KR20190070681A - A method and apparatus for preventing ransomware using blockchain - Google Patents

Abstract

Disclosed are a method and an apparatus for preventing ransomware using a block chain. According to one embodiment of the present invention, the method for preventing ransomware comprises the following steps: collecting anomaly symptom data related to ransomware from a plurality of peers; using the collected anomaly symptom data and generating a data block; connecting the data block to an existing data block and generating a block chain; and using the block chain and sharing the anomaly symptom data to the peers.

Description

TECHNICAL FIELD [0001] The present invention relates to a method and apparatus for preventing random-

The following embodiments relate to a method and apparatus for preventing random software using a block chain.

Cyber threats are evolving with the characteristics of intelligence and special purpose. Companies using proprietary mail systems are becoming targets of cyber threats such as Advanced Persistent Threat (APT), and individual attention needs to be paid to individual employees.

Such cyber threats are mainly addressed using human psychology in a social engineering way, so it is difficult to prevent by simple spam blocking technology. Therefore, additional filtering and intensive and ongoing monitoring of the suspected mail information is required.

Embodiments can provide a technique for preventing Ransomware using a block chain.

According to an embodiment of the present invention, there is provided a method for preventing an Ramsomware comprising the steps of: collecting abnormality symptom data related to Ransomware from a plurality of peers; generating a data block using collected abnormality symptom data; Generating a block chain by connecting a block to an existing data block; and sharing the abnormal symptom data by using the block chain.

The plurality of peers may include a commuting peer using a mail system, an endorsing peer for verifying the abnormal symptom data, and a sorting peer for sorting the abnormal symptom data in order .

The abnormality symptom data may include at least one of a mail IP (Internet Protocol) address, a domain name server address, routing information until reaching the mail recipient, mail notifying time, mail transmission server unique notation, actual mail address of the mail sender, An actual PC (Personal Computer) IP address of the mail server, the content of the mail body, and an attachment file in the mail.

The collecting may include automatically collecting the anomalous symptom data for an external mail, or manually collecting the anomalous symptom data by notification of each of the plurality of peers.

The step of generating the data block may include verifying the anomalous symptom data through the plurality of peers.

The step of generating the block chain may include concatenating the data blocks by possessing a hash value of the existing data block.

The step of generating the block chain may further comprise transmitting and verifying the data block to the peers.

The step of collecting the abnormality symptom data and the step of generating the data block may be repeatedly performed every block generation cycle.

The anti-virus protection method may further comprise setting a security policy using the block chain.

According to an embodiment of the present invention, a random access protection apparatus includes a collector for collecting abnormality symptom data related to a random access from a plurality of peers, a data block generation unit for generating a data block using the collected abnormality data, And a controller for generating a block chain by connecting to an existing data block and sharing the abnormality symptom data by using the block chain to share the abnormality symptom data by using the block chain. A block generator for generating a block chain by connecting the data block to an existing data block, and a router for sharing the abnormal symptom data with the block chain using the block chain.

The plurality of peers may include a commuting peer using a mail system, an endorsing peer for verifying the abnormal symptom data, and a sorting peer for sorting the abnormal symptom data in order .

The abnormality symptom data may include at least one of a mail IP (Internet Protocol) address, a domain name server address, routing information until reaching the mail recipient, mail notifying time, mail transmission server unique notation, actual mail address of the mail sender, An actual PC (Personal Computer) IP address of the mail server, the content of the mail body, and an attachment file in the mail.

The collector may automatically collect the anomalous symptom data for external mail or manually collect the anomalous symptom data by reporting each of the plurality of peers.

The block generator may verify the anomalous symptom data through the plurality of peers.

The block chain generator may concatenate the data blocks by possessing a hash value of the existing data block.

The block-chain generator may send the data block to the peers for verification.

The collector and the block generator may collect the abnormal symptom data repeatedly for each block generation period and generate the data block using the collected abnormal symptom data.

