KR20160142268A - System for detecting and preventing malicious code based on website - Google Patents

Abstract

Disclosed is a malicious code detection and blocking system. According to an embodiment of the present invention, the system for detecting and blocking malicious codes on websites includes: a web providing server which provides websites and homepage services to a communication terminal device of an internet user; and a monitoring server which monitors the websites and homepages provided by the web providing server, detects malicious codes, malicious code access URLs, malicious program distribution codes, and malicious program distribution patterns on a real-time basis, blocks the malicious codes, malicious code access URLs, and malicious program distribution codes in accordance with the detection result, and generates notification messages. Accordingly, the malicious code detection and blocking system can prevent damage to company websites and customers using the websites as well as enhancing company reliability and customer satisfaction.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a malicious code detection /

The present invention relates to a malicious code detection and blocking technique, and more particularly, to a malicious code detection and blocking technique in which a malicious code in an encoded state inserted in a web site and a malicious program distribution code are previously detected and blocked, To a malicious code detection and blocking system for a web site that can prevent damage and improve corporate reliability and customer satisfaction.

With the development of networks and computers, malicious codes are also showing explosive growth. Along with the emergence of new malicious codes, variants using existing malicious codes also play a large part.

Malicious code refers to software designed to infiltrate, install, damage the system or network, and illegally obtain information from the computer system without the user's knowledge. In order to cope with such malicious code threats, currently various malicious code analysis and detection researches are actively carried out, but it is a reality that there are many limitations to cope with malicious codes that become more intelligent and sophisticated day by day.

The methods of analyzing malicious code can be roughly divided into static analysis and dynamic analysis. Static analysis is a method of analyzing without executing malicious code. Binary pattern matching, data flow and code flow analysis are typical static analysis techniques. The static analysis technique has the merit that safe and quick analysis is easy because it excludes the execution of malicious code, but it has a disadvantage that accurate analysis is not easy.

A new type of analytical approach proposed to overcome the drawbacks of static analysis is dynamic analysis. Dynamic analysis is a technique to analyze malicious code by operating in a controllable environment such as a virtual machine. It has an advantage that accurate actual behavior can be seen regardless of code obfuscation such as execution compression. The dynamic analysis technique has a disadvantage that it takes a lot of time to observe the contamination possibility and behavior of the experimental environment according to actual malicious code execution.

Open Patent Publication No. 2007-0049511 (published on May 11, 2007) discloses a method for overcoming the disadvantages that take a long time to observe the behavior, and by setting standards for analyzing information related to malicious code by itself, And malicious code analysis techniques that can prevent malicious code and prevent malicious code.

However, this conventional technology detects malicious code based on a vaccine, and recently there is a problem that hackers can not detect and analyze new techniques such as hacking a web site to plant and distribute malicious code. Internet users suffer malicious code that is embedded on a web site. Therefore, if a malicious code occurs on a website or a homepage, the image of the company may be lost, the number of connected customers may decrease, Follow.

Open Patent Publication No. 2007-0049511 (published May 11, 2007)

SUMMARY OF THE INVENTION Accordingly, the present invention has been made to solve the above-mentioned problems occurring in the prior art, and it is an object of the present invention to proactively detect and prevent malicious codes in the encoded state and malicious programs, And to provide a malicious code detection and blocking system for a web site that can improve the reliability of the enterprise and the customer satisfaction.

According to another aspect of the present invention, there is provided a malicious code detection and blocking system for a web site, including a web providing server for providing a web site and a homepage service through a communication terminal of an Internet user, The malicious code access URL, the malicious program distribution code, and the malicious program distribution pattern in real time by monitoring the website and the homepage of the malicious program by monitoring the website and the homepage of the malicious program, And generates a notification message.

According to the malicious code detection and blocking system of the web site of the present invention described above, the malicious code in the encoded state inserted in the web site and the distributed code of the malicious program are detected and blocked in advance, It can prevent malicious code infection damage inside the organization.

In addition, it can prevent damage to corporate website and website users and improve corporate reliability and customer satisfaction.

In addition, synergy effect can be expected in connection with security control service, and it is effective to increase customer trust and direct / indirect profit through secure internet environment and stable web service provision of company / public institution.

