KR20170018791A - Apparatus and method for detecting malicious code using cultivation of malware - Google Patents

Abstract

When a malicious code is detected, one or more malicious codes are acquired from a malicious code pool containing a plurality of malicious codes. A new cultivation code is generated by modifying or combining the source code of the acquired malicious code. The operation of the cultivation cord is checked. If operation acceptance and rejection of the cultivation code are inspected, it is checked whether the cultivation code is detected through at least one predetermined vaccination program. If the cultivation code is not detected from at least one of the vaccine programs, the cultivation code is added to the malicious code pool. The cultivation code is discarded if detected.

Description

[0001] APPARATUS AND METHOD FOR DETECTING MALICIOUS CODE USING CULTIVATION OF MALWARE [0002]

The present invention relates to a malicious code detection apparatus and method for detecting a malicious code that is not detected by an existing vaccine program.

Malicious code is also called malware, malicious program, and it is classified as virus, worm virus, Trojan horse and so on.

Various vaccine programs have been developed and distributed to detect and treat these malicious codes. In general, signature-based detection and heuristic detection techniques are used.

A signature is a specific piece of data that a vaccine program uses to uniquely identify the file when scanning it. Most locally installed antivirus programs include a signature database and regularly update signature data for newly discovered malicious code by malicious code analysts. For example, a vaccine program can check whether a scanned file is malicious code by comparing / collating the signatures included in each code with the signature database. This signature-based detection method is disadvantageous in that it is hard to diagnose even if the malicious code file changes only a few hundred bytes by inserting padding in the middle of the code while modifying the basic logic of the code or modifying a little content. In addition, signature-based detection methods have limitations in that it is impossible to diagnose new malicious codes in addition to previously analyzed malicious codes.

The heuristic detection technique has been proposed to overcome the disadvantage of detecting only the malicious codes studied in advance and difficulty in detecting mutated viruses. According to the heuristic detection technique, unlike the signature-based detection method which simply hashizes the file and verifies / compares the signature, any rule is used as a signature. In particular, in the case of dynamic heuristic detection, an executable file can be executed using an emulator. However, the heuristic detection technique has a disadvantage in that the detection rate may be slowed down and a search error such as a false positive is likely to occur.

In recent years, there has been a growing interest in the use of existing methods such as Entry-Point Obscuring (EPO) viruses, polymorphic viruses, and attacks using metamorphic malware or Advanced Persistent Threats (APT) Malicious codes, which are difficult to defend with the vaccine program, have greatly increased.

For example, a polymorphic virus is a virus that is infeasible when a file is infected, and it is difficult to confirm the infection. It inserts padding in the code and modifies the file so that the vaccine program is different from the signature To bypass the vaccine program. In addition, APT attacks are attacks using time differences (ie, zero-day vulnerabilities) until a security patch is issued after a problem is known to a program. These APT attacks are intelligent and advanced to specific targets, such as rootkit attacks that provide functionality for future intrusions (ie, backdoors, Trojans, etc.) while hiding intrusions after system intrusions. Attack is persistent for a long period of time.

As such, attacks by new types of malware can not be defended by traditional passive signature-based protection technologies, and thus require an advanced malware detection solution that plays a complementary role to various types of attacks.

In this regard, Korean Unexamined Patent Publication No. 10-0910761 (entitled "Atypical malicious code detection method and system using the process action prediction method and system thereof)", primary malicious code filtering A DB filtering module for performing the filtering process; A system resource monitor module for monitoring system resources to collect individual event information generated by execution codes executed in the system; A reprocessing module for reprocessing the individual event information collected by the system resource monitor module and reconstructing the integrated event information into a single integrated log indicating associative behavior property values of the execution codes; A behavior prediction information processing module for inputting an integrated log reconstructed from the remodeling module into a learning algorithm and extracting atypical malicious behavior feature values (prediction patterns); And an atypical malicious behavior detection module for detecting a malicious behavior by comparing the atypical malicious behavior feature value (predicted pattern) extracted from the behavior prediction information processing module with the behavior characteristic value data comprised in the rework module A malicious code detection system using a process behavior prediction technique is disclosed.

Disclosure of Invention Technical Problem [8] Accordingly, the present invention has been made keeping in mind the above problems occurring in the prior art, and it is an object of the present invention to provide a method and apparatus for cultivating malicious codes such as advanced viruses, super viruses and unknown viruses, And a malicious code detection apparatus and method capable of detecting malicious codes.

It should be understood, however, that the technical scope of the present invention is not limited to the above-described technical problems, and other technical problems may exist.

