KR20140144636A - Apparatus and method for examining malicious url - Google Patents

Abstract

A method for detecting a malicious URL according to the present invention includes: detecting whether a URL is a malicious URL inducing a user to install a malicious application, wherein the URL is contained in a message among various messages that are sent to user terminals from message providers such as many kinds of enterprises or an unspecific individual for purposes of announcement, promotion, advertisement, or a purpose of leaking of private information and the like; determining the message containing the URL is an abnormal message; and blocking the message not to be sent to a user terminal or notifying the user of danger so as to prevent damage caused by the malicious URL.

Description

 [0001] APPARATUS AND METHOD FOR EXAMINING MALICIOUS URL [0002]

The present invention relates to a method of processing a message including a uniform resource locator (URL), and more particularly, to a method of inspecting a malicious URL by using a message provider of a plurality of companies or an unspecified person, , It is checked whether the URL is a malicious URL which induces the installation of a malicious application for a message including a URL among various messages sent to a user terminal for an advertisement or the like to leak personal information of the user, A malicious URL checking apparatus and method for preventing a malicious URL from being damaged by preventing a message including the URL from being transmitted to a user terminal by judging the message as an abnormal message or by warning a danger of a URL.

In recent years, user terminals such as mobile phones and smart phones have been used as necessities indispensable to modern people, regardless of whether they are male or female. Service providers and handset manufacturers use competitive products or services .

The user terminal may be a multimedia device capable of a phone book, a game, a message, an email, a morning call, an MPEG Layer 3 (MP3), a digital camera, and a wireless Internet service It is developing and providing various services.

On the other hand, among the functions of the user terminal, the message function is often used by the users because it is relatively inexpensive as compared with the voice call.

Such a message may be, for example, a short messaging service (SMS), a multimedia messaging service (MMS), a packet based message, or the like. SMS can say a message that can transmit simple text, and MMS can say a message that can be transmitted by adding a moving picture, a photograph, a music file, etc., away from a simple text message. In addition, a packet-based message is a message transmitted through a packet-switched system using a data network. Like a MMS, a file can be attached to a video, a photograph, a music file, or the like. have.

However, in recent years, many companies or unspecified individuals use the above SMS / MMS message function to publicize, publicize, and advertise a company, and the user inconveniences such as feeling pollution due to the reception of a large number of unnecessary messages Also, there is a problem in that it is inconvenient due to a spam message such as a gambling advertisement message and an obscene message from an abnormal company.

In addition, among the messages such as SMS, MMS, or packet-based messages transmitted to a plurality of user terminals targeted for notification, publicity, and advertisement from a message transmission entity of a company, an individual, etc., malicious URLs Spam (spamming) messages may be present.

At this time, a message including the malicious URL as described above may cause damage to the user by allowing the user who receives the message to click on the URL, for example, to install an application containing malicious code or to connect to an overseas service provider .

Accordingly, when a message including a malicious URL is transmitted to a user's mobile communication terminal or the like, the transmission of the message is blocked, or when the message is transmitted to the user terminal, the danger of the URL included in the message is warned, It is necessary to develop a technology that can reduce the damage caused by the URL.

Meanwhile, as a conventional method for preventing the malicious URL from being damaged, for example, a pattern for an abnormal message such as a spam filtering system or a short message service center (SMSC) However, there is a problem that the pattern for filtering a message that induces a malicious application installation is very limited, and after receiving the notification of the message, have.

In addition, a method of acquiring message specials by collecting messages of problem of attempting to spread malicious application after intentionally leaking personal information and securing several test terminals is proposed in a method proposed by a vaccine developer, Of malicious applications that target personal information are found in more than a hundred different types of malware in a week. However, there is limited performance and limited number of malicious applications.

(Patent Literature)

Korean Patent Registration No. 10-0482538 (registered on Apr. 1, 2005) discloses a technique for a multimedia message service method and system.

Accordingly, in the present invention, a method for inspecting a malicious URL is a method for inspecting a malicious URL by using various messages sent from a message provider such as an enterprise or an unspecified individual to a user terminal for notification, advertisement, It is determined whether or not the URL is a malicious URL that induces installation of a malicious application. If the URL is a malicious URL, the message containing the URL is determined to be an abnormal message and is blocked from being transmitted to the user terminal And a malicious URL inspecting apparatus and method for preventing harm caused by a malicious URL by warning the danger of the URL.

The malicious URL checking apparatus according to the present invention is a malicious URL checking apparatus which comprises a URL extracting unit for checking whether or not a URL (uniform resource locator) is included in the message upon receiving a message and extracting the URL; And an authority / API verification unit for checking whether the URL is malicious by checking whether the application downloaded through the communication unit contains a right or API having a security risk in the communication unit.

The malicious URL inspection apparatus stores the URL list information determined to be malicious as filtering information, and checks whether or not the extracted URL exists in the filtering information before downloading the application from the communication unit, And a pre-filtering unit for blocking the URL if the URL is present in the filtering information.

