KR20200037472A - Malware cross analysis system and method for operating the same - Google Patents

Abstract

Disclosed is a malicious code cross analysis system which can enhance security. According to an embodiment of the present invention, the malicious code cross analysis system comprises: a cross analysis unit analyzing a file by using each of a plurality of security solutions; a collection unit receiving the file from a user terminal, requesting analysis for the file to the analysis unit, receiving a result of the analysis of each of the plurality of security solutions from the analysis unit, and determining whether the file is infected with a malicious code based on the result of the analysis of each of the plurality of security solutions; and a processing unit transmitting a hash value of the malicious code, a file name, a deletion command, and information on whether a network is isolated to the user terminal if it is determined that the file is infected with the malicious code by the collection unit.

Description

Malware cross-analysis system and its operation method {MALWARE CROSS ANALYSIS SYSTEM AND METHOD FOR OPERATING THE SAME}

The embodiments below relate to cross-analysis of malicious code.

Recently, malicious code is hidden in files and distributed, causing damage. In order to reduce such damage, a technology for accurately detecting malicious code is required.

As a related prior art, there is Korean Patent Registration No. 10-1060596 (name of invention: malicious file detection system, malicious file detection device and method, and applicant: Korea Electronics and Telecommunications Research Institute). In the registered patent publication, a virtualization window corresponding to the executable file collected on the network is allocated, and then executed through the virtualization program, the operation status of the execution file is monitored, and the result of the monitored operation status is analyzed to be malicious. After determining whether a file is a file, by providing malicious file information including a malicious file, a content for easily determining the presence or absence of a malicious file through an operation state analysis by executing an executable file through a virtualization program is disclosed.

The malicious code cross-analysis system according to one side includes a cross-analysis unit that analyzes a file using each of a plurality of security solutions; Receiving the file from the user terminal, requesting the analysis of the file to the analysis unit, receiving the analysis results of each of the plurality of security solutions from the analysis unit, analysis results of each of the plurality of security solutions A collection unit that determines whether the file is infected with a malicious code based on the; And a processing unit transmitting the hash value of the malicious code, a file name, a deletion command, and network isolation to the user terminal when it is determined that the file is infected with the malicious code by the collection unit.

When the file is received from the user terminal, the collection unit may check whether the file corresponds to a malicious code-infected file, and when it is determined that the file does not correspond to a malicious code-infected file, analyzes the file. You can ask the analysis department.

The collection unit may store the file in a database when it is determined that the file is not infected with the malicious code.

The malicious code cross-analysis system according to one side may further include a database in which at least one file determined by the collection unit is not infected with the malicious code in the past.

The malicious code cross-analysis system according to one side acquires one or more scan results for whether at least one file stored in the database is infected with the malicious code, and at least one stored in the database based on the obtained scan results It may further include a regression diagnostic engine to determine whether the file is infected with the malicious code.

The obtained inspection result can be obtained through the latest analysis technique.

A method of operating a malicious code cross-analysis system according to one side includes receiving a file from a user terminal; Analyzing the file using each of a plurality of security solutions; Determining whether the file is infected with malicious code based on an analysis result of each of the plurality of security solutions; And when it is determined that the file is infected with the malicious code, transmitting the hash value of the malicious code, a file name, a deletion command, and network isolation to the user terminal.

The operation method of the malicious code cross-analysis system according to one side may further include determining whether the file corresponds to a malicious code-infected file when the file is received from the user terminal, and analyzing the file The step may include analyzing the file when it is determined that the file does not correspond to a malicious code infected file.

The operation method of the malicious code cross-analysis system according to one side may further include storing the file in a database when it is determined that the file is not infected with the malicious code.

The method of operating a malicious code cross-analysis system according to an aspect includes obtaining one or more scan results of whether at least one file stored in a database is infected with the malicious code; And determining whether at least one file stored in the database is infected with the malicious code based on the obtained scan result.

The obtained inspection result can be obtained through the latest analysis technique.

At least one file stored in the database may have been determined not to be infected with the malicious code in the past.