The controller may further include a security configurer for setting a security policy using the block chain.

1 shows a schematic block diagram of an anti-rheumware protection device according to an embodiment.
Fig. 2 shows a schematic block diagram of the controller shown in Fig.
Fig. 3 shows an example of the operation of the anti-virus protection apparatus shown in Fig.
4 shows an example of the operation of the collector shown in Fig.
Fig. 5 shows a flowchart of the operation of the anti-tamper protection apparatus shown in Fig.

It is to be understood that the specific structural or functional descriptions of embodiments of the present invention disclosed herein are presented for the purpose of describing embodiments only in accordance with the concepts of the present invention, May be embodied in various forms and are not limited to the embodiments described herein.

Embodiments in accordance with the concepts of the present invention are capable of various modifications and may take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. However, it is not intended to limit the embodiments according to the concepts of the present invention to the specific disclosure forms, but includes changes, equivalents, or alternatives falling within the spirit and scope of the present invention.

The terms first, second, or the like may be used to describe various elements, but the elements should not be limited by the terms. The terms may be named for the purpose of distinguishing one element from another, for example without departing from the scope of the right according to the concept of the present invention, the first element being referred to as the second element, Similarly, the second component may also be referred to as the first component.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between. Expressions that describe the relationship between components, for example, "between" and "immediately" or "directly adjacent to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms " comprises ", or " having ", and the like, are used to specify one or more of the features, numbers, steps, operations, elements, But do not preclude the presence or addition of steps, operations, elements, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning of the context in the relevant art and, unless explicitly defined herein, are to be interpreted as ideal or overly formal Do not.

A module in this specification may mean hardware capable of performing the functions and operations according to the respective names described in this specification and may mean computer program codes capable of performing specific functions and operations , Or an electronic recording medium, e.g., a processor or a microprocessor, equipped with computer program code capable of performing certain functions and operations.

In other words, a module may mean a functional and / or structural combination of hardware for carrying out the technical idea of the present invention and / or software for driving the hardware.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, the scope of the patent application is not limited or limited by these embodiments. Like reference symbols in the drawings denote like elements.

1 shows a schematic block diagram of an anti-rheumware protection device according to an embodiment.

Referring to FIG. 1, the random access protection device 10 collects abnormal symptom data from a plurality of peers participating in the network and constructs a block chain using the collected data to prevent random software .

The anti-virus protection device 10 can share the collected data to a plurality of peers. Each peer can use the shared data to guard against Ransomware risks.

The anti-spyware protection device 10 can analyze attacks using various social engineering techniques of Ransomware and set security policies based on the analysis results.

The security officer can analyze the newly updated information from network participants and analyze and prevent attacks using Ransomware, such as Advanced Persistent Threat (APT), using the anti-spyware device 10. [ By sharing and updating information to a plurality of peers participating in the network using the block chain in which the anti-spyware protection device 10 is configured, each of the peers can recognize the threat information and prevent the riskware.

The anti-spyware protection device 10 can collect, collect, and share anomalous symptom data for mail users and security officers in the enterprise. The anti-spyware protection device 10 can continuously and automatically provide a mail system for preventing anomalous signs and cyber threat information on the RANSAWARE using a block chain.

The plurality of peers may include a network participant or a node of the network. The plurality of peers may include a committing peer using a mail system, an endorsing peer for verifying abnormal symptom data, and an odering peer for arranging the abnormal symptom data in order . For example, usually the peers may be corporate mail system users, and the verification peer and sorting peer may be enterprise security personnel.

Each peer can be set up as a normal peer, a verification peer, or an alignment peer depending on the purpose of the project to clarify the block chain process. For example, if a new transaction is entered, the verification peer can perform consensus and verification, and the sorting peer can perform the sort to collect the transaction into blocks and form a block chain.