In addition, the pre-filtering unit updates the URL determined to be malicious in the authorization / API verification unit to the filtering information.

In addition, when the malicious URL inspection apparatus accesses a URL determined as a harmful site including a site that distributes a malicious application, the malicious URL inspection apparatus provides the malicious URL determined by the malicious site blocking system that blocks the connection .

The malicious URL checking apparatus may further include a processing unit for generating URL verification information indicating that the URL is malicious when the URL is determined to be malicious and processing the URL verification information to be included in the message .

The processing unit may include the URL verification information in a header or a data area of the message.

The malicious URL inspection apparatus may further include a dynamic analysis unit for executing the application downloaded through the communication unit on the emulator and analyzing the execution result to determine maliciousness.

The malicious URL inspection apparatus may further include a vaccine engine unit for checking whether the application is malicious by using a vaccine engine for detecting a malicious application for the application downloaded through the communication unit.

The authority / API verification unit analyzes the execution file of the application downloaded through the communication unit to determine whether the URL has maliciousness by checking whether the right having security risk exists among the right information assigned to the application .

The authority / API verifier further checks whether an API for executing the authority is executed by decompiling an executable file of the application.

According to another aspect of the present invention, there is provided a malicious URL checking method including: a URL extracting step of, upon receiving a message, checking whether a URL is included in the message and extracting the URL; And an authority / API verification step of determining whether the URL is malicious by checking whether the downloaded application contains an authority or an API having a security risk.

The malicious URL checking method may further include checking whether the extracted URL exists in the filtering information by using the URL list information determined to be malicious as filtering information and if the extracted URL exists in the filtering information, And a pre-filtering step of judging the URL as a malicious URL.

And a message processing step of, when the URL is determined to be malicious, generating URL verification information indicating that the URL is malicious and processing the URL verification information to be included in the message.

The method may further include a dynamic analysis step of executing the downloaded application on the emulator and analyzing the execution result to determine whether the application is malicious.

The malicious application checking step may further include a malicious application checking step of checking whether the application is malicious by using a vaccine engine for detecting the malicious application with respect to the downloaded application.

The authority / API verification step may include analyzing an execution file of the downloaded application to check whether a right having security risk is included in the right information granted to the application.

Further, after the checking of the authority, it is further checked whether an API for executing the authority is executed by decompiling an executable file of the application.

According to the present invention, there is provided a method for inspecting a malicious URL, comprising the steps of: receiving various messages sent from a message provider of a plurality of companies or an unspecified person to a user terminal for notification, publicity, advertisement, It is determined whether or not the URL is a malicious URL that induces installation of a malicious application. If the URL is a malicious URL, the message containing the URL is determined to be an abnormal message and is blocked from being transmitted to the user terminal , There is an advantage that the damage caused by the malicious URL is prevented by warning the danger of the URL.

In addition, there is an advantage that a malicious application that is transmitted through a message can be originally and preemptively blocked by blocking a message including a malicious URL before filtering the message transmission server before being transmitted to the user terminal.

In addition, by providing a model in which a communication company itself can check maliciousness of an application downloaded through a malicious URL, it becomes more advantageous in collecting malicious application samples than a vaccine providing company that provides a vaccine engine, There is an advantage in creating a carrier's own business model.

1 is a configuration diagram of a communication network for transmitting a message including a malicious URL checking apparatus to which an embodiment of the present invention is applied;
FIG. 2 is a detailed block diagram of a malicious URL testing apparatus according to an embodiment of the present invention. FIG.
3 is a detailed block diagram of a user terminal according to an embodiment of the present invention.
FIG. 4 is a diagram illustrating an example of displaying a connection blocking information message message due to a malicious URL according to an exemplary embodiment of the present invention,
FIG. 5 is a flowchart illustrating an abnormal message inspection operation control operation using URL analysis in the malicious URL inspection apparatus according to the embodiment of the present invention. FIG.

Hereinafter, the operation principle of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions of the present invention, and these may be changed according to the intention of the user, the operator, or the like. Therefore, the definition should be based on the contents throughout this specification.

FIG. 1 illustrates a configuration of a communication network for message transmission including a malicious URL checking apparatus to which an embodiment of the present invention is applied.

Hereinafter, operation of each component on a communication network for message transmission will be described in detail with reference to FIG.

First, a message provider 100 transmits a short message service (SMS) message, a multimedia message service (MMS) message, or a packet-based message service to a user terminal 150 connected to a wired / wireless communication network including a mobile communication network Message, and so on. The user terminal 150 may include a mobile communication terminal such as a mobile phone, a smart phone, or a general wired / wireless telephone having a display window for receiving a message. May be an MMS message, an SMS message, or a packet based message.

