KR20130077184A - Homepage infected with a malware detecting device and method - Google Patents

Abstract

PURPOSE: Apparatus and a method for detecting a homepage compromised by a malicious code are provided to determine the compromised status of a homepage by downloading a web source of the homepage without accessing the homepage for detection. CONSTITUTION: A database (620) stores vulnerability class ID tag values, normal file header values, abnormal iframe tags, image tag size patterns, and malicious shell codes. A class ID tag search part (632) searches a web source for a class ID tag, and a file header value search part (638) searches the web source for a file header value. An iframe and image tag search part (634) searches the web source for an iframe tag or an image tag. A malicious shell code search part (636) searches the web source for a malicious shell code and determines whether a homepage is compromised by a malicious code. [Reference numerals] (612) Web source download part; (614) File download part; (620) Database; (632) Class ID tag search part; (634) Iframe and image tag search part; (636) Malicious shell code search part; (638) File header value search part; (642) First comparison part; (644) Second comparison part; (646) Third comparison part; (650) Quantification part; (AA) Homepage; (BB,EE) Web source; (CC) Class id tag; (DD,GG,LL,NN) Malicious code-compromised Y/N; (FF) My frame tag, image tag; (HH) File; (II) Chance of being compromised by a malicious code; (JJ) Malicious shell code; (KK) File header value; (MM) Vulnerable point class id tag value; (OO) Abnormal iframe and image tag size pattern; (PP) Normal file header value

Description

Homepage infected with a malware detecting device and method}

The present invention relates to an apparatus and method for detecting homepage infected with malware.

Malware is a generic term for all software that can harm your computer. In the past, malicious code has been spread through storage media such as disk cloning, but recently, as the network develops, the number of malicious codes has been increased through e-mail or websites.

In particular, hackers hack a website's homepage and install malicious code so that when a user accesses the homepage, the user's computer is infected with the malware. If a computer is infected with malware, not only the performance of the computer will be degraded, but also personal information may be leaked. Therefore, a method for determining whether the homepage is infected with malware is necessary.

The problem to be solved by the present invention is to provide an apparatus and method for determining whether the homepage is infected with malware.

The method for detecting a home page infected with malicious code according to the first embodiment of the present invention includes downloading a web source from a home page, class ID tag values and prestored vulnerability class ID tag values included in the web source. And comparing the class ID tag value included in the web source with the vulnerability class ID tag value, and determining that the homepage is infected with a malicious code.

The method for detecting a home page infected with a malicious code according to a second embodiment of the present invention includes downloading a web source from a home page. Downloading a file inserted into the web source, comparing a header value of the file with a header value of a normal file previously stored, and if the header value of the file does not match the header value of the normal file, the homepage And determining that it is infected with malware.

The method for detecting a home page infected with a malicious code according to a third embodiment of the present invention includes downloading a web source from a home page, an iframe tag or an image tag included in the web source, stored in advance. Checking whether the tag is used as a tag size pattern, and determining that the homepage is infected with a malicious code when the iframe tag or the image tag is used as a pre-stored abnormal tag size pattern.

According to a fourth embodiment of the present invention, there is provided a method for detecting a home page infected with malicious code, the method including downloading a web source from a home page, checking whether the web source includes pre-stored malicious shell codes, and the web source is If it contains a malicious shell code includes the step of determining that the home page is infected with malware.

A method for detecting a home page infected with a malicious code according to a fifth embodiment of the present invention includes the steps of downloading a web source from a home page, downloading the file when a file is inserted into the web source, and the web source is a class ID. comparing a class ID tag value included in the web source with a prestored vulnerability class ID tag value when comparing a classid tag, comparing a header value of the file with a header value of a normal file stored in advance; If the web source includes an iframe tag or an img tag, checking whether the iframe tag or image tag is used as a pre-stored abnormal tag size pattern, and the pre-stored malicious shellcode Verifying that it contains the data, and the class ID tag value included in the web source. And the vulnerability class ID tag value match, the header value of the file and the header value of the normal file do not match, the iframe tag or image tag is used as a pre-stored abnormal tag size pattern, or And determining that the home page is infected with malicious code when the web source includes the malicious shell code.