Embodiments can cross-analyze if one or more files are infected with one or more malware through a plurality of security solutions, so that advanced persistent threats (APTs) based on known and / or unknown malware Countermeasures and increase security.

1 is a diagram for explaining a malicious code cross-analysis system according to an embodiment.
2 is a diagram for explaining a multiple cross analysis engine in a malicious code cross analysis system according to an embodiment.
3 is a diagram for describing a regression diagnosis engine in a malicious code cross-analysis system according to an embodiment.
4 is a flowchart illustrating a method of operating a malicious code cross-analysis system according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, various changes may be made to the embodiments, and the scope of the patent application right is not limited or limited by these embodiments. It should be understood that all modifications, equivalents, or substitutes for the embodiments are included in the scope of rights.

The terms used in the examples are for illustrative purposes only and should not be construed as limiting. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this specification, the terms "include" or "have" are intended to indicate the presence of features, numbers, steps, actions, components, parts or combinations thereof described herein, one or more other features. It should be understood that the existence or addition possibilities of fields or numbers, steps, operations, components, parts or combinations thereof are not excluded in advance.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person skilled in the art to which the embodiment belongs. Terms such as those defined in a commonly used dictionary should be interpreted as having meanings consistent with meanings in the context of related technologies, and should not be interpreted as ideal or excessively formal meanings unless explicitly defined in the present application. Does not.

In addition, in the description with reference to the accompanying drawings, the same reference numerals are assigned to the same components regardless of reference numerals, and redundant descriptions thereof will be omitted. In describing the embodiments, when it is determined that detailed descriptions of related known technologies may unnecessarily obscure the subject matter of the embodiments, detailed descriptions thereof will be omitted.

1 is a diagram for explaining a malicious code cross-analysis system according to an embodiment.

Referring to FIG. 1, the malicious code cross-analysis system 100 according to an embodiment includes a multiple cross-analysis engine 110 and a regression diagnosis engine 120.

The multiple cross-analysis engine 110 collects files from at least one end point and network. The endpoint can be represented differently by a user terminal such as a user PC. The file may include, for example, an executable file, a document file, and the like. The file is not limited to the examples described above.

The multiple cross analysis engine 110 analyzes a file using each of a plurality of security solutions. Each of the plurality of security solutions represents a solution that detects whether there is malicious code in the corresponding file. In one embodiment, each vendor of a plurality of security solutions is different. In other words, the multiple cross-analysis engine 110 analyzes files using security solutions of different vendors. In one example, if a multiple cross-analysis engine 110 has a vendor A security solution, a vendor B security solution, and a vendor C security solution, the multiple cross-analysis engine 110 is the vendor A security solution, the vendor B You can analyze the files by running each of the security solutions of Vendor C and the security solutions of Vendor C.

The multiple cross analysis engine 110 determines whether the file is infected with malicious code based on the analysis result of each of the plurality of security solutions. When it is determined that the file is not infected with malicious code, the multi-cross analysis engine 110 stores the file in the database. As will be described later, the file is then checked for infection by malicious code by precise analysis of the regression diagnosis engine 120. When the cross-analysis engine 110 determines that a file is infected with malicious code, the multi-cross analysis engine 110 corresponds to any one or a combination of hash value of the malicious code, the malicious code file name, and IP (internet protocol) address information of the host of the malicious code. Transfer to the endpoint corresponding to the destination of the file. The endpoint may delete the file or suspend the execution of the file based on the hash value of the malicious code and / or the file name of the malicious code, and isolate the host from the network to block the spread to the surroundings.

The regression diagnosis engine 120 analyzes one or more files stored in the database of the multiple cross-analysis engine 110 to check whether the corresponding file is infected with malicious code. These tests took into account the situation where they penetrated the network after bypassing the analysis using new techniques. In other words, the malicious code can evade the analysis technology and the malicious code may not be searched by the multiple cross-analysis engine 110. In this case, the multiple cross-analysis engine 110 may include a file containing the malicious code. Can be determined as normal. The regression diagnosis engine 120 may precisely analyze one or more files that the multiple cross-analysis engine 110 has determined to be normal in the past using the latest analysis method to check whether the corresponding files are infected with malicious code. As an example, the regression diagnosis engine 120 may check whether the corresponding file is infected with the malicious code using static / dynamic / reputation analysis using one or more files in the form of code, sandbox, and the latest malicious code DB. Accordingly, damage caused by the malicious code may be minimized or absent, and the reliability of the malicious code cross-analysis system 100 may be improved.