According to an aspect of the present invention, there is provided a malicious code detection apparatus comprising: a memory for storing a malicious code pool including a plurality of malicious codes and storing a malicious code culture and detection program; And a processor for executing the malicious code cultivation and detection program, wherein the processor, in response to the execution of the program, obtains one or more malicious codes from the malicious code pool and transforms the source code of the obtained malicious code The cultivation code is detected as malicious code through at least one predetermined vaccination program when the cultivation code is operated as a result of checking whether the cultivation code is operated or not, The culture code is discarded when the culture code is detected in at least one of the vaccine programs, and the culture code is added to the malicious code pool when the culture code is not detected, and the malicious code pool Is used as a database for detecting malicious codes.

According to another aspect of the present invention, there is provided a malicious code detection method using a malicious code detection apparatus, comprising: obtaining at least one malicious code from a malicious code pool including a plurality of malicious codes; Generating a new cultivation code by modifying or combining the obtained source code of the malicious code; Checking whether the cultivation cords are operating; Checking if the cultivation code is detected through at least one vaccine program set in advance, when the cultivation code is activated; And adding the culture code to the malicious code pool if the culture code is not detected in at least one of the vaccine programs and discarding the culture code if detected.

According to any one of the above-described tasks of the present invention, malicious codes newly cultured using previously known malicious codes can be used as malicious code detection criteria. Accordingly, it is possible to efficiently detect new or variant malicious codes that are not present or have not been detected through an existing vaccine program.

1 is a block diagram of a malicious code detection apparatus according to an embodiment of the present invention.
FIG. 2 is a diagram for explaining a malicious code culture method according to an embodiment of the present invention.
3 is a block diagram of a malicious code detection apparatus according to another embodiment of the present invention.
4 is a flowchart for explaining a malicious code detection method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between . Also, when an element is referred to as "comprising ", it means that it can include other elements as well, without departing from the other elements unless specifically stated otherwise.

Herein, the term " part " or " module " means a unit realized by hardware or software, a unit realized by using both, and a unit realized by using two or more hardware Or two or more units may be realized by one hardware.

1 is a block diagram of a malicious code detection apparatus according to an embodiment of the present invention.

1, a malicious code detection apparatus 100 according to an exemplary embodiment of the present invention includes a storage unit 110, a code culture unit 120, a code operation unit 130, a code checking unit 140, A code management unit 150, and a malicious code detection unit 160. [

The storage unit 110 stores a malware pool including a plurality of malicious codes.

The initial state of the malicious code pool (ie, the state before the addition of the newly cultivated malicious code) contains "known malicious code" previously registered on at least one vaccine program.

The storage unit 110 acquires additional registered malicious codes from at least one vaccine programs every predetermined period after the initial state, and updates the malicious code acquired from the vaccine programs to the malicious code pool. This process can be processed separately (in parallel) from the process of adding new malicious code that the malicious code detection apparatus 100 has cultivated itself.

The code culturing unit 120 acquires one or more malicious codes from the malicious code pool and performs a cultivation process of transforming or combining the source codes of the obtained malicious codes to generate new malicious codes Quot;).

Specifically, the code culturing unit 120 separates the source code by at least one of a code line unit, a function unit, and a semantic unit for each of at least one malicious code acquired from the malicious code pool. The code culturing unit 120 can randomly acquire at least one malicious code from the malicious code pool.

The code culturing unit 120 generates a cultivation code by modifying or combining the malicious code obtained from the malicious code pool on a separate unit basis.

For example, the code culturing unit 120 may generate the cultivation code by changing or deleting at least a part of the source code of any one of the obtained malicious codes. That is, the code culturing unit 120 may generate the cultivation code by individually modifying the acquired malicious codes, and may modify the malicious code by applying at least a part of other malicious codes to the malicious code.

On the other hand, the code culturing unit 120 may apply a genetic algorithm to a malicious code cultivation method to generate a new cultivation code by crossing two or more malicious codes.

At this time, the code culturing unit 120 acquires two or more malicious codes from the malicious code pool, generates a cultivation code by shuffling the obtained two or more pieces of malicious code-specific source codes by the separated units.

In this regard, a more detailed description will be given with reference to FIG. 2 below.

FIG. 2 is a diagram for explaining a malicious code culture method according to an embodiment of the present invention.

In FIG. 2, the code culturing unit 120 has acquired two malicious codes (that is, "malicious code A" and "malicious code B") from the malicious code pool. That is, the code culturing unit 120 processes the generated culture code by setting the acquired two malicious codes as parents and applying the genetic algorithm.

The code culturing unit 120 divides the acquired source codes of two or more malicious codes into a main function, a main function upper part, and a lower part of a main function, and shuffles at least a part of the source codes of two or more malicious codes in units of parts.