1 is a block diagram specifically illustrating a malicious code detection and blocking system of a web site according to an embodiment of the present invention.
2 is a block diagram illustrating a procedure for distributing a malicious code on a web site and a process for monitoring malicious code distribution.
FIG. 3 is a configuration diagram specifically showing the monitoring server shown in FIG. 1. FIG.
FIG. 4 is a diagram illustrating a method of analyzing malicious code and malicious code distribution patterns of the MC spread pattern analyzing engine and the MC breaker shown in FIG. 3;
FIG. 5 is a flowchart showing an operation of analyzing HTML content of the HTML content analysis engine shown in FIG. 3 and FIG.
FIG. 6 is a flowchart illustrating a malicious program distribution pattern detection operation of the MC distribution pattern analysis engine shown in FIGS. 3 and 4. FIG.
7 is a diagram showing an example of detection of a malicious code distribution pattern and a malicious code distribution pattern.
FIG. 8 is a flowchart showing a malicious code decoding and detection operation of the MC decoding processing engine shown in FIGS. 3 and 4. FIG.
9 is a diagram illustrating a malicious code and malicious code decoding process and detection example.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram specifically illustrating a malicious code detection and blocking system of a web site according to an embodiment of the present invention. 2 is a block diagram illustrating a procedure for distributing a malicious code on a web site and monitoring a malicious code distribution.

1, a malicious code detection and blocking system of a web site according to the present invention includes a web providing server 200 for providing a web site and a homepage service to a communication terminal 100 of an Internet user, A malicious code access URL, a malicious program distribution code, and a malicious program distribution pattern distributed from the zombie server 400 or the hacker server 500 in real time by monitoring a website and a homepage provided in the terminal 200, And a monitoring server 300 for blocking a malicious code, a malicious code access URL and a malicious program distribution code according to the detection result and generating a notification message.

The web providing server 200 may be an Internet hosting engine or a hosting server operated by a company or an individual. The web providing server 200 distributes a web site and a homepage address through the Internet, and operates a web site and a homepage. When an Internet user accesses a web site or a homepage through a communication terminal 100 such as a notebook computer, a tablet mobile communication device, or a PC, a web site and a homepage service are provided.

The communication terminal 100 may be a notebook, a smart phone, a tablet PC, a tablet mobile communication device, a personal PC, etc. A customer or an Internet user using the Internet may form a network with the communication terminal 100, You will access the homepage and use it.

However, hackers who distribute malicious code can use a zombie server (400), a hacker server (500), or a PC to embed a dropper on a website or a homepage, It embeds patterns of spreading codes and malicious codes of code or malicious programs. Here, the malicious code or malicious code distribution pattern of the malicious program and the malicious code distribution pattern may be included as the i-frame tag, the embed, the object tag, the link tag, the script tag, and the JavaScript tag.

As shown in FIG. 2, when a user accesses a web site or a homepage provided by the web providing server 200 via the communication terminal 100 such as a notebook computer, a tablet mobile communication device, or a PC, the malicious behavior For example, key logging, data leakage). In this state, the communication terminal 100 downloads the malicious code by an instruction to download the information, and the downloaded file is executed to periodically transmit the personal information and various information stored in the communication terminal 100 It is exposed to malicious acts such as leakage.

The monitoring server 300 real-time monitors various contents, a distribution code, an execution code, and the like provided by the web providing server 200 while being connected to the web site and the homepage provided by the web providing server 200 in real time. At this time, the monitoring server 300 detects and analyzes various contents, dubbed codes, execution codes, and the like provided from the web providing server 200 and transmits the detected contents, the drop codes, and the execution codes distributed from the zombie server 400 or the hacker server 500, , Data leakage file, malicious code, malicious code access URL, malicious program distribution code, and malicious program distribution pattern in real time. The web server 200 and the zombie server 200 generate a notification message by blocking the dropper, the keylog, the data leakage file, the malicious code, the malicious code access URL, the malicious program distribution code and the malicious program distribution pattern according to the detection result, (400) and the hacker server (500).

FIG. 3 is a configuration diagram specifically showing the monitoring server shown in FIG. 1. FIG. 4 is a diagram specifically illustrating a malicious code and malicious code distribution pattern analysis method of the MC fuzzing pattern analysis engine and the MC blocking unit shown in FIG.