The homepage detection apparatus infected with malicious code according to an embodiment of the present invention includes a download unit for downloading a web source from a home page or downloading a file inserted into the web source, a vulnerability class ID tag value, a normal file header value, A database in which at least one of an abnormal iframe tag and an img tag size pattern, and malicious shell code are stored, a class ID tag search unit for searching for a class ID tag from the web source, and a file header value from the web source A file header value search unit for searching for an iframe and an image tag search unit for searching an iframe tag or an image tag from the web source, and a search for the malicious shellcode from the web source. Malicious shellcode search unit to determine whether the malware is infected The search unit and the value of the class ID tag and the vulnerability class ID tag value, the file header value and the normal file header value, the iframe tag and image tag is the abnormal iframe tag and image tag size And a comparison discrimination unit for determining whether the home page is infected with malicious code according to the comparison and the verification result.

According to the homepage detection device and method infected with the malware of the present invention,

It detects a specific pattern (or rule) by downloading the web source of the homepage without accessing the homepage to be detected and determines that the homepage is infected with malware when the detected specific pattern matches the pattern when the malicious code is installed. can do.

1 is a flowchart illustrating a method of detecting a home page infected with a malicious code according to a first embodiment of the present invention.
2 is a flowchart illustrating a method of detecting a home page infected with a malicious code according to a second embodiment of the present invention.
3 is a flowchart illustrating a method of detecting a home page infected with a malicious code according to a third embodiment of the present invention.
4 is a flowchart illustrating a method of detecting a home page infected with a malicious code according to a fourth embodiment of the present invention.
5 is a flowchart illustrating a method of detecting a home page infected with a malicious code according to a fifth embodiment of the present invention.
6 is a block diagram illustrating an apparatus for detecting a homepage infected with a malicious code according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between .

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. Also, the terms " part, "" module," and " module ", etc. in the specification mean a unit for processing at least one function or operation and may be implemented by hardware or software or a combination of hardware and software have.

1 is a flowchart illustrating a method of detecting a home page infected with a malicious code according to a first embodiment of the present invention.

Referring to FIG. 1, in the method for detecting a home page infected with a malicious code according to a first embodiment of the present invention, a web source is first downloaded from a home page (step 110).

Then, it is searched whether a class ID tag (<classid =) exists in the downloaded web source (step 120).

If the class ID tag does not exist as a result of the search, it is determined that the homepage is not infected with the malicious code (step 130), and the process ends. If the class ID tag exists, it is compared whether the retrieved class ID tag value matches a prestored vulnerability class ID tag value (step 140). Since hackers install malicious code by inserting class IDs with vulnerabilities in web pages, if the vulnerability class ID tag exists in the web source, the home page is likely infected with malware. Therefore, it is possible to determine whether the homepage is infected with malicious code based on whether the vulnerability class ID tag exists in the web source. The vulnerability class ID tag value may be stored in advance in a database. The list of vulnerability class IDs is shown in Table 1 below.

Vulnerability Class ID List Classid weakness C1B7E532-3ECB-4E9E-BB3A-2951FFE67C61 HTTP C6 Messenger ActiveX File Overwrite BD96C556-65A3-11D0-983A-00C04FC29E36 MS06-014 AB9BCEDD-EC7E-47E1-9322-D4A210617116 MS06-014 0006F033-0000-0000-C000-000000000046 MS06-014 6e32070a-766d-4ee6-879c-dc1fa91d2fc3 MS06-014 6414512B-B978-451D-A0D8-FCFDF33E833C WUWebControl Class 7F5B7F63-F06F-4331-8A26-339E03C0AE3D MS06-014, MS06-073, MS07-016 06723E09-F4C2-43c8-8358-09FCD1DB0766 MS06-014 639F725F-1B2D-4831-A9FD-874847682010 MS06-014 BA018599-1DB3-44f9-83B4-461454C84BF8 MS06-014 D0C07D56-7C69-43F1-B4A0-25F5A11FAB19 Metasploit E8CCCDDF-CA28-496b-B050-6C07C962476B Metasploit

When the class ID tag value retrieved from the web source is compared with the vulnerability class ID tag value, if the detected class ID tag value and the vulnerability class ID tag value do not match, the homepage is determined to be not infected with malware (step 130). Terminate the process. On the other hand, if the searched class ID tag value and the vulnerability class ID tag value match, it is determined that the homepage is infected with malicious code (step 150).