The message provider 100 may be, for example, a company such as a financial company, a manufacturer, an open market, or an unspecified person. A message sent by the message provider 100 may be, for example, It may be a message of a content to be notified, promoted or advertised to the user.

The message relay 102 receives a message transmission request to a user terminal 150 as a target from an enterprise such as a financial institution, a manufacturer, an open market or the like or an unspecified individual that becomes the message provider 100 and sends a message request Generates a corresponding content message, and transmits the generated message to the communication network-based message transmission server 110. That is, the message relay 102 transmits data such as the contents of a message to be transmitted from the message provider 100 and information such as a mobile identification number (MIN) of the target user's user terminal 150 to which the corresponding message is to be transmitted And transmits the message to the communication network-based message transmission server 150.

The message transmission server 110 is a server for transmitting a message sent from the message provider 100 to the user terminal 150 requested to be sent and may be an SMSC 112 or an MMSC 114, (150).

On the other hand, a message including a malicious URL among messages transmitted from a message transmission entity such as an enterprise or an unspecified individual to the user terminals 150 of a plurality of target users may include a malicious code when a malicious URL included in the message is clicked The problem is caused by causing an application to be installed or connecting to a foreign smsing server, as described above.

Accordingly, in the present invention, before a message including the URL is transmitted from the message transmission server 110 to the user terminal 150 requested to be transmitted, the malicious URL for checking whether the URL included in the message is malicious The abnormality message including the malicious URL is blocked from being transmitted to the user terminal 150 or warning information indicating that the message is a dangerous message is displayed in the abnormal message So that damage caused by the damage can be prevented.

1, the malicious URL checking apparatus 130 is connected to a message transmission server 110 such as the SMSC 112 and the MMSC 114 to receive a message from the SMSC 112 or the like , It receives a corresponding message from the SMSC 112 and determines whether the URL included in the message is a normal URL or a malicious URL having a malicious intention, thereby determining whether the message requested to be transmitted to the user terminal 150 is an abnormal message .

Hereinafter, an operation of the malicious URL checking apparatus 130 for checking a malicious URL will be described in more detail.

First, the malicious URL checking device 130 extracts the URL information included in the message, and determines whether or not the URL extracted from the message is a malicious URL through preliminary filtering through comparison with a malicious URL list, It is possible to provide the determination information to the message transmission server 110 so that the corresponding message is not transmitted to the user terminal 150 or warn of the danger of the URL. At this time, the malicious URL list as described above refers to the list information of the URLs previously judged to be malicious URLs by the malicious URL checking device 130, and the malicious URL list is provided to the malicious URL checking device 130 And the URL information determined as a malicious URL may be periodically updated in the course of malicious URL checking performed by the malicious URL checking device 130. [

Next, the malicious URL checking device 130 can determine whether the malicious URL is a malicious URL through a vaccine check, an authority / API check, a dynamic analysis, and the like, have.

At this time, in the method for determining whether a malicious URL is obtained through the above-described vaccine inspection, authority / API inspection, dynamic analysis, etc., the malicious URL inspection device 130 determines whether the malicious URL is a malicious URL, (Not shown) linked to the URL address through the URL, and judges whether the URL is malicious through the maliciousness of the downloaded application according to the connection to the URL.

More specifically, first, the malicious URL checking device 130 may check maliciousness of the downloaded application by comparing it with the signage information of the previously inspected application and checking whether it is the same application . At this time, the malicious URL checking device 130 judges that the URL is a malicious URL when the application is scanned as a malicious application through comparison with the signature information as described above. If the application is inspected as a normal application, the malicious URL checking device 130 determines the URL as a normal URL . Also, at this time, the signature information may be hash code information such as SHA-256, MD5, and the like.

Next, when the downloaded application is an application that has not been previously inspected, the malicious URL inspection device 130 checks whether or not the application is a malicious application by using a vaccine engine that is provided in advance. The above-mentioned vaccine engine may be, for example, a commercial vaccine engine provided from a company developing a vaccine, and the malicious URL inspection device 130 judges the URL as a malicious URL when the downloaded application is scanned as a malicious application. However, an application maliciousness check using the above-mentioned vaccine engine may not be accurately inspected for an application having a variant pattern not included in the vaccine engine.

Accordingly, the malicious URL checking device 130 performs an authorization / API check, a dynamic analysis, and the like for an application not determined to be a malicious application through the vaccine engine.

That is, the malicious URL checking device 130 analyzes an execution file of an application for which the malicious application has not been checked through the vaccine engine, and checks the privilege information held by the application.

This permission information records information on rights that can be performed by the user terminal 150 when the application is installed in the user terminal 150 or the like. In the case of a malicious application, for example, "read a message "," "And the like may be set in a security risk dangerous to leakage of the user's personal information. Also, at this time, if the application is created based on the Android OS (operating system), such rights information may be recorded in, for example, an AndroidManifest.xml file or the like.