Referring to FIG. 3, the monitoring server 300 accesses a web site and a homepage operated by the web providing server 200, and uses contents provided by a web site and a homepage, and transmits a distribution code and an execution code The zombie server 400 or the hacker 400 may analyze the contents provided by the web agent 310, the web site, and the homepage provided with the script code, etc., in real time, An MC analysis unit 320 for detecting a dropper, a keylog, a data leakage file, a malicious code, a malicious code access URL, a malicious program distribution code and a malicious program distribution pattern by the server 500; The URL, the malicious program distribution code, and the malicious program distribution pattern, and outputs the dropper, the keylog, the data And transmits the notification message to the web server 200, the zombie server 400, and the hacker server 500. In this case, the malicious program access URL, the malicious program distribution code, and the malicious program distribution pattern are blocked The malicious program distribution pattern information, the malicious code access URL information, the access information of the communication terminal 100, and the malicious code distribution information of the communication terminal 100, And a database unit 340 that stores and updates the user information and the operator information for operating the web providing server 200 and updates and shares the information with the MC analyzing unit 320 and the MC blocking unit 330 in real time.

The web agent 310 real-time accesses to a web site and a homepage operated by the web providing server 200 to maintain a real-time connection state. Various behaviors that can be used on websites and homepages, such as by sequentially using various contents provided on a website and a homepage, receiving distributed codes and execution codes (for example, script codes, etc.) Are sequentially executed.

As shown in FIG. 4, the MC analyzer 320 analyzes the contents provided on the web site and the homepage according to the execution operation of the web agent 310, and the distributed codes and execution codes generated when providing the contents, Detects a dropper, a keylog, a data leakage file, a malicious code, a malicious code access URL, a malicious program distribution code, and a malicious program distribution pattern by the zombie server 400 or the hacker server 500. To this end, the MC analysis unit 320 includes an HTML content analysis engine 321 for sequentially detecting and analyzing HTML content to detect a malicious program distribution code using HTML, And an MC spread pattern analysis engine 321 for detecting a malicious program spread pattern used in spreading a malicious program.

FIG. 5 is a flowchart showing an operation of analyzing HTML content of the HTML content analysis engine shown in FIG. 3 and FIG.

Referring to FIG. 5, the HTML content analysis engine 321 receives the Http / Https URL of the HTML content through the web agent 310 and sequentially parses and analyzes the HTML content to construct an HTML DOM. And, it analyzes and analyzes Http / Https URL and existence of HTML contents and Http / Https URL, and detects and analyzes malicious program spread code using HTML to be included in Http / Https URL.

FIG. 6 is a flowchart illustrating a malicious program distribution pattern detection operation of the MC distribution pattern analysis engine shown in FIGS. 3 and 4. FIG. 7 is a diagram showing an example of detection of a malicious code distribution pattern and a malicious code distribution pattern.

6 and 7, the MC distribution pattern analysis engine 321 receives HTML contents through the web agent 310 and generates URLs and HTML contents sequentially generated according to the operation of the web agent 310 And decodes at least one URL or codes of the distributed code and the script code in real time. Then, at least one of an inline frame (iframe) tag, an inline frame tag, an embedded tag, an object tag, a link tag, a script tag, and a JavaScript tag used for distributing malicious code is detected do. Next, at least one attribute value of src, width, height is referenced and compared in the HTML contents to check whether there is a pattern used for distributing malicious code or not.

As shown in FIG. 7, HTML contents or HTML codes used for distribution of malicious code are included in an execution code such as a URL, a distributed code generated in providing contents, and a script code in an encoded state. Accordingly, the MC distribution pattern analysis engine 321 decodes real-time execution codes such as a URL generated sequentially in accordance with the operation of the web agent 310, a distributed code generated in providing contents, and a script code, height of the malicious code can be checked by referring to at least one attribute value among the patterns.

Meanwhile, the MC distribution pattern analysis engine 321 decodes in real time the execution codes such as the URL, the distributed code generated in providing the contents, and the script code, and then, the malicious program distribution pattern information provided by the database unit 340 And malicious code access URL information, respectively, to check whether there is a pattern used for distributing malicious code.

The MC blocking unit 330 decodes the malicious code, the malicious code access URL, the malicious program distribution code, and the malicious program distribution pattern, and stores the dropper, the keylog, the data leakage file, Block malicious code, malicious code access URL, malicious program distribution code, and malicious program distribution pattern. Then, a notification message is generated and transmitted to the web providing server 200, the zombie server 400, and the hacker server 500. For this purpose, the MC blocking unit 330 decodes in real time the URLs generated in sequence according to the operation of the web agent 310, the distributed codes generated when the HTML contents are provided, and the script codes to generate droppers, An MC decoding processing engine 331 for detecting a malicious code, a malicious code access URL, and a malicious program distributed code, respectively, and for blocking a URL generated according to the detection result, The malicious code access URL generated when the HTML content is provided, the malicious program distribution code, and the malicious program distribution pattern are blocked based on the result of the malicious code distribution pattern check by the distribution pattern analysis engine 321, An MC distribution pattern processing engine 332 for transferring the malicious code to the malicious code distribution server 200, the zombie server 400 and the hacker server 500, And transmits an alert message to the web providing server 200, the zombie server 400, and the hacker server 500 according to the result of the presence / absence checking and the malicious program distribution code detection result, And a distributed URL blocking engine 333.

