile platform environment according to the present invention, by detecting the process of the mobile terminal to detect and register the malicious code, it is possible to prevent the malicious code that can be generated later.

1 is a diagram showing an example of the overall system configuration for implementing the present invention.
2 is a diagram illustrating a process of downloading content according to an embodiment of the present invention.
3 is a diagram showing the configuration and interaction of the malware detection system of the open mobile platform environment according to an embodiment of the present invention.
Figure 4 is a block diagram of the configuration of a malicious code detection system of an open mobile platform environment according to an embodiment of the present invention.
Description of the Related Art [0002]
10: mobile terminal 21: mobile communication network
22: network 30: content server
40: malware detection system / server 41: constraint policy measures
42: malware analysis unit 43: status monitor
50: Database 51: Malware Knowledge DB
52: log DB 60: cloud

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the drawings.

In addition, in describing this invention, the same code | symbol is attached | subjected and the repeated description is abbreviate | omitted.

First, examples of the overall system configuration for implementing the present invention will be described with reference to FIG.

As shown in FIG. 1, the entire system for implementing the present invention includes a mobile terminal 10, a content server 30, and a malicious code detection server 40. In addition, it may be configured to further include a database (50) for storing data. In addition, the cloud 60 may be configured by a plurality of malware detection servers 40.

The mobile terminal 10 is a mobile communication terminal having a computing function, such as a smartphone. The mobile terminal 10 downloads the content from the content server 30 and executes the content.

The content server 30 is a normal server, and is a server for providing content to the mobile terminal 10. Content includes not only text, documents, images, music, video, etc. but also an application (or application). Also included are mails, messages, messages, and the like.

The application is a mobile app that can be installed and run on the mobile terminal 10. The application is installed on the mobile terminal 10 and runs on its own. On the other hand, the image, video, and the like are executed by the player installed in the mobile terminal 10. However, the document or mail may include executable code in its contents.

The mobile terminal 10 may request the necessary content from the content server 30 and download the requested content.

Malware detection server 40 is a kind of server, it detects whether the malicious code is included in the content. The malware detection server 40 receives the content from the content server 30 and detects the malicious code with respect to the received content. And it downloads the safe content without malware to the mobile terminal (10).

On the other hand, the malware detection server (or detection server) 40 is composed of a number to provide a single cloud computing environment (60). Therefore, the mobile terminal 10 may be provided with a malware detection service anywhere. That is, the mobile terminal 10 is provided with a malware detection service from any one server in the cloud computing environment 60. However, hereinafter, any one server will be described as a malware detection server 40 for convenience.

When the mobile terminal 10 requests the content, the process of detecting and downloading the content by the detection server 40 is shown in FIG. 2.

When the user accesses the content server 30 through the mobile terminal 10 and requests a content service, the content server 30 checks malicious code before downloading the corresponding content to the user to download safe content. Send feedback.

The user responds to the content server 30 via the mobile terminal 10 to determine whether to download safe content via the content server 30. When the content server 30 responds that the user downloads the safe content, the content server 30 sends the corresponding content to the detection server 40 to check the malicious code of the content in advance, and the user downloads the safe content.

The database 50 includes a malicious code knowledge DB 51 for storing information on signatures, processing modes, and the like, and a log DB 52 for monitoring data of the status of the mobile terminal. However, the configuration of the database 40 is only a preferred embodiment, and in the development of a specific device, it may be configured in a different structure by a database construction theory in view of the ease and efficiency of access and search.

According to the prior art, malware has been detected in mobile devices with existing limited memory and resources. On the contrary, through the cloud (or detection server), which is an intermediate medium, by applying an engine for detecting malware to the cloud, it is possible to detect malware more efficiently from the resources of limited mobile devices. In addition, since the malicious code is not downloaded directly to the mobile device, the damage caused by the malicious code is greatly reduced.

 Through the malware engine of the cloud mounted on the detection server 40, the user can easily and conveniently detect the malware, and the malware detection engine can be updated in real time from the provider of the engine, and thus known malware and It can quickly cope with unknown malware.

Mobile devices (or mobile terminals) have the advantage of being able to handle tasks quickly and easily. However, when the malware detection technique is applied to such a mobile device, since a complicated operation must be performed with limited resources, there is an inconvenience such as a decrease in the performance of the mobile device and insufficient memory capacity. Therefore, the malware detection technique is not applied to the mobile device, but is applied to the cloud to process complex operations in the cloud, and the mobile device receives only the result.

Next, the configuration of a malware detection system of an open mobile platform environment according to an embodiment of the present invention will be described in more detail with reference to FIGS. 3 and 4.

That is, as shown in Figure 3, the malicious code detection system 40 can be largely composed of a malicious code inspection module and malicious code knowledge DB. The malware inspection module goes through an analysis process of codes and processes through a malware analysis unit 42 to determine whether malicious code exists, and the results of the analysis are transmitted to the constraint policy 41. do. Constraint Policy 41 describes the security policy for malware intrusion and risk. The security policy is executed by comparing with existing malware information stored in the malware knowledge database. Judge.

The status monitor 43 records the status change of the service and the status of the current mobile device and process in the database, and the log information is linked to the malware knowledge database to generate a process, memory, and the like. It is used as the information according to the change of state.