2 is a flowchart illustrating a method of detecting a home page infected with a malicious code according to a second embodiment of the present invention.

Referring to FIG. 2, in the method for detecting a home page infected with a malicious code according to a second embodiment of the present invention, a web source is first downloaded from a home page (step 210).

Next, the file inserted in the web source is downloaded (step 220). The file includes a media file and a portable executable file. Media files include files with extensions jpg, gif, swf, and so on, and PE files include files with extension exe.

Next, the header value of the file is compared with the header value of the normal file (step 230). Hackers insert files with file extensions such as jpg, gif, swf, and exe into the web page as described above, and these files often include malware links. Therefore, if the header value of the file inserted into the web source and the header value of the normal file do not match, it can be determined that the home page is infected with malware. The header value of the normal file may be stored in advance in a database or the like. Header values of a normal file having an extension of jpg, gif, swf, exe, etc. are disclosed in Table 2 below.

Normal file header value File type File header jpg FF D8 FF gif 47 49 46 38 swf 43 57 53 exe 4D 5A

If the header value of the file inserted into the web source and the header value of the normal file match, it is determined that the homepage is not infected with the malicious code (step 240), and the process ends. On the other hand, if the header value of the file inserted into the web source and the header value of the normal file do not match, it is determined that the home page is infected with malicious code (step 250).

3 is a flowchart illustrating a method of detecting a home page infected with a malicious code according to a third embodiment of the present invention.

Referring to FIG. 3, in the method of detecting a homepage infected with a malicious code according to a third embodiment of the present invention, first, a web source is downloaded from a homepage (step 310).

Then, it is searched whether an iframe tag or an img tag exists in the downloaded web source (step 320).

If there is no iframe tag or image tag as a result of the search, it is determined that the homepage is not infected with the malicious code (step 330), and the process ends. If the iframe tag or image tag exists, it is checked whether the searched iframe tag or image tag is used as an abnormal tag size pattern (step 340). Hackers insert malware links using the width or height values of image tag sizes in Web pages. For example, if a link file of a normal image tag exists in the homepage, but a malware link is inserted in the image tag, an external address is used, and a pattern using a value of 1 or null size that cannot be identified by a related line Often used as. Therefore, it is possible to determine whether the corresponding homepage is infected with malware based on whether an iframe tag or an image tag is used as an abnormal tag size pattern. The abnormal tag size pattern may be stored in advance in a database or the like. An abnormal iframe image tag size rule list is shown in Table 3 below.

Unusual iframe, image tag size rule list Detection pattern Remarks img and iframe + external address (format: ASCII, hex, utf encoding) + width but height = 0 iframe + external address (ascii) + width but height = 0 (width and height = 0)
iframe + external address (hex encoding) + width but height = 0 (width and height = 0)
iframe + external address (utf encoding) + width but height = 0 (width and height = 0)
img + external address (format: ASCII, hex, utf encoding) + width and height = 1 img + external address (ascii) + width and height = 1
img + external address (hex encoding) + width and height = 1
img + external address (utf encoding) + width and height
img + external address (format: ASCII, hex, utf encoding) + width but height = 1,500 (x≥500) img + external address (ascii) + width but height = 1, 500
img + external address (hex encoded) + width but height = 1, 500
img + external address (utf encoding) + width but height = 1, 500 OBJECT width = 0 external address (format: ASCII, hex, utf encoding) OBJECT width = 0 external address (ascii)
OBJECT width = 0 external address (hex encoding)
OBJECT width = 0 external address (utf encoding)
EMBED width = 0 external address (format: ASCII, hex, utf encoding) EMBED width = 0 External Address (ASCII)
EMBED width = 0 external address (hex encoding)
EMBED width = 0 external address (utf encoded)

If the iframe tag or image tag retrieved from the web source is not used as an abnormal tag size pattern, it is determined that the homepage is not infected with malicious code (step 330), and the process ends. On the other hand, if the retrieved iframe tag or image tag is used as an abnormal tag size pattern, it is determined that the homepage is infected with malicious code (step 350).