The anomaly data may include information such as a mail IP (Internet Protocol) address, a domain name server address, routing information that has reached the mail recipient, mail notation time, mail transmission server unique notation, actual mail address of the mail sender, A personal computer (PC) IP address, the content of the mail body, and an attachment in the mail.

The anti-spyware protection device 10 includes a collector 100 and a controller 200.

The collector 100 may collect abnormal symptom data associated with Ransomware from a plurality of peers.

The collector 100 may collect the anomalous symptom data automatically for the external mail or manually collect the anomalous symptom data by reporting each of the plurality of peers.

The controller 200 generates a data block using the collected abnormality data, connects the data block to the existing data block to generate a block chain, and uses the block chain to share the abnormal symptom data. have.

Fig. 2 shows a schematic block diagram of the controller shown in Fig.

Referring to FIG. 2, the controller 200 may include a block generator 210, a block chain generator 230, a router 250, and a security configurer 270.

The block generator 210 may generate the data block using the collected abnormality data. The block generator 210 may verify abnormal symptom data through a plurality of peers.

The collector 100 and the block generator 210 collect the abnormal symptom data repeatedly for each block generation period and generate the data block using the collected abnormal symptom data.

The block chain generator 230 may generate a block chain by connecting a data block to an existing data block. The block-chain generator 230 may concatenate data blocks by owning a hash value of an existing data block.

The block chain generator 230 may send the data block to the peers for verification.

The block chain can collect update information, such as new processing and transaction of only designated peers, by agreeing to each peer based on specific conditions and time. The block chain may be structured such that each block collects such data on a block-by-block basis, and refers to a unique hash value of the previous block in order to prevent data from being overwritten.

Each peer owns a block chain, and information about it can be automatically shared whenever a new process is updated or a block is created. Block chaining is called distributed ledger technology, and it has the advantage that it is robust against stray modulation, peers are dispersed to discuss consensus, and peers share information.

The block chain can be used to verify, record, and archive data in a network, without storing data on a central server, ensuring the integrity and reliability of the data without having to be authorized by a third party.

The block chain can have the types shown in Table 1.

Public
Block chain Consortium
Block chain Private
Block chain Management subject All participants Consortium participants Manager of the institution Governance Difficulty in changing the rule Change the law according to consortium agreement Change the rule according to manager's decision Transaction speed Slow speed Very fast Data access Accessible to anyone Access only to authorized users Access only to authorized users Identification Anonymity Identifiable Identifiable Use case Bit coin R3 CEV NASDAQ's unlisted stock exchange

The block chain generator 230 may generate one type of block chain in consideration of the purpose of utilization of the system and the block chain, utilization environment, and utilization range. The block chain generator 230 may set the type of the block chain according to the range and access right of the participants.

The router 250 can share the abnormal symptom data by using the block chain.

The security configurer 270 may set a security policy using a block chain.

Fig. 3 shows an example of the operation of the anti-tamper protection apparatus shown in Fig. 1, and Fig. 4 shows an example of the operation of the collector shown in Fig.

Referring to FIGS. 3 and 4, when the collector 100 receives an external mail, it can automatically collect anomalous symptom data. The collector 100 may collect abnormal symptom data by reporting each of a plurality of peers.

For example, the collector 100 can automatically and passively collect abnormal symptom data from the randomware and malicious mail that are passed through the firewall of the mail server based on the mail server and system in the enterprise.

Since the block chain is a technique of collecting data collectively from a plurality of nodes, the collector 100 can select a data item to be collected into a block chain in order to prevent randomware using a block chain.

The block chain can be complicated by performing consensus and aggregation of event occurrence by several users. Therefore, to prevent Ransomware for a block chain, the direction of static detection through reputation, signature, and automotive data may be more efficient than a dynamic prevention method that performs the execution and testing in advance in the system .