For example, as shown in FIG. 2, malicious codes A and B are divided into three parts, respectively. Here, 'Part A-1' and 'Part B-1' are the upper part of the main function ('main () -2 'and' Part B-2 'are the lower part of the main function. In general, the top of the main function includes functions before the main function, declarations in the process of importing the library, and global variables. And the bottom of the main function is the function after the main function.

The code culturing unit 120 can classify a code line, a function, and a semantic unit as a unit through which the computer can read and execute. Accordingly, the code culturing unit 120 can separate the top of the main function by code lines or by defined functions. The code culturing unit 120 separates the main function for each code line when the main function is recognizable for each code line as a global variable, and when a plurality of code lines such as a conditional statement and a loop statement form one block, .

According to the above, in FIG. 2, the upper part of the main function of the malicious code A is divided into three parts, the main function part can be separated into five parts, and the lower part of the main function is divided into two parts. In FIG. 2, the upper part of the main function of the malicious code B is divided into seven parts, and the main function part can be divided into seven parts. There is no code to separate the main function lower part. When shuffling the malicious codes A and B in FIG. 2 and changing the order of the separated units for each part, 10 units are included in the upper part of the main function and 12 units are included in the main function part , A new cultivation code can be generated that includes two units in the lower part of the main function.

The code culturing unit 120 shuffles outside the main function that does not include the main function without considering the code order, and shuffles the main function while maintaining the original order of the separated units. This is because, in a computer program, the code in the main function is typically read and processed in a top-down direction using a procedure-oriented method.

The code culturing unit 120 may combine the source codes of two or more malicious codes using various programming languages (e.g., C, Java, Python, Fortran, intermediate language, assembly, bit string, etc.).

The code operation unit 130 checks whether or not the cultured code cultured from the code incubator 120 is operable. At this time, the code operating unit 130 transmits the cultured code to the code checking unit 140 when the cultured code operates properly, and discards it if it does not operate.

When the cultivation code is operated, the code checking unit 140 checks whether the cultivation code is detected as a malicious code through at least one predetermined vaccination program.

The code checking unit 140 executes a vaccine program on at least one virtual machine in which different vaccine programs are installed, and checks whether the corresponding cultivation codes are detected as malicious codes. At this time, the code inspecting unit 140 may generate a signature of the cultured code determined to be operative, and may check whether the malicious code is detected through the vaccine program using the signature of the cultured code. For reference, the vaccine program may be a commercially available antivirus product. Also, the code checking unit 140 can generate a hash value such as MD5 or SHA1 of the file or a specific string in the code as a signature of the malicious code.

The code management unit 150 discards the cultivation code when the cultivation code is detected in at least one of the vaccination programs as a result of the inspection by the code inspection unit 140. If the culture code is not detected, the code management unit 150 transmits the cultivation code to the storage unit 110 Add it to the malware pool.

At this time, the code management unit 150 may add the culture code and the signature to the malicious code pool.

The malicious code detection unit 160 detects a malicious code by using a malicious code pool in which new culture codes are continuously updated as a malicious code detection database.

At this time, the malicious code detection unit 160 may execute an existing vaccine program, and may provide a malicious code pool as a database of the vaccine program.

Meanwhile, the malicious code detection apparatus 100 according to another embodiment of the present invention described above may be constituted by a memory and a processor. That is, each of the configurations of the malicious code detection apparatus 100 shown in FIG. 1 may be implemented by the memory 110 'and the processor 120' as shown in FIG.

3 is a block diagram of a malicious code detection apparatus according to another embodiment of the present invention.

As shown in FIG. 3, the malicious code detection device 100 'includes a memory 110' and a processor 120 '.

Specifically, the memory 110 'processes all the operations or procedures of the storage unit 110 described in FIG.

The memory 110 'stores the malicious code pool described above with reference to FIGS. 1 and 2, and stores various programs for processing malicious code cultivation and detection. At this time, the memory 110 'collectively refers to a non-volatile storage device that keeps stored information even when power is not supplied, and a volatile storage device that requires power to maintain stored information.

The memory 110 'stores a malicious code culture program for generating a new culture code by using a known malicious code stored in a malicious code pool, a malicious code pool having a newly cultivated malicious code (i.e., a cultivation code) A malicious code detection program for providing a malicious code detection database is stored. The malicious code cultivation program and the malicious code detection program may be composed of one program linked to each other, or may be composed of separate programs which are interlocked and processed.

The processor 120 'executes a malicious code cultivation program and a detection program stored in the memory 110' to perform various processes according to the programs.