Therefore, when malicious URL checking apparatus 130 is checked that the downloaded application has security risk, the malicious URL checking apparatus 130 may determine the URL as a malicious URL. At this time, the right to judge the malicious URL can be changed according to the policy.

In addition, the malicious URL checking device 130 decompiles an application executable file through an API check for an application having a security risk that can be determined to be a malicious URL, If you verify that the API is actually created to be invoked, you can determine the URL to be a malicious URL.

In addition to the above-mentioned privilege / API inspection, the malicious URL checking apparatus 130 further performs a more reliable maliciousness checking method. The malicious URL checking apparatus 130 can perform a dynamic analysis to analyze and analyze the application on an emulator, And if the malicious behavior is detected as a result of the behavior analysis of an application actually executed on the emulator, the URL can be determined as a malicious URL.

If the URL included in the message requested to be transmitted to the user terminal 150 is determined to be a malicious URL through the above-described method, the malicious URL checking device 130 determines that the corresponding message is an abnormal message, To prevent the abnormal message from being transmitted to the user terminal 150, or when the message is transmitted, warning information indicating that the corresponding message is a dangerous message including a malicious URL is displayed, thereby displaying an abnormal message So that damage caused by the damage can be prevented.

In addition, the malicious URL checking device 130 may be configured to detect malicious URLs, such as malicious URLs, which are transmitted to the user terminal 150 through a different path on the communication network in addition to messages such as SMS and MMS, And provides the determined URL information to the harmful site blocking and guidance system 140 on the communication network, and may periodically update the information.

The harmful site blocking and guidance system 140 includes information on harmful sites such as distributing a malicious application that may cause harm to the user terminal 150 and when the user terminal 150 tries to access the harmful site It is a system that can block this and provide guidance page about the risk.

Accordingly, the malicious URL checking apparatus 130 provides information on the malicious URL to the malicious website blocking and guidance system 140 and periodically updates the malicious URL, so that the malicious URL can be transmitted to other routes (For example, a text messaging application or the like) to the user terminal 150 to prevent or alert a message including a malicious URL in advance, it is possible to prevent malicious sites having malicious URL information from being blocked The system 140 can block the user terminal 150 from accessing the malicious URL.

At this time, the harmful site blocking and guidance system 140 may block the connection to the URL of the user terminal 150 using the malicious URL information provided by the malicious URL checking device 130, And may transmit the guidance message to the user terminal 150 so that the user can recognize the guidance message.

In the above description of the malicious URL checking device 130, the malicious URL checking device 130 receives a message directly from the message transmission server 110, extracts a URL from the message, and then transmits the malicious URL It is possible to perform the above-described operation through interlocking with the spam filtering server 120. [0050]

Hereinafter, an operation of determining whether an abnormal message is included in a message including a URL by interlocking with the spam filtering server 120 and the malicious URL checking apparatus 130 will be described in detail.

First, the spam filtering server 120 compares various types of messages transmitted to the user terminal 150 through the message transmission server 130 with a pre-stored filtering pattern to check whether the messages are spam messages. .

Accordingly, in the embodiment of the present invention, the spam filtering server 120 extracts a URL from a message containing a URL together with the spam message filtering function as described above, and transmits the URL to the malicious URL checking device 130 It can be implemented to request whether it is malicious URL. In addition, when the malicious URL checking apparatus 130 notifies the malicious URL of the URL, the malicious URL is notified to the message transmission server 110 that the message is an abnormal message, ). ≪ / RTI >

If the malicious URL checking device 130 receives a request from the spam filtering server 120 to determine whether the URL is malicious, the malicious URL checking device 130 determines whether the URL is a malicious URL or a normal URL in the same manner as described above, And provides it to the filtering server 120.

In addition, the spam filtering server 120 may include a list of URLs that are determined to be malicious URLs from the malicious URL checking device 130 in a filtering pattern, and upon determining whether malicious URLs included in newly received messages are malicious, The malicious URL checking device 130 may compare the malicious URL list with the malicious URL list before requesting the malicious URL checking device 130 to determine whether the malicious URL is malicious. At this time, the malicious URL list may be periodically updated in association with the malicious URL checking apparatus 130.

FIG. 2 is a detailed block diagram of a malicious URL checking apparatus according to an embodiment of the present invention. The malicious URL checking apparatus includes a communication unit 200, a URL extracting unit 202, a pre-filtering unit 204, a vaccine unit 206, An API verification unit 208, a dynamic analysis unit 212, a processing unit 214, a memory unit 216, a data base 218, a control unit 220, and the like.

Hereinafter, the operation of each component of the malicious URL checking apparatus 104 of the present invention will be described in detail with reference to FIG.

First, the communication unit 200 transmits and receives data to and from the message transmission server 110 such as the SMSC 108, the MMSC 110, or the packet based message server, and is connected to a communication network such as the Internet, ), The harmful site blocking and guidance system 140, and the like.