Data items to be collected from a plurality of peers participating in a block-chain network can be defined as abnormality symptom data related to the random software. For example, the abnormality symptom data may be composed of items as shown in Table 2. [

Item Explanation Internet Protocol (IP) address Mail IP address Domain Name Server address Domain Name Server Address Received by Routing information that has passed through the mail recipient Date Mail notation time Message-ID Mail delivery server unique notation X-Original-MAILFROM The actual email address of the sender X-Original-IP The actual PC (Personal Computer) IP address of the originator of the message. Text Contents of mail body filename In-mail attachments

The collector 100 can automatically collect the abnormality symptom data based on the external mail address instead of the internal mail address. In addition, the collector 100 may collect manually reported abnormality symptom data when an internal mail user reports a specific mail.

Block generator 210 may verify malicious mail or Ransomware based on the item data of Table 2. [

For example, the block generator 210 may determine malicious mail if mail sent from the outside has a modified mail address and an IP address. In addition, the block generator 210 may determine that the mail is malicious if the mail marking time is not the business time or follows the foreign time marking. The block generator 210 can judge from malicious e-mail whether or not the content of the body of the e-mail and the attachment file use a social engineering technique that can be shared with various people.

In addition, the block generator 210 can verify the random software by combining the abnormality symptom data items independently, or by AND and OR logic.

The block generator 210 can perform verification when newly generated data from the peers of the block chain are mapped to each other. The block generator 210 may collect data generated from peers that are block generation period block chains to generate blocks.

The collector 100 and the block generator 210 may collect abnormal symptom data and generate blocks for each block generation period. For example, a block generation die may be in units of minutes.

The block chain generator 230 can generate and update anomaly data that is automatically and passively collected in a block chain.

Each block has a unique hash value and can be concatenated by possessing the hash value of the previous block together. The block chain generator 230 may connect the blocks to each other to generate a block chain of a linked list structure.

The block-chain generator 230 may perform re-verification by transmitting the connected block to each of the peers again.

Block chain generator 230 may send a fully verified block to the block chain of each of the peers. Thus, the original block chain and the block chain of peers can share the same data.

For example, the block chain generated by the block chain generator 230 may have the configuration shown in Table 3.

Block Chain Type Private block chain manager Corporate Security Officer Block Chain Network Participants Corporate mail system users Rule management Manage rules according to security officer Data item Ransomware anomalous data

Since the block chain generator 230 has a special purpose to prevent the Ransomware targeting the enterprise, it can create a private block chain suitable for a company with a relatively small and closed structure.

The private block chain can be managed by the security officer of the enterprise, and the security officer of the enterprise can construct the chain code, which is the program code, and apply it to the block chain, so that the block chain can contain specific data items and control it in detail.

The block chain generator 230 may update transactions in the block chain based on the anomalous data collected automatically or manually from the collector 100. [

The router 250 may share the abnormality symptom data in the mail system every time abnormality symptom data is updated in the block chain. Multiple peers use shared anomaly data to prevent Ransomware, and security personnel can enforce Web firewalls and security solutions based on anomalous sign data.

The security configurer 270 may use the shared abnormality data to create security control data or defend APT attacks. The security configurer 270 may use block chains to support security related decisions of each peer.

Fig. 5 shows a flowchart of the operation of the anti-tamper protection apparatus shown in Fig.

The collector 100 may automatically collect abnormal symptom data from external mail or manually collect anomalous symptom data by reporting each of the peers to suspicious mail.

The collector 100 can collect the anomalous symptom data on a transaction-by-transaction basis by negotiating a plurality of peers. The collector 100 may request a plurality of peers to collect abnormal symptom data from a plurality of peers.

The block generator 210 may collect the abnormal symptom data collected from the plurality of peers to generate a block.

The block generator 210 may store abnormal symptom data in a database containing raw data by referring to a key value of the block.

The block chain generator 230 may transmit information about the generated blocks to a plurality of peers, and the plurality of peers 230 may update the individual block chains based on the transmitted information.

The router 250 may share the danger information using the generated block chain.

