KR20140119527A - Method and apparatus for inspecting malicious code of a mobile terminal - Google Patents

Abstract

The purpose of the present invention is to minimize resources required for malicious code inspection by extracting a path of an execution file based on application information and checking malicious code infection of the execution file using the extracted path. The present invention provides a method and an apparatus for inspecting malicious code of a mobile terminal, wherein the apparatus generates a path of an execution file based on information of an application installed in a mobile platform and performs the malicious code inspection for the execution file based on the extracted path.

Description

TECHNICAL FIELD [0001] The present invention relates to a malicious code checking method and apparatus for a mobile terminal,

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a malicious code checking apparatus for a mobile terminal, and more particularly, to a malicious code checking method and apparatus for a mobile terminal capable of minimizing resources required for malicious code checking.

2. Description of the Related Art In recent years, with the development of mobile communication technology as well as wired and wireless Internet, mobile phones having various functions such as a wireless Internet service as well as a voice call service have been spreading. Especially, smartphones, which have been spreading recently, are capable of installing various functions such as multimedia playback, and users are using smart phones for various purposes.

Generally, a smart phone is defined as a combination of the advantages of a mobile phone and a personal portable device, and integrates data communication functions such as calendar management, fax transmission and reception, and Internet access to a mobile phone. A typical smartphone is equipped with a wireless communication module such as WiFi, which allows data to be transmitted and received via the Internet. In addition to retrieving Internet information, a character can be input to the liquid crystal display using an electronic pen, .

Each of these smartphones has different operating systems, and applications that can be executed by the operating system are actively being developed.

However, since many applications are being developed and provided, not only applications that are practically useful to smartphone users but also applications that perform malicious actions by other purposes such as advertisements are provided to smartphone users. For example, when there is an application program for uploading personal information of a user stored in a smart phone to a specific server, a smartphone user installing the application may be exposed to the risk of exposing their personal information.

To solve these problems, mobile vaccines have been developed and distributed. Such a mobile-use vaccine checks a file through decompression of an application installation file, for example, an APK file to determine whether malicious code exists in the file.

However, since a large number of applications are installed on a smartphone in recent years, a portion of decompressing each of the application installation files and checking for malicious code infection may have a serious impact on the internal resource management of the smartphone.

Korean Patent Publication No. 10-2011-0128632 discloses a technique and a device for detecting a malicious behavior of a smartphone application program.

The present invention relates to a mobile terminal capable of minimizing resources required for malicious code checking by extracting a path of an executable file based on information of an application and checking whether an executable file is infected with malicious code by using the extracted path, A code checking method and apparatus are provided.

According to an aspect of the present invention, there is provided a method for managing an executable file, the method comprising: generating a path of an executable file based on information of an application installed on the mobile platform; and performing malicious code checking on the executable file based on the extracted path A malicious code checking method of a mobile terminal.

In the malicious code checking method according to the embodiment of the present invention, the step of generating the path may include: setting a basic path in which the application in the mobile platform is installed; And creating a path of an executable file for each of the applications.

In the malicious code checking method according to the embodiment of the present invention, the executable file may be an ODEX (Optimized DEX) file.

In the malicious code checking method according to the embodiment of the present invention, the mobile platform may be an Android platform.

According to another aspect of the present invention, there is provided an information processing apparatus including an installation list collection unit for collecting information of an application installed in a mobile platform, an executable file for generating a path of an executable file for each of the applications based on the information of the application, And an inspection unit for extracting a path of the executable file from the memory when the malicious code inspection request is received and for checking whether the malicious code is infected with the executable file based on the extracted path, Thereby providing an inspection apparatus.

In the malicious code checking apparatus according to the embodiment of the present invention, the installation list collecting unit may collect the installation file name of the application and the type of the application as the information of the application.

In the malicious code checking apparatus according to the embodiment of the present invention, the executable file path generating unit may generate a path of an executable file for each of the applications based on a preset default path, a type of the application, have.

Since the present invention can inspect malicious code without decompressing a file in the mobile platform, it is possible to reduce the risk of performance enhancement and decompression failure.

1 is a block diagram illustrating a malicious code checking apparatus according to an embodiment of the present invention.
2 is a diagram illustrating a process of generating an executable file path according to an embodiment of the present invention;
3 is a flowchart illustrating a process of checking whether an apparatus according to an embodiment of the present invention is infected with malicious code for an executable file.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention and the manner of achieving them will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a block diagram illustrating a mobile malicious code checking apparatus according to an embodiment of the present invention.

The malicious code checking apparatus 100 of FIG. 1 is installed on a mobile platform, for example, an Android platform. The malicious code checking apparatus 100 receives application installation list information from an application manager of the Android platform and extracts an execution file path. Inspection can be performed.

In addition, the malicious code checking apparatus 100 may be installed in a recording medium in a mobile terminal in the form of an application and operated.

The malicious code checking apparatus 100 may include an installation list collection unit 110, an execution file path generation unit 120, an inspection unit 130, a memory 140, and the like.

The installation list collecting unit 110 can collect a list and information of applications installed in the mobile terminal by interworking with the Android platform. That is, the installation list collecting unit 110 may collect information such as an installation file name and an application type of an application installed in the mobile terminal, and provide the information to the execution file path generation unit 120. Here, the type of the application may be a preload or a third party.