When a message to be transmitted to the user terminal 150 is received by the message transmission server 110, the URL extracting unit 202 checks whether a URL in the message is included or not, and extracts the corresponding URL when the URL is included .

The pre-filtering unit 204 performs pre-filtering on the URL extracted from the URL extracting unit 202 through comparison with the malicious URL list to determine whether or not the URL extracted from the message is a malicious URL, And provides such determination information to the control unit 220. Accordingly, the control unit 220 provides the malicious URL determination information to the message transmission server 110 so that the corresponding message is not transmitted to the user terminal 150. The malicious URL list may be stored in the database 218 by referring to the list information of URLs that have been previously inspected by the malicious URL inspection device 130 and determined to be malicious URLs, The URL information determined as a malicious URL may be periodically updated.

The vaccine engine unit 206 checks whether or not the application is a malicious application by using a vaccine engine that is provided in advance for the application downloaded through the URL connection, and provides the inspection result to the control unit 220. Such a vaccine engine may be, for example, a commercial vaccine engine provided by a company developing the vaccine.

The privilege / API verification unit 208 analyzes the executable file of the application and checks the privilege information held by the application. If the privilege is dangerous in security, the privilege / API verifying unit 208 determines that the privilege is a malicious URL and sends the determination result to the control unit 220 to provide. This permission information records information on rights that can be performed by the user terminal 150 when the application is installed in the user terminal 150 or the like. In the case of a malicious application, for example, "read a message "," "And the like may be set in a security risk dangerous to leakage of the user's personal information.

In addition, the authority / API verifying unit 208 decompiles and analyzes the executable file of the application in addition to the above authority checking, and then determines whether or not an executable file has been created such that an API for performing a dangerous security right is actually called And may determine whether or not the URL is malicious. In other words, for example, the authority / API verification unit 208 can determine that the malicious URL is generated when an executable file is created so that the API is actually called, and if not, it can be determined as a normal URL.

The dynamic analysis unit 212 may perform a dynamic analysis to analyze an application by actually executing the application on an emulator, thereby checking whether the application is malicious. That is, if the dynamic analysis unit 212 actually executes the application on the emulator and analyzes the behavior of the executed application and performs the malicious action, the dynamic analysis unit 212 determines the malicious URL, .

When the URL included in the message is identified as a malicious URL through the URL analysis as described above, the processing unit 214 generates URL verification information indicating that the URL is a malicious URL, and processes the URL verification information thus generated to include the URL verification information in the message . At this time, in embedding the URL verification information in the message, the processing unit 214 may add, for example, to a header of the message or a certain area of the data area. In this case, the user terminal 150 of the mobile communication terminal reads the URL verification information in the promised area in the message to check whether or not the URL is malicious, displays whether or not the URL is malicious together with the message, To be recognized in advance.

The memory unit 216 stores an operation control program for the overall operation of the malicious URL checking apparatus 130. The control unit 220 controls the malicious URL checking apparatus 130 according to the operation control program stored in the memory unit 216, Lt; / RTI >

Hereinafter, the operation will be described in more detail. First, the control unit 220 performs prefiltering on the URL by comparing with the malicious URL list through the pre-filtering unit 204 to determine whether or not the URL is malicious, It provides the determination information to the message transmission server 110 so that the corresponding message is not transmitted to the user terminal 150. At this time, the malicious URL list as described above can be referred to the list information of URLs judged to be malicious URLs by the malicious URL inspection device 130, and the URL information judged as a malicious URL is periodically updated .

Next, the control unit 220 performs a vaccination check through the vaccine engine unit 206 for the URLs for which it is not accurately judged whether or not the URL is malicious through the pre-filtering, the authority / API A dynamic analysis through the dynamic analysis unit 212, and the like.

At this time, in the malicious URL determination method through the above vaccine inspection, authority / API inspection, dynamic analysis, etc., the control unit 220 first accesses the corresponding URL through the communication network, It is possible to judge whether the URL is malicious through maliciousness check.

First, the control unit 220 compares the signature information of the application with the signature information of the previously inspected application. When the application is inspected as a malicious application as a result of the comparison, the control unit 220 determines that the URL is a malicious URL. The URL can be judged as a normal URL. At this time, the signature information may be hash code information such as SHA-256, MD5, and the like.

Next, when the downloaded application is an application that has not been previously checked, the control unit 220 controls the vaccine engine unit 206 to check whether or not the application is a malicious application by the vaccine engine provided in the vaccine engine unit 206 If the malicious application is scanned, the malicious URL can be determined.

However, an application maliciousness check using the above-mentioned vaccine engine may not be accurately inspected for an application having a variant pattern not included in the vaccine engine. Accordingly, the control unit 220 may perform authorization / API inspection through the authorization / API verification unit 208, dynamic analysis through the dynamic analysis unit 212 for more accurate determination of an application not determined to be a malicious application through the vaccine engine, And so on.