At this time, the processor 120 'performs all the operations or procedures of the code culturing unit 120, the code operating unit 130, the code checking unit 140, the code managing unit 150 and the malicious code detecting unit 160 described in FIG. .

Specifically, the processor 120 'executes a malicious code cultivation program to perform the following processing.

The processor 120 'acquires one or more malicious codes from the malicious code pool and performs a cultivation process to transform or combine the source code of the obtained malicious code to generate a new malicious code (i.e., a' cultivation code ').

At this time, the source code of the obtained malicious code may be separated based on at least one of a code line unit, a function unit, and a semantic unit, and the obtained malicious code may be modified or combined for each of the separated units to generate a culture code.

The processor 120 'then checks whether the generated cultivation code is actually working or not. The processor 120 'then checks if the incubation code is detected as malicious code through at least one vaccination program if the incubation code is operating properly. At this time, the processor 120 'discards the generated culture code if it does not operate. In addition, the processor 120 'may process the incubation code operational and vaccine tests on the virtual machine to protect the system and prevent conflicts between the vaccine programs.

Next, when the cultivation code is detected through the vaccine program, the processor 120 'discards the cultivation code since it is already known malicious code. On the other hand, the processor 120 'adds the incubation code to the malicious code pool when the incubation program does not detect the incubation code.

That is, the newly generated culture code is a malicious code (for example, super virus) that is not registered as a malicious code in a conventional vaccine program or a malicious code that does not yet exist, which is likely to occur later. Can be used as a reference. To this end, the processor 120 'may be configured to detect malicious code using the malicious code pool in which the cultivation code is constantly updated as a malicious code detection database, or to allow the malicious code pool to be used as a database of at least one vaccine program Can be controlled.

In addition, the processor 120 'obtains additional registered malicious codes from at least one vaccine programs every predetermined period after the initial state of the malicious code pool, updates the malicious code acquired from the antivirus programs to the malicious code pool can do.

Hereinafter, a malicious code detection method using the malicious code detection apparatus according to an embodiment of the present invention will be described in detail with reference to FIG.

4 is a flowchart for explaining a malicious code detection method according to an embodiment of the present invention.

First, one or more malicious codes are obtained from a malicious code pool including a plurality of malicious codes (S410).

At this time, the malicious code pool contains "known malicious codes" registered for each vaccine program linked in advance, and new malicious codes cultivated using the malicious codes included in the malicious code pool are continuously added.

Next, a new malicious code (i.e., a cultured code) is cultured by modifying or combining the obtained source code of the malicious code (S420).

At this time, the source code of the obtained malicious code may be separated based on at least one of a code line unit, a function unit, and a semantic unit, and the obtained malicious code may be modified or combined for each of the separated units to generate a culture code.

For example, at least a part of the source code of any one of the obtained malicious codes may be changed or deleted to generate the cultivation code. In addition, two or more malicious code-specific source codes obtained from the malicious code pool may be shuffled by the separated units to generate a culture code. At this time, the obtained two or more pieces of malicious code-specific source codes are divided into a main function, a main function upper part and a plurality of parts divided into a lower part of the main function, and at least a part of two or more pieces of malicious code- You can generate code. Also, the inside of the main function of the source code can be shuffled while maintaining its own order, and the outside of the main function can be shuffled regardless of the order.

Then, it is checked whether or not the incubation code is operating (S430).

If it is determined that the cultivation code is operable, if the cultivation code does not work properly, the corresponding code is discarded (S440).

On the other hand, if the incubation code is operated, the incubation code is input to at least one vaccination program set in S450, and the incubation code is detected through at least one vaccination program (S460).

At this time, it is possible to prevent a collision between a plurality of vaccine programs and to process the inspection on a plurality of virtual machines for safety in system operation. At this time, one antivirus program is installed in each virtual machine.

If the cultivation code is detected as malicious code in at least one vaccination program as a result of the inspection in step S460, it is discarded (S470).

On the other hand, if the cultivation code is not detected as a malicious code as a result of the inspection in step S460, the malicious code pool is added to the malicious code pool (S480).

At this time, it is possible to process a step of generating a signature in the case of a cultured code that operates properly before the step S450. In the step S460, whether a malicious code is detected through a vaccine program using the signature of the cultured code Can be inspected.

If the malicious code is checked using the signature, the malicious code pool may be matched with the corresponding cultivation code and signature in step S480.

Then, the malicious code pool in which the cultivation code is added is used as the malicious code detection database to detect malicious code (S490).