2 is a diagram for explaining a multiple cross analysis engine in a malicious code cross analysis system according to an embodiment.

Referring to FIG. 2, the multiple cross analysis engine 110 includes a collection unit 210, a database 220, a cross analysis unit 230, and a processing unit 240.

The collection unit 210 collects or receives one or more files from one or more endpoints and / or networks.

According to an embodiment, when the collection unit 210 collects or receives a file, it may determine whether the corresponding file corresponds to a malicious code-infected file. As an example, the collection unit 210 may check whether the corresponding file corresponds to a malicious code infected file based on pre-stored indicators of compromise (IOC) data. When the corresponding file is a malicious code infected file, the collection unit 210 may instruct or instruct the endpoint that transmitted the corresponding file to delete the corresponding file. When the corresponding file does not correspond to a malicious code-infected file, the collection unit 210 may request the cross-analysis unit 230 to analyze the file.

The cross-analysis unit 230 analyzes a file using each of a plurality of security solutions.

Each security solution can derive an analysis result on whether the file is infected with malicious code. At this time, each security solution can analyze the file through at least one of dynamic analysis, static analysis, and reputation analysis.

As an example, when the cross-analysis unit 230 is requested to analyze the file x1, each security solution may derive the analysis results for the file x1 as shown in Table 1 below.

Risk High Risk Medium Low risk Vendor A security solutions One 2 0 Vendor B security solutions 2 One 0 Vendor C security solutions One 3 0

That is, the analysis result of each security solution for the file x1 may include the number of malicious codes corresponding to high risk and the number of malicious codes corresponding to medium risk. Here, the analysis result of each security solution for the file x1 may include the type of malicious code corresponding to the high risk and the type of malicious code corresponding to the medium risk. As another example, the cross-analysis unit 230 is a file When analysis for x2 is requested, each security solution can derive the analysis results for file x2 as shown in Table 2 below.

Risk High Risk Medium Low risk Vendor A security solutions 0 3 0 Vendor B security solutions 0 2 0 Vendor C security solutions 0 0 0

In other words, the analysis results of the vendor A and vendor B security solutions for the file x2 may include the number of malicious codes corresponding to the high risk and the number of malicious codes corresponding to the medium medium, and the vendor C for the file x2. The analysis result of the security solution may include the number of malicious codes corresponding to high risk, the number of malicious codes corresponding to medium risk, and the number of malicious codes corresponding to low risk. As another example, when the cross-analysis unit 230 is requested to analyze the file x3, each security solution may derive the analysis results for the file x3 as shown in Table 3 below.

Risk High Risk Medium Low risk Vendor A security solutions 0 0 0 Vendor B security solutions 0 0 0 Vendor C security solutions 0 0 0

The cross analysis unit 230 transmits the analysis results of each of the plurality of security solutions to the collection unit 210. The analysis results of each security solution may include the number and type of malicious codes corresponding to a specific risk, as described through Tables 1 to 3 above. The collection unit 210 analyzes each of a plurality of security solutions Based on the results, it is determined whether the file is infected with malicious code. As an example, the collection unit 210 may receive the analysis results corresponding to Table 1 above from the cross analysis unit 230. In Table 1 above, since each security solution detects the malicious code corresponding to the high risk in the file x1, the collection unit 210 may determine that the file x1 is infected with the malicious code. As another example, the collection unit 210 may receive the analysis results corresponding to Table 2 above from the cross analysis unit 230. In Table 2 above, vendor A's security solution and vendor B's security solution detected malicious code corresponding to medium risk in file x2, but vendor C's security solution did not detect malicious code. In this case, the collection unit 210 may determine that the file x2 is infected with malicious code according to the majority vote. As another example, the collection unit 210 may receive the analysis results corresponding to Table 3 above from the cross analysis unit 230. In Table 3 above, each security solution did not detect malicious code. In this case, the collection unit 210 may determine that the file x3 is not infected with malicious code.