Through this, the malware detection system 40 performs the core function of malware detection according to the various uses of the user in the smartphone environment of the open mobile platform environment. The system 40 is largely divided into a malware analyzer 42, a constraint policy 41, and a status monitor 43, and a database 50 for this purpose. Consists of

That is, as shown in Figure 4, the malicious code detection system 40 of the open mobile platform environment according to the present invention, the constraint policy means 41, the malware analysis unit 42, and the status monitor unit 43 It is configured to include.

The constraint policy means 41 is a means having a constraint policy for detecting malware of a service requested by a user, and has a constraint policy on a method of processing existing malware and a process of not finding a malicious code. When malicious code is found for the service requested by the user, it handles malicious code with the mode of blocking, detecting, allowing and installing.

In other words, the constraint policy means 41 has two kinds of constraint policies. One is to deal with the malicious code that has already been identified. It mainly deals with the malware in a static state. In particular, malicious code is detected by detecting the signature in a process (or application) in preparation for signature of malicious code.

The other is the processing of undetected malicious codes, which are the processing policies when detected by monitoring the status of the process in which the malicious code is executed in a dynamic state. In particular, malicious code is detected by detecting a change in a state in which a process operates in the mobile terminal 10 or a memory state of the mobile terminal 10.

In other words, the constraint policy means 41 receives and stores this constraint policy for malware detection. The restriction policy includes a malicious code and a processing mode of the malicious code, wherein the processing mode includes at least one of blocking, allowing, detecting, and installing.

The malware analysis unit 42 collects data from the service requested by the user and is in charge of comparative analysis of the malware. For the comparative analysis of malicious code, request a restriction policy to determine whether the malicious code is already known, and in the case of malicious code determined by the restriction policy, it is in charge of pre-processing restrictions on service and application execution.

In particular, the malicious code analysis unit 42 compares and inspects the content with malicious code. In particular, the malicious code analysis unit 42 registers the signature of the malicious code, and if the registered signature is detected in the content, determines that the malicious code corresponding to the signature is detected. In addition, when a malicious code is detected, the malicious code analyzing unit 42 processes the malicious code according to a processing mode of the restriction policy of the malicious code.

The state monitor 43 monitors the state of the mobile terminal and detects a change in the state. In particular, the state monitor 43 receives the process state operated in the mobile terminal and the memory state of the mobile terminal from the mobile terminal, and monitors the process and memory of the mobile terminal.

That is, the state monitor 43 is a module for monitoring the state change of the mobile device in use and performs a function of monitoring a process, a memory, and the like. It monitors the abnormality of process and memory due to undetected malicious code and performs the function of requesting restriction policy in order to handle the malicious code when the service use, device process or memory change occurs.

As an example, if the change in the process state or the memory state does not meet the normal criteria, the state monitoring unit 43 extracts a signature for the process running in the mobile terminal and sends the malware to the malware analysis unit 42. Register with signature.

Detect dynamic state, that is, acting as malicious code in execution state. The signature of the process (or malicious code) is extracted so that the code of the detected process can also be detected statically. The signature of the extracted process (or malicious code) can be prevented by registering it as malicious code.

In particular, since the status monitoring unit 43 detects malicious codes for a plurality of mobile terminals 10, if a new malicious code is detected at least one mobile terminal, the status monitoring unit 43 also applies to other mobile terminals, thereby spreading the malicious code. It can prevent.

As mentioned above, although the invention made by this inventor was demonstrated concretely according to the Example, this invention is not limited to an Example and can be variously changed in the range which does not deviate from the summary.

The present invention is useful for developing a malware detection clyde computing server in an open mobile platform environment in which a mobile terminal receives a content to download from a content server, inspects a malicious code, and transmits the inspected content to the mobile terminal.

Claims (5)

An open mobile platform environment connected to a content server and a network, connected to a mobile terminal and a wireless network, the mobile terminal receives content to be downloaded from the content server, checks malicious code, and transmits the checked content to the mobile terminal. In the malware detection system of,
Constraint policy means for receiving and storing a constraint policy for malware detection;
A malicious code analysis unit for comparing and inspecting the content with malicious code; And,
And a status monitor unit for monitoring a status of the mobile terminal and detecting a change in the status.
The method of claim 1,
The malicious code analysis unit registers the signature of the malicious code, and if the registered signature is detected in the content, determines that the malicious code corresponding to the signature is detected.
The method of claim 2,
The restriction policy includes a malicious code and a processing mode of the malicious code, wherein the processing mode includes at least one of blocking, allowing, detecting, and installing,
When the malicious code analysis unit detects a malicious code, the malware analysis system of the open mobile platform environment, characterized in that for processing according to the processing mode of the restriction policy of the malicious code.
The method of claim 3,
The status monitor detects the malware of an open mobile platform environment by receiving a process status of the mobile terminal and a memory state of the mobile terminal from the mobile terminal and monitoring the process and memory of the mobile terminal. system.
The method of claim 4, wherein
If the change in the process state or the memory state does not meet the normal criteria, the state monitor extracts a signature for a process running in the mobile terminal, and registers the signature as a signature of the malicious code with the malware analysis unit. Malware detection system in open mobile platform environment.

Images