That is, when the control unit 220 determines that the privilege is dangerous because it is possible to leak the user's personal information to the application as a result of the authorization check through the authorization / API verification unit 208, As a malicious URL. At this time, the right that can be determined as a malicious URL in the authority / API verification unit 208 can be changed according to the policy. In addition, the authority / API verifying unit 208 further verifies whether an API for performing the corresponding authority is actually invoked through decompile analysis for an application having a security risk that can be determined to be a malicious URL, . The malicious URL determination information through the API inspection may also be provided to the control unit 220.

In addition to the above-mentioned rights / API checks, the control unit 220 further performs a more reliable maliciousness checking method, such that the application is actually executed on the emulator through the dynamic analyzer 212, If it is checked to perform an action, the URL may be determined to be a malicious URL.

When the URL included in the message requested to be transmitted to the user terminal 150 is determined to be a malicious URL through the above-described method, the control unit 220 notifies the message transmission server 110 that the corresponding message is an abnormal message In the case where the abnormal message is not transmitted to the user terminal 150, or when the message is transmitted, the verification information indicating that the corresponding message contains the malicious URL containing the dangerous URL is transmitted so that the damage caused by the abnormal message is prevented .

Also, in case that a malicious URL that induces the malicious application to download is sent to the user terminal 150 via a different path on the communication network in addition to the SMS or MMS message, the control unit 220 transmits a URL determined as a malicious URL Information can be provided to the harmful site blocking and guidance system 140 on the communication network through the communication unit 200 and can be periodically updated.

In another embodiment of the present invention, when the URL information included in the message is extracted and applied through the spam filtering server 120, the control unit 220 determines whether the corresponding URL is a malicious URL It may be determined whether the URL is a normal URL, and only the malicious result of the URL may be provided to the spam filtering server 120.

In this case, the spam filtering server 120 receives the result of the inspection of the malicious URL. If the malicious URL is found, the malicious URL is notified to the message transmission server 110 that the message is an abnormal message, and an abnormal message is transmitted to the user terminal 150 .

FIG. 3 illustrates a detailed block configuration of a mobile communication terminal in a user terminal 150 according to an embodiment of the present invention. Hereinafter, the operation of each block of the mobile communication terminal will be described in detail with reference to FIG.

First, the key input unit 300 may include a plurality of numeric keys and function keys for requesting various operations of the mobile communication terminal. When the user presses a predetermined key, corresponding key data is generated and output to the control unit 306 do. The key input unit 300 has a character arrangement difference by manufacturer and country. In addition, the key input unit 300 may be displayed in a touch screen format on the display unit 304 whenever necessary in place of a physical keypad in a smart phone or a tablet PC have.

The audio unit 310 modulates a voice signal inputted through a microphone (MIC) into a radio signal under the control of the control unit 306, demodulates the received radio signal, and transmits the demodulated radio signal as a voice signal to the speaker SPK. The audio unit 310 may further include a codec for processing a voice signal with various voice qualities set by the control unit 306 during a voice call.

The communication unit 308 receives a message sent from the message provider 100 via the communication network. At this time, the above-mentioned message may be a message generated by a request of a company such as a financial provider, a manufacturer, or an open market, which is a message provider 100, and a message including a notice related to the corporation, .

The display unit 304 displays various kinds of information of the mobile communication terminal under the control of the control unit 306 and receives and displays key data generated by the key input unit 300 and various information signals of the control unit 306. In addition, according to the embodiment of the present invention, information indicating a danger of a URL included in a message is displayed with a predetermined mark, a picture or a character.

The URL verification unit 312 checks whether URL validation information for a URL included in the message is present in a message such as an SMS, an MMS message, or a packet-based message received from the communication unit 308, And provides the extracted URL verification information to the control unit 306.

The control unit 306 controls the overall operation of the mobile communication terminal according to the operation program stored in the memory unit 302. [ The above operation program connects the display unit 304 and the key input unit 300 and controls the input / output of data, as well as a basic operating system necessary for the operation of the mobile communication terminal, Software that is pre-programmed at the time of manufacturing to operate an application or the like.

In addition, according to the embodiment of the present invention, when a message such as various SMS, MMS message, or packet based message is received, the URL verification unit 312 is controlled to extract URL verification information for a message including a URL, And displays the dangerousness of the URL on the receiving screen of the message.

At this time, when the control unit 306 confirms that the URL included in the received message is a malicious URL, for example, using the URL verification information, the control unit 306 displays the information indicating that the received message is an abnormal message on the screen using a character or a picture Or outputting a sound so that the user can recognize the risk of the message.

FIG. 5 illustrates an operation control flow for checking whether a message transmitted from the malicious URL checking apparatus 130 to the user terminal 150 according to an exemplary embodiment of the present invention is abnormal. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 1 to 5. FIG.