4 is a flowchart illustrating a method of detecting a home page infected with a malicious code according to a fourth embodiment of the present invention.

Referring to FIG. 4, in the method for detecting a home page infected with a malicious code according to a fourth embodiment of the present invention, a web source is first downloaded from a home page (step 410).

Next, the web source is searched for containing malicious shellcode (step 420). Hackers use shellcode to inject malicious code into web pages. Therefore, if a malicious shell code is included in the web source, it can be determined that the homepage is infected with the malicious code. The malicious shellcode list may be stored in advance in a database or the like. The list of malicious shell codes is shown in Table 4 below.

Malicious Shell Code List Kinds unescape ("% u0D0D% u0D0D unescape ("% u9090% u9090 eval (function (p, a, c, k, e, d) document.write (unescape ( Eval (gzinflate (base64_decode (

As a result of the search, if the web source does not contain the malicious shellcode, it is determined that the homepage is not infected with the malicious code (step 430), and the process ends. On the other hand, if the web source contains a malicious shell code, it is determined that the home page is infected with the malicious code (step 440).

5 is a flowchart illustrating a method of detecting a home page infected with a malicious code according to a fifth embodiment of the present invention.

The method of detecting a home page infected with a malicious code according to a fifth embodiment of the present invention is performed by combining the method of detecting a home page infected with a malicious code according to the first to fourth embodiments described above with reference to FIGS. 1 to 4. .

Referring to FIG. 5, in the method for detecting a home page infected with a malicious code according to a fifth embodiment of the present invention, a web source is first downloaded from a home page (step 510).

If the file is inserted into the web source, the inserted file is then downloaded (step 520).

Next, it is searched whether a class ID tag exists in the downloaded web source (step 530).

As a result of the search, if the class ID tag exists, the searched class ID tag value is compared with a previously stored vulnerability class ID tag value (step 532).

As a result of the comparison, if the class ID tag value retrieved from the web source and the vulnerability class ID tag value match, it is determined that the homepage is infected with the malicious code (step 570), and the process ends. On the other hand, if the searched class ID tag value and the vulnerability class ID tag value do not match, the second malware infection determination condition, that is, the file header value and the header value of the normal file are compared (step 540). If the class ID tag does not exist in the web source downloaded in step 530, step 540 is performed.

As a result of the comparison, when the header value of the file inserted into the web source and the header value of the normal file do not match, it is determined that the home page is infected with the malicious code (step 570), and the process ends. On the other hand, if the header value of the file inserted into the web source and the header value of the normal file match, it is determined whether the web source satisfies the third malicious code infection determination condition, that is, the iframe tag or image tag condition.

Search whether the iframe tag or image tag exists in the web source (step 550), and if the iframe tag or image tag exists in the search result, check whether the retrieved iframe tag or image tag is used as an abnormal tag size pattern ( Step 552).

If the iframe tag or image tag retrieved from the web source is used as an abnormal tag size pattern, it is determined that the homepage is infected with malicious code (step 570), and the process ends. On the other hand, if the retrieved iframe tag or image tag is not used as an abnormal tag size pattern, it is searched for the fourth malicious code infection determination condition, that is, whether the web source contains malicious shellcode (step 560). If the iframe tag or the image tag does not exist in the web source downloaded in step 550, step 560 is performed.

As a result of the search, if the web source contains malicious shellcode, it is determined that the homepage is infected with the malicious code (step 570), and the process ends. On the other hand, when the web source does not contain malicious shell code, it is determined that the home page is not infected with the malicious code (step 580).