When the collection unit 210 determines that the file is not infected with the malicious code, the collection unit 210 or the processing unit 240 may store the file in the database 220. In other words, if the file corresponds to a normal file that is not infected with malicious code, the collection unit 210 may store the file in the database 220. The processing unit 240 may deliver the result that the corresponding file is not infected with the malicious code to the endpoint corresponding to the destination of the corresponding file.

When the collection unit 210 determines that the file is infected with the malicious code, the processing unit 240 transmits the hash value of the malicious code, the malicious code file name, and the host of the malicious code (for example, C & C) (Command & Control) server) to send IP address information. Also, the processing unit 240 may store the original malicious code in the database 220.

The endpoint may delete the file or suspend the execution of the file based on the hash value of the malicious code and / or the file name of the malicious code, and isolate the host from the network to block the spread to the surroundings.

One or more files are stored in the database 220. These files correspond to files determined by the collection unit 210 to be normal in the past. For example, in the database 220, one or more files that the collection unit 210 determined to be normal one year ago, one or more files that the collection unit 210 determined to be normal six months ago, and the collection unit 210 to one week One or more files have been saved that were previously determined to be normal. Files stored in the database 220 may be checked for infection by malicious code by a regression diagnosis engine, which will be described later.

According to an embodiment, the multiple cross analysis engine 110 may cross analyze whether one or more files are infected with malicious code through a plurality of security solutions. Due to this, it is possible to cope with advanced persistent threats (APTs) based on unknown malicious codes as well as known malicious codes, and security can be improved.

3 is a diagram for describing a regression diagnosis engine in a malicious code cross-analysis system according to an embodiment.

Referring to FIG. 3, the regression diagnosis engine 120 includes an analysis unit 310.

The analysis unit 310 acquires one or more scan results of whether at least one file stored in the database 220 is infected with malicious code. For example, the analysis unit 310 may examine at least one file stored in the database 220 through one or more vaccine programs. In addition, the analysis unit 310 may request a malicious website to scan a specific website for at least one file stored in the database 220 and receive a scan result from the specific website.

The analysis unit 310 determines whether at least one file stored in the database 220 is infected with malicious code based on the obtained one or more scan results. For example, the analysis unit 310 may determine that the file is infected with the malicious code when the scan result that the file is suspected to be infected with the high-risk malicious code among the scan results occupies more than half.

When it is determined that the specific file is infected with the malicious code, the analysis unit 310 may transmit the hash value of the malicious code, a file name, a deletion command, and network isolation to the endpoint that transmitted the corresponding file. The endpoint can delete the corresponding file through the hash value and file name of the malicious code, and can isolate the host from the network and block the spread to the surroundings.

According to an embodiment, the regression diagnosis engine 120 may re-determine whether a file not infected with the malicious code in the past has been infected with the malicious code at the present time. That is, although it was not known in the past but was not analyzed as currently known malicious code or in the past, it can be detected as malicious code through the regression diagnosis engine 120. Accordingly, the security of the endpoint can be improved, and damage caused by the APT can be reduced or the APT can be better responded.

4 is a flowchart illustrating a method of operating a malicious code cross-analysis system according to an embodiment.

4, the malicious code cross-analysis system 100 receives a file from the user terminal (410). In one example, when the user terminal receives an email with a file attached, the user terminal may transmit it to the malicious code cross-analysis system 100 before executing the file.

The malicious code cross-analysis system 100 analyzes a file using each of a plurality of security solutions (420).

The malicious code cross-analysis system 100 determines whether the file is infected with the malicious code based on the analysis result of each of the plurality of security solutions (430).

When it is determined that the file is infected with the malicious code, the malicious code cross-analysis system 100 transmits the hash value of the malicious code, the file name, a deletion command, and network isolation to the user terminal (440).