First, the malicious URL checking apparatus 130 is connected to a message transmission server 110 such as the SMSC 112 and the MMSC 114 as shown in FIG. 1 and receives a message through the SMSC 112 or the like The corresponding message is received from the SMSC 112 to check whether the message is abnormal (S500).

Then, the malicious URL checking apparatus 130 extracts the URL included in the message from the received message (S502), and checks whether the URL extracted through the pre-filtering is a malicious URL (S504).

At this time, the malicious URL checking device 130 compares the URL extracted from the message with the list of malicious URLs (S506), and if the extracted URL exists in the malicious URL list, (S526). When the malicious URL is determined, the malicious URL is provided to the message transmission server 110 so that the corresponding message is not transmitted to the user terminal 150, or the risk of the URL is warned. At this time, the malicious URL list as described above refers to the list information of the URLs previously judged to be malicious URLs by the malicious URL checking device 130, and the malicious URL list is provided to the malicious URL checking device 130 And the URL information determined as a malicious URL in the malicious URL checking process may be periodically updated.

However, if the malicious URL is not determined through the prefiltering, the malicious URL checking device 130 determines whether the URL is a malicious URL by performing a vaccine check, an authority / API check, a dynamic analysis, and the like.

That is, first, the malicious URL checking device 130 accesses a web server (not shown) linked to the corresponding URL address through a wired / wireless communication network for a URL for which it is not accurately judged whether or not the malicious URL is determined through the pre-filtering, The application is downloaded (S508) when a specific application is downloaded.

Next, the malicious URL checking device 130 may check whether the application is malicious by checking whether the downloaded application is the same application by comparing it with signage information of the previously inspected application (S510). At this time, the malicious URL checking device 130 judges that the URL is a malicious URL when the application is scanned as a malicious application through comparison with the signature information as described above. If the application is inspected as a normal application, the malicious URL checking device 130 determines the URL as a normal URL . Also, at this time, the signature information may be hash code information such as SHA-256, MD5, and the like.

Next, in a case where the downloaded application is an application that has not been previously inspected, the malicious URL checking device 130 checks whether the downloaded application is a malicious application by using a vaccine engine that is provided in advance (S512). For example, the above-mentioned vaccine engine may be a commercial vaccine engine provided from a company developing a vaccine. If the downloaded application is examined as a malicious application (S514), the malicious URL inspection device 130 judges the URL as a malicious URL (S526).

However, an application maliciousness check using the above-mentioned vaccine engine may not be accurately inspected for an application having a variant pattern not included in the vaccine engine. Accordingly, the malicious URL checking device 130 performs an authorization / API check, a dynamic analysis, and the like for an application not determined to be a malicious application through the vaccine engine.

That is, if the malicious URL checking device 130 does not check whether the malicious application is detected through the vaccine engine (S514), the malicious URL checking device 130 analyzes the execution file of the application and checks the privilege information held by the application (S514).

This permission information records information on rights that can be performed by the user terminal 150 when the application is installed in the user terminal 150 or the like. In the case of a malicious application, for example, "read a message "," "And the like may be set in a security risk dangerous to leakage of the user's personal information.

In addition, if the malicious URL checking device 130 is checked that the downloaded application has a dangerous security to the downloaded application through the authorization checking, the malicious URL checking device 130 can additionally perform the API checking for the application having the security risk ). In performing the API check, the malicious URL checking device 130 decompresses the executable file of the corresponding application, and then checks whether an executable file is created so that the API for performing the permission is actually called.

Then, the malicious URL checking device 130 checks whether the URL requested for inspection is a malicious URL based on the authorization check and the API check result for the application (S524) If the privilege is set, or if the API of the application executable file is created to actually execute the privilege, the URL may be determined to be a malicious URL (S526).

On the other hand, if the privilege checking and the API check result show that the security risk is not set in the application, or if the application executable file is not prepared to actually call the API for performing the security privilege, the malicious URL checking device 130 ) Can determine the URL as a normal URL (S528).

On the other hand, the malicious URL checking device 130 is a more reliable method of checking maliciousness in addition to the above-mentioned privilege / API inspection for an application that is not checked for malicious application through a vaccine engine, and actually executes the application on an emulator And performing a dynamic analysis to analyze the maliciousness.

That is, if the malicious URL checking device 130 does not check whether the malicious application is detected through the anti-virus engine (S514), the malicious URL checking device 130 actually executes the corresponding application on the emulator (S520) and analyzes the behavior of the actually executed application (S522) .

Then, the malicious URL checking device 130 checks whether the URL requested to be inspected is a malicious URL based on the dynamic analysis result of the application (S524). If malicious action is performed as a result of the behavior analysis of the application actually executed on the emulator It is determined that the URL is a malicious URL (S526).

Otherwise, if the dynamic analysis result indicates that the application actually executed on the emulator is not performing the malicious action, the malicious URL checking apparatus 130 may determine the URL as a normal URL (S528).