As described above, according to the method of detecting a home page infected with a malicious code according to a fifth embodiment of the present invention, the homepage is not provided with the malicious code only when all four malicious code infection determination conditions described in FIGS. 1 to 4 are not satisfied. By determining that it is not infected, more accurate identification is possible when the homepage is not infected with malicious code. The order of checking each malicious code infection determination condition, that is, the order of performing steps 530 to 560 may be appropriately changed and is not limited to the order described in FIG. 5.

In FIG. 5, only the homepage is determined whether the homepage is infected with malicious code, but it is also possible to calculate the probability that the homepage is infected with the malicious code. To this end, each malicious code infection determination condition may be examined, and the probability that the homepage is infected with the malicious code may be output based on the number of times that each malicious code infection determination condition is satisfied. For example, if 1, 2, 3, or 4 each of the four malware infection determination criteria is met, the probability that the homepage is infected with malware is 25%, 50%, 75%, 100%. Can be printed as In addition, a weight may be applied to each malicious code infection determination condition to output a probability that the homepage is infected with the malicious code. At this time, according to the applied weight, the probability that the homepage is infected with the malicious code is properly calculated and output.

6 is a block diagram illustrating an apparatus for detecting a homepage infected with a malicious code according to an embodiment of the present invention.

Referring to FIG. 6, the homepage detecting apparatus 600 infected with a malicious code includes a download unit 610, a database 620, a search unit 630, and a comparison discriminator 640, and a digitizer 650. It may further include.

The download unit 610 includes a web source download unit 612 and a file download unit 614. The web source download unit 612 downloads and outputs a web source from a homepage. The file download unit 614 downloads and outputs a file from a web source output from the web source download unit 612. The file may have an extension of jpg, gif, or swf.

Database 620 stores vulnerability class ID tag values, normal file header values, iframe and image tag size patterns, or malicious shellcode. Since the vulnerability class ID tag value, the normal file header value, the iframe tag and the image tag size pattern, or the malicious shellcode have already been described with reference to FIGS. 1 to 4, additional descriptions will be omitted.

The search unit 630 includes a class ID tag search unit 632, an iframe and image tag search unit 634, a malicious shell code search unit 636, and a file header value search unit 638. The class ID tag search unit 632 searches for and outputs a class ID tag from a web source. The file header value search unit 638 retrieves and outputs a file header value. The iframe and image tag search unit 634 searches for and outputs the iframe tag and image tag from a web source. The malicious shellcode search unit 636 receives a list of malicious shellcodes from the database 620 and searches whether a malicious shellcode exists in the web source, and determines whether the homepage is infected with the malicious code according to the search result. In other words, if a malicious shell code is included in the web source, the corresponding homepage is determined to be infected with malicious code.

The comparison discrimination unit 640 includes first to third comparison discrimination units 642, 644, and 646. The first comparison unit 642 compares the value of the class ID tag output by the class ID tag search unit 632 with the vulnerability class ID tag value stored in the database 620, and the corresponding homepage is malware based on the comparison result. Determine if you have been infected. In detail, when the class ID tag value matches the vulnerability class ID tag value, it is determined that the corresponding homepage is infected with malicious code. The second comparison determiner 644 confirms whether the iframe tag and the image tag output by the iframe and image tag search unit 634 are used as an abnormal iframe and image tag size pattern stored in the database 620. Based on the result of the check, it is determined whether the homepage is infected with malicious code. In detail, when the iframe tag and the image tag are used as an abnormal iframe and image tag size pattern, it is determined that the corresponding homepage is infected with malicious code. The third comparison determiner 646 compares the header value of the file output by the file header value search unit 638 with the normal file header value stored in the database 620, and the homepage is infected with the malicious code according to the comparison result. Determine if Specifically, when the file header value does not match the normal file header value, it is determined that the home page is infected with malicious code.

The homepage detection apparatus 600 infected with the malicious code of the present invention may further include a digitizer 650.