The security setting unit 270 can access the database containing the real data and can load the real data information. The security configurer 270 may set a security policy based on the real data. For example, the security configurer 270 may perform long-term data analysis based on the anomalous sign data to detect and prevent APT attacks.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (18)

Collecting abnormality symptom data related to Ransomware from a plurality of peers;
Generating a data block using the collected abnormality symptom data;
Connecting the data block to an existing data block to generate a block chain; And
And sharing the abnormal symptom data by using the block chain
The method comprising the steps of:
The method according to claim 1,
Wherein the plurality of peers comprises:
A commuting peer using the mail system, an endorsing peer for verifying the abnormal symptom data, and a sorting peer for sorting the abnormal symptom data in order,
The method comprising the steps of:
The method according to claim 1,
The abnormality symptom data includes,
Mail address, the domain name server address, the routing information that has reached the mail recipient, the mail notifying time, the mail transmission server unique notation, the actual mail address of the mail sender, the actual PC of the mail sender ) IP address, contents of mail body and attachment in mail
The method comprising the steps of:
The method according to claim 1,
Wherein the collecting comprises:
Automatically collecting the anomalous symptom data for an external mail; or
Manually collecting the anomalous symptom data by reporting each of the plurality of peers
The method comprising the steps of:
The method according to claim 1,
Wherein the step of generating the data block comprises:
Verifying the anomalous symptom data through the plurality of peers
The method comprising the steps of:
The method according to claim 1,
Wherein the step of generating the block chain comprises:
Connecting the data block by possessing a hash value of the existing data block
The method comprising the steps of:
The method according to claim 6,
Wherein the step of generating the block chain comprises:
Transmitting the data block to the peers and verifying
Further comprising the steps of:
The method according to claim 1,
Collecting the anomalous symptom data and generating the data block comprises:
Is repeatedly performed every block generation cycle
How to prevent ransomware.
The method according to claim 1,
Setting a security policy using the block chain
Further comprising the steps of:
A collector for collecting abnormal symptom data associated with the Ramsomware from a plurality of peers; And
A controller for generating a data block by using the collected abnormality data, generating a block chain by connecting the data block to an existing data block, and sharing the abnormality symptom data by using the block chain,
Lt; / RTI >
The controller comprising:
A block generator for generating a data block using the collected abnormality data;
A block chain generator for connecting the data block to an existing data block to generate a block chain; And
A router for sharing the abnormality symptom data by using the block chain,
And an anti-virus protection device.
11. The method of claim 10,
Wherein the plurality of peers comprises:
A commuting peer using the mail system, an endorsing peer for verifying the abnormal symptom data, and a sorting peer for sorting the abnormal symptom data in order,
And an anti-virus protection device.
11. The method of claim 10,
The abnormality symptom data includes,
Mail address, the domain name server address, the routing information that has reached the mail recipient, the mail notifying time, the mail transmission server unique notation, the actual mail address of the mail sender, the actual PC of the mail sender ) IP address, contents of mail body and attachment in mail
Wherein the at least one of the plurality of devices comprises at least one of:
11. The method of claim 10,
The collector includes:
The abnormality symptom data is automatically collected for the external mail or the abnormality symptom data is manually collected by the notification of each of the plurality of peers
Anti-virus protection device.
11. The method of claim 10,
Wherein the block generator comprises:
And verifying the anomalous symptom data through the plurality of peers
Anti-virus protection device.
11. The method of claim 10,
Wherein the block-
And connecting the data block by possessing a hash value of the existing data block
Anti-virus protection device.
16. The method of claim 15,
Wherein the block-
Send the data block to the peers and verify
Anti-virus protection device.
11. The method of claim 10,
The collector and the block generator,
Collects the abnormal symptom data repeatedly at every block generation period, and generates the data block using the collected abnormal symptom data
Anti-virus protection device.
11. The method of claim 10,
The controller comprising:
A security setting unit for setting a security policy using the block chain;
Further comprising:

Images