Since the items described through FIGS. 1 to 3 may be applied to the items described through FIG. 4, detailed descriptions are omitted.

The device described above may be implemented with hardware components, software components, and / or combinations of hardware components and software components. For example, the devices and components described in the embodiments include, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors (micro signal processors), microcomputers, field programmable gate arrays (FPGAs). , A programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose computers or special purpose computers. The processing device may run an operating system (OS) and one or more software applications running on the operating system. In addition, the processing device may access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of understanding, a processing device may be described as one being used, but a person having ordinary skill in the art, the processing device may include a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that may include. For example, the processing device may include a plurality of processors or a processor and a controller. In addition, other processing configurations, such as parallel processors, are possible.

The software may include a computer program, code, instruction, or a combination of one or more of these, and configure the processing device to operate as desired, or process independently or collectively You can command the device. Software and / or data may be interpreted by a processing device, or to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. , Or may be permanently or temporarily embodied in the transmitted signal wave. The software may be distributed on networked computer systems, and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiments or may be known and usable by those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs, DVDs, and magnetic media such as floptical disks. Includes hardware devices specifically configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language code that can be executed by a computer using an interpreter, etc., as well as machine language codes produced by a compiler. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described by a limited embodiment and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques are performed in a different order than the described method, and / or the components of the described system, structure, device, circuit, etc. are combined or combined in a different form from the described method, or other components Alternatively, even if replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (10)

A cross-analysis unit that analyzes a file using each of a plurality of security solutions;
Receiving the file from the user terminal, requesting the analysis of the file to the analysis unit, receiving the analysis results of each of the plurality of security solutions from the analysis unit, analysis results of each of the plurality of security solutions A collection unit that determines whether the file is infected with a malicious code based on the; And
When it is determined that the file is infected with the malicious code by the collection unit, a processing unit that transmits the hash value of the malicious code, a file name, a deletion command, and network isolation to the user terminal
Containing,
Malware cross-analysis system.
According to claim 1,
When the file is received from the user terminal, the collection unit checks whether the file corresponds to a malicious code-infected file, and analyzes the analysis of the file when it is determined that the file does not correspond to a malicious code-infected file. Asking for wealth,
Malware cross-analysis system.
According to claim 1,
If the collection unit determines that the file is not infected with the malicious code, the file is stored in the database.
Malware cross-analysis system.
According to claim 1,
Database that stores at least one file that has been determined by the collection unit as not being infected with malicious code in the past
Further comprising,
Malware cross-analysis system.
According to claim 4,
Obtain one or more scan results of whether at least one file stored in the database is infected with the malicious code, and-the obtained scan results are obtained through the latest analysis technique-based on the obtained scan results Regression diagnosis engine that determines whether at least one file stored in the database is infected with the malicious code
Containing more,
Malware cross-analysis system.
Receiving a file from a user terminal;
Analyzing the file using each of a plurality of security solutions;
Determining whether the file is infected with malicious code based on an analysis result of each of the plurality of security solutions; And
If it is determined that the file is infected with the malicious code, transmitting the hash value, file name, deletion command, and network isolation of the malicious code to the user terminal
Containing,
How the malware cross-analysis system works.
The method of claim 6,
Checking whether the file corresponds to a malicious code infected file when the file is received from the user terminal
Further comprising,
The step of analyzing the file,
Analyzing the file if it is determined that the file does not correspond to a malicious code-infected file
Containing,
How the malware cross-analysis system works.
The method of claim 6,
If it is determined that the file is not infected with the malicious code, storing the file in a database
Further comprising,
How the malware cross-analysis system works.
The method of claim 6,
Obtaining one or more scan results of whether at least one file stored in the database is infected with the malicious code, wherein the obtained scan results are obtained through the latest analysis technique; And
Determining whether at least one file stored in the database is infected with the malicious code based on the obtained scan result
Further comprising,
How the malware cross-analysis system works.
The method of claim 9,
At least one file stored in the database was determined to have been infected with the malicious code in the past,
How the malware cross-analysis system works.

Images