The digitizing unit 650 digitizes the malicious code infection determination result value input from the malicious shell code search unit 632 and the determination result value input from the first to third comparison determination units 642, 644, and 646, The weight is applied to each determination result to output the probability that the corresponding homepage is infected with malicious code. For example, if the weight is not applied, the result of determining that it is infected with malware is 0, 1, 2, 3, or 4, and the probability that the homepage is infected with malware is 0% and 25%. You can output 50%, 75% or 100%. When weights are applied to each determination result value, the probability that the corresponding homepage is infected with malicious code can be properly calculated and output according to the applied weight.

The embodiments of the present invention described above are not only implemented by the apparatus and method but may be implemented through a program for realizing the function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded, The embodiments can be easily implemented by those skilled in the art from the description of the embodiments described above.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

610: Download section
612: Download web source
614: file download unit
620:
630: search unit
632: class ID tag search unit
634: iframe and image tag search unit
636: Malware shell code search unit
638: file header value search unit
640: comparison judgment
642: First Comparative Determination Unit
644: second comparative determination
646: third comparative section
650: numerical department

Claims (16)

Downloading a web source from a homepage;
Comparing a class ID tag value included in the web source with a prestored vulnerability class ID tag value; And
And determining that the homepage is infected with malicious code when the class ID tag value included in the web source and the vulnerability class ID tag value match.
How to detect homepages infected with malware. The method of claim 1, wherein the vulnerability class ID tag value is
"C1B7E532-3ECB-4E9E-BB3A-2951FFE67C61, BD96C556-65A3-11D0-983A-00C04FC29E36, AB9BCEDD-EC7E-47E1-9322-D4A210617116, 0006F033-0000-0000-C000-000000000046, 6e3207091dcfc , 6414512B-B978-451D-A0D8-FCFDF33E833C, 7F5B7F63-F06F-4331-8A26-339E03C0AE3D, 06723E09-F4C2-43c8-8358-09FCD1DB0766, 639F725F-1B2D-4831-A9FD-444849983 , D0C07D56-7C69-43F1-B4A0-25F5A11FAB19, E8CCCDDF-CA28-496b-B050-6C07C962476B "
How to detect homepages infected with malware. Downloading a web source from a homepage;
Downloading a file inserted into the web source;
Comparing a header value of the file with a header value of a normal file stored in advance; And
And determining that the home page is infected with a malicious code when the header value of the file and the header value of the normal file do not match.
How to detect homepages infected with malware. The method of claim 3, wherein the file comprises a media file and a portable executable file (PE),
The media file includes a jpg, gif, swf file,
The PE file includes an exe file,
The header value of a normal jpg file is "FF D8 FF".
The header value of a normal gif file is "47 49 46 38".
The header value of a normal swf file is "43 57 53".
The header value of a normal exe file is "4D 5A"
How to detect homepages infected with malware. Downloading a web source from a homepage;
Checking whether an iframe tag or an img tag included in the web source is used as a pre-stored abnormal tag size pattern; And
Determining that the homepage is infected with a malicious code when the iframe tag or image tag is used as a pre-stored abnormal tag size pattern.
How to detect homepages infected with malware. The method of claim 5, wherein the abnormal tag size pattern is
"img and iframe + external address (format: ASCII, hex, utf encoding) + width or height = 0, img + external address (format: ASCII, hex, utf encoding) + width and height = 1, img + external address ( Format: ASCII, hex, utf encoding) + width but height = 1,500, OBJECT width = 0 external address (format: ASCII, hex, utf encoding), EMBED width = 0 external address (format: ASCII, hex, utf encoding) " Selected from the group consisting of
How to detect homepages infected with malware. Downloading a web source from a homepage;
Checking whether the web source contains pre-stored malicious shellcodes; And
Determining that the homepage is infected with malicious code when the web source includes the malicious shellcode.
How to detect homepages infected with malware. The method of claim 7, wherein the malicious shell code is
"unescape ("% u0D0D% u0D0D, unescape ("% u9090% u9090, eval (function (p, a, c, k, e, d), document.write (unescape (, Eval (gzinflate (base64_decode ("
Selected from the group consisting of