The malicious code detection apparatus and method according to an embodiment of the present invention may be implemented in the form of a recording medium including instructions executable by a computer such as a program module executed by a computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, the computer-readable medium can include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes any information delivery media, including computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transport mechanism.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

The scope of the present invention is defined by the appended claims rather than the detailed description and all changes or modifications derived from the meaning and scope of the claims and their equivalents are to be construed as being included within the scope of the present invention do.

100, 110 ': malicious code detection device 110:
120: code culturing unit 130: code operating unit
140: code checking unit 150: code managing unit
160: Malicious code detection unit 110 ': Memory
120 ': Processor

Claims (14)

In a malicious code detection device,
A memory storing a malicious code pool including a plurality of malicious codes and storing a malicious code cultivation and detection program; And
And a processor for executing the malicious code cultivation and detection program,
Wherein the processor obtains one or more malicious codes from the malicious code pool in response to the execution of the program and generates a new culture code by modifying or combining the obtained source code of the malicious code to determine whether the culture code is operating And checking whether the cultivation code is detected as malicious code through at least one preset vaccination program when the cultivation code is operated as a result of checking whether or not the cultivation code is detected, Discarding the culture code if it is detected, adding the culture code to the malicious code pool if not detected,
The malicious code pool to which the culture code is added is used as a malicious code detection database.
The method according to claim 1,
The processor comprising:
Malicious code detection that separates the obtained source code of the obtained malicious code based on at least one of a code line unit, a function unit and a semantic unit and generates a cultured code by transforming or combining the obtained malicious code by the separated unit Device.
3. The method of claim 2,
The processor comprising:
And changing or deleting at least a part of the source code of any one of the acquired malicious codes to generate a cultivation code.
3. The method of claim 2,
The processor comprising:
Wherein the malicious code generation unit obtains two or more malicious codes from the malicious code pool and divides the acquired two or more malicious code source codes into a main function, a main function upper part, and a main function lower part, Shuffling at least a portion of the codes,
Wherein the main function is shuffled while maintaining its own internal order and shuffling the outside of the main function in any order.
The method according to claim 1,
The processor comprising:
A malicious code detection device for detecting said cultivation codes on at least one virtual machine in which different vaccine programs are installed.
The method according to claim 1,
The processor comprising:
Generating a signature of the cultured code that is determined to be operative as a result of the operation; checking whether the malicious code is detected through the vaccine program using the signature of the cultured code;
And adding the cultivation code and the signature to the malicious code pool when the cultivation code is not detected as malicious code.
The method according to claim 1,
The malicious code pool in the initial state includes known malicious codes previously registered on at least one vaccine program,
The processor comprising:
And acquires additional registered malicious codes from at least one vaccine programs every predetermined period after the initial state and updates the obtained malicious codes to the malicious code pool.
A malicious code detection method using a malicious code detection device,
Obtaining one or more malicious codes from a malicious code pool including a plurality of malicious codes;
Generating a new cultivation code by modifying or combining the obtained source code of the malicious code;
Checking whether the cultivation cords are operating;
Checking if the cultivation code is detected through at least one vaccine program set in advance, when the cultivation code is activated; And
Adding the culture code to the malicious code pool if the culture code is not detected in at least one of the vaccine programs and discarding the culture code if detected.
9. The method of claim 8,
Detecting malicious code using the malicious code pool to which the cultivation code is added as a malicious code detection database.
9. The method of claim 8,
Wherein the step of generating the new cultivation code comprises:
Separating the source code of the obtained malicious code based on at least one of a code line unit, a function unit and a semantic unit; And
And generating the cultivation code by transforming or combining the obtained malicious code for each of the separated units.
11. The method of claim 10,
Wherein the step of generating the culture code by modifying or combining the separated units comprises:
And changing or deleting at least a part of the source code of any one of the obtained malicious codes to generate the cultivation code.
11. The method of claim 10,
Wherein the step of generating the new cultivation code comprises:
Dividing the two or more malicious code source codes obtained from the malicious code pool into a plurality of parts respectively divided into a main function, a main function upper part and a lower main function part; And
And shuffling at least a part of the two or more pieces of malicious code-specific source codes on a part-by-part basis,
Wherein the main function is shuffled while maintaining its own internal order and shuffling the outside of the main function in any order.
9. The method of claim 8,
Wherein the step of verifying that the culturing code is detected through the at least one vaccine program comprises:
And detecting said cultivation code on at least one virtual machine in which different vaccine programs are installed.
9. The method of claim 8,
Prior to the step of checking whether the incubation code is detected via the at least one vaccine program,
Further comprising generating a signature of the cultured code determined to be operative,
A malicious code is checked through the vaccine program using the signature of the cultivation code,
And adding the cultivation code and the signature to the malicious code pool when the cultivation code is not detected as a malicious code.

Images