KR20120124638A - Malignant code detecting system and method based on action - Google Patents

Abstract

PURPOSE: An action based malignant code detection system and a malignant code detection method are provided to compose an emulator of an environment which is similar to a user terminal and access to a web site and confirm execution action of a program, thereby detecting an attacking code. CONSTITUTION: A website connection control unit(310) accesses to a web site corresponding to link information by using the link information. When execution action is detected through a code included in the web site, a malignant code detection unit(320) detects a malignant code in the code and a file downloaded through the code.. When the file is automatically downloaded, installed or executed through the code, the malignant code detection unit detects the execution action. An information collection unit(330) collects information about at least one of the website, the code, the file and a server. When at least one of the code and the file is detected as the malignant code, an information provision unit(340) provides the information about at least the recorded one to a manager. [Reference numerals] (310) Website connection control unit; (320) Malignant code detection unit; (330) Information collection unit; (340) Information provision unit

Description

Behavior-based malware detection system and malware detection method {MALIGNANT CODE DETECTING SYSTEM AND METHOD BASED ON ACTION}

Embodiments of the present invention relate to a behavior-based malware detection system and a malware detection method.

Malware is software that is intentionally designed to perform malicious activities, such as destroying the system or exposing information against the user's intentions and interests. The typical malware distribution route is due to various free softwares that are easily available on the Internet. It is often a file-sharing program, which allows malware to be installed during the program installation. These programs are already exposed to the Internet for long periods of time and are often detected by computer antivirus programs.

However, in addition to these infection paths, malicious code may be inserted into websites. 1 is an example for explaining a malicious code infection path through a website in the prior art. 1 shows a user terminal 110, a website 120, a web server 130, and an attacker server 140.

When the user requests to visit the website 120 through the user terminal 110, the web server 130 may provide the website 120 to the user terminal 110. At this time, if the website 120 visited by the user is vulnerable to security and the attacker's malicious code is hidden, the malicious code hidden in the specific page is executed simply by visiting the specific page of the website 120. The user terminal 110 accesses the attacker server 140 through the malicious code link 150, and downloads and installs the malicious program 160 from the attacker server 140. At this time, in the prior art, the installation and execution of such malicious code cannot be detected in advance.

Such exploits are called exploits, often written in JavaScript, and often made code hard to read through code obfuscation. It even has a property that changes dynamically every time the user visits the page.

This type of attack code makes patterning difficult for computer vaccines to detect, especially for dynamically changing code that cannot be detected by the vaccine.

Most of these exploits take advantage of operating system, ActiveX, and web plug-in (Flash, etc.) modules. Easily changeable causes serious problems.

In the present specification, a system and method for more efficiently detecting malicious codes are proposed.

The present invention relates to a malicious code detection system and method for configuring an emulator in an environment similar to a user terminal, accessing a website, and detecting an attack code by checking whether a program is executed.

Instead of detecting malicious codes according to the patterns of malicious codes, malicious codes are detected according to the actions performed according to malicious codes. Thus, code obfuscation makes malware difficult to read and dynamically changes automatically. It also relates to a malicious code detection system and method that can be easily detected.

At least one of a website access control unit that accesses a website corresponding to the link information using the link information and execution of execution through the code included in the website is detected. A malicious code detection system including a malicious code detection unit for detecting as malicious code is provided.

According to one side, the malware detection unit is connected to any server through the code, when the file is automatically downloaded and installed or executed, it can detect the execution behavior.

According to another aspect, the malware detection system may further include an information collection unit for collecting and recording information about at least one of a website, a code, a file, and a server.

According to another aspect, the malware detection system may further include an information providing unit that provides the administrator with information on at least one recorded when at least one of the code and the file is detected as the malicious code.

At least one of a code and a file downloaded through the code is detected as malicious code when a step of accessing a website corresponding to the link information using the link information and execution of execution through the code included in the website is detected. There is provided a malicious code detection method comprising the step of detecting.

An emulator with an environment similar to that of a user terminal can be configured to access a website, and detect an attack code by checking whether a program is executed.

Instead of detecting malicious codes according to the patterns of malicious codes, malicious codes are detected according to the actions performed according to malicious codes. Thus, code obfuscation makes malware difficult to read and dynamically changes automatically. Can be easily detected.