How to detect homepages infected with malware. Downloading a web source from a homepage;
Downloading the file when the file is inserted into the web source;
Comparing the class ID tag value included in the web source with prestored vulnerability class ID tag values when the web source includes a class ID tag;
Comparing a header value of the file with a header value of a normal file stored in advance;
When the web source includes an iframe tag or an img tag, checking whether the iframe tag or an image tag is used as a pre-stored abnormal tag size pattern;
Checking whether the web source contains pre-stored malicious shellcodes; And
When the class ID tag value included in the web source and the vulnerability class ID tag value match, when the header value of the file does not match the header value of the normal file, the iframe tag or image tag is stored in advance Determining that the home page is infected with malicious code when used as an abnormal tag size pattern or when the web source includes the malicious shell code.
How to detect homepages infected with malware. The method of claim 9, wherein in the step of determining that the home page is infected with malicious code,
Outputting a probability that the home page is infected with malicious code based on the number of conditions for determining the home page is infected with malware;
How to detect homepages infected with malware. A download unit for downloading a web source from a homepage or downloading a file inserted into the web source;
A database storing at least one of a vulnerability class ID tag value, a normal file header value, an abnormal iframe tag and an image tag size pattern, and malicious shell code;
A class ID tag search unit for searching a class ID tag from the web source, a file header value search unit for searching a file header value from the web source, an iframe and an image for searching an iframe tag or an image tag from the web source A search unit including a tag search unit and a malicious shell code search unit for searching the malicious shell code from the web source and determining whether the homepage is infected with the malicious code according to the result; And
Compares the value of the class ID tag with the vulnerability class ID tag value, the file header value and the normal file header value, and determines whether the iframe tag and the image tag are used as the abnormal iframe tag and image tag size pattern. And a comparison discrimination unit for determining whether the home page is infected with malicious code according to the comparison and the verification result.
Homepage detection device infected with malware. 12. The method of claim 11, wherein the numerical value of the discrimination result input from the malicious shellcode search unit and the comparison discrimination unit is digitized and a weight is applied to each quantized discrimination result value to output a probability that the homepage is infected with the malicious code. Containing more wealth
Homepage detection device infected with malware. The method of claim 11, wherein the vulnerability class ID tag value is
"C1B7E532-3ECB-4E9E-BB3A-2951FFE67C61, BD96C556-65A3-11D0-983A-00C04FC29E36, AB9BCEDD-EC7E-47E1-9322-D4A210617116, 0006F033-0000-0000-C000-000000000046, 6e3207091dcfc , 6414512B-B978-451D-A0D8-FCFDF33E833C, 7F5B7F63-F06F-4331-8A26-339E03C0AE3D, 06723E09-F4C2-43c8-8358-09FCD1DB0766, 639F725F-1B2D-4831-A9FD-444849983 , D0C07D56-7C69-43F1-B4A0-25F5A11FAB19, E8CCCDDF-CA28-496b-B050-6C07C962476B "
Homepage detection device infected with malware. The method of claim 11, wherein the file comprises a media file and a portable executable file (PE),
The media file includes a jpg, gif, swf file,
The PE file includes an exe file,
The header value of a normal jpg file is "FF D8 FF".
The header value of a normal gif file is "47 49 46 38".
The header value of a normal swf file is "43 57 53".
The header value of a normal exe file is "4D 5A"
Homepage detection device infected with malware. The method of claim 11, wherein the abnormal tag size pattern is
"img and iframe + external address (format: ASCII, hex, utf encoding) + width or height = 0, img + external address (format: ASCII, hex, utf encoding) + width and height = 1, img + external address ( Format: ASCII, hex, utf encoding) + width but height = 1,500, OBJECT width = 0 external address (format: ASCII, hex, utf encoding), EMBED width = 0 external address (format: ASCII, hex, utf encoding) " Selected from the group consisting of
Homepage detection device infected with malware. The method of claim 11, wherein the malicious shellcode is
"unescape ("% u0D0D% u0D0D, unescape ("% u9090% u9090, eval (function (p, a, c, k, e, d), document.write (unescape (, Eval (gzinflate (base64_decode ("
Selected from the group consisting of
Homepage detection device infected with malware.

Images