3, the database unit 340 stores the operator information for operating the web providing server 200 and the login information of the web site operated by the web providing server 200 or the homepage accessing users 200 The information of the user information DB, the dropper, the keylog, the data leakage file, the malicious program distribution script, the malicious code script, and the decoding information of the dropper, the keylog, the data leakage file, the malicious program distribution script, A MC distributed URL DB for storing, updating and sharing URL information generated according to detection results of malicious code access URLs and malicious program distribution codes, malicious program distribution pattern information and malicious code distribution And an MC distribution pattern DB for storing, updating, and sharing the pattern information used in All.

FIG. 8 is a flowchart showing a malicious code decoding and detection operation of the MC decoding processing engine shown in FIGS. 3 and 4. FIG. 9 is a diagram illustrating a malicious code and malicious code decoding process and detection example.

Referring to FIGS. 8 and 9, the MC decoding processing engine 331 of the MC interceptor 330 receives a URL sequentially generated according to the operation of the web agent 310, a script of a distributed code generated when HTML contents are provided, The script of the malicious code is loaded in real time and stored in memory. Then, the HTML DOM and the BOM are constructed by sequentially parsing and analyzing the URL, the script of the distributed code, and the script of the malicious code.

Thereafter, the MC decoding processing engine 331 compares the scripts of the HTML DOM and the BOM with the decoding information of the dropper, the keylog, the data leakage file, the malicious program distribution script, and the malicious code script from the MC decoding information DB A malicious code, a malicious code access URL, and a malicious program distribution code, and detects a URL generated according to the detection result, a distribution code generated when providing HTML contents, and a script Block code entry and connection.

The MC distribution pattern processing engine 332 transmits an execution code such as a URL sequentially generated according to the operation of the web agent 310, a distribution code generated in providing contents, and a script code to malicious program distribution pattern information , Pattern information used for distributing malicious code, and attribute value of at least one of src, width, and height to check presence / absence of a malicious code distribution pattern. In accordance with the malicious code distribution pattern check result, the URL, the malicious code access URL generated when providing the HTML content, the malicious program distribution code, and the malicious program distribution pattern are blocked, and a notification message is generated and transmitted to the web providing server 200 To the zombie server (400) and the hacker server (500).

The MC distributed URL blocking engine 333 blocks the URL and the malicious code access URL access according to the result of the presence / absence of the malicious code distribution pattern of the MC distribution pattern processing engine 332 and the detection result of the malicious program distribution code, And transmits it to the web providing server 200, the zombie server 400, and the hacker server 500.

As described above, according to the malicious code detection and blocking system of the web site of the present invention, malicious code in the encoding state inserted in the website and malicious program distribution code are detected and blocked in advance, It is possible to prevent the malicious code infection damage inside the user and enterprise organization. In addition, it can prevent damages to corporate website and website users and improve corporate reliability and customer satisfaction.

In addition, synergy effects can be expected in connection with security management services, and customer trust and direct and indirect profits can be increased through secure internet environment and stable web service provision of corporate / public institutions.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the following claims And changes may be made without departing from the spirit and scope of the invention.

Claims (6)