The executable file path generation unit 120 can generate a path in which the executable file exists based on the information about the executable file name and the type of the application. That is, the executable file path generation unit 120 generates a primary path in which an executable file exists based on the primary path and the application type, generates a secondary path connected to the primary path based on the installed file name, Can be generated. For example, if the default path is' data / dalvik-cache ', the type of application is third party, and the name of the installed file is ahnlab, the executable file path generation unit 120 generates' / dalvik-cache / data @ app ', connect the name of the installation file to' classes.dex 'in the primary path and set the path of the executable file, ie,' data / dalvik-cache / Can be generated.

On the other hand, if ahnlab's application type is preloaded, you can create a path to an executable file called 'data / dalvik-cache /'.

In this manner, the executable file path generation unit 120 generates a path of an executable file for each application installed in the mobile terminal, and stores it in the memory 140. [

When a new application is installed in the mobile terminal, the execution file path generation unit 120 receives the application information from the installation list collection unit 110 by recognizing the new application, and creates a path of the execution file based on the provided application information To update the memory 140.

The executable file of the present invention is a file that is created when an application is installed in a mobile terminal. Examples of executable files include, but are not limited to, optimized DEX (ODEX) files.

The process of generating an ODEX file path will be described with reference to FIG.

2 is a diagram for explaining a process of generating a path of an ODEX file according to an embodiment of the present invention.

As shown in FIG. 2, the basic path of all applications is 'data / dalvik-cache'. If the type of application is preload, it is an application related to the system. @ classes.dex 'can be created. On the other hand, if the type of application is a third party, a path of ODEX file called 'data / dalvik-cache / data @ app @ installation' can be created.

The inspection unit 130 accesses the executable file in the mobile platform according to the installation path stored in the memory 140, and can check whether the executable file is infected with the malicious code. Examples of the inspection method include, but are not limited to, an inspection method using a malicious code pattern.

A process of checking whether the malicious code inspection apparatus 100 having the above configuration has malicious code infection will be described with reference to FIG.

3 is a flowchart illustrating a malicious code checking process according to an embodiment of the present invention.

As shown in FIG. 3, first, the installation list collecting unit 110 collects application information installed on a mobile platform, for example, an Android platform (step 302). For example, the installation list collecting unit 110 may collect information of an application installed in the mobile terminal by interworking with an application manager in the Android platform. Here, the information of the application may be an application type (type), an installation file name of the application, or the like.

The executable file path collection unit 120 may then create an executable path for each application based on the application's installed base path and application information, and store it in the memory 140 (step 304). Here, the default path for the application may be 'data / dalvik-cache' for the Android platform.

After that, the inspector 130 performs a real-time inspection, that is, accesses the executable file using the executable file path stored in the memory 140, and then checks whether the executable file is infected with the malicious code (step 306). The malicious code checking method includes, but is not limited to, a method using a previously stored malicious code pattern.

If the executable file is infected with malicious code as a result of checking for malicious code, the malicious infected executable file can be deleted or can be treated by a predetermined treatment method.

Meanwhile, the installation list collection unit 110 of the malicious code checking apparatus 100 determines whether a new application is installed in the mobile platform (step 308).

If it is determined in step 308 that the application is installed, the process returns to step 302 to perform a subsequent step, that is, the installation list collecting unit 110 receives the information of the installed application from the application manager, The executable file path collecting unit 120 may generate an executable path based on the basic path and the information of the application, and may use the information to update the information in the memory 140. [

However, if the malicious code checking apparatus 100 performs the inspection in real time, the checking unit 130 checks whether the execution file path is stored in the memory 140 It is possible to check whether an execution file is infected with malicious code in real time.

The executable file may be an ODEX file, but is not limited thereto. In other words, it can be various types of executable files.

Also, the basic route mentioned in the embodiment of the present invention may also be changed according to the form of the mobile platform.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Accordingly, the scope of the invention should not be limited by the described embodiments but should be defined by the appended claims.

100: Malicious Code Inspection Apparatus 110: Installation List Collection Unit
120: executable file path collecting unit 130:
140: Memory

Claims (9)

Generating a path of an executable file based on information of an application installed in the mobile platform;
And performing malicious code checking on the executable file based on the extracted path
A malicious code inspection method of a mobile terminal.
The method according to claim 1,
Wherein the generating the path comprises:
Setting a basic path in which an application in the mobile platform is installed,
Generating a path of an executable file for each of the applications based on the basic path, the type of the application, and the installation file name of the application
A malicious code inspection method of a mobile terminal.
The method according to claim 1,
The executable file is an ODEX (Optimized DEX) file
A malicious code inspection method of a mobile terminal.
The method according to claim 1,
The mobile platform may be an Android platform
A malicious code inspection method of a mobile terminal.
An installation list collection unit for collecting information of an application installed in the mobile platform,
An executable file path generation unit for generating a path of an executable file for each of the applications based on the information of the application and storing the path of the executable file in a memory;
And an inspection unit for extracting a path of the executable file from the memory and checking whether the malicious code is infected with the executable file based on the extracted path
Malicious code checking device of mobile terminal.
6. The method of claim 5,
The installation list collecting unit,
The installation file name of the application and the type of the application are collected as the information of the application
Malicious code checking device of mobile terminal.
The method according to claim 6,
Wherein the executable file path generation unit comprises:
Generates a path of an executable file for each of the applications based on the predetermined basic path, the type of the application, and the installation file name of the application
Malicious code checking device of mobile terminal.
6. The method of claim 5,
The executable file is an ODEX (Optimized DEX) file
Malicious code checking device of mobile terminal.
6. The method of claim 5,
The mobile platform may be an Android platform
Malicious code checking device of mobile terminal.

Images