As described above, according to the present invention, in a malicious URL inspection method, a malicious URL is scanned from a message provider of a plurality of companies or an unspecified individual for the purpose of notifying, publicizing, advertising, Of the various messages sent to the user terminal, it is checked whether or not the URL is a malicious URL inducing installation of a malicious application. If the URL is a malicious URL, the message containing the URL is determined to be an abnormal message and transmitted to the user terminal , Or to warn of the danger of URLs to prevent damage from malicious URLs. In addition, the message transmission server blocks the malicious URL including the malicious URL by filtering before transmitting the malicious URL to the user terminal, so that the malicious application propagated through the message can be blocked in a source and preemptive manner. In addition, by providing a model in which a communication company itself can check maliciousness of an application downloaded through a malicious URL, it becomes more advantageous in collecting malicious application samples than a vaccine providing company that provides a vaccine engine, And to create a unique business model for telcos.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Accordingly, the scope of the invention should not be limited by the described embodiments but should be defined by the appended claims.

100: message provider 102: message relay
110: message transmission server 120: spam filtering server
130: malicious URL checking device 140: harmful site blocking and guidance system
150: user terminal 200:
202 URL extracting unit 204:
206: Vaccine engine unit 208: Authority / API verification unit
212: dynamic analysis unit 214:
216: memory unit 218: database
220:

Claims (17)

A URL extracting unit for checking whether a URL (uniform resource locator) is included in the message and extracting the URL when the message is received;
A communication unit for downloading an application through the URL,
An authority / API verification unit for checking whether the URL is malicious by checking whether the application downloaded through the communication unit includes authority or API having a security risk,
A malicious URL inspection device.
The method according to claim 1,
The malicious URL checking apparatus comprises:
Storing the URL list information judged to be malicious as filtering information, checking whether the extracted URL exists in the filtering information before downloading the application from the communication unit, and if the extracted URL exists in the filtering information A pre-filtering unit for blocking the URL
The malicious URL inspection apparatus further comprising:
3. The method of claim 2,
The pre-
Wherein the malicious URL checking unit updates the URL determined to be malicious in the authorization / API verification unit to the filtering information.
The method of claim 3,
The malicious URL checking device provides the URL determined to be malicious to the malicious site blocking system that blocks the connection when the user terminal accesses a URL determined as a malicious site including a site distributing a malicious application Malicious URL checking device.
The method according to claim 1,
The malicious URL checking apparatus comprises:
Generating a URL verification information indicating that the URL is malicious when the URL is determined to be malicious and processing the URL verification information to be included in the message,
The malicious URL inspection apparatus further comprising:
6. The method of claim 5,
Wherein,
And the URL verification information is included in a header or a data area of the message.
The method according to claim 1,
The malicious URL checking apparatus comprises:
A dynamic analysis unit for executing the application downloaded through the communication unit on the emulator and analyzing the execution result to determine whether the application is malicious;
The malicious URL inspection apparatus further comprising:
The method according to claim 1,
The malicious URL checking apparatus comprises:
A vaccine engine unit for checking whether the application is malicious or not using the vaccine engine for detecting a malicious application for the application downloaded through the communication unit;
The malicious URL inspection apparatus further comprising:
The method according to claim 1,
Wherein the authority /
Wherein the malicious URL checking unit determines whether the URL is malicious by analyzing an execution file of the application downloaded through the communication unit and checking whether the right having security risk exists among the right information assigned to the application.
10. The method of claim 9,
Wherein the authority /
And further examines whether an API for executing the privilege is executed by decompiling an executable file of the application.
A URL extracting step of, upon receipt of the message, checking whether or not a URL is included in the message and extracting the URL;
A download step of downloading an application through the URL,
An authorization / API verification step of determining whether the URL is malicious by checking whether the downloaded application includes an authority or an API having a security risk,
A malicious URL inspection method.
12. The method of claim 11,
The malicious URL inspection method includes:
A pre-filtering step of determining whether the extracted URL exists in the filtering information by using the URL list information judged to be malicious as filtering information and judging the URL as a malicious URL when the extracted URL exists in the filtering information
The malicious URL checking method further comprising:
12. The method of claim 11,
Generating a URL verification information indicating that the URL is malicious when the URL is determined to be malicious and processing the URL verification information to be included in the message
The malicious URL checking method further comprising:
12. The method of claim 11,
Executing the downloaded application on the emulator, analyzing the execution result, and determining whether the application is malicious or not,
The malicious URL checking method further comprising:
12. The method of claim 11,
A malicious application checking step of checking whether the application is malicious using a vaccine engine for detecting the malicious application for the downloaded application
The malicious URL checking method further comprising:
12. The method of claim 11,
The authority / API verification step may include:
And analyzing an execution file of the downloaded application to check whether the right having security risk is present among the right information given to the application.
17. The method of claim 16,
After the checking of the authority,
And further examining whether an API for executing the privilege is executed by decompiling an executable file of the application.

Images