1 is an example for explaining a malicious code infection path through a website in the prior art.
2 is a diagram illustrating the overall configuration of detecting malicious code through a website according to an embodiment of the present invention.
3 is a block diagram illustrating an internal configuration of a malware detection system according to an embodiment of the present invention.
4 is a flowchart illustrating a malicious code detection method according to an embodiment of the present invention.
FIG. 5 illustrates an example of information collected through an emulator by a malware detection system according to an exemplary embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram illustrating the overall configuration of detecting malicious code through a website according to an embodiment of the present invention. 2 illustrates a malware detection system 210, a website 220, a web server 230, and an attacker server 240.

First, the malware detection system 210 may include an emulator in an environment similar to a user terminal. Here, the emulator is a device or program for emulating a hardware or software function by another type of hardware or software, and the malware detection system 210 accesses the website 220 through the web server 230. It can be a device or a program that emulates the function of the user terminal for realization. That is, the malware detection system 210 may include an emulator configured to mimic the function of the user terminal to access the website 220. Here, the malware detection system 210 may access the website 220 by using link information such as a URL.

In this case, the malware detection system 210 may access the website 220 through the web server 230 using the emulator. If a malicious code is included in the website 220, the malicious code link 250 is connected to the attacker server 240, and if the malicious program 260 is downloaded and executed, the malicious code detection system is executed. Reference numeral 210 may obtain information about the accessed website 220, information on the malware link 250, information on the malicious program 260, and the like. At this time, the malicious code detection system 210 can analyze the obtained information to detect the malicious code distribution behavior, as well as notify the administrator of the information about the malicious code distribution behavior, the administrator to the website 220 It can detect that malware is hidden.

3 is a block diagram illustrating an internal configuration of a malware detection system according to an embodiment of the present invention. The malicious code detection system 300 according to the present embodiment may correspond to the malicious code detection system 210 described with reference to FIG. 2, and may include a website access control unit 310 and a malicious code detection unit 320. have. In addition, the malware detection system 300 may further include the information collecting unit 330 and the information providing unit 340 shown in FIG. 3 as needed.

The website access control unit 310 accesses a website corresponding to the link information by using the link information. Here, the link information may include information for identifying and accessing the corresponding website, such as the URL of the website.

The malware detection unit 320 may detect at least one of the code and a file downloaded through the code as the malicious code when the execution behavior through the code included in the website is detected. In other words, as described above, an attack on the web necessarily causes an execution to install malicious code on a user's terminal. Therefore, the malicious code detection unit 320 may not detect the malicious code using the pattern of the malicious code but may detect the execution behavior of the malicious code to detect that the file downloaded through the corresponding code or the code is malicious code. For example, the malware detection unit 320 may detect the execution behavior when the server is connected to any server through a code and the file is automatically downloaded and installed or executed.

The information collecting unit 330 may collect and record information about at least one of the website, the code, the file, and the server. For example, the information collecting unit 330 may collect and record information such as a URL of a website, information about the code itself, a file name or a path where the file is downloaded or installed, and an IP address of the server.

If at least one of the code and the file is detected as a malicious code, the information providing unit 340 provides the administrator with information on at least one recorded. That is, the information providing unit 340 notifies the administrator that the malicious code is detected, and informs the administrator of at least one of websites, codes, files, and servers related to the malware, so that the administrator can respond to the malicious code. can do.

4 is a flowchart illustrating a malicious code detection method according to an embodiment of the present invention. The malware detection method according to the present embodiment may be performed by the malware detection system 300 described with reference to FIG. 3. In FIG. 4, the malicious code detection method will be described by describing a process in which each step is performed by the malicious code detection system 300.

In operation 410, the malware detection system 300 accesses a website corresponding to the link information by using the link information. Here, the link information may include information for identifying and accessing the corresponding website, such as the URL of the website.

In operation 420, when the malicious code detection system 300 detects execution behavior through code included in a website, the malware detection system 300 may detect at least one of the code and a file downloaded through the code as malware. Can be. In other words, as described above, an attack on the web necessarily causes an execution to install malicious code on a user's terminal. Accordingly, the malicious code detection system 300 may detect that the malicious code is executed using a pattern of the malicious code, but not a malicious code, and detect that the file downloaded through the corresponding code or code is malicious code. For example, the malware detection system 300 may detect the execution behavior when the server is connected to an arbitrary server through code and the file is automatically downloaded and installed or executed.