A web providing server for providing a web site and a homepage service to a communication terminal of the Internet user; And
A malicious code access URL, a malicious program distribution code and a malicious program distribution pattern in real time by monitoring a web site and a homepage provided by the web providing server, and detecting the malicious code, the malicious code access URL And a monitoring server for blocking the malicious program distribution code and generating a notification message,
The monitoring server
A web agent that accesses a web site operated by the web providing server and a homepage accessed through a web site and contents provided on a homepage, and receives a distributed code, a distributed script, an executable code, and an execution script,
Analyzing the contents provided on the web site and the homepage, the dubbed code, the dubbing script, the execution code, and the execution script in real time and detecting the dropper, the keylog, the data leakage file, the malicious code, An MC analysis unit for detecting a URL, a malicious program distribution code, and a malicious program distribution pattern;
The malware, the malicious code access URL, the malicious program distribution code, and the malicious program distribution pattern, and distributes the dropper, the keylog, the data leakage file, the malicious code, An MC blocking unit for blocking the malicious code access URL, the malicious program distribution code and the malicious program distribution pattern, generating the notification message, and transmitting the notification message to the web providing server, the zombie server and the hacker server,
The malicious program distribution pattern information, the malicious code access URL information, the connection information of the communication terminal, the user information of the communication terminal, and the operator information for operating the web providing server And a database unit for storing and updating the MC analysis unit and the MC blocking unit in real time,
The MC blocking unit
A drupper, a keylog, a data leakage file, a malicious code, a malicious code, and a malicious code by sequentially decoding a URL generated sequentially according to the operation of the web agent, the dubbed code, And an MC decoding processing engine for detecting at least one of an access URL and a malicious program distribution code and for blocking the inflow and connection of the URL, the dubbed code, the distribution script, and the execution code or the execution script according to the detection result,
The MC analysis unit
An HTML content analysis engine for detecting a malicious program distribution code using HTML by parsing and analyzing HTML content sequentially; And
And an MC dissemination pattern analysis engine for analyzing a script code and HTML contents generated at the time of providing the content in real time to detect a malicious program distribution pattern used in distributing a malicious program,
The HTML content analysis engine
The Http or Https URL of the HTML content is received through the web agent, and the HTML DOM is configured by parsing and analyzing the HTML content sequentially, and analyzing the existence of the Http / Https URL and the Http or Https URL And detecting and analyzing a malicious program distribution code using HTML to be included in the Http or Https URL.
The method according to claim 1,
The MC dissemination pattern analysis engine
Receiving at least one HTML URL from the web agent, generating a URL sequentially generated according to the operation of the web agent, a distributed code generated at the time of providing the HTML content, and a script code in real time using a heuristic technique By doing so,
At least one of an inline frame (iframe) tag, an inline frame tag, an embedded tag, an object tag, a link tag, a script tag, and a JavaScript tag used for distributing a malicious code is detected in the HTML content ,
A malicious code detection and blocking system for a web site that checks and detects at least one attribute value of src, width, height in the HTML content to check whether there is a pattern used for distributing malicious code.
The method according to claim 1,
The MC blocking unit
Checking whether or not the malicious code distribution pattern exists, blocking the malicious code access URL generated when providing the URL, HTML content, the malicious program distribution code and the malicious program distribution pattern according to the confirmation result, An MC distribution pattern processing engine for transmitting to the providing server, the zombie server and the hacker server;
The URL and the malicious code access URL are blocked according to the result of the malicious code distribution pattern detection and the detection result of the malicious program distribution code, and a notification message is generated so that the web server, the zombie server and the hacker server A malware detection and blocking system on a website that includes an MC-distributed URL blocking engine that sends.
The method according to claim 1,
The MC decoding processing engine
A script of the dubbed code and a script of the malicious code sequentially loaded in accordance with the operation of the web agent,
The HTML DOM and the BOM are constructed by sequentially analyzing and analyzing the URL, the script of the distributed code, and the script of the malicious code,
The above HTML DOM and BOM scripts are compared with decoding information of droppers, a keylog, a data leakage file, a malicious program distribution script and malicious code scripts from the database unit and decoded in real time using a heuristic technique, A dropper, a keylog, a data leakage file, a malicious code, a malicious code access URL, and a malicious program distributed code,
A malicious code detection and blocking system for blocking inflow of a URL generated according to the detection result, a malicious code and a script code generated when HTML contents are provided, and a connection.
The method of claim 3,
The MC distribution pattern processing engine
A malicious program distribution pattern information from the database unit, pattern information used for distributing a malicious code, src , width, and height to check whether there is a malicious code distribution pattern,
Blocking the malicious code access URL generated upon providing the HTML content, the malicious program distribution code and the malicious program distribution pattern according to the result of the malicious code distribution pattern check,
And transmitting the notification message to the web providing server, the zombie server, and the hacker server.
The method according to claim 1,
The database unit
A user information DB storing and sharing operator information for operating the web providing server and login information of a web site operated by the web providing server or login users of a homepage accessing server;
MC for storing, updating, and sharing decoding information of the dropper, the keylog, the data leakage file, the malicious program distribution script, the malicious code script information, and the dropper, the keylog, the data leakage file, the malicious program distribution script, Decoding information DB;
An MC distribution URL DB storing, updating and sharing URL information generated according to a malicious code access URL and a detection result of the malicious program distribution code; And
A malicious code detection and blocking system for a web site including an MC distribution pattern DB for storing and sharing malicious program distribution pattern information and pattern information used for distribution of malicious code, respectively.

Images