In operation 430, the malware detection system 300 may collect and record information about at least one of the website, the code, the file, and the server. For example, the malware detection system 300 may collect and record information such as a URL of a website, information about the code itself, a file name or a path where the file is downloaded or installed, and an IP address of the server. .

In operation 440, when at least one of the code and the file is detected as the malicious code, the malicious code detection system 300 provides the administrator with information about the recorded at least one. That is, the malicious code detection system 300 notifies the administrator that the malicious code has been detected and simultaneously informs the administrator of information on at least one of a website, code, a file, and a server related to the malicious code, so that the administrator responds to the malicious code. You can do that.

3 to 4 may refer to FIG. 2.

FIG. 5 illustrates an example of information collected through an emulator by a malware detection system according to an exemplary embodiment of the present invention.

Table 500 shows information that can be collected by the malware detection system 210 or 300 described with reference to FIGS. 2 to 5. First, 'Target URL' may refer to a URL of a website to which the malicious code detection system 210 or 300 is connected to analyze the presence of malicious code. In addition, 'Analysis Date Time' may indicate the date and time of the analysis, 'Top Level' may mean the highest level of the level indicating the degree of risk.

'Type Code' may indicate the type of recorded information, and 'Result Code' may indicate whether the recorded information is capable of malware. In addition, the 'Risk Level' may indicate the degree of danger of the recorded information, and the 'Info' may indicate what information the recorded information relates to. 'CDR' in 'Type Code' indicates that a request between different domains has occurred. For example, if a user visits aaa.com site and receives data of bbb.com, a CDR (Cross-Domain-Request) has occurred. 'FILE' may indicate that the action based on the recorded information is the act of downloading the file, and 'EXECUTION' may indicate that the action according to the recorded information is the act of executing the file or related program. In addition, 'Malcode Distribution Possibility' in 'Result Code' indicates that there is a possibility that the recorded information is related to the distribution of malicious code.

At this time, referring to the table 500, when the user visits the website 'www.aaa.kr', 'sky.html' and 'en1. jtm 'is included on the website' www.aaa.kr ', and this malware is automatically downloaded from the attacker's server corresponding to' www.bbb.com.cn '. It can be seen that the execution of executing or installing a program is performed.

That is, the malicious code detection system 210 or 300 may detect malicious code depending on whether a code included in the website is controlled to download, install, or execute a file by accessing a specific website.

As described above, according to the embodiments of the present invention, an emulator in an environment similar to a user terminal may be configured to access a website, and to detect an attack code by checking whether a program is executed, and according to a pattern of malicious code. By detecting malicious codes according to the actions performed according to the malicious code, not malicious code, the code obfuscation can easily detect malicious codes or dynamically changing malicious code. . It can also detect malware such as zero-day exploits that cannot be detected by vaccines.

Methods according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. In addition, the above-described file system can be recorded in a computer-readable recording medium.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the equivalents of the claims, as well as the claims.

210: malware detection system
220: website
230: web server
240: attacker server
250: malware link
260: malware

Claims (9)

A website access control unit which accesses a website corresponding to the link information using link information; And
Malware detection unit that detects at least one of the code and the file downloaded through the code as a malicious code when the execution behavior through the code included in the website is detected
Malware detection system comprising a. The method of claim 1,
The malware detection unit,
When connected to any server through the code, the file is automatically downloaded and installed or executed, characterized in that for detecting the execution behavior, malware detection system. The method of claim 2,
An information collecting unit collecting and recording information about at least one of the website, the code, the file, and the server
Malware detection system further comprising a. The method of claim 3,
When at least one of the code and the file is detected as a malicious code, an information providing unit for providing information on the recorded at least one to the administrator
Malware detection system further comprising a. Accessing a website corresponding to the link information by using the link information; And
Detecting execution as at least one of the code and a file downloaded through the code, when execution is detected through code included in the website;
Malware detection method comprising a. The method of claim 5,
Detecting at least one of the code and a file downloaded through the code as malicious code,
Connecting to any server through the code, and detecting the execution behavior when the file is automatically downloaded and installed or executed. The method according to claim 6,
Collecting and recording information about at least one of the website, the code, the file, and the server
Malware detection method further comprising a. The method of claim 7, wherein
If at least one of the code and the file is detected as malicious code, providing information about the recorded at least one to an administrator
Malware detection method further comprising a. A computer-readable recording medium having recorded thereon a program for performing the method of any one of claims 5 to 8.

Images